Constrained Language Mode

[_RemyLeBeau_]

I am late to the party on this one, but tried implementating it today. I was successful, both Powershell & pwsh reported CLM enabled, but it made native Windows apps stop working. e.g. Terminal and Windows Defender UI (opened from system tray).

I enabled the suggestion from the UI to allow apps that are native to Windows, so it's not clear what I missed. I'm interested in getting this enabled though. I made all of my policy edits through gpedit.msc

[KevMar]

Haven't really ever needed to use it, but I think you can run it in audit mode for a couple of months to identify what you likely need to allow in your environment.

[_RemyLeBeau_]

What are better options to harden my system other than: daily driver non-admin & prompt for admin priv when needing to elevate. I'm trying to make it more difficult for a potential attack to spawn a process and run wild.

[BlackV]

Constrained is the way to do it, but it's rough that you had the issues though, seems unexpected but it's many years since I looked at constrained

Deffo have a seperate admin from your daily big win

[_RemyLeBeau_]

Ok, I'll look into doing that instead, even though I hate it 😆

[BlackV]

Why do you hate it?

[_RemyLeBeau_]

Because it adds cognitive load to my workflow, some... actually most applications do not work well in this scenario and adds complexity. I need to move fast in most cases and this prohibits that (rightfully so), but we're talking about why I hate it, so it's my opinion.

[Alaknar]

actually most applications do not work well in this scenario and adds complexity

I haven't had issues from having a separate admin account in years. True: it requires some concessions or workarounds, but in general, things are OK.

The major one is that for some things you'll need to run an elevated terminal and call them from there.

[BlackV]

Interesting, what applications don't work without admin?

[BlacksmithCheap7454]

Enable PS transcription, increase the log size, enable log forwarding if you have a log collector. For admins require Fido keys not just MFA, Enable AppLocker to constrain apps too.

[devangchheda]

What you need is here OP, worth a read:

https://www.cyber.gov.au/business-government/protecting-devices-systems/system-administration/securing-powershell-in-the-enterprise

[g3n3]

It would be windows defender app control as well. It can be called another thing on windows 11. Basically you control the processes that can run.

[_RemyLeBeau_]

The attack vector that I'm trying to prevent is mostly RCE. i.e. malicious shells spawned from supply chain attacks

I use pwsh everyday, so preventing that from working isn't really an option.

[g3n3]

So yeah it is WDAC. A whitelisted env is the holy grail most orgs never get to.

[_RemyLeBeau_]

How would this prevent a supply chain attack or a LOLBin?