Audit PowerShell script block logging
Documentation: Microsoft Learn
Read the PowerShell ScriptBlockLogging policy registry key with Get-ItemProperty and interpret missing settings before drawing conclusions.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -ErrorAction SilentlyContinue- Stage 1Get-ItemProperty
-ErrorAction
How it works
Get-ItemProperty reads the ScriptBlockLogging policy key and returns whatever values it holds, with -EA SilentlyContinue keeping the command quiet on hosts where the key does not exist because the policy was never applied.
Adapting it
Test the EnableScriptBlockLogging value explicitly against 1 rather than dumping the whole key, so the result becomes a boolean a monitoring system can alert on.
If the result is unexpected
Script-block logging appears enabled but expected events are absent.
Effective policy, the PowerShell edition, log channel and execution time influence available evidence.
- Check policy for the host that ran the command and inspect the matching operational log around that time.
Validate the result
A controlled test produces an event in the intended channel or the missing prerequisite is identified.
Keep the check reliable
Document the edition and logging channel and account for sensitive data in retained script content.
