A security administrator wants to configure Windows to log all PowerShell script block executions for forensic analysis. Which Group Policy setting enables this capability?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need to enable PowerShell Script Block Logging in the Administrative Templates path for Windows PowerShell. It logs the full content of every script block executed, including decoded Base64 and dynamically generated code, so you get real forensic visibility.
Full Explanation
The correct setting is enabling PowerShell Script Block Logging under Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > Turn on PowerShell Script Block Logging. When enabled, PowerShell logs the content of every script block executed, including dynamically generated code and decoded Base64 content, to Event ID 4104 in the Microsoft-Windows-PowerShell/Operational event log, providing full visibility into script content. The Audit Process Creation setting under Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy is wrong because Event ID 4688 logs that PowerShell.exe was executed and its command line, but it does not log the full script block content for scripts that load from variables or files. The PowerShell Module Logging setting is wrong because module logging records pipeline execution and module use, but it does not capture full script block content the way Script Block Logging does. The Windows Script Host restriction setting is wrong because it affects VBScript/JScript execution rather than PowerShell and is not the logging configuration described.