Monitoring Winrm\pssessions with eventlogs or other best practices

is there best practice way of monitoring winrm connections made administrators? reason ask because company may hesitant implement powershell environment (with winrm enabled) due fact remote connections transparent end users. know regular old wmi has been able stuff forever, not have install\enable and configure (i guess did have fiddle dcom or something, thats not same thing). powershell more conspicuous technology auditor's point of view.

when check security log of machine have accessed via pssremoting find entries name, not workstation. there log tell me machine accessed computer via remote session?

thanks any assistance, i've been trying hard sell on powershell , possible remaining hindrance is misguided notion of invasion of privacy.

hmm im little surprised doesn’t show system that’s connecting...

i guess suggest using trustedhosts limit can connect , don’t allow administrator connect in, each user should have own account.

i have imagine can grabbed place... can reconfigure etw winrm include maybe?

Windows Server  >  Windows PowerShell