The Windows PowerShell 2.0 feature must be disabled on the system.

An XCCDF Rule

Description

Windows PowerShell 5.0 added advanced logging features which can provide additional detail when malware has been run on a system. Disabling the Windows PowerShell 2.0 mitigates against a downgrade attack that evades the Windows PowerShell 5.0 script block logging feature.

ID: SV-253285r958478_rule
Version: WN11-00-000155
Severity: Medium
References: CCI-000381
Updated: 24 days ago

Remediation Templates

Disable "Windows PowerShell 2.0" on the system.

Run "Windows PowerShell" with elevated privileges (run as administrator).
Enter the following:
Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root
This command must disable both "MicrosoftWindowsPowerShellV2Root" and "MicrosoftWindowsPowerShellV2" which correspond to "Windows PowerShell 2.0" and "Windows PowerShell 2.0 Engine" respectively in "Turn Windows features on or off".

Alternately:
Search for "Features".
Select "Turn Windows features on or off".
De-select "Windows PowerShell 2.0".

The Windows PowerShell 2.0 feature must be disabled on the system.

Description

Remediation Templates

A Manual Procedure