Securing Windows Server 2016 — Question 176

Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1.
On Server1, administrators plan to use several scripts that have the .ps1 extension.
You need to ensure that when code is generated from the scripts, an event containing the details of the code is logged in the Operational log.
Which Group Policy setting or settings should you configure?

Answer options

• A. Audit Process Creation and Audit Process Termination
• B. Turn on PowerShell Transcription
• C. Enable Protected Event Logging
• D. Turn on PowerShell Script Block Logging

Correct answer: D

Explanation

The correct answer is D, as enabling PowerShell Script Block Logging allows detailed logging of script execution, including the code generated from scripts. Option A focuses on auditing process creation and termination, which does not log script details. Option B, while useful for logging commands, does not capture the detailed event data required. Option C relates to securing event logs but does not pertain specifically to script execution logging.