Script block logging in PowerShell - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What does enabling Script Block Logging in PowerShell do?

Script Block Logging is a security feature in PowerShell. What is its main purpose?

A It records the full content of all executed script blocks for auditing and analysis.

B It prevents any script blocks from running unless they are digitally signed.

C It automatically encrypts all PowerShell scripts on the system.

D It disables the execution of all scripts except those from trusted publishers.

💡 Hint

Think about what logging means in general and how it applies to scripts.

Script Block Logging captures the actual code of script blocks as they run, helping admins see what commands were executed.

💻 Command Output

intermediate

Output of enabling Script Block Logging via Group Policy

What is the expected effect after enabling Script Block Logging through Group Policy and running a PowerShell script?

PowerShell

Write-Output 'Hello World'

A The script fails to run with an access denied error.

B The script runs normally and the script block content is logged in the Windows Event Log under Microsoft-Windows-PowerShell/Operational.

C The script runs but no logging occurs anywhere.

D The script output is redirected to a file automatically.

💡 Hint

Consider what logging means and where PowerShell logs events.

When Script Block Logging is enabled, PowerShell logs the executed script blocks in the event log but does not block script execution.

❓ Configuration

advanced

Correct registry key to enable Script Block Logging

Which registry key and value correctly enable Script Block Logging on a Windows machine?

A HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\EnableScriptBlockLogging = 1

B HKCU\Software\Microsoft\PowerShell\ScriptBlockLogging\Enable = 1

C HKLM\Software\Microsoft\Windows\PowerShell\EnableScriptBlockLogging = 0

D HKLM\Software\Policies\Microsoft\Windows\PowerShell\EnableScriptBlockLogging = 2

💡 Hint

Look for the key under Policies and the correct value name and data.

The correct registry path is under Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging with the value EnableScriptBlockLogging set to 1 to enable it.

❓ Troubleshoot

advanced

Why are script blocks not logged despite enabling Script Block Logging?

You enabled Script Block Logging via Group Policy, but no script block events appear in the event log. What is a likely cause?

A The PowerShell execution policy is set to Restricted, blocking all scripts.

B The script blocks are too small to be logged by design.

C The Group Policy changes were not applied or the system was not restarted.

D Script Block Logging only works on PowerShell Core, not Windows PowerShell.

💡 Hint

Think about how Group Policy changes take effect on Windows.

Group Policy changes require a refresh or restart to apply. Without this, logging settings may not be active.

✅ Best Practice

expert

Best practice to minimize performance impact of Script Block Logging

Script Block Logging can impact system performance. Which approach best reduces this impact while keeping useful logs?

A Enable Script Block Logging on all machines permanently without filtering.

B Run all scripts with -NoProfile to avoid logging overhead.

C Disable Script Block Logging and rely only on antivirus software.

D Enable Script Block Logging only on critical servers and use event filtering to collect relevant events.

💡 Hint

Think about balancing security and performance in a real environment.

Limiting Script Block Logging to critical systems and filtering events reduces overhead while maintaining security visibility.