title: Prevent bypassing PowerShell execution policy
body: <p>We have PowerShell installed on our <a href="https://en.wikipedia.org/wiki/Remote_Desktop_Services" rel="nofollow noreferrer">RDS</a> environment. It's currently being used for tasks like remote management and <a href="https://en.wikipedia.org/wiki/Microsoft_App-V" rel="nofollow noreferrer">App-V</a> virtual application publishing. To my understanding, it's fairly easy to bypass a restricted execution policy.</p>
  
  <p>I can't however find any useful information on preventing bypassing the execution policy (or making it a lot harder). I was thinking about using file screening (AppLocker) for blocking PowerShell files, but I guess then attackers could just use a VBA script attached to an Microsoft Office file to execute a PowerShell script.</p>
  
  <p>For now we focus on monitoring, but I would like more attention on preventing.</p>