I need to find the Event Id that is generated by Windows when it happens

I've tried to search in various websites and docs, but there's nothing about it

Could it be that the Clear-History command doesnt generate an Event Id?

Links that i've tried searching:

Clear-History

Audit Log Clearing

This last one isn't what i need, but i've tried finding in the website, no success

I need to find the Event Id that is generated by Windows when it happens

I've tried to search in various websites and docs, but there's nothing about it

Could it be that the Clear-History command doesnt generate an Event Id?

Links that i've tried searching:

Clear-History

Audit Log Clearing

This last one isn't what i need, but i've tried finding in the website, no success

• windows
• powershell
• security

• Re the 2nd link in your question: You already hint at its inapplicability, which is indeed the case: It refers to an Active Directory auditing tool, which is unrelated to PowerShell's Clear-History cmdlet. – mklement0 Commented Mar 15 at 21:10

1 Answer 1

Could it be that the Clear-History command doesn't generate an Event Id?

Indeed it doesn't.^[1]

Given that Clear-History's purpose is to clear the history of recently executed interactive commands, something that exists purely for user-specific, interactive convenience, it isn't surprising that no event-log entry is created when it is invoked.

As an aside:

• Clear-History alone isn't actually enough to clear the command history in PowerShell versions since v5 (including PowerShell (Core) 7), given that these versions ship with the PSReadLine module that maintains its own history: see this answer.

^{[1] Neither the linked help topic mentions event logs nor does the source code. While the source code, strictly speaking, applies only to PowerShell (Core) 7 (the modern, cross-platform, install-on-demand edition), not also to the closed-source Windows PowerShell (the legacy, ships-with-Windows, Windows-only edition of PowerShell whose latest and last version is 5.1), the former's source code was forked from the latter's, and it's unlikely that changes were made in this area since.}