close

Windows

Cloud

Microsoft 365

PowerShell

Active Directory

Security

Windows Server

Video

Microsoft Teams Day is back!

Home

PowerShell

How to Enable PowerShell Logging

Russell Smith

|

What are some ways I can enable PowerShell logging?

PowerShell is a sophisticated management tool that can revolutionize the way you manage Windows Server. But with the power and capabilities that PowerShell has to offer also come risks. PowerShell logging is turned off by default, but there are two easy ways to enable logging so that you can get some insight into what commands are being executed and collect information for security forensics.

Enable logging from the command line

PowerShell logging is enabled per module. In this example I’ll show you how to enable logging for Active Directory cmdlets.

  • Log on to Windows Server 2012 with local administrative privileges.
  • Open a PowerShell window using the icon on the desktop Taskbar.
  • Type Import-Module ActiveDirectory and press Enter.
  • Type (Get-Module ActiveDirectory).LogPipelineExecutionDetails = $true and press Enter. To disable logging for the Active Directory module, you would simply exchange $true for $false.

Now run an Active Directory cmdlet such as get-aduser –filter * -property *, and press Enter.

Once the cmdlet has returned a complete set of results, open Event Viewer from the Tools menu in Server Manager and expand Applications and Services Log, Microsoft, Windows, and PowerShell, then select the Operational log. You should see an event similar to that shown below, giving details of the command run, any specified parameters, and the user who executed the command.

PowerShell Event Log entry

Enable logging in Group Policy

If you want to enable logging on more than one server, it may be more convenient to use Group Policy to push out the necessary settings. In the Group Policy Management Editor, you can find the configuration settings for PowerShell under Computer Configuration, Policies, Administrative Templates, Windows Components, and Windows Powershell.

The Group Policy Object (GPO) setting you need is called Turn on Module Logging. You can see in the figure below that I’ve enabled logging for the core modules as suggested (Microsoft.PowerShell.* and Microsoft.WSMan.Management), and specifically for the Active Directory module. Enabling logging for the core modules gives more detail in the event log when running the get-aduser cmdlet, such as to which AD objects the command binds. Once you’ve configured the policy setting and made sure the GPO is linked to an OU, you should reboot the affected server(s).

Configuring PowerShell logging in Group Policy

More in PowerShell

PowerShell

How To Set Environment Variables With PowerShell

Dec 5, 2022 | Sukesh Mudrakola

PowerShell

How to Use a PowerShell Foreach Loop

Oct 24, 2022 | Ivan Mirchev

PowerShell

How to Use a PowerShell Array

Oct 19, 2022 | Michael Reinders

PowerShell

Filtering with PowerShell Where-Object: Easy Examples

Oct 10, 2022 | Michael Reinders

PowerShell

What is PowerShell and How to Get Started With It?

Sep 7, 2022 | Mike Kanakos

PowerShell

Use a PowerShell Substring to Search Inside a String

Aug 11, 2022 | Jeff Hicks

Most popular on petri

Article saved!

Access saved content from your profile page. View Saved