Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Turn on PowerShell Script Block Logging

These policy-backed registry values control script block logging in Windows PowerShell.

since 0.9.8.11

Purpose

Show registry keys (4)
  • HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\EnableScriptBlockLogging
  • HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\EnableScriptBlockInvocationLogging
  • HKCU\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\EnableScriptBlockLogging
  • HKCU\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\EnableScriptBlockInvocationLogging

These policy-backed registry values control script block logging in Windows PowerShell. Both values use the REG_DWORD data type.

When EnableScriptBlockLogging is set to 1, Windows PowerShell logs the processing of commands, script blocks, functions, and scripts. This covers both interactive input and automated invocation. The processed script content is recorded in the Microsoft-Windows-PowerShell/Operational event log, primarily through event ID 4104.

When EnableScriptBlockInvocationLogging is set to 1, enabled script block logging is supplemented with events marking the start and end of command, script block, function, and script invocations. This value controls the additional invocation events; it does not replace EnableScriptBlockLogging.

Notes

Security

The recorded script content can support the detection and forensic analysis of PowerShell activity. This setting does not block commands or scripts, change the PowerShell execution policy, or grant or revoke permissions for a process or user.

Script blocks can contain sensitive information, including credentials, access tokens, or other secrets used directly in commands or scripts. Such content can be written to the event log and may become accessible to unauthorized parties if the logs are not adequately protected. Microsoft provides Protected Event Logging as a separate mechanism for sensitive log content; the registry values described here do not enable it automatically.

Possible side effects

Script block logging increases event volume in proportion to PowerShell activity. Invocation logging can generate particularly large numbers of start and stop events, substantially increasing the storage and processing requirements of local or centrally collected event logs.

Notes

The policy is available in both Computer Configuration and User Configuration. Values under HKLM represent the computer policy and take precedence over the corresponding values under HKCU.

After the effective setting changes, new PowerShell sessions log according to that setting.

The specified registry path belongs to Windows PowerShell. PowerShell 7 has separate policy settings under Software\Policies\Microsoft\PowerShellCore. These registry values therefore should not be assumed to affect PowerShell 7 directly without accounting for its own policy and compatibility settings.

Microsoft documentation

Microsoft Learn: WindowsPowerShell Policy CSP

Microsoft Learn: about_Logging — Windows PowerShell 5.1

Microsoft Learn: about_Group_Policy_Settings

See also