Restricting PowerShell Remoting & WinRM Across Hybrid Windows Fleets
Eliminating lateral movement paths used by ransomware and offensive penetration testing frameworks across corporate endpoints.
The Adversary's Favorite Management Protocol
PowerShell Remoting over WinRM (ports 5985/5986) provides administrators with powerful remote management capabilities—but it provides threat actors and ransomware operators with the exact same power to execute lateral commands silently across subnets.
Disabling WinRM on User Endpoints
Workstations and laptops have zero operational requirement to accept inbound WinRM connections from other client machines. Standardizing Group Policies or Intune configuration profiles to disable the WinRM service on all non-server endpoints stops lateral spreading in its tracks.
Enforcing Constrained Language Mode and Script Block Logging
For servers where PowerShell is required, enable PowerShell Script Block Logging (Event ID 4104) and Transcription. Implement AppLocker or Windows Defender Application Control (WDAC) to enforce Constrained Language Mode, preventing attackers from invoking unmanaged COM objects and APIs.
Related Articles & Advisories
Microsoft 365 Security Baseline: Essential Defensive Hardening Before Audits
A technical walkthrough of default misconfigurations in Microsoft 365 and Entra ID, and the practical controls needed to prevent business email compromise and identity takeover.
Architecting Zero-Trust Conditional Access in Entra ID for Modern Workforces
A deep dive into constructing modular, non-conflicting Conditional Access policies that enforce least-privilege context without locking out legitimate personnel.
Defeating Adversary-in-the-Middle (AiTM) Phishing & Session Token Theft
How modern reverse proxy toolkits steal active browser session cookies and bypass standard SMS/TOTP MFA, and the specific controls needed to prevent token replay.