Reply to thread

Message

<blockquote data-quote="93803123" data-source="post: 837788">No, it is all working as designed and intended.Using the Windows Features wizard only disables PowerShell version 2.0.There are multiple versions of PowerShell that ship with Windows. PowerShell version 5.X is the latest on Windows 10. At a basic level, Powershell version 2.0 continues to be shipped and activated by default. It should be disabled always. In fact, it should not even ship with Windows in this day and age. Microsoft sacrifices everyone&#039;s security to provide backwards compatibility convenience to only a minuscule number of users that still cling to Powershell 2.0.Here is some basic level discussion of Powershell and its versions: <a href="https://4sysops.com/wiki/differences-between-powershell-versions/" target="_blank">Differences between PowerShell versions</a>The above setting blocks the execution of Powershell script file types themselves. The setting does not block the execution of Powershell. By setting it to on, I know it definitely blocks .ps1 files. It might also block .ps2, powershell module file types (e.g. .psm1), but I assume those file types are included in [USER=32260]@Andy Ful[/USER]&#039;s extended file type blocking feature.If you want to disable the default Powershell version on your system, then select &quot;Powershell&quot; under LOLBins.More about Powershell file types: <a href="https://richardspowershellblog.wordpress.com/2017/10/30/powershell-file-extensions/" target="_blank">PowerShell file extensions</a></blockquote>

[QUOTE="93803123, post: 837788"] No, it is all working as designed and intended. Using the Windows Features wizard only disables PowerShell version 2.0. There are multiple versions of PowerShell that ship with Windows. PowerShell version 5.X is the latest on Windows 10. At a basic level, Powershell version 2.0 continues to be shipped and activated by default. It should be disabled always. In fact, it should not even ship with Windows in this day and age. Microsoft sacrifices everyone's security to provide backwards compatibility convenience to only a minuscule number of users that still cling to Powershell 2.0. Here is some basic level discussion of Powershell and its versions: [URL='https://4sysops.com/wiki/differences-between-powershell-versions/']Differences between PowerShell versions[/URL] The above setting blocks the execution of Powershell script file types themselves. The setting does not block the execution of Powershell. By setting it to on, I know it definitely blocks .ps1 files. It might also block .ps2, powershell module file types (e.g. .psm1), but I assume those file types are included in [USER=32260]@Andy Ful[/USER]'s extended file type blocking feature. If you want to disable the default Powershell version on your system, then select "Powershell" under LOLBins. More about Powershell file types: [URL='https://richardspowershellblog.wordpress.com/2017/10/30/powershell-file-extensions/']PowerShell file extensions[/URL] [/QUOTE]

Verification