{"id":208604,"date":"2023-09-26T09:24:57","date_gmt":"2023-09-26T09:24:57","guid":{"rendered":"https:\/\/www.ninjaone.com\/script-hub\/herramientas-de-administracion\/"},"modified":"2024-03-04T17:06:55","modified_gmt":"2024-03-04T17:06:55","slug":"herramientas-de-administracion","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/es\/script-hub\/herramientas-de-administracion\/","title":{"rendered":"C\u00f3mo desactivar las herramientas de administraci\u00f3n local en Windows [PowerShell Script]"},"content":{"rendered":"

Atenci\u00f3n, profesional de TI y proveedor de servicios gestionados (MSP): si te han encargado mantener la seguridad de la red y el acceso administrativo, debes saber que a menudo es m\u00e1s f\u00e1cil decirlo que hacerlo. Un aspecto clave es la gesti\u00f3n de las herramientas de administraci\u00f3n local a las que los usuarios no deber\u00edan tener libre acceso. Esto nos lleva a una pregunta frecuente: \u00bfc\u00f3mo desactivo las herramientas de administraci\u00f3n local<\/strong> a gran escala?<\/span>\u00a0<\/span><\/p>\n

Tenemos un script PowerShell completo que te permitir\u00e1 desactivar las herramientas de administraci\u00f3n de forma selectiva en un entorno Windows.\u00a0<\/span><\/p>\n

El script PowerShell para desactivar las herramientas de administraci\u00f3n local<\/h2>\n
#Requires -Version 5.1\r\n\r\n<#\r\n.SYNOPSIS\r\n    This will disable the selected administrator tools depending on your selection (Defaults to all). Can be given a comma separated list of users to exclude from this action.\r\n.DESCRIPTION\r\n    This will disable the selected administrator tools. The options are \"All\", the command prompt, the control panel, the microsoft management console,\r\n    the registry editor, the run command window and task manager. You can give it a comma separated list of items if you want to disable some but not all.\r\n    Exit 1 is usually an indicator of bad input but can also mean editing the registry is blocked.\r\n.EXAMPLE\r\n    PS C:> .Disable-LocalAdminTools.ps1 -Tools \"MMC,Cmd,TaskMgr,RegistryEditor\"\r\n    Disabling MMC...\r\n    Set Registry::HKEY_USERSDefaultProfileSoftwarePoliciesMicrosoftMMCRestrictToPermittedSnapins to...\r\n    Disabling Cmd...\r\n    Set Registry::HKEY_USERSDefaultProfileSoftwarePoliciesMicrosoftWindowsDisableCMD to...\r\n    Disabling TaskMgr...\r\n    Set Registry::HKEY_USERSDefaultProfileSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableTaskMgr to...\r\n    Disabling RegistryEditor...\r\n    Set Registry::HKEY_USERSDefaultProfileSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableRegistryTools to...\r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    Minimum Supported OS: Windows 10, Windows Server 2016+\r\n    Release Notes: Renamed script and added Script Variable support\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    [Parameter()]\r\n    [String]$Tools = \"All\",\r\n    [Parameter()]\r\n    [String]$ExcludedUsers\r\n)\r\n\r\nbegin {\r\n    \r\n    if ($env:excludeUsers -and $env:excludeUsers -notlike \"null\") { $ExcludedUsers = $env:excludeUsers }\r\n    \r\n    # Lets double check that this script is being run appropriately\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n    }\r\n\r\n    function Test-IsSystem {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        return $id.Name -like \"NT AUTHORITY*\" -or $id.IsSystem\r\n    }\r\n\r\n    if (!(Test-IsElevated) -and !(Test-IsSystem)) {\r\n        Write-Error -Message \"[Error] Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n\r\n    # Setting up some functions to be used later.\r\n    function Set-HKProperty {\r\n        param (\r\n            $Path,\r\n            $Name,\r\n            $Value,\r\n            [ValidateSet('DWord', 'QWord', 'String', 'ExpandedString', 'Binary', 'MultiString', 'Unknown')]\r\n            $PropertyType = 'DWord'\r\n        )\r\n        if (-not $(Test-Path -Path $Path)) {\r\n            # Check if path does not exist and create the path\r\n            New-Item -Path $Path -Force | Out-Null\r\n        }\r\n        if ((Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)) {\r\n            # Update property and print out what it was changed from and changed to\r\n            $CurrentValue = Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore\r\n            try {\r\n                Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force -Confirm:$false -ErrorAction Stop | Out-Null\r\n            }\r\n            catch {\r\n                Write-Error \"[Error] Unable to Set registry key for $Name please see below error!\"\r\n                Write-Error $_\r\n                exit 1\r\n            }\r\n            Write-Host \"$Path$Name changed from $CurrentValue to $(Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)\"\r\n        }\r\n        else {\r\n            # Create property with value\r\n            try {\r\n                New-ItemProperty -Path $Path -Name $Name -Value $Value -PropertyType $PropertyType -Force -Confirm:$false -ErrorAction Stop | Out-Null\r\n            }\r\n            catch {\r\n                Write-Error \"[Error] Unable to Set registry key for $Name please see below error!\"\r\n                Write-Error $_\r\n                exit 1\r\n            }\r\n            Write-Host \"Set $Path$Name to $(Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)\"\r\n        }\r\n    }\r\n\r\n    # This will get all the registry path's for all actual users (not system or network service account but actual users.)\r\n    function Get-UserHives {\r\n        param (\r\n            [Parameter()]\r\n            [ValidateSet('AzureAD', 'DomainAndLocal', 'All')]\r\n            [String]$Type = \"All\",\r\n            [Parameter()]\r\n            [String[]]$ExcludedUsers,\r\n            [Parameter()]\r\n            [switch]$IncludeDefault\r\n        )\r\n\r\n        # User account SID's follow a particular patter depending on if they're azure AD or a Domain account or a local \"workgroup\" account.\r\n        $Patterns = switch ($Type) {\r\n            \"AzureAD\" { \"S-1-12-1-(d+-?){4}$\" }\r\n            \"DomainAndLocal\" { \"S-1-5-21-(d+-?){4}$\" }\r\n            \"All\" { \"S-1-12-1-(d+-?){4}$\" ; \"S-1-5-21-(d+-?){4}$\" } \r\n        }\r\n\r\n        # We'll need the NTuser.dat file to load each users registry hive. So we grab it if their account sid matches the above pattern. \r\n        $UserProfiles = Foreach ($Pattern in $Patterns) { \r\n            Get-ItemProperty \"HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionProfileList*\" |\r\n                Where-Object { $_.PSChildName -match $Pattern } | \r\n                Select-Object @{Name = \"SID\"; Expression = { $_.PSChildName } }, \r\n                @{Name = \"UserHive\"; Expression = { \"$($_.ProfileImagePath)NTuser.dat\" } }, \r\n                @{Name = \"UserName\"; Expression = { \"$($_.ProfileImagePath | Split-Path -Leaf)\" } }\r\n        }\r\n\r\n        # There are some situations where grabbing the .Default user's info is needed.\r\n        switch ($IncludeDefault) {\r\n            $True {\r\n                $DefaultProfile = \"\" | Select-Object UserName, SID, UserHive\r\n                $DefaultProfile.UserName = \"Default\"\r\n                $DefaultProfile.SID = \"DefaultProfile\"\r\n                $DefaultProfile.Userhive = \"$env:SystemDriveUsersDefaultNTUSER.DAT\"\r\n\r\n                # It was easier to write-output twice than combine the two objects.\r\n                $DefaultProfile | Where-Object { $ExcludedUsers -notcontains $_.UserName } | Write-Output\r\n            }\r\n        }\r\n\r\n        $UserProfiles | Where-Object { $ExcludedUsers -notcontains $_.UserName } | Write-Output\r\n    }\r\n\r\n    function Set-Tool {\r\n        [CmdletBinding()]\r\n        param(\r\n            [Parameter()]\r\n            [ValidateSet(\"All\", \"Cmd\", \"ControlPanel\", \"theControlPanel\", \"MMC\", \"RegistryEditor\", \"theRegistryEditor\", \"Run\", \"TaskMgr\", \"taskManager\")]\r\n            [string]$Tool,\r\n            [string]$key\r\n        )\r\n        process {\r\n            # Each option has a different registry key to change. Since this function only supports 1 item at a time I can check which option and set the regkey individually.\r\n            Write-Host \"Disabling $Tool...\"\r\n            switch ($Tool) {\r\n                \"Cmd\" { Set-HKProperty -Path $keySoftwarePoliciesMicrosoftWindowsSystem -Name DisableCMD -Value 1 }\r\n                \"ControlPanel\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoControlPanel -Value 1 }\r\n                \"theControlPanel\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoControlPanel -Value 1 }\r\n                \"MMC\" { Set-HKProperty -Path $keySoftwarePoliciesMicrosoftMMC -Name RestrictToPermittedSnapins -Value 1 }\r\n                \"RegistryEditor\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableRegistryTools -Value 1 }\r\n                \"theRegistryEditor\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableRegistryTools -Value 1 }\r\n                \"Run\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoRun -Value 1 }\r\n                \"TaskMgr\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableTaskMgr -Value 1 }\r\n                \"taskManager\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableTaskMgr -Value 1 }\r\n                \"All\" {\r\n                    Set-HKProperty -Path $keySoftwarePoliciesMicrosoftWindowsSystem -Name DisableCMD -Value 1\r\n                    Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name NoDispCPL -Value 1\r\n                    Set-HKProperty -Path $keySoftwarePoliciesMicrosoftMMC -Name RestrictToPermittedSnapins -Value 1\r\n                    Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableRegistryTools -Value 1\r\n                    Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoRun -Value 1\r\n                    Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableTaskMgr -Value 1\r\n                }\r\n            }\r\n        }\r\n    }\r\n}\r\nprocess {\r\n\r\n    # Get each user profile SID and Path to the profile. If there are any exclusions we'll have to take them into account.\r\n    if ($ExcludedUsers) {\r\n        $ToBeExcluded = New-Object System.Collections.Generic.List[string]\r\n        $ExcludedUsers.split(\",\").trim() | ForEach-Object { if ($_) { $ToBeExcluded.Add($_) } }\r\n        Write-Warning \"The Following Users will not have your selected tools disabled. $ToBeExcluded\"\r\n        $UserProfiles = Get-UserHives -IncludeDefault -ExcludedUsers $ToBeExcluded\r\n    }\r\n    else {\r\n        $UserProfiles = Get-UserHives -IncludeDefault\r\n    }\r\n\r\n    # Loop through each profile on the machine\r\n    Foreach ($UserProfile in $UserProfiles) {\r\n        # Load each user's registry hive if not already loaded. Backticked \"UserProfile.UserHive\" so that it accounts for spaces in the username.\r\n        If (($ProfileWasLoaded = Test-Path Registry::HKEY_USERS$($UserProfile.SID)) -eq $false) {\r\n            Start-Process -FilePath \"cmd.exe\" -ArgumentList \"\/C reg.exe LOAD HKU$($UserProfile.SID) `\"$($UserProfile.UserHive)`\"\" -Wait -WindowStyle Hidden\r\n        }\r\n        # The path is different for each individual user. This is the base path.\r\n        $key = \"Registry::HKEY_USERS$($UserProfile.SID)\"\r\n\r\n        # List of checkbox items\r\n        $CheckboxItems = \"cmd\", \"theControlPanel\", \"mmc\", \"theRegistryEditor\", \"run\", \"taskManager\"\r\n        # Checkboxes come in as environmental variables. This'll grab the ones that were selected (if any)\r\n        $EnvItems = Get-ChildItem env:* | Where-Object { $CheckboxItems -contains $_.Name -and $_.Value -notlike \"false\" }\r\n\r\n        # This will grab the tool selections from the parameter field. Since it comes in as a string we'll have to split it up.\r\n        $Tool = $Tools.split(\",\").trim()\r\n\r\n        # If the checkbox for all was selected I can just run the function once instead of running it repeatedly for the same thing.\r\n        if ($env:allTools -and $env:allTools -notlike \"false\") {\r\n            Set-Tool -Tool \"All\" -Key $key\r\n        }\r\n        elseif ($EnvItems) {\r\n            # If checkboxes were used we should just use those.\r\n            $EnvItems | ForEach-Object { Set-Tool -Tool $_.Name -Key $key }\r\n        }\r\n        else {\r\n            $Tool | ForEach-Object { Set-Tool -Tool $_ -Key $key }\r\n        }\r\n\r\n        # Unload NTuser.dat for user's we loaded previously.\r\n        If ($ProfileWasLoaded -eq $false) {\r\n            [gc]::Collect()\r\n            Start-Sleep -Seconds 1\r\n            Start-Process -FilePath \"cmd.exe\" -ArgumentList \"\/C reg.exe UNLOAD HKU$($UserProfile.SID)\" -Wait -WindowStyle Hidden | Out-Null\r\n        }\r\n    }\r\n    \r\n}\r\nend {\r\n    \r\n    \r\n    \r\n}<\/pre>\n
 <\/p>\n\n
Accede a m\u00e1s de 700 scripts en el Dojo de NinjaOne<\/p>\n
Accede<\/a><\/p>\n<\/div>\n
C\u00f3mo funciona el script<\/h2>\n
El script en cuesti\u00f3n est\u00e1 escrito en PowerShell y est\u00e1 dise\u00f1ado para desactivar herramientas administrativas espec\u00edficas en m\u00e1quinas locales. Se ha optimizado para funcionar con PowerShell 5.1 y cuenta con varias opciones seleccionables como S\u00edmbolo del sistema, Panel de control, Consola de administraci\u00f3n de Microsoft (MMC), Editor del registro, Ventana de ejecuci\u00f3n de comandos y Administrador de tareas. Puedes desactivar todas estas herramientas o elegir de una lista separada por comas para desactivar s\u00f3lo algunas.<\/span>\u00a0<\/span><\/p>\n
Adem\u00e1s, el script ofrece la posibilidad de excluir de esta acci\u00f3n a determinados perfiles de usuario. Si necesitas asegurarte de que algunos usuarios conservan sus capacidades de administrador, puedes hacerlo f\u00e1cilmente.<\/span>\u00a0<\/span><\/p>\n
Este script PowerShell realiza tres comprobaciones importantes:<\/span>\u00a0<\/span><\/p>\n
    \n
  1. Comprueba si el script se est\u00e1 ejecutando con privilegios administrativos.<\/span>\u00a0<\/span><\/li>\n
  2. Carga las claves de registro de cada perfil de usuario, excepto las excluidas expl\u00edcitamente.<\/span>\u00a0<\/span><\/li>\n
  3. Modifica o establece claves de registro para desactivar las herramientas administrativas seleccionadas.<\/span>\u00a0<\/span><\/li>\n<\/ol>\n
    No se trata s\u00f3lo de desactivar; se trata de control y especificidad, lo que hace que este script sea muy vers\u00e1til para los administradores de TI y MSP.<\/span>\u00a0<\/span><\/p>\n
    Por qu\u00e9 los profesionales de TI y los MSP deber\u00edan interesarse<\/span><\/span><\/h2>\n
    Control centralizado<\/span>\u00a0<\/span><\/h3>\n
    Mediante este script de PowerShell, los profesionales de TI pueden desactivar las herramientas de administraci\u00f3n local de forma centralizada, lo que reduce significativamente el tiempo que se tardar\u00eda en hacerlo manualmente para cada usuario.<\/span>\u00a0<\/span><\/p>\n
    Seguridad<\/span>\u00a0<\/span><\/h3>\n
    Desactivar estas herramientas mejora la seguridad al limitar la capacidad de los usuarios para realizar cambios a nivel de sistema. Esto resulta especialmente \u00fatil en entornos en los que se desea minimizar los posibles riesgos de seguridad desde dentro.<\/span>\u00a0<\/span><\/p>\n
    Versatilidad<\/span>\u00a0<\/span><\/h3>\n
    La capacidad del script para desactivar herramientas de forma selectiva y excluir a usuarios concretos le confiere una flexibilidad perfecta para diversos entornos inform\u00e1ticos. No va a ser una soluci\u00f3n que le valga a todo el mundo, pero s\u00ed que puede ser adaptada seg\u00fan las necesidades.<\/span>\u00a0<\/span><\/p>\n
    Automatizaci\u00f3n y escalabilidad<\/span>\u00a0<\/span><\/h3>\n
    Para los MSP, el script puede integrarse en procesos de despliegue automatizados, lo que lo hace escalable para grandes redes. Imag\u00ednate la comodidad de poder desplegarlo en miles de m\u00e1quinas con unos pocos clics.<\/span>\u00a0<\/span><\/p>\n
    C\u00f3mo desplegarlo<\/h2>\n
    Es suficiente con descargar el script Disable-LocalAdminTools.ps1 y ejecutarlo a trav\u00e9s de PowerShell en los equipos de destino. El script admite varias opciones de l\u00ednea de comandos para ajustar lo que deseas desactivar.<\/span>\u00a0<\/span><\/p>\n
    PS C:>.Disable-LocalAdminTools.ps1 -Tools \u00abMMC,Cmd,TaskMgr,RegistryEditor\u00bb<\/span><\/i><\/p>\n
    Reflexiones finales<\/h2>\n
    Tanto si eres un profesional de TI que busca una soluci\u00f3n para deshabilitar las herramientas de administraci\u00f3n local como si eres un MSP que busca un script de deshabilitaci\u00f3n de herramientas de administraci\u00f3n f\u00e1cil de implementar, este script de PowerShell proporciona una soluci\u00f3n s\u00f3lida, flexible y eficaz. Un script que transforma lo complejo en simple, d\u00e1ndote m\u00e1s control sobre la configuraci\u00f3n de seguridad de tu red.<\/span>\u00a0<\/span><\/p>\n
    Mantente a la vanguardia utilizando este enfoque eficaz y espec\u00edfico al acceso administrativo. \u00a1Feliz scripting!<\/span>\u00a0<\/span><\/p>\n","protected":false},"author":35,"featured_media":206857,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"","_relevanssi_noindex_reason":"","_lmt_disableupdate":"no","_lmt_disable":""},"operating_system":[4212],"use_cases":[4267],"class_list":["post-208604","script_hub","type-script_hub","status-publish","has-post-thumbnail","hentry","script_hub_category-windows"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.ninjaone.com\/es\/wp-json\/wp\/v2\/script_hub\/208604","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ninjaone.com\/es\/wp-json\/wp\/v2\/script_hub"}],"about":[{"href":"https:\/\/www.ninjaone.com\/es\/wp-json\/wp\/v2\/types\/script_hub"}],"author":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/es\/wp-json\/wp\/v2\/users\/35"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/es\/wp-json\/wp\/v2\/comments?post=208604"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/es\/wp-json\/wp\/v2\/media\/206857"}],"wp:attachment":[{"href":"https:\/\/www.ninjaone.com\/es\/wp-json\/wp\/v2\/media?parent=208604"}],"wp:term":[{"taxonomy":"script_hub_category","embeddable":true,"href":"https:\/\/www.ninjaone.com\/es\/wp-json\/wp\/v2\/operating_system?post=208604"},{"taxonomy":"use_cases","embeddable":true,"href":"https:\/\/www.ninjaone.com\/es\/wp-json\/wp\/v2\/use_cases?post=208604"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}