PowerShell guardrails for admin workstations
Nathan Chadwick · · 1 min read
Listen
0:000:00
TLDRRead the short version
- Send PowerShell script block logging to your SIEM so transcription exists before you need it.
- Block remote sessions from machines that are not hardened admin tier.
- Time-bound elevation beats standing local admin.
- Pair Just Enough Administration with Privileged Identity Management where the licensing allows it.
On this page
Transcription#
Send script block logging to your SIEM. Block remote sessions from machines that are not hardened admin tier.
Just enough access#
Time-bound elevation beats standing local admin. Pair Just Enough Administration with Privileged Identity Management where possible.
References#
Sources and further reading for the claims above.
A quiet signal if this helped. No account needed.
Series
Cyber Essentials
Which frameworks matter, then the UK baseline and the controls that trip people up: identity, patching, and what an assessor actually tests.