{"id":211134,"date":"2024-03-05T15:19:24","date_gmt":"2024-03-05T15:19:24","guid":{"rendered":"https:\/\/www.ninjaone.com\/?post_type=script_hub&p=211134"},"modified":"2024-03-05T15:19:24","modified_gmt":"2024-03-05T15:19:24","slug":"hur-man-inaktiverar-lokala-adminverktyg-windows","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/sv\/script-hub\/hur-man-inaktiverar-lokala-adminverktyg-windows\/","title":{"rendered":"Hur man inaktiverar lokala adminverktyg i Windows [PowerShell-skript]"},"content":{"rendered":"

IT-proffs och IT-partners (MSP): Om du har f\u00e5tt i uppgift att uppr\u00e4tth\u00e5lla n\u00e4tverkss\u00e4kerhet och administrativ \u00e5tkomst vet du att det ofta \u00e4r l\u00e4ttare sagt \u00e4n gjort. En viktig aspekt av detta \u00e4r hanteringen av lokala administrat\u00f6rsverktyg som anv\u00e4ndarna inte b\u00f6r ha fri tillg\u00e5ng till. Detta leder oss till en fr\u00e5ga som ofta st\u00e4lls: Hur inaktiverar jag lokala administrat\u00f6rsverktyg<\/strong> i stor skala?<\/p>\n

Vi har ett omfattande PowerShell-skript som g\u00f6r att du selektivt kan inaktivera administrat\u00f6rsverktyg i en Windows-milj\u00f6.<\/p>\n

PowerShell-skriptet Inaktivera lokala administrat\u00f6rsverktyg<\/h2>\n
#Requires -Version 5.1\r\n\r\n<#\r\n.SYNOPSIS\r\n    This will disable the selected administrator tools depending on your selection (Defaults to all). Can be given a comma separated list of users to exclude from this action.\r\n.DESCRIPTION\r\n    This will disable the selected administrator tools. The options are \"All\", the command prompt, the control panel, the microsoft management console,\r\n    the registry editor, the run command window and task manager. You can give it a comma separated list of items if you want to disable some but not all.\r\n    Exit 1 is usually an indicator of bad input but can also mean editing the registry is blocked.\r\n.EXAMPLE\r\n    PS C:> .Disable-LocalAdminTools.ps1 -Tools \"MMC,Cmd,TaskMgr,RegistryEditor\"\r\n    Disabling MMC...\r\n    Set Registry::HKEY_USERSDefaultProfileSoftwarePoliciesMicrosoftMMCRestrictToPermittedSnapins to...\r\n    Disabling Cmd...\r\n    Set Registry::HKEY_USERSDefaultProfileSoftwarePoliciesMicrosoftWindowsDisableCMD to...\r\n    Disabling TaskMgr...\r\n    Set Registry::HKEY_USERSDefaultProfileSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableTaskMgr to...\r\n    Disabling RegistryEditor...\r\n    Set Registry::HKEY_USERSDefaultProfileSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableRegistryTools to...\r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    Minimum Supported OS: Windows 10, Windows Server 2016+\r\n    Release Notes: Renamed script and added Script Variable support\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    [Parameter()]\r\n    [String]$Tools = \"All\",\r\n    [Parameter()]\r\n    [String]$ExcludedUsers\r\n)\r\n\r\nbegin {\r\n    \r\n    if ($env:excludeUsers -and $env:excludeUsers -notlike \"null\") { $ExcludedUsers = $env:excludeUsers }\r\n    \r\n    # Lets double check that this script is being run appropriately\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n    }\r\n\r\n    function Test-IsSystem {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        return $id.Name -like \"NT AUTHORITY*\" -or $id.IsSystem\r\n    }\r\n\r\n    if (!(Test-IsElevated) -and !(Test-IsSystem)) {\r\n        Write-Error -Message \"[Error] Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n\r\n    # Setting up some functions to be used later.\r\n    function Set-HKProperty {\r\n        param (\r\n            $Path,\r\n            $Name,\r\n            $Value,\r\n            [ValidateSet('DWord', 'QWord', 'String', 'ExpandedString', 'Binary', 'MultiString', 'Unknown')]\r\n            $PropertyType = 'DWord'\r\n        )\r\n        if (-not $(Test-Path -Path $Path)) {\r\n            # Check if path does not exist and create the path\r\n            New-Item -Path $Path -Force | Out-Null\r\n        }\r\n        if ((Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)) {\r\n            # Update property and print out what it was changed from and changed to\r\n            $CurrentValue = Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore\r\n            try {\r\n                Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force -Confirm:$false -ErrorAction Stop | Out-Null\r\n            }\r\n            catch {\r\n                Write-Error \"[Error] Unable to Set registry key for $Name please see below error!\"\r\n                Write-Error $_\r\n                exit 1\r\n            }\r\n            Write-Host \"$Path$Name changed from $CurrentValue to $(Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)\"\r\n        }\r\n        else {\r\n            # Create property with value\r\n            try {\r\n                New-ItemProperty -Path $Path -Name $Name -Value $Value -PropertyType $PropertyType -Force -Confirm:$false -ErrorAction Stop | Out-Null\r\n            }\r\n            catch {\r\n                Write-Error \"[Error] Unable to Set registry key for $Name please see below error!\"\r\n                Write-Error $_\r\n                exit 1\r\n            }\r\n            Write-Host \"Set $Path$Name to $(Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)\"\r\n        }\r\n    }\r\n\r\n    # This will get all the registry path's for all actual users (not system or network service account but actual users.)\r\n    function Get-UserHives {\r\n        param (\r\n            [Parameter()]\r\n            [ValidateSet('AzureAD', 'DomainAndLocal', 'All')]\r\n            [String]$Type = \"All\",\r\n            [Parameter()]\r\n            [String[]]$ExcludedUsers,\r\n            [Parameter()]\r\n            [switch]$IncludeDefault\r\n        )\r\n\r\n        # User account SID's follow a particular patter depending on if they're azure AD or a Domain account or a local \"workgroup\" account.\r\n        $Patterns = switch ($Type) {\r\n            \"AzureAD\" { \"S-1-12-1-(d+-?){4}$\" }\r\n            \"DomainAndLocal\" { \"S-1-5-21-(d+-?){4}$\" }\r\n            \"All\" { \"S-1-12-1-(d+-?){4}$\" ; \"S-1-5-21-(d+-?){4}$\" } \r\n        }\r\n\r\n        # We'll need the NTuser.dat file to load each users registry hive. So we grab it if their account sid matches the above pattern. \r\n        $UserProfiles = Foreach ($Pattern in $Patterns) { \r\n            Get-ItemProperty \"HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionProfileList*\" |\r\n                Where-Object { $_.PSChildName -match $Pattern } | \r\n                Select-Object @{Name = \"SID\"; Expression = { $_.PSChildName } }, \r\n                @{Name = \"UserHive\"; Expression = { \"$($_.ProfileImagePath)NTuser.dat\" } }, \r\n                @{Name = \"UserName\"; Expression = { \"$($_.ProfileImagePath | Split-Path -Leaf)\" } }\r\n        }\r\n\r\n        # There are some situations where grabbing the .Default user's info is needed.\r\n        switch ($IncludeDefault) {\r\n            $True {\r\n                $DefaultProfile = \"\" | Select-Object UserName, SID, UserHive\r\n                $DefaultProfile.UserName = \"Default\"\r\n                $DefaultProfile.SID = \"DefaultProfile\"\r\n                $DefaultProfile.Userhive = \"$env:SystemDriveUsersDefaultNTUSER.DAT\"\r\n\r\n                # It was easier to write-output twice than combine the two objects.\r\n                $DefaultProfile | Where-Object { $ExcludedUsers -notcontains $_.UserName } | Write-Output\r\n            }\r\n        }\r\n\r\n        $UserProfiles | Where-Object { $ExcludedUsers -notcontains $_.UserName } | Write-Output\r\n    }\r\n\r\n    function Set-Tool {\r\n        [CmdletBinding()]\r\n        param(\r\n            [Parameter()]\r\n            [ValidateSet(\"All\", \"Cmd\", \"ControlPanel\", \"theControlPanel\", \"MMC\", \"RegistryEditor\", \"theRegistryEditor\", \"Run\", \"TaskMgr\", \"taskManager\")]\r\n            [string]$Tool,\r\n            [string]$key\r\n        )\r\n        process {\r\n            # Each option has a different registry key to change. Since this function only supports 1 item at a time I can check which option and set the regkey individually.\r\n            Write-Host \"Disabling $Tool...\"\r\n            switch ($Tool) {\r\n                \"Cmd\" { Set-HKProperty -Path $keySoftwarePoliciesMicrosoftWindowsSystem -Name DisableCMD -Value 1 }\r\n                \"ControlPanel\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoControlPanel -Value 1 }\r\n                \"theControlPanel\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoControlPanel -Value 1 }\r\n                \"MMC\" { Set-HKProperty -Path $keySoftwarePoliciesMicrosoftMMC -Name RestrictToPermittedSnapins -Value 1 }\r\n                \"RegistryEditor\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableRegistryTools -Value 1 }\r\n                \"theRegistryEditor\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableRegistryTools -Value 1 }\r\n                \"Run\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoRun -Value 1 }\r\n                \"TaskMgr\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableTaskMgr -Value 1 }\r\n                \"taskManager\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableTaskMgr -Value 1 }\r\n                \"All\" {\r\n                    Set-HKProperty -Path $keySoftwarePoliciesMicrosoftWindowsSystem -Name DisableCMD -Value 1\r\n                    Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name NoDispCPL -Value 1\r\n                    Set-HKProperty -Path $keySoftwarePoliciesMicrosoftMMC -Name RestrictToPermittedSnapins -Value 1\r\n                    Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableRegistryTools -Value 1\r\n                    Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoRun -Value 1\r\n                    Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableTaskMgr -Value 1\r\n                }\r\n            }\r\n        }\r\n    }\r\n}\r\nprocess {\r\n\r\n    # Get each user profile SID and Path to the profile. If there are any exclusions we'll have to take them into account.\r\n    if ($ExcludedUsers) {\r\n        $ToBeExcluded = New-Object System.Collections.Generic.List[string]\r\n        $ExcludedUsers.split(\",\").trim() | ForEach-Object { if ($_) { $ToBeExcluded.Add($_) } }\r\n        Write-Warning \"The Following Users will not have your selected tools disabled. $ToBeExcluded\"\r\n        $UserProfiles = Get-UserHives -IncludeDefault -ExcludedUsers $ToBeExcluded\r\n    }\r\n    else {\r\n        $UserProfiles = Get-UserHives -IncludeDefault\r\n    }\r\n\r\n    # Loop through each profile on the machine\r\n    Foreach ($UserProfile in $UserProfiles) {\r\n        # Load each user's registry hive if not already loaded. Backticked \"UserProfile.UserHive\" so that it accounts for spaces in the username.\r\n        If (($ProfileWasLoaded = Test-Path Registry::HKEY_USERS$($UserProfile.SID)) -eq $false) {\r\n            Start-Process -FilePath \"cmd.exe\" -ArgumentList \"\/C reg.exe LOAD HKU$($UserProfile.SID) `\"$($UserProfile.UserHive)`\"\" -Wait -WindowStyle Hidden\r\n        }\r\n        # The path is different for each individual user. This is the base path.\r\n        $key = \"Registry::HKEY_USERS$($UserProfile.SID)\"\r\n\r\n        # List of checkbox items\r\n        $CheckboxItems = \"cmd\", \"theControlPanel\", \"mmc\", \"theRegistryEditor\", \"run\", \"taskManager\"\r\n        # Checkboxes come in as environmental variables. This'll grab the ones that were selected (if any)\r\n        $EnvItems = Get-ChildItem env:* | Where-Object { $CheckboxItems -contains $_.Name -and $_.Value -notlike \"false\" }\r\n\r\n        # This will grab the tool selections from the parameter field. Since it comes in as a string we'll have to split it up.\r\n        $Tool = $Tools.split(\",\").trim()\r\n\r\n        # If the checkbox for all was selected I can just run the function once instead of running it repeatedly for the same thing.\r\n        if ($env:allTools -and $env:allTools -notlike \"false\") {\r\n            Set-Tool -Tool \"All\" -Key $key\r\n        }\r\n        elseif ($EnvItems) {\r\n            # If checkboxes were used we should just use those.\r\n            $EnvItems | ForEach-Object { Set-Tool -Tool $_.Name -Key $key }\r\n        }\r\n        else {\r\n            $Tool | ForEach-Object { Set-Tool -Tool $_ -Key $key }\r\n        }\r\n\r\n        # Unload NTuser.dat for user's we loaded previously.\r\n        If ($ProfileWasLoaded -eq $false) {\r\n            [gc]::Collect()\r\n            Start-Sleep -Seconds 1\r\n            Start-Process -FilePath \"cmd.exe\" -ArgumentList \"\/C reg.exe UNLOAD HKU$($UserProfile.SID)\" -Wait -WindowStyle Hidden | Out-Null\r\n        }\r\n    }\r\n    \r\n}\r\nend {\r\n    \r\n    \r\n    \r\n}<\/pre>\n
 <\/p>\n\n
F\u00e5 tillg\u00e5ng till \u00f6ver 300+ skript i NinjaOne Dojo<\/p>\n
F\u00e5 tillg\u00e5ng till<\/a><\/p>\n<\/div>\n
Hur manuset fungerar<\/h2>\n
Skriptet vi diskuterar \u00e4r skrivet i PowerShell och \u00e4r utformat f\u00f6r att inaktivera specifika administrativa verktyg p\u00e5 lokala maskiner. Den har optimerats f\u00f6r att fungera med PowerShell 5.1 och har olika valbara alternativ som Kommandotolken, Kontrollpanelen, Microsoft Management Console (MMC), Registerredigeraren, K\u00f6r kommandof\u00f6nster och Aktivitetshanteraren. Du kan antingen inaktivera alla dessa verktyg eller v\u00e4lja fr\u00e5n en kommaseparerad lista f\u00f6r att inaktivera endast specifika verktyg.<\/p>\n
Dessutom ger skriptet m\u00f6jlighet att utesluta vissa anv\u00e4ndarprofiler fr\u00e5n denna \u00e5tg\u00e4rd. Om du beh\u00f6ver se till att vissa anv\u00e4ndare beh\u00e5ller sina administrat\u00f6rsfunktioner kan du enkelt g\u00f6ra det.<\/p>\n
Detta PowerShell-skript utf\u00f6r tre viktiga valideringar:<\/p>\n
    \n
  1. Kontrollerar om skriptet k\u00f6rs med administrat\u00f6rsbeh\u00f6righet.<\/li>\n
  2. L\u00e4ser in registernycklarna f\u00f6r varje anv\u00e4ndarprofil, med undantag f\u00f6r de som uttryckligen har undantagits.<\/li>\n
  3. \u00c4ndrar eller st\u00e4ller in registernycklar f\u00f6r att inaktivera de valda administrativa verktygen.<\/li>\n<\/ol>\n
    Det handlar inte bara om inaktivering, utan \u00e4ven om kontroll och specificitet, vilket g\u00f6r detta skript mycket m\u00e5ngsidigt f\u00f6r IT-administrat\u00f6rer och IT-partners.<\/p>\n
    Varf\u00f6r IT-proffs och IT-partners b\u00f6r bry sig<\/h2>\n
    Centraliserad kontroll<\/h3>\n
    Med hj\u00e4lp av detta PowerShell-skript kan IT-personal inaktivera lokala administrationsverktyg p\u00e5 ett centraliserat s\u00e4tt, vilket avsev\u00e4rt minskar den tid det skulle ta att g\u00f6ra detta manuellt f\u00f6r varje anv\u00e4ndare.<\/p>\n
    S\u00e4kerhet<\/h3>\n
    Inaktivering av dessa verktyg f\u00f6rb\u00e4ttrar s\u00e4kerheten genom att begr\u00e4nsa anv\u00e4ndarnas m\u00f6jligheter att g\u00f6ra \u00e4ndringar p\u00e5 systemniv\u00e5. Detta \u00e4r s\u00e4rskilt anv\u00e4ndbart i milj\u00f6er d\u00e4r man vill minimera potentiella s\u00e4kerhetsrisker inifr\u00e5n.<\/p>\n
    M\u00e5ngsidighet<\/h3>\n
    Skriptets f\u00f6rm\u00e5ga att selektivt inaktivera verktyg och utesluta specifika anv\u00e4ndare ger det en flexibilitet som \u00e4r skr\u00e4ddarsydd f\u00f6r olika IT-milj\u00f6er. Det \u00e4r inte en storlek som passar alla, det \u00e4r en storlek som passar hur du vill ha det.<\/p>\n
    Automatisering och skalbarhet<\/h3>\n
    F\u00f6r IT-partners kan skriptet integreras i automatiserade drifts\u00e4ttningsprocesser, vilket g\u00f6r det skalbart f\u00f6r stora n\u00e4tverk. F\u00f6rest\u00e4ll dig hur enkelt det \u00e4r att rulla ut detta till tusentals maskiner med bara n\u00e5gra f\u00e5 klick.<\/p>\n
    Hur man distribuerar<\/h2>\n
    Ladda bara ner skriptet Disable-LocalAdminTools.ps1 och k\u00f6r det via PowerShell p\u00e5 m\u00e5ldatorerna. Skriptet st\u00f6der olika kommandoradsalternativ f\u00f6r att finjustera vad du vill inaktivera.<\/p>\n
    PS C:>.Disable-LocalAdminTools.ps1 -Tools ”MMC,Cmd,TaskMgr,RegistryEditor”<\/em><\/p>\n
    Avslutande tankar<\/h2>\n
    Oavsett om du \u00e4r en IT-specialist som letar efter en l\u00f6sning f\u00f6r att inaktivera lokala administrat\u00f6rsverktyg eller en IT-partners som letar efter ett enkelt implementerbart skript f\u00f6r inaktivering av administrat\u00f6rsverktyg, ger detta PowerShell-skript en robust, flexibel och effektiv l\u00f6sning. Det tar komplexitet och g\u00f6r det enkelt, vilket ger dig mer kontroll \u00f6ver n\u00e4tverkets s\u00e4kerhetsinst\u00e4llningar.<\/p>\n
    H\u00e5ll dig steget f\u00f6re genom att anv\u00e4nda denna effektiva och m\u00e5linriktade metod f\u00f6r administrativ \u00e5tkomst. Lycka till med skrivarbetet!<\/p>\n","protected":false},"author":35,"featured_media":141780,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"","_relevanssi_noindex_reason":"","_lmt_disableupdate":"no","_lmt_disable":""},"operating_system":[4212],"use_cases":[4257],"class_list":["post-211134","script_hub","type-script_hub","status-publish","has-post-thumbnail","hentry","script_hub_category-windows"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.ninjaone.com\/sv\/wp-json\/wp\/v2\/script_hub\/211134","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ninjaone.com\/sv\/wp-json\/wp\/v2\/script_hub"}],"about":[{"href":"https:\/\/www.ninjaone.com\/sv\/wp-json\/wp\/v2\/types\/script_hub"}],"author":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/sv\/wp-json\/wp\/v2\/users\/35"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/sv\/wp-json\/wp\/v2\/comments?post=211134"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/sv\/wp-json\/wp\/v2\/media\/141780"}],"wp:attachment":[{"href":"https:\/\/www.ninjaone.com\/sv\/wp-json\/wp\/v2\/media?parent=211134"}],"wp:term":[{"taxonomy":"script_hub_category","embeddable":true,"href":"https:\/\/www.ninjaone.com\/sv\/wp-json\/wp\/v2\/operating_system?post=211134"},{"taxonomy":"use_cases","embeddable":true,"href":"https:\/\/www.ninjaone.com\/sv\/wp-json\/wp\/v2\/use_cases?post=211134"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}