Command Prompt keeps popping up randomly

A black box flashes on screen for a fraction of a second, then disappears. It happens once an hour. Once a day. Sometimes during a video call. Almost always a scheduled task — here is how to find which one and shut it up.

Step 1 — open Task Scheduler

Press Win + R, type taskschd.msc, press Enter.

This opens the Windows Task Scheduler — the centralised place where every Windows service, OS update, app updater and bundled utility schedules its background work.

Step 2 — find the recently-run task

Wait for the next CMD popup, then immediately:

In Task Scheduler, click the History tab in the bottom-middle pane (you may need to click "Enable All Tasks History" in the Actions pane on the right first).
Look for the most recent "Action started" entry. Note the task name.

Step 3 — the usual suspects

By far the most common causes I see in client repairs:

OfficeBackgroundTaskHandlerRegistration — Office Click-to-Run integrity check. Runs hourly. Brief CMD flash.
GoogleUpdateTaskMachineCore / GoogleUpdaterTaskUserCore — Chrome's auto-update check.
OneDrive Standalone Update Task — OneDrive client check.
Adobe Acrobat Update Task — Adobe Reader/Acrobat check.
NvProfileUpdaterDaily — Nvidia driver profile updater.
AdobeAAMUpdater — Adobe Application Manager updater.

Step 4 — stop the task showing the window

You have two options. Stopping the task entirely removes the popup but also disables whatever the task does. Reconfiguring the task to "run hidden" keeps the function but kills the popup.

Option A — disable the task (kills the function too)

In Task Scheduler, find the task in the Library tree.
Right-click → Disable.

Use this for tasks you do not need — e.g. if you do not use Adobe Reader, the Adobe updater can go.

Option B — make it run hidden (keeps the function)

Right-click the task → Properties.
On the General tab, tick Run whether user is logged on or not.
Click OK. Windows will ask for the account password.

This switches the task from "interactive" (visible to the desktop) to "service-style" (runs in the background, no window).

If you cannot find a task in History

Two possibilities:

The task is not running through Task Scheduler. Some apps schedule themselves through their own mechanism. Open Process Explorer (free, from Microsoft) and watch for short-lived cmd.exe processes — the parent process column will tell you who launched it.
It is malware. Run Windows Defender Offline (Settings → Privacy & Security → Windows Security → Virus & Threat Protection → Scan options → Microsoft Defender Offline scan). This boots a clean environment and scans without the malware running.

Why this happens at all

When Windows runs a scheduled task, it can either show the window (interactive) or hide it (service mode). Service mode requires the task to run under the SYSTEM account or with cached credentials. Many third-party installers default to interactive because it is simpler to set up — and the result is a brief CMD flash whenever the task fires.

Microsoft fixed many of its own first-party tasks in Windows 11 by switching to silent execution. Third-party apps catch up at their own pace.

Frequently asked

Why does Command Prompt keep popping up randomly on my computer? +

Almost always a scheduled task running in the background. Common culprits are the Office Click-to-Run task, OneDrive's automatic update check, GoogleUpdater, or Adobe's reporting tool. The CMD window flashes because the scheduled task is configured to run "with the highest privileges" and not "hidden" — a Microsoft default that exposes the console window briefly.

Could random Command Prompt popups be malware? +

Possibly, but rare. Real malware usually hides the window entirely. The brief CMD flash is almost always a legitimate scheduled task with a misconfigured "show window" setting. Run a Windows Defender Offline scan if you want to rule out malware, but check Task Scheduler first — that is where the fix usually lives.

How do I find out which task is causing the popup? +

Open Task Scheduler (Win+R, type taskschd.msc). Look at the History tab — set the time filter to the last hour. The most recent task triggered around the time you saw the popup is the culprit. The full path to the task tells you which application it belongs to.