Hi all.
Today I would like to present second part of my
resume by e-book "PowerShell Security".
JEA.
I don't know if I need to describe JEA again. Ok, I will write about it very shortly today. So, by default, there are three Session Configurations on each Windows computer, namely:
- microsoft.powershell,
- microsoft.powershell.workflow,
- microsoft.windows.server-managerworkflows.
1) Get-PSSessionConfiguration
Define "HelpDesk" configuration:
Register-PSSessionConfiguration -Name HelpDesk
This opens the dialog you already know from managing file permissions:
Register-PSSessionConfiguration -Name HelpDesk -ShowSecurityDescriptorUI
Defining RunsAs users:
Register-PSSessionConfiguration -Name HelpDesk -RunAsCredential forza.com\MikeLee
Set additional options via configuration file:
New-PSSessionConfigurationFile -Path .\MyConfig.pssc
The following are particularly useful to prevent users from potentially harmful actions:
-languageMode with the values FullLanguage, RestrictedLanguage, ConstrainedLanguage, NoLanguage: The latter allows only the exe-cution of cmdlets and functions, other language resources are not available.
FullLanguage offers the full range of language capabilities, the other two lie between these two poles.
-VisibleAliases, VisibleCmdlets, VisibleFunctions, VisibleProviders: These allow you to specify which aliases, cmdlets, functions, and providers are available in the session.
You can use wildcards and specify multiple values as array.
Example:
New-PSSessionConfigurationFile -Path .\MyConfig.pssc -VisibleCmdlets "Get*","Select*"
You adjust the Session Configuration based on this file:
Set-PSSessionConfiguration -Name HelpDesk -Path .\MyConfig.pssc
Enter-PSSession -ComputerName Remote-PC -ConfigurationName HelpDesk
-OR-
Invoke-Command -ComputerName Remote-PC -ConfigurationName Helpdesk {Get-ChildItem}
2) New-PSRoleCapabilityFile -Path MyRCF.psrc
-OR-
JEA Helper Tool create MyRCF.psrc
Once you have created the list of permitted cmdlets and parameters, you can add them to the .psrc file. You save this file in a directory called RoleCapabilities under
$env:ProgramFiles\WindowsPowerShell\Modules
The last step is to link the role capabilities to the desired session configu-ration. To do this, edit the configuration file with the extension .pssc and add the role functions there.
Since you create this file automatically at the beginning, this (commented out) section for RoleDefinitions should already be there:
RoleDefinitions = @{ 'CONTOSO\SqlAdmins' = ` @{ RoleCapabilities = 'SqlAdministration' };
'CONTOSO\SqlManaged' = @{ RoleCapabilityFiles = 'C:\RoleCapability\SqlManaged.psrc' };
'CONTOSO\ServerMonitors' = ` @{ VisibleCmdlets = 'Get-Process' } }
Привіт привіт.
