Overview

It is desirable to have each instance of PowerShell log ETW events to its own instance-specific event log rather than re-using the existing inbox PowerShell event log. To do this, each instance of PowerShell must register its event manifest with ETW and carry its own copy of PSEvents.dll (assuming it differs from the inbox version of the file).

Changes Required

1. Port PSEvents.dll to GitHub. The big step here is to create PSEvents.dll from the manifest
2. Generate a unique GUID and name for the event provider during each major or minor release. These values must be saved in Microsoft-Windows-PowerShell-Instrumentation.man.
3. Create a post-install script or cmdlet to register the event provider with ETW using wevtutil.exe

Open Issues:

1. wevtutil.exe should be supported on all Windows OSs, but it might now work on Nano Server. How do we support event registration in that case?
2. More investigation is required to determine the process for generating PSEvents.dll in GitHub. SD produces it automatically for us based on a macro.
3. A non-Windows eventing or logging solution should be researched as well.