How can I disable all versions of Windows Powershell regardless of name or location??

[imkira3]

Pretty straightforward. Every option I see for disabling powershell relies on the executable location or name. They rely on specific paths, so all a user would have to do is have the program installed elsewhere, like, on a USB. What can I do to truly disable powershell for the computers at the community centre? Can I set the permissions so low Powershell is basically useless or something? Thanks.

[halbaradkenafin]

Just a warning that even if you manage to disable access to powershell.exe and powershell_ise.exe it won't stop people running other consoles that use the powershell engine, such as conemu.

 

Having said that you're likely looking at something with GPO, probably best to blacklist the exe by filehash. There is an option under computer -> security I think, don't have access to a machine with GPO right now so can't give the exact path.

[Arthur]

Here are the paths to the EXEs.

 

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe

 

They rely on specific paths, so all a user would have to do is have the program installed elsewhere, like, on a USB.

If you setup AppLocker (or SRP) properly that won't work.

 

Just a warning that even if you manage to disable access to powershell.exe and powershell_ise.exe it won't stop people running other consoles that use the powershell engine, such as conemu.

It also won't stop people using applications like p0wnedShell.

 

p0wnedShell is an offensive PowerShell host application written in C# that does not rely on powershell.exe but runs powershell commands and functions within a powershell runspace environment (.NET).

 

There are some things you can do however...

 

Detecting Offensive PowerShell Attack Tools

 

PowerShell is more than PowerShell.exe

Blocking access to PowerShell.exe is an “easy” way to stop PowerShell capability, at least that’s how it seems. The reality is that PowerShell is more than a single executable. PowerShell exists in the System.Management.Automation.dll dynamic linked library file (DLL) and can host different runspaces which are effectively PowerShell instances. A custom PowerShell runspace can be instantiated via code, so PowerShell can be executed through a custom coded executable (such as MyPowershell.exe). Since PowerShell code can be executed without running PowerShell.exe, blocking this executable is not an ideal solution to block attacks.

Edited June 24, 2016 by Arthur

[Guest obsidianpillar]

Couldn't you do it the other way and use the "Run only specified Windows Applications" policy? Yes, it's tedious depending on the software installed and collecting all the executables on the PC's however It has worked great with me in the past with workstations where they are accessible by the general public. I suppose it's down to the software that's installed on the PC. In our case it was just Microsoft Office and Firefox. Everything else was disabled by default due to that policy being enforced.

 

Hope this helps.

 

Best,

Tom