Track whether any Powershell modules were installed

• Question

• 

  

  0

  Sign in to vote

  Hello, dear gurus.
  
  I need to monitor the events whether Powershell modules were installed by someone during a day on Azure VMs and get email notifications correspondingly. I thought about writing a custom Powershell script and now I am using the following approach to catch the events caused by MsiInstaller:
  
  (Get-WinEvent -FilterHashtable @{LogName="Application";ID=11707;ProviderName="MsiInstaller"}).UserID.Value | select -First 1 . 
  
  So I would like to use the same approach in catching Powershell module installations. But I do not know where such events are logged and would be glad if you could advise me where that source is located, if it exists of course?
  I hope my explanation was clear enough. Thank you in advance.

  
  

  
  

  • Edited by Andrei Baturov Friday, January 24, 2020 2:31 PM
  • Moved by Kyle Wang - MSFTMicrosoft contingent staff Monday, January 27, 2020 2:27 AM

  Friday, January 24, 2020 2:31 PM