How to test what started a powershell script

Question

I have a PowerShell script that can be started either by

running a shortcut on the desktop, OR
as a scheduled job from the windows Task Scheduler.

Is there any way within the script itself of identifying how it was started? In practice each method produces a slowly scrolling command window on screen, and once it's running I have no way of knowing how it was initiated. The script already logs some data about itself (name, date, time and $PID) but so far I've not found how to test the launch method i.e. task scheduler or manual run.

I would simply add a switch parameter like `-scheduled`, that I would pass when launching from Task Scheduler. — zett42, Jan 25 '21 at 23:07
you can set a function within the script that tells you who runs it. In regards to who/how runs it, i would use event filtering. — Abraham Zinala, Jan 25 '21 at 23:34

score 2 · Accepted Answer · answered Jan 26 '21 at 01:58

A script that is run by Task Scheduler has a parent process whose name is svchost, so you can use the following code in your script to detect this:

'svchost' -eq (Get-Process -Id (Get-CimInstance Win32_Process -Filter "ProcessID = $pid").ParentProcessId).Name

How to test what started a powershell script

1 Answers1