PowerShell Transcript logging
Start-Transcript records everything in a session, both the commands you type and their output, into a text file. Stop-Transcript closes it. Between the two you get a complete record of what happened, which is what you want for a change window or an incident.
Documentation: Microsoft Learn
Overview
The usual pattern is Start-Transcript -Path $file -Append at the top of a script and Stop-Transcript in a finally block, so the transcript closes even when the script fails. Without the finally, an unhandled error leaves the transcript open.
Transcripts are a record, not a log. They capture the console as a human saw it, mixed together and unstructured, which makes them awkward to parse. When you want something a machine will read later, emit objects and export them to CSV or JSON, and keep the transcript for the narrative.
One warning worth taking seriously: a transcript captures whatever appeared on screen. If a script echoes a credential, a token or personal data, that now sits in a text file. Check what your script prints before enabling one.
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
$log = Join-Path 'C:\Temp' ('run-' + (Get-Date -Format 'yyyyMMdd-HHmmss') + '.log')
Write-Output "Transcript would be written to: $log"- Stage 1$log
Positional values or no named parameters
An example to inspect
Preview the example. Sign in for the full lesson and activities.
$log = Join-Path 'C:\Temp' ('run-' + (Get-Date -Format 'yyyyMMdd-HHmmss') + '.log')
Write-Output "Transcript would be written to: $log"What happens
This builds a timestamped log path with Join-Path and Get-Date -Format, then prints it instead of starting a transcript, because a transcript would write to disk. The date format string yyyyMMdd-HHmmss sorts correctly when you list the directory, which is the reason to use that order rather than a local date format.
Worth remembering
- Start-Transcript captures commands and output; Stop-Transcript closes it.
- Call Stop-Transcript in finally so failures still close the file.
- Transcripts are narrative. Export objects for anything machine-readable.
- Anything printed on screen ends up in the file, including secrets.
Primary documentation
Try it
Illustrative output · values vary by environment
Example reader
Inspect this page's example
Run supported commands against the practice data, or inspect the example without executing it.
Ready to inspect.
Builds a sortable timestamped log filename without writing anything.
Show reference output
Illustrative output · values vary by environment
Transcript would be written to: C:\Temp\run-20260910-234712.log