Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 17:50 UTC Customize Public modeDiscuss ChangeIntel on Discord

PowerShell remoting security

This page's changes and edits · All guidance changes

Microsoft's edit ·

Update link to FireEye report (#11570)

Microsoft's commit message in MicrosoftDocs/PowerShell-Docs · commit c2cc6d5 · +2 −2 lines · also on GitHub

11 ---
22 description: This document covers security concerns, recommendations, and best practices when using PowerShell Remoting.
3 −ms.date: 10/23/2023
3 +ms.date: 12/07/2024
44 title: Security considerations for PowerShell Remoting using WinRM
55 ---
66
⋯ 135 unchanged lines
142142 [03]: /windows/win32/secauthn/microsoft-ntlm
143143 [04]: /windows/win32/winrm/portal
144144 [05]: https://www.dmtf.org/sites/default/files/standards/documents/DSP0226_1.2.0.pdf
145 −[06]: https://www.mandiant.com/resources/investigating-powershell-attacks
145 +[06]: https://www.mandiant.com/sites/default/files/2021-09/wp-lazanciyan-investigating-powershell-attacks.pdf
146146 [07]: PS-remoting-second-hop.md
147147 [08]: running-remote-commands.md

Microsoft's Markdown source from MicrosoftDocs/PowerShell-Docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:53 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 17:50 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current