Hey guys, can you help me?
I can't run WIndows Powershell (even as admin or not),
it say "C:\Users\ASUS K84L\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk",
i try to run via directory and then windows say "This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator."
Any idea?
Any help would be appreciated. Sorry with my bad english
The message is clear: Restricted access has been set for certain(s) program(s). Do you own the computer? Are you an administrator?"This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator."
And of course: Is your machine infected?
Try to create a new user account and check if the issue persists.
Since you're running Win10 Pro, you have access to Group Policy. There is an Administrative Template "Don't run specified Windows Applications". Run it.
See https://www.microsoft.com/en-us/down....aspx?id=48257
and https://blogs.technet.microsoft.com/...ive-templates/
Maybe I came up too strong. Forget about Administrative Templates for the moment.
Instead, using the registry editor, navigate to: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies
and look at what's there, like a key named PowerShell in your case.
That message looks similar to what I have, because I have blocked PS from running, like this:
Code:reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "DisallowRun" /t REG_DWORD /d "1" /f reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "1" /t REG_SZ /d "powershell.exe" /f reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "2" /t REG_SZ /d "powershell_ise.exe" /f
yeah, i found it
Should I delete that registry key?
Yes.
Malware prevention, it is not like PS is required by anything. I actually remove PS as well.
Lets Unpack: Dridex Loader | MalwareTech
15 Ways to Bypass the PowerShell Execution Policy
The rise of .NET and powershell malware - Securelist
UAC Bypass Using eventvwr.exe and Registry Hijacking | enigma0x3
Sure, .net tools could be used to craft attacks, but I am pretty sure very few boxes were compromised by people going through weaknesses in powershell. I could see a questionable user, who insists on running as an admin, executing a powershell script which does compromise the system.
I am a big powershell user, and am going to GUI less Windows server which must be managed by powershell remotely. Different strokes I guess.
Check, if it is disabled in group policy:
Gpedit.msc\User Configuration\Administrative Templates\System\Don't run specified Windows applications
Don,t Run Specified Windows Application, Run Only Specified Windows Application - YouTube
Quote
