topic Re: GlobalProtect causing intermittent vanishing CMD Windows on Win10 in GlobalProtect Discussions

GlobalProtect causing intermittent vanishing CMD Windows on Win10

toysnoize — Sat, 23 Jan 2021 18:27:56 GMT

I've looked for the source of this for months and I believe I've narrowed it down to GlobalProtect. Upon rebooting, only once a connection to PanGP has been established, will a CMD window appear on my main screen, vanishing almost immediately afterwards. It happens about once a day, usually when I am not connected to the VPN.
Of course, given the short duration of the message's appearance and the random nature, I have not managed to capture it on a screen recorder. I attempted to use Process Monitor to catch any CMD or PS window and its launch arguments but had no luck.

Has anyone else noticed this and is there anything I can do to stop it?

Re: GlobalProtect causing intermittent vanishing CMD Windows on Win10

TheRealAndrewBrown — Mon, 25 Jan 2021 15:41:43 GMT

Can't say I've seen that before. However in attempting to capture the message, what about using an iPhone or android that has slow-mo video option and then play it back frame by frame?

Re: GlobalProtect causing intermittent vanishing CMD Windows on Win10

toysnoize — Mon, 25 Jan 2021 17:00:59 GMT

That would require me to sit with my phone against the screen for up to 24 hours waiting for the message to appear. Using a screen recorder presents this issue; otherwise I'd just use OBS.

The fact that you are unfamiliar with the problem is what I needed to hear most of all. Since posting this message I have been informed of the SysInternals tool "Sysmon", which was more or less designed for this use case. It puts entries into the Event Log upon the creation and dismissal of any program in memory alongside its command-line parameters.
This'll tell me what it is for sure; I just need to notice it when it happens and keep a note of the time so I can find the log entry.

I'll be sure to keep the board appraised if it does indeed turn out to be PanGPS causing it. If not, I'll say that and an admin can lock the thread.