01Fields in the event
The cited Microsoft page does not list field names for this event.
02How to use it
Recovers the actual code run, including code that was decoded or generated at run time. Reassemble long scripts split across several events using the script block ID, and correlate with 4688 for the powershell.exe process.
03Caveats
Must be enabled by Group Policy or registry. With Protected Event Logging the content is encrypted and needs the private key to read.
05Sources
- Microsoft Learn — about_Logging (Windows PowerShell 5.1) checked 2026-10-18