🎯 Purpose

✅ Record PowerShell activity and the full command line of every new process on Windows devices, meeting Essential Eight – User Application Hardening (Maturity Level 2).

➡️ Gives security teams the evidence they need to detect and investigate script‑based attacks.

👥 Who is affected

✅ Devices: All Windows 10 / 11 devices
🚫 Exclusions: None

☁️ What is protected

✅ PowerShell sessions, modules and scripts
✅ Process creation events (Security event 4688)
✅ Type: Settings catalog

🔐 How logging is enforced

Setting	Value
Turn on PowerShell Script Block Logging	Enabled (invocation start/stop logging off, to limit noise)
Turn on Module Logging	Enabled – Module names: `*` (all modules)
Turn on PowerShell Transcription	Enabled – invocation headers on; default output folder (user's Documents)
Audit Process Creation	Success
Include command line in process creation events	Enabled

➡️ Every PowerShell script block and module call is logged, and every new process records its full command line in event 4688.

ℹ️ Note: Transcripts are written to the user's Documents folder by default. Point Transcript output directory to a protected network share if one is available.

⚙️ What this policy does NOT enforce

🚫 Forwarding logs to a SIEM (centralised collection must be configured separately, for example with Microsoft Sentinel or Defender for Endpoint)
🚫 PowerShell Constrained Language Mode
🚫 Removal of PowerShell 2.0 (see E8-User Application Hardening- Feature Removal PS2.0)

🟢 Policy status

✅ Enabled
✅ Assigned to all devices

📘 Essential Eight Alignment

✅ PowerShell module logging, script block logging and transcription events are logged (ISM‑1623)
✅ Command line process creation events are logged (ISM‑1889)
ℹ️ Applies to Maturity Levels 2 and 3. Both controls require the events to be centrally logged, so pair this policy with log collection.

📘 Practical Interpretation (Executive‑Friendly)

This policy ensures that:

✅ Attackers using PowerShell or command‑line tools leave a clear record
✅ Investigators can see exactly what was run, and when

This turns Windows devices into a reliable source of security evidence.