Advice Request Windows PowerShell is still active although I blocked it using Hard Configurator!

[DDE_Server]

although i turned on block power shell scripts in hard configurator it still not disabled in windows features as shown in the below screen shot:

is this a bug in the hard configurator tool or just I misunderstand something @Andy Ful ??

 

[93803123]

No, it is all working as designed and intended.

although i turned on block power shell scripts in hard configurator it still not disabled in windows features as shown in the below screen shot:

View attachment 226639

Using the Windows Features wizard only disables PowerShell version 2.0.

There are multiple versions of PowerShell that ship with Windows. PowerShell version 5.X is the latest on Windows 10. At a basic level, Powershell version 2.0 continues to be shipped and activated by default. It should be disabled always. In fact, it should not even ship with Windows in this day and age. Microsoft sacrifices everyone's security to provide backwards compatibility convenience to only a minuscule number of users that still cling to Powershell 2.0.

Here is some basic level discussion of Powershell and its versions: Differences between PowerShell versions

View attachment 226638
is this a bug in the hard configurator tool or just I misunderstand something @Andy Ful ??

The above setting blocks the execution of Powershell script file types themselves. The setting does not block the execution of Powershell. By setting it to on, I know it definitely blocks .ps1 files. It might also block .ps2, powershell module file types (e.g. .psm1), but I assume those file types are included in @Andy Ful's extended file type blocking feature.

If you want to disable the default Powershell version on your system, then select "Powershell" under LOLBins.

More about Powershell file types: PowerShell file extensions

 

[DDE_Server]

No, it is all working as designed and intended.



Using the Windows Features wizard only disables PowerShell version 2.0.

There are multiple versions of PowerShell that ship with Windows. PowerShell version 5.X is the latest on Windows 10. At a basic level, Powershell version 2.0 continues to be shipped and activated by default. It should be disabled always. In fact, it should not even ship with Windows in this day and age. Microsoft sacrifices everyone's security to provide backwards compatibility convenience to only a minuscule number of users that still cling to Powershell 2.0.

Here is some basic level discussion of Powershell and its versions: Differences between PowerShell versions



The above setting blocks the execution of Powershell script file types themselves. The setting does not block the execution of Powershell. By setting it to on, I know it definitely blocks .ps1 files. It might also block .ps2, powershell module file types (e.g. .psm1), but I assume those file types are included in @Andy Ful's extended file type blocking feature.

If you want to disable the default Powershell version on your system, then select "Powershell" under LOLBins.

More about Powershell file types: PowerShell file extensions

ok thanks for the explanation