{"id":208563,"date":"2024-01-24T09:09:45","date_gmt":"2024-01-24T09:09:45","guid":{"rendered":"https:\/\/www.ninjaone.com\/script-hub\/wie-deaktiviere-lokale-admin-tools-in-windows-powershell\/"},"modified":"2024-03-04T17:05:48","modified_gmt":"2024-03-04T17:05:48","slug":"wie-deaktiviere-lokale-admin-tools-in-windows-powershell","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/de\/script-hub\/wie-deaktiviere-lokale-admin-tools-in-windows-powershell\/","title":{"rendered":"Lokale Verwaltungstools in Windows deaktivieren [PowerShell Script]"},"content":{"rendered":"

Achtung IT-Fachleute und Managed Service Provider (MSPs): Wenn Sie schon einmal mit der Aufrechterhaltung der Netzwerksicherheit und des administrativen Zugriffs betraut waren, wissen Sie, dass dies oft leichter gesagt als getan ist. Ein wichtiger Aspekt dabei ist die Verwaltung lokaler Administrator-Tools, \u00fcber die die Benutzer:innen nicht frei verf\u00fcgen sollten. Dies f\u00fchrt uns zu einer h\u00e4ufig gestellten Frage: Wie deaktiviere ich lokale Verwaltungstools<\/strong> bei der Skalierung?<\/p>\n

Wir haben ein umfassendes PowerShell-Skript, mit dem Sie die Verwaltungstools in einer Windows-Umgebung selektiv deaktivieren k\u00f6nnen.<\/p>\n

Das PowerShell-Skript „Lokale Admin-Tools deaktivieren<\/h2>\n
#Requires -Version 5.1\r\n\r\n<#\r\n.SYNOPSIS\r\n    This will disable the selected administrator tools depending on your selection (Defaults to all). Can be given a comma separated list of users to exclude from this action.\r\n.DESCRIPTION\r\n    This will disable the selected administrator tools. The options are \"All\", the command prompt, the control panel, the microsoft management console,\r\n    the registry editor, the run command window and task manager. You can give it a comma separated list of items if you want to disable some but not all.\r\n    Exit 1 is usually an indicator of bad input but can also mean editing the registry is blocked.\r\n.EXAMPLE\r\n    PS C:> .Disable-LocalAdminTools.ps1 -Tools \"MMC,Cmd,TaskMgr,RegistryEditor\"\r\n    Disabling MMC...\r\n    Set Registry::HKEY_USERSDefaultProfileSoftwarePoliciesMicrosoftMMCRestrictToPermittedSnapins to...\r\n    Disabling Cmd...\r\n    Set Registry::HKEY_USERSDefaultProfileSoftwarePoliciesMicrosoftWindowsDisableCMD to...\r\n    Disabling TaskMgr...\r\n    Set Registry::HKEY_USERSDefaultProfileSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableTaskMgr to...\r\n    Disabling RegistryEditor...\r\n    Set Registry::HKEY_USERSDefaultProfileSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableRegistryTools to...\r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    Minimum Supported OS: Windows 10, Windows Server 2016+\r\n    Release Notes: Renamed script and added Script Variable support\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/de\/nutzungsbedingungen\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    [Parameter()]\r\n    [String]$Tools = \"All\",\r\n    [Parameter()]\r\n    [String]$ExcludedUsers\r\n)\r\n\r\nbegin {\r\n    \r\n    if ($env:excludeUsers -and $env:excludeUsers -notlike \"null\") { $ExcludedUsers = $env:excludeUsers }\r\n    \r\n    # Lets double check that this script is being run appropriately\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n    }\r\n\r\n    function Test-IsSystem {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        return $id.Name -like \"NT AUTHORITY*\" -or $id.IsSystem\r\n    }\r\n\r\n    if (!(Test-IsElevated) -and !(Test-IsSystem)) {\r\n        Write-Error -Message \"[Error] Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n\r\n    # Setting up some functions to be used later.\r\n    function Set-HKProperty {\r\n        param (\r\n            $Path,\r\n            $Name,\r\n            $Value,\r\n            [ValidateSet('DWord', 'QWord', 'String', 'ExpandedString', 'Binary', 'MultiString', 'Unknown')]\r\n            $PropertyType = 'DWord'\r\n        )\r\n        if (-not $(Test-Path -Path $Path)) {\r\n            # Check if path does not exist and create the path\r\n            New-Item -Path $Path -Force | Out-Null\r\n        }\r\n        if ((Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)) {\r\n            # Update property and print out what it was changed from and changed to\r\n            $CurrentValue = Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore\r\n            try {\r\n                Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force -Confirm:$false -ErrorAction Stop | Out-Null\r\n            }\r\n            catch {\r\n                Write-Error \"[Error] Unable to Set registry key for $Name please see below error!\"\r\n                Write-Error $_\r\n                exit 1\r\n            }\r\n            Write-Host \"$Path$Name changed from $CurrentValue to $(Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)\"\r\n        }\r\n        else {\r\n            # Create property with value\r\n            try {\r\n                New-ItemProperty -Path $Path -Name $Name -Value $Value -PropertyType $PropertyType -Force -Confirm:$false -ErrorAction Stop | Out-Null\r\n            }\r\n            catch {\r\n                Write-Error \"[Error] Unable to Set registry key for $Name please see below error!\"\r\n                Write-Error $_\r\n                exit 1\r\n            }\r\n            Write-Host \"Set $Path$Name to $(Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)\"\r\n        }\r\n    }\r\n\r\n    # This will get all the registry path's for all actual users (not system or network service account but actual users.)\r\n    function Get-UserHives {\r\n        param (\r\n            [Parameter()]\r\n            [ValidateSet('AzureAD', 'DomainAndLocal', 'All')]\r\n            [String]$Type = \"All\",\r\n            [Parameter()]\r\n            [String[]]$ExcludedUsers,\r\n            [Parameter()]\r\n            [switch]$IncludeDefault\r\n        )\r\n\r\n        # User account SID's follow a particular patter depending on if they're azure AD or a Domain account or a local \"workgroup\" account.\r\n        $Patterns = switch ($Type) {\r\n            \"AzureAD\" { \"S-1-12-1-(d+-?){4}$\" }\r\n            \"DomainAndLocal\" { \"S-1-5-21-(d+-?){4}$\" }\r\n            \"All\" { \"S-1-12-1-(d+-?){4}$\" ; \"S-1-5-21-(d+-?){4}$\" } \r\n        }\r\n\r\n        # We'll need the NTuser.dat file to load each users registry hive. So we grab it if their account sid matches the above pattern. \r\n        $UserProfiles = Foreach ($Pattern in $Patterns) { \r\n            Get-ItemProperty \"HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionProfileList*\" |\r\n                Where-Object { $_.PSChildName -match $Pattern } | \r\n                Select-Object @{Name = \"SID\"; Expression = { $_.PSChildName } }, \r\n                @{Name = \"UserHive\"; Expression = { \"$($_.ProfileImagePath)NTuser.dat\" } }, \r\n                @{Name = \"UserName\"; Expression = { \"$($_.ProfileImagePath | Split-Path -Leaf)\" } }\r\n        }\r\n\r\n        # There are some situations where grabbing the .Default user's info is needed.\r\n        switch ($IncludeDefault) {\r\n            $True {\r\n                $DefaultProfile = \"\" | Select-Object UserName, SID, UserHive\r\n                $DefaultProfile.UserName = \"Default\"\r\n                $DefaultProfile.SID = \"DefaultProfile\"\r\n                $DefaultProfile.Userhive = \"$env:SystemDriveUsersDefaultNTUSER.DAT\"\r\n\r\n                # It was easier to write-output twice than combine the two objects.\r\n                $DefaultProfile | Where-Object { $ExcludedUsers -notcontains $_.UserName } | Write-Output\r\n            }\r\n        }\r\n\r\n        $UserProfiles | Where-Object { $ExcludedUsers -notcontains $_.UserName } | Write-Output\r\n    }\r\n\r\n    function Set-Tool {\r\n        [CmdletBinding()]\r\n        param(\r\n            [Parameter()]\r\n            [ValidateSet(\"All\", \"Cmd\", \"ControlPanel\", \"theControlPanel\", \"MMC\", \"RegistryEditor\", \"theRegistryEditor\", \"Run\", \"TaskMgr\", \"taskManager\")]\r\n            [string]$Tool,\r\n            [string]$key\r\n        )\r\n        process {\r\n            # Each option has a different registry key to change. Since this function only supports 1 item at a time I can check which option and set the regkey individually.\r\n            Write-Host \"Disabling $Tool...\"\r\n            switch ($Tool) {\r\n                \"Cmd\" { Set-HKProperty -Path $keySoftwarePoliciesMicrosoftWindowsSystem -Name DisableCMD -Value 1 }\r\n                \"ControlPanel\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoControlPanel -Value 1 }\r\n                \"theControlPanel\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoControlPanel -Value 1 }\r\n                \"MMC\" { Set-HKProperty -Path $keySoftwarePoliciesMicrosoftMMC -Name RestrictToPermittedSnapins -Value 1 }\r\n                \"RegistryEditor\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableRegistryTools -Value 1 }\r\n                \"theRegistryEditor\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableRegistryTools -Value 1 }\r\n                \"Run\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoRun -Value 1 }\r\n                \"TaskMgr\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableTaskMgr -Value 1 }\r\n                \"taskManager\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableTaskMgr -Value 1 }\r\n                \"All\" {\r\n                    Set-HKProperty -Path $keySoftwarePoliciesMicrosoftWindowsSystem -Name DisableCMD -Value 1\r\n                    Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name NoDispCPL -Value 1\r\n                    Set-HKProperty -Path $keySoftwarePoliciesMicrosoftMMC -Name RestrictToPermittedSnapins -Value 1\r\n                    Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableRegistryTools -Value 1\r\n                    Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoRun -Value 1\r\n                    Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableTaskMgr -Value 1\r\n                }\r\n            }\r\n        }\r\n    }\r\n}\r\nprocess {\r\n\r\n    # Get each user profile SID and Path to the profile. If there are any exclusions we'll have to take them into account.\r\n    if ($ExcludedUsers) {\r\n        $ToBeExcluded = New-Object System.Collections.Generic.List[string]\r\n        $ExcludedUsers.split(\",\").trim() | ForEach-Object { if ($_) { $ToBeExcluded.Add($_) } }\r\n        Write-Warning \"The Following Users will not have your selected tools disabled. $ToBeExcluded\"\r\n        $UserProfiles = Get-UserHives -IncludeDefault -ExcludedUsers $ToBeExcluded\r\n    }\r\n    else {\r\n        $UserProfiles = Get-UserHives -IncludeDefault\r\n    }\r\n\r\n    # Loop through each profile on the machine\r\n    Foreach ($UserProfile in $UserProfiles) {\r\n        # Load each user's registry hive if not already loaded. Backticked \"UserProfile.UserHive\" so that it accounts for spaces in the username.\r\n        If (($ProfileWasLoaded = Test-Path Registry::HKEY_USERS$($UserProfile.SID)) -eq $false) {\r\n            Start-Process -FilePath \"cmd.exe\" -ArgumentList \"\/C reg.exe LOAD HKU$($UserProfile.SID) `\"$($UserProfile.UserHive)`\"\" -Wait -WindowStyle Hidden\r\n        }\r\n        # The path is different for each individual user. This is the base path.\r\n        $key = \"Registry::HKEY_USERS$($UserProfile.SID)\"\r\n\r\n        # List of checkbox items\r\n        $CheckboxItems = \"cmd\", \"theControlPanel\", \"mmc\", \"theRegistryEditor\", \"run\", \"taskManager\"\r\n        # Checkboxes come in as environmental variables. This'll grab the ones that were selected (if any)\r\n        $EnvItems = Get-ChildItem env:* | Where-Object { $CheckboxItems -contains $_.Name -and $_.Value -notlike \"false\" }\r\n\r\n        # This will grab the tool selections from the parameter field. Since it comes in as a string we'll have to split it up.\r\n        $Tool = $Tools.split(\",\").trim()\r\n\r\n        # If the checkbox for all was selected I can just run the function once instead of running it repeatedly for the same thing.\r\n        if ($env:allTools -and $env:allTools -notlike \"false\") {\r\n            Set-Tool -Tool \"All\" -Key $key\r\n        }\r\n        elseif ($EnvItems) {\r\n            # If checkboxes were used we should just use those.\r\n            $EnvItems | ForEach-Object { Set-Tool -Tool $_.Name -Key $key }\r\n        }\r\n        else {\r\n            $Tool | ForEach-Object { Set-Tool -Tool $_ -Key $key }\r\n        }\r\n\r\n        # Unload NTuser.dat for user's we loaded previously.\r\n        If ($ProfileWasLoaded -eq $false) {\r\n            [gc]::Collect()\r\n            Start-Sleep -Seconds 1\r\n            Start-Process -FilePath \"cmd.exe\" -ArgumentList \"\/C reg.exe UNLOAD HKU$($UserProfile.SID)\" -Wait -WindowStyle Hidden | Out-Null\r\n        }\r\n    }\r\n    \r\n}\r\nend {\r\n    \r\n    \r\n    \r\n}<\/pre>\n
|<\/p>\n
#Requires -Version 5.1\r\n\r\n<#\r\n.SYNOPSIS\r\n    This will disable the selected administrator tools depending on your selection (Defaults to all). Can be given a comma separated list of users to exclude from this action.\r\n.DESCRIPTION\r\n    This will disable the selected administrator tools. The options are \"All\", the command prompt, the control panel, the microsoft management console,\r\n    the registry editor, the run command window and task manager. You can give it a comma separated list of items if you want to disable some but not all.\r\n    Exit 1 is usually an indicator of bad input but can also mean editing the registry is blocked.\r\n.EXAMPLE\r\n    PS C:> .Disable-LocalAdminTools.ps1 -Tools \"MMC,Cmd,TaskMgr,RegistryEditor\"\r\n    Disabling MMC...\r\n    Set Registry::HKEY_USERSDefaultProfileSoftwarePoliciesMicrosoftMMCRestrictToPermittedSnapins to...\r\n    Disabling Cmd...\r\n    Set Registry::HKEY_USERSDefaultProfileSoftwarePoliciesMicrosoftWindowsDisableCMD to...\r\n    Disabling TaskMgr...\r\n    Set Registry::HKEY_USERSDefaultProfileSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableTaskMgr to...\r\n    Disabling RegistryEditor...\r\n    Set Registry::HKEY_USERSDefaultProfileSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableRegistryTools to...\r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    Minimum Supported OS: Windows 10, Windows Server 2016+\r\n    Release Notes: Renamed script and added Script Variable support\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    [Parameter()]\r\n    [String]$Tools = \"All\",\r\n    [Parameter()]\r\n    [String]$ExcludedUsers\r\n)\r\n\r\nbegin {\r\n    \r\n    if ($env:excludeUsers -and $env:excludeUsers -notlike \"null\") { $ExcludedUsers = $env:excludeUsers }\r\n    \r\n    # Lets double check that this script is being run appropriately\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n    }\r\n\r\n    function Test-IsSystem {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        return $id.Name -like \"NT AUTHORITY*\" -or $id.IsSystem\r\n    }\r\n\r\n    if (!(Test-IsElevated) -and !(Test-IsSystem)) {\r\n        Write-Error -Message \"[Error] Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n\r\n    # Setting up some functions to be used later.\r\n    function Set-HKProperty {\r\n        param (\r\n            $Path,\r\n            $Name,\r\n            $Value,\r\n            [ValidateSet('DWord', 'QWord', 'String', 'ExpandedString', 'Binary', 'MultiString', 'Unknown')]\r\n            $PropertyType = 'DWord'\r\n        )\r\n        if (-not $(Test-Path -Path $Path)) {\r\n            # Check if path does not exist and create the path\r\n            New-Item -Path $Path -Force | Out-Null\r\n        }\r\n        if ((Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)) {\r\n            # Update property and print out what it was changed from and changed to\r\n            $CurrentValue = Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore\r\n            try {\r\n                Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force -Confirm:$false -ErrorAction Stop | Out-Null\r\n            }\r\n            catch {\r\n                Write-Error \"[Error] Unable to Set registry key for $Name please see below error!\"\r\n                Write-Error $_\r\n                exit 1\r\n            }\r\n            Write-Host \"$Path$Name changed from $CurrentValue to $(Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)\"\r\n        }\r\n        else {\r\n            # Create property with value\r\n            try {\r\n                New-ItemProperty -Path $Path -Name $Name -Value $Value -PropertyType $PropertyType -Force -Confirm:$false -ErrorAction Stop | Out-Null\r\n            }\r\n            catch {\r\n                Write-Error \"[Error] Unable to Set registry key for $Name please see below error!\"\r\n                Write-Error $_\r\n                exit 1\r\n            }\r\n            Write-Host \"Set $Path$Name to $(Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)\"\r\n        }\r\n    }\r\n\r\n    # This will get all the registry path's for all actual users (not system or network service account but actual users.)\r\n    function Get-UserHives {\r\n        param (\r\n            [Parameter()]\r\n            [ValidateSet('AzureAD', 'DomainAndLocal', 'All')]\r\n            [String]$Type = \"All\",\r\n            [Parameter()]\r\n            [String[]]$ExcludedUsers,\r\n            [Parameter()]\r\n            [switch]$IncludeDefault\r\n        )\r\n\r\n        # User account SID's follow a particular patter depending on if they're azure AD or a Domain account or a local \"workgroup\" account.\r\n        $Patterns = switch ($Type) {\r\n            \"AzureAD\" { \"S-1-12-1-(d+-?){4}$\" }\r\n            \"DomainAndLocal\" { \"S-1-5-21-(d+-?){4}$\" }\r\n            \"All\" { \"S-1-12-1-(d+-?){4}$\" ; \"S-1-5-21-(d+-?){4}$\" } \r\n        }\r\n\r\n        # We'll need the NTuser.dat file to load each users registry hive. So we grab it if their account sid matches the above pattern. \r\n        $UserProfiles = Foreach ($Pattern in $Patterns) { \r\n            Get-ItemProperty \"HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionProfileList*\" |\r\n                Where-Object { $_.PSChildName -match $Pattern } | \r\n                Select-Object @{Name = \"SID\"; Expression = { $_.PSChildName } }, \r\n                @{Name = \"UserHive\"; Expression = { \"$($_.ProfileImagePath)NTuser.dat\" } }, \r\n                @{Name = \"UserName\"; Expression = { \"$($_.ProfileImagePath | Split-Path -Leaf)\" } }\r\n        }\r\n\r\n        # There are some situations where grabbing the .Default user's info is needed.\r\n        switch ($IncludeDefault) {\r\n            $True {\r\n                $DefaultProfile = \"\" | Select-Object UserName, SID, UserHive\r\n                $DefaultProfile.UserName = \"Default\"\r\n                $DefaultProfile.SID = \"DefaultProfile\"\r\n                $DefaultProfile.Userhive = \"$env:SystemDriveUsersDefaultNTUSER.DAT\"\r\n\r\n                # It was easier to write-output twice than combine the two objects.\r\n                $DefaultProfile | Where-Object { $ExcludedUsers -notcontains $_.UserName } | Write-Output\r\n            }\r\n        }\r\n\r\n        $UserProfiles | Where-Object { $ExcludedUsers -notcontains $_.UserName } | Write-Output\r\n    }\r\n\r\n    function Set-Tool {\r\n        [CmdletBinding()]\r\n        param(\r\n            [Parameter()]\r\n            [ValidateSet(\"All\", \"Cmd\", \"ControlPanel\", \"theControlPanel\", \"MMC\", \"RegistryEditor\", \"theRegistryEditor\", \"Run\", \"TaskMgr\", \"taskManager\")]\r\n            [string]$Tool,\r\n            [string]$key\r\n        )\r\n        process {\r\n            # Each option has a different registry key to change. Since this function only supports 1 item at a time I can check which option and set the regkey individually.\r\n            Write-Host \"Disabling $Tool...\"\r\n            switch ($Tool) {\r\n                \"Cmd\" { Set-HKProperty -Path $keySoftwarePoliciesMicrosoftWindowsSystem -Name DisableCMD -Value 1 }\r\n                \"ControlPanel\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoControlPanel -Value 1 }\r\n                \"theControlPanel\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoControlPanel -Value 1 }\r\n                \"MMC\" { Set-HKProperty -Path $keySoftwarePoliciesMicrosoftMMC -Name RestrictToPermittedSnapins -Value 1 }\r\n                \"RegistryEditor\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableRegistryTools -Value 1 }\r\n                \"theRegistryEditor\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableRegistryTools -Value 1 }\r\n                \"Run\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoRun -Value 1 }\r\n                \"TaskMgr\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableTaskMgr -Value 1 }\r\n                \"taskManager\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableTaskMgr -Value 1 }\r\n                \"All\" {\r\n                    Set-HKProperty -Path $keySoftwarePoliciesMicrosoftWindowsSystem -Name DisableCMD -Value 1\r\n                    Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name NoDispCPL -Value 1\r\n                    Set-HKProperty -Path $keySoftwarePoliciesMicrosoftMMC -Name RestrictToPermittedSnapins -Value 1\r\n                    Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableRegistryTools -Value 1\r\n                    Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoRun -Value 1\r\n                    Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableTaskMgr -Value 1\r\n                }\r\n            }\r\n        }\r\n    }\r\n}\r\nprocess {\r\n\r\n    # Get each user profile SID and Path to the profile. If there are any exclusions we'll have to take them into account.\r\n    if ($ExcludedUsers) {\r\n        $ToBeExcluded = New-Object System.Collections.Generic.List[string]\r\n        $ExcludedUsers.split(\",\").trim() | ForEach-Object { if ($_) { $ToBeExcluded.Add($_) } }\r\n        Write-Warning \"The Following Users will not have your selected tools disabled. $ToBeExcluded\"\r\n        $UserProfiles = Get-UserHives -IncludeDefault -ExcludedUsers $ToBeExcluded\r\n    }\r\n    else {\r\n        $UserProfiles = Get-UserHives -IncludeDefault\r\n    }\r\n\r\n    # Loop through each profile on the machine\r\n    Foreach ($UserProfile in $UserProfiles) {\r\n        # Load each user's registry hive if not already loaded. Backticked \"UserProfile.UserHive\" so that it accounts for spaces in the username.\r\n        If (($ProfileWasLoaded = Test-Path Registry::HKEY_USERS$($UserProfile.SID)) -eq $false) {\r\n            Start-Process -FilePath \"cmd.exe\" -ArgumentList \"\/C reg.exe LOAD HKU$($UserProfile.SID) `\"$($UserProfile.UserHive)`\"\" -Wait -WindowStyle Hidden\r\n        }\r\n        # The path is different for each individual user. This is the base path.\r\n        $key = \"Registry::HKEY_USERS$($UserProfile.SID)\"\r\n\r\n        # List of checkbox items\r\n        $CheckboxItems = \"cmd\", \"theControlPanel\", \"mmc\", \"theRegistryEditor\", \"run\", \"taskManager\"\r\n        # Checkboxes come in as environmental variables. This'll grab the ones that were selected (if any)\r\n        $EnvItems = Get-ChildItem env:* | Where-Object { $CheckboxItems -contains $_.Name -and $_.Value -notlike \"false\" }\r\n\r\n        # This will grab the tool selections from the parameter field. Since it comes in as a string we'll have to split it up.\r\n        $Tool = $Tools.split(\",\").trim()\r\n\r\n        # If the checkbox for all was selected I can just run the function once instead of running it repeatedly for the same thing.\r\n        if ($env:allTools -and $env:allTools -notlike \"false\") {\r\n            Set-Tool -Tool \"All\" -Key $key\r\n        }\r\n        elseif ($EnvItems) {\r\n            # If checkboxes were used we should just use those.\r\n            $EnvItems | ForEach-Object { Set-Tool -Tool $_.Name -Key $key }\r\n        }\r\n        else {\r\n            $Tool | ForEach-Object { Set-Tool -Tool $_ -Key $key }\r\n        }\r\n\r\n        # Unload NTuser.dat for user's we loaded previously.\r\n        If ($ProfileWasLoaded -eq $false) {\r\n            [gc]::Collect()\r\n            Start-Sleep -Seconds 1\r\n            Start-Process -FilePath \"cmd.exe\" -ArgumentList \"\/C reg.exe UNLOAD HKU$($UserProfile.SID)\" -Wait -WindowStyle Hidden | Out-Null\r\n        }\r\n    }\r\n    \r\n}\r\nend {\r\n    \r\n    \r\n    \r\n}<\/pre>\n
 <\/p>\n\n
Zugriff auf \u00fcber 300 Skripte im NinjaOne Dojo<\/p>\n
Zugang erhalten<\/a><\/p>\n<\/div>\n
Wie das Skript funktioniert<\/h2>\n
Das Skript, das wir hier besprechen, ist in PowerShell geschrieben und dient dazu, bestimmte Verwaltungstools auf lokalen Computern zu deaktivieren. Es wurde f\u00fcr die Arbeit mit PowerShell 5.1 optimiert und bietet verschiedene ausw\u00e4hlbare Optionen wie Eingabeaufforderung, Systemsteuerung, Microsoft Management Console (MMC), Registrierungseditor, Befehlsfenster und Task-Manager. Sie k\u00f6nnen entweder alle diese Tools deaktivieren oder aus einer durch Kommata getrennten Liste ausw\u00e4hlen, um nur bestimmte Tools zu deaktivieren.<\/p>\n
Au\u00dferdem bietet das Skript die M\u00f6glichkeit, bestimmte Benutzerprofile von dieser Aktion auszuschlie\u00dfen. Wenn Sie sicherstellen m\u00fcssen, dass einige Benutzer:innen ihre Verwaltungsfunktionen beibehalten, k\u00f6nnen Sie dies problemlos tun.<\/p>\n
Dieses PowerShell-Skript f\u00fchrt drei wichtige \u00dcberpr\u00fcfungen durch:<\/p>\n
    \n
  1. \u00dcberpr\u00fcft, ob das Skript mit administrativen Rechten ausgef\u00fchrt wird.<\/li>\n
  2. L\u00e4dt die Registrierungsschl\u00fcssel f\u00fcr jedes Benutzerprofil, mit Ausnahme derjenigen, die ausdr\u00fccklich ausgeschlossen sind.<\/li>\n
  3. \u00c4ndert oder setzt Registrierungsschl\u00fcssel, um die ausgew\u00e4hlten Verwaltungstools zu deaktivieren.<\/li>\n<\/ol>\n
    Es geht nicht nur um die Deaktivierung, sondern auch um Kontrolle und Spezifit\u00e4t, was dieses Skript f\u00fcr IT-Administratoren und MSPs sehr vielseitig macht.<\/p>\n
    Warum IT-Fachleute und MSPs sich darum k\u00fcmmern sollten<\/h2>\n
    Zentralisierte Kontrolle<\/h3>\n
    Mithilfe dieses PowerShell-Skripts k\u00f6nnen IT-Experten lokale Verwaltungstools zentral deaktivieren, was den Zeitaufwand f\u00fcr die manuelle Deaktivierung f\u00fcr jeden einzelnen Benutzer erheblich verringert.<\/p>\n
    Sicherheit<\/h3>\n
    Die Deaktivierung dieser Tools erh\u00f6ht die Sicherheit, da sie die M\u00f6glichkeiten der Benutzer:innen, \u00c4nderungen auf Systemebene vorzunehmen, einschr\u00e4nkt. Dies ist besonders in Umgebungen n\u00fctzlich, in denen Sie potenzielle Sicherheitsrisiken von innen heraus minimieren m\u00f6chten.<\/p>\n
    Vielseitigkeit<\/h3>\n
    Die F\u00e4higkeit des Skripts, Tools selektiv zu deaktivieren und bestimmte Benutzer:innen auszuschlie\u00dfen, verleiht ihm eine Flexibilit\u00e4t, die f\u00fcr unterschiedliche IT-Umgebungen ma\u00dfgeschneidert ist. Es ist keine Einheitsgr\u00f6\u00dfe, sondern eine Einheitsgr\u00f6\u00dfe, die passt, wie Sie es wollen.<\/p>\n
    Automatisierung und Skalierbarkeit<\/h3>\n
    F\u00fcr MSPs kann das Skript in automatisierte Bereitstellungsprozesse integriert werden, wodurch es f\u00fcr gro\u00dfe Netzwerke skalierbar ist. Stellen Sie sich vor, Sie k\u00f6nnten dies mit wenigen Klicks auf Tausende von Rechnern ausweiten.<\/p>\n
    Wie wird es eingesetzt?<\/h2>\n
    Laden Sie einfach das Skript Disable-LocalAdminTools.ps1 herunter und f\u00fchren Sie es \u00fcber PowerShell auf den Zielcomputern aus. Das Skript unterst\u00fctzt verschiedene Befehlszeilenoptionen zur Feinabstimmung dessen, was Sie deaktivieren m\u00f6chten.<\/p>\n
    PS C:>.Disable-LocalAdminTools.ps1 -Tools „MMC,Cmd,TaskMgr,RegistryEditor“<\/em><\/p>\n
    Abschlie\u00dfende \u00dcberlegungen<\/h2>\n
    Ganz gleich, ob Sie als IT-Experte nach einer L\u00f6sung zum Deaktivieren lokaler Administratortools oder als MSP nach einem einfach zu implementierenden Skript zum Deaktivieren von Administratortools suchen, dieses PowerShell-Skript bietet eine robuste, flexible und effiziente L\u00f6sung. Es macht aus der Komplexit\u00e4t eine Einfachheit und gibt Ihnen mehr Kontrolle \u00fcber die Sicherheitseinstellungen Ihres Netzwerks.<\/p>\n
    Mit diesem effizienten, zielgerichteten Ansatz f\u00fcr den administrativen Zugriff sind Sie dem Wettbewerb immer einen Schritt voraus. Viel Spa\u00df beim Schreiben!<\/p>\n","protected":false},"author":35,"featured_media":206851,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"","_relevanssi_noindex_reason":"","_lmt_disableupdate":"no","_lmt_disable":""},"operating_system":[4212],"use_cases":[],"class_list":["post-208563","script_hub","type-script_hub","status-publish","has-post-thumbnail","hentry","script_hub_category-windows"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.ninjaone.com\/de\/wp-json\/wp\/v2\/script_hub\/208563","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ninjaone.com\/de\/wp-json\/wp\/v2\/script_hub"}],"about":[{"href":"https:\/\/www.ninjaone.com\/de\/wp-json\/wp\/v2\/types\/script_hub"}],"author":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/de\/wp-json\/wp\/v2\/users\/35"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/de\/wp-json\/wp\/v2\/comments?post=208563"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/de\/wp-json\/wp\/v2\/media\/206851"}],"wp:attachment":[{"href":"https:\/\/www.ninjaone.com\/de\/wp-json\/wp\/v2\/media?parent=208563"}],"wp:term":[{"taxonomy":"script_hub_category","embeddable":true,"href":"https:\/\/www.ninjaone.com\/de\/wp-json\/wp\/v2\/operating_system?post=208563"},{"taxonomy":"use_cases","embeddable":true,"href":"https:\/\/www.ninjaone.com\/de\/wp-json\/wp\/v2\/use_cases?post=208563"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}