Command prompt - remote shutdown block

[SteveB_NI]

Out of interest it appears students may have found a way of running command prompt, and initiating remote shutdowns on computers - or at the very least, getting a message prompted on remote computers that a shutdown will happen shortly.

 

It appears to be a proper shutdown prompt message.

 

From what I understand - no reports of a computer actually managing to be shutdown in this manner yet.

 

Any suggestions for what to do double check that students shouldn't have access to?

 

Thanks

[jthompson]

In Group Policy being applied to your student users, "User Config > Policies > Administrative Templates > System > Prevent access to the command prompt". If that's not already enabled, enable it, but leave its option "Disable the command prompt script processing also?" set to "No" if you want to allow any logon/logoff scripts to be able to continue to work.

 

You might also want to check whether students are able to launch any of the various PowerShell prompts. To block those, "User Config > Policies > Administrative Templates > System > Don't run specified Windows applications", adding:

• %SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe
  
• %SystemRoot%\system32\WindowsPowerShell\v1.0\powershell_ise.exe
  
• %SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  
• %SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe
  

 

If the students are using a batch script or some other script/executable to initiate those remote shutdowns, rather than doing directly from a prompt, that'd be a job for application allowlisting (i.e. AppLocker).

[Steve21]

Have you disabled uac etc? They shouldn’t be able to raise that permissions remotely normally as it’s admin requirements

 

If you run secpol.msc on a machine then go to local policies, user rights assignment and check force shutdown from a remote system does it have anything in but administrator group?

 

Steve

[SteveB_NI]

Thanks for this - I immediately disabled command prompt via GPO and applied to all students. This worked immediately upon next log on for a student user.

 

However - I added the Powershell blocks and noticed that Powershell still works for the users. I did notice I think that the name shouldn’t have a space in between power and shell but that made no difference either. Any further advise would be welcome.

 

With regards to secpol.msc - I can confirm only administrators can shut down so that’s good.

 

They appear to be running batch scripts. Is there any way to block .bats running on a blanket policy?

 

Thanks for all your help!

[jthompson]

The spaces in those PowerShell paths will have been added automatically by EduGeek upon submission of the post. There'll be no spaces in those paths.

 

If you're not already using AppLocker, I can recommend exploring that, as it will take care of a whole bunch of stuff for you on this front, including blocking any batch scripts other than those that you specifically allow. You'll want to take your time to get all your various rules in place first before making them all active, however. It'll block executables by default, so you'll need to add to the default allow rules as required for your environment before you start enforcing them. In AppLocker, one of the default rules is to allow everyone to run anything within %WINDIR%\*. You can block PowerShell by adding exceptions to that rule, so that the paths to the various PowerShell exes aren't allowed.

 

As a more immediate, temporary fix, you could use Group Policy to create a little Software Restritction Policy (Computer Config > Policies > Windows Settings > Security Settings > Software Restriction Policy), set to allow by default, with rules to block the PowerShell exes. That then wouldn't interfere with anything else in the meantime.

[mavhc]

The actual question is why do students have permissions to remotely shutdown computers, are they local admins of the remote computers?

[SteveB_NI]

The actual question is why do students have permissions to remotely shutdown computers, are they local admins of the remote computers?

 

It turns out they don't actually have powers to remotely shutdown - but could create a message simulating one. It never actually shut the computer down.

[mavhc]

What service are they using to remotely cause messages to appear?

[2097]

Net Send ?

[Norphy]

‘Net send’ was taken out back and shot when Vista was released.

[mavhc]

https://www.cezeo.com/tips-and-tricks/msg-command/ still, obviously, requires the correct permissions.

[ITGuyNW]

Net Send ?

 

haha I remember classmates using net send over 20 years ago.. precious memories..

[Duke5A]

The other side of this is local firewall policy. You didn't disable it, did you? It needs to be forced enabled in GPO and connections to RDP, inbound sharing and remote management relegated to your management subnet.

 

Below is what I'm using for student machines.

 

Administrative Templateshide

Policy definitions (ADMX files) retrieved from the central store.

Network/Network Connections/Windows Defender Firewall/Domain Profilehide

 

Windows Defender Firewall: Allow ICMP exceptions Enabled

Allow outbound destination unreachable Enabled

Allow outbound source quench Disabled

Allow redirect Disabled

Allow inbound echo request Enabled

Allow inbound router request Disabled

Allow outbound time exceeded Disabled

Allow outbound parameter problem Disabled

Allow inbound timestamp request Disabled

Allow inbound mask request Disabled

Allow outbound packet too big Disabled

 

Windows Defender Firewall: Allow inbound file and printer sharing exception Enabled

Allow unsolicited incoming messages from these IP addresses: xxx.xxx.xxx.xxx/xx

 

Windows Defender Firewall: Allow inbound remote administration exception Enabled

Allow unsolicited incoming messages from these IP addresses: xxx.xxx.xxx.xxx/xx

 

 

Windows Defender Firewall: Allow inbound Remote Desktop exceptions Enabled

Allow unsolicited incoming messages from these IP addresses: xxx.xxx.xxx.xxx/xx

 

Windows Defender Firewall: Allow local program exceptions Enabled

Windows Defender Firewall: Define inbound port exceptions Enabled

Define port exceptions:

5900:TCP:xxx.xxx.xxx.xxx/xx:enabled:VNC Port Exception

 

Windows Defender Firewall: Define inbound program exceptions Enabled

Define program exceptions:

%PROGRAMFILES(X86)%\LANSchool\student.exe:10.0.0.0/8:enabled:LANSchool Student

%PROGRAMFILES(X86)%\LANSchool\LskHelper.exe:10.0.0.0/8:enabled:LANSchool Helper

%PROGRAMFILES(X86)%\LANSchool\lskHlpr64.exe:10.0.0.0/8:enabled:LANSchool Helper x64

%PROGRAMFILES(X86)%\Faronics\Deep Freeze\Install C-0\DFServ.exe:10.0.0.0/8:enabled:Deep Freeze inbound

%PROGRAMFILES(X86)%\promethean\screenshare\screenshare.exe:*:enabled:ScreenShare

 

 

Windows Defender Firewall: Prohibit notifications Enabled

Windows Defender Firewall: Protect all network connections Enabled

[Duke5A]

haha I remember classmates using net send over 20 years ago.. precious memories..

 

Wait, I used to do that.......

 

....I feel old. :-/

[dapaulio]

We had an instance where a student managed to shut down a lot of the computers because a staff member left themselves logged in and unlocked to a classroom management software that supported shutdown feature

[mjhardisty]

Also ensure that any exceptionables are banned on your student file server by turning on File Screening in File Server Resource Management.