How to Block PowerShell and CMD for Standard Users but Allow Admin Access

[townsteal]

Hello,

We need to restrict our users from running scripts in PowerShell and CMD or block these applications completely, while allowing administrators to run scripts or open these apps with elevated privileges.

We attempted to use AppLocker, but the apps are blocked for both standard users and administrators. Even when we configure AppLocker to allow admins, the blocks still apply.

Additionally, I tried using the "Turn on Script Execution" option under "Administrative Templates\Windows Components\Windows PowerShell" in an Intune configuration profile. This method blocks scripts saved as files but does not prevent users from pasting scripts into an already open PowerShell window.

Any advice on how to achieve this?

 

[Bighorn]

The only offering I have would be about KIOSK mode, what stores have set for their display machines. When booting a computer there will be times when CMD windows flash up as things load, don't think they can be stopped without killing Windows.