question

MH-3834 avatar image
0 Votes"
MH-3834 asked ·

after enabling PSLogging, issues to start powershell on W10

Dear all,

I have been looking into securing my W10 device and enable extended logging for Powershell using this link:
https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html

After I have set the parameters in the registry and restarted my client, I am failing to start powershell.

I.e. in the CMD typing "powershell" - which has worked without any issues, I receive:

"the type of object "System.String" can not be converted into "System.String[]".

Once I remove the registry keys from the link again, Powershell starts without any issues.

To my understanding I am just enabling the logging for the modules, etc. - but no script block or simillar.

Would you please assist to have both features (logging and powershell) working?
Thank you very much for your assistance.

windows-server-powershellwindows-10-security
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

RichMatheisen-8856 avatar image
0 Votes"
RichMatheisen-8856 answered ·

Have you tried making only one of the three changes at a time to determine which type of logging is causing the problem?

·
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

MH-3834 avatar image
0 Votes"
MH-3834 answered ·
 # Module Logging
 $RegistryPath = "HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ModuleLogging"
 $Name = "EnableModuleLogging"
 $Value = "1"
 If (!(Test-Path $RegistryPath))  { # Value Doesn't Exist, so create it
     New-Item -Path $RegistryPath -Force | Out-Null
     New-ItemProperty -Path $RegistryPath -Name $Name -Value $Value -PropertyType DWORD -Force | Out-Null}
  Else {
     New-ItemProperty -Path $RegistryPath -Name $Name -Value $Value -PropertyType DWORD -Force | Out-Null}
 $Name = "ModuleNames"
 $Value = "*"
 New-ItemProperty -Path $RegistryPath -Name $Name -Value $Value -PropertyType String -Force | Out-Null
· 1 ·
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

immediately after setting this, powershell can not be started...

same error message as above "the type of object "System.String" can not be converted into "System.String[]".

The Parts with "Transcription" and "Script Block" seem not to cause this issue.

0 Votes 0 ·
MH-3834 avatar image
0 Votes"
MH-3834 answered ·

I would still would like to have some advise, how to proceed from there:

  • to enable the logging to increase security

  • without blocking any powershell

is this just happening on my device or anybody else has the same issues?
Any help is highly appreciated, thank you :)


·
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

IanXue-MSFT avatar image
0 Votes"
IanXue-MSFT answered ·

Hi,

Try creating a new subkey named ModuleNames, not a string value.

 $RegistryPath = "HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ModuleLogging"
 $Name = "EnableModuleLogging"
 $Value = "1"
 If (!(Test-Path $RegistryPath))  { # Value Doesn't Exist, so create it
     New-Item -Path $RegistryPath -Force | Out-Null
     New-ItemProperty -Path $RegistryPath -Name $Name -Value $Value -PropertyType DWORD -Force | Out-Null}
  Else {
     New-ItemProperty -Path $RegistryPath -Name $Name -Value $Value -PropertyType DWORD -Force | Out-Null}
    
 $RegistryPath = "HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames"
 $Name = '*'
 $Value = '*'
 New-Item -Path $RegistryPath
 New-ItemProperty -Path $RegistryPath -Name $Name -Value $Value -PropertyType String 

Best Regards,
Ian Xue
============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

·
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.