1

I've been having issues with people modifying powershell scripts and causing mayhem. Is there a one liner that I can insert into a current script to require a password that I set in order to modify the script? I still need everyone to be able to run it.

3
  • It sounds to me like you want to implement script signing in your environment. But even that isn't foolproof, because anyone can copy and paste a script, change the execution policy for a session, and run a modified copy. Commented Jan 11, 2018 at 18:20
  • @Bill_Stewart Unless they can't execute un-signed scripts, in which case that's a perfect solution that can be implemented by changing the policy with GPO. Commented Jan 11, 2018 at 18:48
  • 1
    My point was that I can start powershell.exe, set execution policy to bypass, and run whatever I need (as briantist pointed out in his answer). Commented Jan 11, 2018 at 18:51

1 Answer 1

2

The easiest and most straightforward way is to put the scripts somewhere that the problem users don't have write access to. There's nothing you can do in the language itself to prevent a user from modifying a file they have write access to.

If you can't do this for some reason (they are admins and have too much access), then you can do a few other things.

Signing

Apply a digital signature to your scripts.

For this to work, you need to be able to enforce an execution policy of AllSigned (or RemoteSigned if these scripts are executed directly off of a share). You might do this with Group Policy.

You also need to control access to the signing certificate and ensure that it's the only one that's trusted.

Note that these users can still copy the script locally, make modifications, run powershell.exe -ExecutionPolicy Bypass and still run their modified script.

The difference is that this is their copy and doesn't break it for anyone else. And if they overwrite the central script without signing it or signing it with an untrusted certificate then everyone will notice.

If the users are privileged enough they be able to override more of this.

Central Deployment

Put the scripts in a custom local repository and use the package management functions Find-Script / Install-Script so everyone is referring to the same ones, and have a well-thought out deployment process. This can be combined with signing.

But...

Ultimately if these users are privileged and they are acting in bad faith, this is a personnel problem and can't effectively be solved with technology. In that case, The Workplace may be able to help.

Sign up to request clarification or add additional context in comments.

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.