[1809, ou] Blocking PowerShell and Command prompt

[Ertech]

Is there a GPO to prevent users running\launching PowerShell and Command prompt in Windows 10 - we want the script or batch files to run in the background.

 

Thanks

[CHiLL]

I have the following GPO items set:

User Configuration > Policies > Administrative Templates > System: Don't run the specified Windows applications

cmd.exe

powershell.exe

powershell_ise.exe

 

User Configuration > Policies > Administrative Templates > Start Menu and Taskbar > Add the Run command to the Start Menu: Disabled

 

I also use File Screen on the file server to prevent users from saving certain file types to their Documents and also disabled the ability to right click the Start Menu.

Edited July 3, 2019 by CHiLL

[Ertech]

Would this prevent CMDs to run on the startup which is part of the profile?

[CHiLL]

Would this prevent CMDs to run on the startup which is part of the profile?

Not from my experience. I've moved away from startup scripts, but those GPO settings have been in place for years, including when we did have logon scripts.

[Ertech]

Many thanks! Managed to block cmd.exe, powershell.exe, powershell_ise.exe but the "Run" was not blocked - could there be something I am missing for W10?

 

[CHiLL]

Many thanks! Managed to block cmd.exe, powershell.exe, powershell_ise.exe but the "Run" was not blocked - could there be something I am missing for W10?

 

No problem.

To remove 'Run' from the Start Menu:

User Configuration > Administrative Templates > Start Menu and Taskbar > Remove Run from Start Menu: Enabled

 

To disable Win+ keyboard shortcuts:

User Configuration > Administrative Templates > Windows Components > File Explorer > Turn off Windows Key hotkeys: Enabled

 

To prevent the user from right clicking the Start Menu:

User Configuration > Preferences > Windows Settings > Folders

Add the following entries:

Name: Group 1

Action: Update

Path: %userprofile%\AppData\Local\Microsoft\Windows\WinX\Group1

Attributes: Hidden

 

Name: Group 2

Action: Update

Path: %userprofile%\AppData\Local\Microsoft\Windows\WinX\Group2

Attributes: Hidden

 

Name: Group 3

Action: Update

Path: %userprofile%\AppData\Local\Microsoft\Windows\WinX\Group3

Attributes: Hidden

 

Name: WinX

Action: Update

Path: %userprofile%\AppData\Local\Microsoft\Windows\WinX

Attributes: Hidden

Edited July 4, 2019 by CHiLL

[SimonInOz]

Hi, thanks for that. In relation to:

 

Add the Run command to the Start Menu: Disabled

 

This also seems to prevent me from using UNC paths and in fact any network location through group policy/AD. Is this correct?

[Ertech]

The GPO above hasn't disabled the UNC paths or the cmd lines within the search area -anyone got a solution for this?

[benjabrahamson]

Late to the thread but:

 

It's probably best to block scripts too, since users could run commands using notepad (and saving as a .bat file).

 

I believe powershell has a feature where only signed scripts can be executed, so perhaps block all except them, and sign your administrative scripts?

[HPlum78]

I have said this on a similar thread and will reiterate here, in Windows 10 PowerShell is restricted to the permissions and privileges that are assigned to your user. Execution policies are not a security barrier and don't install the PS 2 engine on your workstations or servers (unless you have an identified need). Turn on script logging and store them centrally. So on and so forth. Installing Python is a bigger risk to workstation security than doing the work and secureing your environments for PS.

 

https://blogs.msdn.microsoft.com/daviddasneves/2017/05/25/powershell-security-at-enterprise-customers/

[mrcrazy04]

Constrained Language Mode does seem to function as a security barrier, but you’ll need to enable AppLocker for it to work. It’s also not supported in PowerShellv2.

If you want to use AppLocker, NCSC have published a pretty comprehensive whitelist policy in their End User Device Guidance. The rest of the guidance is aimed at single user devices in large government departments, so is less likely to be relevant- but the AppLocker policies are worth looking at. https://www.ncsc.gov.uk/collection/end-user-device-security/platform-specific-guidance/eud-security-guidance-windows-10-1809#applockerconfig

[benjabrahamson]

@mrcrazy04 Thanks, that's a really useful link