{"id":3321,"date":"2009-11-22T16:52:02","date_gmt":"2009-11-22T16:52:02","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/powershell\/2009\/11\/22\/you-dont-have-to-be-an-administrator-to-run-remote-powershell-commands\/"},"modified":"2019-02-18T13:06:05","modified_gmt":"2019-02-18T20:06:05","slug":"you-dont-have-to-be-an-administrator-to-run-remote-powershell-commands","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/powershell\/you-dont-have-to-be-an-administrator-to-run-remote-powershell-commands\/","title":{"rendered":"You Don&#8217;t Have to Be An Administrator to Run Remote PowerShell Commands"},"content":{"rendered":"<p>I was just read blog entry which complained about having to have administrative access to execute PowerShell commands against a remote server.&#160; This is not the case.<\/p>\n<p>We are \u201c<em>secure by default<\/em>\u201d which means that if you want to do something that exposes a security risk to your machines, you have to make a conscious decision to do so.&#160; We are secure by default so that you can feel confident in putting PowerShell on all your machines.&#160; Your risks are a function of the decisions you make after&#160; you install PowerShell and we\u2019ll educate you about the risks and benefits of those decisions.&#160; (Run \u201cGet-Help about_Execution_Policies\u201d to see a great example of that.)<\/p>\n<p>That is why remoting is turned off by default and you have to run Enable-PSRemoting to turn it on.&#160; <\/p>\n<p>When you do this, we create the default PSSessionConfiguration called Microsoft.PowerShell with a SDDL which only allows people with administrative rights to execute remote commands on that machine.&#160; You can see that by the following command:<\/p>\n<p><font color=\"#000080\" size=\"2\" face=\"Courier New\">PS&gt; Get-PSSessionConfiguration |fl * <\/font><\/p>\n<p><font color=\"#000080\" size=\"2\" face=\"Courier New\">Name&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; : microsoft.powershell     <br \/>Filename&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; : %windir%\\system32\\pwrshplugin.dll      <br \/>SDKVersion&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; : 1      <br \/>XmlRenderingType&#160;&#160;&#160;&#160;&#160;&#160; : text      <br \/>lang&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; : en-US      <br \/>PSVersion&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; : 2.0      <br \/>ResourceUri&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; : <\/font><a href=\"http:\/\/schemas.microsoft.com\/powershell\/microsoft.powershell\"><font color=\"#000080\" size=\"2\" face=\"Courier New\">http:\/\/schemas.microsoft.com\/powershell\/microsoft.powershell<\/font><\/a>    <br \/><font color=\"#000080\" size=\"2\" face=\"Courier New\">SupportsOptions&#160;&#160;&#160;&#160;&#160;&#160;&#160; : true     <br \/>Capability&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; : {Shell}      <br \/>xmlns&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; : <\/font><a href=\"http:\/\/schemas.microsoft.com\/wbem\/wsman\/1\/config\/PluginConfiguration\"><font color=\"#000080\" size=\"2\" face=\"Courier New\">http:\/\/schemas.microsoft.com\/wbem\/wsman\/1\/config\/PluginConfiguration<\/font><\/a>    <br \/><font color=\"#000080\" size=\"2\" face=\"Courier New\">Uri&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; : <\/font><a href=\"http:\/\/schemas.microsoft.com\/powershell\/Microsoft.PowerShell\"><font color=\"#000080\" size=\"2\" face=\"Courier New\">http:\/\/schemas.microsoft.com\/powershell\/Microsoft.PowerShell<\/font><\/a>    <br \/><font color=\"#000080\" size=\"2\" face=\"Courier New\">ExactMatch&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; : false     <br \/><font color=\"#ff0000\">SecurityDescriptorSddl : O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)       <br \/>Permission&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; : BUILTIN\\Administrators AccessAllowed<\/font><\/font><\/p>\n<p>&#160;<\/p>\n<p>If you decide you want to allow others, what you do is run the command:   <\/p>\n<p><font color=\"#000080\" size=\"2\" face=\"Courier New\">PS&gt; <strong> Set-PSSessionConfiguration -Name Microsoft.PowerShell -showSecurityDescriptorUI <\/strong><\/font><\/p>\n<p><font color=\"#000080\" size=\"2\" face=\"Courier New\">Confirm     <br \/>Are you sure you want to perform this action?      <br \/>Performing operation &quot;Set-PSSessionConfiguration&quot; on Target &quot;Name: Microsoft.PowerShell&quot;.      <br \/>[Y] Yes&#160; [A] Yes to All&#160; [N] No&#160; [L] No to All&#160; [S] Suspend&#160; [?] Help (default is &quot;Y&quot;): y<\/font><\/p>\n<p><font color=\"#000080\" size=\"2\" face=\"Courier New\"><\/font><\/p>\n<p>Notice that this action could have a serious impact on your system so we ask you to confirm that you really want to do this.(In general we assume you know what you are doing and only bring up these nag-messages when we think it is super important that you not sleep walk through this one.&#160; You can always add a \u2013FORCE switch to bypass this message.)&#160; This brings up the following dialog box which allows you to give others the ability to run commands on that machine:   <\/p>\n<p><a href=\"https:\/\/msdnshared.blob.core.windows.net\/media\/TNBlogsFS\/BlogFileStorage\/blogs_msdn\/powershell\/WindowsLiveWriter\/YouDontHavetoBeAnAdministratortoRunRemot_ED2C\/image_2.png\"><img decoding=\"async\" style=\"border-bottom: 0px;border-left: 0px;border-top: 0px;border-right: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"https:\/\/msdnshared.blob.core.windows.net\/media\/TNBlogsFS\/BlogFileStorage\/blogs_msdn\/powershell\/WindowsLiveWriter\/YouDontHavetoBeAnAdministratortoRunRemot_ED2C\/image_thumb.png\" width=\"399\" height=\"483\" \/><\/a> <\/p>\n<p>&#160;<\/p>\n<p>Experiment!&#160; Enjoy!&#160; Engage! <\/p>\n<p>Jeffrey Snover [MSFT]   <br \/>Distinguished Engineer    <br \/>Visit the Windows PowerShell Team blog at:&#160;&#160;&#160; <a href=\"http:\/\/blogs.msdn.com\/PowerShell\">http:\/\/blogs.msdn.com\/PowerShell<\/a>    <br \/>Visit the Windows PowerShell ScriptCenter at:&#160; <a href=\"http:\/\/www.microsoft.com\/technet\/scriptcenter\/hubs\/msh.mspx\">http:\/\/www.microsoft.com\/technet\/scriptcenter\/hubs\/msh.mspx<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>I was just read blog entry which complained about having to have administrative access to execute PowerShell commands against a remote server.&#160; This is not the case. We are \u201csecure by default\u201d which means that if you want to do something that exposes a security risk to your machines, you have to make a conscious [&hellip;]<\/p>\n","protected":false},"author":600,"featured_media":13641,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-3321","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-powershell"],"acf":[],"blog_post_summary":"<p>I was just read blog entry which complained about having to have administrative access to execute PowerShell commands against a remote server.&#160; This is not the case. We are \u201csecure by default\u201d which means that if you want to do something that exposes a security risk to your machines, you have to make a conscious [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/posts\/3321","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/users\/600"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/comments?post=3321"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/posts\/3321\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/media\/13641"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/media?parent=3321"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/categories?post=3321"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/tags?post=3321"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}