You enable and configure PowerShell Script Block Logging.
You need to view which script blocks were executed by using Windows PowerShell scripts.
What should you do?
A.
View the Microsoft-Windows-PowerShell/Operational event log.
B.
Open the log files in %LocalAppData%\\Microsoft\\Windows\\PowerShell.
C.
View the Windows PowerShell event log.
D.
Open the log files in %SYSTEMROOT%\\Logs.
Explanation:
https://docs.microsoft.com/en-us/powershell/wmf/5.0/audit_script
After you enable detailed script tracing, Windows PowerShell logs all script blocks to the event log, MicrosoftWindows-PowerShell/Operational.
correct answer is C
from book :
script block logging does not record the output
generated by the executed code. Logs are recorded as events in the Windows
PowerShell event log.
0
3
You are correct about not logging the output when enabling the “PowerShell Script Block Logging”.
but that’s not the question in this case. The actual code that get’s executed is recorderd in Microsoft-Windows-PowerShell/Operational. So the correct answer is indeed A.
When you want to record the output aswell, make sure you enable the policy “Turn on Module Logging”. That way, the output of powershell is recorded in the Powershell Event Log. (And also Microsoft-Windows-PowerShell/Operational)
2
1