Windows 10, how can I find out what ran a powershell script at a certain time

Solution 1:

Users write to logs not an executable.

If you want to track PowerShell code (command/script) actions, you need to enable full Powershell Logging/Auditing via GPO/LPO as well as transcript logging and then as noted, dig at event logs or set alerts to notify you.

https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_eventlogs?view=powershell-5.1

https://adamtheautomator.com/powershell-logging-2

Lastly, powershell.exe is not Powershell. powershell.exe is just a host to run PowerShell code/commands.

https://www.youtube.com/watch?v=54xwcNMb1wo https://leanpub.com/thebigbookofpowershellgotchas

One can write my own PowerShell host and run any PowerShell command/script(s) one chooses.

Heck, one could just rename powershell.exe to something else to run it.