Learn What IT Pros Need to Know About Windows 11 - August 24th at 1 PM ET! Learn What IT Pros Need to Know About Windows 11 - August 24th at 1 PM ET!
PowerShell

How to Enable PowerShell Logging

What are some ways I can enable PowerShell logging?

PowerShell is a sophisticated management tool that can revolutionize the way you manage Windows Server. But with the power and capabilities that PowerShell has to offer also come risks. PowerShell logging is turned off by default, but there are two easy ways to enable logging so that you can get some insight into what commands are being executed and collect information for security forensics.

Enable logging from the command line

PowerShell logging is enabled per module. In this example I’ll show you how to enable logging for Active Directory cmdlets.

  • Log on to Windows Server 2012 with local administrative privileges.
  • Open a PowerShell window using the icon on the desktop Taskbar.
  • Type Import-Module ActiveDirectory and press Enter.
  • Type (Get-Module ActiveDirectory).LogPipelineExecutionDetails = $true and press Enter. To disable logging for the Active Directory module, you would simply exchange $true for $false.

Now run an Active Directory cmdlet such as get-aduser –filter * -property *, and press Enter.

Once the cmdlet has returned a complete set of results, open Event Viewer from the Tools menu in Server Manager and expand Applications and Services Log, Microsoft, Windows, and PowerShell, then select the Operational log. You should see an event similar to that shown below, giving details of the command run, any specified parameters, and the user who executed the command.

Sponsored Content

Read the Best Personal and Business Tech without Ads

Staying updated on what is happening in the technology sector is important to your career and your personal life but ads can make reading news, distracting. With Thurrott Premium, you can enjoy the best coverage in tech without the annoying ads.

PowerShell Event Log entry

Enable logging in Group Policy

If you want to enable logging on more than one server, it may be more convenient to use Group Policy to push out the necessary settings. In the Group Policy Management Editor, you can find the configuration settings for PowerShell under Computer Configuration, Policies, Administrative Templates, Windows Components, and Windows Powershell.

The Group Policy Object (GPO) setting you need is called Turn on Module Logging. You can see in the figure below that I’ve enabled logging for the core modules as suggested (Microsoft.PowerShell.* and Microsoft.WSMan.Management), and specifically for the Active Directory module. Enabling logging for the core modules gives more detail in the event log when running the get-aduser cmdlet, such as to which AD objects the command binds. Once you’ve configured the policy setting and made sure the GPO is linked to an OU, you should reboot the affected server(s).

Configuring PowerShell logging in Group Policy

Related Topics:

BECOME A PETRI MEMBER:

Don't have a login but want to join the conversation? Sign up for a Petri Account

Register
Comments (0)

Leave a Reply

IT consultant, Contributing Editor @PetriFeed, and trainer @Pluralsight. All about Microsoft, Office 365, Azure, and Windows Server.

Register for Advanced Microsoft 365 Day!

GET-IT: Advanced Microsoft 365 1-Day Virtual Conference - Live August 24th!

Join us on Tuesday, August 24th and hear from Microsoft MVPs and industry experts about how to take advantage of Microsoft 365 at a technical level and dive deep into the features and functionality that will make your environment more secure and compliant.

RSVP Now

Sponsored By