3

Is it possible to configure the Powershell execution policy to ask the Administrator for authorization each time a Powershell script wants to run?

Something like this : Windows Administrator Permission

I need to run .ps1 scripts for my C++ project setup.

Also, I'm concerned about the command line :

-ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -file "\\location\folder1\script.ps1

I've already removed a "registry injection" injected with this type of command line. I don't really know his origin, but I removed the scheduled task, the script, and the registry entries related to it, and the problem seems solved. It was some type of cryptomining.

It seems to be a really huge security breach. How can I resolve it?

-- EDIT --

I've found this : https://social.technet.microsoft.com/Forums/ie/en-US/349f1319-9feb-455d-9244-a2bc88b3424b/blocking-bypassing-of-powershell-execution-policy?forum=ITCG

This response is interesting : "Execution policy is an administrator safety feature, not a security feature. It is widely misunderstood. You cannot fully prevent PowerShell from ever executing scripts because that's one of its core purposes. You can set the policy to prevent scripts or allow only signed scripts (for example), but anyone with access to run powershell.exe can use the -ExecutionPolicy command-line parameter to bypass this on a case-by-case basis."

But it's a security breach at my sense.. Do I need to restrict the Powershell execution directly ?

6
  • “Is it possible to configure the Powershell execution policy to ask the Moderator” - What exactly is a moderator in this context, instead of submitting a temporary comment, you should edit your question to clarify it.
    – Ramhound
    Commented Apr 23, 2023 at 15:01
  • It's done, I've added a picture, it's more Administrator permission in fact, sorry about the confusion. Commented Apr 23, 2023 at 15:06
  • As you've noted, EPs are not security boundaries and were never designed to be. They are there to prevent errant things from happening. EP's are easily bypassed by an experienced person. This bee well documented by MS and other for years. See: 15 Ways to Bypass the PowerShell Execution Policy. There are several level to apply EPs, see the docs, as well as the #Requires keyword and StrictMode as well as full auditing in PS.
    – postanote
    Commented Apr 23, 2023 at 20:09
  • IMHO, the host EP, should be the most restrictive you can set, all else should be EP set at the process level. Full auditing (domain GPO/LPO settings) for all things PS must be enabled, monitored, and acted on as needed.
    – postanote
    Commented Apr 23, 2023 at 20:12
  • 1
    PowerShell runs in the security context of the security which the user that executes it. If you allow your users to also be local admins, then that may be a concern. If you allow your users to run powershell.exe, you should be just as concerned with them running cmd.exe, regedit.exe, and a slew of other things. Otherwise, they can do what you allow them to do but GPOs can setup to disallow specific executables from running as user configurations, software restriction policies may help here, as well as app locker and allow listing only the processes you trust. Having good Endpoint and EDR too. Commented Apr 24, 2023 at 3:02

0

You must log in to answer this question.

Browse other questions tagged .