When to use a non-embedded script vs embedded script?

For any "Process" action or "Application Scheduler" object in EventSentry, you can use a non-embedded script by providing the full path to the script file, i.e., C:\Batch\powershell_script.ps1.

In many cases it is however easier to utilize the embedded scripts functionality. This allows you to embed scripts of any kind (command-line scripts, visual basic scripts, PowerShell scripts, etc.) within the EventSentry configuration so that the scripts themselves do not have to be maintained on one or more target machines, making it significantly easier to maintain.

The Restrict Permissions option (which is enabled by default) ensures that only the service account that the EventSentry agent is running under will have access to the file, essentially ensuring that no unauthorized changes can be made to the file.