Skip to content

Commit 3864798

Browse files
sdwheelermichaeltlombardi
sdwheeler
and
michaeltlombardi
authored
Fixes #10298 - Fix registry path information for policies (#10301)
* Fix registry path information for policies * Apply suggestions from code review Co-authored-by: Mikey Lombardi (He/Him) <michael.t.lombardi@gmail.com> * Fix broken link --------- Co-authored-by: Mikey Lombardi (He/Him) <michael.t.lombardi@gmail.com>
1 parent 6d7b652 commit 3864798

File tree

4 files changed

+132
-149
lines changed

4 files changed

+132
-149
lines changed

‎reference/5.1/Microsoft.PowerShell.Core/About/about_Logging.md

Lines changed: 39 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
description: PowerShell logs internal operations from the engine, providers, and cmdlets.
33
Locale: en-US
4-
ms.date: 12/14/2018
4+
ms.date: 07/25/2023
55
online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1&WT.mc_id=ps-gethelp
66
schema: 2.0.0
77
title: about Logging
@@ -10,8 +10,8 @@ title: about Logging
1010
# about_Logging
1111

1212
## Short description
13-
14-
PowerShell logs internal operations from the engine, providers, and cmdlets.
13+
PowerShell logs internal operations from the engine, providers, and cmdlets to
14+
the Windows event log.
1515

1616
## Long description
1717

@@ -22,27 +22,27 @@ stopping the engine and providers, and executing PowerShell commands.
2222
> Windows PowerShell versions 3.0, 4.0, 5.0, and 5.1 include **EventLog**
2323
> cmdlets for the Windows event logs. In those versions, to display the list of
2424
> **EventLog** cmdlets type: `Get-Command -Noun EventLog`. For more
25-
> information, see the cmdlet documentation and [about_EventLogs](about_Eventlogs.md) for your
26-
> version of Windows PowerShell.
25+
> information, see the cmdlet documentation and
26+
> [about_EventLogs](about_Eventlogs.md) for your version of Windows PowerShell.
2727
2828
## Viewing the PowerShell event log entries on Windows
2929

3030
PowerShell logs can be viewed using the Windows Event Viewer. The event log is
31-
located in the Application and Services Logs group and is named
32-
`Microsoft-Windows-PowerShell`. The associated ETW provider `GUID` is
31+
located in the **Application and Services Logs** group and is named
32+
**Microsoft-Windows-PowerShell**. The associated ETW provider `GUID` is
3333
`{A0C1853B-5C40-4B15-8766-3CF1C58F985A}`.
3434

3535
When Script Block Logging is enabled, PowerShell logs the following events to
36-
the `Microsoft-Windows-PowerShell/Operational` log:
36+
the **Microsoft-Windows-PowerShell/Operational** log:
3737

38-
|Field| Value|
39-
|-|-|
40-
|EventId|`4104` / `0x1008`|
41-
|Channel|`Operational`|
42-
|Level|`Verbose`|
43-
|Opcode|`Create`|
44-
|Task|`CommandStart`|
45-
|Keyword|`Runspace`|
38+
| Field | Value |
39+
| ------- | ----------------- |
40+
| EventId | `4104` / `0x1008` |
41+
| Channel | `Operational` |
42+
| Level | `Verbose` |
43+
| Opcode | `Create` |
44+
| Task | `CommandStart` |
45+
| Keyword | `Runspace` |
4646

4747
## Enabling Script Block Logging
4848

@@ -58,22 +58,22 @@ Script Block Logging can be enabled via Group Policy or a registry setting.
5858

5959
### Using Group Policy
6060

61-
To enable automatic transcription, enable the `Turn on PowerShell Script Block
62-
Logging` feature in Group Policy through `Administrative Templates -> Windows
63-
Components -> Windows PowerShell`.
61+
To enable automatic transcription, enable the **Turn on PowerShell Script Block
62+
Logging** feature in Group Policy through **Administrative Templates** ->
63+
**Windows Components** -> **Windows PowerShell**.
6464

6565
### Using the Registry
6666

6767
Run the following function:
6868

6969
```powershell
70-
function Enable-PSScriptBlockLogging
71-
{
72-
$basePath = 'HKLM:\Software\Policies\Microsoft\Windows' +
73-
'\PowerShell\ScriptBlockLogging'
70+
function Enable-PSScriptBlockLogging {
71+
$basePath = @(
72+
'HKLM:\Software\Policies\Microsoft\Windows'
73+
'PowerShell\ScriptBlockLogging'
74+
) -join '\'
7475
75-
if(-not (Test-Path $basePath))
76-
{
76+
if (-not (Test-Path $basePath)) {
7777
$null = New-Item $basePath -Force
7878
}
7979
@@ -101,13 +101,13 @@ content and decrypt content are kept separate.
101101
The public key can be shared widely and isn't sensitive data. Any content
102102
encrypted with this public key can only be decrypted by the private key. For
103103
more information about Public Key Cryptography, see
104-
[Wikipedia - Public Key Cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography).
104+
[Wikipedia - Public Key Cryptography][04].
105105

106106
To enable a Protected Event Logging policy, deploy a public key to all machines
107107
that have event log data to protect. The corresponding private key is used to
108108
post-process the event logs at a more secure location such as a central event
109-
log collector, or [SIEM][SIEM] aggregator. You can set up SIEM in Azure. For more
110-
information, see [Generic SIEM integration](/cloud-app-security/siem).
109+
log collector, or [SIEM][05] aggregator. You can set up SIEM in Azure. For more
110+
information, see [Generic SIEM integration][01].
111111

112112
### Enabling Protected Event Logging via Group Policy
113113

@@ -127,27 +127,31 @@ can provide in one of several forms:
127127
certificate store (can be deployed by PKI infrastructure).
128128

129129
The resulting certificate must have `Document Encryption` as an enhanced key
130-
usage (`1.3.6.1.4.1.311.80.1`), and either `Data Encipherment` or `Key
131-
Encipherment` key usages enabled.
130+
usage (`1.3.6.1.4.1.311.80.1`), and either `Data Encipherment` or
131+
`Key Encipherment` key usages enabled.
132132

133133
> [!WARNING]
134134
> The private key shouldn't be deployed to the machines logging events. It
135135
> should be kept in a secure location where you decrypt the messages.
136136
137137
### Decrypting Protected Event Logging messages
138138

139-
The following script will retrieve and decrypt, assuming that you have the
139+
The following script retrieves and decrypts events, assuming that you have the
140140
private key:
141141

142142
```powershell
143143
Get-WinEvent Microsoft-Windows-PowerShell/Operational |
144-
Where-Object Id -eq 4104 | Unprotect-CmsMessage
144+
Where-Object Id -eq 4104 |
145+
Unprotect-CmsMessage
145146
```
146147

147148
## See also
148149

149-
- [Generic SIEM integration](/cloud-app-security/siem)
150-
- [PowerShell the Blue Team](https://devblogs.microsoft.com/powershell/powershell-the-blue-team/)
150+
- [PowerShell the Blue Team][03]
151+
- [Generic SIEM integration][01]
151152

152153
<!-- link references -->
153-
[SIEM]: https://wikipedia.org/wiki/Security_information_and_event_management
154+
[01]: /cloud-app-security/siem
155+
[03]: https://devblogs.microsoft.com/powershell/powershell-the-blue-team/
156+
[04]: https://en.wikipedia.org/wiki/Public-key_cryptography
157+
[05]: https://wikipedia.org/wiki/Security_information_and_event_management

‎reference/7.2/Microsoft.PowerShell.Core/About/about_Logging_Windows.md

Lines changed: 31 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
description: PowerShell logs internal operations from the engine, providers, and cmdlets to the Windows event log.
33
Locale: en-US
4-
ms.date: 10/07/2022
4+
ms.date: 07/25/2023
55
online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.2&WT.mc_id=ps-gethelp
66
schema: 2.0.0
77
title: about Logging Windows
@@ -18,13 +18,6 @@ the Windows event log.
1818
PowerShell logs details about PowerShell operations, such as starting and
1919
stopping the engine and providers, and executing PowerShell commands.
2020

21-
> [!NOTE]
22-
> Windows PowerShell versions 3.0, 4.0, 5.0, and 5.1 include **EventLog**
23-
> cmdlets for the Windows event logs. In those versions, to display the list of
24-
> **EventLog** cmdlets type: `Get-Command -Noun EventLog`. For more
25-
> information, see the cmdlet documentation and about_EventLogs for your
26-
> version of Windows PowerShell.
27-
2821
## Registering the PowerShell event provider on Windows
2922

3023
Unlike Linux or macOS, Windows requires the event provider to be registered
@@ -38,12 +31,12 @@ $PSHOME\RegisterManifest.ps1
3831
## Viewing the PowerShell event log entries on Windows
3932

4033
PowerShell logs can be viewed using the Windows Event Viewer. The event log is
41-
located in the Application and Services Logs group and is named
42-
`PowerShellCore`. The associated ETW provider `GUID` is
34+
located in the **Application and Services Logs** group and is named
35+
**PowerShellCore**. The associated ETW provider GUID is
4336
`{f90714a8-5509-434a-bf6d-b1624c8a19a2}`.
4437

4538
When Script Block Logging is enabled, PowerShell logs the following events to
46-
the `PowerShellCore/Operational` log:
39+
the **PowerShellCore/Operational** log:
4740

4841
| Field | Value |
4942
| ------- | ----------------- |
@@ -84,22 +77,22 @@ Script Block Logging can be enabled via Group Policy or a registry setting.
8477

8578
### Using Group Policy
8679

87-
To enable automatic transcription, enable the `Turn on PowerShell Script Block
88-
Logging` feature in Group Policy through `Administrative Templates -> Windows
89-
Components -> Windows PowerShell`.
80+
To enable automatic transcription, enable the **Turn on PowerShell Script Block
81+
Logging** feature in Group Policy through **Administrative Templates** ->
82+
**PowerShell Core**.
9083

9184
### Using the Registry
9285

9386
Run the following function:
9487

9588
```powershell
96-
function Enable-PSScriptBlockLogging
97-
{
98-
$basePath = 'HKLM:\Software\Policies\Microsoft\Windows' +
99-
'\PowerShell\ScriptBlockLogging'
89+
function Enable-PSScriptBlockLogging {
90+
$basePath = @(
91+
'HKLM:\Software\Policies\Microsoft'
92+
'PowerShellCore\ScriptBlockLogging'
93+
) -join '\'
10094
101-
if(-not (Test-Path $basePath))
102-
{
95+
if (-not (Test-Path $basePath)) {
10396
$null = New-Item $basePath -Force
10497
}
10598
@@ -127,13 +120,13 @@ content and decrypt content are kept separate.
127120
The public key can be shared widely and isn't sensitive data. Any content
128121
encrypted with this public key can only be decrypted by the private key. For
129122
more information about Public Key Cryptography, see
130-
[Wikipedia - Public Key Cryptography][01].
123+
[Wikipedia - Public Key Cryptography][04].
131124

132125
To enable a Protected Event Logging policy, deploy a public key to all machines
133126
that have event log data to protect. The corresponding private key is used to
134127
post-process the event logs at a more secure location such as a central event
135-
log collector, or [SIEM][02] aggregator. You can set up SIEM in Azure. For more
136-
information, see [Generic SIEM integration][03].
128+
log collector, or [SIEM][05] aggregator. You can set up SIEM in Azure. For more
129+
information, see [Generic SIEM integration][01].
137130

138131
### Enabling Protected Event Logging via Group Policy
139132

@@ -153,33 +146,33 @@ can provide in one of several forms:
153146
certificate store (can be deployed by PKI infrastructure).
154147

155148
The resulting certificate must have `Document Encryption` as an enhanced key
156-
usage (`1.3.6.1.4.1.311.80.1`), and either `Data Encipherment` or `Key
157-
Encipherment` key usages enabled.
149+
usage (`1.3.6.1.4.1.311.80.1`), and either `Data Encipherment` or
150+
`Key Encipherment` key usages enabled.
158151

159152
> [!WARNING]
160153
> The private key shouldn't be deployed to the machines logging events. It
161154
> should be kept in a secure location where you decrypt the messages.
162155
163156
### Decrypting Protected Event Logging messages
164157

165-
The following script will retrieve and decrypt, assuming that you have the
158+
The following script retrieves and decrypts events, assuming that you have the
166159
private key:
167160

168161
```powershell
169162
Get-WinEvent Microsoft-Windows-PowerShell/Operational |
170-
Where-Object Id -eq 4104 | Unprotect-CmsMessage
163+
Where-Object Id -eq 4104 |
164+
Unprotect-CmsMessage
171165
```
172166

173167
## See also
174168

175-
- [about_Logging_Non-Windows][04]
176-
- [PowerShell the Blue Team][05]
177-
- [Generic SIEM integration][03]
178-
179-
<!-- added link references -->
180-
[01]: https://en.wikipedia.org/wiki/Public-key_cryptography
181-
[02]: https://wikipedia.org/wiki/Security_information_and_event_management
182-
[03]: /cloud-app-security/siem
183-
[04]: about_Logging_Non-Windows.md
184-
[05]: https://devblogs.microsoft.com/powershell/powershell-the-blue-team/
185-
[06]: /cloud-app-security/siem
169+
- [about_Logging_Non-Windows][02]
170+
- [PowerShell the Blue Team][03]
171+
- [Generic SIEM integration][01]
172+
173+
<!-- link references -->
174+
[01]: /cloud-app-security/siem
175+
[02]: about_Logging_Non-Windows.md
176+
[03]: https://devblogs.microsoft.com/powershell/powershell-the-blue-team/
177+
[04]: https://en.wikipedia.org/wiki/Public-key_cryptography
178+
[05]: https://wikipedia.org/wiki/Security_information_and_event_management

0 commit comments

Comments
 (0)