Worklet - Disable PowerShell v2.0 on Windows 10
Windows 10 includes Windows PowerShell 5.0 by default that has some great new features that enhance security including enhanced transcription logging and AMSI protection. However, the Windows PowerShell 2.0 engine is still enabled and is now recognized as a security risk that can be used to run malicious scripts.
Evaluation:
$App = Get-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2 | Select-Object Status
if ( $App -eq ‘Disabled’ ) {
Exit 0
} else { Exit 1 }
And then fix.
Remediation Code to Disable the PS v. engine
Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2RootYou can recheck remotely with command:
$computer => Name of the host you trying to check
invoke-command -computername $computer {Get-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2 }
Cheers,
-Roman
This discussion is archived and closed to replies. Continue it in the Automox Community Slack.
Discuss on Slack