For one reason or another, you may want to disable remote PowerShell access for all the users in your organisation.
\nThe main reason for doing so would be to prevent ‘reconnaissance’ type attacks whereby a user will try to gain information about your network\/organisation\/topology\/system etc by simply running (in this case) PowerShell queries against your organisation.<\/p>\n
<\/p>\n
By default, users (all, including non-admins) will have remote PowerShell access to your organisation (Exchange online, etc).
\nNon-administrators have a limited set of commands they can run in PowerShell but the fact that they can access these commands in the first place pops up a red flag (what if a new command was introduced and was inadvertently accessible to all users?)<\/p>\n
The command below turns off remotePowerShell for a particular user. You can amend this to disable PowerShell for all user’s but remember to exclude (-ne) the Administrator account!!!<\/p>\n
For one reason or another, you may want to disable remote PowerShell access for all the users in your organisation. The main reason for doing so would be to prevent ‘reconnaissance’ type attacks whereby a user will try to gain information about your network\/organisation\/topology\/system etc by simply running (in this case) PowerShell queries against your […]<\/p>\n","protected":false},"author":32,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"footnotes":""},"categories":[1],"tags":[37,45,42,51],"class_list":["post-354","post","type-post","status-publish","format-standard","hentry","category-tech","tag-office-365","tag-permissions","tag-powershell","tag-security"],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p1trTO-5I","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/posts\/354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/users\/32"}],"replies":[{"embeddable":true,"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/comments?post=354"}],"version-history":[{"count":2,"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/posts\/354\/revisions"}],"predecessor-version":[{"id":911,"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/posts\/354\/revisions\/911"}],"wp:attachment":[{"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/media?parent=354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/categories?post=354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/emtunc.org\/blog\/wp-json\/wp\/v2\/tags?post=354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Set-User -Identity \"User Alias\" -RemotePowerShellEnabled $false<\/code><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"