I'm currently trying to figure out the best way to configure Windows PowerShell logging, so that

  1. it is secure (Attackers cannot gain sensitive data out of it)
  2. it helps in DFIR (digital forensic and incident response) cases

The CIS Benchmark for Windows 10 (latest is v1.5.0 for release 1803) recommends to completely disable PowerShell logging due to the bad default ACL in Windows, which allows basically everyone to read the logs.

However because I know how valuable such a log can be in a DFIR case, I'd prefer to enable as much logging as possible but secure the access to the logs.

I found a good blog article on the MS technet which describes a way to configure the SDDL (security descriptor definition language): MS Technet Blog: Securing Your PS Operational Logs

Does anyone have experience with PowerShell logging configurations regarding these aspects?

  • 1
    Hilariously, the CIS Benchmarks recommend disabling logging, but the CIS Top 20 recommend turning on logging. Commented Aug 16, 2019 at 18:04
  • I think this can be answered here security.stackexchange.com/questions/180133/…
    – Gaius
    Commented Aug 17, 2019 at 13:22
  • @Gaius No, it is not about how to enable logging in PowerShell, it is about how to properly secure the access to these logs by defining SDDLs etc...
    – Ville
    Commented Aug 21, 2019 at 6:16
  • @Adonalsium Exactly, they recommend disabling it because the default ACL is bad and allows everyone to read the potenitally sensitive content in those logs... That's why I'm trying to sitll enable them but protect them from unauthorized access
    – Ville
    Commented Aug 21, 2019 at 6:18


You must log in to answer this question.

Browse other questions tagged .