So I was looking at informational logs across our servers recently and noticed we’re logging a bunch of PowerShell events every 15 minutes.
Usually get a bunch of id 600 like:
Provider "Alias" is Started.
SequenceNumber=7261 HostName=OpsMgr PowerShell Host HostVersion=7.0.5000.0 HostId=d6025fb5-6f89-47c4-8ed9-4dfda6c181c5 EngineVersion= RunspaceId= PipelineId= CommandName= CommandType= ScriptName= CommandPath= CommandLine=
For several providers, FileSystem, Environment, Alias, Registry, Variable, Certificate, WSMan.
Followed by Event 400 and 403.
Engine state is changed from None to Available.
Engine state is changed from Available to Stopped.
All within the span of a second or so. These repeat every 15 minutes exactly across hundreds of servers. All refer to OpsMgr PowerShell Host. We’re not having any issues, and they’re all informational, but I’m not really sure what’s going on.