Powershell Execution Policy best practice

[disk]

We are looking to grant our desktop support techs the ability to create/run some basic powershell scripts for things like copying desktop shortcuts to their labs, etc. The question came up regarding setting powershell execution policy to bypass on the lab machines. Trying to determine is this is acceptable or not. Has anyone else gone and done something similar at your school? Implications? Advice? Thank you!

[psydii]

Here, people writing powershell scripts are issued code-signing certs from our enterprise CA.

[disk]

I was assuming this was the correct way. In addition to this, does your college allow desktop techs this ability via domain admin credentials or is this usually reserved for sys admins? We use Deep Freeze so I am not too concerned with the lab machines, especially since so many courses require local admin privileges and some even teach powershell. The concern is more some accidental script running against staff or faculty. Thoughts?

 

Back to code-signing, reading through various sites and blogs online, it seems fairly confusing as to whether or not the execution policy for powershell is any kind of security issue or not. If anyone here has some great reference or insight regarding this, I would love to hear it!

[psydii]

In our setup code signing certs can only be requested by members of a particular security group. Members of this group are not DA or even Local Administrators.

 

Each Desktop Support tech gets an account for doing admin work on end user devices. GPO makes these accounts admin on a subset of machines. These accounts are members of the Protected Users group. Devices cannot communicate laterally due to local firewall rules. (If I was going to be even more secure, we'd add the tech account to local admin on demand and only for the duration of the work they were doing.)

 

They have to write and sign their scripts in their day to day non-administrative account.

 

https://stackoverflow.com/questions/67270197/windows-powershell-policy-execution-bypass?msclkid=727f3d9ac70311ec86d8b7e14af1d8e5 echoes my understanding of the topic. If code signing is required by GPO a user cannot bypass it.

 

That said there are several things I see regularly managing to launch with the -executionpolicy bypass flags (something to do with Defender I think).. so I am not at all sure whether being system offers a way for bypass to work. But at the end of the day if you are admin/system and a bad guy, you've won that box, and any others that share the same admin username/password.

[HPlum78]

Jeff Snover says this

 

"The reason why PowerShell has a -ExecutionPolicy BYPASS parameter is to make it absolutely clear that it isn't a security layer."

 

And he knows a thing or two about PS...

 

https://devblogs.microsoft.com/powershell/powershells-security-guiding-principles/

 

The above may help.

[mavhc]

Right, it's to stop you accidentally running things you downloaded really.

[HPlum78]

Yeah I hear this all the time 'I have found this code on the Internet...'

 

I shudder take a deep breath and hope all I see is get- :-p

[mavhc]

I found linux on the internet, seems fine.

 

Question is what permissions does the user running the code have

[psydii]

Jeff Snover says this

 

"The reason why PowerShell has a -ExecutionPolicy BYPASS parameter is to make it absolutely clear that it isn't a security layer."

 

And he knows a thing or two about PS...

 

https://devblogs.microsoft.com/powershell/powershells-security-guiding-principles/

 

The above may help.

 

I sort of knew that deep in my soul. But that is daft. We require executables to be correctly signed and in the right places (applocker). This stops most incidents of *END USERS* running stuff we don't want them to, including many many pieces of malware over the years. Of course there are/were bypass techniques (I've seen a Year 11 wrapping exe's as dll, and dynamically loading it via flash embedded in a pdf), but they should not be trivial. Just because you can run code on a box does not mean you be considered to have SYSTEM level of access, that is denying the entire design and purpose of the NT security model.

 

Powershell should honour the instructions of the administrator, I mean if the user is admin, then sure let them bypass the policy (maybe?) but an end user? No.

 

That said the horror show that having python on a computer opens your network up to is something I choose not to consider lest staring into the abys breaks my mind.

 

(hint, Modern security tools basically don't look into what is going on in app-store python or WSL so chaos can be launched from there without leaving traces in the more well understood logs)

[mavhc]

If your network is insecure then your network is insecure, stopping python or powershell running won't make it secure