Windows 10: I can't run Windows PowerShell

Hey guys, can you help me?
I can't run WIndows Powershell (even as admin or not),
it say "C:\Users\ASUS K84L\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk",


i try to run via directory and then windows say "This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator."



Any idea?
Any help would be appreciated. Sorry with my bad english

:)

 

Can't run Powershell or cmd.exe as administrator

I had the same problem to say until i did this:

1. Go to the search bar

2. Type cmd admin

3. Right click and run as admin

4. It should pop up the run Admin thing now click yes and your done!

I dont know why this is working and not just typing cmd and right click and run as admin. I just typed cmd admin and runned it as admin.

 

Can't run Powershell or cmd.exe as administrator

I had the same problem on the same day as you (Jan 10 2018). Then I remembered that earlier in the day Avast had put a file consent.exe in its virus chest. I restored that file and everything worked as normal again. So I guess that Avast is throwing up
a false positive for that file at the moment and we both were the victims. If you are not using Avast, it might nevertheless be worth checking your consent.exe file. I do hope that this helps.

 

The message is clear: Restricted access has been set for certain(s) program(s). Do you own the computer? Are you an administrator?

And of course: Is your machine infected? *Shock

Try to create a new user account and check if the issue persists.

Since you're running Win10 Pro, you have access to Group Policy. There is an Administrative Template "Don't run specified Windows Applications". Run it.

See https://www.microsoft.com/en-us/down....aspx?id=48257
and https://blogs.technet.microsoft.com/...ive-templates/

 

Maybe I came up too strong. Forget about Administrative Templates for the moment.

Instead, using the registry editor, navigate to: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies
and look at what's there, like a key named PowerShell in your case.

 

That message looks similar to what I have, because I have blocked PS from running, like this:

Code: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "DisallowRun" /t REG_DWORD /d "1" /f reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "1" /t REG_SZ /d "powershell.exe" /f reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "2" /t REG_SZ /d "powershell_ise.exe" /f[/quote]

 

yeah, i found it



Should I delete that registry key?

 

[/quote] Is there a reason you do not want powershell to be able to run?

 

Yes.

Malware prevention, it is not like PS is required by anything. I actually remove PS as well.

Lets Unpack: Dridex Loader | MalwareTech
15 Ways to Bypass the PowerShell Execution Policy
The rise of .NET and powershell malware - Securelist
UAC Bypass Using eventvwr.exe and Registry Hijacking | enigma0x3

 

Sure, .net tools could be used to craft attacks, but I am pretty sure very few boxes were compromised by people going through weaknesses in powershell. I could see a questionable user, who insists on running as an admin, executing a powershell script which does compromise the system.

I am a big powershell user, and am going to GUI less Windows server which must be managed by powershell remotely. Different strokes I guess.

 

I have delete that registry, but after I restart my laptop, that registry appear again



i think, maybe the main problem is on Task Scheduler or Services which cause registry re-adding again

 

Check, if it is disabled in group policy:

Gpedit.msc\User Configuration\Administrative Templates\System\Don't run specified Windows applications

Don,t Run Specified Windows Application, Run Only Specified Windows Application - YouTube

 

I didn't touch anything on Group Policy, so it's still default configuration



Something's running that is adding it. Personally, i don't mind if i have to delete that registry first before I use/open PowerShell, but I just curious with it

 

What security software do you use?

You could check out in Autoruns for anything odd.

 

Hi, it's solved now, the only one cause that is my additional AV (SMADAV) block powershell since windows start.
Just set Allow on SMADAV and everything goes well



Thank you for all your help, i will mark this thread solved *Smile