Glossary
PowerShell transcription
A feature that writes a full text record of a PowerShell session — input and output — to a PowerShell_transcript file, with local timestamps.
PowerShell transcription writes a text record of a whole PowerShell session, both the commands typed and the output they produced, to a file. A user can start it by hand with Start-Transcript, or an administrator can force it for every session with the Group Policy setting "Turn on PowerShell Transcription", which can also set a central OutputDirectory and add per-command invocation headers.
Why it matters in investigations
Transcripts are the only common PowerShell artifact that records output. Event logs and PSReadLine history show what was run; a transcript also shows what came back: a directory listing, the contents of a file that was read, an error that proves a command failed. That context often settles whether an action succeeded.
Two caveats apply. First, every time in a transcript is the host's local wall clock, formatted yyyyMMddHHmmss, with no time zone, so note the machine's zone before correlating with UTC event logs. Second, a file that is missing its closing transcript end footer was cut short or truncated, and a single file can hold several start/end pairs.
Example
By default each session goes under the user's Documents folder as PowerShell_transcript.<computer>.<random>.<timestamp>.txt. The header looks like this:
**********************
Windows PowerShell transcript start
Start time: 20260914104500
Username: FIN-WKS-07\svc_backup
Machine: FIN-WKS-07 (Microsoft Windows NT 10.0.19045.0)
Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Process ID: 4242
PSVersion: 5.1.19041.4648
**********************
Each prompt line is then followed by the command and its output. With -IncludeInvocationHeader, a Command start time: precedes each command and the parser attaches it to that command; without it, commands inherit the session start time and are shown as approximate.
Related terms
- PSReadLine, the timestamp-less history file to read alongside
- Encoded command, which the parser decodes on transcript lines
- Windows PowerShell classic log, whose
HostApplicationpairs with the transcript header
Read transcripts as a timeline in the PowerShell Parser, and see PowerShell transcription forensics for the full format.