followed your tips on my win10 computers and it did exactly as you described ... course I understood about 50% of what you said and have never run a powershell .. so yeah, I feel safer now!
It needs to be said that the Constrained Language will have a large impact on your system ability to run legitimate powershell scripts. I really don't advise this option at all. You should only do this on dedicated computer systems where you know Powershell is not being used as a means to install or manage software or the system itself. This option will otherwise break tools like Chocolatey, the SQL Server installation process, and a lot more. Don't do this on your daily usage computer. There is a lot of Windows software out there that relies on Powershell features for its own maintenance or installation processes.
@@jstephens2758well it would constantly break down, if it ran on mac it wouldn't break but could only drive on one street and I'd it ran linux it wouldn't crash, but the driver needed to do all the maintenance themselves 😂
Very nice. I've been a programmer for 40 years now and this is something I didn't know. I am retired now so I am not as up to date as I used to be when working in the IT environment.
One of the best things you can do is enable logging for PowerShell, which is disabled by default for some unholy reason. That way when someone does get past any blocks you set up you or someone else can go back and see what was done.
How to revert back eveything @thiojoe ? I really need to revert everything back to normal. But I don;t know how. I blocked command line powershell execution watching your one of the videos. I don't remember which one though. Sorry.
Very useful information. I wish Microsoft took Windows security more seriously. Like why have Powershell 2.0 even enabled by default? Anyone who needs it can just enable it on their own. Massive security risk.
This is one of the best examples of why Win11 was a cash grab. They made such big talk about finally breaking backwards compatibility for the sake of security, but left so many gaping security holes because they didn’t want to break backwards compatibility. CMD should be gone, it hasn’t been updated in, let me check, 23 years. PS2 should be gone, heck, even the default PS5 should be gone. There’s still ancient services that still exist for archaic programs that can be exploited.
Method 2, Microsoft's comment: "As part of the implementation of Constrained Language, PowerShell included an environment variable for debugging and unit testing called __PSLockdownPolicy. While we have never documented this, some have discovered it and described this as an enforcement mechanism. This is unwise because an attacker can easily change the environment variable to remove this enforcement. In addition, there are also file naming conventions that enable FullLanguage mode on a script, effectively bypassing Constrained Language."
For many years now I've woken up to youtube autoplaying ThioJoe videos. This time no different, I started watching Warhammer videos, fell asleep and now woke up to the voice of Thio. It's almost nostalgic and homely at the same time. Great video as always, will need to check these tips out.
Your videos are always informative and helpful. I especially appreciate that you take the time to put complicated commands in the description so they may be copied and pasted.
@@Netsuki I don’t think ThioJoe comes across as egotistical, pompous, or blinded by greed, so it is hard for me to draw the parallel between him and Linus.
@@the_dark_defender That's why I said that he is actually useful (instead of being just a YoUTube celebrite). Linus is well known for technical videos, hence the comparison. Technical RU-vidr, but the one that actually helps.
Thx Thio, this was very helpful. A small adjustment with potential big headache savings. You move so fast on your How To Step by Step. I had to pause your instruction several times.
@@jeff__w The video could have been much shorter - and more effective - if it just showed us how to download a bootable Ubuntu ISO onto a USB thumb drive :-)
Great info! You should do a video on the Microsoft Security Baselines sometime; they have an extensive inventory of useful settings like this and they're from Microsoft themselves. Lots of companies use these as a starting point for securing corporate devices.
"You don't have permission..." I created a "New Folder" in my D drive and named it "Policy Definitions", put it into "Windows:\" and it now magically has a grip of files in it. I can do nothing with it including saving anything to it. I also thought I told my pc, when I first built it, to NEVER claim I am not the administrator and to never ask for one. It really sucks that we don't get a save direction. I NEVER put anything I can avoid onto my C drive bc it's only 120 gigs. I now see that there's a ton of stuff that I use that can only be on the C drive. I just want to undo the folder but it tells my I am NOT the admin and it somehow got a grip of files put into it when I moved it from the D drive, where I created it, into the C drive. I'm hyper concerned I just screwed something up and cannot complete the Policy Plus/Definitions step. F me!
Lots to think about. I use PS (v7.x) scripts to manage two Windows systems, Home (v 10) and Pro (v 11). I configured an execution policy for PS that gave me some peace of mind. But now I realize that peace of mind was unwarranted. It looks like I will have to sign all my scripts after making the necessary security tweaks.
Absolutely Brilliant!! As an I.T engineer, this type of info is invaluable both to myself and my customers. Thank you muchly! Subbed and liked quicker than mouse can click ;)
What you forgot to mention @ThioJoe is that this will severely disable the ability to use PowerShell and bug out command history, especially when you set the constrained language option. If you're a PowerShell frequent user I advise against this since it will break both it and its usage.
@@themadmallard No. Using even the simplest history keys (eg: up and down) will result in only the commands that you input only in that certain PS session (by that I mean only commands used in that certain window, which will disappear once you close it). Also if you are using `npm` for NodeJs, you'll get error cause using scripts is disabled and/or they are not signed. The `ConstrictedLanguage` will make most Chocolatey scripts also fail due to the fact that you cannot access object members through the `.` notation. If you're a developer and you're using PS as a `terminal` you should stay away from this. The only thing which most likely will have no impact is the `disable PS 2`, all the rest will have an impact on the use of PS as a terminal.
Excellent video and walk through of all the relevant steps. I was able to stop and restart the video at various points to ensure I undertook all steps in the relevant sequence outlined. Many, many thanks. And, no I had not heard of all this before and quite agree not entirely bullet proof, the steps go a long way to ensure my computer is as safe as possible.
I think this is excellent advice! And not just for home users, but network and corporate admins should review this information to see if it can apply to their computing environments!
Here's a tip if u don't want for companies to spy on u:break your pc phone and everything electronic then go on some remote island and then maybe no one will spy on u
Mister ThioJoe , Thanks You for taking all this time to do theses videos and share them with us. You explain really well , with clarity and visual and thats from my perspective....the best way to do it. Hope you receive all the best in you're life my friend.
But, if our Computer have some error in booting up and want to open CMD or Powershell, We can't change the Group Policy or Language Policy again and we will be completely stuck! I am thinking to enable these settings only for this reason
Thank you!...again lol.. Instead of wishing I has a friend like you, thanks to RU-vid, I now have a friend like you! Amazingly helpful tips, and you teach/convey it all so well x
You can still use --command and specify a ps1 including a function to get around these still I believe. So you can atill run scripts. You can call that from a bat file if you cabt run powershell but can run bats so this would still get around it. Even if cmd was disabled from running
There are like a dozen ways around the execution policy in PowerShell. Setting the policy at the machine level does disable some of them but there are always ways around it. To quote the Microsoft documentation: "The execution policy isn't a security system that restricts user actions. For example, users can easily bypass a policy by typing the script contents at the command line when they cannot run a script. Instead, the execution policy helps users to set basic rules and prevents them from violating them unintentionally." I also wouldn't mess with the constrained language mode honestly. Lots of legitimate installers and updaters use PowerShell and may need access to the APIs and types that are blocked in ConstrainedLanguage mode. By all means remove PS 2.0 if you don't need it (should be disabled by default honestly) but the rest is kind of meh advice. I work in cybersecurity and my global execution policy is set to bypass and my language mode is set to Full. What I have done though is setup multiple layers of PowerShell logging so if PowerShell is abused I will know how.
Wada PITA ! ! The PowerShell Core maneuver just sent me over the edge with frustration. It sucks so much we have to deal with this BS & Microsoft couldn't have baked-in a patch to respect existing Policys. I used to love anything IT & now 20% + of time is either implementing changes like this or chasing the next great preventative measure & by the time I'm done the luster has faded from the heart of a project. BTW - Nice job & always a thorough & high quality video...
So in Windows you have to make restrictions for possible programs that you don't even have installed on your system? Imagine if Linux allowed a non-privileged script to download it's own sudo version and automatically gave that new version permission to elevate the scripts privileges. It's clear that "Windows" is the perfect name for it, seen as it's so easy to break it and gain access. While other OS'es build strong walls, Microsoft just decorates with thin glass.
It's not at all like sudo. It's more like disabling bash on Linux (for "security" because a lot of malware runs scripts in bash), then being surprised that people can use dash or ksh instead. Powershell is just a convenient interface for running .Net programs without compiling code. Its security boundary is exactly the same as any random exe. Things that require administrator still require administrator. No version of powershell lets you bypass that.
@@letao12 Not quite. If that was the case there would be no need to restrict it. Bash or any other shell has no permissions outside of the user running it. As such you will gain nothing by switching the shell on Linux. Even if you wanted to provide a shell with additional privileges you would still require those privileges first in order to do so. This is not what is said about Windows in this video.
Honestly, if you don't absolutely need Windows, there's no reason to stay on it at this point. Been daily driving Linux on my personal rig for almost a year now and it's been great.
@@danielberglv259 Powershell doesn't have permissions outside of the user running it either. The video never said it does, and in fact it does not. Please get your facts correct and provide evidence.
Thank you so much for all of your help over the years! I have come to your site many times to have you you do a very thorough explanation for my issues. Keep up the amazing work you do ...I know you are challenged by Windows problems and take pride in what you do. AMAZING WORK and DEDICATION! One note: I followed your instructions to the letter but was not able to change "Full Language" to "Constrained Language" on my PC. Likely other issues preventing me from doing so. No problem ...I'll take my chances. Thanks so much.
You first bring up a PS window to check the current language status. Later, you use a PS window to check the new language status. If you re-use the original PS window, it reports the *old* language status. If you re-check, I expect that your PC is set to "Constrained Language".
I literally just went through a course for my job, learning about Group Policies. I recently built a new PC and this was golden to keep it safe from the simplest vulnerabilities. Thank you for this easy to follow video.
It's more like making an open flame a little safer. It's still dangerous if mishandled, and will likely cause a greater fire, but these should help keep the fire from spreading... at the moment.
Joe, I downloaded PS 7 and copied the 2 files. I did not see the 'PowerCore" dropdown in Local Security Policy. But I did find Powershell under Windows Components, and clicked the Disabled button. FYI I have Win10- Pro, so that may be the difference. Been delaying upgrading to Win 11 to allow MS to get the 'bugs' out.
Same. I have Windows 11 (trying to figure it out) and can't even find this "Local Security Policy" option, let alone PowerCore. Everything went fine up to that last point.
Will this cause any side effects though? Especially the disabling PS 2.0? And if any program having problems because of lack of PS 2.0 how can i understand that it is caused by that?
Yeah. Can't wait until all the people who did this blindly suddenly find many programs stop working properly, then blame Microsoft for "breaking" Windows.
Btw, the method you showed doesn't really prevent bypassing the execution policy. If a program like policy plus can easily change the execution policy with admin perms, why wouldn't any other program (with admin rights ofcourse) not be able to just turn it off and run the script it wants. Anyways I'm thinking out of the scope here, because if a program is ran with admin perms, it's just gonna do whatever it wants from the exe itself, there's no point in using a powershell script.
If you are running a program as admin that is bot trustworthy, they dont need to run powershell anymore you just gave them permission to do whatever they want from the program itself
Is there a way to set it to signed scripts only and somehow sign your own scripts with your own separate key without needing Microsoft's approval? I write my own PowerShell scripts for some common stuff and this would just break all of that...
Here's an idea. Open a new tab on your browser and navigate to a website called a "Search Engine". Google is an example... Then, type the following words into the search box _"how to sign powershell script"_and then click "Enter".
Me who always checks that Nr 2 and 3 are FullLanguage and unrestricted: 👁👄👁 (These 2 quite suck as a Dev, but thanks for Nr 1, never gave that one ever a second thought)
What you could theoretically do is have a separate dev account and personal accounts, and set the “CurrentUser” policy instead of MachinePolicy for each. It still can’t be overridden but I believe applies to each user. I think you could also require AllSigned and just self-sign your scripts and set it as a trusted publisher.
@@cheehuigoh9363 If you set group policies correctly, it should be possible to delay feature updates but not security updates (IIRC, and I only tested this on Win 10)
@@ThioJoe THANKS for creating & posting this helpful video, However, after working on it for 2 hours, I wasn't able to accomplish the 3rd setting. Can you PLEASE help me? I sincerely appreciate your consideration & attention. Best regards, Ben
Important addition: There are a couple of important things to do while you are carrying out these simple operations: 1. Be sure you are facing East 2. Wear your best Wizard Robe, and ensure that you have your tungsten wand close at hand. 3. Hum the Microsoft Loyalty Song quietly throughout the process.
I am going to try out these settings because I trust you, I am only hoping it does not break my computer. I am a screen reader user and I have been having troubles with my Windows 10 desktop, like unable to delete tasks in Task Scheduler and Power and Sleep settings. More on that after I try out your suggestion in this video.
It will break installing certain applications if you disable powershell. Some also depend on PS to execute/perform correctly. The security advantage is negligible.
Thank you so much. I am very paranoid, so I only try to visit websites I know. I use ad and cookie blockers, and I also employ one of the best total security applications, along with second opinion scanners. I don't download anything I don't know about. I never use pirated software or games, except for movies that I download sometimes to watch. I am very paranoid because everything on my computer, including my passwords, address, bank card details, and important documents, is crucial to me. I find this channel very helpful. Thanks, man, for your work, and please continue doing what you do.
Downloading movies funny enough is one of the most risky types of pirated download. That is the media more business care and put their money into catching including to smoke out torrents, contact ISPs, mark the downloads and more. You want to do this right, get the movies on DVD.
Excellent video thank you, I tend to be slack with my PC, but for some reason when i saw this video I followed it and it was nice and easy to follow. and thank you for the context, very valuable.
Hi. I am not an expert or a novice. I have seen many "How to do" videos. Many of yours and some of others. I do not mean to swell your head but you are unbelievably fantastic. your knowledge and your presentations are a gift. If I ever win the lottery, (don't laugh, it's possible - My brother won 4 mil) I'm gonna find you and I am soooo gonna share with you. thank you for sharing your knowledge
some users may have a higher probability of needing it that some process is dependent on, than it being exploited, maybe? (if there are any) some examples of functions dependent on it might of been nice and informative.
Excellent explanation and easy to follow instructions. My PC is usually managed well enough but family's PCs do require some extra security settings ^_^. Thanks.
Thanks ThioJoe for the amazing content i managed to disable the script execution...but the other protective measures i wasnt able to cause apparently im not well versed with computers and you where kinda too fast in explaining
Can't say how good this will work since I'm just a regular home PC user but I must say I had to rewind the video on most steps 4 or 5 times to see where you were clicking on. For us not too familiar with doing stuff like this just saying and clicking as fast as you can almost made me stop and forget about it. Need to slooooow down on those steps especially on the last ones of copying those files, my PC screen looks nothing like yours. Other than that, thanks!
Have a need for speed? This time I have a setting for YOU. Straight from ms, we were troubleshooting via remote, and waahla. Animation is key in pc's and phones, do this: run regedit/hkey current user/control panel/desktop/menushowdelay. Will be at 400, decrease 50% -95% (200ms-20ms). you need min delay to prevent crash. I knew it was in the phone devloper settings but never knew about windows.
Can you make an in-depth video about Rectify11? I would love to know something more about its security, influence on performance, uninstallation etc. :))
I advise people to download this video for future reference. For example, should a program, update, or whatever is unable to be installed and you get some error message, you can put everything back the way it was. You are gonna need this video to do that, including the links he provides.
