PowerShell Gallery: Discovering Script Block Logging (Part 2)

by May 28, 2018

In the previous tip we introduced the free ScriptBlockLoggingAnalyzer module which uncovers the code that PowerShell logs. By default, this is limited to only a few commands, but if you enable full Script Block Logging, then any code run by anyone on your machine is logged.

Here are the steps to take (applies to Windows PowerShell, run from a PowerShell with elevated privileges!):

#requires -RunAsAdministrator

# install the module from the Gallery (only required once!)
Install-Module ScriptBlockLoggingAnalyzer -Force

# enable full script block logging 

# extend the log size
Set-SBLLogSize -MaxSizeMB 100

# clear the log (optional)

From now on, all PowerShell code on this machine is logged. To view the logged code, use this:

PS> Get-SBLEvent | Out-GridView 

Twitter This Tip! ReTweet this Tip!