script block logging

Script block logging is a security feature in PowerShell that records the content of script blocks executed during a session, helping administrators detect and investigate malicious activity. The tagged content focuses on the removal of Windows PowerShell 2.0 from Windows 11 24H2 and Windows Server 2025, a change that closes a known downgrade vector attackers used to bypass modern defenses like script block logging. Microsoft deprecated PowerShell 2.0 in 2017 and now urges migration to PowerShell 5.1 or 7.x, which include enhanced security features such as script block logging, constrained language mode, and AMSI integration. The removal reduces attack surface and forces enterprises to adopt more secure automation practices.