Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. winevt
  5. Logs
  6. Microsoft-Windows-PowerShell%4Operational.evtx
LogRisk: Caution

Microsoft-Windows-PowerShell%4Operational.evtx C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx

PowerShell%4Operational.evtx: the log of what Windows PowerShell executed (script blocks 4104, modules 4103). The source for which code ran.

Updated on By AltF4 Formation

What it’s for

Microsoft-Windows-PowerShell/Operational answers the question “which PowerShell code ran on this machine?”. It complements the Security log (which sees processes, not the script) and the console history. Its neighbor Windows PowerShell.evtx only traces the life cycle of the engine, without the content, so this is where you read the scripts. PowerShell 7 writes to a separate log, PowerShellCore/Operational.

What it contains

  • Event 4104: the text of executed script blocks. A long script is split across several events. PowerShell automatically logs some blocks it considers suspicious at Warning level, even when the feature is not enabled.
  • Event 4103: pipeline execution and parameter binding, if module logging is on.
  • Events 4100 (execution errors), 4105 and 4106 (start and end of each block, if enabled), 40961 and 40962 (console startup).

Full logging is turned on through Group Policy: “Turn on PowerShell Script Block Logging” and “Turn on Module Logging”. Transcription is a separate mechanism that produces text files.

Risks and best practices

  • Scripts often contain passwords, tokens or server names in clear text, so treat the log and its copies as sensitive.
  • It is evidence in an investigation. Send it to a SIEM or an event collector before any purge, and raise its maximum size if script block logging is active.
  • No events does not mean no activity: first check that the policy is actually applied.

Useful commands

Fenêtre de terminal
# Latest logged script blocks (as administrator)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} -MaxEvents 20 |
    Select-Object TimeCreated, Id, LevelDisplayName, Message


# Look for common obfuscation or download patterns
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} |
    Where-Object { $_.Message -match 'FromBase64String|DownloadString|Invoke-Expression' } | Select-Object -First 20 TimeCreated, Message


# Is script block logging enforced by policy?
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -ErrorAction SilentlyContinue


# Log configuration (size, retention, state)
wevtutil gl "Microsoft-Windows-PowerShell/Operational"

Format

Binary XML file (.evtx). The “/” in the log name becomes “%4” in the file name.

Rotation and archiving

The maximum size and the behavior when full (overwrite the oldest, or archive) are set in the log properties or through Group Policy. wevtutil epl exports the log to an .evtx file for archiving.

How to read it

Event Viewer > Applications and Services Logs > Microsoft > Windows > PowerShell > Operational. Filter by ID (4104, 4103) or search the text for a keyword with Get-WinEvent then Where-Object { $_.Message -match 'pattern' }.

Report a mistake