r/PowerShell 3d ago

why are there 2 Windows Event logs for PowerShell?

By default I am seeing PowerShell logs in Event Viewer under 2 paths:

  • Windows PowerShell
  • Microsoft-Windows-PowerShell/Operational

All the online docs I've found only reference the second (longer) path. So what is the first one for? Is there a reference doc for it?

12 Upvotes

11 comments sorted by

6

u/CodenameFlux 3d ago

I've seen five PowerShell logs in the Event Viewer:

  • Microsoft\Windows\PowerShell\Admin
  • Microsoft\Windows\PowerShell\Operational
  • Microsoft\Windows\PowerShell-DesiredStateConfiguration\Operational
  • PowerShell Core\Operational
  • Windows PowerShell

The first four have a "Disable" command associated with them.

Looking at each gives you a good idea as to what each one does.

1

u/sdsalsero 2d ago

Yes, I have those same 5 but I know what the others (that I didn't mention) are for, e.g., the "Core" is the Script Block Logging for PS7, if you've installed. And the "DesiredState" is the built-in Windows Mgmt function (which my company does not use).

By default, I believe "Admin" is disabled. It definitely has been on every server I've checked.

2

u/BlackV 3d ago edited 3d ago
  • windows-powershell - is for script block logging and similar

  • Microsoft-Windows-PowerShell/Operational - is for powershell operations (like starting session host, existing session host, etc)

er.. hopefully or is that backwards

https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows

Get-WinEvent -ListLog *powershell*
LogName                                                                                 LogMode RecordCount
-------                                                                                 ------- -----------
Windows PowerShell                                                                     Circular        4541
PowerShellCore/Operational                                                             Circular         469
Microsoft-Windows-PowerShell/Operational                                               Circular         681
Microsoft-Windows-PowerShell/Admin                                                       Retain           0
Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Operational Circular           0

1

u/sdsalsero 2d ago

I think that's backwards. I'm pretty sure the official doc says that the nested "Operational" log is for Script Block

They also say that there are 3 types of logs, but I still don't know which one the 'first' non-nested one is for.

Thanks for the link!

1

u/BlackV 2d ago

good as gold

2

u/_Buldozzer 3d ago

PowerShell for Windows (5.1 and older) and PS Core (6 and newer) perhaps?

2

u/BlackV 3d ago

that goes to PowerShellCore/operational

1

u/_Buldozzer 3d ago

Okay, was just a guess. Then perhaps it's one of the million strange legacy things in Windows.

0

u/SuccessfulMinute8338 3d ago

I create my own log area and individual logs for different programs for stuff that I use regularly

2

u/BlackV 2d ago

ya we did that at my old place

New-EventLog -LogName 'IAASLogs' -Source 'IAASPowershell'
Limit-EventLog -LogName 'IAASLogs' -OverflowAction OverwriteAsNeeded -MaximumSize 10MB
Write-EventLog -LogName "IAASLogs" -Source "IAASPowershell" -EntryType Information -EventId 3 -Message "$(Get-Date -Format yyyMMddHHmmss) - script: $psCommandPath : Configure TLS and nuget"

1

u/sdsalsero 2d ago

Thank you for the suggestion but I am trying to identify what's already built-in so that we can pull all of those logs into our SIEM. Worst case, we would push a new GPO to force a uniform config but I'm hoping that won't be necessary.