Skip to content

Glossary

Event ID 4104

The PowerShell Script Block Logging event: one block of compiled code, identified by ScriptBlockId and numbered MessageNumber of MessageTotal.

Event ID 4104 is the Script Block Logging event in the Microsoft-Windows-PowerShell/Operational log. Each event carries ScriptBlockText (the code), ScriptBlockId (a GUID shared by every part of one block), MessageNumber/MessageTotal (this part n of N) and Path (the source .ps1, if any).

To recover a long script, group events by ScriptBlockId and concatenate ScriptBlockText in MessageNumber order; a missing part leaves a gap. Blocks logged at Warning level were flagged by PowerShell as suspicious even without full logging. See the 4104 guide.