Enabling powershell logging

Content Authoring
1

we are trying to change a local security policy by changing the registry value. The setting to be changed is “Turn on Module Logging” is to be Enabled in Windows powershell of gpedit.msc.

I enabled it manually and checked the registry modification and created a fixlet to do the same modification via windows registry wizard. The registry is getting changed but the change is not reflecting in the gpedit.msc.

Is there any other way to do it?

the action script I used:

action uses wow64 redirection false

delete __createfile
delete wizardedit.reg

createfile until @end_create_reg_file
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging]
“EnableModuleLogging”=“1”

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Powershell\ModuleLogging\ModuleNames]
""=""
@end_create_reg_file

move __createfile wizardedit.reg
waithidden regedit /s “wizardedit.reg”

2

Have you ran gpupdate /force to make the updates sync?

You could maybe do it at the end of your fixlet with a:

waithidden powershell.exe gpupdate /force
1 Like
3

I did it manually and checked. Not working

I tried only gpupade /force. is it necessary to run in powershell?

4

No, you can run it in a cmd prompt too

https://developer.bigfix.com/action-script/reference/registry/ is your best bet for using native action script rather than a registry file given it’s only one key you are changing.

As for why it’s not updating at the group policy level, I’m not entirely sure :frowning:

5

No. Still not working. I tried with native action script

6

Hello @pratik,
try to use this action script and keep attention to the double quote:

action uses wow64 redirection false

delete __createfile
delete wizardedit.reg

createfile until @end_create_reg_file
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging]
“EnableModuleLogging”=“1”

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Powershell\ModuleLogging\ModuleNames]
""=""
@end_create_reg_file

move __createfile wizardedit.reg

waithidden reg import “wizardedit.reg”

7

I’m not sure whether things are getting lost (format scripts when you post them using the </> button) but I believe the value name and contents should be an asterisk, not an empty string

action uses wow64 redirection {not x64 of operating system}

regset64 "[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging]" "EnableModuleLogging"="1"

regset64 "[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Powershell\ModuleLogging\ModuleNames]" "*"="*"
8

I did this in my PS script that logs every thing.

$LOG="C:\TEMP\bftaskFIP_upd.log"
Start-Transcript -Path $LOG
…your ps code…
…

Stop-Transcript

9

Turn On Module logging
Turn On Module logging704×639 28.4 KB

From the above PowerShell script, this policy will be enabled?.

If you have any other script which will enable the “Turn on module logging”. Please send the complete action script.

10

Yes. There is an Asterisk symbol. I have used that. Still not working.

11

Doing a bit of research I believe EnableModuleLogging to be of type DWORD - your original script was setting it to be a string

action uses wow64 redirection {not x64 of operating system}

regset64 "[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging]" "EnableModuleLogging"=dword:00000001

regset64 "[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Powershell\ModuleLogging\ModuleNames]" "*"="*"
12

Thank you for your response. It’s still not working.

13

Please post your full script. Remember to format it with the </> button.

14

image
image945×205 7.01 KB

15

gpupdate…

So what is the group policy for Powershell logging, and why are you no using GPO to enforce the setting(s) you want?

16

In our environment servers are not included in AD. So we need to do it through bigfix.

17

Are the registry values actually being set? It’s not clear to me whether the values are not being applied,or whether they are being applied but not having the effect you want.

18

So what is the purpose of the gpupdate?

19

The Values are being set, but not having the effect I want.

I want the Policy “Turn on module logging” to be set as “Enabled”. in path
"Computer Configuration\ Administrative Templates\ Windows Components\ Windows PowerShell".

20

Someone in this thread suggested to add gpupdate in the script.