Overview

Purpose of this guide

Use this guide to configure, verify, and maintain Windows PowerShell auditing in ADAudit Plus for:

• Domain Controllers
• Windows member servers
• Windows workstations

Follow this workflow before you rely on PowerShell reports or alerts:

1. Add the target Domain Controllers, Windows Servers, or Windows Workstations in ADAudit Plus.

2. Enable the required Windows PowerShell logging policies.

3. Increase the PowerShell Operational log size.

4. Verify that PowerShell events are written to Event Viewer.

5. Confirm that ADAudit Plus reports and alerts show the expected data.

Why PowerShell auditing matters

Windows PowerShell is a dual-use administration tool. Your administrators use it for automation, remote management, reporting, and maintenance. Attackers also use it for:

• Credential access and credential dumping activity
• Host and domain reconnaissance
• Lateral movement
• Persistence
• Data collection and exfiltration staging

Because PowerShell is legitimate and powerful, suspicious activity can blend into normal administration. PowerShell auditing helps you distinguish expected administrative use from risky behavior and investigation-worthy activity.

What ADAudit Plus audits for PowerShell

ADAudit Plus reads the PowerShell Operational event log and turns that data into searchable reports and alerts. For PowerShell activity, ADAudit Plus helps you audit:

• PowerShell processes that run in your environment
• Commands executed in PowerShell sessions
• PowerShell script activity
• Suspicious PowerShell usage patterns, such as encoded commands, credential access attempts, lateral movement, and reconnaissance behavior

The Windows event source used by this feature is:

Application and Services Logs\Microsoft\Windows\PowerShell\Operational

PowerShell auditing depends on two Windows logging features:

Logging type	Primary event IDs	What it records	Why it matters
Module Logging	4103	Cmdlets, module activity, and pipeline execution details	Helps you see which commands and modules were used.
Script Block Logging	4104	Script blocks as PowerShell executes them	Helps you inspect the actual script content used during execution.
Script Block lifecycle	4105, 4106	Script block start and stop activity	Helps you confirm that script block logging is active and that execution occurred.

⚠️ Important: Enable both Module Logging and Script Block Logging for complete visibility. If you enable only one, the resulting audit trail is partial and investigations take longer.

Supported PowerShell versions

ADAudit Plus PowerShell auditing supports Windows PowerShell 4.0, 5.0, and 5.1 using the Windows PowerShell Operational event log. Windows PowerShell 5.1 is the standard inbox version on modern Windows builds.

PowerShell version	Support
Windows PowerShell 4.0	Supported
Windows PowerShell 5.0	Supported
Windows PowerShell 5.1	Supported — common inbox version on Windows Server 2016, 2019, 2022, and Windows 10/11
PowerShell 7.x	Validate separately in your environment before relying on it for production investigations

Note: This guide covers the Windows PowerShell Operational log. If you use PowerShell 7.x, validate collection behavior in a lab before treating it as in-scope.