Enable Script Block Logging to Capture All PowerShell Commands for Forensic Investigation

Check Current Logging Status

$path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
$val = Get-ItemProperty -Path $path -Name EnableScriptBlockLogging -ErrorAction SilentlyContinue
if ($val.EnableScriptBlockLogging -eq 1) {
    Write-Host "SECURE: Script block logging is enabled" -ForegroundColor Green
} else {
    Write-Host "NOT CONFIGURED: Script block logging is disabled" -ForegroundColor Red
}

Enable Script Block Logging

$path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name EnableScriptBlockLogging -Value 1 -Type DWord

# Also enable Module Logging for additional visibility
$modPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging'
New-Item -Path $modPath -Force | Out-Null
Set-ItemProperty -Path $modPath -Name EnableModuleLogging -Value 1 -Type DWord
New-Item -Path "$modPath\ModuleNames" -Force | Out-Null
Set-ItemProperty -Path "$modPath\ModuleNames" -Name '*' -Value '*' -Type String

View Captured Script Blocks

# Script blocks are logged to: Windows PowerShell event log, Event ID 4104
Get-WinEvent -LogName 'Microsoft-Windows-PowerShell/Operational' |
    Where-Object { $_.Id -eq 4104 } |
    Select-Object TimeCreated, Message |
    Select-Object -Last 20

Verification

(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging').EnableScriptBlockLogging
# Must return 1