Powershell Access - Preventing

[SimonInOz]

Hi,

 

Is there a way to prevent powershell being launched/accessed by students? If someone has a straightforward way, preferably with group policy, that works it would be appreciated.

 

I have tried SRP with a powershell hash entry, still launches. (Other items in the SRP do work though)

 

Cheers

Edited August 29, 2019 by SimonInOz

[HPlum78]

There is nothing that can be done in PowerShell that your users cannot do in the GUI, by that I mean that if you set your permissions correctly for your student identities then even if they access PS they have no more access than you allow. There is little need to remove powershell in Win10. Clearly if you install the version 2 shell then that is not the case but no one has PS v2 installed on their workstations/ servers these days, do they? And if you do then don't (unless you have identified an absolute requirement for it)

[HPlum78]

You can test for v2 by running powershell.exe - version 2 or

Get-WindowsFeature |? {$_.name -eq "PowerShell-V2"}

 

https://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/

https://blogs.msdn.microsoft.com/daviddasneves/2017/05/25/powershell-security-at-enterprise-customers/

Edited August 29, 2019 by HPlum78

[Ertech]

Check this out - http://www.edugeek.net/forums/windows-10/208030-blocking-powershell-command-prompt.html

[HPlum78]

As I was trying to say without saying it, it's simply not enough to use the GPO to remove the running of PS. Do the work and secure your environments....

[mrcrazy04]

If you configure AppLocker (assuming you're running Windows 10 Enterprise), then that will make PowerShell use Constrained Language mode. This will prevent the use of more advanced functionality (like loading .NET libraries and invoking functions that allow AppLocker to be bypassed).

Alternatively, you could use AppLocker to block PowerShell completely (just remember to block every version of it, including ISE). You should do that with a whitelist though, to stop users copying the binary to a new location and running it from there.

 

NCSC have included a pretty solid AppLocker policy in their End User Device Guidance, which should be a good starting point - https://www.ncsc.gov.uk/collection/end-user-device-security/platform-specific-guidance/eud-security-guidance-windows-10-1809#applockerconfig. The guidance is mainly aimed at government departments with single user devices, so the rest of it probably won't be relevant.

[SimonInOz]

Cheers mrcrazy, appreciate the information.

[SimonInOz]

Cheers, thanks for the info

 

- - - Updated - - -

 

thanks a lot, appreciated.

[free780]

You can go down the route of signing any powershell scripts. Particularly if you have powershell scripts running in the user context. You can also forward the Windows Powershell log events to a server to get some insight if it is an issue.