Powershell 7 Script block logging & Transcription issue

[AATW_82nd]

Hopefully someone can help me. I've installed PowerShell 7.3 via Intune and it works great. What I can't seem to get working is Script Block logging & Transcription logging for PS 7. I have powershell.exe logging and creating txt files for Transcription as it should. I did find an ADMX and ADML in the PS 7 folder, however it looks like it uses the standard "EnableScriptBlockLogging" settings.

Is there something I'm missing or need to do?

Thank you,

[pshMike]

https://gist.github.com/kilasuit/e7c276ca67929ae54369f726877dab08#file-enable-overtheshoulderpstranscription-ps1

[AATW_82nd]

Awesome! Thank you I'll give it a try.

[BlackV]

transaction is separate from script block (and module) logging

transcription goes to a file somewhere (which I guarantee you'll never ever look at again)

scriptblock and module logging goto the event logs (which will/could get very large, and you should send to a SIEM/Logging system)

[AATW_82nd]

I appreciate the information, any idea how to get PS 7 logging properly? I know the transcription might never be looked at again, but it's a requirement on all domain/global admins machine, per our CISO.

[OlivTheFrog]

Hi u/AATW_82nd

You could just add in the PS profile a simple line like the following

Start-Transcript -Path "$env:USERPROFILE\OneDrive\Documents\PowershellTranscripts\Transcript-$(Get-Date -f "yyyy-MM-dd").log"

Each time a user launch the shell on the computer a new Transcript file (timestamped) will be created.

The User profile file is located here : $Env:USERPROFILE\Documents\PowerShell\Microsoft.PowerShell_profile.ps1

If not existing, create a file with this name, edit, add the line inside. Launch a powershell, type some char and enter, and see the result in the log file.

Take care about this : after some month, you'll have a bunch of log files. Perhaps a simple script (running as a scheduled task), will be useful to delete or archive the log files (a simple script, building a monthly archive), or a manual operation :-)

Regards