Windows PowerShell · Event 4100
PowerShell Event 4100: A PowerShell command failed
PowerShell recorded an error. This event is written whether or not anyone enabled logging, which means it frequently captures attempts that were blocked — a script stopped by execution policy, a cmdlet refused by Constrained Language Mode — on machines where nothing else would have noticed.
Also written as PowerShell 4100Event ID 4100 powershell error
- How oftenFires regularly
- Vendor calls itWarning
- LogMicrosoft-Windows-PowerShell/Operational
- SourceMicrosoft-Windows-PowerShell
The fields that decide it
Everything else in the log line is context.
- Error Message
- The exception text PowerShell produced. What it says determines whether this is a typo or a blocked attempt.
-
cannot be loaded because running scripts is disabled on this systemExecution policy refused a script file. Common on locked-down machines and also what an unsophisticated payload runs into. -
Cannot invoke method. Method invocation is supported only on core typesConstrained Language Mode blocked a .NET method call. This is an application-control boundary being enforced. -
The term ... is not recognized as the name of a cmdletA missing command or a typo. Almost always benign, occasionally a script written for a different machine. -
Access to the path ... is deniedA permissions failure. Interesting when the path is somewhere sensitive rather than a user's own folder. -
Exception calling "DownloadString"A download cradle that failed to reach its server — the attempt is recorded even though nothing was retrieved. - Fully Qualified Error ID
- PowerShell's stable identifier for the error type, such as UnauthorizedAccess or CommandNotFoundException. Better to alert on than the message text, which changes with language and version.
- Context / ScriptName
- The script file the error came from, when there was one. An empty ScriptName means the command was typed or piped in.
- User and Host Application
- Who was running it and how. The same command line context that Event 4103 carries.
- Severity
- PowerShell's own classification of the error record, which distinguishes a terminating error from a non-terminating one.
Common questions
Does Event 4100 need script block logging enabled?
No. The PowerShell operational log records errors by default, which is what makes 4100 unusually useful — on a machine where nobody turned logging on, it is often the only record that a particular command was ever attempted. It will not tell you the whole script, but it tells you something failed and why.
Why is Event 4100 useful for security if it only records failures?
Because a failure is evidence of an attempt. An execution policy error means a script file was run and refused. A Constrained Language Mode error means someone tried a .NET method call that application control blocked. A failed DownloadString means a download cradle ran and could not reach its server. In each case the control worked and the event is the receipt.
How do I stop 'running scripts is disabled on this system'?
That message is the execution policy refusing a script file. On a machine you administer, Set-ExecutionPolicy RemoteSigned for the current user is the usual answer. Be aware that execution policy is a safety feature rather than a security boundary — it stops accidents, not deliberate action, since the same code can be pasted into the console or passed as an encoded command.
What is the difference between Event 4100 and Event 4104?
4104 records the code PowerShell was about to run and has to be enabled. 4100 records an error that occurred and is on by default. If you have both, 4104 gives you the script and 4100 tells you which part of it failed; if you have only 4100, you are reconstructing from error messages alone.
Read next
- Read alongside PowerShell Event 4104: Script block logging Script block logging, which shows the code that produced the error.
- Usually comes before PowerShell Event 4103: Module logging recorded a command Module logging, which records the pipeline that then failed.
- The equivalent of PowerShell Event 400: A PowerShell session started The classic log's engine start, useful when the operational log is not being collected.
- Usually comes before Event 4688: A new process has been created Process creation for the PowerShell process itself.
Mentioned by
Vendor documentation
Last reviewed 6 September 2026