EventID for the GPO

Question

I have enabled the GPO (Turn on PowerShell Transcription):

Computer Configuration-Administrative Templates-Windows Components-Windows PowerShell.

Turn on PowerShell Transcription: Enabled. Should I see any other Event ID besides 4103 in Event Viewer with this GPO?

Answer 1

Hello Glenn Maxwell,

Thank you for posting in Q&A forum.

From the following article, I can see:

Turn on Module Logging will log event ID 800 under Applications and Services Logs > Windows PowerShell in event viewer.

Turn on PowerShell Script Block Logging will log event ID 4104 under

Application and Services Logs > Microsoft > Windows > PowerShell > Operational event log

Turn on PowerShell Transcription

Enabling this policy will log both input and the resulting output of PowerShell into a text file. We need to specify a folder to store the logs to.

For more information, please read link below.
https://www.rootusers.com/enable-and-configure-module-script-block-and-transcription-logging-in-windows-powershell/

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

with this gpo enabled what event ids will we see?

Answer 3

As per this article, Event ID 4103 – Module logging, should i consider 800 or 4103

https://www.iblue.team/incident-response-1/logging-powershell-activities