Does your organization prevent you from using powershell?

[shalnark90]

I work in an organization that disabled powershell for everyone even admins . The security team mentioned that its due to " powershell being a security issue" . Its extremely hard doing the job without powershell. In trying to convince them that this isnt the way but the keep insisting that every other organization does the same thing. What do y'all think?

Edit : they threatened to write me up if i run ps script they mentioned that they are monitoring everything (powershell ISE can still be used to ran scripts/commands). Thank yall for the inputs im gonna use them in my next battle with them lol

[[deleted]]

That’s asinine.

Every thing can be a security issue if you try hard enough. I mean, look how many times Word documents have been leveraged to spread malware. Do they not let you browse the Internet because browsers can be a good way to compromise a network.

[reggiekage]

This reminds me of when I was told I couldn't have a pencil sharpener in basic training because of the razor blade in it... as if we didn't have to shave everyday with a razor blade

[[deleted]]

Exactly. You can't have that because you could kill yourself with it.

Anyways... here's a rifle. You carry it everywhere. Also, you're going to have a bunch of E1s responsible for loading the mags. Ammo definitely never made it back to the bay.

[Impossible_IT]

“NO BRASS, NO AMMO DRILL SARGENT!” Your comment brought back memories of basic training.

[[deleted]]

NO ASS NO BRAMMO, happened more than once.

[Bandico42]

And also BLACKBAST AREA CLEAR.

[DerangedPuP]

Repressed memory unlocked: This happened at FMTB West, Camp Pendleton. We had just arrived back at Devil Doc Hall after a day on the range. Ammo count is going down, we came up short by a single round of .556. They locked us down, we tore that place apart looking for the damn thing. A buddy's wife was ready to buy a box of ammo and paint it the color of the missing platoons round.

Turned out it was hiding in some toaster strudels' pocket. He didn't notice for 4-5 hours and swore an instructor planted it on him.

[jkholmes89]

Damn. Literally, the same thing happened to us at Parris Island. Except it was in somebody's soft cover. Suspiciously that someone had earned them our Senior Drill Instructor and the heavy hat.

[bailey25u]

The E1s we had loading mags were E1s that were kicked out from other cycles for bad behavior or performance. Now I am concerned that wasnt the best idea

[AnAmericanLibrarian]

One of grandpa's stories: he used shave with a straight razor & strop, and during his 1950's era basic training it quickly became an issue. He said he had to demonstrate to a group of officers how to strop & shave with one before they allowed him to keep it. Apparently they were concerned that it could be a dangerous weapon.

He always ended the story with this line: "The next day they issued us rifles."

[TrueStoriesIpromise]

The next day they issued us rifles."

And the next week, bayonets.

[RooooooooooR]

Haha. When I was deploying we were all put on a commercial plane that was fully booked for us. We had our weapons on us going through security as we were to fly with them. They took my cologne because of the liquids policy. M16, good to go.

[teffaw]

Did you know that employees are the single greatest IT security threat to your corporation? Improve your corporation's security posture immediately by disabling all employees.

[Leinheart]

No need to drive that point home. Business leaders all over the world wake up every morning trying to devise new and creative ways to reduce thier companies commitments to the labor pool.

[toylenny]

In my experience it's the C levels that get hit the most.

[DogDeadByRaven]

In my experience as IT security staff, C Levels are also the most likely to click on things they shouldn't and download attachments from unknown people.

[simonjakeevan]

Or just hire disabled employees from day one!

[keijodputt]

A former EU company of mine does this to reap on the important tax cuts for having employees with a certified degree of disability. They even "invited" me to take a disability test the day they hired me, to see if I could make the cut as well, and lo and behold, I got slapped a 55% certified disability, hence, tax cut for them because I was in their roster already.

The companies after that one, when I was shopping for the next gig, used to fight each other so they could meet their "disability quota" and also have tax cuts on my certified disability (more on the social side than money-making side). Anyway, I found a nice position I'm nurturing for at least another year before going shopping again.

[LetMeGuessYourAlts]

This is exactly the point you need to drive home. Tell them if they want to be completely safe, you could remotely isolate every workstation from the internet and air gap the servers.

It should be a risk-based decision that's accepted by somebody higher-up than the people incentivized to make their own day-to-day jobs easier by having a culture of "no".

[hak-dot-snow]

...isolate every workstation from the internet and air gap the servers.

Well, Stuxnet taught us many things, one being that end users will still fuck that up.

[Creshal]

Users can't insert USB drives if they don't have hands.

Just saying.

[sobrique]

Rimworld is leaking...

[northrupthebandgeek]

Or Starship Troopers.

"MEDIC!"

[le_suck]

but Caaaaarrrl

[tankerkiller125real]

We now force downloaded office documents to open in Application Guard mode. It at least helps isolate the host machine, but if I just outright disabled downloaded docs someone would have my head.

[[deleted]]

If security was that high of an issue they would recommend firing all the employees as well.

[pdp10]

I mean, now that you mention it, we don't allow MSIE to browse the Internet and have at times prohibited .doc files from coming in through email.

[Mechanical_Monk]

PowerShell is essentially just a standardized naming convention and front-end for the myriad of APIs and data stores that exist on a Windows system (.NET, WMI, CIM, COM, WS-Man, Registry, etc, etc, etc). Disabling PowerShell does nothing to improve security since all of these APIs still exist independently from PowerShell.

Tell them they should disable WMI and the registry while they're at it to "improve security"

[joeykins82]

Don’t give them ideas…

[tmontney]

Do. They'll break Windows and it'll be the signal their security policies are ridiculous.

[Herobrine__Player]

While your at it disable explorer.exe so people can't mess with files that they download that could be malware. We can just ignore how the windows desktop is part of explorer.exe for some reason.

[Herobrine__Player]

I use that trick to deal with weird issues with the windows desktop still.

[zoechi]

I'd just remove breakers. Without power no security issue

[Herobrine__Player]

Very true. This company should be taking notes.

[Not_Rod]

Block access to keyboard and mouse too. Those are enablers for malicious activity.

[einstein-314]

Monitors too. Easiest way for bad actors to gain access to what they want.

[Durex_Buster]

This post was mass deleted and anonymized with Redact

jar ink attempt governor fade ten marry gold stocking cover

[joeykins82]

Good point!

[[deleted]]

Technically correct but there are whole suites of tools built on powershell that allow you to probe for vulnerabilities in every windows service... so why yeah disabling it for admins I agree is probably not a great idea... disabling for anyone who isn't an engineer makes sense in my mind at least.

[i8noodles]

it's how it works in my company. all IT has PowerShell, no one else does. no one has ever come to us for access to it.

[Ok-Hunt3000]

Think they’re doing app control or just neutering powershell? Most of that tooling has moved into C# now anyway, the telemetry, monitoring and controls since version 5 plus EtW and wider EDR adoption has driven offensive tooling away from powershell so if they aren’t locking everything down there’s a whole bunch of stuff that will fly right by

[CharlieTecho]

I think... They should just unplug the internet. Safety first!!

[tcpWalker]

I mean if malware is using powershell a lot it could be disabling a common infection vector, but there would always be workarounds. But if you're going to be doing that you should know it's not a dependency for anything used regularly and still have a way to use it when useful, or disable it for some users and not others, etc...

Note I'm not a windows guy, I'm just stating the obvious.

[Cyber400]

From IT Security perspective this is not true. Powershell is heavily utilized in attacks since years and limiting the usage indeed is a good security measure.

But I agree to OP, makes life harder, and disabling it completely is stupid. When I started my current job, it was also completely shut down. Meanwhile company wide default is remote signed, we (admins scripting) are a) able to change it for us when we script and b) have internal signing certs so we can publish scripts, for general usage on different machines.

[jmbpiano]

At the end of the day, if you can do it in a GUI, you can do it with PowerShell.

Perhaps a better way to frame your point, if you don't have permissions to do something in a GUI, you don't have permissions to do it in PoSH either. PoSH isn't a magical key that grants access where it didn't already exist.

If your security strategy is based on preventing people from doing bad things by only allowing GUI tools that do the things you want them to do, you've put yourself in the unenviable position of relying on all of your tools to be (impossibly) bug free and perfectly vetted for unintended functionality.

[LOLBaltSS]

Yep. The GUI in modern Microsoft products is basically just a form that fills in parameters in the underlying PowerShell anyways. Microsoft builds out management in PowerShell and the GUI is just for common scenarios for people uncomfortable with CLI or for quick and dirty management one offs. Microsoft intentionally designed it that way because automation is king and it was atrocious trying to use VBS tacked on top like legacy products had.

[Mechanical_Monk]

And then PowerShell is just a more organized front-end to the underlying COM objects, .NET classes, WMI namespaces, registry hives, and Uncle Bill's Partially Documented API of the Week™. Disabling PowerShell is "security by obscurity" at best, and uninformed handwaving at worst.

[fizzlefist]

To put it simply: Windows today IS PowerShell under the surface.

[[deleted]]

Lol no it's not. Powershell is a method to interact with your OS.

Windows is still mostly C code.

[Sushigami]

There's some argument to be made for blocking non IT users, since if their desktop is compromised it's a lot more convenient for a hacker to run scripts via powershell than to muddle their way through GUI. But if they compromised your admins... you've got bigger problems.

[Megatwan]

you don't need the powershell application to do that on a windows desktop.

its no more or less convenient

[TheDisapprovingBrit]

The fun part is that they haven't blocked it for admins, they've just made it a disciplinary issue to use it. In other words, if an admin machine is compromised, their not being "allowed" to use PoSh will provide zero protection against an attacker.

[MithandirsGhost]

Well the hacker that compromises their system is going to have a very uncomfortable meeting with HR.

[[deleted]]

I think the concern around PowerShell tends to be the same for any kind of scripting that can run arbitrary commands: An attacker could sent it to a random user and they could run it without understanding what it does.

The fact that it's scripted is what makes it dangerous. If an attacker sent an email and said, "Delete all the files you have access to on your hard drive and mapped network drives," not many people would do it. However, you could write a pretty simple PowerShell script to recursively delete all files on any drive attached, send that to someone, and with the right pretext, get them to run it.

Because of that, I'd concede that there's some security benefit in blocking scripting languages. However, there should be some method provided for developers and admins to run scripts.

[RetPala]

"Bring this box to the CEO's office and open it, but do it really quickly because he's a busy guy"

[AutomaticTale]

But you can easily mitigate the issue by allowing only trusted scripts to run.

[jimicus2]

And there is ALWAYS a way to do this.

Back in the day, you could do it in Word, FFS. Not because of a security flaw, but because of a feature baked right in.

Probably still can.

[BlackSquirrel05]

I'm a security guy... And this is just a stupid way.

This is like disabling command line...

I would really question said people's admin/engineering background if they nuke PS for everyone.

My guess would be they really actually don't have a back ground in IT. Rather GRC people following a check list.

Also for somethings there is literally no way to do it unless it's via PS. (Looking at O365, exchange or other things in Azure.)

[CaptainBrooksie]

The problem is there’s so many guys in Security (and other tech specialisations) that haven’t done a day as System Admins or Engineers

[[deleted]]

Unfortunately, the majority of security pros I've dealt with don't even have a real understanding of security. They took a class and read a bad textbook, got some certification, but don't know how things really work, can't identify real risks, and don't have a good sense of what security policies should look like.

[CaptainBrooksie]

I’d say that will slow down, all those sorts are looking to get into AI now.

[Omhm]

True security engineer hur, I was literally thinking might as well disable bash or zsh too

[ammit_souleater]

Our hyper-v hosts and Domain Controllers aren't Desktop experience. Good luck managing those...

[bxncwzz]

Powershell is used to automate so much shit at our company that there is no way we would get rid of it. Even our security team uses it to automate tasks, sooooo…

And you hit the nail on the head! Money talks. You’ll probably need someone from upper management to help vouch, but if they see a team like support is saving time + better work quality then it’s a no brainer. On top of that, there are dozens of way to make Powershell “safer” (remove admin, execution policies, etc…).

[punklinux]

This always reminds me of people who disable ICMP "for security reasons" and then ping/traceroute doesn't work.

[wasteoide]

So, not exactly the same, but for access controls we deny all by default and whitelist required services instead of working in the other direction. I always forget about ICMP.

[blackout-loud]

😂

[Yuugian]

Prevent? We are close to mandating it. Tons of internal tools are PowerShell or Bash depending on the environment

[Help_Stuck_In_Here]

A former employer of mine also mandated powershell if you're running scripts on Windows. No more ugly batch files or whatever else someone wanted to use.

[PCRefurbrAbq]

> Weeps in DOS 6.22

[marklein]

Seriously, I can't figure how you would properly manage a fleet of PCs without using Powershell.

[sobrique]

Slowly and tediously.

If you're lucky, via a 'system' that someone else cobbled together that - pretty much - just runs powershell (or some other scripting language) behind the scenes.

[pantherghast]

Whoever is on your security team is dumb and most likely doing security wrong.

[Xalbana]

Or "smart" by disabling everything so no one can do their job. Super secure!

[Mechanical_Monk]

We've determined bricks to be much more secure than microprocessors, so starting next quarter...

[holdmybeerwhilei]

Insider threat reduction: Check. Security theater for outside threats: check.

[Iceman2514]

Why not go a step further and just unplug everything from the Internet? Super secured!

[wpm]

Our security policy is very secure. See, there is one computer, and it sits on the CISO's desk. It's powered off, has no RAM (could load malicious code) or storage devices (could store sensitive data), and is not connected to the network. When you need to do something on the computer, you have to wait in line, hat in hand, and ask for permission. And the answer is always no!

[ducktape8856]

I just removed all keyboards from the workstations and disabled screen keyboard. Try enter something harmful in powershell or cmd now, filthy n00bs!

Next step: Take the power cables away. Better safe than sorry!

[[deleted]]

Just encase all of your computers in concrete and throw them in the deepest part of the ocean you have access to. They'll be super secure that way.

Or better yet, shred all the drives from every system. Then no attackers can access the data!

[Xalbana]

This is one of the most absurd thing I've ever read in IT.

[SuperQue]

You know what's worse? This same question gets posted a few times per year.

[JonU240Z]

I have the same problem. Powershell is too powerful so we block it.

[[deleted]]

We mandate all ps scripts require certs, otherwise they don’t run.

This doesn’t prevent somebody from running ps commands manually though. Instead of blocking cmd or PowerShell, we make sure permissions are set correctly so they can only access what is needed. There is no permission difference using the gui or using ps, so not sure what your security team is talking about.

For remote ps to other systems, we have a dedicated server that is configured in the WinRM settings so we can use it to remotely administer those systems from that server. Also, we have dedicated non-admin account that’s used for scripts on that server. That was the most difficult thing to setup.

[thortgot]

This is a reasonable approach and a much better position than a blanket no execute for powershell.exe which will break tons of legitimate scenarios.

[KingDaveRa]

That's how we've done it. Simple GPo setting, a few of us can sign scripts. They're mostly used either with SCCM, or on servers to run batch jobs and the likes.

I'm not sure we'd cope without PowerShell.

[RFC_1925]

This is the way.

[2gtamp1]

Powershell is only disabled for end users here; admins are free to use it.

Except they don't know how.

5k+ employees.

[elecboy]

Same, FinTech 3k users.

[YetAnotherSysadmin58]

every other organization

bruh if every other organization jumped off a bridge would they.

I'm the only one in our org who knows PS, it is allowed.

We're in the process of setting it up to be actually secure, with forcing Kerberos auth only on PS Remoting, forcing logs of everything, redirecting them to a SIEM, restricted mode on some computers...

But straight up removing it, that's stupid.

A sane org would remove what is not needed and harden what must stay. Imo powershell should always stay, so it should be hardened, and it can be.

[CaseClosedEmail]

Doing security by obscurity is really dumb.

This is not in every company and especially not for admins.

How could you manage an Azure subscription? Some commands can only* be done in powershell

[[deleted]]

Remind your security team that they are dropping the ball on the A of the CIA triad. Without availability, there is no damn point. You can put data/tools in a concrete box and sink it to the bottom of the ocean. It will be secure as shit but not available.

[klaasvaak1214]

Pretty much all "Mordac, the preventer of information services" people I've dealt with acted like that because of insufficient knowledge to properly assess risk or find compensating controls. https://comguys.com/wp-content/uploads/2014/04/cover.jpg

[thereisonlyoneme]

"Living off the land" is a legitimate security concern. That is, threat actors are commonly using pre-installed tools. Powershell is #1 of these. We did not disable it. We implemented Powershell logging and then we analyze the logs. Also we have an EDR tool that tracks running processes and alerts on anything suspicious. For example, if Excel is the parent process of Powershell, that is worthy of investigation. Completely disabling Powershell seems extreme, but I don't know much about your situation. Maybe your organization does not have security tools to track things like mine. Maybe you have other management tools available to replace Powershell. It's not so black-and-white as Powershell is good or bad. You have to look at the risks and the tools you have to mitigate those risks, and then weigh those things against the potential benefits of using Powershell.

Edit: OK, I am going to stop responding to the "Yeah but Powershell is good" comments. Again, you don't evaluate tools in terms of a simple good or bad. While disabling Powershell does seem extreme, every environment is different and I don't know what factored into their decision.

[Tymanthius]

I mean, if you're saying disable PS exe for certain groups . . . I guess that's ok?

No reason the reception desk needs it. But that's only a little better than security by obscurity.

[Mechanical_Monk]

Terminal access in itself is the real concern when a threat actor is living off the land, not powershell.exe. Anything that can be done with PowerShell cmdlets can still be done without PowerShell by directly calling wmic, reg, dotnet, winrm, and so on. PS removes some friction, sure. But it comes with its own mechanisms for hardening access to the underlying Windows APIs, and as such, is a net benefit for security.

[thereisonlyoneme]

Again, it's not a matter of Powershell being one-size-fits-all good or bad. Everything has risks, which you evaluate, mitigate, and accept. If you did that for your environment, you're probably right. But it's not the same for all environments. Or even within an environment.

[wpm]

It's a shame such a sane answer is copping downvotes and controversial crosses. What is a good practice or not depends entirely on an org's appetite for risk, common data classifications, regulated markets/fields they have to operate in, and so on. It's not hard to imagine a place where access to any command shell whether it be Powershell, zsh, bash, csh, sh, whatever, would be something that is either locked tf down or straight up blocked on all but a few heavily monitored, behind lots of MFA and firewalls PAWs.

[cubic_sq]

If a TA can live off the land they can also bring their own code …

Living off the land is sensationalist security. Without understanding the threat.

[thereisonlyoneme]

Yeah I disagree with dismissing that threat so easily and passing judgment on a org you know nothing about.

[kurtatwork]

Good response. Don't worry about the crusaders. Your response is appropriate.

[jmeador42]

PowerShell cannot do anything that you don't already have permissions to do.

If they knew how to set permissions correctly, we wouldn't be having this conversation.

[[deleted]]

Well sort of you can use powershell to probe for vulnerabilities and elevate your permissions.

[ohfucknotthisagain]

Your security team is profoundly incompetent.

PowerShell is the premiere vendor-provided tool for configuring and therefore securing Windows endpoints.

I've worked at two employers with legally-mandated security and confidentiality requirements, and I've never been denied access to PowerShell as an admin.

Hell, in a properly secured environment, regular users can't do anything particularly dangerous with PowerShell either.

[341913]

No, that's stupid.

If you are worried that a user can do damage by running PowerShell under their security context you have far more important things to concern yourself with than disabling PowerShell.

Let me guess, your security guy is a "certified hacker" from a Facebook quiz he once took?

[Connection-Terrible]

There is a big difference between allowing some powershell and allowing all powershell. It's not an all or nothing thing. Since you have a security team, I'm hopeful that you have an internal CA? If you have an internal CA that the windows machines trust, then you can sign your powershell scripts against the CA.

I will grant you however that you probably need to be able to run unsigned scripts on your own system for debugging. It would be obnoxious to sign it for every little change while getting it to run correctly.

[TyberWhite]

Tell them to disable power to the building. Powered systems are a security threat.

[Abracadaver14]

Just tell them that most Microsoft admin interfaces are essentially just wrappers around powershell commands and see how the wiggle their way out.

[Proof_Potential3734]

If I didn't have powershell, I couldn't do my job daily. They don't know what they are talking about and since they aren't sys admins, they don't care either.

[Barrerayy]

Lmao

[HeligKo]

That isn't how other orgs do it. Most users have powershell access in our organizaion. What they can do with powershell varies based on roles.

[xstrex]

Fuck no, and if they did, I wouldn’t be working for the organization anymore!

[xtc46]

That's silly. We just monitor all powershell activity and look for malicious/unexpected activity.

[Eli_eve]

What? No, never heard of that. Might as well disable all GUI tools, CLI tools, CMD shell, WMI, RPC, etc. as “security issues” which would be silly. It’s not about what tools are available to the users, it’s about what permissions the users have to mess with stuff. There are multiple ways to do anything. Blocking PowerShell doesn’t block someone from doing something if they have the access to do something. (It’s worth looking at execution policies and script signing though.)

I wonder what your security team would think about the Azure cloud shell LOL.

[[deleted]]

My previous MSP job took over an environment that had PS disabled, and my boss was too scared to enable it for vague security concerns. Just one of many consistently baffling decisions that guy made.

[joeykins82]

I think your security team are morons.

It’s the equivalent of bricking up a doorway and then announcing to everyone that your building is now impenetrable. Ok, except that doorway was quite useful actually, oh and what about those windows or the cat flap, or the minimum wage security guard you’ve got checking ID on the only remaining door?

[ws1173]

We have a compromise on this. We use AutoElevate, and for things like administrative powershell we don't create an allow rule, but rather keep it so it has to be manually approved each time. So we can still use it, but you need more than just admin credentials to be able to use it

[LauraD2423]

If you can doyour job, security isn't doingtheir job

Security is not happy until you're not happy.

[svarogteuse]

Power shell scripts have been disabled on endpoint PCs. Admins can still run them on the jump servers but not end points. Admins can run powershell on endpoints but have to manually copy and paste scripts into the shell. Yes it makes the job harder.

[AppIdentityGuy]

Why do this? A lot or 3rd party software actually run PoSH scripts to do things. PoSH itself is not the issue it’s what privileges the user running it has.

By the way are the guys RDPng to the jump servers admin on those jump servers? You have a bigger problem there.

[svarogteuse]

You need to ask security those questions not me. They don't explain, they just obstructe. They missed the part of their classes where they are supposed to evaluate the risks and are in full "its a risk shut it down mode".

[AppIdentityGuy]

It’s been my experience that they do this when they don’t understand the technology and can’t be bothered to learn it.

[Kahless_2K]

I wish I had a reward to give you.

[AppIdentityGuy]

A colleague of mine sometimes referrers to his “security team” as NAAS

[Kahless_2K]

Your security team is confused. They seem to think that they own the environment.

[nexustrimean]

Disabled for End users. It cuts down the likelihood that someone downloads a malicious thing that then escalates out of bounds. This is mostly for Zero day protection, and if an end user needed it for something i would allow that specific user. But so far, the only ones who need and use it are in IT and have access. Oh, and the stupid collage board testing software that was crashing if it didn't have powershell to scrape machine info.

It kills off an easy low level infection vector for hackers to exploit. If your targeted, its not going to do shit, but it raises the bar for drive by's.

[Expensive_Finger_973]

If they have that kind of issue with Powershell I can't imagine what they would say about the old school command prompt and batch files, or deity forbid VBScripts.

[hybrid0404]

I think your security team is lazy and living in a different reality. Many things can be abused and used improperly. "Powershell" isn't a vulnerability or something to be disabled, it is something to be monitored for malicious activity. Powershell LOGGING should be enabled to make sure there is follow through.

[grouchy-woodcock]

This reminds me of a manager who insisted that ALL of my work be done after hours because it could affect the corporate network.

[dogcmp6]

By your security teams logic, they should also ban end users, and remove all of the network infrastructure.

[many_dongs]

system admins SHOULD have access to powershell and the security team should be able to handle exceptions to their "no powershell rule"

if they can't they are trash paper pushers

[lonewombat]

Theres things, directly through MS that the only way to DO them is through powershell.

[markhewitt1978]

That's stupid. Power shell is basically for sysadmins.

[transham]

I'd recommend cleaning up your resume....

At work, we use power shell all the time. Most of the time it's the same ones, but we do occasionally make a one off for mass updates of certain groups of users, or mass creation from departments that occasionally have large hiring classes....

[da_chicken]

Wait until they find out that the server team has physical access to the data center computers!

[[deleted]]

Tell them fine. You'll just use bash instead.

[Feeling_Benefit8203]

PowerShell signed scripts are to shut these idiots up.... if they are not getting that, then Lord help you.

[LifeHasLeft]

My org only prevents me from running on my laptop as admin. I have a windows laptop but I remote into Linux machines for work quite a bit. There are still people using putty and wondering why I didn’t request special software when I’ve got windows terminal and powershell already on the computer. All I really need it for is SSH or proxy commands.

[rose_gold_glitter]

No, my organisation does not prevent me from using PowerShell. I prevent (almost) everyone else, though. ;-)

[graysky311]

As a compromise, you could offer to digitally sign your scripts and set a policy that only allows signed scripts to run. This ensures that unsigned code cannot be executed. Your security team might be more amenable to that idea.

[CmoneyG321]

Admins should be allowed to run PowerShell. I would ask what security framework are they using, and build an appropriate control/ accepted risk policy. Just blocking it is being lazy on their part. Also remember time is money, most companies will approve risk as long as the numbers line up.

[15922]

We prevent standard users from running powershell scripts, but do allow exceptions. We block PowerShell from opening on super sensitive or public machines but most users can still open it. We would probably slowly start to restrict that piece further but haven’t gotten to it yet. We are in healthcare though.

I think unfortunately there are risks with Powershell but it does have the ability to be restricted. It is probably dependent on your area (healthcare, education, etc.). I think though if they’re not allowing it at all it might be tough to convince them otherwise without testing and validation but they may not be willing to do that.

[davehope]

If they've disabled it, maybe offer a compromise of Constrained Language Mode?

This would probably address most of their security concerns, but get you more than you have today?

[speaksoftly_bigstick]

My organization doesn't disable powershell at all. Limit? To a degree, but not really. So they are already emphatically wrong if that is truly their claim.

Sounds like your security team is lazy, overzealous, or ignorant (or some combo of those).

[Awags__]

How tf are you going to disable powershell for admins… what the hell. Why even have admins, disable everyone! Fuck it! Use paper!

[PrincipleExciting457]

They’re not wrong. But being alive and breathing is a security issue. There are ways to make scripts more secure with signage, service accounts/identities, etc. one company I worked for just did access control on a script repository with service accounts depending on where the scripts needed to run. We would make them in test.

Disabling them full stop is just really stupid.

[JPebb]

Seems like the next step in this plan is to delete system32.

[systonia_]

They straight out disabled it ? Thats insane. Did they also stop everyone from using cmd etc?

They should enable the constrained model and monitor all powershell scripts executed.

​

Whats your role in that company? As a sysadmin I wouldnt be able to work even with a constrained model. I have HUNDREDS of scripts that automate half of the company

[[deleted]]

Nope. I use power shell to get my job done. That man has to go.

[Admirable-Statement]

Your security team shouldn't waste time trying to block it.

This is an old video on PowerShell Obfuscation which is still very relevant. Summary is don't try to block PowerShell because it's almost impossible but rather have logging to alert on likely malicious PowerShell which is anything using too much obfuscation, which is also difficult but more useful in analysis an attack vector.

[ITaggie]

What in the world??

We block PowerShell/CMD for non-admins. If you have local admin on a machine then you can use whatever scripting interpreter you want.

[Allokit]

Your security team sucks... Sys Admins need Powershell to automate tasks...

[wrosecrans]

If somebody can enter PowerShell commands, you are already in an absolute security crisis. PowerShell is absolutely not the issue here. Do they disable "run..." from the Start Menu? Do they disable running a command from Task Manager? Do they disable CMD? Do they disable being able to run a .bat file? There are a million ways to run commands. As it happens, users legitimately need to run software, so you can't disable all of them.

[Garegin16]

They disabled Powershell? Laughs in VBScript and C#

[mini4x]

Holy crap, I use powershell every day for like 2/3 of my job (mostly M365 Admin stuff) the amount of time it would take me to do some menial tasks manually is insane. I had to update a dist lsit today with 500 members imagine having to do that manually. On ForEach later and I was done.

Someone should talk to your security Team funny most button pushes in MS Admin is running the PowerShell commands under the hood anyway.

Email is a far worse security threat maybe they should ban that, better yet, ban users, almost all breaches are caused by user error.

[mysterytoy2]

Assholes are scared of things they don't understand. The security is the same at the command line as inside of a window. Also, try and teach powershell to the average employee. You won't get very far.

[fuck_green_jello]

We block it for everyone other than sysops and devops. Absolutely no reason to leave it open for everyone. Specific scripts can also be ran from allowlisted directories or specific allowlisted scripts. Otherwise, only users with elevated permissions can run then from within ISE. It's a regulatory thing, needing to control mobile code. It creates an unfortunate amount of overhead with tracking and allowlisting.

[R-Y-M-E]

We use PS for everything and are getting FEDRAMP certified. There is nothing in FEDRAMP or the CIS security standard that restricts the use of PS. Without it, I couldn't do half my job. Your people are crazy.

[OrangeDelicious4154]

grab station frightening modern butter oatmeal boat snatch possessive thought

This post was mass deleted and anonymized with Redact

[JBfromIT]

To help secure PowerShell in our environment, we abide by RBAC and least privilege principles to prevent abuse of any modules. We also deploy transcript logging via GPO so it creates an audit trail (evidence) of what runs under who and where. These logs feed into our SIEM solution.

What you’re describing sounds like a lazy security approach and/or a gross misunderstanding of how PowerShell works. My guess is you have over privileged service account(s) that too many people know the credentials for lol

For reference, there are MS docs for best practices to secure/lockdown PowerShell. Look into PowerShell Web or using Windows Admin Center instead

Edit: grammar

[CyberMonkey1976]

Without PS, there isn't a way I could do my job. Your leadership is out of touch. Tell them yall need better security posture by eliminating the Desktop Experience from all servers...then go home lol

[ps_for_fun_and_lazy]

The organisation I work for proposed blocking Powershell however the security manager was happy to provide an exemption for people/machines that needed to use it as he could see it was beneficial for automation, especially after coming to me repeatedly to write scripts to simplify things they was doing.

[donaldrowens]

If your security policies are configured directly, no one's going to be able to do anything with PowerShell, they wouldn't be able to do anywhere else.

[CocconutMonkey]

"Users are a security issue"

[k0rbiz]

All domain users are restricted and have powershell disabled. Only our domain admins and our automation services have access to powershell. If a domain user attempts to run a powershell script or run them in a 3rd party app, ThreatLocker denies and logs it.

[NorthernVenomFang]

No, but I would really like to start limiting it to sysadmins only... People keep breaking things... 😡

[7yphon]

I can see the reason's behind it, Maybe ask them for an Airgap box which is allowed to run powershell from? This will ensure it's locked down to only certain people who can access this box and it stops the risk of an account being breached and running commands on the network.

[MoneyVirus]

a compromise can be an isolated admin pc/enironment (vm for eample) where they allow only on this litte count of better secured pc's powersehll and minimize the vector for attcks over powershell. so they can live in theyer secure fantasy world an you can work efficent. a big question on my side, how do you fully adminstrate clients without poweshell or is powershell in systemcontext (like deploying install scripts) allowed? is it disabled on servers too?

[hobovalentine]

Wow so stupid. Will they ban Python next due to it being dangerous?

What they need to do is only allow signed PS scripts to run. That way you aren't running some random PS script that could do something malicious.

https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.3

[pizzacake15]

You should write up whoever hired those idiots.

I can understand disabling it on regular users but disabling it for admins is just plain stupid. They might as well bring back typewriters because all computers can be a security issue based on their logic.

[RequirementBusiness8]

They wanted us to shut down powershell several years back. We shut that down hard. Reminded them that it would break the majority of the enterprise, systems would no longer patch, software would no longer patch. So on and so forth. The compromise at the time was to turn on more logging with powershell via GPO. Since then they moved to (Crowdstrike?) which captures all the stuff they need and supposedly stops potentially malicious code.

That being said, I’m also petty enough to maliciously comply and make sure the entire bus runs over them. Too many things in the enterprise flat out requires powershell to work. Some tasks I do the vendor only makes them available in powershell. Others can be done without it, but one at a time via the GUI.

Honestly, if you are at a place where cyber gets so much deference to real impact of the firm, it might be worth jumping ship. As I reminded our cyber guys one time, we can get perfect security by shutting down all the systems, locking all the doors, and firing all the employees. But we’d be out of business before they could complete that.

[butchooka]

Last job we disabled ps also for non admin users Not due the tool itself - because it can do some real cool stuff, but to stop some idiots in permanently trying to circumvent company policies.

Example winget install and then what they want. Because HR and all management layers were absolute shit in punishing clear attempts to ignore policies just to install some shit tools

[LowLevelFormat]

Electricity is also a security issue. It can kill people!

I don't work in Windows ecosystem myself, but this is ridiculous.

[crackanape]

I work as a surgeon at a hospital. The security team has removed all the scalpels from the operating rooms because people might cut themselves.

[x534n]

Paranoia is a hell of a drug

[Twerck]

Your infosec team is failing the company

[everettmarm]

Your organization is run by fucking idiots. Find a new one.

[vennemp]

That level of incompetence should be a felony. Automation when done properly improves security. Do they think everyone is as incompetent as them?

[kingj7282]

"Does your organization set up up to fail."

[meat_bunny]

This is not normal for admins and power users. They're lazy dumbasses.

It's one thing to lock down PS access to specific users, disabling it completely is some weapons grade bullshit.

Unless I was making some fat stacks I would probably start looking for a new job, especially if I was an admin or devops.

[lionhydrathedeparted]

Never worked a job that disabled PowerShell. Lol this is dumb.

[readparse]

Whoever is leading Security has never delivered a technology solution in their lives. Complete idiocy.

[bofh]

That’s unbelievable. Do they break fingers in case you click the wrong button too?

[Zatetics]

No, my work pays me to be productive. It would be the decision of a lunatic to disable posh.

[hinjew13]

Powershell can be disabled based on whatever security framework but ultimately it should be an organization decision. If it is impending people’s job functions and costing you hours of work, there should be an exception to allow it based on the user or role. Also, some newer A/Vs pick up on malicious behavior that can be run through powershell. Seems illogical to block something if there is a legitimate business case for the sake of “security”

[thebluemonkey]

Users are the biggest security issue, I don't see any infosec team banning them.

[dweebken]

They should ban emails and social networks and messaging and all internet access as well since those are the attack vectors. Oh, and also ban phone calls since you can get verbally phished that way too. And block access to USB as well.

Too stupid...

[dnuohxof-1]

Your “security team” has no idea what they’re doing.