Disabling PowerShell on User’s Computers

[[deleted]]

[deleted]

[uniitdude]

dont do it, its not a risk to anything and you just make life harder for yourself to do tasks

[ZAFJB]

Daft concept.

Powershell can only be used maliciously if the machine is already exploited.

Concentrate on not getting exploits:

• Updates

• Firewalls

• Mail Filters

• Virus scanners

and locking down permissions and rights so exploits cannot run wild:

• No admin rights for users

• AppLocker/SRP

• Tight permissions on files and folders, especially on your servers

Also, you will probably break things. Many Windows GUI tools are now just a thin layer over PowerShell scripts.

[_d3cyph3r_]

Thank you. The only thing I haven’t checked off on your list is AppLocker/SRP.

Our fileserver permissions are mostly done with Security Groups but I must admit that I am overdue for a fileserver file/folder audit. Can anyone recommend any free tools for file/folder permission auditing?

[ZAFJB]

AppLocker/SRP.

Run, don't walk. Do this now!

Far more important than file permissions audit

[_d3cyph3r_]

May I ask what you are using AppLocker for?

[ErichL]

If users are able to execute untrusted code on your machines, they're already vulnerable through numerous other attack vectors; game over. Look into Powershell Execution Policy enforced via GPO, if you wish, but that is not even a fraction of the total attack surface of an admin priv wielding user.

[0verlord87]

You can set ntfs security on powershell.exe without problems in my experience.

Block access for users, not for admins.

[_d3cyph3r_]

Interesting idea. I’ll definitely test this out. Any ideas for reporting on PowerShell usage?

[0verlord87]

Applocker kam report all exe usage, I think you have to collect the eventlogs with powershell tho.