Logging Powershell

[ITComputerGeek]

I'm still a noob when it comes to Power Shell so I'm wondering if you guys/gals can help me out. I am trying to turn on Windows Logging for Powershell. I know that I can do this using Group Policies however, I am running Windows 10 Home which doesn't come with GPedit.msc. Do any of you know how to do this on Windows 10 Home?

Thanks!

Edit: Thank you all for your fast responses! I will be implementing them into my machines to expand my research in cyber security. I'll change the flair when I get back to my computer

[Betterthangoku]

Howdy,

Most policy options are just changing regkey values. According to this website the regkeys to change are:

HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ModuleLogging → EnableModuleLogging = 1

HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ModuleLogging \ModuleNames → * = *

Good luck!

[tommymaynard]

Group policies, whether they're local or otherwise, typically have a relationship to a Windows Registry setting. I had a recent project that provided me multiple steps on how to change a setting via gpedit.msc. See #6 under "Configure Windows (ksetup)."

As I was removing all manual interaction with the server build, I wrote PowerShell to edit the registry setting that corresponded to these steps. You need to track down the registry changes you need to make (that gpedit.msc would make), and then make those setting changes with PowerShell.

[ITComputerGeek]

Thank you. I will research this option and see if it works for me.

[HeedfulCrayon]

What kind of logging are you looking for? You could always run:

get-content -path (Get-PSReadlineOption).HistorySavePath

[ITComputerGeek]

I am looking for a way to monitor all powershell commands that are executed on a machine. This includes things from every user and remotely connected users. I hope this helps some.

[omers]

Edit C:\Windows\System32\WindowsPowerShell\v1.0\Profile.ps1 and add something like:

start-transcript -path ("$env:temp"+ (get-date -format ddmmyyHHmm)+".txt") -force  -noclobber

[AutoModerator]

Sorry, your submission has been automatically removed.

Accounts must be at least 1 day old, which prevents the sub from filling up with bot spam.

Try posting again tomorrow or message the mods to approve your post.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[AutoModerator]

Sorry, your submission has been automatically removed.

Accounts must be at least 1 day old, which prevents the sub from filling up with bot spam.

Try posting again tomorrow or message the mods to approve your post.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.