Troubleshooting

Event IDs 4103 and 4104 are not logged

Symptom: You run PowerShell commands, but the PowerShell Operational log does not show event IDs 4103 or 4104.

Resolution:

1. Confirm that Turn on Module Logging and Turn on PowerShell Script Block Logging are both enabled in the correct GPO.
2. Verify that the correct GPO applies to the target computer:
   • Default Domain Controllers Policy for Domain Controllers
   • ADAuditPlusMSPolicy for Windows member servers
   • <DomainName>_ADAuditPlusWSPolicy for Windows workstations
3. Force Group Policy update on the target computer.
4. Run a new PowerShell command after policy refresh.
5. Reopen Event Viewer and check the PowerShell Operational log again.

Only one of the expected event types is logged

Symptom: You see 4103 events but not 4104, or 4104 events but not 4103.

Resolution:

1. Open the applicable GPO and check each PowerShell setting separately.
2. Confirm that Turn on Module Logging is enabled with Module Names set to *.
3. Confirm that Turn on PowerShell Script Block Logging is enabled.
4. Run a new test that includes both cmdlet execution and a script block.
5. Recheck the PowerShell Operational log.

GPO changes do not apply to the target computer

Symptom: The GPO looks correct in GPMC, but the target computer does not show the PowerShell settings.

Resolution:

1. Confirm that you edited the correct GPO for the target computer type.
2. Check GPO linking, inheritance, and security filtering.
3. Use Group Policy Results to confirm the winning policy.
4. Allow time for AD replication if you recently changed the GPO.
5. Run Group Policy refresh on the target computer and verify again.

Automatic configuration fails in ADAudit Plus

Symptom: ADAudit Plus reports that automatic audit policy configuration failed or did not complete.

Resolution:

1. Confirm that the account used for automatic configuration has permission to create, edit, or apply the required GPO settings.
2. Check whether the environment blocks automatic GPO changes through delegation or change-control restrictions.
3. Re-run the automatic configuration action from the ADAudit Plus web console.
4. If the failure persists, switch to the manual configuration workflow in this Section.
5. Verify the result on the target computer after configuration.

Events exist in Event Viewer but not in ADAudit Plus

Symptom: Event Viewer shows 4103 and 4104, but ADAudit Plus reports do not show the same activity.

Resolution:

1. Confirm that the correct Domain Controller, Windows Server, or Windows Workstation is onboarded in ADAudit Plus.
2. Verify that the required license is present for the monitored object type.
3. Allow enough time for collection and processing.
4. Check connectivity between the monitored system and the ADAudit Plus server or ADAudit Plus agent path.
5. Filter the ADAudit Plus report using the exact test time window, computer name, and user account.

The PowerShell Operational log fills too quickly

Symptom: PowerShell events roll over quickly, or investigation windows are too short.

Resolution:

1. Confirm that the MaxSize value is set to 153616384 decimal.
2. If the environment has high PowerShell volume, increase the log size beyond 150 MB.
3. Review whether scripts or automation jobs are generating unusually high PowerShell event volume.
4. Recheck the log size after Group Policy refresh.
5. Verify that ADAudit Plus is collecting events as expected so you do not rely only on local retention.

PowerShell 7 activity is missing or incomplete

Symptom: Activity from PowerShell 7.x does not appear the same way as Windows PowerShell activity.

Resolution:

1. Confirm whether the tested activity ran in Windows PowerShell or PowerShell 7.x.
2. ADAudit Plus collects from the Windows PowerShell Operational log; PowerShell 7.x uses a separate event channel.
3. Validate PowerShell 7.x behavior in a non-production test before treating it as fully covered.
4. Keep Windows PowerShell logging enabled even if PowerShell 7.x is present in the environment.
5. Document the observed behavior for your internal security operations team.

Frequently Asked Questions (FAQ)

Q1. What is the difference between Module Logging and Script Block Logging?

Module Logging records cmdlet and pipeline activity in event ID 4103. Script Block Logging records executed script content in event ID 4104. Use both for complete visibility.

Q2. Do I need both Module Logging and Script Block Logging?

Yes, if you want complete PowerShell audit coverage. If you enable only one, your command or script visibility is incomplete.

Q3. Why is the recommended PowerShell Operational log size 150 MB?

150 MB reduces the chance that important PowerShell events are overwritten before ADAudit Plus collects them. Increase it further in high-volume environments.

Q4. Which PowerShell versions does ADAudit Plus audit?

ADAudit Plus supports Windows PowerShell 4.0, 5.0, and 5.1. Windows PowerShell 5.1 is the standard inbox version on Windows Server 2016, 2019, 2022, and Windows 10/11. Validate PowerShell 7.x separately in your environment.

Q5. How do I know that PowerShell auditing is working?

Confirm that the target computer writes event IDs 4103 and 4104 to Event Viewer → Application and Services Logs → Microsoft → Windows → PowerShell → Operational, then verify the same activity in ADAudit Plus under Server → PowerShell Activity (or Endpoint → PowerShell Activity for workstations).

Q6. What license do I need for PowerShell auditing?

Use the Domain Controllers license for Domain Controller auditing, the Member Servers add-on for Windows Server PowerShell auditing, and the Workstations add-on for Windows Workstation PowerShell auditing.

Q7. Can ADAudit Plus alert on suspicious PowerShell behavior?

Yes. Create alert profiles for encoded commands, suspicious keywords, logging disable attempts, unusual execution times, or high-volume script activity.