Find where powershell onload settings are

Question

On a corporate machine, whenever one attempts to open Powershell, Powershell sends many requests to domain controllers. This would be find if the machine was on the network, but when it's not, then it just takes forever to time out and this happens before every command is executed (i.e. the timeouts keep happening after type and hitting enter every command).

I looked in the following places for where these calls are being made from:

%windir%\system32\WindowsPowerShell\v1.0\profile.ps1
%windir%\system32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1
%UserProfile%\My Documents\WindowsPowerShell\profile.ps1
%UserProfile%\My Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1

but none of these files exist.

Where else would the setting/scripts be that would be causes these calls to be made?

If it matters, the way I have debugged this so far was suspecting network timeouts, and then using wireshark to see the requests time out. There might be more going on that just attempts to contact the domain controller though.

@JimB `$profile` does not exist (it is set to the last path in the list) — soandos, Feb 16 '16 at 14:54
So does it return true or false? You can't say it doesn't exist and then tell me the path to it. — Jim B, Feb 16 '16 at 15:22
@JimB sorry, it returns false. The value of `$profile` is set to the last path listed. — soandos, Feb 16 '16 at 15:24
The only things left that I can think of should be a restricted powershell session or some sort of additional "security" software. — Jim B, Feb 16 '16 at 15:27
@JimB is this something that AV would do specifically for powershell? — soandos, Feb 16 '16 at 15:28
Do you have any mapped drives and/or shares? If so, could you try unmapping them and seeing if Powershell continues to exhibit this behavior? — Ryan Ries, Feb 16 '16 at 15:55

score 3 · Accepted Answer · answered Feb 16 '16 at 16:47

3

Unmap any mapped drives/network shares, then see if Powershell continues to exhibit this behavior.

answered Feb 16 '16 at 16:47

Ryan Ries

55,481
10
142
199

Find where powershell onload settings are

1 Answers1