← Blog
PowerShell guardrails for admin workstations
Nathan Chadwick · · 1 min read
TLDRRead the short version
- Send PowerShell script block logging to your SIEM so transcription exists before you need it.
- Block remote sessions from machines that are not hardened admin tier.
- Time-bound elevation beats standing local admin.
- Pair Just Enough Administration with Privileged Identity Management where the licensing allows it.
Transcription#
Send script block logging to your SIEM. Block remote sessions from machines that are not hardened admin tier.
Just enough access#
Time-bound elevation beats standing local admin. Pair Just Enough Administration with Privileged Identity Management where possible.
References#
Sources and further reading for the claims above.