Enable-PSWSManCombinedTrace

Understanding Enable-PSWSManCombinedTrace: Tracing PowerShell Remoting Like a Pro

Welcome back to Wahmans PowerShell Blog! Today’s cmdlet spotlight shines on Enable-PSWSManCombinedTrace — a powerful tool that combines diagnostics from both the WSMan and PowerShell sides of remoting. This cmdlet is invaluable when you’re troubleshooting PowerShell remoting issues and need visibility into what’s happening under the hood.

According to Microsoft’s documentation:

Enable-PSWSManCombinedTrace – Start a logging session with the WSMan and PowerShell providers enabled.

Why Should You Use Enable-PSWSManCombinedTrace?

This cmdlet sets up tracing and logging for issues that occur during PowerShell Remoting operations. It is especially useful when encountering errors that are hard to diagnose, such as intermittent connection failures or authentication hiccups during remote sessions.

Examples of Use

Example 1: Enabling Basic Remoting Trace as a Beginner

Let’s start with a simple trace to capture logging on a local machine when you’re trying to connect to a remote session but it’s failing without detailed error messages.

Enable-PSWSManCombinedTrace

This will begin a combined trace session, helping you collect useful information for further debugging.

Example 2: Reproducing an Issue After Enabling Trace

Enable the trace, reproduce your remoting issue, then review the log:

Enable-PSWSManCombinedTrace
Enter-PSSession -ComputerName RemoteServer1  # reproduce the issue
Get-WinEvent -LogName Microsoft-Windows-WinRM/Operational | Select-Object -First 10

The log collection will include entries from PowerShell and WSMan providers, offering a consolidated view.

Example 3: Automating the Trace & Collection to Aid Support

If you’re working in an enterprise and want to collect logs systematically for support or escalation, use this pattern:

Enable-PSWSManCombinedTrace
Start-Sleep -Seconds 60 # Wait while user reproduces the issue
$logPath = "$env:Temp\PSRemotingLogs.evtx"
wevtutil epl Microsoft-Windows-WinRM/Operational $logPath
Write-Host "Logs saved to $logPath"

This is great for helpdesk scenarios!

Example 4: Advanced – Enabling Tracing Remotely via Background Job

If you want to enable tracing on a remote server securely, do it through a background job:

Invoke-Command -ComputerName RemoteServer1 -ScriptBlock {
    Enable-PSWSManCombinedTrace
    Start-Sleep -Seconds 30
    $logPath = "$env:Temp\RemoteTraceLogs.evtx"
    wevtutil epl Microsoft-Windows-WinRM/Operational $logPath
    return $logPath
}

This allows administrators to automate trace collection even on headless or hard-to-reach servers.

Conclusion

The Enable-PSWSManCombinedTrace cmdlet is a must-have in your toolbox when things go wrong with remoting. It captures detailed useful diagnostic data to help you or your support team pinpoint issues swiftly and effectively.

Happy scripting, and I will see you in the next post!