Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

PowerShell ETW logging on windows needs to use a unique provider id and register the manifest. #4939

Copy link
Copy link
@dantraMSFT

Description

@dantraMSFT
Issue body actions

Currently, PowerShell uses the same ETW provider GUID as PowerShell on Windows. This presents a few, subtle problems:
1: PowerShell 6 events cannot be easily distinguished from PowerShell/Windows.
2: PowerShell 6 is relying on a valid ETW manifest being registered to ensure events can be decoded. This assumption breaks on down-level systems that do not contain PowerShell/Windows 5.X and also ties PowerShell 6 to PowerShell/Windows events.
The solution is as follows:
1: Snapshot the PowerShell/Windows ETW manifest and update the provider GUID and Provider Name.

The Event viewer location should be moved outside the Microsoft/Windows event tree since PowerShell 6 does not ship inbox.
2: Provide a script or MSI action to register the PowerShell 6 manifest either at install time or as a post install, user step to address xcopy deploy use cases.
3: Document the updated Provider GUID, name, and any registration steps (if appropriate)consumers.

Reactions are currently unavailable

Metadata

Metadata

Assignees

Labels

Resolution-FixedThe issue is fixed.The issue is fixed.WG-Enginecore PowerShell engine, interpreter, and runtimecore PowerShell engine, interpreter, and runtime

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

    Morty Proxy This is a proxified and sanitized view of the page, visit original site.