# Logging

### Enable Logging in Registry

This method may be useful if using a deployment or logon script.&#x20;

* Enable ScriptBlock Logging
  * HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
    * EnableScriptBlockLogging = 1
* Enable Module Logging
  * HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ModuleLogging
* EnableModuleLogging = 1
  * HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ModuleLogging \ModuleNames
    * \* = \*
* Transcription
  * HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\Transcription\\
    * EnableInvocationHeader = 1
    * EnableTranscripting = 1
    * OutputDirectory = \<path\_to\_directory>

The PowerShell Operational Log may be found here:

%SystemRoot%\system32\winevt\logs\Microsoft-Windows-PowerShell%4Operational.evtx

### Find ScriptBlock Logging Events in Event Logger

Application and Service Logs > Microsoft > Windows >  PowerShell > Operational > Event ID 4104 Scriptblock

<br>
