Enable PowerShell Transcription to Log Administrative Commands in Windows 10/11

PowerShell Transcription can automatically record the commands typed and the console output displayed in each Windows PowerShell 5.1 session, including elevated administrative sessions. On Windows 10 and Windows 11, enable the Turn on PowerShell Transcription policy under Computer Configuration, then open a new PowerShell window to begin logging. This guide covers Windows 10 and Windows 11; the relevant Local Group Policy Editor path is the same on both versions. It also explains how to cover PowerShell 7 (pwsh) and how to configure systems without Local Group Policy Editor.

Prerequisites and compatibility​

• Supported client versions: Windows 10 and Windows 11.
• Built-in host covered by the main procedure: Windows PowerShell 5.1 (powershell.exe), which is included with Windows 10 and Windows 11.
• PowerShell 7: Requires its separate PowerShell Core administrative templates if you want policy-managed transcription for pwsh.
• Local Group Policy Editor: Normally available in Windows Pro, Enterprise, and Education editions. Windows Home does not normally include gpedit.msc; use the registry method later in this guide instead.
• Permissions: You must be signed in with an administrator account to configure a computer policy.
• Restart requirement: No Windows restart is required. Existing PowerShell sessions should be closed and reopened after the policy is refreshed.

Important security warning: Transcripts capture commands and console output. Do not assume they are safe to share. A transcript can contain usernames, server names, file paths, command output, or secrets inadvertently displayed by a command or script. Store logs only in a location that administrators and approved auditors can access.

Important scope warning: Computer Configuration applies to PowerShell sessions for users of that computer, not only to administrators. It is useful for broad device auditing, but it also creates logs for non-administrative PowerShell use. If you must target only particular administrators, use a domain Group Policy Object with appropriate security filtering rather than a local computer policy.

Enable transcription for Windows PowerShell 5.1​

1. Decide where transcript files will be stored​

The safest starting point is to leave the policy’s output directory blank. Windows PowerShell will then write each user’s transcripts to that user’s Documents folder, using names similar to:
PowerShell_transcript.DESKTOP-123ABC.random.20260720.txt
This keeps one user’s logs separate from another user’s documents.
If you need centralized local storage, create a protected folder first, such as:
C:\PowerShellTranscripts
Do not use a broadly writable or publicly readable folder such as C:\Temp, the Desktop, Downloads, or a shared drive with open permissions.

Warning — shared or centralized storage: If you set a common output directory, every affected PowerShell session must be able to create its own transcript there. At the same time, ordinary users should not be able to browse, alter, or delete other users’ transcripts. Incorrect NTFS or share permissions can expose sensitive command output or cause transcription to fail. For a first deployment, use the default per-user Documents location and validate the logs before moving to centralized storage.

2. Open Local Group Policy Editor​

Use the method appropriate to the Windows interface:
Windows 11

• Select Start.
• Type gpedit.msc.
• Select Edit group policy.
• Approve the User Account Control prompt if it appears.

Windows 10

• Select Start.
• Type gpedit.msc.
• Select Edit group policy.
• Approve the User Account Control prompt if it appears.

You can also press Windows key + R, type:
gpedit.msc
and select OK.

3. Navigate to the Windows PowerShell transcription policy​

In Local Group Policy Editor, expand this path:

Computer Configuration
  > Administrative Templates
    > Windows Components
      > Windows PowerShell

Select Windows PowerShell, then double-click Turn on PowerShell Transcription in the right pane.
Use Computer Configuration for device-wide logging. A matching setting exists under User Configuration, but a Computer Configuration setting takes precedence when both are configured.

4. Enable the policy and choose the logging options​

In the Turn on PowerShell Transcription policy window:

• Select Enabled.
• Leave Transcript output directory blank to use each user’s Documents folder.
  Or, if you have already created and secured a dedicated directory, enter its full local path, for example:
  C:\PowerShellTranscripts
• Select Include invocation headers.
  Invocation headers add timing information for commands, which makes a long transcript more useful during review.
• Select Apply.
• Select OK.

Expected result: The policy now directs new Windows PowerShell sessions to create text transcripts automatically. The policy behaves similarly to automatically running Start-Transcript when each PowerShell session starts.

5. Refresh Group Policy​

Open Command Prompt or Windows PowerShell as administrator, then run:
gpupdate /target:computer /force
Wait for the confirmation that computer policy was updated successfully.
A restart is not required. However, close every currently open Windows PowerShell window. Policy-driven transcription begins when a new PowerShell session starts; an already-running session is not a reliable test of the new setting.

6. Open a new elevated Windows PowerShell session​

• Select Start.
• Type Windows PowerShell.
• Select Run as administrator.
• Approve the User Account Control prompt.
• Run a few harmless administrative commands:

Get-Date
whoami
Get-Service | Select-Object -First 5

• Close the PowerShell window by running:

exit
Expected result: A new .txt transcript is created when the session starts and is finalized when the session closes.

Verify that transcription is working​

1. Confirm the policy registry values​

Open a new elevated Windows PowerShell window and run:
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription'
A configured computer policy should show values similar to:

EnableTranscripting     : 1
EnableInvocationHeader  : 1
OutputDirectory         : C:\PowerShellTranscripts

OutputDirectory is absent when you left the transcript output directory blank. The unusual spelling EnableTranscripting is intentional and is the policy’s actual registry value name.

2. Locate the transcript file​

If you left the output directory blank, run:

Get-ChildItem "$HOME\Documents\PowerShell_transcript*.txt" |
    Sort-Object LastWriteTime -Descending |
    Select-Object -First 5 Name, LastWriteTime, Length

To open the newest transcript in Notepad:

$log = Get-ChildItem "$HOME\Documents\PowerShell_transcript*.txt" |
    Sort-Object LastWriteTime -Descending |
    Select-Object -First 1

notepad $log.FullName

If you configured C:\PowerShellTranscripts, use:

Get-ChildItem 'C:\PowerShellTranscripts' |
    Sort-Object LastWriteTime -Descending |
    Select-Object -First 5 Name, LastWriteTime, Length

3. Review the expected contents​

The transcript should show:

• The session start time and host information.
• The account that opened the session.
• The commands entered, such as Get-Date and Get-Service.
• The output displayed by those commands.
• Invocation timing details when Include invocation headers was selected.
• A transcript end entry after PowerShell exits.

Do not edit the original transcript while validating it. Editing a local text file makes it unsuitable as evidence of an unchanged record.

Enable policy-managed transcription for PowerShell 7​

PowerShell 7 (pwsh.exe) is separate from the inbox Windows PowerShell 5.1 engine. The Windows PowerShell policy configured above is the correct setting for powershell.exe; do not assume it automatically configures every PowerShell 7 installation.
To configure PowerShell 7 through Group Policy:

• Open PowerShell 7 as administrator.
• Check whether the PowerShell Core policy files are present:
  Get-ChildItem -Path $PSHOME -Filter '*Core*Policy*'
• If InstallPSCorePolicyDefinitions.ps1 is listed, run:
  & "$PSHOME\InstallPSCorePolicyDefinitions.ps1"
• Close and reopen Local Group Policy Editor.
• Go to:
  

  Computer Configuration
    > Administrative Templates
      > PowerShell Core

• Open Turn on PowerShell Transcription.
• Select Enabled.
• Select Use Windows PowerShell Policy setting if you want PowerShell 7 to use the same configuration already defined under Windows Components > Windows PowerShell.
• Select Apply, then OK.
• Refresh policy:
  gpupdate /target:computer /force
• Close and reopen PowerShell 7, then test:
  

  Get-Date
  $PSVersionTable.PSVersion
  exit

Expected result: A separate transcript is produced for the new pwsh session according to the configured PowerShell Core policy.

Alternate method: configure Windows PowerShell transcription on Windows Home​

Use this method only when Local Group Policy Editor is unavailable. It configures the same Windows PowerShell 5.1 computer-policy registry location used by the Group Policy setting.

Warning — registry change: Incorrect registry edits can affect policy processing or other Windows PowerShell settings. Enter the commands exactly as shown. This procedure changes only the Transcription policy subkey and includes a direct rollback command.

• Open Windows PowerShell as administrator.
• If the Transcription key already exists, export it before changing anything:
  reg export 'HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription' "$env:USERPROFILE\Desktop\PowerShell-Transcription-backup.reg" /y
  If Windows reports that the key cannot be found, continue; it means no transcription policy key currently exists.
• Create the policy key and enable transcription with invocation headers:
  

  $key = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription'
  
  New-Item -Path $key -Force | Out-Null
  New-ItemProperty -Path $key -Name EnableTranscripting -PropertyType DWord -Value 1 -Force | Out-Null
  New-ItemProperty -Path $key -Name EnableInvocationHeader -PropertyType DWord -Value 1 -Force | Out-Null

• To use the default per-user Documents location, do not add an output directory value.
  To specify a protected local directory instead, first create and secure the directory, then run:
  New-ItemProperty -Path $key -Name OutputDirectory -PropertyType String -Value 'C:\PowerShellTranscripts' -Force | Out-Null
• Close every Windows PowerShell window.
• Open a new elevated Windows PowerShell window and perform the verification steps above.

Troubleshooting and rollback​

No transcript is created​

Check that you tested with a new powershell.exe session after refreshing policy. Existing windows may have started before the setting was applied.
Confirm the policy values:
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription'
If EnableTranscripting is not 1, reopen the policy and confirm Enabled was selected, then run:
gpupdate /target:computer /force
Also verify that you are checking the right location:

• Blank output directory: $HOME\Documents
• Configured output directory: the exact path entered in the policy
• PowerShell 7: verify that the separate PowerShell Core policy was configured

A transcript warning or access-denied error appears at PowerShell startup​

The configured output directory is unavailable or the current user cannot create files there.
Check that the directory exists:
Test-Path 'C:\PowerShellTranscripts'
Check its permissions:
Get-Acl 'C:\PowerShellTranscripts' | Format-List
For a quick recovery, edit Turn on PowerShell Transcription, clear the Transcript output directory field, apply the change, run gpupdate /force, and start a new PowerShell session. Transcripts will return to each user’s Documents folder.

The policy works in Windows PowerShell but not in pwsh​

This is expected unless PowerShell 7 policy templates and the PowerShell Core transcription policy have been configured. Use the PowerShell 7 procedure above. Confirm which host you are testing:

$PSVersionTable.PSEdition
$PSVersionTable.PSVersion

Desktop normally indicates Windows PowerShell 5.1; Core indicates PowerShell 7.

Users can read or delete other users’ centralized transcripts​

Treat this as a security issue. Immediately stop using the shared folder by clearing Transcript output directory in the policy, refreshing Group Policy, and returning to per-user Documents storage while you correct the folder’s NTFS and share permissions.
For centralized logging, grant write capability only to identities that must generate logs, grant read access only to administrators or auditors, and ensure users cannot browse or alter records created by other users. For stronger protection against local administrator tampering, send transcripts to a managed central location with separate audit controls rather than relying solely on a local folder.

PowerShell or a management console becomes noticeably slower​

Transcription writes output to disk, so commands that produce large amounts of output can take longer. This is especially relevant for management tools that invoke many PowerShell commands in the background.
First, test with the output directory left blank or moved from a network share to a fast local protected drive. If performance remains unacceptable, disable the policy temporarily:

• Open Turn on PowerShell Transcription.
• Select Disabled.
• Select Apply, then OK.
• Run:
  gpupdate /target:computer /force
• Close and reopen PowerShell or the affected management application.

Roll back the configuration completely​

For the Group Policy method:

• Return to:
  

  Computer Configuration
    > Administrative Templates
      > Windows Components
        > Windows PowerShell

• Open Turn on PowerShell Transcription.
• Select Not Configured.
• Select Apply, then OK.
• Run:
  gpupdate /target:computer /force
• Close and reopen PowerShell windows.

For the registry method, run this in an elevated Windows PowerShell session:
Remove-Item 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription' -Recurse -Force
Then close all PowerShell sessions and open a new one. If you exported a prior configuration, restore it by double-clicking the saved .reg file and approving the prompts.