Skip to content

Commit 588434a

Browse files
sdwheelersdwheeler
committed
Update guidance about lockdown mode
1 parent aa54d0e commit 588434a

5 files changed

Lines changed: 54 additions & 29 deletions

File tree

‎reference/7.4/Microsoft.PowerShell.Core/About/about_Language_Modes.md‎

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
description: Explains language modes and their effect on PowerShell sessions.
33
Locale: en-US
4-
ms.date: 01/18/2026
4+
ms.date: 01/23/2026
55
no-loc: [FullLanguage, ConstrainedLanguage, RestrictedLanguage, NoLanguage]
66
online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes?view=powershell-7.4&WT.mc_id=ps-gethelp
77
schema: 2.0.0
@@ -60,7 +60,7 @@ ConstrainedLanguage
6060
```
6161

6262
However, in sessions with `RestrictedLanguage` and `NoLanguage` modes, you
63-
can't use the [member-access operator][02] (`.`) to get property values.
63+
can't use the [member-access operator][03] (`.`) to get property values.
6464
Instead, the error message reveals the language mode.
6565

6666
When you access `$ExecutionContext.SessionState.LanguageMode` in a
@@ -150,7 +150,7 @@ running a defined set of commands and can't directly access APIs, the file
150150
system, or other system resources.
151151

152152
For more information, see [JEA Session configurations][01] and
153-
[New-PSSessionConfigurationFile][05].
153+
[New-PSSessionConfigurationFile][06].
154154

155155
## Language mode features and limitations
156156

@@ -223,6 +223,12 @@ The features of `ConstrainedLanguage` mode are as follows:
223223
- Users can get all properties of allowed types. Users can set the values of
224224
properties only on allowed types.
225225

226+
> [!IMPORTANT]
227+
> You must use `ConstrainedLanguage` mode in System Lockdown mode with App
228+
> Control for Business to ensure that `ConstrainedLanguage` mode can't be
229+
> bypassed. For more information about how PowerShell supports AppLocker and
230+
> App Control, see [Use App Control to secure PowerShell][02].
231+
226232
The following .NET types are permitted in `ConstrainedLanguage` mode. Users can
227233
get properties, invoke methods, and convert objects to these types.
228234

@@ -346,12 +352,13 @@ Beginning in PowerShell 7.2, the `New-Object` cmdlet is disabled in
346352

347353
## See also
348354

349-
- [about_Session_Configuration_Files][03]
350-
- [about_Session_Configurations][04]
355+
- [about_Session_Configuration_Files][04]
356+
- [about_Session_Configurations][05]
351357

352358
<!-- link references -->
353359
[01]: /powershell/scripting/learn/remoting/jea/session-configurations
354-
[02]: about_Member-Access_Enumeration.md
355-
[03]: about_Session_Configuration_Files.md
356-
[04]: about_Session_Configurations.md
357-
[05]: xref:Microsoft.PowerShell.Core.New-PSSessionConfigurationFile
360+
[02]: /powershell/scripting/security/app-control/application-control
361+
[03]: about_Member-Access_Enumeration.md
362+
[04]: about_Session_Configuration_Files.md
363+
[05]: about_Session_Configurations.md
364+
[06]: xref:Microsoft.PowerShell.Core.New-PSSessionConfigurationFile

‎reference/7.5/Microsoft.PowerShell.Core/About/about_Language_Modes.md‎

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
description: Explains language modes and their effect on PowerShell sessions.
33
Locale: en-US
4-
ms.date: 01/18/2026
4+
ms.date: 01/23/2026
55
no-loc: [FullLanguage, ConstrainedLanguage, RestrictedLanguage, NoLanguage]
66
online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes?view=powershell-7.5&WT.mc_id=ps-gethelp
77
schema: 2.0.0
@@ -60,7 +60,7 @@ ConstrainedLanguage
6060
```
6161

6262
However, in sessions with `RestrictedLanguage` and `NoLanguage` modes, you
63-
can't use the [member-access operator][02] (`.`) to get property values.
63+
can't use the [member-access operator][03] (`.`) to get property values.
6464
Instead, the error message reveals the language mode.
6565

6666
When you access `$ExecutionContext.SessionState.LanguageMode` in a
@@ -150,7 +150,7 @@ running a defined set of commands and can't directly access APIs, the file
150150
system, or other system resources.
151151

152152
For more information, see [JEA Session configurations][01] and
153-
[New-PSSessionConfigurationFile][05].
153+
[New-PSSessionConfigurationFile][06].
154154

155155
## Language mode features and limitations
156156

@@ -223,6 +223,12 @@ The features of `ConstrainedLanguage` mode are as follows:
223223
- Users can get all properties of allowed types. Users can set the values of
224224
properties only on allowed types.
225225

226+
> [!IMPORTANT]
227+
> You must use `ConstrainedLanguage` mode in System Lockdown mode with App
228+
> Control for Business to ensure that `ConstrainedLanguage` mode can't be
229+
> bypassed. For more information about how PowerShell supports AppLocker and
230+
> App Control, see [Use App Control to secure PowerShell][02].
231+
226232
The following .NET types are permitted in `ConstrainedLanguage` mode. Users can
227233
get properties, invoke methods, and convert objects to these types.
228234

@@ -346,12 +352,13 @@ Beginning in PowerShell 7.2, the `New-Object` cmdlet is disabled in
346352

347353
## See also
348354

349-
- [about_Session_Configuration_Files][03]
350-
- [about_Session_Configurations][04]
355+
- [about_Session_Configuration_Files][04]
356+
- [about_Session_Configurations][05]
351357

352358
<!-- link references -->
353359
[01]: /powershell/scripting/learn/remoting/jea/session-configurations
354-
[02]: about_Member-Access_Enumeration.md
355-
[03]: about_Session_Configuration_Files.md
356-
[04]: about_Session_Configurations.md
357-
[05]: xref:Microsoft.PowerShell.Core.New-PSSessionConfigurationFile
360+
[02]: /powershell/scripting/security/app-control/application-control
361+
[03]: about_Member-Access_Enumeration.md
362+
[04]: about_Session_Configuration_Files.md
363+
[05]: about_Session_Configurations.md
364+
[06]: xref:Microsoft.PowerShell.Core.New-PSSessionConfigurationFile

‎reference/7.6/Microsoft.PowerShell.Core/About/about_Language_Modes.md‎

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
description: Explains language modes and their effect on PowerShell sessions.
33
Locale: en-US
4-
ms.date: 01/18/2026
4+
ms.date: 01/23/2026
55
no-loc: [FullLanguage, ConstrainedLanguage, RestrictedLanguage, NoLanguage]
66
online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes?view=powershell-7.6&WT.mc_id=ps-gethelp
77
schema: 2.0.0
@@ -60,7 +60,7 @@ ConstrainedLanguage
6060
```
6161

6262
However, in sessions with `RestrictedLanguage` and `NoLanguage` modes, you
63-
can't use the [member-access operator][02] (`.`) to get property values.
63+
can't use the [member-access operator][03] (`.`) to get property values.
6464
Instead, the error message reveals the language mode.
6565

6666
When you access `$ExecutionContext.SessionState.LanguageMode` in a
@@ -150,7 +150,7 @@ running a defined set of commands and can't directly access APIs, the file
150150
system, or other system resources.
151151

152152
For more information, see [JEA Session configurations][01] and
153-
[New-PSSessionConfigurationFile][05].
153+
[New-PSSessionConfigurationFile][06].
154154

155155
## Language mode features and limitations
156156

@@ -223,6 +223,12 @@ The features of `ConstrainedLanguage` mode are as follows:
223223
- Users can get all properties of allowed types. Users can set the values of
224224
properties only on allowed types.
225225

226+
> [!IMPORTANT]
227+
> You must use `ConstrainedLanguage` mode in System Lockdown mode with App
228+
> Control for Business to ensure that `ConstrainedLanguage` mode can't be
229+
> bypassed. For more information about how PowerShell supports AppLocker and
230+
> App Control, see [Use App Control to secure PowerShell][02].
231+
226232
The following .NET types are permitted in `ConstrainedLanguage` mode. Users can
227233
get properties, invoke methods, and convert objects to these types.
228234

@@ -346,12 +352,13 @@ Beginning in PowerShell 7.2, the `New-Object` cmdlet is disabled in
346352

347353
## See also
348354

349-
- [about_Session_Configuration_Files][03]
350-
- [about_Session_Configurations][04]
355+
- [about_Session_Configuration_Files][04]
356+
- [about_Session_Configurations][05]
351357

352358
<!-- link references -->
353359
[01]: /powershell/scripting/learn/remoting/jea/session-configurations
354-
[02]: about_Member-Access_Enumeration.md
355-
[03]: about_Session_Configuration_Files.md
356-
[04]: about_Session_Configurations.md
357-
[05]: xref:Microsoft.PowerShell.Core.New-PSSessionConfigurationFile
360+
[02]: /powershell/scripting/security/app-control/application-control
361+
[03]: about_Member-Access_Enumeration.md
362+
[04]: about_Session_Configuration_Files.md
363+
[05]: about_Session_Configurations.md
364+
[06]: xref:Microsoft.PowerShell.Core.New-PSSessionConfigurationFile

‎reference/docs-conceptual/security/remoting/jea/security-considerations.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -187,7 +187,9 @@ configured session.
187187
### Don't allow commands that can create new runspaces.
188188

189189
> [!WARNING]
190-
> The `*-Job` cmdlets can create new runspaces without the restrictions.
190+
> The Windows Compatibility feature in PowerShell 7 creates a new runspace to host Windows
191+
> PowerShell. Don't allow any commands that would run via the Windows Compatibility feature. The
192+
> `*-Job` cmdlets can create new runspaces without the restrictions.
191193
192194
### Don't allow the `Trace-Command` cmdlet.
193195

‎reference/docs-conceptual/security/securing-restricted-sessions.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,9 @@ restricted session implementation.
3939
### Don't allow commands that can create new runspaces
4040

4141
> [!WARNING]
42-
> The `*-Job` cmdlets can create new runspaces without the restrictions.
42+
> The Windows Compatibility feature in PowerShell 7 creates a new runspace to host Windows
43+
> PowerShell. Don't allow any commands that would run via the Windows Compatibility feature. The
44+
> `*-Job` cmdlets can create new runspaces without the restrictions.
4345
4446
### Don't allow the `Trace-Command` cmdlet.
4547

0 commit comments

Comments
 (0)