Windows Security - Locking Down Powershell Script Execution

Resources:

• ThioJoe Video: https://www.youtube.com/watch?v=zW69MisrsWk
• Policy Plus: https://github.com/Fleex255/PolicyPlus
• PowerShell 7: https://github.com/PowerShell/PowerShell

---

Disable old Powershell 2.0

• Open Start Menu
• Search for "Turn Windows Features on or off"
• Uncheck "Windows Powershell 2.0"

---

Enable Powershell Constrained Language Mode

• Open Powershell Window
• Get Language Mode: $ExecutionContext.SessionState.LanguageMode
• Default is "FullLanguage"
• Open Start Menu
• Search for "Environment Variables"
• Select "Edit the system environment variables"
• Select "Environment Variables"
• Add NEW System Variable
  • Variable Name: __PSLockDownPolicy
  • Value: 4
• Open new Powershell Window
• Get Language Mode: $ExecutionContext.SessionState.LanguageMode
• Now should be "ConstrainedLanguage"

---

Create Policy to block powershell changes

Windows 10/11 Pro

• Use included Group Policy Editor
• From Admin Terminal/CmdPrompt use: gpedit.msc

Windows 10/11 Home

• Use Policy Plus (link above)
• After installing, select "computer" in the drop down

Edit the Policies:

• Navigate to: Computer Configuration / Administrative Templates / Windows Components / Windows Powershell
• Open Setting "Turn on Script Execution"
• Set to "Disabled"
• In Policy Plus, select Save in menu
• check Setting
  • in a new Powershell Window, run Get-ExecutionPolicy -List
  • should show "MachinePolicy" as Restricted

---

Adding a Powershell 7.0 Policy

• Download latest Powershell 7.0 "PowerShell-7.x.x-win-x64.zip" file (link above)
• Extract zip file into folder
• copy PowerShellCoreExecutionPolicy.admx into c:\Windows\PolicyDefinitions
• copy PowerShellCoreExecutionPolicy.adml into c:\Windows\PolicyDefinitions\en-US

In Group Policy editor:

• Navigate to: Computer Configuration / Administrative Templates / PowerShell Core
• Open Setting "Turn on Script Execution"
• Set to "Disabled"

---

Related Powershell commands

• Get-ExecutionPolicy -List
• Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process