How are people parsing the powershell transcriptions files which have a large amount of command executions within the file? For those not familiar, Powershell Transcription will create a log file once a user starts their powershell transaction. It will log the users name at the top of the file and will not close the file until the command is closed. In some cases we have a MMC running open all week and this can produce 100's of commands within the powershell transaction file. Unfortunately, it only logs the user name who initially executed the command at the start at the launch of the process. The subsequent entries just show the command and output. How do you associate the users name with each of these commands if you want to keep them as separate events? Or are you just bundling all of those commands into one event? Or has someone found a way to associate the username to each command? Windows PowerShell transcript start Start time: 20190216091018 Username: XYZ RunAs User: ABC Configuration Name: Machine: HOSTNAME Host Application: C:\WINDOWS\system32\mmc.exe Process ID: 1111 PSVersion: 5.1.111 PSEdition: Desktop PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.590 BuildVersion: 10.0.17134 CLRVersion: 4.0.30319 WSManStackVersion: 3.0 PSRemotingProtocolVersion: 2.3 SerializationVersion: 1.1. Command start time: 20190216091032 PS>CommandInvocation(Get-ConfigInstalledDBVersion): "Get-ConfigInstalledDBVersion" >> ParameterBinding(Get-ConfigInstalledDBVersion): name="AdminAddress"; value="xyz.com:80" >> ParameterBinding(Get-ConfigInstalledDBVersion): name="Upgrade"; value="True" Command start time: 20190216091031 PS>CommandInvocation(Get-ConfigInstalledDBVersion): "Get-ConfigInstalledDBVersion" >> ParameterBinding(Get-ConfigInstalledDBVersion): name="AdminAddress"; value="xyz.com:80" >> ParameterBinding(Get-ConfigInstalledDBVersion): name="Upgrade"; value="True" Command start time: 20190216091032 PS>CommandInvocation(Get-ConfigInstalledDBVersion): "Get-ConfigInstalledDBVersion" >> ParameterBinding(Get-ConfigInstalledDBVersion): name="AdminAddress"; value="xyz.com:80" >> ParameterBinding(Get-ConfigInstalledDBVersion): name="Upgrade"; value="True" Command start time: 20190216091034 PS>CommandInvocation(Get-ConfigInstalledDBVersion): "Get-ConfigInstalledDBVersion" >> ParameterBinding(Get-ConfigInstalledDBVersion): name="AdminAddress"; value="xyz.com:80" >> ParameterBinding(Get-ConfigInstalledDBVersion): name="Upgrade"; value="True" Command start time: 20190216091037 PS>CommandInvocation(Get-ConfigInstalledDBVersion): "Get-ConfigInstalledDBVersion" >> ParameterBinding(Get-ConfigInstalledDBVersion): name="AdminAddress"; value="xyz.com:80" >> ParameterBinding(Get-ConfigInstalledDBVersion): name="Upgrade"; value="True" ... View more

How is everyone parsing these powershell transcriptions when a person leaves the shell open for multiple days? In that case it shows the user who executed once, but there can be a hundred command starts spanning multiple days. Is the consensus to capture this still as one event? Or do you have logic that breaks those into multiple events? I have some transcripts files 30+MB in size. Command start time: 20190522100828 PS>CommandInvocation(Get-ProvTask): "Get-ProvTask" ParameterBinding(Get-ProvTask): name="AdminAddress"; value="google.com:80" ParameterBinding(Get-ProvTask): name="MaxRecordCount"; value="2147483647" Command start time: 20190522100830 PS>CommandInvocation(Get-BrokerCatalog): "Get-BrokerCatalog" ParameterBinding(Get-BrokerCatalog): name="AdminAddress"; value="yahoo.com:80" ParameterBinding(Get-BrokerCatalog): name="MaxRecordCount"; value="2147483647" ParameterBinding(Get-BrokerCatalog): name="Property"; value="Uid, Name, MetadataMap, ProvisioningSchemeId, Scopes" ... View more