Windows PowerShell · Event 40961
PowerShell Event 40961: The PowerShell console is starting
A PowerShell host began initialising. It is the operational log's equivalent of the classic Event 400, and it is the first event of every session — which makes it the anchor point for reconstructing what a session did, and the marker for sessions that never finished starting.
Also written as PowerShell 40961PowerShell console is starting upEvent ID 40961
- How oftenFires constantly
- Vendor calls itInformation
- LogMicrosoft-Windows-PowerShell/Operational
- SourceMicrosoft-Windows-PowerShell
The fields that decide it
Everything else in the log line is context.
- User
- The account the host is starting under, as domain and username. On a machine where PowerShell should only run as a service account, an interactive user here is worth noticing.
- HostApplication / HostName
- Which host is starting. ConsoleHost is powershell.exe; ServerRemoteHost means the session arrived over remoting.
- Engine or Provider version
- The engine about to be used. As with Event 400, an old version here is the thing to look at first.
- Sequence relative to 40962
- Not a field, but the pairing matters: 40961 says starting, 40962 says ready for input. A 40961 with no 40962 means the host was terminated or blocked before it could be used.
Common questions
What is the difference between Event 40961 and Event 40962?
40961 is logged when the PowerShell host begins starting up, and 40962 when it is ready to accept input. In a normal session they appear within milliseconds of each other. A 40961 without a matching 40962 means the host never became usable — the process was killed, or something blocked initialisation.
Why do I have thousands of Event 40961s?
Because every PowerShell invocation produces one, and a great deal of Windows runs on PowerShell — maintenance tasks, software updaters, management agents. This is one of the highest-volume events in the operational log and its per-event value is close to zero. It earns its place as a session marker, not as an alert.
Is Event 40961 useful for investigations?
As a boundary, yes. It marks the beginning of a runspace, so it gives you a start time and a user for a session whose contents you then read from Events 4103 and 4104. It is also the cheapest way to count how often PowerShell runs on a host at all, which is how you find the machines where PowerShell should never be running.
Does Event 40961 mean someone opened a PowerShell window?
Not necessarily. Any process that hosts the PowerShell engine produces it, including services and applications that embed PowerShell without ever showing a console. Read the host name and the user to tell an interactive console from a background invocation.
Read next
- The equivalent of PowerShell Event 400: A PowerShell session started The classic Windows PowerShell log's engine start event, recording the same moment in the older channel.
- Usually comes after PowerShell Event 4104: Script block logging The script blocks the session went on to run.
- Usually comes after PowerShell Event 4103: Module logging recorded a command The pipelines the session executed.
- Usually comes after PowerShell Event 4100: A PowerShell command failed Any errors the session produced, including ones caused by controls blocking it.
Mentioned by
Vendor documentation
Last reviewed 6 September 2026