When executing powershell or invoke-command scripts the Change Auditor does not record anything
I would look at it this way. The story is complex and we need to consider the whole picture with following points of control:
#1. Right to execute the script/ACL/permissions layer: Local Admin, OS rights (Logon as Batch Job, As Service) - controlled by GPO
#2. Log the execution actions on Server: Events (Logon as Batch Job, As Service), TS Logon, Interactive Logon.
#2.1 Log access on Resources: File Access on Share by the script, other servers$ shares etc...
I would look at it this way. The story is complex and we need to consider the whole picture with following points of control:
#1. Right to execute the script/ACL/permissions layer: Local Admin, OS rights (Logon as Batch Job, As Service) - controlled by GPO
#2. Log the execution actions on Server: Events (Logon as Batch Job, As Service), TS Logon, Interactive Logon.
#2.1 Log access on Resources: File Access on Share by the script, other servers$ shares etc...
