Turn on PowerShell Script Block Logging
Setting the `EnableScriptBlockLogging` DWORD value to `1` enables machine-wide script block logging for PowerShell 7.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging\EnableScriptBlockLogging
Setting the EnableScriptBlockLogging DWORD value to 1 enables machine-wide script block logging for PowerShell 7. PowerShell records the content of processed commands, script blocks, functions, and scripts, whether they are submitted interactively or invoked through automation.
On Windows, these records are written as event ID 4104 to the PowerShellCore/Operational event log. The resulting events provide a record of the PowerShell code processed in a session.
Notes
Security
Script block logging increases visibility into PowerShell activity and supports the detection and investigation of executed script content, including dynamically generated commands.
The recorded content can also contain sensitive information. For example, credentials, keys, or other secrets embedded directly in a script or command can be written to the event log. Users or processes with access to that log could retrieve the information. The separate Protected Event Logging feature can encrypt event data written by participating components; this registry value does not enable that protection by itself.
Notes
The PowerShellCore path applies to PowerShell 7. It is distinct from the Windows PowerShell 5.1 policy path under Microsoft\Windows\PowerShell.
The setting takes effect for newly started PowerShell sessions. On Windows, the PowerShell event provider must also be registered before PowerShell can write events to the Windows event log.
This value does not enable the additional start and stop events for individual script block invocations. Those events are controlled by the separate EnableScriptBlockInvocationLogging setting.
Microsoft documentation
Microsoft Learn: about_Logging_Windows
Microsoft Learn: About PowerShell Group Policy settings