Detections
Analytics

1.33 WN11-00-000155

Information

The Windows PowerShell 2.0 feature must be disabled on the system.

GROUP ID: V-253285
RULE ID: SV-253285r1153425

Windows PowerShell 5.0 added advanced logging features, which can provide additional detail when malware has been run on a system. Disabling the Windows PowerShell 2.0 mitigates against a downgrade attack that evades the Windows PowerShell 5.0 script block logging feature.

Solution

Disable 'Windows PowerShell 2.0' on the system.

Run 'Windows PowerShell' with elevated privileges (run as administrator).
Enter the following:
Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root

This command must disable both 'MicrosoftWindowsPowerShellV2Root' and 'MicrosoftWindowsPowerShellV2', which correspond to 'Windows PowerShell 2.0' and 'Windows PowerShell 2.0 Engine' respectively in 'Turn Windows features on or off'.

Alternately:
Search for 'Features'.
Select 'Turn Windows features on or off'.
De-select 'Windows PowerShell 2.0'.

See Also

https://workbench.cisecurity.org/benchmarks/27756

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7, 800-53|CM-7a., CCI|CCI-000381, Rule-ID|SV-253285r1153425_rule, STIG-ID|WN11-00-000155, Vuln-ID|V-253285

Plugin: Windows

Control ID: 454ea34db1314e1b30ab80be01068edcdf0d2b279f6f4b64ec35f0af48025780