Warning PowerShell ID 300

This is the text of the event:

• <Event xmlns="__http://schemas.microsoft.com/win/2004/08/events/event__"> <System>

  <Provider Name="PowerShell" />

  <EventID Qualifiers="0">300</EventID>

  <Version>0</Version>

  <Level>3</Level>

  <Task>3</Task>

  <Opcode>0</Opcode>

  <Keywords>0x80000000000000</Keywords>

  <TimeCreated SystemTime="2024-09-18T16:35:04.0326182Z" />

  <EventRecordID>1689</EventRecordID>

  <Correlation />

  <Execution ProcessID="8792" ThreadID="0" />

  <Channel>Windows PowerShell</Channel>

  <Computer>Windows-11</Computer>

  <Security />

  </System>

• <EventData>

  <Data>Dispositivo non pronto.</Data>

  <Data>ProviderName=Microsoft.PowerShell.Core\FileSystem ExceptionClass=IOException ErrorCategory= ErrorId= ErrorMessage=Dispositivo non pronto. Severity=Warning SequenceNumber=13 HostName=ConsoleHost HostVersion=5.1.22621.4111 HostId=df92d23d-43cc-41b4-938f-33a69b1f8380 HostApplication=powershell.exe -ExecutionPolicy Restricted -Command $Res = 0; $Session = New-Object -ComObject Microsoft.Update.Session; $Searcher = $Session.CreateUpdateSearcher(); $Count = $Searcher.GetTotalHistoryCount(); if ($Count -ge 1) { $Updates = $Searcher.QueryHistory(0, $Count); }; if(($Updates | Where-Object {$_.Title -match 'KB5030310'}) -ne $null) { $Res = 1; }; Write-Host 'Final result:', $Res; EngineVersion= RunspaceId= PipelineId= CommandName= CommandType= ScriptName= CommandPath= CommandLine=</Data>

  </EventData>

  </Event>

Thank you!

The error is "Device not ready" The exception class is IOException. The only explicit "IO" I can see in your code is the use of the "Write-Host".

So, is this being run as a scheduled task? Does the account under which the scheduled task runs have the necessary permission and rights?

The use of the COM object may also be a problem. It has to access your system disk to have access to the data. See the above question about the user account, permissions, and rights.

I'm pretty sure you need administrative rights to use Microsoft.Update.Session. If running from a scheduled task make sure the task is using the "highest rights" option. That account would also need the necessary COM Object Permissions.

It was able to access Microsoft.Update.Session with a non-admin account.

Run this and examine the transcript. If it is the write-host, then I would expect that you would get several errors.

Start-Transcript -Path 'C:\windows\temp\KB-Test.log'
$Res = 0                   
$look4 = 'KB5030310'
$UpdateSession = New-Object -ComObject 'Microsoft.Update.Session'
$UpdateSearcher = $UpdateSession.CreateUpdateSearcher()
$count = $UpdateSearcher.GetTotalHistoryCount()
Write-Host "We found $count total updates."
if ($Count -ge 1) {
    $Updates = $UpdateSearcher.QueryHistory(0,$count)
    Write-Host "QueryHistory returned $($updates.count) updates."
    $kb = $Updates | Where-Object {$_.Title -match $look4}
    if ($kb -eq $null) {
        Write-Host "We did not find $look4."
    } else {
        Write-Host "We found $look4."
        $Res = 1
    }
}
Write-Host 'Final result:',$res
Stop-Transcript
  

@MotoX80

PowerShell transcript start

Start time: 20240919175116

Username: WINDOWS-11\Piero

RunAs User: WINDOWS-11\Piero

Configuration Name:

Machine: WINDOWS-11 (Microsoft Windows NT 10.0.22631.0)

Host Application: C:\Program Files\WindowsApps\Microsoft.PowerShell_7.4.5.0_x64__8wekyb3d8bbwe\pwsh.dll

Process ID: 11232

PSVersion: 7.4.5

PSEdition: Core

GitCommitId: 7.4.5

OS: Microsoft Windows 10.0.22631

Platform: Win32NT

PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1, 6.0, 7.0

PSRemotingProtocolVersion: 2.3

SerializationVersion: 1.1.0.1

WSManStackVersion: 3.0

Transcript started, output file is C:\windows\temp\KB-Test.log

PS C:\Windows\System32> $Res = 0

PS C:\Windows\System32> $look4 = 'KB5030310'

PS C:\Windows\System32> $UpdateSession = New-Object -ComObject 'Microsoft.Update.Session'

PS C:\Windows\System32> $UpdateSearcher = $UpdateSession.CreateUpdateSearcher()

PS C:\Windows\System32> $count = $UpdateSearcher.GetTotalHistoryCount()

PS C:\Windows\System32> Write-Host "We found $count total updates."

We found 167 total updates.

PS C:\Windows\System32> if ($Count -ge 1) {

$Updates = $UpdateSearcher.QueryHistory(0,$count)

Write-Host "QueryHistory returned $($updates.count) updates."

$kb = $Updates | Where-Object {$_.Title -match $look4}

if ($kb -eq $null) {

    Write-Host "We did not find $look4."

} else {

    Write-Host "We found $look4."

    $Res = 1

}
```}

QueryHistory returned 167 updates.

We did not find KB5030310.

PS C:\Windows\System32> Write-Host 'Final result:',$res

Final result: 0

PS C:\Windows\System32> Stop-Transcript

**********************

PowerShell transcript end

End time: 20240919175212

**********************

You're running different versions.

Your image and the text of the error says "HostVersion=5.1.22621.4111".

But your last post has

Host Application: C:\Program Files\WindowsApps\Microsoft.PowerShell_7.4.5.0_x64__8wekyb3d8bbwe\pwsh.dll
Process ID: 11232
PSVersion: 7.4.5

Back to Rich's question; how are you running this script? A scheduled task? Intune? SCCM? Interactively?

Did PS 7.4.5 generate the eventlog record?

Why did you switch from 5.1 to 7.4.5?

Sorry, the event is automatically generated after system startup and I wanted to understand what was causing it!

thanks

What is launching the script?

Why did you change PS versions?

Does PS 7.4.5 also generate the same event that PS 5.1 did?

Are you the network/desktop/server admin who is responsible for managing your environment or are you more of an end user who just happened to see this event and wondered what it was?

Okay, so it's like to be a scheduled task or, more frightening, there's something in the registry that causes a script to run when a local user logs on here: “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run” or here: “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce”

To check your scheduled tasks, try running this PowerShell script (modify the $outcsv value to use a path of your choice

$taskPath = "\"                     # for example
$outcsv = "c:\junk\taskdef.csv"
Get-ScheduledTask |                 # Without a -taskpath value, it looks in ALL folders
    ForEach-Object { 
        if ($_.Actions.Arguments -like "*Microsoft.Update.*") {
            [pscustomobject]@{
                Name       = $_.TaskName
                Path       = $_.TaskPath
                LastResult = $(($_ | Get-ScheduledTaskInfo).LastTaskResult)
                NextRun    = $(($_ | Get-ScheduledTaskInfo).NextRunTime)
                Status     = $_.State
                Command    = $_.Actions.execute
                Arguments  = $_.Actions.Arguments 
            }
        }
    } |
        Export-Csv -Path $outcsv -NoTypeInformation

Autoruns from sysinternals.com would show all startup entries. But if he's not the admin who developed/administers that script then he really should be talking to his desktop support team.

@MotoX80 They may not know who wrote it either! Stuff like that creeps into the system over time, people forget, or don't want to fess up to the ownership, or any number of other reasons for disavowing any knowledge of the "who" or the "why".

Knowing that it does run was the first step. Discovering how it runs is the second step. Right now, he doesn't even know that! Punishing the innocent will be the last step. :-O