Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 816596" data-attributes="member: 32260">PowerShell runs already restricted in recommended settings. Generally, it runs restricted by Constrained Language Mode when &lt;Default Security Level&gt; is set to &#039;Disallowed&#039; or &#039;Basic User&#039;.There are some circumstances for not doing so:<ol>
<li data-xf-list-type="ol">There are already two options &lt;No PowerShell Exec.&gt; and &lt;Disable Win. Script Host&gt; which can disable running script files (globally by policies) related to PowerShell and Windows Script Host: PS1, JS, JSE, VBS, VBE, WSF, WSH scripts.</li>
<li data-xf-list-type="ol">When you set &lt;Default Security Level&gt;&nbsp; to &#039;Disallowed&#039;, then the scripts (in UserSpace) related to CMD and Windows Script Host are blocked by SRP, independently of point 1. That is why I prefer &#039;Disallowed&#039; over &#039;Basic User&#039;. Furthermore, SRP restricts PowerShell to Constrained Language Mode.</li>
</ol>When using only SRP (Disallowed) all scripts are blocked/restricted. If the user wants more, then point 1. can be used to additionally block PowerShell scripts. Still, the combination of points 1. and 2. allows running PowerShell and CMD command lines. That can be used by exploits, so on the vulnerable system or when using vulnerable software, the user can use:&lt;Block Sponsors&gt; &lt;Enhanced&gt; or &lt;Block Sponsors&gt;&lt;Script Interpreters&gt;to block command lines with script sponsors (cmd.exe, powershell.exe, powershell_ise.exe, mshta.exe, wmic.exe, etc.).</blockquote>

[QUOTE="Andy Ful, post: 816596, member: 32260"] PowerShell runs already restricted in recommended settings. Generally, it runs restricted by Constrained Language Mode when <Default Security Level> is set to 'Disallowed' or 'Basic User'. There are some circumstances for not doing so: [LIST=1] [*]There are already two options <No PowerShell Exec.> and <Disable Win. Script Host> which can disable running script files [COLOR=rgb(0, 168, 133)][B](globally by policies)[/B][/COLOR] related to PowerShell and Windows Script Host: PS1, JS, JSE, VBS, VBE, WSF, WSH scripts. [*]When you set <Default Security Level> to 'Disallowed', then the scripts [COLOR=rgb(0, 168, 133)][B](in UserSpace) [/B][/COLOR]related to CMD and Windows Script Host are blocked by SRP, independently of point 1. That is why I prefer 'Disallowed' over 'Basic User'. Furthermore, SRP restricts PowerShell to Constrained Language Mode. [/LIST] When using only SRP (Disallowed) all scripts are blocked/restricted. If the user wants more, then point 1. can be used to additionally block PowerShell scripts. Still, the combination of points 1. and 2. allows running PowerShell and CMD command lines. That can be used by exploits, so on the vulnerable system or when using vulnerable software, the user can use: <Block Sponsors> <Enhanced> or <Block Sponsors><Script Interpreters> to block command lines with script sponsors (cmd.exe, powershell.exe, powershell_ise.exe, mshta.exe, wmic.exe, etc.). [/QUOTE]

Verification