Only the changes i made for this is the “message to the sender”…

$execute = “C:\Windows\System32\msg.exe”


$message = “We have patched a security updates on your devices. Please reboot your workstation to take effect.”

$time = (Get-Date).AddSeconds(30)


$triggerAt = New-ScheduledTaskTrigger -At $time -Once


$currentusr = (Get-WmiObject -class win32_process -ComputerName ‘localhost’ | Where-Object name -Match explorer).getowner().user


$argument = $currentusr + " " + “/W” + " " + $message


$command = $execute + " " + $argument + " " + “| Out-Null `n”

New-Item -Path “c:\ProgramData\Amagent” -Name “message.ps1” -ItemType “file” -Value $command


Add-Content -Path “c:\ProgramData\Amagent\message.ps1” -Value “Restart-Computer”

$action = New-ScheduledTaskAction -Execute Powershell.exe -Argument “-windowstyle hidden c:\ProgramData\Amagent\message.ps1”

Register-ScheduledTask -TaskName “StartMsg” -Trigger $triggerAt -Action $action -User $currentusr


Start-Sleep 31


Unregister-ScheduledTask -TaskName “StartMsg” -Confirm:$false


#Remove-Item -Path “c:\ProgramData\Amagent\message.ps1”

Let’s check and see what the $currentusr variable is returning when it’s run through the worklet. Add this line:

Write-Output $currentusr

right after the $currentusr gets populated with the Get-WmiObject command.

Run the worklet again and look in the Activity Log report to see if “Greenlots IT” is showing just once, or twice.

Still showing twice. I will try to delete the worklet and create a new worklet and just paste the original code. Will see what happen.

Sounds good. I’m still not sure why the command returns one copy of the user when run manually, and then two when it’s run through the worklet. It could be that running it as System is the issue. The other thing you can try is running just the

(Get-WmiObject -class win32_process -ComputerName 'localhost' | Where-Object name -Match explorer).getowner().user

manually as the System user instead of the currently logged in user.