How to block powershell using group policy

Question

We blocked the powershell using GPO "Don't run specified Windows applications" but if a user rename the powershell.exe to something else then he is allowed to run it. We found another method in URL "https://activedirectorypro.com/disable-powershell-with-group-policy/" , It is blocking the path "C:\Windows\System32\WindowsPowerShell\v1.0" which means user can it from a different location. Wondering if anyt=one has blocked it using group policy and which method did you use. Please suggest

Answer 1

Hello @HM ,

Thank you for posting here.

We can try to create a task schedule: run this task schedule every short time to kill/end the PS process.

Then push task schedule via GPO to all machines.

Hope the information above is helpful

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

Can we do something to not even allow it.

Answer 3

Hi,

You can uninstall windows powershell using one of the method mentioned on the link below:

uninstall-powershell-windows-10.html

Please don't forget to mark helpful reply as answer

Answer 4

We actually need some users to run it so we cannot completely uninstall it. We were thinking to have a group of those users and we will deny this AD group on GPO. For ex : User A login to machine with his regular account (Non admin account) and he should not be able to run powershell (it should be completely blocked even from launching) and he runas powershell as a different userid (which is also a local admin) and should be able to run powershell on same machine.

Answer 5

This is actually counted as vulnerability by our security scanners and therefore to satisfy Audit needs

My experience with security scanners is that when they find a vulnerability they point us to a knowledge base article that describes the issue and also provides instructions on how to fix it. Go back to your auditors and ask them to review the scan report and contact the scanner software support team if you have to, and ask them for instructions on how they expect you to fix this.

Powershell is Microsoft's solution to provide a common framework for supporting the Windows OS. The problem that they recognized was that there were multiple executables like ipconfig.exe and netsh.exe and they all had different command line interfaces. And the classic .bat/.cmd language was just archaic. But they had to leave those programs in place to allow for compatibility for existing users.

I've seen malware that uses Powershell to do a base64 encoding and hide itself inside of WMI. That is likely what the scanner is trying to address. But if Powershell.exe is a vulnerability, then so is cmd.exe, and cscript.exe, and csc.exe, and wmic.exe and just about about every other executable in Windows\System32.