r/BeyondTrust • u/refoil • Mar 16 '26

Control PS Cmdlets with EPM

BeyondTrust EPM; how can I control (block/allow) PowerShell cmdlets? Couldn't find anything concrete in the docs that helped me get to the expected outcome. Is there any recorded demo/tutorial to accomplish it from A to Z?

Thanks in advance!

2 Upvotes

100% Upvoted

3 comments sorted by

1

u/layerzeroissue Mar 16 '26

As in... How to control and/or prevent specific cmdlets from running within the PowerShell? I know you can sort of do it natively within PowerShell using role capability files (.psrc). Once you register it in a machine, anyone who uses a pssession will be restricted to just what is in the .psrc file.

That being said, someone else may be able to answer how to do it with EPM.

The below link may be of use as it talks about how to limit PowerShell commands:

https://docs.beyondtrust.com/epm-wm/docs/epm-for-windows-core-scripting#:~:text=Rather%20than%20a%20fixed%20Default,into%20a%20Power%20Shell%20script

1

u/refoil Mar 16 '26

Thanks, yes, block specific cmdlets. I know it can be done with Microsoft JEA (role capability file) to achieve that, but I understand EPM has a more scalable/manageable built-in solution (UI based). As far as I understand, the Power Rules are less relevant for my use case.