Blocking Powershell ISE

[ITGURU]

I have a GPO which prevents users loading powershell.exe

however in the same policy i've added powershell_ise.exe but it only blocks the powershell.exe and not the ISE.

Please could someone advise how to block the ISE properly so students are unable to access?

Thanks

[NicholasEsping]

I have a GPO which prevents users loading powershell.exe

however in the same policy i've added powershell_ise.exe but it only blocks the powershell.exe and not the ISE.

Please could someone advise how to block the ISE properly so students are unable to access?

Thanks

 

We use applocker. Below is my policy it blocks cmd powershell/powershell ise and registry.

[color=#0000FF][font=Consolas]<[/font][/color][color=#800000][font=Consolas]RuleCollection[/font][/color][color=#FF0000][font=Consolas]Type[/font][/color][color=#000000][font=Consolas]=[/font][/color][color=#0000FF][font=Consolas]"Exe"[/font][/color][color=#FF0000][font=Consolas]EnforcementMode[/font][/color][color=#000000][font=Consolas]=[/font][/color][color=#0000FF][font=Consolas]"NotConfigured">[/font][/color][color=#000000][font=Consolas]        [color=#0000ff]<[/color][color=#800000]FilePathRule[/color] [color=#ff0000]Id[/color]=[color=#0000ff]"fd686d83-a829-4351-8ff4-27c7de5755d2"[/color] [color=#ff0000]Name[/color]=[color=#0000ff]"(Default Rule) All files"[/color] [color=#ff0000]Description[/color]=[color=#0000ff]"Allows members of the local Administrators group to run all applications."[/color] [color=#ff0000]UserOrGroupSid[/color]=[color=#0000ff]"S-1-5-32-544"[/color] [color=#ff0000]Action[/color]=[color=#0000ff]"Allow">[/color]
         [color=#0000ff]<[/color][color=#800000]Conditions[/color][color=#0000ff]>[/color]
           [color=#0000ff]<[/color][color=#800000]FilePathCondition[/color] [color=#ff0000]Path[/color]=[color=#0000ff]"*"[/color] [color=#800000]/[/color][color=#0000ff]>[/color]
         [color=#0000ff][/color][color=#800000]Conditions[/color][color=#0000ff]>[/color]
       [color=#0000ff][/color][color=#800000]FilePathRule[/color][color=#0000ff]>[/color]
       [color=#0000ff]<[/color][color=#800000]FilePathRule[/color] [color=#ff0000]Id[/color]=[color=#0000ff]"ce9d9fd5-d765-48df-b87b-e1bafd5653ed"[/color] [color=#ff0000]Name[/color]=[color=#0000ff]"All files"[/color] [color=#ff0000]Description[/color]=[color=#0000ff]"Allows members of the Everyone group to run applications that are located in any folder."[/color] [color=#ff0000]UserOrGroupSid[/color]=[color=#0000ff]"S-1-1-0"[/color] [color=#ff0000]Action[/color]=[color=#0000ff]"Allow">[/color]
         [color=#0000ff]<[/color][color=#800000]Conditions[/color][color=#0000ff]>[/color]
           [color=#0000ff]<[/color][color=#800000]FilePathCondition[/color] [color=#ff0000]Path[/color]=[color=#0000ff]"*"[/color] [color=#800000]/[/color][color=#0000ff]>[/color]
         [color=#0000ff][/color][color=#800000]Conditions[/color][color=#0000ff]>[/color]
           [color=#0000ff]<[/color][color=#800000]Exceptions[/color][color=#0000ff]><[/color][color=#800000]FilePublisherCondition[/color] [color=#ff0000]PublisherName[/color]=[color=#0000ff]"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US"[/color] [color=#ff0000]ProductName[/color]=[color=#0000ff]"MICROSOFT® WINDOWS® OPERATING SYSTEM"[/color] [color=#ff0000]BinaryName[/color]=[color=#0000ff]"cmd.exe">[/color]
           [color=#0000ff]<[/color][color=#800000]BinaryVersionRange[/color] [color=#ff0000]LowSection[/color]=[color=#0000ff]"*"[/color] [color=#ff0000]HighSection[/color]=[color=#0000ff]"*"[/color] [color=#800000]/[/color][color=#0000ff]>[/color]
           [color=#0000ff][/color][color=#800000]FilePublisherCondition[/color][color=#0000ff]><[/color][color=#800000]FilePublisherCondition[/color] [color=#ff0000]PublisherName[/color]=[color=#0000ff]"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US"[/color] [color=#ff0000]ProductName[/color]=[color=#0000ff]"MICROSOFT® WINDOWS® OPERATING SYSTEM"[/color] [color=#ff0000]BinaryName[/color]=[color=#0000ff]"powershell.exe">[/color]
           [color=#0000ff]<[/color][color=#800000]BinaryVersionRange[/color] [color=#ff0000]LowSection[/color]=[color=#0000ff]"*"[/color] [color=#ff0000]HighSection[/color]=[color=#0000ff]"*"[/color] [color=#800000]/[/color][color=#0000ff]>[/color]
           [color=#0000ff][/color][color=#800000]FilePublisherCondition[/color][color=#0000ff]><[/color][color=#800000]FilePublisherCondition[/color] [color=#ff0000]PublisherName[/color]=[color=#0000ff]"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US"[/color] [color=#ff0000]ProductName[/color]=[color=#0000ff]"MICROSOFT® WINDOWS® OPERATING SYSTEM"[/color] [color=#ff0000]BinaryName[/color]=[color=#0000ff]"powershell_ise.exe">[/color]
           [color=#0000ff]<[/color][color=#800000]BinaryVersionRange[/color] [color=#ff0000]LowSection[/color]=[color=#0000ff]"*"[/color] [color=#ff0000]HighSection[/color]=[color=#0000ff]"*"[/color] [color=#800000]/[/color][color=#0000ff]>[/color]
           [color=#0000ff][/color][color=#800000]FilePublisherCondition[/color][color=#0000ff]><[/color][color=#800000]FilePublisherCondition[/color] [color=#ff0000]PublisherName[/color]=[color=#0000ff]"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US"[/color] [color=#ff0000]ProductName[/color]=[color=#0000ff]"MICROSOFT® WINDOWS® OPERATING SYSTEM"[/color] [color=#ff0000]BinaryName[/color]=[color=#0000ff]"reg.exe">[/color]
           [color=#0000ff]<[/color][color=#800000]BinaryVersionRange[/color] [color=#ff0000]LowSection[/color]=[color=#0000ff]"*"[/color] [color=#ff0000]HighSection[/color]=[color=#0000ff]"*"[/color] [color=#800000]/[/color][color=#0000ff]>[/color]
           [color=#0000ff][/color][color=#800000]FilePublisherCondition[/color][color=#0000ff]><[/color][color=#800000]FilePublisherCondition[/color] [color=#ff0000]PublisherName[/color]=[color=#0000ff]"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US"[/color] [color=#ff0000]ProductName[/color]=[color=#0000ff]"MICROSOFT® WINDOWS® OPERATING SYSTEM"[/color] [color=#ff0000]BinaryName[/color]=[color=#0000ff]"regedit.exe">[/color]
           [color=#0000ff]<[/color][color=#800000]BinaryVersionRange[/color] [color=#ff0000]LowSection[/color]=[color=#0000ff]"*"[/color] [color=#ff0000]HighSection[/color]=[color=#0000ff]"*"[/color] [color=#800000]/[/color][color=#0000ff]>[/color]
           [color=#0000ff][/color][color=#800000]FilePublisherCondition[/color][color=#0000ff]>[/color]
               [color=#0000ff][/color][color=#800000]Exceptions[/color][color=#0000ff]>[/color]
       [color=#0000ff][/color][color=#800000]FilePathRule[/color][color=#0000ff]>[/color]
[/font][/color]
[color=#0000FF][font=Consolas][/font][/color][color=#800000][font=Consolas]RuleCollection[/font][/color][color=#0000FF][font=Consolas]>[/font][/color]

[ITGURU]

I have saved the code as xml and tried to import but get the error below

[NicholasEsping]

I have saved the code as xml and tried to import but get the error below

[ATTACH=CONFIG]65257[/ATTACH]

Try the one below my original example came from my intune csp file so was missing the AppLockerPolicy Version. I was able to import this example into my group policy editor.

[ITGURU]

That imported the 2 allowed rules, but not any of the deny ones, the code has non formatted characters presumable from the way its being pasted in.

[NicholasEsping]

That imported the 2 allowed rules, but not any of the deny ones, the code has non formatted characters presumable from the way its being pasted in.

The deny rules are listed as exceptions in the allow all files rule.

[ITGURU]

AH OK. If users search powershell in the start menu, they cannot open the folder, but if powershell_ise shows in the start menu as a search result, it still loads

[NicholasEsping]

AH OK. If users search powershell in the start menu, they cannot open the folder, but if powershell_ise shows in the start menu as a search result, it still loads

 

I am not sure I follow with the policy I use when a student tries to open powershell or powershell ise they will see a message saying the app has been blocked. The policy does allow all administrators to still open the applications with elevation. Below is what a student will see if running the policy I posted.

 

[jthompson]

The AppLocker rule that covers this for us is an exe path rule that allows everyone to run things in the path %WINDIR%\* with the following path exceptions added to it:

 

%WINDIR%\system32\WindowsPowerShell\v1.0\powershell.exe

%WINDIR%\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exe

%WINDIR%\syswow64\WindowsPowerShell\v1.0\powershell.exe

%WINDIR%\syswow64\WindowsPowerShell\v1.0\PowerShell_ISE.exe

 

Note that the PowerShell executables exist in two places, so you'll want to cover both of them off. Might that be what's missing for you?