Powershell version 7.4 does not support script block logging and no logs seen in eventviewer

[defaultshr]

Prerequisites

• Write a descriptive title.
• Make sure you are able to repro it on the latest released version
• Search the existing issues.
• Refer to the FAQ.
• Refer to Differences between Windows PowerShell 5.1 and PowerShell.

Steps to reproduce

Configure group policy for script block logging for powershell.

Expected behavior

logs in eventviewer under "Application and Services logs" -> "Microsoft" -> "Windows" -> "PowerShell" -> Operational

Actual behavior

No logs seen in the eventviewer for 7.4 powershell. However, we can see for older 5.x powershell.

Error details

No response

Environment data

PS C:\Program Files\PowerShell\7> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.4.1
PSEdition                      Core
GitCommitId                    7.4.1
OS                             Microsoft Windows 10.0.19045
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Visuals

No response

[MartinGC94]

PowerShell does support script block logging, it just logs them in a different location: PowerShellCore/Operational. IIRC one of the MSI install options asks if you want logging enabled, maybe you disabled that?

[gwsales]

The docs aren't updated to reflect the needed steps to enable logging.

Check out issue #20769 I created.

The install settings to enable logging doesn't actually enable logging, you have to set some registry keys in order to turn it on, the GPO settings aren't currently working.

[daxian-dbw]

If you are using group policy, be noted that PowerShell 7+ are using different registry keys from Windows PowerShell.

PowerShell/src/System.Management.Automation/engine/Utils.cs

Lines 783 to 792 in 4faf527

	private static readonly Dictionary<string, string> GroupPolicyKeys = new Dictionary<string, string>
	{
	{nameof(ScriptExecution), @"Software\Policies\Microsoft\PowerShellCore"},
	{nameof(ScriptBlockLogging), @"Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging"},
	{nameof(ModuleLogging), @"Software\Policies\Microsoft\PowerShellCore\ModuleLogging"},
	{nameof(ProtectedEventLogging), @"Software\Policies\Microsoft\Windows\EventLog\ProtectedEventLogging"},
	{nameof(Transcription), @"Software\Policies\Microsoft\PowerShellCore\Transcription"},
	{nameof(UpdatableHelp), @"Software\Policies\Microsoft\PowerShellCore\UpdatableHelp"},
	{nameof(ConsoleSessionConfiguration), @"Software\Policies\Microsoft\PowerShellCore\ConsoleSessionConfiguration"}
	};

However, PowerShell 7+ allows falling back to the Windows PowerShell group policy for each of them, by setting a registry key named UseWindowsPowerShellPolicySetting to 1 for that particular logging policy:

PowerShell/src/System.Management.Automation/engine/Utils.cs

Lines 932 to 940 in 4faf527

	// if PolicySettingFallbackKey is Not set - use PowerShell Core policy reg key
	if ((int)gpoKey.GetValue(PolicySettingFallbackKey, 0) == 0)
	{
	isAnyPropertySet = TrySetPolicySettingsFromRegistryKey(tInstance, tType, gpoKey);
	}
	else
	{
	// when PolicySettingFallbackKey flag is set (REG_DWORD "1") use Windows PS policy reg key
	WindowsPowershellGroupPolicyKeys.TryGetValue(tType.Name, out string winPowershellGpoKeyPath);

Please give it a try and see if it enables the module logging for you.

[daxian-dbw]

Duplicate of #20769

[microsoft-github-policy-service]

This issue has been marked as duplicate and has not had any activity for 1 day. It has been closed for housekeeping purposes.

[microsoft-github-policy-service]

📣 Hey @defaultshr, how did we do? We would love to hear your feedback with the link below! 🗣️

🔗 https://aka.ms/PSRepoFeedback

Microsoft Forms