diff --git a/GPO Files/Logmira - DCs.zip b/GPO Files/Logmira - DCs.zip
new file mode 100644
index 0000000..886caff
Binary files /dev/null and b/GPO Files/Logmira - DCs.zip differ
diff --git a/GPO Files/Logmira-DCs-Backup.xml b/GPO Files/Logmira-DCs-Backup.xml
new file mode 100644
index 0000000..ba608c0
--- /dev/null
+++ b/GPO Files/Logmira-DCs-Backup.xml
@@ -0,0 +1,20 @@
+
+ 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 43 19 fc 7b 7e 17 b6 04 0a a9 72 f7 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 43 19 fc 7b 7e 17 b6 04 0a a9 72 f7 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 43 19 fc 7b 7e 17 b6 04 0a a9 72 f7 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/GPO Files/Logmira-DCs-gpreport.xml b/GPO Files/Logmira-DCs-gpreport.xml
new file mode 100644
index 0000000..eb157a5
--- /dev/null
+++ b/GPO Files/Logmira-DCs-gpreport.xml
@@ -0,0 +1,493 @@
+
+
+
+ {AA3A4A06-3CAE-42CE-8744-3E47E519A430}
+ miratime.org
+
+ Logmira - DCs
+ true
+ 2023-05-05T15:57:10
+ 2023-05-05T15:57:53
+ 2023-05-05T16:03:11.5364363Z
+
+ O:DAG:DAD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-2080119107-79042430-4151486730-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)S:AI(OU;CIIDSA;WPWD;;f30e3bc2-9ff0-11d1-b603-0000f80367c1;WD)(OU;CIIOIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIOIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)
+
+ S-1-5-21-2080119107-79042430-4151486730-512
+ MIRATIME\Domain Admins
+
+
+ S-1-5-21-2080119107-79042430-4151486730-512
+ MIRATIME\Domain Admins
+
+ true
+
+ false
+
+
+ S-1-5-9
+ NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
+
+
+ Allow
+
+ false
+
+ true
+ false
+ true
+ false
+
+
+ Read
+
+ 0
+
+
+
+ S-1-5-21-2080119107-79042430-4151486730-519
+ MIRATIME\Enterprise Admins
+
+
+ Allow
+
+ false
+
+ true
+ false
+ true
+ false
+
+
+ Edit, delete, modify security
+
+ 0
+
+
+
+ S-1-5-18
+ NT AUTHORITY\SYSTEM
+
+
+ Allow
+
+ false
+
+ true
+ false
+ true
+ false
+
+
+ Edit, delete, modify security
+
+ 0
+
+
+
+ S-1-5-11
+ NT AUTHORITY\Authenticated Users
+
+
+ Allow
+
+ false
+
+ true
+ false
+ true
+ false
+
+
+ Apply Group Policy
+
+ 0
+
+
+
+ S-1-5-21-2080119107-79042430-4151486730-512
+ MIRATIME\Domain Admins
+
+
+ Allow
+
+ false
+
+ true
+ false
+ true
+ false
+
+
+ Edit, delete, modify security
+
+ 0
+
+
+ false
+
+ true
+
+ 2
+ 2
+ true
+
+
+
+ MACHINE\System\CurrentControlSet\Control\Lsa\SCENoApplyLegacyAuditPolicy
+ 1
+
+ Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings
+
+ true
+
+
+
+ MaximumLogSize
+ Application
+ 16384
+
+
+ MaximumLogSize
+ System
+ 16384
+
+
+ MaximumLogSize
+ Security
+ 2048000
+
+ false
+
+ Security
+
+
+
+
+ System
+ Audit Credential Validation
+ {0cce923f-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Kerberos Authentication Service
+ {0cce9242-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Kerberos Service Ticket Operations
+ {0cce9240-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Other Account Logon Events
+ {0cce9241-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Application Group Management
+ {0cce9239-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Computer Account Management
+ {0cce9236-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Distribution Group Management
+ {0cce9238-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Other Account Management Events
+ {0cce923a-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Security Group Management
+ {0cce9237-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit User Account Management
+ {0cce9235-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit PNP Activity
+ {0cce9248-69ae-11d9-bed3-505054503030}
+ 1
+
+
+ System
+ Audit Process Creation
+ {0cce922b-69ae-11d9-bed3-505054503030}
+ 1
+
+
+ System
+ Audit RPC Events
+ {0cce922e-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Token Right Adjusted
+ {0cce924a-69ae-11d9-bed3-505054503030}
+ 1
+
+
+ System
+ Audit Directory Service Changes
+ {0cce923c-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Account Lockout
+ {0cce9217-69ae-11d9-bed3-505054503030}
+ 1
+
+
+ System
+ Audit Group Membership
+ {0cce9249-69ae-11d9-bed3-505054503030}
+ 1
+
+
+ System
+ Audit Logoff
+ {0cce9216-69ae-11d9-bed3-505054503030}
+ 1
+
+
+ System
+ Audit Logon
+ {0cce9215-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Network Policy Server
+ {0cce9243-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Other Logon/Logoff Events
+ {0cce921c-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Special Logon
+ {0cce921b-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Application Generated
+ {0cce9222-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Certification Services
+ {0cce9221-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Detailed File Share
+ {0cce9244-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit File Share
+ {0cce9224-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Removable Storage
+ {0cce9245-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit SAM
+ {0cce9220-69ae-11d9-bed3-505054503030}
+ 1
+
+
+ System
+ Audit Audit Policy Change
+ {0cce922f-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Authentication Policy Change
+ {0cce9230-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Authorization Policy Change
+ {0cce9231-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Filtering Platform Policy Change
+ {0cce9233-69ae-11d9-bed3-505054503030}
+ 1
+
+
+ System
+ Audit Sensitive Privilege Use
+ {0cce9228-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit IPsec Driver
+ {0cce9213-69ae-11d9-bed3-505054503030}
+ 1
+
+
+ System
+ Audit Other System Events
+ {0cce9214-69ae-11d9-bed3-505054503030}
+ 2
+
+
+ System
+ Audit Security State Change
+ {0cce9210-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Security System Extension
+ {0cce9211-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit System Integrity
+ {0cce9212-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ Advanced Audit Configuration
+
+
+
+
+ Include command line in process creation events
+ Enabled
+ This policy setting determines what information is logged in security audit events when a new process has been created.
+
+This setting only applies when the Audit Process Creation policy is enabled. If you enable this policy setting the command line information for every process will be logged in plain text in the security event log as part of the Audit Process Creation event 4688, "a new process has been created," on the workstations and servers on which this policy setting is applied.
+
+If you disable or do not configure this policy setting, the process's command line information will not be included in Audit Process Creation events.
+
+Default: Not configured
+
+Note: When this policy setting is enabled, any user with access to read the security events will be able to read the command line arguments for any successfully created process. Command line arguments can contain sensitive or private information such as passwords or user data.
+
+ At least Windows Server 2012 R2, Windows 8.1 or Windows RT 8.1
+ System/Audit Process Creation
+
+ false
+
+ Registry
+
+
+
+ 1
+ 1
+ true
+
+
+
+ Turn on Module Logging
+ Enabled
+
+ This policy setting allows you to turn on logging for Windows PowerShell modules.
+
+ If you enable this policy setting, pipeline execution events for members of the specified modules are recorded in the Windows PowerShell log in Event Viewer. Enabling this policy setting for a module is equivalent to setting the LogPipelineExecutionDetails property of the module to True.
+
+ If you disable this policy setting, logging of execution events is disabled for all Windows PowerShell modules. Disabling this policy setting for a module is equivalent to setting the LogPipelineExecutionDetails property of the module to False.
+
+ If this policy setting is not configured, the LogPipelineExecutionDetails property of a module or snap-in determines whether the execution events of a module or snap-in are logged. By default, the LogPipelineExecutionDetails property of all modules and snap-ins is set to False.
+
+ To add modules and snap-ins to the policy setting list, click Show, and then type the module names in the list. The modules and snap-ins in the list must be installed on the computer.
+
+ Note: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting.
+
+ At least Microsoft Windows 7 or Windows Server 2008 family
+ Windows Components/Windows PowerShell
+
+ To turn on logging for one or more modules, click Show, and then type the module names in the list. Wildcards are supported.
+
+
+ Module Names
+ Enabled
+ false
+ false
+
+
+ *
+
+
+
+
+ To turn on logging for the Windows PowerShell core modules, type the following module names in the list:
+
+
+ Microsoft.PowerShell.*
+
+
+ Microsoft.WSMan.Management
+
+
+
+ Turn on PowerShell Script Block Logging
+ Enabled
+
+ This policy setting enables logging of all PowerShell script input to the Microsoft-Windows-PowerShell/Operational event log. If you enable this policy setting,
+ Windows PowerShell will log the processing of commands, script blocks, functions, and scripts - whether invoked interactively, or through automation.
+
+ If you disable this policy setting, logging of PowerShell script input is disabled.
+
+ If you enable the Script Block Invocation Logging, PowerShell additionally logs events when invocation of a command, script block, function, or script
+ starts or stops. Enabling Invocation Logging generates a high volume of event logs.
+
+ Note: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting.
+
+ At least Microsoft Windows 7 or Windows Server 2008 family
+ Windows Components/Windows PowerShell
+
+ Log script block invocation start / stop events:
+ Enabled
+
+
+ false
+
+ Registry
+
+
+
diff --git a/GPO Files/Logmira-gpreport.xml b/GPO Files/Logmira-gpreport.xml
new file mode 100644
index 0000000..9138e10
--- /dev/null
+++ b/GPO Files/Logmira-gpreport.xml
@@ -0,0 +1,493 @@
+
+
+
+ {C0F30034-879B-44B0-BC8C-AEDCFB1BCA8F}
+ miratime.org
+
+ Logmira
+ true
+ 2021-09-29T14:25:33
+ 2022-03-09T17:37:58
+ 2022-03-09T17:41:58.5089043Z
+
+ O:DAG:DAD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-2080119107-79042430-4151486730-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)S:AI(OU;CIIDSA;WPWD;;f30e3bc2-9ff0-11d1-b603-0000f80367c1;WD)(OU;CIIOIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIOIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)
+
+ S-1-5-21-2080119107-79042430-4151486730-512
+ MIRATIME\Domain Admins
+
+
+ S-1-5-21-2080119107-79042430-4151486730-512
+ MIRATIME\Domain Admins
+
+ true
+
+ false
+
+
+ S-1-5-9
+ NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
+
+
+ Allow
+
+ false
+
+ true
+ false
+ true
+ false
+
+
+ Read
+
+ 0
+
+
+
+ S-1-5-21-2080119107-79042430-4151486730-519
+ MIRATIME\Enterprise Admins
+
+
+ Allow
+
+ false
+
+ true
+ false
+ true
+ false
+
+
+ Edit, delete, modify security
+
+ 0
+
+
+
+ S-1-5-18
+ NT AUTHORITY\SYSTEM
+
+
+ Allow
+
+ false
+
+ true
+ false
+ true
+ false
+
+
+ Edit, delete, modify security
+
+ 0
+
+
+
+ S-1-5-11
+ NT AUTHORITY\Authenticated Users
+
+
+ Allow
+
+ false
+
+ true
+ false
+ true
+ false
+
+
+ Apply Group Policy
+
+ 0
+
+
+
+ S-1-5-21-2080119107-79042430-4151486730-512
+ MIRATIME\Domain Admins
+
+
+ Allow
+
+ false
+
+ true
+ false
+ true
+ false
+
+
+ Edit, delete, modify security
+
+ 0
+
+
+ false
+
+ true
+
+ 2
+ 2
+ true
+
+
+
+ MACHINE\System\CurrentControlSet\Control\Lsa\SCENoApplyLegacyAuditPolicy
+ 1
+
+ Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings
+
+ true
+
+
+
+ MaximumLogSize
+ Application
+ 16384
+
+
+ MaximumLogSize
+ System
+ 16384
+
+
+ MaximumLogSize
+ Security
+ 2048000
+
+ false
+
+ Security
+
+
+
+
+ System
+ Audit Credential Validation
+ {0cce923f-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Kerberos Authentication Service
+ {0cce9242-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Kerberos Service Ticket Operations
+ {0cce9240-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Other Account Logon Events
+ {0cce9241-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Application Group Management
+ {0cce9239-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Computer Account Management
+ {0cce9236-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Distribution Group Management
+ {0cce9238-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Other Account Management Events
+ {0cce923a-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Security Group Management
+ {0cce9237-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit User Account Management
+ {0cce9235-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit PNP Activity
+ {0cce9248-69ae-11d9-bed3-505054503030}
+ 1
+
+
+ System
+ Audit Process Creation
+ {0cce922b-69ae-11d9-bed3-505054503030}
+ 1
+
+
+ System
+ Audit RPC Events
+ {0cce922e-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Token Right Adjusted
+ {0cce924a-69ae-11d9-bed3-505054503030}
+ 1
+
+
+ System
+ Audit Directory Service Changes
+ {0cce923c-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Account Lockout
+ {0cce9217-69ae-11d9-bed3-505054503030}
+ 1
+
+
+ System
+ Audit Group Membership
+ {0cce9249-69ae-11d9-bed3-505054503030}
+ 1
+
+
+ System
+ Audit Logoff
+ {0cce9216-69ae-11d9-bed3-505054503030}
+ 1
+
+
+ System
+ Audit Logon
+ {0cce9215-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Network Policy Server
+ {0cce9243-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Other Logon/Logoff Events
+ {0cce921c-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Special Logon
+ {0cce921b-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Application Generated
+ {0cce9222-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Certification Services
+ {0cce9221-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit File Share
+ {0cce9224-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Removable Storage
+ {0cce9245-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit SAM
+ {0cce9220-69ae-11d9-bed3-505054503030}
+ 1
+
+
+ System
+ Audit Audit Policy Change
+ {0cce922f-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Authentication Policy Change
+ {0cce9230-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Authorization Policy Change
+ {0cce9231-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Filtering Platform Policy Change
+ {0cce9233-69ae-11d9-bed3-505054503030}
+ 1
+
+
+ System
+ Audit Sensitive Privilege Use
+ {0cce9228-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit IPsec Driver
+ {0cce9213-69ae-11d9-bed3-505054503030}
+ 1
+
+
+ System
+ Audit Other System Events
+ {0cce9214-69ae-11d9-bed3-505054503030}
+ 2
+
+
+ System
+ Audit Security State Change
+ {0cce9210-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit Security System Extension
+ {0cce9211-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ System
+ Audit System Integrity
+ {0cce9212-69ae-11d9-bed3-505054503030}
+ 3
+
+
+ Advanced Audit Configuration
+
+
+
+
+ Include command line in process creation events
+ Enabled
+ This policy setting determines what information is logged in security audit events when a new process has been created.
+
+This setting only applies when the Audit Process Creation policy is enabled. If you enable this policy setting the command line information for every process will be logged in plain text in the security event log as part of the Audit Process Creation event 4688, "a new process has been created," on the workstations and servers on which this policy setting is applied.
+
+If you disable or do not configure this policy setting, the process's command line information will not be included in Audit Process Creation events.
+
+Default: Not configured
+
+Note: When this policy setting is enabled, any user with access to read the security events will be able to read the command line arguments for any successfully created process. Command line arguments can contain sensitive or private information such as passwords or user data.
+
+ At least Windows Server 2012 R2, Windows 8.1 or Windows RT 8.1
+ System/Audit Process Creation
+
+ false
+
+ Registry
+
+
+
+ 1
+ 1
+ true
+
+
+
+ Turn on Module Logging
+ Enabled
+
+ This policy setting allows you to turn on logging for Windows PowerShell modules.
+
+ If you enable this policy setting, pipeline execution events for members of the specified modules are recorded in the Windows PowerShell log in Event Viewer. Enabling this policy setting for a module is equivalent to setting the LogPipelineExecutionDetails property of the module to True.
+
+ If you disable this policy setting, logging of execution events is disabled for all Windows PowerShell modules. Disabling this policy setting for a module is equivalent to setting the LogPipelineExecutionDetails property of the module to False.
+
+ If this policy setting is not configured, the LogPipelineExecutionDetails property of a module or snap-in determines whether the execution events of a module or snap-in are logged. By default, the LogPipelineExecutionDetails property of all modules and snap-ins is set to False.
+
+ To add modules and snap-ins to the policy setting list, click Show, and then type the module names in the list. The modules and snap-ins in the list must be installed on the computer.
+
+ Note: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting.
+
+ At least Microsoft Windows 7 or Windows Server 2008 family
+ Windows Components/Windows PowerShell
+
+ To turn on logging for one or more modules, click Show, and then type the module names in the list. Wildcards are supported.
+
+
+ Module Names
+ Enabled
+ false
+ false
+
+
+ *
+
+
+
+
+ To turn on logging for the Windows PowerShell core modules, type the following module names in the list:
+
+
+ Microsoft.PowerShell.*
+
+
+ Microsoft.WSMan.Management
+
+
+
+ Turn on PowerShell Script Block Logging
+ Enabled
+
+ This policy setting enables logging of all PowerShell script input to the Microsoft-Windows-PowerShell/Operational event log. If you enable this policy setting,
+ Windows PowerShell will log the processing of commands, script blocks, functions, and scripts - whether invoked interactively, or through automation.
+
+ If you disable this policy setting, logging of PowerShell script input is disabled.
+
+ If you enable the Script Block Invocation Logging, PowerShell additionally logs events when invocation of a command, script block, function, or script
+ starts or stops. Enabling Invocation Logging generates a high volume of event logs.
+
+ Note: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting.
+
+ At least Microsoft Windows 7 or Windows Server 2008 family
+ Windows Components/Windows PowerShell
+
+ Log script block invocation start / stop events:
+ Enabled
+
+
+ false
+
+ Registry
+
+
+
+ miratime
+ miratime.org
+ true
+ false
+
+
diff --git a/GPO Files/manifest.xml b/GPO Files/Logmira-manifest.xml
similarity index 94%
rename from GPO Files/manifest.xml
rename to GPO Files/Logmira-manifest.xml
index 52d6fed..430fdb2 100644
--- a/GPO Files/manifest.xml
+++ b/GPO Files/Logmira-manifest.xml
@@ -1 +1 @@
-
\ No newline at end of file
+
diff --git a/GPO Files/gpreport.xml b/GPO Files/gpreport.xml
deleted file mode 100644
index cdefca5..0000000
Binary files a/GPO Files/gpreport.xml and /dev/null differ