Om du arbetar med IT eller \u00e4r chef f\u00f6r en tj\u00e4nsteleverant\u00f6r (MSP) vet du att det \u00e4r en sv\u00e5r balansg\u00e5ng att garantera systems\u00e4kerheten samtidigt som det ska vara enkelt att komma \u00e5t olika administrationsverktyg. Det \u00e4r d\u00e4r PowerShell-skript, som det som beskrivs ovan, kommer in i bilden.<\/p>\n
Med skriptet kan du aktivera eller inaktivera specifika administrat\u00f6rsverktyg p\u00e5 en Windows-maskin. De verktyg du kan anv\u00e4nda \u00e4r Kommandotolken, Kontrollpanelen, Microsoft Management Console, Registereditorn, kommandof\u00f6nstret K\u00f6r och Aktivitetshanteraren. Det b\u00e4sta \u00e4r att du kan k\u00f6ra skriptet f\u00f6r alla anv\u00e4ndarprofiler p\u00e5 en maskin, eller till\u00e4mpa det selektivt baserat p\u00e5 anv\u00e4ndarspecifika profiler.<\/p>\n
#Requires -Version 5.1\r\n\r\n<#\r\n.SYNOPSIS\r\n This will enable the selected administrator tools depending on your selection (Defaults to all). Can be given a comma seperated list\/string of tools to be enabled.\r\n Can also be given a comma seperated list of users to exclude from this action. Full Options: \"All\", \"Cmd\", \"ControlPanel\", \"MMC\", \"RegistryEditor\", \"Run\", \"TaskMgr\"\r\n.DESCRIPTION\r\n This will enable the selected administrator tools. The options are \"All\", the command prompt, the control panel, the microsoft management console,\r\n the registry editor, the run command window and task manager. You can give it a comma seperated list of items if you want to enable some but not all.\r\n Exit 1 is usually an indicator of bad input but can also mean editing the registry is blocked.\r\n.EXAMPLE\r\n PS C:> .Enable-LocalAdminTools.ps1 -Tools \"MMC,Cmd,TaskMgr,RegistryEditor\"\r\n Enabling MMC...\r\n Set Registry::HKEY_USERSDefaultProfileSoftwarePoliciesMicrosoftMMCRestrictToPermittedSnapins to...\r\n Enabling Cmd...\r\n Set Registry::HKEY_USERSDefaultProfileSoftwarePoliciesMicrosoftWindowsDisableCMD to...\r\n Enabling TaskMgr...\r\n Set Registry::HKEY_USERSDefaultProfileSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableTaskMgr to...\r\n Enabling RegistryEditor...\r\n Set Registry::HKEY_USERSDefaultProfileSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableRegistryTools to...\r\n.OUTPUTS\r\n None\r\n.NOTES\r\n General notes: Will set the regkeys for users created after this script is ran.\r\n Release Notes:\r\n Initial Release\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n [Parameter()]\r\n [String]$Tools = \"All\",\r\n [Parameter()]\r\n [String]$ExcludedUsers\r\n)\r\n\r\nbegin {\r\n # Lets double check that this script is being run appropriately\r\n function Test-IsElevated {\r\n $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n }\r\n\r\n function Test-IsSystem {\r\n $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n return $id.Name -like \"NT AUTHORITY*\" -or $id.IsSystem\r\n }\r\n\r\n if (!(Test-IsElevated) -and !(Test-IsSystem)) {\r\n Write-Error -Message \"[Error] Access Denied. Please run with Administrator privileges.\"\r\n exit 1\r\n }\r\n\r\n # Setting up some functions to be used later.\r\n function Set-HKProperty {\r\n param (\r\n $Path,\r\n $Name,\r\n $Value,\r\n [ValidateSet('DWord', 'QWord', 'String', 'ExpandedString', 'Binary', 'MultiString', 'Unknown')]\r\n $PropertyType = 'DWord'\r\n )\r\n if (-not $(Test-Path -Path $Path)) {\r\n # Check if path does not exist and create the path\r\n New-Item -Path $Path -Force | Out-Null\r\n }\r\n if ((Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)) {\r\n # Update property and print out what it was changed from and changed to\r\n $CurrentValue = Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore\r\n try {\r\n Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force -Confirm:$false -ErrorAction Stop | Out-Null\r\n }\r\n catch {\r\n Write-Error \"[Error] Unable to Set registry key for $Name please see below error!\"\r\n Write-Error $_\r\n exit 1\r\n }\r\n Write-Host \"$Path$Name changed from $CurrentValue to $(Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)\"\r\n }\r\n else {\r\n # Create property with value\r\n try {\r\n New-ItemProperty -Path $Path -Name $Name -Value $Value -PropertyType $PropertyType -Force -Confirm:$false -ErrorAction Stop | Out-Null\r\n }\r\n catch {\r\n Write-Error \"[Error] Unable to Set registry key for $Name please see below error!\"\r\n Write-Error $_\r\n exit 1\r\n }\r\n Write-Host \"Set $Path$Name to $(Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)\"\r\n }\r\n }\r\n\r\n # This will get all the registry path's for all actual users (not system or network service account but actual users.)\r\n function Get-UserHives {\r\n param (\r\n [Parameter()]\r\n [ValidateSet('AzureAD', 'DomainAndLocal', 'All')]\r\n [String]$Type = \"All\",\r\n [Parameter()]\r\n [String[]]$ExcludedUsers,\r\n [Parameter()]\r\n [switch]$IncludeDefault\r\n )\r\n\r\n # User account SID's follow a particular patter depending on if they're azure AD or a Domain account or a local \"workgroup\" account.\r\n $Patterns = switch ($Type) {\r\n \"AzureAD\" { \"S-1-12-1-(d+-?){4}$\" }\r\n \"DomainAndLocal\" { \"S-1-5-21-(d+-?){4}$\" }\r\n \"All\" { \"S-1-12-1-(d+-?){4}$\" ; \"S-1-5-21-(d+-?){4}$\" } \r\n }\r\n\r\n # We'll need the NTuser.dat file to load each users registry hive. So we grab it if their account sid matches the above pattern. \r\n $UserProfiles = Foreach ($Pattern in $Patterns) { \r\n Get-ItemProperty \"HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionProfileList*\" |\r\n Where-Object { $_.PSChildName -match $Pattern } | \r\n Select-Object @{Name = \"SID\"; Expression = { $_.PSChildName } }, \r\n @{Name = \"UserHive\"; Expression = { \"$($_.ProfileImagePath)NTuser.dat\" } }, \r\n @{Name = \"UserName\"; Expression = { \"$($_.ProfileImagePath | Split-Path -Leaf)\" } }\r\n }\r\n\r\n # There are some situations where grabbing the .Default user's info is needed.\r\n switch ($IncludeDefault) {\r\n $True {\r\n $DefaultProfile = \"\" | Select-Object UserName, SID, UserHive\r\n $DefaultProfile.UserName = \"Default\"\r\n $DefaultProfile.SID = \"DefaultProfile\"\r\n $DefaultProfile.Userhive = \"$env:SystemDriveUsersDefaultNTUSER.DAT\"\r\n\r\n # It was easier to write-output twice than combine the two objects.\r\n $DefaultProfile | Where-Object { $ExcludedUsers -notcontains $_.UserName } | Write-Output\r\n }\r\n }\r\n\r\n $UserProfiles | Where-Object { $ExcludedUsers -notcontains $_.UserName } | Write-Output\r\n }\r\n\r\n function Set-Tool {\r\n [CmdletBinding()]\r\n param(\r\n [Parameter()]\r\n [ValidateSet(\"All\", \"Cmd\", \"ControlPanel\", \"MMC\", \"RegistryEditor\", \"Run\", \"TaskMgr\")]\r\n [string]$Tool,\r\n [string]$key\r\n )\r\n process {\r\n # Each option has a different registry key to change. Since this function only supports 1 item at a time I can check which option and set the regkey individually.\r\n Write-Host \"Enabling $Tool...\"\r\n switch ($Tool) {\r\n \"Cmd\" { Set-HKProperty -Path $keySoftwarePoliciesMicrosoftWindowsSystem -Name DisableCMD -Value 0 }\r\n \"ControlPanel\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoControlPanel -Value 0 }\r\n \"MMC\" { Set-HKProperty -Path $keySoftwarePoliciesMicrosoftMMC -Name RestrictToPermittedSnapins -Value 0 }\r\n \"RegistryEditor\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableRegistryTools -Value 0 }\r\n \"Run\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoRun -Value 0 }\r\n \"TaskMgr\" { Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableTaskMgr -Value 0 }\r\n \"All\" {\r\n Set-HKProperty -Path $keySoftwarePoliciesMicrosoftWindowsSystem -Name DisableCMD -Value 0\r\n Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name NoDispCPL -Value 0\r\n Set-HKProperty -Path $keySoftwarePoliciesMicrosoftMMC -Name RestrictToPermittedSnapins -Value 0\r\n Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableRegistryTools -Value 0\r\n Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer -Name NoRun -Value 0\r\n Set-HKProperty -Path $keySoftwareMicrosoftWindowsCurrentVersionPoliciesSystem -Name DisableTaskMgr -Value 0\r\n }\r\n }\r\n }\r\n }\r\n}\r\nprocess {\r\n\r\n # Get each user profile SID and Path to the profile. If there are any exclusions we'll have to take them into account.\r\n if ($ExcludedUsers -or $env:ExcludedUsers) {\r\n if ($env:ExcludedUsers) {\r\n $ToBeExcluded = @()\r\n $ToBeExcluded += $env:ExcludedUsers.split(\",\").trim()\r\n Write-Warning \"The Following Users will not have your selected tools disabled. $ToBeExcluded\"\r\n }\r\n else {\r\n $ToBeExcluded = @()\r\n $ToBeExcluded += $ExcludedUsers.split(\",\").trim()\r\n Write-Warning \"The Following Users will not have your selected tools disabled. $ToBeExcluded\"\r\n }\r\n $UserProfiles = Get-UserHives -IncludeDefault -ExcludedUsers $ToBeExcluded\r\n }\r\n else {\r\n $UserProfiles = Get-UserHives -IncludeDefault\r\n }\r\n\r\n # Loop through each profile on the machine\r\n Foreach ($UserProfile in $UserProfiles) {\r\n # Load each user's registry hive if not already loaded. Backticked \"UserProfile.UserHive\" so that it accounts for spaces in the username.\r\n If (($ProfileWasLoaded = Test-Path Registry::HKEY_USERS$($UserProfile.SID)) -eq $false) {\r\n Start-Process -FilePath \"cmd.exe\" -ArgumentList \"\/C reg.exe LOAD HKU$($UserProfile.SID) `\"$($UserProfile.UserHive)`\"\" -Wait -WindowStyle Hidden\r\n }\r\n # The path is different for each individual user. This is the base path.\r\n $key = \"Registry::HKEY_USERS$($UserProfile.SID)\"\r\n\r\n # List of checkbox items\r\n $CheckboxItems = \"Cmd\", \"ControlPanel\", \"MMC\", \"RegistryEditor\", \"Run\", \"TaskMgr\"\r\n # Checkboxes come in as environmental variables. This'll grab the ones that were selected (if any)\r\n $EnvItems = Get-ChildItem env:* | Where-Object { $CheckboxItems -contains $_.Name }\r\n\r\n # This will grab the tool selections from the parameter field. Since it comes in as a string we'll have to split it up.\r\n $Tool = $Tools.split(\",\").trim()\r\n\r\n # If the checkbox for all was selected I can just run the function once instead of running it repeatedly for the same thing.\r\n if ($env:All) {\r\n Set-Tool -Tool \"All\" -Key $key\r\n }\r\n elseif ($EnvItems) {\r\n # If checkboxes were used we should just use those.\r\n $EnvItems | ForEach-Object { Set-Tool -Tool $_.Name -Key $key }\r\n }\r\n else {\r\n $Tool | ForEach-Object { Set-Tool -Tool $_ -Key $key }\r\n }\r\n\r\n # Unload NTuser.dat for user's we loaded previously.\r\n If ($ProfileWasLoaded -eq $false) {\r\n [gc]::Collect()\r\n Start-Sleep -Seconds 1\r\n Start-Process -FilePath \"cmd.exe\" -ArgumentList \"\/C reg.exe UNLOAD HKU$($UserProfile.SID)\" -Wait -WindowStyle Hidden | Out-Null\r\n }\r\n }\r\n \r\n}\r\nend {\r\n $ScriptVariables = @(\r\n [PSCustomObject]@{\r\n name = \"All\"\r\n calculatedName = \"all\"\r\n required = $false\r\n defaultValue = [PSCustomObject]@{\r\n type = \"TEXT\"\r\n value = $true\r\n }\r\n valueType = \"CHECKBOX\"\r\n valueList = $null\r\n description = \"All Admin Tools\"\r\n }\r\n [PSCustomObject]@{\r\n name = \"Cmd\"\r\n calculatedName = \"cmd\"\r\n required = $false\r\n defaultValue = $null\r\n valueType = \"CHECKBOX\"\r\n valueList = $null\r\n description = \"Command Prompt\"\r\n }\r\n [PSCustomObject]@{\r\n name = \"ControlPanel\"\r\n calculatedName = \"controlpanel\"\r\n required = $false\r\n defaultValue = $null\r\n valueType = \"CHECKBOX\"\r\n valueList = $null\r\n description = \"Control Panel\"\r\n }\r\n [PSCustomObject]@{\r\n name = \"MMC\"\r\n calculatedName = \"mmc\"\r\n required = $false\r\n defaultValue = $null\r\n valueType = \"CHECKBOX\"\r\n valueList = $null\r\n description = \"Microsoft Management Console\"\r\n }\r\n [PSCustomObject]@{\r\n name = \"RegistryEditor\"\r\n calculatedName = \"registryeditor\"\r\n required = $false\r\n defaultValue = $null\r\n valueType = \"CHECKBOX\"\r\n valueList = $null\r\n description = \"The Registry Editor\"\r\n }\r\n [PSCustomObject]@{\r\n name = \"Run\"\r\n calculatedName = \"run\"\r\n required = $false\r\n defaultValue = $null\r\n valueType = \"CHECKBOX\"\r\n valueList = $null\r\n description = \"Run Command Window\"\r\n }\r\n [PSCustomObject]@{\r\n name = \"TaskMgr\"\r\n calculatedName = \"taskmgr\"\r\n required = $false\r\n defaultValue = $null\r\n valueType = \"CHECKBOX\"\r\n valueList = $null\r\n description = \"Task Manager\"\r\n }\r\n [PSCustomObject]@{\r\n name = \"ExcludedUsers\"\r\n calculatedName = \"excludedusers\"\r\n required = $false\r\n defaultValue = $null\r\n valueType = \"TEXT\"\r\n valueList = $null\r\n description = \"Comma separated list of users you would like to exclude.\"\r\n }\r\n )\r\n}<\/pre>\n <\/p>\n\n
F\u00e5 tillg\u00e5ng till \u00f6ver 300+ skript i NinjaOne Dojo<\/p>\n
F\u00e5 tillg\u00e5ng till<\/a><\/p>\n<\/div>\nVarf\u00f6r \u00e4r detta manus anv\u00e4ndbart f\u00f6r IT-proffs och MSP:er?<\/h2>\n\n- Centraliserad kontroll<\/strong>: Med detta skript kan du styra flera anv\u00e4ndarprofiler centralt, vilket sparar tid och minskar risken f\u00f6r m\u00e4nskliga fel.<\/li>\n
- S\u00e4kerhet<\/strong>: Genom att inaktivera specifika verktyg kan du se till att ditt system \u00e4r s\u00e4kert mot b\u00e5de interna och externa hot.<\/li>\n
- Anv\u00e4ndarv\u00e4nlighet<\/strong>: Skriptet \u00e4r sj\u00e4lvf\u00f6rklarande och kommer med en uppsj\u00f6 av alternativ f\u00f6r att anpassa dina inst\u00e4llningar.<\/li>\n
- Automatisering<\/strong>: Den kan integreras i en st\u00f6rre automatiseringsprocess och d\u00e4rigenom effektivisera systemkonfigurationsuppgifterna.<\/li>\n
- Alternativ f\u00f6r \u00e5terg\u00e5ng<\/strong>: Eftersom skriptet manipulerar registernycklar kan \u00e4ndringar enkelt \u00e5terst\u00e4llas vid behov.<\/li>\n<\/ol>\n
Hur man anv\u00e4nder skriptet<\/h2>\n\n- Ladda ner och \u00f6ppna<\/strong>: Ladda ner skriptet och \u00f6ppna PowerShell som administrat\u00f6r.<\/li>\n
- Utf\u00f6r<\/strong>: K\u00f6r skriptet genom att ange de verktyg du vill aktivera eller inaktivera. Om du t.ex. bara vill aktivera Aktivitetshanteraren och Kommandotolken k\u00f6r du
\n<\/li>\n- Verifiera<\/strong>: Efter k\u00f6rning, kontrollera att \u00e4ndringarna har till\u00e4mpats genom att logga in p\u00e5 respektive anv\u00e4ndarkonto.<\/li>\n<\/ol>\n
Avslutande tankar<\/h2>\n
I dagens snabbt f\u00f6r\u00e4nderliga tekniklandskap kan vikten av robusta, skalbara och flexibla systemhanteringsl\u00f6sningar inte \u00f6verskattas. Detta PowerShell-skript ger IT-proffs och MSP:er ett kraftfullt verktyg f\u00f6r att anpassa hanteringen av administrativa verktyg p\u00e5 Windows-system. N\u00e4r den anv\u00e4nds tillsammans med en omfattande IT-hanteringsplattform<\/a> som NinjaOne kan du inte bara f\u00f6renkla utan \u00e4ven f\u00f6rst\u00e4rka dina systemadministrationsm\u00f6jligheter.<\/p>\n