How to Configure and Manage PowerShell in Windows 11 for Administrators

Steps to Update PowerShellGet

To take advantage of the latest features of the PowerShell Gallery, make sure the PowerShellGet module is updated to the latest version. Here are the steps:

1. Check the current version of PowerShellGet:

Get-Module -Name PowerShellGet -ListAvailable

2. If the existing version is old, update it with the following command:

Install-Module -Name PowerShellGet -Force -Scope CurrentUser

3. Make sure the module is updated by checking the version again.

Basic Commands for Searching and Adding Modules

Here are some basic commands for managing modules in PowerShell:

1. Searching for the module in the PowerShell Gallery:

Find-Module -Name ModulName

2. Installing the module:

Install-Module -Name ModulName -Scope PenggunaSaatIni

3. View the modules that are already installed on the system:

Get-InstalledModule

4. Deleting modules:

Uninstall-Module -Name ModulName

5. Updating the module:

Update-Module -Name ModulName

Implement Group Policy for PowerShell

Group Policy is an important feature in Windows that allows administrators to set settings and policies across computers in an Active Directory-based network. With Group Policy, you can control various aspects of the operating system, including PowerShell configuration, giving you more control over security, logging, and default behavior.

In the context of PowerShell, Group Policy allows:

• Applying security policies to scripts.
• PowerShell activity logging management for audits.
• Provision of a uniform work environment across computers in the organization.

Configurable Policies Through Group Policy for PowerShell

1. Execution Policy

This policy specifies permissions to run PowerShell scripts. You can configure the security level by selecting one of the following policies:

• Restricted: Doesn’t allow script execution.
• RemoteSigned: Scripts from a remote must have a valid digital signature.
• Unrestricted: All scripts can be run without restrictions.

Steps to Set Execution Policy in Group Policy:

• Open Group Policy Management Console (GPMC).
• Navigate to Computer Configuration >  Administrative Templates > Windows Components > Windows PowerShell.
• Set the policy Turn on Script Execution and select the desired policy.

Example of a manual command:

If you’re not using Group Policy, you can set the policy directly in PowerShell:

Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned

2. Module Recording

This policy allows the logging of activities from specific modules used in PowerShell. This is especially useful for security audits or troubleshooting.

How to Set Module Logging in Group Policy:

• Open Windows PowerShell >  Turn on Module Logging.
• Add the module for which you want to enable logging, such as NTFSSecurity or ActiveDirectory.

3. Script Block Logging

This policy logs every block of scripts that are executed in PowerShell, including more complex commands and scripts. This feature helps in detecting suspicious activity or script-based attacks.

How to set up script block logging:

• Access policies Turn on PowerShell Script Block Logging.
• Enable the policy to log all script block executions.

4. Transcription

This policy records all PowerShell sessions into log files, including inputs and outputs. It is very effective for auditing and debugging.

How to Set Up Transcription:

• Navigate to Turn on PowerShell Transcription in Group Policy.
• Specify the location where the logs are stored, for example: C:\Transcripts\.
• The log results will record every session executed by the user.