Are you having the issue where console windows pop up and disappear?

Then this guide is for you.

Typically this happens either through an application installed on the system that has a command-line utility in one of the Startup categories... or a command-line utility that is being deployed to your system that is managed by your company or school's IT department.

If you do gpedit.msc and then set the process launch/exit auditing policies… you might be able to go check the event logs after you see those pop up and get an idea of what ran and started them.

Here’s how to do it:

1. Set Audit Process Creation and Audit Process Termination under this node of your local computer policy

2. Set this to Enabled under the Audit Process Creation area of Administrative Templates

3. Then look in eventvwr.msc in the System node after you see this stuff pop up to see what launched and exited and with what command line to see where it came from. Event 4688 is process creation. Event 4689 is process exit. You should see a chain like this one for a defterm startup: a. Command line tool starts

b. OS conhost starts to host it

c. Terminal package conhost replacement (openconsole.exe) starts to takeover work from inbox conhost.exe

d. Terminal starts

4. When we’ve figured it out, turn auditing off again.