PowerShell › Event 800

Event ID 800 —

Provider
PowerShell
Channel
Windows PowerShell
Level
Informational
Collection Priority
Recommended (Microsoft-WEF, others)

Fields #

NameDescription
Data_0
Data_1
Data_2
Binary

Example Event #

{
  "system": {
    "provider": "PowerShell",
    "guid": "",
    "event_source_name": "",
    "event_id": 800,
    "version": 0,
    "level": 4,
    "task": 8,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-06T01:35:06.006085+00:00",
    "event_record_id": 390,
    "correlation": {},
    "execution": {
      "process_id": 15468,
      "thread_id": 0
    },
    "channel": "Windows PowerShell",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "    Microsoft.PowerShell.Core\\Set-StrictMode -Off\r\n",
    "Data_1": "\tDetailSequence=1\r\n\tDetailTotal=1\r\n\r\n\tSequenceNumber=57\r\n\r\n\tUserId=WINDEV2310EVAL\\User\r\n\tHostName=ConsoleHost\r\n\tHostVersion=5.1.22621.2428\r\n\tHostId=9500ad9e-7709-413f-b91b-8945cbb52940\r\n\tHostApplication=powershell.exe -NoExit -Command &{Import-Module \"C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\Tools\\Microsoft.VisualStudio.DevShell.dll\"; Enter-VsDevShell d5dcd421 -SkipAutomaticLocation -DevCmdArguments \"-arch=x64 -host_arch=x64\"}\r\n\tEngineVersion=5.1.22621.2428\r\n\tRunspaceId=6fa4bb48-d600-4d4b-b445-e1fa0a41db53\r\n\tPipelineId=23\r\n\tScriptName=C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadLine\\2.0.0\\PSReadLine.psm1\r\n\tCommandLine=    Microsoft.PowerShell.Core\\Set-StrictMode -Off\r\n",
    "Data_2": "CommandInvocation(Set-StrictMode): \"Set-StrictMode\"\r\nParameterBinding(Set-StrictMode): name=\"Off\"; value=\"True\"\r\n",
    "Binary": ""
  },
  "message": ""
}

References #