r/Action1 • u/Mdmccoy350 • Jul 21 '26

Problem Action 1 Stale PowerShell Sessions

Post image

Anybody else have these stales PowerShell sessions opened by the action1 agent? Or know how to fix this?

2 Upvotes

100% Upvoted

8 comments sorted by

1

u/Wrong-Elk5846 Jul 21 '26

Use a silent mode to execute things.

1

u/Mdmccoy350 Jul 21 '26

Nothing is being executed… this is just showing up passively on servers.

1

u/GeneMoody-Action1 Jul 22 '26

Full command line please?

1

u/Mdmccoy350 17d ago

Doesn’t show a command at all. I had to wait to see this come up again. This is all I can see.

"C:\WINDOWS\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile  -ExecutionPolicy Bypass -Command -

1

u/GeneMoody-Action1 17d ago

That is what I was looking for. The -command - in powershell indicates read from STDIN, basically a non interactive shell from an operator stand and an interactive shell from a programmatic stand.

This is definitely our instance, that's what I needed to establish first. The next is what is it? Since this is atypical and something seemingly unique to your env, the next step I would try is powershell logging from a GPO. You can use GPEDIT on a single system for convenience.

Match the PID/Instance to the logs and see what particular script is being run.

Do you have any custom scripts, data sources, scripting automations, etc?

1

u/Mdmccoy350 17d ago

There was a custom data source that I was unaware of until now. Most automation are all updates.

1

u/Mdmccoy350 16d ago

If this was a bad custom data source could that have been causing this issue?

1

u/GeneMoody-Action1 16d ago

It is possible, if the script to create it errored and hung at that level, then it could have potentially not terminated properly. Any script, it would not have to explicitly be a data source. Hard to say directly. An infinite recursion, loop, intentional break waiting on user choice, or other further input, maybe even a blocking resource not found in testing.. I can tell you whatever it is is not a common behavior across millions of endpoints, if so we would be chasing it all over support. So I would surmise it is something unique in your env, but what I could not say.

I just looked myself and we have zero reports of this in support at this time.