Hello, we want to deactivate the Windows Script Host on all of our VMs in the network. However, since we currently do not know which scripts are still being executed by the WSH and do not want to / cannot check them manually on each server, we need a script which provides the following properties for each system:
Is WSH activated?
Has WSH been running a script recently?
Which script was executed?
When was it carried out?
Unfortunately, I couldn't find anything suitable on the Internet.
Many thanks for the help!
Get Windows Scripting Host info with PowerShell
Forum rules
Do not post any licensing information in this forum.
Any code longer than three lines should be added as code using the 'Select Code' dropdown menu or attached as a file.
Do not post any licensing information in this forum.
Any code longer than three lines should be added as code using the 'Select Code' dropdown menu or attached as a file.
Get Windows Scripting Host info with PowerShell
To do this you would have to enable auditing of the WSH engine (cscript, wscript). The audit records would then be available in the event log.
Go to full post