Windows Event Viewer flooded with PowerShell engine state modification alerts

Question

We're reviewing the system logs on our corporate Windows server. Our Event Viewer is getting flooded with too many alerts saying that the PowerShell execution engine altered its condition. It is taking up a lot of space in our database. How can I resolve or configure this continuous engine status logging? Thank you.

Answer 1

Hi Julian Hoffmann,

To configure and reduce this continuous logging behavior, you can modify the local group policy editor by navigating to computer configuration, administrative templates, windows components and selecting windows PowerShell. From there, locate turn on module logging and turn on PowerShell script block logging, open their configurations, and change the setting to disabled or uncheck unnecessary modules to prevent routine tasks from generating overwhelming state modification entries. If you prefer to handle this directly in the registry, you can adjust the EnableModuleLogging value to 0 under the path HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging.

If these adjustments help resolve the event log flooding and optimize your database utilization, free feel to hit "Accepted" for benefitting others in community having the same issue too.

Tracy Le.