Turn on PowerShell Transcription
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Microsoft Windows 7 or Windows Server 2008 family
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\Windows PowerShell User Configuration\Administrative Templates\Windows Components\Windows PowerShell Description
This policy setting lets you capture the input and output of Windows PowerShell commands into text-based transcripts. If you enable this policy setting, Windows PowerShell will enable transcripting for Windows PowerShell, the Windows PowerShell ISE, and any other applications that leverage the Windows PowerShell engine. By default, Windows PowerShell will record transcript output to each users' My Documents directory, with a file name that includes 'PowerShell_transcript', along with the computer name and time started. Enabling this policy is equivalent to calling the Start-Transcript cmdlet on each Windows PowerShell session. If you disable this policy setting, transcripting of PowerShell-based applications is disabled by default, although transcripting can still be enabled through the Start-Transcript cmdlet. If you use the OutputDirectory setting to enable transcript logging to a shared location, be sure to limit access to that directory to prevent users from viewing the transcripts of other users or computers. Note: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting.
Registry
Software\Policies\Microsoft\Windows\PowerShell\Transcription Software\Policies\Microsoft\Windows\PowerShell\Transcription Value name: EnableTranscripting
Enabled: EnableTranscripting = 1
Disabled: EnableTranscripting = 0
MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/ADMX_PowerShellExecutionPolicy/EnableTranscripting ./User/Vendor/MSFT/Policy/Config/ADMX_PowerShellExecutionPolicy/EnableTranscripting Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
Applying both scopes creates an ambiguous configuration (computer takes precedence over user). Only do this intentionally.
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Turn on PowerShell Transcription
; State: Enabled
; Scope: Computer (HKLM)
; Supported on: At least Microsoft Windows 7 or Windows Server 2008 family
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription]
"EnableTranscripting"=dword:00000001
"OutputDirectory"=""
"EnableInvocationHeader"=dword:00000000More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Turn on PowerShell Transcription
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Microsoft Windows 7 or Windows Server 2008 family
$path = 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'EnableTranscripting' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'OutputDirectory' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'EnableInvocationHeader' -Value 0 -Type DWordIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ADMX_PowerShellExecutionPolicy/EnableTranscripting
Data type: String
Value:
<enabled/>
<data id="OutputDirectory" value=""/>
<data id="EnableInvocationHeader" value="0"/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Turn on PowerShell Transcription
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Microsoft Windows 7 or Windows Server 2008 family
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription' -Name 'EnableTranscripting' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription' -Name 'OutputDirectory' -Expected '' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription' -Name 'EnableInvocationHeader' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Turn on PowerShell Transcription
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Microsoft Windows 7 or Windows Server 2008 family
$path = 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'EnableTranscripting' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'OutputDirectory' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'EnableInvocationHeader' -Value 0 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Turn on PowerShell Transcription
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Microsoft Windows 7 or Windows Server 2008 family
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Turn on PowerShell Transcription
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Microsoft Windows 7 or Windows Server 2008 family
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription' -Name 'EnableTranscripting' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription' -Name 'OutputDirectory' -Expected '' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription' -Name 'EnableInvocationHeader' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Turn on PowerShell Transcription
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Microsoft Windows 7 or Windows Server 2008 family
$path = 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'EnableTranscripting' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'OutputDirectory' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'EnableInvocationHeader' -Value 0 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.