Track whether any Powershell modules were installed RRS feed

  • Question

  • Hello, dear gurus.

    I need to monitor the events whether Powershell modules were installed by someone during a day on Azure VMs and get email notifications correspondingly. I thought about writing a custom Powershell script and now I am using the following approach to catch the events caused by MsiInstaller:

    (Get-WinEvent -FilterHashtable @{LogName="Application";ID=11707;ProviderName="MsiInstaller"}).UserID.Value | select -First 1

    So I would like to use the same approach in catching Powershell module installations. But I do not know where such events are logged and would be glad if you could advise me where that source is located, if it exists of course?
    I hope my explanation was clear enough. Thank you in advance.

    Friday, January 24, 2020 2:31 PM