Viewing Script Execution History

The PowerShell Orchestrator execution log provides a complete record of every script run — whether triggered by a schedule, run manually on demand, or fired automatically in response to an alert. Reviewing execution history regularly helps confirm that assessments are running as expected, identify scripts that are failing, and retrieve assessment output for investigation or compliance purposes.

---

Accessing the execution log:

1. Log in to the LT Auditor ^MP Web UI
2. Navigate to Configure → PowerShell Orchestrator → Execution Log
3. The execution log displays all script runs with the following information:

Column	Description
Script Name	The name of the script that was executed
Target	The endpoint or cloud target the script ran against
Trigger Type	How the script was triggered — Scheduled, Manual, or Alert
Status	The outcome of the execution — Success, Failed, or Running
Started	The date and time the execution began
Completed	The date and time the execution finished
Duration	How long the script took to complete
Triggered By	The user or alert rule that initiated the execution

---

Filtering the execution log:

To narrow down the execution log to specific runs:

1. Use the filter bar at the top of the execution log
2. Filter by any combination of:
   • Script Name — view runs for a specific script
   • Target — view runs against a specific endpoint or cloud target
   • Trigger Type — filter by Scheduled, Manual, or Alert
   • Status — filter by Success, Failed, or Running
   • Date Range — limit results to a specific time period
3. Click Apply Filters

---

Viewing execution details and output:

To view the full details and output of a specific script run:

1. Locate the execution entry in the log
2. Click the entry to open the detail panel
3. The detail panel displays:
   • Execution Status — Success, Failed, or Running
   • Start and End Time — exact timestamps for the run
   • Target — the endpoint or cloud target the script ran against
   • Trigger — what initiated the execution (schedule name, user, or alert rule)
   • Script Output — the full output returned by the script
   • Error Messages — any errors encountered during execution
   • Exit Code — the PowerShell exit code returned by the script

---

Understanding execution statuses:

Status	Description
Success	The script completed without errors and output was forwarded to LT Auditor MP
Failed	The script encountered an error and did not complete successfully
Running	The script is currently executing — output not yet available
Timeout	The script exceeded the maximum allowed execution time and was terminated

---

Investigating failed executions:

If a script shows a status of Failed, use the following steps to diagnose the issue:

1. Open the failed execution entry in the log
2. Review the Error Messages section for details on what went wrong
3. Check the Exit Code — a non-zero exit code indicates a PowerShell error

Common failure causes:

Error	Likely Cause	Resolution
Access denied	Service account lacks required permissions	Review and update service account permissions
WinRM connection refused	WinRM not running on target endpoint	Start the WinRM service on the target machine
Target unreachable	Network or firewall issue	Verify connectivity using Test-WSMan
Script timeout	Script taking too long to complete	Optimize the script or increase the timeout limit
Module not found	Required PowerShell module missing on target	Install the required module on the target endpoint
Authentication failure	Service account credentials expired	Update the service account credentials in the orchestrator configuration

---

Viewing assessment results in LT Auditor ^MP:

Script output forwarded to LT Auditor ^MP is available in the View module alongside event data from other modules:

1. Navigate to View in the Web UI
2. Select the environment and category relevant to your assessment (e.g., Active Directory, Entra ID)
3. Set the date range to cover the time of the script execution
4. Filter by:
   • Source — select PowerShell Orchestrator
   • Script Name — filter by the specific script if needed
5. Review the structured assessment data returned by the script

---

Exporting execution history:

To export the execution log for reporting or audit purposes:

1. Apply your desired filters and date range
2. Click the Export button
3. Choose your format:
   • CSV — for Excel or data analysis
   • Excel — native Excel format
   • PDF — for audit documentation
4. Click Download

---

Monitoring scheduled script health:

Use the execution log to confirm that scheduled scripts are running as expected:

1. Filter the execution log by Trigger Type — Scheduled
2. Review the most recent run for each scheduled script
3. Confirm:
   • The last run time matches the expected schedule
   • The status shows as Success
   • The output contains the expected assessment data
4. If a scheduled script has not run at its expected time, check:
   • The script is set to Active in the script library
   • The PowerShell Orchestrator service is running
   • The target endpoint is reachable

---

Best practices:

• Review the execution log at least weekly to confirm all scheduled assessments are running successfully
• Investigate any failed executions promptly — a failing assessment script means a gap in your security posture visibility
• Use the execution log as part of incident response to confirm that alert-linked scripts fired correctly and produced useful output
• Retain execution history exports as supporting evidence for compliance audits
• Set up an alert rule in LT Auditor ^MP to notify your team when a critical assessment script fails so issues are caught quickly rather than discovered during a log review

[Your administrator should define which assessment scripts are considered critical and ensure alert notifications are configured for any failures in those scripts.]