{"id":353673,"date":"2024-09-18T09:08:26","date_gmt":"2024-09-18T09:08:26","guid":{"rendered":"https:\/\/www.ninjaone.com\/script-hub\/restreindre-l-acces-a-python-dans-excel-powershell\/"},"modified":"2024-10-13T19:03:11","modified_gmt":"2024-10-13T19:03:11","slug":"restreindre-l-acces-a-python-dans-excel-powershell","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/fr\/script-hub\/restreindre-l-acces-a-python-dans-excel-powershell\/","title":{"rendered":"Comment restreindre l’acc\u00e8s \u00e0 Python dans Microsoft Excel \u00e0 l’aide de PowerShell"},"content":{"rendered":"

Dans le monde du travail moderne, la s\u00e9curit\u00e9 des donn\u00e9es et la gestion des acc\u00e8s sont devenues de plus en plus cruciales, en particulier parce que les entreprises int\u00e8grent divers langages et outils de programmation dans leurs activit\u00e9s quotidiennes.<\/p>\n

L’une de ces int\u00e9grations est l’utilisation de Python dans Microsoft Excel, une fonction puissante qui peut am\u00e9liorer la productivit\u00e9, mais qui pr\u00e9sente \u00e9galement des risques potentiels pour la s\u00e9curit\u00e9. Pour les professionnels de l’informatique et les fournisseurs de services g\u00e9r\u00e9s (MSP)<\/a>, la gestion et la restriction de l’acc\u00e8s \u00e0 Python dans Excel sont essentielles au maintien d’un environnement s\u00e9curis\u00e9.<\/p>\n

Cet article de blog explore un script PowerShell<\/a> con\u00e7u pour contr\u00f4ler l’utilisation de Python dans Excel<\/strong>, en veillant \u00e0 ce que les protocoles de s\u00e9curit\u00e9 soient respect\u00e9s sans compromettre la fonctionnalit\u00e9.<\/p>\n

Contexte<\/h2>\n

Avec la popularit\u00e9 croissante de Python dans l’analyse et l’automatisation des donn\u00e9es, son int\u00e9gration dans Excel offre aux utilisateurs des capacit\u00e9s avanc\u00e9es. Cependant, cette int\u00e9gration introduit \u00e9galement des vuln\u00e9rabilit\u00e9s potentielles, en particulier si des scripts Python sont ex\u00e9cut\u00e9s sans surveillance ad\u00e9quate.<\/p>\n

Les professionnels de l’informatique et les MSP doivent trouver un \u00e9quilibre entre les avantages des capacit\u00e9s de Python et la n\u00e9cessit\u00e9 de prot\u00e9ger les donn\u00e9es sensibles. Le script PowerShell pr\u00e9sent\u00e9 ici offre une solution en permettant aux administrateurs de restreindre l’utilisation de Python dans Excel, soit en activant des invites de s\u00e9curit\u00e9, soit en bloquant compl\u00e8tement l’acc\u00e8s \u00e0 Python, soit en revenant aux param\u00e8tres par d\u00e9faut de Microsoft.<\/p>\n

Le script\u00a0:<\/h2>\n
<#\r\n.SYNOPSIS\r\n    Restricts the use of Python in Excel for all users. By default it'll enable a security prompt but does have the option to block or to set it back to the Microsoft default (no warnings or prompts).\r\n.DESCRIPTION\r\n    Restricts the use of Python in Excel for all users. By default it'll enable a security prompt but does have the option to block or to set it back to the Microsoft default (no warnings or prompts).\r\n.EXAMPLE\r\n    (No Parameters)\r\n    \r\n    Registry::HKEY_USERS\\S-1-5-21-3870645062-3653562310-3850680542-1001\\software\\policies\\microsoft\\office\\16.0\\excel\\security\\PythonFunctionWarnings changed from 1 to 1\r\n    Registry::HKEY_USERS\\S-1-5-21-3870645062-3653562310-3850680542-1002\\software\\policies\\microsoft\\office\\16.0\\excel\\security\\PythonFunctionWarnings changed from 1 to 1\r\n    Set Registry::HKEY_USERS\\S-1-5-21-3870645062-3653562310-3850680542-1003\\software\\policies\\microsoft\\office\\16.0\\excel\\security\\PythonFunctionWarnings to 1\r\n\r\nPARAMETER: -Block\r\n    Blocks the use of Python in Excel.\r\n.EXAMPLE\r\n    -Block\r\n\r\n    Registry::HKEY_USERS\\S-1-5-21-3870645062-3653562310-3850680542-1001\\software\\policies\\microsoft\\office\\16.0\\excel\\security\\PythonFunctionWarnings changed from 1 to 2\r\n    Registry::HKEY_USERS\\S-1-5-21-3870645062-3653562310-3850680542-1002\\software\\policies\\microsoft\\office\\16.0\\excel\\security\\PythonFunctionWarnings changed from 1 to 2\r\n    Set Registry::HKEY_USERS\\S-1-5-21-3870645062-3653562310-3850680542-1003\\software\\policies\\microsoft\\office\\16.0\\excel\\security\\PythonFunctionWarnings to 2\r\n\r\nPARAMETER: -IncludeNewUsers\r\n    Adds the registry key to the Default Profile so that this change carriers over when new accounts are created.\r\n.EXAMPLE\r\n    -IncludeNewUsers\r\n\r\n    Set Registry::HKEY_USERS\\DefaultProfile\\software\\policies\\microsoft\\office\\16.0\\excel\\security\\PythonFunctionWarnings to 1\r\n    Registry::HKEY_USERS\\S-1-5-21-3870645062-3653562310-3850680542-1001\\software\\policies\\microsoft\\office\\16.0\\excel\\security\\PythonFunctionWarnings changed from 1 to 1\r\n    Registry::HKEY_USERS\\S-1-5-21-3870645062-3653562310-3850680542-1002\\software\\policies\\microsoft\\office\\16.0\\excel\\security\\PythonFunctionWarnings changed from 1 to 1\r\n    Set Registry::HKEY_USERS\\S-1-5-21-3870645062-3653562310-3850680542-1003\\software\\policies\\microsoft\\office\\16.0\\excel\\security\\PythonFunctionWarnings to 1\r\n\r\nPARAMETER: -ChangeBackToMicrosoftDefault\r\n    Resets the setting\/restriction back to the Microsoft Default (enabled with no security prompt).\r\n.EXAMPLE\r\n    -ChangeBackToMicrosoftDefault\r\n\r\n    Registry::HKEY_USERS\\S-1-5-21-3870645062-3653562310-3850680542-1001\\software\\policies\\microsoft\\office\\16.0\\excel\\security\\PythonFunctionWarnings changed from 1 to 0\r\n    Registry::HKEY_USERS\\S-1-5-21-3870645062-3653562310-3850680542-1002\\software\\policies\\microsoft\\office\\16.0\\excel\\security\\PythonFunctionWarnings changed from 1 to 0\r\n    Set Registry::HKEY_USERS\\S-1-5-21-3870645062-3653562310-3850680542-1003\\software\\policies\\microsoft\\office\\16.0\\excel\\security\\PythonFunctionWarnings to 0\r\n.LINK\r\n    https:\/\/support.microsoft.com\/en-us\/office\/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327\r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    Minimum OS Architecture Supported: Windows 8.1, Server 2012\r\n    Release Notes: Initial Release\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    [Parameter()]\r\n    [Switch]$Block = [System.Convert]::ToBoolean($env:blockPython),\r\n    [Parameter()]\r\n    [Switch]$IncludeNewUsers = [System.Convert]::ToBoolean($env:includeNewUsers),\r\n    [Parameter()]\r\n    [Switch]$ChangeBackToMicrosoftDefault = [System.Convert]::ToBoolean($env:changeBackToMicrosoftDefaultSetting)\r\n)\r\n\r\nbegin {\r\n\r\n    # If incompatible options are detected error out\r\n    if($Block -and $ChangeBackToMicrosoftDefault){\r\n        Write-Error \"-ChangeBackToMicrosoftDefault and -Block cannot be used together. The 'Change Back To Microsoft Default' option is to set Python in Excel back to how Microsoft ships the feature (with all security warnings disabled).\"\r\n        exit 1\r\n    }\r\n\r\n    # Write a warning message for the least secure option\r\n    if($ChangeBackToMicrosoftDefault){\r\n        Write-Warning \"Changing the setting back to the default. All Python security warnings will be disabled...\"\r\n    }\r\n\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n    }\r\n\r\n    # Handy registry setting function\r\n    function Set-HKProperty {\r\n        param (\r\n            $Path,\r\n            $Name,\r\n            $Value,\r\n            [ValidateSet('DWord', 'QWord', 'String', 'ExpandedString', 'Binary', 'MultiString', 'Unknown')]\r\n            $PropertyType = 'DWord'\r\n        )\r\n        if (-not $(Test-Path -Path $Path)) {\r\n            # Check if path does not exist and create the path\r\n            New-Item -Path $Path -Force | Out-Null\r\n        }\r\n        if ((Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue)) {\r\n            # Update property and print out what it was changed from and changed to\r\n            $CurrentValue = (Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name\r\n            try {\r\n                Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force -Confirm:$false -ErrorAction Stop | Out-Null\r\n            }\r\n            catch {\r\n                Write-Error \"[Error] Unable to Set registry key for $Name please see below error!\"\r\n                Write-Error $_\r\n                exit 1\r\n            }\r\n            Write-Host \"$Path\\$Name changed from $CurrentValue to $($(Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name)\"\r\n        }\r\n        else {\r\n            # Create property with value\r\n            try {\r\n                New-ItemProperty -Path $Path -Name $Name -Value $Value -PropertyType $PropertyType -Force -Confirm:$false -ErrorAction Stop | Out-Null\r\n            }\r\n            catch {\r\n                Write-Error \"[Error] Unable to Set registry key for $Name please see below error!\"\r\n                Write-Error $_\r\n                exit 1\r\n            }\r\n            Write-Host \"Set $Path\\$Name to $($(Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name)\"\r\n        }\r\n    }\r\n\r\n    # This function will gather all the user profiles on the system for use later\r\n    function Get-UserHives {\r\n        param (\r\n            [Parameter()]\r\n            [ValidateSet('AzureAD', 'DomainAndLocal', 'All')]\r\n            [String]$Type = \"All\",\r\n            [Parameter()]\r\n            [String[]]$ExcludedUsers,\r\n            [Parameter()]\r\n            [switch]$IncludeDefault\r\n        )\r\n    \r\n        # User account SID's follow a particular patter depending on if they're azure AD or a Domain account or a local \"workgroup\" account.\r\n        $Patterns = switch ($Type) {\r\n            \"AzureAD\" { \"S-1-12-1-(\\d+-?){4}$\" }\r\n            \"DomainAndLocal\" { \"S-1-5-21-(\\d+-?){4}$\" }\r\n            \"All\" { \"S-1-12-1-(\\d+-?){4}$\" ; \"S-1-5-21-(\\d+-?){4}$\" } \r\n        }\r\n    \r\n        # We'll need the NTuser.dat file to load each users registry hive. So we grab it if their account sid matches the above pattern. \r\n        $UserProfiles = Foreach ($Pattern in $Patterns) { \r\n            Get-ItemProperty \"HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\*\" |\r\n                Where-Object { $_.PSChildName -match $Pattern } | \r\n                Select-Object @{Name = \"SID\"; Expression = { $_.PSChildName } },\r\n                @{Name = \"UserName\"; Expression = { \"$($_.ProfileImagePath | Split-Path -Leaf)\" } }, \r\n                @{Name = \"UserHive\"; Expression = { \"$($_.ProfileImagePath)\\NTuser.dat\" } }, \r\n                @{Name = \"Path\"; Expression = { $_.ProfileImagePath } }\r\n        }\r\n    \r\n        # There are some situations where grabbing the .Default user's info is needed.\r\n        switch ($IncludeDefault) {\r\n            $True {\r\n                $DefaultProfile = \"\" | Select-Object UserName, SID, UserHive, Path\r\n                $DefaultProfile.UserName = \"Default\"\r\n                $DefaultProfile.SID = \"DefaultProfile\"\r\n                $DefaultProfile.Userhive = \"$env:SystemDrive\\Users\\Default\\NTUSER.DAT\"\r\n                $DefaultProfile.Path = \"$env:SystemDrive\\Users\\Default\"\r\n    \r\n                $DefaultProfile | Where-Object { $ExcludedUsers -notcontains $_.UserName }\r\n            }\r\n        }\r\n    \r\n        $UserProfiles | Where-Object { $ExcludedUsers -notcontains $_.UserName }\r\n    }\r\n}\r\nprocess {\r\n    if (-not (Test-IsElevated)) {\r\n        Write-Error -Message \"Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n\r\n    # If we're only asked to set it for existing users we won't include the default registry hive\r\n    if($IncludeNewUsers){\r\n        $UserProfiles = Get-UserHives -Type \"All\" -IncludeDefault\r\n    }else{\r\n        $UserProfiles = Get-UserHives -Type \"All\"\r\n    }\r\n    \r\n    $Key = \"software\\policies\\microsoft\\office\\16.0\\excel\\security\"\r\n    $PropertyName = \"PythonFunctionWarnings\"\r\n\r\n    if($ChangeBackToMicrosoftDefault){\r\n        # No Prompt and unlocked\r\n        $Value = 0\r\n    }\r\n\r\n    # This is the default option for the script\r\n    if(-not ($ChangeBackToMicrosoftDefault) -and -not ($Block)){\r\n        # Prompt\r\n        $Value = 1\r\n    }\r\n    \r\n    if($Block){\r\n        # Block\r\n        $Value = 2\r\n    }\r\n\r\n    # Loop through each profile on the machine\r\n    Foreach ($UserProfile in $UserProfiles) {\r\n        # Load User ntuser.dat if it's not already loaded\r\n        If (($ProfileWasLoaded = Test-Path Registry::HKEY_USERS\\$($UserProfile.SID)) -eq $false) {\r\n            Start-Process -FilePath \"cmd.exe\" -ArgumentList \"\/C reg.exe LOAD HKU\\$($UserProfile.SID) `\"$($UserProfile.UserHive)`\"\" -Wait -WindowStyle Hidden\r\n        }\r\n\r\n        Set-HKProperty -Path \"Registry::HKEY_USERS\\$($UserProfile.SID)\\$Key\" -Name $PropertyName -Value $Value\r\n        \r\n        # Unload NTuser.dat\r\n        If ($ProfileWasLoaded -eq $false) {\r\n            [gc]::Collect()\r\n            Start-Sleep 1\r\n            Start-Process -FilePath \"cmd.exe\" -ArgumentList \"\/C reg.exe UNLOAD HKU\\$($UserProfile.SID)\" -Wait -WindowStyle Hidden | Out-Null\r\n        }\r\n    }\r\n}\r\nend {\r\n    \r\n    \r\n    \r\n}<\/pre>\n
 <\/p>\n\n
<\/h2>
<\/p><\/div>
<\/a><\/div><\/div>\n
Description d\u00e9taill\u00e9e<\/h2>\n
Le script PowerShell fourni est con\u00e7u pour permettre aux administrateurs de contr\u00f4ler la fonctionnalit\u00e9 de Python dans Excel. Voici une description \u00e9tape par \u00e9tape du fonctionnement du script :<\/p>\n
1. Param\u00e8tres du script :<\/h3>\n