PowerShell Security Hardening

Purpose

When to Use

• Configuring PowerShell security policies
• Implementing Constrained Language Mode
• Setting up Just Enough Administration (JEA)
• Enabling PowerShell logging and auditing
• Securing automation credentials
• Applying CIS/STIG baselines
• Protecting against PowerShell attacks
• Implementing execution policies

Quick Start

• Hardening PowerShell environments
• Implementing JEA or constrained language mode
• Configuring PowerShell logging
• Securing automation credentials
• Applying security baselines

• General Windows administration → use

  /windows-infra-admin

• PowerShell development → use

  /powershell-7-expert

• Active Directory security → use

  /ad-security-reviewer

• Network security → use

  /network-engineer

Decision Framework

Security Requirement?
├── Script Execution Control
│   ├── Basic → Execution Policy
│   └── Strict → AppLocker/WDAC
├── Language Restriction
│   └── Constrained Language Mode
├── Privilege Reduction
│   └── JEA (Just Enough Administration)
└── Auditing
    └── Script Block Logging + Transcription

Core Workflows

1. PowerShell Logging Setup

1. Enable Script Block Logging via GPO
2. Enable Module Logging for key modules
3. Configure transcription to secure location
4. Set up protected event log forwarding
5. Create alerts for suspicious patterns
6. Test logging with sample scripts

2. JEA Configuration

1. Define role capabilities file
2. Specify allowed cmdlets and parameters
3. Create session configuration
4. Register JEA endpoint
5. Test with limited user account
6. Document role assignments

3. Constrained Language Mode

1. Assess application requirements
2. Create AppLocker/WDAC policy
3. Enable CLM for untrusted scripts
4. Whitelist required scripts
5. Test application functionality
6. Monitor for bypass attempts

Best Practices

• Enable script block logging on all systems
• Use JEA instead of full admin rights
• Store credentials in secure vault (not scripts)
• Apply AMSI for malware detection
• Use signed scripts with AllSigned policy
• Regularly audit PowerShell usage logs

Anti-Patterns