Windows command-line, script-block and module logging are off by default - which do you enable first?

## The shape of the argument Windows execution telemetry is not a single dial. It is a set of independent switches, each off by default, each with a different cost, and each answering a different question. The interviewer is testing whether you can make the case one switch at a time rather than demanding "turn on all logging" — which is how these requests get refused wholesale. ### Switch one: the command line on process creation Event **4688** requires the *Audit Process Creation* subcategory to be enabled at all, and even then the arguments are a separate setting: *Include command line in process creation events*, under Administrative Templates > System > Audit Process Creation. Until it is on, a 4688 record tells you a program's path and not one thing about what it was asked to do. This is nearly always the first switch, for three reasons. The marginal cost is a longer string on records that are already being written and shipped. The interpretive gain is enormous: an interpreter or a signed system utility is only meaningful with its arguments. And the field is the one most often missing at exactly the moment somebody asks what a process was doing. The real objection is not volume — it is **secrets**. Passwords, tokens and connection strings get passed on command lines by scripts and installers, and once captured they sit in a log that a wide set of people can read. That objection is legitimate and answerable: tighten who can read the log, and treat the collected data as sensitive. (If Sysmon is deployed, its Event ID 1 already carries the command line unconditionally — but Sysmon is an agent with partial rollout, and the native switch covers hosts it has not reached.) ### Switch two: PowerShell script-block logging Script-block logging, enabled by Group Policy, writes event **4104** to `Microsoft-Windows-PowerShell/Operational` and records the **text of each script block as it is compiled**. That is qualitatively different from a command line: - an encoded or heavily obfuscated one-liner appears in its expanded, readable form, because logging happens after decoding; - content that never reached a command line at all — a script pulled from elsewhere and run in memory, a block constructed at runtime — is still recorded; - a large block is split across multiple messages that you have to reassemble. The costs are equally real: this is high volume on script-heavy estates, and it captures whatever the scripts contain, secrets included. Note also that a limited subset of blocks matching suspicious patterns may be recorded at warning level even without the policy — useful, but far too partial to plan around. ### Switch three: module and image-load records Module logging (PowerShell event 4103, pipeline execution detail) and the sensor's **image-load** records — Sysmon Event ID 7, which reports each module loaded into a process together with whether it is signed and by whom — are the verbose end of the spectrum. Their unique value is that they see something no process-creation record can: a legitimate, signed, expected binary loading a module that has no business being there. But an active workstation loads modules constantly, so this is the switch you scope narrowly rather than enable everywhere. ## Making the case Three things carry the argument with a platform team that owns the endpoint configuration: 1. **Anchor on a real past case.** "Last quarter we could not say what this process was told to do, and this specific field is the one that would have said." A concrete unanswered question beats a general appeal to visibility. 2. **Measure before you ask.** Enable on a pilot ring, measure the added bytes per host per day, and bring numbers rather than fears. Volume estimates offered without measurement are the reason these requests lose. 3. **Say what you will not ask for.** Conceding module logging fleet-wide is what makes the command-line request credible. ## The constraint that makes this urgent Enabling a field changes only the future. A field that was off produced no record, and there is nothing to search, reprocess or recover — the absence of evidence is indistinguishable from the absence of activity. That asymmetry is why this is a pre-incident decision, and why the worst version of this story is not a slow investigation but an intrusion that is never explained at all, because the one field that would have carried the answer was never on.