Clash Royale CLAN TAG#URR8PPP

View recent remote powershell connections

Is there an event log of some kind that is made when a remote pssession is initiated on a computer? I need to be able to see where a remote session has originated from.

Currently I am running

Get-EventLog -LogName "Windows powershell" -newest 100 | Format-List -Property * | where $_.UserID -eq "username"


But it is not filtering and/or showing remote connections.

1 Answer
1

We are here to help you with code issues. This is really not a code issue, but a understanding of how to set up and where correlate such detail. So, it's potentially a question for another forum.

Anyway, to get you close to what you are after, there are extra steps you need to employ to get such information. More on that in a bit.

Now, once you get this all setup and you write your script to pull / look at such info and you are having issues with that, then post that back here for folks to see what can be done

So, that leads us to here:
There are three general areas for logging available:

• Module Logging
• Script Block Logging
• PowerShell Transcription

If you have not done so, I would advise enabling on PS auditing and script logging for more insight into this use case and well as transcript logging (which can capture all commands / code executed on a host machine). If you set all this up properly, you fist look to the transcript log for details and well as the log name you reference in your post for other details.

Set this enterprise wide via GPO or DSC.

There is lot's of guidance on how to set this up.

For Example:

Audit PowerShell Usage using Transcription and Logging

Get-Command -Name '*transcript*'

CommandType Name Version Source
----------- ---- ------- ------
Cmdlet Get-TRSTranscriptionJob 3.3.234.0 AWSPowerShell
Cmdlet Get-TRSTranscriptionJobList 3.3.234.0 AWSPowerShell
Cmdlet Start-Transcript 3.0.0.0 Microsoft.PowerShell.Host
Cmdlet Start-TRSTranscriptionJob 3.3.234.0 AWSPowerShell
Cmdlet Stop-Transcript 3.0.0.0 Microsoft.PowerShell.Host


https://docs.microsoft.com/en-us/powershell/wmf/5.0/audit_overview

Practical PowerShell Security: Enable Auditing and Logging with DSC

https://blogs.technet.microsoft.com/ashleymcglone/2017/03/29/practical-powershell-security-enable-auditing-and-logging-with-dsc

More New Stuff in PowerShell V5: Extra PowerShell Auditing

Get-Module Microsoft.* | Select Name, LogPipelineExecutionDetails
Get-Module Microsoft.* | ForEach $_.LogPipelineExecutionDetails = $True
(Import-Module ActiveDirectory).LogPipelineExecutionDetails = $True
Get-WinEvent -FilterHashtable @LogName='Windows PowerShell';Id ='800' -MaxEvents 1 | Select -Expand Message


https://learn-powershell.net/2014/08/26/more-new-stuff-in-powershell-v5-extra-powershell-auditing

Investigating PowerShell: Command and Script Logging

https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.