group Policy
If you use a traditional active directory tool, use a group policy to enable Powershell logging. Open group policy management console. Create a new group policy object (GPO) or edit an existing. Computer Configuration> Administrative Template> Windows components> navigate on Windows PowerShel. Find the settings “Turn on the Powershel script block logging” and set it to enable it.
Susan Bradley / CSO
This logging allows you to capture the content of all executed scripts including commands and functions.
Intune
Similarly, perform the following steps in Intune: Go to Microsoft Intune Admin Center and find devices. Click on Windows device and configuration. Click Create, choose the new policy. Select Windows 10 and later, select the settings catalogs under the profile type, and click Create. Enter the Powershell configuration name, enter the details if necessary, and click next. Click on adding settings, enter the Powershell in search for a setting bar, and click on the search. Select the administrative template \ Windows component \ Windows Powershell, and select all these settings. Click on, or go through each and select the people you want to monitor.
