{"id":208377,"date":"2024-01-03T11:25:03","date_gmt":"2024-01-03T11:25:03","guid":{"rendered":"https:\/\/www.ninjaone.com\/script-hub\/comment-desactiver-les-outils-d-administration-locale-dans-windows-powershell\/"},"modified":"2024-03-04T17:05:11","modified_gmt":"2024-03-04T17:05:11","slug":"comment-desactiver-les-outils-d-administration-locale-dans-windows-powershell","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/fr\/script-hub\/comment-desactiver-les-outils-d-administration-locale-dans-windows-powershell\/","title":{"rendered":"Comment d\u00e9sactiver les outils d’administration dans Windows [PowerShell Script]"},"content":{"rendered":"

Attention aux professionnels de l’informatique et aux fournisseurs de services g\u00e9r\u00e9s (MSP) : si vous avez \u00e9t\u00e9 charg\u00e9 de maintenir la s\u00e9curit\u00e9 du r\u00e9seau et l’acc\u00e8s administratif, vous savez que c’est souvent plus facile \u00e0 dire qu’\u00e0 faire. Un aspect essentiel est la gestion des outils d’administrateur local que les utilisateurs ne devraient pas pouvoir utiliser librement. Cela nous am\u00e8ne \u00e0 une question souvent pos\u00e9e : Comment d\u00e9sactiver les outils d’administration locale<\/strong> \u00e0 grande \u00e9chelle ?<\/p>\n

Nous avons un script PowerShell complet qui vous permet de d\u00e9sactiver les outils d’administration de votre choix dans un environnement Windows.<\/p>\n

Le script PowerShell de d\u00e9sactivation des outils d’administration locale<\/h2>\n
#Requires -Version 5.1\r\n\r\n<#\r\n.SYNOPSIS\r\n    This will disable the selected administrator tools depending on your selection (Defaults to all). Can be given a comma separated list of users to exclude from this action.\r\n.DESCRIPTION\r\n    This will disable the selected administrator tools. The options are \"All\", the command prompt, the control panel, the microsoft management console,\r\n    the registry editor, the run command window and task manager. You can give it a comma separated list of items if you want to disable some but not all.\r\n    Exit 1 is usually an indicator of bad input but can also mean editing the registry is blocked.\r\n.EXAMPLE\r\n    PS C:> .Disable-LocalAdminTools.ps1 -Tools \"MMC,Cmd,TaskMgr,RegistryEditor\"\r\n    Disabling MMC...\r\n    Set Registry::HKEY_USERSDefaultProfileSoftwarePoliciesMicrosoftMMCRestrictToPermittedSnapins to...\r\n    Disabling Cmd...\r\n    Set Registry::HKEY_USERSDefaultProfileSoftwarePoliciesMicrosoftWindowsDisableCMD to...\r\n    Disabling TaskMgr...\r\n    Set Registry::HKEY_USERSDefaultProfileSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableTaskMgr to...\r\n    Disabling RegistryEditor...\r\n    Set Registry::HKEY_USERSDefaultProfileSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableRegistryTools to...\r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    Minimum Supported OS: Windows 10, Windows Server 2016+\r\n    Release Notes: Renamed script and added Script Variable support\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    [Parameter()]\r\n    [String]$Tools = \"All\",\r\n    [Parameter()]\r\n    [String]$ExcludedUsers\r\n)\r\n\r\nbegin {\r\n    \r\n    if ($env:excludeUsers -and $env:excludeUsers -notlike \"null\") { $ExcludedUsers = $env:excludeUsers }\r\n    \r\n    # Lets double check that this script is being run appropriately\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n    }\r\n\r\n    function Test-IsSystem {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        return $id.Name -like \"NT AUTHORITY*\" -or $id.IsSystem\r\n    }\r\n\r\n    if (!(Test-IsElevated) -and !(Test-IsSystem)) {\r\n        Write-Error -Message \"[Error] Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n\r\n    # Setting up some functions to be used later.\r\n    function Set-HKProperty {\r\n        param (\r\n            $Path,\r\n            $Name,\r\n            $Value,\r\n            [ValidateSet('DWord', 'QWord', 'String', 'ExpandedString', 'Binary', 'MultiString', 'Unknown')]\r\n            $PropertyType = 'DWord'\r\n        )\r\n        if (-not $(Test-Path -Path $Path)) {\r\n            # Check if path does not exist and create the path\r\n            New-Item -Path $Path -Force | Out-Null\r\n        }\r\n        if ((Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)) {\r\n            # Update property and print out what it was changed from and changed to\r\n            $CurrentValue = Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore\r\n            try {\r\n                Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force -Confirm:$false -ErrorAction Stop | Out-Null\r\n            }\r\n            catch {\r\n                Write-Error \"[Error] Unable to Set registry key for $Name please see below error!\"\r\n                Write-Error $_\r\n                exit 1\r\n            }\r\n            Write-Host \"$Path$Name changed from $CurrentValue to $(Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)\"\r\n        }\r\n        else {\r\n            # Create property with value\r\n            try {\r\n                New-ItemProperty -Path $Path -Name $Name -Value $Value -PropertyType $PropertyType -Force -Confirm:$false -ErrorAction Stop | Out-Null\r\n            }\r\n            catch {\r\n                Write-Error \"[Error] Unable to Set registry key for $Name please see below error!\"\r\n                Write-Error $_\r\n                exit 1\r\n            }\r\n            Write-Host \"Set $Path$Name to $(Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)\"\r\n        }\r\n    }\r\n\r\n    # This will get all the registry path's for all actual users (not system or network service account but actual users.)\r\n    function Get-UserHives {\r\n        param (\r\n            [Parameter()]\r\n            [ValidateSet('AzureAD', 'DomainAndLocal', 'All')]\r\n            [String]$Type = \"All\",\r\n            [Parameter()]\r\n            [String[]]$ExcludedUsers,\r\n            [Parameter()]\r\n            [switch]$IncludeDefault\r\n        )\r\n\r\n        # User account SID's follow a particular patter depending on if they're azure AD or a Domain account or a local \"workgroup\" account.\r\n        $Patterns = switch ($Type) {\r\n            \"AzureAD\" { \"S-1-12-1-(d+-?){4}$\" }\r\n            \"DomainAndLocal\" { \"S-1-5-21-(d+-?){4}$\" }\r\n            \"All\" { \"S-1-12-1-(d+-?){4}$\" ; \"S-1-5-21-(d+-?){4}$\" } \r\n        }\r\n\r\n        # We'll need the NTuser.dat file to load each users registry hive. So we grab it if their account sid matches the above pattern. \r\n        $UserProfiles = Foreach ($Pattern in $Patterns) { \r\n            Get-ItemProperty \"HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionProfileList*\" |\r\n                Where-Object { $_.PSChildName -match $Pattern } | \r\n                Select-Object @{Name = \"SID\"; Expression = { $_.PSChildName } }, \r\n                @{Name = \"UserHive\"; Expression = { \"$($_.ProfileImagePath)NTuser.dat\" } }, \r\n                @{Name = \"UserName\"; Expression = { \"$($_.ProfileImagePath | Split-Path -Leaf)\" } }\r\n        }\r\n\r\n        # There are some situations where grabbing the .Default user's info is needed.\r\n        switch ($IncludeDefault) {\r\n            $True {\r\n                $DefaultProfile = \"\" | Select-Object UserName, SID, UserHive\r\n                $DefaultProfile.UserName = \"Default\"\r\n                $DefaultProfile.SID = \"DefaultProfile\"\r\n                $DefaultProfile.Userhive = \"$env:SystemDriveUsersDefaultNTUSER.DAT\"\r\n\r\n                # It was easier to write-output twice than combine the two objects.\r\n                $DefaultProfile | Where-Object { $ExcludedUsers -notcontains $_.UserName } | Write-Output\r\n            }\r\n        }\r\n\r\n        $UserProfiles | Where-Object { $ExcludedUsers -notcontains $_.UserName } | Write-Output\r\n    }\r\n\r\n    function Set-Tool {\r\n        [CmdletBinding()]\r\n        param(\r\n            [Parameter()]\r\n            [ValidateSet(\"All\", \"Cmd\", \"ControlPanel\", \"theControlPanel\", \"MMC\", \"RegistryEditor\", \"theRegistryEditor\", \"Run\", \"TaskMgr\", \"taskManager\")]\r\n            [string]$Tool,\r\n            [string]$key\r\n        )\r\n        process {\r\n            # Each option has a different registry key to change. Since this function only supports 1 item at a time I can check which option and set the regkey individually.\r\n            Write-Host \"Disabling $Tool...\"\r\n            switch ($Tool) {\r\n                \"Cmd\" { Set-HKProperty -Path $keySoftwarePoliciesMicrosoftWindowsSystem -Name DisableCMD -Value 1 }\r\n                \"ControlPanel\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoControlPanel -Value 1 }\r\n                \"theControlPanel\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoControlPanel -Value 1 }\r\n                \"MMC\" { Set-HKProperty -Path $keySoftwarePoliciesMicrosoftMMC -Name RestrictToPermittedSnapins -Value 1 }\r\n                \"RegistryEditor\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableRegistryTools -Value 1 }\r\n                \"theRegistryEditor\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableRegistryTools -Value 1 }\r\n                \"Run\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoRun -Value 1 }\r\n                \"TaskMgr\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableTaskMgr -Value 1 }\r\n                \"taskManager\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableTaskMgr -Value 1 }\r\n                \"All\" {\r\n                    Set-HKProperty -Path $keySoftwarePoliciesMicrosoftWindowsSystem -Name DisableCMD -Value 1\r\n                    Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name NoDispCPL -Value 1\r\n                    Set-HKProperty -Path $keySoftwarePoliciesMicrosoftMMC -Name RestrictToPermittedSnapins -Value 1\r\n                    Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableRegistryTools -Value 1\r\n                    Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoRun -Value 1\r\n                    Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableTaskMgr -Value 1\r\n                }\r\n            }\r\n        }\r\n    }\r\n}\r\nprocess {\r\n\r\n    # Get each user profile SID and Path to the profile. If there are any exclusions we'll have to take them into account.\r\n    if ($ExcludedUsers) {\r\n        $ToBeExcluded = New-Object System.Collections.Generic.List[string]\r\n        $ExcludedUsers.split(\",\").trim() | ForEach-Object { if ($_) { $ToBeExcluded.Add($_) } }\r\n        Write-Warning \"The Following Users will not have your selected tools disabled. $ToBeExcluded\"\r\n        $UserProfiles = Get-UserHives -IncludeDefault -ExcludedUsers $ToBeExcluded\r\n    }\r\n    else {\r\n        $UserProfiles = Get-UserHives -IncludeDefault\r\n    }\r\n\r\n    # Loop through each profile on the machine\r\n    Foreach ($UserProfile in $UserProfiles) {\r\n        # Load each user's registry hive if not already loaded. Backticked \"UserProfile.UserHive\" so that it accounts for spaces in the username.\r\n        If (($ProfileWasLoaded = Test-Path Registry::HKEY_USERS$($UserProfile.SID)) -eq $false) {\r\n            Start-Process -FilePath \"cmd.exe\" -ArgumentList \"\/C reg.exe LOAD HKU$($UserProfile.SID) `\"$($UserProfile.UserHive)`\"\" -Wait -WindowStyle Hidden\r\n        }\r\n        # The path is different for each individual user. This is the base path.\r\n        $key = \"Registry::HKEY_USERS$($UserProfile.SID)\"\r\n\r\n        # List of checkbox items\r\n        $CheckboxItems = \"cmd\", \"theControlPanel\", \"mmc\", \"theRegistryEditor\", \"run\", \"taskManager\"\r\n        # Checkboxes come in as environmental variables. This'll grab the ones that were selected (if any)\r\n        $EnvItems = Get-ChildItem env:* | Where-Object { $CheckboxItems -contains $_.Name -and $_.Value -notlike \"false\" }\r\n\r\n        # This will grab the tool selections from the parameter field. Since it comes in as a string we'll have to split it up.\r\n        $Tool = $Tools.split(\",\").trim()\r\n\r\n        # If the checkbox for all was selected I can just run the function once instead of running it repeatedly for the same thing.\r\n        if ($env:allTools -and $env:allTools -notlike \"false\") {\r\n            Set-Tool -Tool \"All\" -Key $key\r\n        }\r\n        elseif ($EnvItems) {\r\n            # If checkboxes were used we should just use those.\r\n            $EnvItems | ForEach-Object { Set-Tool -Tool $_.Name -Key $key }\r\n        }\r\n        else {\r\n            $Tool | ForEach-Object { Set-Tool -Tool $_ -Key $key }\r\n        }\r\n\r\n        # Unload NTuser.dat for user's we loaded previously.\r\n        If ($ProfileWasLoaded -eq $false) {\r\n            [gc]::Collect()\r\n            Start-Sleep -Seconds 1\r\n            Start-Process -FilePath \"cmd.exe\" -ArgumentList \"\/C reg.exe UNLOAD HKU$($UserProfile.SID)\" -Wait -WindowStyle Hidden | Out-Null\r\n        }\r\n    }\r\n    \r\n}\r\nend {\r\n    \r\n    \r\n    \r\n}<\/pre>\n
 <\/p>\n\n
Acc\u00e9dez \u00e0 plus de 700 scripts dans le Dojo NinjaOne<\/p>\n
Obtenez l’acc\u00e8s<\/a><\/p>\n<\/div>\n
Comment fonctionne le script<\/h2>\n
Le script dont nous parlons est \u00e9crit en PowerShell et est con\u00e7u pour d\u00e9sactiver des outils d’administration sp\u00e9cifiques sur des machines locales. Il a \u00e9t\u00e9 optimis\u00e9 pour fonctionner avec PowerShell 5.1 et propose plusieurs options s\u00e9lectionnables telles que l’Invite de commande, le Panneau de configuration, la Console de gestion Microsoft (MMC), l’\u00c9diteur de registre, la Fen\u00eatre d’ex\u00e9cution des commandes et le Gestionnaire des t\u00e2ches. Vous pouvez d\u00e9sactiver tous ces outils ou choisir dans une liste s\u00e9par\u00e9e par des virgules de ne d\u00e9sactiver que certains d’entre eux.<\/p>\n
De plus, le script permet d’exclure certains profils utilisateur de cette action. Si vous devez vous assurer que certains utilisateurs conservent leurs capacit\u00e9s d’administration, vous pouvez le faire facilement.<\/p>\n
Ce script PowerShell effectue trois validations importantes :<\/p>\n
    \n
  1. V\u00e9rifie si le script est ex\u00e9cut\u00e9 avec des privil\u00e8ges administrateur.<\/li>\n
  2. Charge les cl\u00e9s de registre pour chaque profil utilisateur, \u00e0 l’exception de celles qui sont explicitement exclues.<\/li>\n
  3. Modifie ou d\u00e9finit les cl\u00e9s de registre pour d\u00e9sactiver les outils d’administration s\u00e9lectionn\u00e9s.<\/li>\n<\/ol>\n
    Il ne s’agit pas seulement de d\u00e9sactivation, mais aussi de contr\u00f4le et de sp\u00e9cificit\u00e9, ce qui rend ce script tr\u00e8s polyvalent pour les administrateurs informatiques et les MSP.<\/p>\n
    Pourquoi c’est important pour les professionnels de l’informatique et les MSP<\/h2>\n
    Contr\u00f4le centralis\u00e9<\/h3>\n
    En utilisant ce script PowerShell, les professionnels de l’informatique peuvent d\u00e9sactiver les outils d’administration locaux de mani\u00e8re centralis\u00e9e, sans avoir besoin de le faire manuellement pour chaque utilisateur.<\/p>\n
    S\u00e9curit\u00e9<\/h3>\n
    La d\u00e9sactivation de ces outils renforce la s\u00e9curit\u00e9 en limitant la capacit\u00e9 des utilisateurs \u00e0 apporter des modifications au niveau du syst\u00e8me. Ceci est particuli\u00e8rement utile dans les environnements o\u00f9 l’on souhaite minimiser les risques potentiels de s\u00e9curit\u00e9 \u00e0 l’int\u00e9rieur de l’entreprise.<\/p>\n
    Polyvalence<\/h3>\n
    La capacit\u00e9 du script \u00e0 d\u00e9sactiver s\u00e9lectivement des outils et \u00e0 exclure des utilisateurs sp\u00e9cifiques lui conf\u00e8re une flexibilit\u00e9 adapt\u00e9e \u00e0 divers environnements informatiques. Il ne s’agit pas d’une solution unique, mais d’une solution adapt\u00e9e \u00e0 la fa\u00e7on dont vous voulez agir.<\/p>\n
    Automatisation et \u00e9volutivit\u00e9<\/h3>\n
    Pour les MSP, le script peut \u00eatre int\u00e9gr\u00e9 dans des processus de d\u00e9ploiement automatis\u00e9s, ce qui le rend \u00e9volutif pour les grands r\u00e9seaux. Imaginez la facilit\u00e9 avec laquelle vous pouvez d\u00e9ployer ce syst\u00e8me sur des milliers de machines en quelques clics.<\/p>\n
    Comment le d\u00e9ployer<\/h2>\n
    Il suffit de t\u00e9l\u00e9charger le script Disable-LocalAdminTools.ps1 et de l’ex\u00e9cuter via PowerShell sur les machines cibles. Le script prend en charge diverses options de ligne de commande pour affiner ce que vous souhaitez d\u00e9sactiver.<\/p>\n
    PS C :>.Disable-LocalAdminTools.ps1 -Tools \u00ab\u00a0MMC,Cmd,TaskMgr,RegistryEditor\u00a0\u00bb<\/em><\/p>\n
    Conclusions<\/h2>\n
    Que vous soyez un professionnel de l’informatique \u00e0 la recherche d’une solution pour d\u00e9sactiver les outils d’administration locaux ou une entreprise MSP \u00e0 la recherche d’un script de d\u00e9sactivation des outils d’administration facile \u00e0 d\u00e9ployer, ce script PowerShell fournit une solution fiable, flexible et efficace. Il transforme la complexit\u00e9 en simplicit\u00e9, en vous donnant plus de contr\u00f4le sur les param\u00e8tres de s\u00e9curit\u00e9 de votre r\u00e9seau.<\/p>\n
    Gardez une longueur d’avance en adoptant cette approche efficace et cibl\u00e9e de l’acc\u00e8s administratif. Bon codage !<\/p>\n","protected":false},"author":35,"featured_media":206850,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"","_relevanssi_noindex_reason":"","_lmt_disableupdate":"no","_lmt_disable":""},"operating_system":[4212],"use_cases":[4289],"class_list":["post-208377","script_hub","type-script_hub","status-publish","has-post-thumbnail","hentry","script_hub_category-windows"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/script_hub\/208377","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/script_hub"}],"about":[{"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/types\/script_hub"}],"author":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/users\/35"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/comments?post=208377"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/media\/206850"}],"wp:attachment":[{"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/media?parent=208377"}],"wp:term":[{"taxonomy":"script_hub_category","embeddable":true,"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/operating_system?post=208377"},{"taxonomy":"use_cases","embeddable":true,"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/use_cases?post=208377"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}