Skip to content

Commit ed29ad1

Browse files
AndrewTravisEz13
Andrew
authored and
TravisEz13
committed
Adding PSCore group policy definitions (PowerShell#10468)
1 parent 2aae04a commit ed29ad1

File tree

8 files changed

+666
-27
lines changed

8 files changed

+666
-27
lines changed

‎assets/GroupPolicy/InstallPSCorePolicyDefinitions.ps1

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# Copyright (c) Microsoft Corporation.
2+
# Licensed under the MIT License.
3+
4+
<#
5+
.Synopsis
6+
Group Policy tools use administrative template files (.admx, .adml) to populate policy settings in the user interface.
7+
This allows administrators to manage registry-based policy settings.
8+
This script installes PowerShell Core Administrative Templates for Windows.
9+
.Notes
10+
The PowerShellCoreExecutionPolicy.admx and PowerShellCoreExecutionPolicy.adml files are
11+
expected to be at the location specified by the Path parameter with default value of the location of this script.
12+
#>
13+
[CmdletBinding()]
14+
param
15+
(
16+
[ValidateNotNullOrEmpty()]
17+
[string] $Path = $PSScriptRoot
18+
)
19+
Set-StrictMode -Version Latest
20+
$ErrorActionPreference = 'Stop'
21+
22+
function Test-Elevated
23+
{
24+
[CmdletBinding()]
25+
[OutputType([bool])]
26+
Param()
27+
28+
# if the current Powershell session was called with administrator privileges,
29+
# the Administrator Group's well-known SID will show up in the Groups for the current identity.
30+
# Note that the SID won't show up unless the process is elevated.
31+
return (([Security.Principal.WindowsIdentity]::GetCurrent()).Groups -contains "S-1-5-32-544")
32+
}
33+
$IsWindowsOs = $PSHOME.EndsWith('\WindowsPowerShell\v1.0', [System.StringComparison]::OrdinalIgnoreCase) -or $IsWindows
34+
35+
if (-not $IsWindowsOs)
36+
{
37+
throw 'This script must be run on Windows.'
38+
}
39+
40+
if (-not (Test-Elevated))
41+
{
42+
throw 'This script must be run from an elevated process.'
43+
}
44+
45+
if ([System.Management.Automation.Platform]::IsNanoServer)
46+
{
47+
throw 'Group policy definitions are not supported on Nano Server.'
48+
}
49+
50+
$admxName = 'PowerShellCoreExecutionPolicy.admx'
51+
$admlName = 'PowerShellCoreExecutionPolicy.adml'
52+
$admx = Get-Item -Path (Join-Path -Path $Path -ChildPath $admxName)
53+
$adml = Get-Item -Path (Join-Path -Path $Path -ChildPath $admlName)
54+
$admxTargetPath = Join-Path -Path $env:WINDIR -ChildPath "PolicyDefinitions"
55+
$admlTargetPath = Join-Path -Path $admxTargetPath -ChildPath "en-US"
56+
57+
$files = @($admx, $adml)
58+
foreach ($file in $files)
59+
{
60+
if (-not (Test-Path -Path $file))
61+
{
62+
throw "Could not find $($file.Name) at $Path"
63+
}
64+
}
65+
66+
Write-Verbose "Copying $admx to $admxTargetPath"
67+
Copy-Item -Path $admx -Destination $admxTargetPath -Force
68+
$admxTargetFullPath = Join-Path -Path $admxTargetPath -ChildPath $admxName
69+
if (Test-Path -Path $admxTargetFullPath)
70+
{
71+
Write-Verbose "$admxName was installed successfully"
72+
}
73+
else
74+
{
75+
Write-Error "Could not install $admxName"
76+
}
77+
78+
Write-Verbose "Copying $adml to $admlTargetPath"
79+
Copy-Item -Path $adml -Destination $admlTargetPath -Force
80+
$admlTargetFullPath = Join-Path -Path $admlTargetPath -ChildPath $admlName
81+
if (Test-Path -Path $admlTargetFullPath)
82+
{
83+
Write-Verbose "$admlName was installed successfully"
84+
}
85+
else
86+
{
87+
Write-Error "Could not install $admlName"
88+
}

‎assets/GroupPolicy/PowerShellCoreExecutionPolicy.adml

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<policyDefinitionResources xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" revision="1.0" schemaVersion="1.0" xmlns="http://www.microsoft.com/GroupPolicy/PolicyDefinitions">
3+
<displayName>PowerShell Core</displayName>
4+
<description>This file contains the configuration options for PowerShell Core</description>
5+
<resources>
6+
<stringTable>
7+
<string id="AllScripts">Allow all scripts</string>
8+
<string id="AllScriptsSigned">Allow only signed scripts</string>
9+
<string id="EnableScripts">Turn on Script Execution</string>
10+
<string id="EnableScripts_Explain">This policy setting lets you configure the script execution policy, controlling which scripts are allowed to run.
11+
12+
If you enable this policy setting, the scripts selected in the drop-down list are allowed to run.
13+
14+
The "Allow only signed scripts" policy setting allows scripts to execute only if they are signed by a trusted publisher.
15+
16+
The "Allow local scripts and remote signed scripts" policy setting allows any local scrips to run; scripts that originate from the internet must be signed by a trusted publisher.
17+
18+
The "Allow all scripts" policy setting allows all scripts to run.
19+
20+
If you disable this policy setting, no scripts are allowed to run.
21+
22+
Note: This policy setting exists under both "Computer Configuration" and "User Configuration" in the Local Group Policy Editor. The "Computer Configuration" has precedence over "User Configuration."
23+
24+
If you disable or do not configure this policy setting, it reverts to a per-machine preference setting; the default if that is not configured is "Allow local scripts and remote signed scripts."</string>
25+
<string id="PowerShell">PowerShell Core</string>
26+
<string id="RemoteSignedScripts">Allow local scripts and remote signed scripts</string>
27+
<string id="SUPPORTED_WIN7">At least Microsoft Windows 7 or Windows Server 2008 family</string>
28+
29+
<string id="EnableModuleLogging">Turn on Module Logging</string>
30+
<string id="EnableModuleLogging_Explain">
31+
This policy setting allows you to turn on logging for PowerShell Core modules.
32+
33+
If you enable this policy setting, pipeline execution events for members of the specified modules are recorded in the PowerShell Core log in Event Viewer. Enabling this policy setting for a module is equivalent to setting the LogPipelineExecutionDetails property of the module to True.
34+
35+
If you disable this policy setting, logging of execution events is disabled for all PowerShell Core modules. Disabling this policy setting for a module is equivalent to setting the LogPipelineExecutionDetails property of the module to False.
36+
37+
If this policy setting is not configured, the LogPipelineExecutionDetails property of a module determines whether the execution events of a module are logged. By default, the LogPipelineExecutionDetails property of all modules is set to False.
38+
39+
To add modules to the policy setting list, click Show, and then type the module names in the list. The modules in the list must be installed on the computer.
40+
41+
Note: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting.
42+
</string>
43+
44+
<string id="EnableTranscripting">Turn on PowerShell Transcription</string>
45+
<string id="EnableTranscripting_Explain">
46+
This policy setting lets you capture the input and output of PowerShell Core commands into text-based transcripts.
47+
48+
If you enable this policy setting, PowerShell Core will enable transcription logging for PowerShell Core and any other
49+
applications that leverage the PowerShell Core engine. By default, PowerShell Core will record transcript output to each users' My Documents
50+
directory, with a file name that includes 'PowerShell_transcript', along with the computer name and time started. Enabling this policy is equivalent
51+
to calling the Start-Transcript cmdlet on each PowerShell Core session.
52+
53+
If you disable this policy setting, transcription logging of PowerShell-based applications is disabled by default, although transcripting can still be enabled
54+
through the Start-Transcript cmdlet.
55+
56+
If you use the OutputDirectory setting to enable transcription logging to a shared location, be sure to limit access to that directory to prevent users
57+
from viewing the transcripts of other users or computers.
58+
59+
Note: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting.
60+
</string>
61+
62+
<string id="EnableScriptBlockLogging">Turn on PowerShell Script Block Logging</string>
63+
<string id="EnableScriptBlockLogging_Explain">
64+
This policy setting enables logging of all PowerShell script input to the Microsoft-Windows-PowerShell/Operational event log. If you enable this policy setting,
65+
PowerShell Core will log the processing of commands, script blocks, functions, and scripts - whether invoked interactively, or through automation.
66+
67+
If you disable this policy setting, logging of PowerShell script input is disabled.
68+
69+
If you enable the Script Block Invocation Logging, PowerShell additionally logs events when invocation of a command, script block, function, or script
70+
starts or stops. Enabling Invocation Logging generates a high volume of event logs.
71+
72+
Note: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting.
73+
</string>
74+
75+
<string id="EnableUpdateHelpDefaultSourcePath">Set the default source path for Update-Help</string>
76+
<string id="EnableUpdateHelpDefaultSourcePath_Explain">This policy setting allows you to set the default value of the SourcePath parameter on the Update-Help cmdlet.
77+
78+
If you enable this policy setting, the Update-Help cmdlet will use the specified value as the default value for the SourcePath parameter. This default value can be overridden by specifying a different value with the SourcePath parameter on the Update-Help cmdlet.
79+
80+
If this policy setting is disabled or not configured, this policy setting does not set a default value for the SourcePath parameter of the Update-Help cmdlet.
81+
82+
Note: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting.
83+
</string>
84+
<string id="ConsoleSessionConfiguration">Console session configuration</string>
85+
<string id="ConsoleSessionConfiguration_Explain">Specifies a configuration endpoint in which PowerShell is run. This can be any endpoint registered on the local machine including the default PowerShell remoting endpoints or a custom endpoint having specific user role capabilities.</string>
86+
87+
<!--<string id="PowerShell">PowerShell Core</string>-->
88+
</stringTable>
89+
<presentationTable>
90+
<presentation id="EnableScripts">
91+
<checkBox refId="UseWindowsPowerShellPolicySetting">Use Windows PowerShell Policy setting.</checkBox>
92+
<dropdownList refId="ExecutionPolicy" noSort="true">Execution Policy</dropdownList>
93+
</presentation>
94+
<presentation id="EnableModuleLogging">
95+
<checkBox refId="UseWindowsPowerShellPolicySetting">Use Windows PowerShell Policy setting.</checkBox>
96+
<text>To turn on logging for one or more modules, click Show, and then type the module names in the list. Wildcards are supported.</text>
97+
<listBox refId="Listbox_ModuleNames" required="false">Module Names</listBox>
98+
<text>To turn on logging for the PowerShell Core core modules, type the following module names in the list:</text>
99+
<text>Microsoft.PowerShell.*</text>
100+
<text>Microsoft.WSMan.Management</text>
101+
</presentation>
102+
<presentation id="EnableTranscripting">
103+
<checkBox refId="UseWindowsPowerShellPolicySetting">Use Windows PowerShell Policy setting.</checkBox>
104+
<textBox refId="OutputDirectory"><label>Transcript output directory</label></textBox>
105+
<checkBox refId="EnableInvocationHeader">Include invocation headers:</checkBox>
106+
</presentation>
107+
<presentation id="EnableScriptBlockLogging">
108+
<checkBox refId="UseWindowsPowerShellPolicySetting">Use Windows PowerShell Policy setting.</checkBox>
109+
<checkBox refId="EnableScriptBlockInvocationLogging">Log script block invocation start / stop events:</checkBox>
110+
</presentation>
111+
<presentation id="EnableUpdateHelpDefaultSourcePath">
112+
<checkBox refId="UseWindowsPowerShellPolicySetting">Use Windows PowerShell Policy setting.</checkBox>
113+
<textBox refId="SourcePathForUpdateHelp">
114+
<label>Default Source Path</label>
115+
</textBox>
116+
</presentation>
117+
<presentation id="ConsoleSessionConfiguration">
118+
<textBox refId="ConsoleSessionConfigurationName">
119+
<label>ConsoleSessionConfigurationName</label>
120+
</textBox>
121+
</presentation>
122+
</presentationTable>
123+
</resources>
124+
125+
</policyDefinitionResources>

‎assets/GroupPolicy/PowerShellCoreExecutionPolicy.admx

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<policyDefinitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" revision="1.0" schemaVersion="1.0" xmlns="http://www.microsoft.com/GroupPolicy/PolicyDefinitions">
3+
<policyNamespaces>
4+
<target prefix="powershellexecutionpolicy" namespace="Microsoft.Policies.PowerShellCore" />
5+
<using prefix="windows" namespace="Microsoft.Policies.Windows" />
6+
</policyNamespaces>
7+
<resources minRequiredRevision="1.0" />
8+
<supportedOn>
9+
<definitions>
10+
<definition name="SUPPORTED_WIN7" displayName="$(string.SUPPORTED_WIN7)" />
11+
</definitions>
12+
</supportedOn>
13+
<categories>
14+
<category name="PowerShell" displayName="$(string.PowerShell)">
15+
</category>
16+
</categories>
17+
<policies>
18+
<policy name="EnableScripts" class="Both" displayName="$(string.EnableScripts)" explainText="$(string.EnableScripts_Explain)" presentation="$(presentation.EnableScripts)" key="Software\Policies\Microsoft\PowerShellCore" valueName="EnableScripts">
19+
<parentCategory ref="PowerShell" />
20+
<supportedOn ref="SUPPORTED_WIN7" />
21+
<enabledValue>
22+
<decimal value="1" />
23+
</enabledValue>
24+
<disabledValue>
25+
<decimal value="0" />
26+
</disabledValue>
27+
<elements>
28+
<boolean id="UseWindowsPowerShellPolicySetting" valueName="UseWindowsPowerShellPolicySetting" />
29+
<enum id="ExecutionPolicy" valueName="ExecutionPolicy" required="true">
30+
<item displayName="$(string.AllScriptsSigned)">
31+
<value>
32+
<string>AllSigned</string>
33+
</value>
34+
</item>
35+
<item displayName="$(string.RemoteSignedScripts)">
36+
<value>
37+
<string>RemoteSigned</string>
38+
</value>
39+
</item>
40+
<item displayName="$(string.AllScripts)">
41+
<value>
42+
<string>Unrestricted</string>
43+
</value>
44+
</item>
45+
</enum>
46+
</elements>
47+
</policy>
48+
<policy name="EnableModuleLogging" class="Both" displayName="$(string.EnableModuleLogging)" explainText="$(string.EnableModuleLogging_Explain)" presentation="$(presentation.EnableModuleLogging)" key="Software\Policies\Microsoft\PowerShellCore\ModuleLogging" valueName="EnableModuleLogging">
49+
<parentCategory ref="PowerShell" />
50+
<supportedOn ref="SUPPORTED_WIN7" />
51+
<enabledValue>
52+
<decimal value="1" />
53+
</enabledValue>
54+
<disabledValue>
55+
<decimal value="0" />
56+
</disabledValue>
57+
<elements>
58+
<boolean id="UseWindowsPowerShellPolicySetting" valueName="UseWindowsPowerShellPolicySetting" />
59+
<list id="Listbox_ModuleNames" key="Software\Policies\Microsoft\PowerShellCore\ModuleLogging\ModuleNames" />
60+
</elements>
61+
</policy>
62+
<policy name="EnableTranscripting" class="Both" displayName="$(string.EnableTranscripting)" explainText="$(string.EnableTranscripting_Explain)" presentation="$(presentation.EnableTranscripting)" key="Software\Policies\Microsoft\PowerShellCore\Transcription" valueName="EnableTranscripting">
63+
<parentCategory ref="PowerShell" />
64+
<supportedOn ref="SUPPORTED_WIN7" />
65+
<enabledValue>
66+
<decimal value="1" />
67+
</enabledValue>
68+
<disabledValue>
69+
<decimal value="0" />
70+
</disabledValue>
71+
<elements>
72+
<boolean id="UseWindowsPowerShellPolicySetting" valueName="UseWindowsPowerShellPolicySetting" />
73+
<text id="OutputDirectory" valueName="OutputDirectory" />
74+
<boolean id="EnableInvocationHeader" valueName="EnableInvocationHeader" />
75+
</elements>
76+
</policy>
77+
<policy name="EnableScriptBlockLogging" class="Both" displayName="$(string.EnableScriptBlockLogging)" explainText="$(string.EnableScriptBlockLogging_Explain)" presentation="$(presentation.EnableScriptBlockLogging)" key="Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging" valueName="EnableScriptBlockLogging">
78+
<parentCategory ref="PowerShell" />
79+
<supportedOn ref="SUPPORTED_WIN7" />
80+
<enabledValue>
81+
<decimal value="1" />
82+
</enabledValue>
83+
<disabledValue>
84+
<decimal value="0" />
85+
</disabledValue>
86+
<elements>
87+
<boolean id="UseWindowsPowerShellPolicySetting" valueName="UseWindowsPowerShellPolicySetting" />
88+
<boolean id="EnableScriptBlockInvocationLogging" valueName="EnableScriptBlockInvocationLogging" />
89+
</elements>
90+
</policy>
91+
<policy name="EnableUpdateHelpDefaultSourcePath" class="Both" displayName="$(string.EnableUpdateHelpDefaultSourcePath)" explainText="$(string.EnableUpdateHelpDefaultSourcePath_Explain)" presentation="$(presentation.EnableUpdateHelpDefaultSourcePath)" key="Software\Policies\Microsoft\PowerShellCore\UpdatableHelp" valueName="EnableUpdateHelpDefaultSourcePath">
92+
<parentCategory ref="PowerShell" />
93+
<supportedOn ref="SUPPORTED_WIN7" />
94+
<enabledValue>
95+
<decimal value="1" />
96+
</enabledValue>
97+
<disabledValue>
98+
<decimal value="0" />
99+
</disabledValue>
100+
<elements>
101+
<boolean id="UseWindowsPowerShellPolicySetting" valueName="UseWindowsPowerShellPolicySetting" />
102+
<text id="SourcePathForUpdateHelp" valueName="DefaultSourcePath" required="true"/>
103+
</elements>
104+
</policy>
105+
<policy name="ConsoleSessionConfiguration" class="Both" displayName="$(string.ConsoleSessionConfiguration)" explainText="$(string.ConsoleSessionConfiguration_Explain)" presentation="$(presentation.ConsoleSessionConfiguration)" key="Software\Policies\Microsoft\PowerShellCore\ConsoleSessionConfiguration" valueName="EnableConsoleSessionConfiguration">
106+
<parentCategory ref="PowerShell" />
107+
<supportedOn ref="SUPPORTED_WIN7" />
108+
<enabledValue>
109+
<decimal value="1" />
110+
</enabledValue>
111+
<disabledValue>
112+
<decimal value="0" />
113+
</disabledValue>
114+
<elements>
115+
<text id="ConsoleSessionConfigurationName" valueName="ConsoleSessionConfigurationName" required="true"/>
116+
</elements>
117+
</policy>
118+
</policies>
119+
</policyDefinitions>

0 commit comments

Comments
 (0)