PowerShell Gallery: Discovering Script Block Logging (Part 2)

by May 28, 2018

In the previous tip we introduced the free ScriptBlockLoggingAnalyzer module which uncovers the code that PowerShell logs. By default, this is limited to only a few commands, but if you enable full Script Block Logging, then any code run by anyone on your machine is logged.

Here are the steps to take (applies to Windows PowerShell, run from a PowerShell with elevated privileges!):

#requires -RunAsAdministrator

# install the module from the Gallery (only required once!)
Install-Module ScriptBlockLoggingAnalyzer -Force

# enable full script block logging 
Enable-SBL 

# extend the log size
Set-SBLLogSize -MaxSizeMB 100

# clear the log (optional)
Clear-SBLLog

From now on, all PowerShell code on this machine is logged. To view the logged code, use this:

 
PS> Get-SBLEvent | Out-GridView 
 

Twitter This Tip! ReTweet this Tip!