Script block logging in PowerShell - Step-by-Step Execution

Concept Flow - Script block logging

Enable Script Block Logging

↓

PowerShell runs script block

↓

Script block content captured

↓

Log entry created in Event Log

↓

Admin reviews logs for auditing

This flow shows how enabling script block logging captures PowerShell script blocks as they run and records them in event logs for auditing.

Execution Sample

PowerShell

Set-ItemProperty -Path HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging -Name EnableScriptBlockLogging -Value 1
Write-Output "Hello, World!"

This code enables script block logging via registry and runs a simple PowerShell command that will be logged.

Execution Table

Step	Action	Evaluation	Result
1	Set registry key to enable script block logging	Registry key set successfully	Script block logging enabled
2	Run Write-Output command	Command executes	Output: Hello, World!
3	PowerShell captures script block content	Script block content: Write-Output "Hello, World!"	Content logged to event log
4	Event log entry created	Log contains script block text and metadata	Log entry available for admin review
5	Admin checks event log	Log entry found with script block details	Auditing successful

💡 Script block logging enabled and script block content successfully logged in event log

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
EnableScriptBlockLogging	Not set	1 (enabled)	1 (enabled)	1 (enabled)	1 (enabled)
ScriptBlockContent	None	None	Write-Output "Hello, World!"	Write-Output "Hello, World!"	Logged in event log

Key Moments - 3 Insights

Why doesn't script block logging capture commands before enabling it?

Script block logging only captures script blocks executed after the registry key is set, as shown in step 1 enabling logging before running commands in step 2.

Does script block logging affect the output of commands?

No, as seen in step 2, the command outputs normally while logging happens in the background (step 3 and 4).

Where can I find the logged script block content?

The logged content is stored in the Windows Event Log under PowerShell operational logs, confirmed in step 4 and 5.

Visual Quiz - 3 Questions

Look at the execution table, what is the value of EnableScriptBlockLogging after step 1?

A 1 (enabled)

B 0 (disabled)

C Not set

D Error

💡 Hint

Check variable_tracker row for EnableScriptBlockLogging after Step 1

At which step does PowerShell capture the script block content?

A Step 2

B Step 3

C Step 4

D Step 5

💡 Hint

Look at execution_table rows describing script block capture

If script block logging was not enabled, what would change in the execution table?

A Step 4 would create a log entry anyway

B Step 2 would fail to run command

C Step 3 would not capture script block content

D Step 5 would show auditing successful

💡 Hint

Refer to the exit_note and step 1 enabling logging

Concept Snapshot

Script block logging captures PowerShell script blocks as they run.
Enable it by setting registry key EnableScriptBlockLogging to 1.
Logged script blocks appear in Windows Event Logs.
Does not affect command output.
Useful for auditing and security monitoring.

Full Transcript

Script block logging in PowerShell works by enabling a registry key that tells PowerShell to record every script block it runs. When enabled, each script block's content is captured and saved in the Windows Event Log. This helps administrators audit what scripts have run on a system. The process starts by setting the registry key EnableScriptBlockLogging to 1. After that, any PowerShell command or script block executed is logged without changing its output. The logs can be reviewed later in the event viewer under PowerShell operational logs. This method is useful for security and troubleshooting.