How to Enable PowerShell Transcription with Group Policy
Applies to: Windows Server 2019, 2022 and 2025.
Transcription records commands and output for troubleshooting and accountability. Output can contain secrets, so storage needs strict ACLs and retention.
Automation magnifies both correct and incorrect actions. Use source control, peer review, test environments and least privilege. Visit networkmanager.info.
Prerequisites
- Choose a protected central or local path.
- Define retention and access.
- Test applications that host PowerShell.
- Coordinate with privacy and security policy.
Procedure
Step 1: Create GPO
Use a descriptive policy.
New-GPO -Name 'PowerShell - Transcription'Step 2: Link to server OU
Pilot first.
New-GPLink -Name 'PowerShell - Transcription' -Target 'OU=Test Servers,DC=corp,DC=example'Step 3: Configure transcription
In Administrative Templates, Windows Components, Windows PowerShell enable Turn on PowerShell Transcription.
Step 4: Set output directory
Use a secured path not writable by standard users beyond required creation semantics.
Step 5: Enable invocation headers
Include timestamps for investigations.
Step 6: Test and review
Run a controlled session and inspect the transcript.
Verification
Confirm policy application and transcript creation.
gpupdate /force
gpresult /h C:\Temp\powershell-policy.html
Get-ChildItem 'C:\ProgramData\PowerShellTranscripts' -Recurse -ErrorAction SilentlyContinueRollback
Disable or unlink the GPO and preserve existing transcripts according to retention policy.
Security notes
Transcription is not a secret-filtering system; commands and output may reveal credentials or tokens.
Official references
Explore Netcloud24 Canada.
