Shell – Disable windows powershell event logging

event-logpowershell

I'm using PsExec to run PowerShell scripts on remote machines and as a side effect of this, the "Windows PowerShell" event-log (found in the Event Viewer under "Applications and Services Logs") is logging all of our arguments to the script under "HostApplication". This is a problem because some of these arguments contain sensitive passwords.

I've tried setting the preference variables listed below to false but it will still create logs when the PowerShell engine starts. From what I've read this is because PowerShell creates these logs before it even checks the value of these preference variables.

$LogEngineLifeCycleEvent=$false;
$LogEngineHealthEvent=$false;
$LogProviderLifeCycleEvent=$false;
$LogProviderHealthEvent=$false;

Our current solution uses these preference variables in combination with putting the following line at the beginning of each of our PowerShell scripts to make sure that the logs created when the PowerShell engine starts are wiped away.

Clear-EventLog "Windows PowerShell";

This solution is ok, but I'd like to get it to a point where our passwords are never being saved in the log and the log never needs to be cleared. Is there any way to disable PowerShell logging so that events won't be created at ANY point in the PowerShell engine life cycle?

Best Answer

I think the following Local Group Policies are what you need, particularly the second:

Turn on Module Logging

If you disable this policy setting, logging of execution events is disabled for all Windows PowerShell modules. Disabling this policy setting for a module is equivalent to setting the LogPipelineExecutionDetails property of the module to False.

Turn on PowerShell Block Logging

This policy setting enables logging of all PowerShell script input to the Microsoft-Windows-PowerShell/Operational event log. If you enable this policy setting, Windows PowerShell will log the processing of commands, script blocks, functions, and scripts - whether invoked interactively, or through automation.

If you disable this policy setting, logging of PowerShell script input is disabled.

  1. Press Win+R
  2. Type gpedit.msc
  3. Go to Computer Configuration -> Administrative Templates -> Windows Components -> Windows PowerShell

  1. Then configure the settings explained above
Related Question