Locking down powershell on windows 7 clients?

[zag]

Does anyone know how to lock down powershell on student machines?

 

At the moment the students are just creating a batch file to launch it.

 

start powershell.exe

 

We even ban .bat using FSRM but they seem to still be able to transfer it to their user drives somehow.

 

Any ways to prevent it?

[FN-GM]

- - - Updated - - -

 

Does anyone know how to lock down powershell on student machines?

 

At the moment the students are just creating a batch file to launch it.

 

start powershell.exe

 

We even ban .bat using FSRM but they seem to still be able to transfer it to their user drives somehow.

 

Any ways to prevent it?

 

You could use group policy software restrictions to block .bat on the USB.

 

http://www.mechbgon.com/srp/

[jertsy]

Applocker is also useful if you are using enterprise clients

[Arthur]

AppLocker + PowerShell >5.0

 

Detecting Offensive PowerShell Attack Tools

 

PowerShell v5 also supports automatic lock-down when AppLocker is deployed in “Allow” mode. Applocker Allow mode is true whitelisting and can prevent any unauthorized binary from being executed. PowerShell v5 detects when Applocker Allow mode is in effect and sets the PowerShell language to Constrained Mode, severely limiting the attack surface on the system. With Applocker in Allow mode and PowerShell running in Constrained Mode, it is not possible for an attacker to change the PowerShell language mode to full in order to run attack tools. When AppLocker is configured in “Allow Mode”, PowerShell reduces its functionality to “Constrained Mode” for interactive input and user-authored scripts. Constrained PowerShell only allows core PowerShell functionality and prevents execution of the extended language features often used by offensive PowerShell tools (direct .NET scripting, invocation of Win32 APIs via the Add-Type cmdlet, and interaction with COM objects).

 

Note that scripts allowed by AppLocker policy such as enterprise signed code or in a trusted directory are executed in full PowerShell mode and not the Constrained PowerShell environment. This can’t be easily bypassed by an attacker, even with admin rights.

 

Blacklisting the PowerShell EXEs and .ps1 scripts isn't enough...

 

http://www.sixdub.net/?p=367