What security issues are presented by letting server admins in a corporate environment run PowerShell scripts from their local desktop rather than from the server?
I am not a server guru by any means so I am curious what potential security issues this poses.
If it's a dedicated admin workstation and admin account then that is the ideal scenario. So admin uses his regular account and regular pc for email & web browsing. And the admin uses his admin account and admin pc for powershell scripting against other systems.
Also don't forget to enable powershell logging so that you have a history of the commands executed in case an account is compromised.
Also make sure you apply least privilege to admin accounts. In many cases an admin can accomplish his powershell commands and queries without requiring local admin privileges.
Running a Powershell script is not a problem per se, but what the script does is the issue. Almost every admin runs day to day tasks that are easily automated, and creating Powershell scripts is one of the best ways to automate things. I would be very displeased if I was an admin and had denied the right to run Powershell on my workstation. My productivity would crater, and I would take way more time to do a lot of things.
Powershell does not magically creates security issues. It's just a scripting tool. Powershell cannot do anything itself that is not allowed by Windows anyway. But what the admin does is the issue. Does he log in everywhere using his admin rights? Do it work as admin or as the normal user? Do he bypass corporate controls and change things outside a change window or without proper process? Those are the issues, not Powershell.
