How Can I Effectively Block PowerShell via GPO on Windows 11?

AppLocker can indeed work in constrained mode to limit PowerShell's functionalities, which could be a good compromise. Instead of just blocking PowerShell, think about allowing only signed scripts to run. This way, you retain usability without opening your systems to attacks.

Blocking PowerShell entirely might cause more issues than it solves. Many legitimate applications rely on it, and if you remove access, you might create difficulties for deployment and system management. Users typically can't execute anything they're not permitted to, so consider the need for PowerShell before restricting it completely.

Blocking PowerShell may indeed reduce risk, as it can be used for malicious activities. Just keep in mind that if a user can access cmd, they might still be able to launch PowerShell from there. So, a complete security strategy is necessary.

If blocking PowerShell through GPO isn't working, consider adjusting registry settings to enforce restrictions more effectively. If you're interested, I can provide the registry modifications that could help with that.

Another approach could be using Windows Firewall to prevent PowerShell from accessing the internet, which can mitigate some risks while keeping it available for necessary tasks. Disabling it completely could lead to frustrations among users, especially if they rely on scripts for regular functions.