Direct answer
Define the investigation need and privacy controls, enable the appropriate logging through the approved policy, then verify a harmless test script reaches the intended log and collector.
Understand what is recorded
Microsoft documents Windows PowerShell script block logging and event 4104 in the PowerShell Operational log when enabled. Script content can contain sensitive values. Versions and products may use different channels, so document the actual PowerShell environment and policy.
Reference: Microsoft: Windows PowerShell logging.
Protect collected content
Agree log access, retention and handling with security and privacy owners. Microsoft recommends Protected Event Logging when script block logging is used beyond diagnostics. Avoid embedding passwords or tokens in scripts and do not paste captured sensitive content into ordinary tickets.
Test with a harmless script
Use a dedicated nonproduction device or approved test account to run a harmless known script after policy processing. Locate the expected event and verify the central collector receives it with the right device and time. Document whether a new PowerShell session was required and note collection gaps.
Operate and review
Monitor event volume and the health of the forwarding path. Investigate unexplained scripts using execution context and approved change records; the presence of a script is not itself malicious. Reassess retention, access and application compatibility when management policy changes.
Long script content may span multiple records, so preserve the event context and avoid drawing a conclusion from one fragment alone.
Assessment limits
Logging does not prevent execution or cover every execution method. Configuration, version, permissions and collection determine what investigators can see.
Frequently asked questions
Does script block logging block a script?
No. It records configured activity; prevention requires separate controls.
Can logged scripts contain secrets?
Yes. Protect and restrict log content and avoid putting secrets in scripts.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.