I am in the process of prepping our 100+ terminal server environment for remote PowerShell management and I have run into a problem regarding Endpoint configuration.
Summary:
We have a ‘Block_App_Exec’ GPO that apparently puts the default powershell endpoint on each server into a Constrained language mode which prevents me from running different types of scripts on the network. This GPO was put in place to prevent certain types of malware from running and encrypting files. I confirmed this was the entity that was putting PowerShell endpoint into contrained mode by removing a specific server from the GPO. Post removal, I was able to do the steps below and run my inventory application script without hindrance.
My ‘resolution’ was to define a custom endpoint on each server with ‘Full Language Mode’ capability, however that does not seem to make a difference even when I do a direct session to that endpoint…the $ExecutionContext.SessionState.LanguageMode still returns constrained mode even though I am connecting to the session configuration type that has ‘Full Language Mode’ capability.
It seems that the GPO is overriding my custom endpoint.
Want to confirm that my method is sound so I can invoke powershell commands without relaxing security policies from our network.
This is a test on one server in the mix to illustrate the issue.
Confirming that the session is in Constrained mode.
[w2k8-c12-01]: PS C:\> $ExecutionContext.SessionState.LanguageMode ConstrainedLanguage
Whether I use the Invoke-command or Enter-pssession, current language mode prevents execution.
[w2k8-c12-01]: PS C:\Users\administrator.XXXX\Documents> .\get-installedProg.ps1
Cannot invoke method. Method invocation is supported only on core types in this language mode.
At C:\Users\administrator.XXXX \Documents\get-installedProg.ps1:12 char:5
+ $reg=[microsoft.win32.registrykey]::OpenRemoteBaseKey('LocalMachi ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : MethodInvocationNotSupportedInConstrainedLanguage
You cannot call a method on a null-valued expression.
At C:\Users\administrator.XXXX\Documents\get-installedProg.ps1:16 char:5
+ $regkey=$reg.OpenSubKey($UninstallKey)
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull
You cannot call a method on a null-valued expression.
At C:\Users\administrator.XXXX\Documents\get-installedProg.ps1:20 char:5
+ $subkeys=$regkey.GetSubKeyNames()
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull
Created a custom session configuration on this particular server with ‘Full Language Mode’
PSSC file
[w2k8-c12-01]: PS C:\Users\administrator.XXXX\Documents> Get-PSSessionConfiguration
**** *** Name : tp_session PSVersion : 5.0 StartupScript : RunAsUser : Permission : NT AUTHORITY\INTERACTIVE AccessAllowed, BUILTIN\Administrators AccessAllowed
This is the PSSC file for the session config.
@{
# Version number of the schema used for this document
SchemaVersion = '2.0.0.0'
# ID used to uniquely identify this document
GUID = '8ea96f31-132e-4e95-97b2-6349debc3d62'
# Author of this document
Author = 'Brian Clanton'
# Description of the functionality provided by these settings
Description = 'XXXX remote session configuration'
# Company associated with this document
CompanyName = 'XXXX'
# Session type defaults to apply for this session configuration. Can be 'RestrictedRemoteServer' (recommended), 'Empty', or 'Default'
SessionType = 'Default'
# Directory to place session transcripts for this session configuration
# TranscriptDirectory = 'C:\Transcripts\'
# Whether to run this session configuration as the machine's (virtual) administrator account
# RunAsVirtualAccount = $true
# Groups associated with machine's (virtual) administrator account
# RunAsVirtualAccountGroups = 'Remote Desktop Users', 'Remote Management Users'
# Scripts to run when applied to a session
# ScriptsToProcess = 'C:\ConfigData\InitScript1.ps1', 'C:\ConfigData\InitScript2.ps1'
# User roles (security groups), and the role capabilities that should be applied to them when applied to a session
# RoleDefinitions = @{ 'CONTOSO\SqlAdmins' = @{ RoleCapabilities = 'SqlAdministration' }; 'CONTOSO\ServerMonitors' = @{ VisibleCmdlets = 'Get-Process' } }
# Language mode to apply when applied to a session. Can be 'NoLanguage' (recommended), 'RestrictedLanguage', 'ConstrainedLanguage', or 'FullLanguage'
LanguageMode = 'FullLanguage'
}
I enter a pssession and specify the full language config type, however the language mode is still constrained and I still can’t execute the script.
PS C:\Windows> Enter-PSSession -ComputerName w2k8-c12-01 -ConfigurationName tp_session
[w2k8-c12-01]: PS C:\Users\administrator.XXXX\Documents> $ExecutionContext.SessionState.LanguageMode
ConstrainedLanguage
[w2k8-c12-01]: PS C:\Users\administrator.XXXX\Documents> .\get-installedProg.ps1
Cannot invoke method. Method invocation is supported only on core types in this language mode.
At C:\Users\administrator.XXXX\Documents\get-installedProg.ps1:12 char:5
+ $reg=[microsoft.win32.registrykey]::OpenRemoteBaseKey('LocalMachi ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : MethodInvocationNotSupportedInConstrainedLanguage
You cannot call a method on a null-valued expression.
At C:\Users\administrator.XXXX\Documents\get-installedProg.ps1:16 char:5
+ $regkey=$reg.OpenSubKey($UninstallKey)
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull
You cannot call a method on a null-valued expression.
At C:\Users\administrator.XXXX\Documents\get-installedProg.ps1:20 char:5
+ $subkeys=$regkey.GetSubKeyNames()
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull