how to block GET-ADUSER command on Powershell

Question

Vignesh Vijayakumar 1

Hello all,

I want to block GET-ADUSER command execution on PowerShell to all AD users.

And I would like to block users from opening AD users and computers application.

How do I block the above two features?

3 answers

Answer 1

Gary Reynolds 9,621

Have a look at this question which covers the same topic.

Gary.

Vignesh Vijayakumar 1 Reputation point

2022-03-09T19:37:03.147+00:00

Thanks for the quick response.

but, my question is how to block the Get-AD module, the above topic not covering my needs.
Rich Matheisen 47,901 Reputation points

2022-03-09T19:48:49.53+00:00

Get-ADUser is a cmdlet, not a module. Get-ADUser is part of the ActiveDirectory module.
Gary Reynolds 9,621 Reputation points

2022-03-10T11:08:31.603+00:00

The above topic is different approach to accomplish the same result. If implemented for user objects, it would prevent users that have been assigned the deny permissions from seeing the attributes of the user objects and would prevent users from using either Get-ADUser or ADUC to read the user object attributes.

Gary.
Vignesh Vijayakumar 1 Reputation point

2022-03-11T09:32:37.117+00:00

I will try but, I need a quick solution for this issue.

Answer 2

Rich Matheisen 47,901

You can use "Just Enough Administration" (JEA) to do that. Here's a link: overview

Answer 3

SChalakov 10,576 MVP Volunteer Moderator

Hi,

what about uninstalling the Active directory PowerShell module?

Regards,
Stoyan

Vignesh Vijayakumar 1 Reputation point

2022-03-11T09:29:24.423+00:00

Some users have local Administrator access, they can install again. I don't want that.