Turn on PowerShell Script Block Logging: kayıt defteri değeri EnableScriptBlockLogging ve 1 tane dahaBilgisayarHKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging

Bu dilde resmi metin yok (İngilizce özgün metin gösteriliyor)

İlke Kimliği: EnableScriptBlockLogging
Kapsam: Bilgisayar Yapılandırması, Kullanıcı Yapılandırması
Desteklenen işletim sistemleri: At least Microsoft Windows 7 or Windows Server 2008 family
Kaynak: Administrative Templates (.admx) for Windows 11 2026 Update (26H2) (sürüm 1.0)
Kategori: Windows Bileşenleri › Windows PowerShell

This policy setting enables logging of all PowerShell script input to the Microsoft-Windows-PowerShell/Operational event log. If you enable this policy setting,
Windows PowerShell will log the processing of commands, script blocks, functions, and scripts - whether invoked interactively, or through automation.

If you disable this policy setting, logging of PowerShell script input is disabled.

If you enable the Script Block Invocation Logging, PowerShell additionally logs events when invocation of a command, script block, function, or script
starts or stops. Enabling Invocation Logging generates a high volume of event logs.

Note: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting.

Açıklamanın tamamını Grup İlkesi sayfasında gör ›

Kayıt defteri

EnableScriptBlockLogging

REG_DWORDBilgisayarKullanıcı

…\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLoggingHKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging Geçerli anahtar
HKCU\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging

Etkin değeri: 1
Devre dışı değeri: 0

.reg · CMD · PowerShell ile uygula

BilgisayarMakine genelinde ayar

.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging]

; Seçenekler (yalnızca birini kullanın)
; Etkin
"EnableScriptBlockLogging"=dword:00000001
; Devre Dışı
"EnableScriptBlockLogging"=dword:00000000

CMD

:: Seçenekler (yalnızca birini kullanın)

:: Etkin
reg add "HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v "EnableScriptBlockLogging" /t REG_DWORD /d 1 /f
:: Devre Dışı
reg add "HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v "EnableScriptBlockLogging" /t REG_DWORD /d 0 /f

PowerShell

# Ortak: anahtarı oluştur
New-Item -Path 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Force | Out-Null

# Seçenekler (yalnızca birini kullanın)
# Etkin
New-ItemProperty -Path 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name 'EnableScriptBlockLogging' -PropertyType DWord -Value 1 -Force | Out-Null
# Devre Dışı
New-ItemProperty -Path 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name 'EnableScriptBlockLogging' -PropertyType DWord -Value 0 -Force | Out-Null

KullanıcıHesap başına ayar

.reg

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging]

; Seçenekler (yalnızca birini kullanın)
; Etkin
"EnableScriptBlockLogging"=dword:00000001
; Devre Dışı
"EnableScriptBlockLogging"=dword:00000000

CMD

:: Seçenekler (yalnızca birini kullanın)

:: Etkin
reg add "HKCU\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v "EnableScriptBlockLogging" /t REG_DWORD /d 1 /f
:: Devre Dışı
reg add "HKCU\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v "EnableScriptBlockLogging" /t REG_DWORD /d 0 /f

PowerShell

# Ortak: anahtarı oluştur
New-Item -Path 'HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Force | Out-Null

# Seçenekler (yalnızca birini kullanın)
# Etkin
New-ItemProperty -Path 'HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name 'EnableScriptBlockLogging' -PropertyType DWord -Value 1 -Force | Out-Null
# Devre Dışı
New-ItemProperty -Path 'HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name 'EnableScriptBlockLogging' -PropertyType DWord -Value 0 -Force | Out-Null

EnableScriptBlockInvocationLogging

REG_DWORDBilgisayarKullanıcı

İşaretli: 1
İşaretsiz: 0
Öğe: Log script block invocation start / stop events:
Değer türü: REG_DWORD

.reg · CMD · PowerShell ile uygula

BilgisayarMakine genelinde ayar

.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging]

; Seçenekler (yalnızca birini kullanın)
; İşaretli
"EnableScriptBlockInvocationLogging"=dword:00000001
; İşaretsiz
"EnableScriptBlockInvocationLogging"=dword:00000000

CMD

:: Seçenekler (yalnızca birini kullanın)

:: İşaretli
reg add "HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v "EnableScriptBlockInvocationLogging" /t REG_DWORD /d 1 /f
:: İşaretsiz
reg add "HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v "EnableScriptBlockInvocationLogging" /t REG_DWORD /d 0 /f

PowerShell

# Ortak: anahtarı oluştur
New-Item -Path 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Force | Out-Null

# Seçenekler (yalnızca birini kullanın)
# İşaretli
New-ItemProperty -Path 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name 'EnableScriptBlockInvocationLogging' -PropertyType DWord -Value 1 -Force | Out-Null
# İşaretsiz
New-ItemProperty -Path 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name 'EnableScriptBlockInvocationLogging' -PropertyType DWord -Value 0 -Force | Out-Null

KullanıcıHesap başına ayar

.reg

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging]

; Seçenekler (yalnızca birini kullanın)
; İşaretli
"EnableScriptBlockInvocationLogging"=dword:00000001
; İşaretsiz
"EnableScriptBlockInvocationLogging"=dword:00000000

CMD

:: Seçenekler (yalnızca birini kullanın)

:: İşaretli
reg add "HKCU\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v "EnableScriptBlockInvocationLogging" /t REG_DWORD /d 1 /f
:: İşaretsiz
reg add "HKCU\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v "EnableScriptBlockInvocationLogging" /t REG_DWORD /d 0 /f

PowerShell

# Ortak: anahtarı oluştur
New-Item -Path 'HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Force | Out-Null

# Seçenekler (yalnızca birini kullanın)
# İşaretli
New-ItemProperty -Path 'HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name 'EnableScriptBlockInvocationLogging' -PropertyType DWord -Value 1 -Force | Out-Null
# İşaretsiz
New-ItemProperty -Path 'HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name 'EnableScriptBlockInvocationLogging' -PropertyType DWord -Value 0 -Force | Out-Null