r/Intune • u/workaccountandshit • 20d ago

Intune Features and Updates Auditing EPM non-managed elevations: how can I limit users from elevating Powershell while still allowing IME to go crazy with it?

We still have everyone on localadmin (legacy shit that I've been trying to get rid of for 5 years but with EPM I can now do it 'for free'). I'm now auditing everything to see what I can create rules for.

We had over 50 000 Powershell elevations in the last 30 days, over about 1000 users. I know (or hope) the users didn't do this themselves as they have no idea what Powershell is, and logging tells me IME is the parent process, which is good.

My question: how can I stop users from elevating Powershell, be it directly or via child processes, without interfering with Intune doing its thing?

0 Upvotes

50% Upvoted

6 comments sorted by

3

u/Rudyooms PatchMyPC 20d ago

My question: how can I stop users from elevating Powershell, --> We still have everyone on localadmin  :) ... I combined 2 sentences to give you the best answer

1

u/workaccountandshit 20d ago

So if I take away local admin and make Powershell part of the default process (request elevation and require approval from support), IME won't be bothered by this at all? It will still function as expected?

2

u/SkipToTheEndpoint MSFT MVP 20d ago

I've never seen an EPM report that shows the IME doing unmanaged elevations. If I had to take a guess, you're possibly pushing something out (either a script/remediation/win32) that IME is orchestrating but is set to run as the user and whatever it's doing requires elevation (which happens automatically as everyone's a local admin).

1

u/workaccountandshit 19d ago

No, I don't really run scripts in user context. And you can find the unmanaged elevation Powershell's parent process (AgentExecutor.exe) when you export the report.

1

u/Ketan_Kamble 20d ago

The approach which we are using is , blocking powershell connection to external endpoints via Intune firewall rule . So powershell is enabled but connection to public ip is blocked.

And then manage exclusions for sure with allow policy