From 9377934dbc2a7410799752daceb109802572f0d2 Mon Sep 17 00:00:00 2001 From: spydisec <9101327+spydisec@users.noreply.github.com> Date: Fri, 2 Oct 2026 12:49:02 +1000 Subject: [PATCH 1/2] Prepare v2.3.0: CHANGELOG release section and upgrade note Co-Authored-By: Claude Fable 5.1 --- CHANGELOG.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index f40f517..91caa9b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,17 @@ Releases are tagged `vX.Y.Z` and published with a zip and a SHA256 checksum. ## [Unreleased] +## [2.3.0] - 2026-10-02 + +One new read-only check: `Test-LoggingBaseline.ps1` now reports the PowerShell transcription policy, which the kit never sets. No setting or script behaviour changes otherwise. + +**Upgrading from 2.2.2** + +| If you used | Now | +|---|---| +| `Test-LoggingBaseline.ps1` in a pipeline or RMM check | A host with transcription on and no `OutputDirectory` now fails (exit 1) where it passed before. Fix the policy, not the kit: set an `OutputDirectory` with restricted access, or remove the `Transcription` policy key. Transcription that is directed to a folder passes with a note. | +| Anything else | Nothing to do. | + ### Added - 🧾 **Transcription policy check.** `Test-LoggingBaseline.ps1` now has a read-only Safety row for the PowerShell transcription policy, which the kit never sets. On with no `OutputDirectory` fails, because every session then writes a transcript into the user's Documents folder; on with a folder passes with a note; off passes. Machine policy takes precedence; the user policy of the account running the test is read when no machine policy is set, and a `Wow6432Node` copy that disagrees is noted. The Safety never-do table explains it. [#91](https://github.com/spydisec/WinLogKit/issues/91) From 50deefb6915926982ee1973c3a40b64308b34237 Mon Sep 17 00:00:00 2001 From: spydisec <9101327+spydisec@users.noreply.github.com> Date: Fri, 2 Oct 2026 12:53:01 +1000 Subject: [PATCH 2/2] Prepare v2.3.0: cite Microsoft's transcription policy guidance in the upgrade note Co-Authored-By: Claude Fable 5.1 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 91caa9b..b174928 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,7 +16,7 @@ One new read-only check: `Test-LoggingBaseline.ps1` now reports the PowerShell t | If you used | Now | |---|---| -| `Test-LoggingBaseline.ps1` in a pipeline or RMM check | A host with transcription on and no `OutputDirectory` now fails (exit 1) where it passed before. Fix the policy, not the kit: set an `OutputDirectory` with restricted access, or remove the `Transcription` policy key. Transcription that is directed to a folder passes with a note. | +| `Test-LoggingBaseline.ps1` in a pipeline or RMM check | A host with transcription on and no `OutputDirectory` now fails (exit 1) where it passed before. Fix the policy, not the kit: set an `OutputDirectory` with restricted access (per [Microsoft's PowerShell Group Policy settings](https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_group_policy_settings#turn-on-powershell-transcription)), or remove the `Transcription` policy key. Transcription that is directed to a folder passes with a note. | | Anything else | Nothing to do. | ### Added