Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Users
  3. <utilisateur>
  4. AppData
  5. Roaming
  6. Microsoft
  7. Windows
  8. PowerShell\PSReadLine\ConsoleHost_history.txt
FileRisk: Caution

PowerShell\PSReadLine\ConsoleHost_history.txt C:\Users\<utilisateur>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

ConsoleHost_history.txt: the PowerShell console command history kept by PSReadLine, one command per line, in clear text. It can hold secrets.

Updated on By AltF4 Formation

What it’s for

ConsoleHost_history.txt is the history file of PSReadLine, the module that handles line editing in the PowerShell console. It is what brings back commands from earlier sessions when you press the up arrow or use reverse search (Ctrl+R). There is one per user profile.

What it contains

The lines typed in the console, one per line, as plain text. By default PSReadLine keeps 4096 entries (MaximumHistoryCount) and writes as you go. The real path is whatever the HistorySavePath setting says, and Get-PSReadLineOption shows it.

Only the console host is covered: PowerShell ISE and Visual Studio Code keep their own history. PSReadLine skips lines that look like they hold a secret, such as those containing password or token, but the filter is crude, so do not rely on it.

Risks and best practices

  • The file is in clear text. Passwords, tokens, server names and paths typed on the command line end up in it, so do not paste it into a ticket.
  • Do not type secrets directly. Get-Credential, Read-Host -AsSecureString or a secret vault leave no trace.
  • On a shared workstation, Set-PSReadLineOption -HistorySaveStyle SaveNothing (in the PowerShell profile) stops the recording, or delete the file on a regular basis.
  • In an investigation it is a good lead but never proof: the user can edit the file. Cross-check it with the PowerShell Operational log and the security logs.

Useful commands

Fenêtre de terminal
# History location and settings
Get-PSReadLineOption | Select-Object HistorySavePath, HistorySaveStyle, MaximumHistoryCount


# Last recorded commands
Get-Content -Path (Get-PSReadLineOption).HistorySavePath -Tail 20


# Search for a command (for example Get-Service)
Select-String -Path (Get-PSReadLineOption).HistorySavePath -Pattern 'Get-Service'


# Clear the current user's history: simulate first with -WhatIf
Remove-Item -Path (Get-PSReadLineOption).HistorySavePath -WhatIf

Report a mistake