PowerShell’s Security Guiding Principles

re: PowerShell’s Security Guiding Principles

martin.zugec — Wed, 01 Oct 2008 00:11:52 GMT

Hi Lee,

-ExecutionPolicy Bypass is supported only in v2??

This could solve a huge problem we have. Running PS scripts in w2k8 environment is not very easy and there are already people asking if we could just use cmd batches instead (PS from SCCM). I understand that Unrestricted will ask you if you wanted to run downloaded script - however you got the same if you run script from network share in secured environment (UNC paths are automatically considered unsecured) :(

Martin

re: PowerShell’s Security Guiding Principles

PowerShellTeam — Wed, 01 Oct 2008 00:37:28 GMT

Correct. It is only supported in V2.

Some machines are configured to treat UNC paths as the same security zone as the internet (as opposed to the intranet.) This is Internet Explorer's "Enhanced Security Configuration." In this case, PowerShell responds the same as the Explorer Shell when it runs scripts from a UNC path: “While scripts from the internet can be useful, this script can potentially harm your computer. Do you want to run <script>?”

One way to fix this is by adding the source server to Internet Explorer’s Trusted Sites, or changing the “UncAsIntranet” configuration property (http://technet.microsoft.com/en-us/library/bb457150.aspx). This is also covered on page 341 of the (my) PowerShell Cookbook.

Lee

re: PowerShell’s Security Guiding Principles

Frank-Peter Schultze — Wed, 01 Oct 2008 02:02:41 GMT

# Add a 'fileserver' to the trusted sites

$RegPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\fileserver"

$RegValue = "file"

$RegType = "DWord"

$RegData = 2

New-Item -Path $RegPath

New-ItemProperty -Path $RegPath -Name $RegValue -PropertyType $RegType -Value $RegData

re: PowerShell’s Security Guiding Principles

Paul — Wed, 01 Oct 2008 17:06:20 GMT

New tagline:

"Ultimately, if bad code has the ability to run this code, it already has control of the machine."

Confusion about PowerShell Script Signing

James Kovacs — Tue, 17 Mar 2009 22:49:47 GMT

I’ve been having fun writing about my adventures in PowerShell. I would like to thank everyone for their

Confusion about PowerShell Script Signing

Community Blogs — Wed, 18 Mar 2009 17:56:39 GMT

I’ve been having fun writing about my adventures in PowerShell. I would like to thank everyone for their