Lockdown Lab #25 CRITICAL Windows Server

Enable PowerShell script block logging

Enable PowerShell script block logging

Attackers live in PowerShell. Your incident response team will be blind without proper logging. This is how you catch them before they pivot from initial access to full compromise.

Every major attack I’ve investigated involved PowerShell. Empire, Cobalt Strike, PowerSploit – these tools abuse PowerShell for execution, data exfiltration, and lateral movement. Without script block logging, these actions often vanish into thin air.

The critical piece here is capturing the decoded content. Obfuscation is a standard attacker tactic. Script Block Logging strips that away, giving you the actual commands executed. It’s a basic control, yet shockingly, many organizations still miss it.

Here’s how to enable it:

New-Item -Path “HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging” -Force Set-ItemProperty -Path “HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging” -Name “EnableScriptBlockLogging” -Value 1

If you’re not doing this, you’re giving attackers a free pass. Implement this today.

The fix

# GPO: Computer Configuration → Administrative Templates →

# Windows Components → Windows PowerShell

# → "Turn on PowerShell Script Block Logging" = Enabled

# Registry:

New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Force

Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1

Reference: CIS Windows Server Benchmark 18.9.100

Mark this as done

Open the interactive hardening checklist and tick this off in your environment.

Open interactive checklist →

Related Posts

Disable SMBv1

WannaCry, NotPetya, EternalBlue. These aren't ancient history; they're a stark reminder of what happens when you leave an ancient, vulnerable protocol like SMBv1 enabled. It's...

lockdown-labhardeningwindowsnetwork
/Shimi Cohen

Disable SMBv1

WannaCry, NotPetya, EternalBlue. If those names don't send a shiver down your spine, you've been lucky. The common thread? SMBv1. This isn't ancient history; it's...

lockdown-labhardeningwindowsnetwork
/Shimi Cohen

Enable Windows Firewall on all profiles

How many times have I seen "unauthorized access" turn out to be a lack of basic perimeter control? Far too many. If your Windows Servers...

lockdown-labhardeningwindowsnetwork
/Shimi Cohen