Turning On and Exporting PowerShell Script Block Logging
This guide explains how to turn on PowerShell script block logging and export the resulting records. The relevant events are 4104 entries in the PowerShell Operational log. Complete data depends on script block logging being enabled first.
The records reside in the PowerShell Operational channel under Applications and Services Logs, with event ID 4104 marking each captured block. Exporting the channel can be done with wevtutil to an .evtx file. PowerShell 7 uses a distinct channel and policy from Windows PowerShell.
Administrators can verify policy via registry query; value 0x1 indicates enabled, missing key means disabled. Windows PowerShell 5.1 may still emit warning-level 4104 entries for suspicious blocks, but these are partial. SOC Prime reports 663 PowerShell-log rules mapped to 417 ATT&CK techniques.
Security teams, IT administrators, and organizations relying on Windows may benefit because fuller PowerShell records can improve incident review and threat hunting. If logging is left off or only partial warning events exist, investigators could miss attacker activity, potentially affecting customers and employees whose data is handled by compromised systems. The separate PowerShell 7 channel may create visibility gaps unless configured.