2

What security issues are presented by letting server admins in a corporate environment run PowerShell scripts from their local desktop rather than from the server?

I am not a server guru by any means so I am curious what potential security issues this poses.

  • Both is problematic, you normally need hardened isolated admin jumpstations. Itmcan be debated, bit Inthinkmusing a 'graphical firewall' aka mstsc is a good thing to separate the trusted jumpstation from the everyday workplace of the Admins (which still needs elevated physical and computer security!) – eckes Apr 26 '17 at 22:25
  • Generally this is a bad idea. Have a look at Active Directory administrative tier model. – phbits Oct 28 at 3:58
1

If it's a dedicated admin workstation and admin account then that is the ideal scenario. So admin uses his regular account and regular pc for email & web browsing. And the admin uses his admin account and admin pc for powershell scripting against other systems.

Also don't forget to enable powershell logging so that you have a history of the commands executed in case an account is compromised.

Also make sure you apply least privilege to admin accounts. In many cases an admin can accomplish his powershell commands and queries without requiring local admin privileges.

| improve this answer | |
0

Running a Powershell script is not a problem per se, but what the script does is the issue. Almost every admin runs day to day tasks that are easily automated, and creating Powershell scripts is one of the best ways to automate things. I would be very displeased if I was an admin and had denied the right to run Powershell on my workstation. My productivity would crater, and I would take way more time to do a lot of things.

Powershell does not magically creates security issues. It's just a scripting tool. Powershell cannot do anything itself that is not allowed by Windows anyway. But what the admin does is the issue. Does he log in everywhere using his admin rights? Do it work as admin or as the normal user? Do he bypass corporate controls and change things outside a change window or without proper process? Those are the issues, not Powershell.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.