PowerShell Auditing & Security Controls

PowerShell security configurations, Script Block Logging (Event ID 4104), Constrained Language Mode, and AMSI protection.

Core Purpose & Operating Context

Configure enterprise PowerShell logging, enforce language constraints, and audit script block telemetry.

01.

Audit & Configuration Cmdlets

Verify security controls on the local host.

Check language mode (FullLanguage vs ConstrainedLanguage)

$$ExecutionContext.SessionState.LanguageMode

Inspect recent script block logs (EID 4104 records full script content)

$Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} -MaxEvents 5

View ExecutionPolicy at MachinePolicy, UserPolicy, Process, and LocalMachine scopes

$Get-ExecutionPolicy -List

•

PowerShell ExecutionPolicy is a safety check to prevent accidental execution, NOT a security boundary.

•

Enabling Script Block Logging captures code after de-obfuscation right before execution by the PowerShell engine.