Disable Remote Powershell for Exchange

Richard Long 281 Reputation points
2022-10-03T23:39:09.203+00:00

I'm following the guidance for the Exchange zero-days (link below) and I'm curious how others are disabling remote PowerShell access for non-admin users.

Is there a command to allow access for a specific ad group or local admins? Ideally we'd like to disable all of our standard users and allow just specific IT users.

How are others accomplishing this?

https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/

Thank you

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,356 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,728 questions

9 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andy David - MVP 142.2K Reputation points MVP
    2022-10-06T11:55:15.003+00:00

    If you screw up and disable an admin account, re-enable following: 

    Add-PSSnapIn Microsoft.Exchange.Management.PowerShell.Snapin  
set-user <user> -RemotePowerShellEnabled $true
    0 comments
  2. Matt 1 Reputation point
    2022-10-07T08:41:37.027+00:00

    Hello,

    I asked myself the same question.

    Also, what about new users? Should we disable powershell remote access each time we have a newcomer to the company?

    I don't see any other solution besides disabling access for everyone, and enabling access for a short list of users right after...

    Has anyone found an easy way to do this?

    0 comments
  3. Martin Bufton 1 Reputation point
    2022-10-07T11:25:45.327+00:00

    I'm effectively looking to run this:

    Get-ADGroupMember -identity 'Non admins' | set-user -RemotePowerShellEnabled $false

    Can someone help with the syntax please?

    0 comments
  4. Martin Bufton 1 Reputation point
    2022-10-07T11:50:48.967+00:00

    To answer my own question I went down the OU route instead:

    Get-User | Where-Object {$_.OrganizationalUnit -ne 'Org.dns/ORG/Users/Engineers/Domain Administrators' | Set-User -RemotePowerShellEnabled $false

    can use and "and" to if required:

    Get-User | Where-Object {$.OrganizationalUnit -ne 'Org.dns/ORG/Users/Engineers/Domain Administrators' -and $.OrganizationalUnit -ne 'Org.dns/ORG/Service Accounts/On_prem'} | Set-User -RemotePowerShellEnabled $false