Share via

Audit Log for specific Powershell command: PSsession

Myron Agio 1 Reputation point
2021-12-07T14:51:34.283+00:00

During our Security hardening, we need to audit if a domain admin tries to connect to any workstation using Powershell command Enter-PSSession.
I have checked for Event ID in event viewer but i did not find something.
Do you know any possible solution?

Thank you

Windows for business | Windows Server | User experience | PowerShell
0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.