[{"data":1,"prerenderedAt":289},["ShallowReactive",2],{"doku:en:richtlinien-anhang\u002Fhilfe-4c0cb4019740-enablescriptblocklogging":3},{"seite":4,"start":34,"leiste":35,"bereich":288,"zurueck":288,"weiter":288},{"sprache":5,"rel":6,"zu":7,"id":8,"titel":9,"titelHtml":9,"beschreibung":10,"kennzeile":11,"imMenue":12,"html":13,"ueberschriften":14},"en","richtlinien-anhang\u002Fhilfe-4c0cb4019740-enablescriptblocklogging","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-4c0cb4019740-enablescriptblocklogging","referenz-hilfe-4c0cb4019740-enablescriptblocklogging","Turn on PowerShell Script Block Logging","Setting the `EnableScriptBlockLogging` DWORD value to `1` enables machine-wide script block logging for PowerShell 7.","since 0.9.8.11",false,"\u003Ch2 id=\"purpose\">Purpose\u003C\u002Fh2>\n\u003Cdetails class=\"doku-klappbox\">\u003Csummary>Show registry keys (1)\u003C\u002Fsummary>\u003Cdiv class=\"doku-klappbox-inhalt\">\n\u003Cul>\n\u003Cli>\u003Ccode>HKLM\\Software\\Policies\\Microsoft\\PowerShellCore\\ScriptBlockLogging\\EnableScriptBlockLogging\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fdiv>\u003C\u002Fdetails>\n\u003Cp>Setting the \u003Ccode>EnableScriptBlockLogging\u003C\u002Fcode> DWORD value to \u003Ccode>1\u003C\u002Fcode> enables machine-wide script block logging for PowerShell 7. PowerShell records the content of processed commands, script blocks, functions, and scripts, whether they are submitted interactively or invoked through automation.\u003C\u002Fp>\n\u003Cp>On Windows, these records are written as event ID \u003Ccode>4104\u003C\u002Fcode> to the \u003Ccode>PowerShellCore\u002FOperational\u003C\u002Fcode> event log. The resulting events provide a record of the PowerShell code processed in a session.\u003C\u002Fp>\n\u003Ch2 id=\"notes\">Notes\u003C\u002Fh2>\n\u003Ch3 id=\"security\">Security\u003C\u002Fh3>\n\u003Cp>Script block logging increases visibility into PowerShell activity and supports the detection and investigation of executed script content, including dynamically generated commands.\u003C\u002Fp>\n\u003Cp>The recorded content can also contain sensitive information. For example, credentials, keys, or other secrets embedded directly in a script or command can be written to the event log. Users or processes with access to that log could retrieve the information. The separate Protected Event Logging feature can encrypt event data written by participating components; this registry value does not enable that protection by itself.\u003C\u002Fp>\n\u003Ch3 id=\"notes-1\">Notes\u003C\u002Fh3>\n\u003Cp>The \u003Ccode>PowerShellCore\u003C\u002Fcode> path applies to PowerShell 7. It is distinct from the Windows PowerShell 5.1 policy path under \u003Ccode>Microsoft\\Windows\\PowerShell\u003C\u002Fcode>.\u003C\u002Fp>\n\u003Cp>The setting takes effect for newly started PowerShell sessions. On Windows, the PowerShell event provider must also be registered before PowerShell can write events to the Windows event log.\u003C\u002Fp>\n\u003Cp>This value does not enable the additional start and stop events for individual script block invocations. Those events are controlled by the separate \u003Ccode>EnableScriptBlockInvocationLogging\u003C\u002Fcode> setting.\u003C\u002Fp>\n\u003Ch3 id=\"microsoft-documentation\">Microsoft documentation\u003C\u002Fh3>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fpowershell\u002Fmodule\u002Fmicrosoft.powershell.core\u002Fabout\u002Fabout_logging_windows?view=powershell-7.6\">Microsoft Learn: about_Logging_Windows\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fpowershell\u002Fmodule\u002Fmicrosoft.powershell.core\u002Fabout\u002Fabout_group_policy_settings?view=powershell-7.6\">Microsoft Learn: About PowerShell Group Policy settings\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch2 id=\"see-also\">See also\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-protokollierung-ueberwachung#e-4c0cb40197\">Entry in the reference\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n",[15,19,22,26,28,31],{"ebene":16,"id":17,"text":18},2,"purpose","Purpose",{"ebene":16,"id":20,"text":21},"notes","Notes",{"ebene":23,"id":24,"text":25},3,"security","Security",{"ebene":23,"id":27,"text":21},"notes-1",{"ebene":23,"id":29,"text":30},"microsoft-documentation","Microsoft documentation",{"ebene":16,"id":32,"text":33},"see-also","See also","\u002Fen\u002Fdocumentation",[36,56,68,76,124,144,160,176,200,216,232],{"titel":37,"pfad":38,"seiten":39},"Getting started","erste-schritte",[40,44,48,52],{"rel":41,"titel":42,"zu":43},"erste-schritte\u002Fwas-ist-setup-foundry","Setup Foundry","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fwas-ist-setup-foundry",{"rel":45,"titel":46,"zu":47},"erste-schritte\u002Finstallation","Installing Setup Foundry","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Finstallation",{"rel":49,"titel":50,"zu":51},"erste-schritte\u002Fschnellstart","Quick start","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fschnellstart",{"rel":53,"titel":54,"zu":55},"erste-schritte\u002Fablauf","How it works","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fablauf",{"titel":57,"pfad":58,"seiten":59},"Setup","wizard",[60,64],{"rel":61,"titel":62,"zu":63},"wizard\u002Fuebersicht","The setup wizard","\u002Fen\u002Fdocumentation\u002Fwizard\u002Fuebersicht",{"rel":65,"titel":66,"zu":67},"wizard\u002Fsystemanforderungen","System requirements","\u002Fen\u002Fdocumentation\u002Fwizard\u002Fsystemanforderungen",{"titel":69,"pfad":70,"seiten":71},"Setup in detail","einrichtung-detail",[72],{"rel":73,"titel":74,"zu":75},"einrichtung-detail\u002Fwindows-quelle","Import an ISO","\u002Fen\u002Fdocumentation\u002Feinrichtung-detail\u002Fwindows-quelle",{"titel":77,"pfad":78,"seiten":79},"Foundry","konfiguration",[80,84,88,92,96,100,104,108,112,116,120],{"rel":81,"titel":82,"zu":83},"konfiguration\u002Fprofile","Profiles","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fprofile",{"rel":85,"titel":86,"zu":87},"konfiguration\u002Fquellen","Sources","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fquellen",{"rel":89,"titel":90,"zu":91},"konfiguration\u002Fbenutzer","Configuring users","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fbenutzer",{"rel":93,"titel":94,"zu":95},"konfiguration\u002Fbilder","Background picture and logo","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fbilder",{"rel":97,"titel":98,"zu":99},"konfiguration\u002Fwindows-bereinigen","Cleaning up Windows","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fwindows-bereinigen",{"rel":101,"titel":102,"zu":103},"konfiguration\u002Fapps-entfernen","Removing apps","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fapps-entfernen",{"rel":105,"titel":106,"zu":107},"konfiguration\u002Fauswaehlen","Selecting applications","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fauswaehlen",{"rel":109,"titel":110,"zu":111},"konfiguration\u002Frichtlinien","Policies","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien",{"rel":113,"titel":114,"zu":115},"konfiguration\u002Fpc-informationen","PC information","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fpc-informationen",{"rel":117,"titel":118,"zu":119},"konfiguration\u002Fnamensschema","Naming scheme","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fnamensschema",{"rel":121,"titel":122,"zu":123},"konfiguration\u002Finstall-assist-gestalten","Design the Install Assist","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Finstall-assist-gestalten",{"titel":125,"pfad":126,"seiten":127},"Installation","installationsmedien",[128,132,136,140],{"rel":129,"titel":130,"zu":131},"installationsmedien\u002Fusb-stick","Create a USB drive","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fusb-stick",{"rel":133,"titel":134,"zu":135},"installationsmedien\u002Fiso-erstellen","Creating an ISO","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fiso-erstellen",{"rel":137,"titel":138,"zu":139},"installationsmedien\u002Fvhd-erstellen","Create VHD","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fvhd-erstellen",{"rel":141,"titel":142,"zu":143},"installationsmedien\u002Finstall-assist","Install Assist on the target computer","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Finstall-assist",{"titel":145,"pfad":146,"seiten":147},"Machines","pruefmaschine",[148,152,156],{"rel":149,"titel":150,"zu":151},"pruefmaschine\u002Fhyper-v-berechtigungen","Hyper-V permissions","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Fhyper-v-berechtigungen",{"rel":153,"titel":154,"zu":155},"pruefmaschine\u002Fverwenden","Use the test machine","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Fverwenden",{"rel":157,"titel":158,"zu":159},"pruefmaschine\u002Ferstellen","Create a machine","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Ferstellen",{"titel":161,"pfad":162,"seiten":163},"Editions","editionen",[164,168,172],{"rel":165,"titel":166,"zu":167},"editionen\u002Fvergleich","Editions at a glance","\u002Fen\u002Fdocumentation\u002Feditionen\u002Fvergleich",{"rel":169,"titel":170,"zu":171},"editionen\u002Flizenz-aktivieren","Activate a license","\u002Fen\u002Fdocumentation\u002Feditionen\u002Flizenz-aktivieren",{"rel":173,"titel":174,"zu":175},"editionen\u002Faktivierungen-zuruecksetzen","Reset activations","\u002Fen\u002Fdocumentation\u002Feditionen\u002Faktivierungen-zuruecksetzen",{"titel":177,"pfad":178,"seiten":179},"Troubleshooting","fehler",[180,184,188,192,196],{"rel":181,"titel":182,"zu":183},"fehler\u002Fusb","USB drive problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fusb",{"rel":185,"titel":186,"zu":187},"fehler\u002Fiso","ISO import problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fiso",{"rel":189,"titel":190,"zu":191},"fehler\u002Fhyperv","Hyper-V problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fhyperv",{"rel":193,"titel":194,"zu":195},"fehler\u002Finstall-assist","When Setup fails on the target computer","\u002Fen\u002Fdocumentation\u002Ffehler\u002Finstall-assist",{"rel":197,"titel":198,"zu":199},"fehler\u002Fantwortdatei","The answer file","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fantwortdatei",{"titel":201,"pfad":202,"seiten":203},"Reference","referenz",[204,208,212],{"rel":205,"titel":206,"zu":207},"referenz\u002Fbekannte-probleme","Known issues","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fbekannte-probleme",{"rel":209,"titel":210,"zu":211},"referenz\u002Fdiagnose-und-protokolle","Diagnostics and logs","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fdiagnose-und-protokolle",{"rel":213,"titel":214,"zu":215},"referenz\u002Fglossar","Glossary","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fglossar",{"titel":217,"pfad":218,"seiten":219},"Windows appendix","windows-anhang",[220,224,228],{"rel":221,"titel":222,"zu":223},"windows-anhang\u002Fdienste","Services","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Fdienste",{"rel":225,"titel":226,"zu":227},"windows-anhang\u002Faufgaben","Scheduled tasks","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Faufgaben",{"rel":229,"titel":230,"zu":231},"windows-anhang\u002Fapps","App packages","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Fapps",{"titel":233,"pfad":234,"seiten":235},"Policy appendix","richtlinien-anhang",[236,240,244,248,252,256,260,264,268,272,276,280,284],{"rel":237,"titel":238,"zu":239},"richtlinien-anhang\u002Frichtlinien","Policy reference","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien",{"rel":241,"titel":242,"zu":243},"richtlinien-anhang\u002Frichtlinien-office-haertung","Office hardening","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-office-haertung",{"rel":245,"titel":246,"zu":247},"richtlinien-anhang\u002Frichtlinien-edge-internet-explorer","Edge and Internet Explorer","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-edge-internet-explorer",{"rel":249,"titel":250,"zu":251},"richtlinien-anhang\u002Frichtlinien-virenschutz-angriffsflaechen","Virus protection and attack surface","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-virenschutz-angriffsflaechen",{"rel":253,"titel":254,"zu":255},"richtlinien-anhang\u002Frichtlinien-netzwerk-freigaben","Network and file sharing","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-netzwerk-freigaben",{"rel":257,"titel":258,"zu":259},"richtlinien-anhang\u002Frichtlinien-datenschutz-telemetrie","Privacy and telemetry","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-datenschutz-telemetrie",{"rel":261,"titel":262,"zu":263},"richtlinien-anhang\u002Frichtlinien-protokollierung-ueberwachung","Logging and auditing","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-protokollierung-ueberwachung",{"rel":265,"titel":266,"zu":267},"richtlinien-anhang\u002Frichtlinien-anmeldung-konten","Sign-in and accounts","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-anmeldung-konten",{"rel":269,"titel":270,"zu":271},"richtlinien-anhang\u002Frichtlinien-geraete-wechselmedien","Devices and removable media","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-geraete-wechselmedien",{"rel":273,"titel":274,"zu":275},"richtlinien-anhang\u002Frichtlinien-kernschutz","Kernel protection","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-kernschutz",{"rel":277,"titel":278,"zu":279},"richtlinien-anhang\u002Frichtlinien-laufwerksverschluesselung","Drive encryption","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-laufwerksverschluesselung",{"rel":281,"titel":282,"zu":283},"richtlinien-anhang\u002Frichtlinien-windows-update","Windows Update","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-windows-update",{"rel":285,"titel":286,"zu":287},"richtlinien-anhang\u002Frichtlinien-grundeinstellungen","Defaults and privacy settings","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-grundeinstellungen",null,1793199125162]