Share via

Securing Powershell script to be tamper proof and only executed from one single server in AD Domain?

EnterpriseArchitect 6,041 Reputation points
2023-04-24T19:49:37.12+00:00

I am looking for some steps and procedures for securing PowerShell scripts using any means necessary. This is so that they may only be run on one computer at a time and cannot be modified. The PowerShell scripts are scheduled to run regularly using Windows Server scheduled tasks. Ideally, I want it to only run on a single server within my AD domain. Script modifications would stop the script's execution to ensure that it has not been tampered with. I appreciate your assistance.

Windows for business Windows Client for IT Pros Directory services Active Directory
Windows for business Windows Server User experience PowerShell
Windows for business Windows Server Devices and deployment Configure application groups
Microsoft Security Microsoft Graph
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Limitless Technology 44,746 Reputation points
    2023-04-25T14:39:29.4466667+00:00

    Hi, I'd be happy to help you out with your question. Sorry for the inconvenience caused. To ensure that the script can only be executed from a single server in your AD domain and cannot be tampered with, there are several steps you can take. Firstly, I would recommend creating a security group in your AD domain that includes only the server that you want to execute the script. This will allow you to control who can access the script. Next, you should set the permissions on the script file to only allow members of the security group to access it. This can be done by denying access to all other users and groups. To further ensure the integrity of the script, you can sign it with a code signing certificate. This will prevent any modifications to the script and ensure that it can only be executed in its original form. When setting up the scheduled task to run the script, make sure to specify the security group as the user account that runs the script. This will ensure that only members of the security group can execute the script. Finally, I would recommend setting the execution policy for PowerShell scripts to "AllSigned". This will require that all scripts be signed with a valid code signing certificate before they can be executed. By following these steps, you can ensure that your PowerShell script is secure and can only be executed from the specified server in your AD domain. If you have any other questions or need assistance with anything, please don't hesitate to let me know. I'm here to help.

    If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.