PowerShellTranscripts
PowerShell Transcripts
- 6 paths
PowerShell_transcript.*.txt- Per-user data
- Version 1.2
- Andrew Rathbun and Chad Tilbury
Paths on disk
6 paths
Notes
These logs appear when auditing is turned on via Group Policy or Start-Transcript is used during PowerShell execution
As more locations are observed, they will be added here
Example location: C:\Users\USERNAME\Documents\20220301\PowerShell_transcript.DEVICENAME.qp9EOTN2.20220301132612.txt
Example location 2: C:\PSTranscript\20250311\PowerShell_transcript.DEVICENAME.1234AbCd.20250311212612.txt
References
5 links
- learn.microsoft.com/en-us/powershell/module/microsoft.powershell.host/start-transcript(opens in new tab)
- lazyadmin.nl/powershell/start-transcript/(opens in new tab)
- stigviewer.com/stig/windows_10/2021-03-10/finding/V-230220(opens in new tab)
- itprotoday.com/powershell/how-use-automatic-powershell-transcription(opens in new tab)
- artefacts.help/windows_powershell_transcript.html(opens in new tab)