NCPA 3.x Powershell Output

[logisbk]

We have NCPA versions 2.4 on the vast majority of our servers, and run 2 custom Powershell plugins/scripts without issue.

I have started testing out NCPA 3.2 and have ran into an issue where the output contains "Transcript started, output file is .\C:\Windows\system32\config\systemprofile\Documents\WindowsPowerShell\History\PS-Transcript 11-12-2025.txt" followed by the actual output defined in the script.

Neither of the scripts use "Start-Transcript" at all. I've also checked the location on multiple servers and there is no text file.

I've observed this on Windows Server 2019 and 2022, though I do have 2 Windows Server 2022 that only show the output defined in the script as intended. I can share the script if someone wants to take a look.

[cdietsch]

Hi @logisbk,

It sounds like you might have stumbled upon a bug. Would you mind sharing your script so I can do some testing to try to recreate the issue?

[logisbk]

@cdietsch sent you a PM.

[cdietsch]

Hi @logisbk,

I've done some initial testing with your powershell script on a few Windows servers and so far I have not been able to replicate the output you were seeing. I tested on Windows server 2025, 2022, 2019, and 2016 and tested your script from the command line, the NCPA webUI, and from Nagios XI checks and it seems to output normally.

Apparently it's possible that Powershell Transcription can be enabled through a Group Policy setting. Can you check to see if this is set on the servers (and/or Active Directory) you were seeing the message on?

Group Policy Editor: Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > "Turn on PowerShell Transcription"

[logisbk]

Thanks Cole, I had checked to see if GPO or anything else was enabling transcription but nothing was as far as I could tell. There was also servers in the same OU, getting the same GPOs, some having issues and others not.

Due to the output path, and the NCPA service being run under LocalSystem, I started looking into the system Powershell profile. I ran this is an Administrative PowerShell:

Code: Select all

$Profile.AllUsersAllHosts

Which pointed me to C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1, where I did find the Start-Transcript directive.

In the ncpa.cfg I added -NoProfile to the .ps1 extension, which fixed the issue for the output.

Code: Select all

.ps1 = powershell -NoProfile -ExecutionPolicy Bypass -File $plugin_name $plugin_args

I'm not sure why this changed when upgraded to v3.2 - I've verified a server running v2.4 that also has the same PowerShell system profile, yet the output does not contain "Transcript started.."

profile.ps1 below:

Code: Select all

#All user profile: C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1
function prompt
{ 
    $currentDirectory = get-location
    write-host "[$env:computername]: " -f green -NoNewline
    write-host "$currentDirectory " -f yellow  -nonewline 
}

$Filepath = "$env:USERPROFILE\Documents\WindowsPowerShell\History"
if (!(test-path $Filepath )) {New-item $Filepath -ItemType Directory }
$date = get-date -Format 'dd-MM-yyyy'
Start-Transcript -Path ".\$Filepath\PS-Transcript $date.txt" -Append

Clear

So I've found a fix, though it would be nice to see why this changed from 2.4 - 3.2 (I know there's been a ton of changes between them).

[cdietsch]

Thanks for looking into this issue into more detail. Glad to hear you figured out a nice fix for this odd behavior. You are correct that quite a bit has changed between NCPA 2.x and NCPA 3.x. A lot has changed with how NCPA runs as a windows service and spawns child processes, so my guess is that is probably related to this.