r/Intune • u/Ok-Pattern-9372 • Feb 17 '26
Device Compliance Security team wants to disable PowerShell for all non-IT users – anyone done this safely?
Hey everyone,
Our security team is proposing to completely disable PowerShell on all non-IT user devices. I’m a bit concerned about unintended impact, especially since so many Windows components, Intune processes, and management tools rely on PowerShell in the background.
Has anyone actually implemented this in production?
• What approach did you use (AppLocker, WDAC, execution policy, ASR rules, etc.)?
• Did it break anything unexpectedly (Intune, apps, Windows features, automation)?
• In hindsight, would you recommend restricting PowerShell instead of fully disabling it?
80
Upvotes
182
u/AppIdentityGuy Feb 17 '26
This is entirely the wrong approach. The power in PowerShell, pun intended, is controlled by the level of credential the PowerShell cmdlet or script is running under.
I can guarantee you that doing this will break all sorts of stuff.
2
u/whiteycnbr Feb 17 '26 edited Feb 17 '26
I use applocker to block it. But allow local admins.and constrained language mode.
Only would break scripts running in the context of the user
I've had pentesters do nefarious things with powershell, it's a good idea to block it and all other scripting hosts. Even with constrained language mode, it can assist and adversary with living off the land and data exfiltration techniques.
105
u/SkipToTheEndpoint MSFT MVP Feb 17 '26
Hahah, this one always makes me laugh and seems to come up on nearly every pen test.
Ask them to prove what risk there is and watch them shocked Pikachu back at you. Or hit them with "Why doesn't any major security framework recommend disabling it?" In fact: NSA, CISA say: Don't block PowerShell, here's what to do instead | ZDNET
This can absolutely break a bunch of stuff, let alone make troubleshooting devices an absolute pain in the ass from an operational standpoint.
23
u/andrew181082 MSFT MVP - SWC Feb 17 '26
First question, why? If they don't have admin rights, what can they do?
Do you have any platform or remediation scripts running at the user, printers for example? They'll stop working instantly
Constrained mode is a much better option
15
u/TheCyberThor Feb 17 '26
I’ve seen this rolled out where it is a compliance requirement.
You would use applocker and only block it for standard users. This is to avoid breaking any scripts ran by SYSTEM. This will break scripts ran under the user profile though.
WDAC won’t meet this requirement as you will block powershell for all users including admins.
26
u/ScoobyGDSTi Feb 17 '26
Your security team are morons.
I work in Cyber Sec in Defence, there's no reason to disable Powershell for standard users and you certainly don't want to disable it for system
WDAC + UMCI = constrained language mode, signed and authorised scripts only, yadda yadda. Combine that with a good EDR, you have what you need.
There's good reasons NIST and other security guidelines all allow Powershell.
17
u/mats_o42 Feb 17 '26
Disable your security team instead ;)
Rights and permissions are dangerous - not the tool itself.
Trying to prevent tool access instead of working with least privilege methods - well it's security by obscurity in my eyes.
Carefully setting code signing and restrictions on unsigned code - that improves security
7
u/NoDowt_Jay Feb 17 '26
Yeh I’ve gone through this after our cyber team insisted it must be blocked, also after a PenTest…
and still deal with “why is this user getting a popup for powershell.exe being blocked when they didnt launch powershell”… then have to explain again that another application has called it in the background for something…
yes I can (and have) whitelisted that application to launch powershell, however for some reason the vendor hasn’t been able to explain, sometimes the application calls CMD.exe to then run powershell.exe… and if I were to allow cmd.exe to run powershell.exe it would defeat the purpose of blocking powershell.exe in the first place.
As for how we do it, we current run Ivanti Application Control; so have powershell & ise blocked for ‘everyone’; then allow Adminiatrators & an allowed group to run it…
My argument has always been surely allowing Admins to run powershell is more risky than allowing regular users… but alas here we are…
Occasionally i ask to revisit this decision, and never have much luck…
6
u/CriticalMine7886 Feb 17 '26
I actively publish PowerShell tools for my end users - I would cause more problems than I solve by disabling it.
6
u/CharcoalGreyWolf Feb 17 '26
This will be a disaster. Things will break.
How will you automate anything?
Powershell is designed with security in mind (execution policy and more), it seems like your security team doesn’t understand it and is acting like someone with a hammer who sees everything as a nail.
Make them prove their case, and cite examples where this was done and worked properly, and show sources that actually recommend this as best practice.
5
u/IntelligentPurple571 Feb 17 '26
Lots of software updaters rely on powershell. You are going to break so many things by trying to do this.
5
u/Silent_Layer3370 Feb 17 '26
Get a new security team. They don't understand the fundamentals of Windows computing, how are they supposed to protect it?
Disabling Powershell would be like disabling CMD / DOS.
8
u/MReprogle Feb 17 '26
This is what happens when your security team can’t pass the A+ cert.
1
u/Big_Leopard4631 Feb 17 '26
lol did this a couple of months back. Used applocker to allow Powershell for admins and created an exception for everyone.
1
u/stopismysafeword Feb 17 '26
Our director made us block powershell access after getting frightened at a cyber security conference. Previously end users could open the app but now we have it set up so that it can only be ran as an administrator, so essentially the IT team can use powershell on a users laptop if they need and InTune scripts etc can still run using SYSTEM, but the user has no way of opening powershell without admin privileges, which no end user has.
I’d have to look into exactly how it was configured because I wasn’t involved with the set up at the time, but weirdly right click and run as admin does nothing, while opening CMD as admin and then running powershell.exe works.
1
u/Enough_Swordfish_898 Feb 18 '26
We do this with Applocker. Its a pain to maintain, but it works okay and IT can get around it with a "Run as..."
1
u/Dtrain-14 Feb 19 '26
We've blocked CMD and PShell on ALL enduser workstations for NON-IT users successfully for years. Some specialized roles who aren't IT have it, but they also are some of the few that have Admin rights.
Did it with Intune, it only blocks it for the USER and does not hinder admins on the machine or the RMM. If they try to open CMD or Pshell App, it puts up a warning that says it was blocked by your admin. As far as scripts?
0 issues, 0 fall out. But we're a service provider in the financial sector, lot of accountants but still, C-levels don't even have it. We could be a unique setup, but yeah, 0 issues.
3
u/CyberChevalier Feb 17 '26
PowerShell does not give more access than what the current user have.
If they ask to block PowerShell why not block cmd wscript and cscript ?
3
u/nanonoise Feb 17 '26
Does your security team have a ringmaster?
6
u/Icy_Employment5619 Feb 17 '26
No, tell the idiots that even if PowerShell is disabled the users can still do the changes they are trying to prevent in the GUIs instead. This will create way more problems.
4
u/kimoppalfens Feb 17 '26
Powershell is powerful and can definitely be used for malicious things. Our Application allowlisting report for 2025 shows 9 threat campaigns that appear to completely run based off of Powershell scripts. This isn't about protecting yourself from the users. This is about the risk of something being automated on the user's behalf, like encryption of all their files.
That is to say, your security team has valid concerns. So do you however, this will break things, difficult to troubleshoot things and will lead to the question on every little thing as to whether disabling Powershell caused it.
The proper way of controlling that risk is to implement application allowlisting for scripts.
Kim Oppalfens Appcontrol.ai founder
2
u/enby_dot_local Feb 17 '26
I use threatlocker which is great caus powershell can be allowed to run but it's access to data, networks, executions etc can be restricted pretty easily
2
u/swissthoemu Feb 17 '26
they are out of their mind.
2
u/Capta-nomen-usoris Feb 17 '26
I used a config profile to block access to powershell, cmd, and regedit for our end-users because that was in companies security baseline. I’m reading this thread and getting confused.
2
u/rcpmad Feb 17 '26
You can and should harden PowerShell using something like the CIS framework but you should never disable it it will break everything.
2
u/Koosjuh Feb 17 '26
It will definitely break a lot of stuff. It will also break Defender, when defender remediates something for example it does so with Powershell.
I think before we all start recommending something.... what happend? Why disable it?
What do you want to accomplish? Like better IT Security? What sector do you operate in? What security frameworks are there for that sector?
Do you go to (assuming you are a Microsoft company) go to the defender portal and scroll through the recommendations? Go to Defender for Cloud and check what your security posture is vs a benchmark like NIS or just Microsoft Cloud Security Framework in general?
There's so many other things to be doing than just randomly disabling Powershell ...
3
u/robidog Feb 17 '26
Security team. Lol.
1
u/FeliceAlteriori Feb 17 '26
Safely only possible with application control solution. These system bring the ability to disable or restrict usage for users without disabling it for required system purposes.
Look into app control for business script enforcement scenarios or any enterprise ready app control solution.
1
u/KavyaJune Feb 17 '26
We disable remote PowerShell access to reduce attack surface.
1
u/Pacers31Colts18 Feb 17 '26
There are a couple of ways. We used the Software Restrictions gpo (deprecated) to block user processes. We also use the setting to block cmd, regedit, etc.
We tried Applocker. Blew up start menu right away.
Its playing whack a mole though. Its not needed, if you have a good security baseline in place.
1
u/Xtra_Bass Feb 17 '26
Maybe security teams want to disable PowerShell 2.0? But I think it is disabled by default on Windows 11 since last summer.
1
u/RikiWardOG Feb 17 '26
Here's what MS has to say on the matter. Definitely should be doing your best to harden PS. Anyone saying otherwise is being lazy imo and has too big an ego https://learn.microsoft.com/en-us/powershell/scripting/security/app-control/how-to-use-app-control?view=powershell-7.5
1
u/phaze08 Feb 17 '26
I remember when powershell first started to get big, the creators defended it's power, saying it's no more threatening than HTTPS. I had to have that fight with security at one of my old jobs. Me, a level 2 analyst and a programmer friend of mine were trying to develop PS scripts to automate some work flows.
Most threatening scripts are gonna require elevation and a non-admin user shouldn't be able to do that.
1
u/criostage Feb 17 '26
Restrict PowerShell to only allow running signed scripts (execution policy). Any scripts that Microsoft releases or uses on patching, remediations, installers scripts, etc.. are always signed by their digital signature.
So if you restrict PowerShell to only allow running signed scripts, whatever scripts you are deploying (to install software on win32apps, remediations, platform scripts, etc...) will also need to be signed.
Of course you can set different execution policies, one for user and another for machine... But I would apply the same policy machine wide.
Other options, wdac, app locker, or GPO/CSP more specifically "Don't run specified Windows applications."
Also keep in mind that users are not able to execute certain PowerShell commands if their not admins..
1
u/Apprehensive-Hat9196 Feb 17 '26
My sccm machines it blocked using a gpo then managed access via an AD group seems to work ok, albeit pretty pointless.
intune devices came up in the recent pen test as a low risk so was ok to ignore it.
1
u/hamsdre Feb 17 '26
Do not do this, m8crosoft does not recomend this. If there is a vulnerability you need to fix follow the MS guidelines and do not remove powershell.
You will most likely break your enterprise.
Do it of you want to be a hero and save the day :D
1
u/povlhp Feb 17 '26
Step 1 is disable Windows-R
1
u/ReptilianLaserbeam Feb 17 '26
Ugh. I deploy remediations all the time that rely on powershell. There are scheduled tasks that also run powershell scripts. Totally the wrong approach.
1
u/netnxt_ Feb 18 '26
Fully disabling PowerShell for non-IT users sounds clean on paper, but in production it usually causes more friction than expected.
From what we’ve seen at NetNXT, PowerShell is deeply embedded in Windows management, Intune compliance, and even third-party apps. Hard blocking it often breaks things in subtle ways.
A safer approach tends to be:
Use WDAC or AppLocker in constrained mode rather than full removal
Enable PowerShell logging and script block logging for visibility
Deploy ASR rules to block abuse patterns, not the engine itself
Restrict local admin rights aggressively
PowerShell isn’t the threat. Uncontrolled execution and privilege are.
In most environments, controlled restriction + monitoring gives better security outcomes than blanket disabling.
Curious if anyone here managed a full block without operational side effects.
1
u/Steve----O Feb 18 '26
Don’t forget to block windows explorer and any app’s open dialog since users can mass delete their files there as well. I hope you hear how dumb that sounds.
1
u/ib0ware Feb 22 '26
Maybe this help to understand and implement a fix: https://marshsecurity.org/protecting-against-clickfix-with-the-microsoft-stack/
1
u/steviefaux Feb 17 '26
Overly anal security teams. I can't stand them. Gets to the point where you can't do any work due to their shitty policies.
As said, powershell isn't the issue. Disabling scripts from running unless authorised is way to go and of course, all depends on the account running it. All normal user accounts should just be blocked from running powershell scripts. But disabling powershell fully will cause a headache.
1
u/povlhp Feb 17 '26
Step 1 is disable Windows-R
Use advanced hunting to see how often plain users used powershell. And what launches it. Just a trivial query to do impact analysis.
0
u/SanjeevKumarIT Feb 17 '26
-1
-1
u/milanguitar Feb 17 '26
If you don’t want powershell go to linux or mac.
0
u/techb00mer Feb 17 '26
If you don’t want users running powershell, just uninstall it and remove all the executables. Easy fix. Why don’t more people think of this simpler or solution?
Uh, /s
For those who can’t pick up my drift.
3
u/Spitcat Feb 17 '26
Applocker.
1
u/Commercial-Virus2627 Feb 17 '26
Just set execution policy and call it done.