4

I'm using PsExec to run PowerShell scripts on remote machines and as a side effect of this, the "Windows PowerShell" event-log (found in the Event Viewer under "Applications and Services Logs") is logging all of our arguments to the script under "HostApplication". This is a problem because some of these arguments contain sensitive passwords.

I've tried setting the preference variables listed below to false but it will still create logs when the PowerShell engine starts. From what I've read this is because PowerShell creates these logs before it even checks the value of these preference variables.

$LogEngineLifeCycleEvent=$false;
$LogEngineHealthEvent=$false;
$LogProviderLifeCycleEvent=$false;
$LogProviderHealthEvent=$false;

Our current solution uses these preference variables in combination with putting the following line at the beginning of each of our PowerShell scripts to make sure that the logs created when the PowerShell engine starts are wiped away.

Clear-EventLog "Windows PowerShell";

This solution is ok, but I'd like to get it to a point where our passwords are never being saved in the log and the log never needs to be cleared. Is there any way to disable PowerShell logging so that events won't be created at ANY point in the PowerShell engine life cycle?

1

I think the following Local Group Policies are what you need, particularly the second:


Turn on Module Logging

If you disable this policy setting, logging of execution events is disabled for all Windows PowerShell modules. Disabling this policy setting for a module is equivalent to setting the LogPipelineExecutionDetails property of the module to False.


Turn on PowerShell Block Logging

This policy setting enables logging of all PowerShell script input to the Microsoft-Windows-PowerShell/Operational event log. If you enable this policy setting, Windows PowerShell will log the processing of commands, script blocks, functions, and scripts - whether invoked interactively, or through automation.

If you disable this policy setting, logging of PowerShell script input is disabled.


  1. Press Win+R
  2. Type gpedit.msc
  3. Go to Computer Configuration -> Administrative Templates -> Windows Components -> Windows PowerShell

  1. Then configure the settings explained above
  • This is useful because I didn't even know about this other PowerShell log, but it didn't solve my original problem. My issue is not with the Operation log but with the "Windows PowerShell" log that's directly in the "Applications and Services Logs" folder. – Bob P Sep 30 '15 at 15:15
-2

I had the same issue and wrote this function to delete the event log.

Function Remove-PowerShellEventLog {
    Write-ToLog -Message 'Remove the PowerShell event log'
    # Function constants
    $PowerShellKey = 'SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell'
    $Admins = 'BUILTIN\Administrators'
    $ReadWriteSubTree = [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree
    $TakeOwnership = [System.Security.AccessControl.RegistryRights]::TakeOwnership
    $ChangePermissions = [System.Security.AccessControl.RegistryRights]::ChangePermissions

    # Define a C# type using P/Invoke and add it
    # Code borrowed from https://www.remkoweijnen.nl/blog/2012/01/16/take-ownership-of-a-registry-key-in-powershell/
    $Definition = @"
    using System;
    using System.Runtime.InteropServices; 

    namespace Win32Api
    {

        public class NtDll
        {
            [DllImport("ntdll.dll", EntryPoint="RtlAdjustPrivilege")]
            public static extern int RtlAdjustPrivilege(ulong Privilege, bool Enable, bool CurrentThread, ref bool Enabled);
        }
    }
"@
    Add-Type -TypeDefinition $Definition -PassThru

    # Enable SeTakeOwnershipPrivilege
    $Res = [Win32Api.NtDll]::RtlAdjustPrivilege(9, $True, $False, [ref]$False)

    # Open the registry key with Take Ownership rights and change the owner to Administrators
    $Key = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("$PowerShellKey\PowerShell", $ReadWriteSubTree, $TakeOwnership)
    $Acl = $Key.GetAccessControl()
    $Acl.SetOwner([System.Security.Principal.NTAccount]$Admins)
    $Key.SetAccessControl($Acl)

    # Re-open the key with Change Permissions rights and grant Administrators Full Control rights
    $Key = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("$PowerShellKey\PowerShell", $ReadWriteSubTree, $ChangePermissions)
    $Acl = $Key.GetAccessControl()
    $Rule = New-Object System.Security.AccessControl.RegistryAccessRule ($Admins, 'FullControl', 'Allow')
    $Acl.SetAccessRule($Rule)
    $Key.SetAccessControl($Acl)

    # Remove the parent and subkeys
    Remove-Item -Path "HKLM:\$PowerShellKey" -Force -Recurse

    # Restart the Event Log service to enforce changes
    Restart-Service EventLog -Force
}
  • 5
    OP is already clearing the event log, with a far simpler snippet. And with all of what's going on in there (RtlAdjustPrivilege? Setting registry key ownership? Really?), I wouldn't dare run this on any system without a careful review of the code. So you are at best essentially providing far more complex code to do exactly what the OP was doing, but where the OP was asking for a solution that doesn't involve doing any of this... At the very least, you should edit this to describe just what the code is doing and why. – a CVn Feb 24 '17 at 18:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.