True history of all powershell commands run on a system RRS feed

  • Question

  • Is it possible to somehow log all commands run on a server via powershell? Not something that is limited by session/user but something that logs everything from all users and all programs that call powershell.
    Thursday, August 7, 2014 8:17 PM


  • Hi Alceryes,

    In addition, I found serveral cmdlets to collect powershell history for your reference, however, which could not meet all the requirements you posted.

    Start-Transcript: this cmdlet can monitor all the cmdlets and all the results across pssessions to a txt file, however, this will not trace powershell when current console closes.

    Get-History and Add-History: this can add your old history (the set of commands saved in .xml file) will be restored to your current history.

    For more detailed information, please also check these articles:

    Using the Add-History Cmdlet

    Use the Export-History PowerShell Function to Save Commands

    If there is anything else regarding this matter, please feel free to post back.

    If you have any feedback on our support, please click here.

    Best Regards,

    Anna Wang

    TechNet Community Support

    • Proposed as answer by Chen VMVP Wednesday, August 13, 2014 10:57 AM
    • Marked as answer by AnnaWYModerator Monday, August 25, 2014 9:27 AM
    Wednesday, August 13, 2014 8:54 AM
  • I doubt this is possible. But that said, by "all commands" do you mean all commands processed by powershell, or just those typed by various users.

    If, for example, a command runs a batch or Powershell script would each of the commands processed by those need to be included?

    I'd suggest you describe your purpose in doing this, as perhaps your needs could be met in other ways.

    Al Dunbar -- remember to 'mark or propose as answer' or 'vote as helpful' as appropriate.

    Thursday, August 7, 2014 9:51 PM

All replies