Skip to content

Update guidance about lockdown mode #12696

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sdwheeler merged 2 commits into from
Jan 26, 2026
Merged

Update guidance about lockdown mode #12696

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
588434a
Update guidance about lockdown mode
sdwheeler Jan 23, 2026
0ad67c7
Feeback edits
sdwheeler Jan 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 16 additions & 9 deletions reference/7.4/Microsoft.PowerShell.Core/About/about_Language_Modes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
description: Explains language modes and their effect on PowerShell sessions.
Locale: en-US
ms.date: 01/18/2026
ms.date: 01/23/2026
no-loc: [FullLanguage, ConstrainedLanguage, RestrictedLanguage, NoLanguage]
online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes?view=powershell-7.4&WT.mc_id=ps-gethelp
schema: 2.0.0
Expand Down Expand Up @@ -60,7 +60,7 @@ ConstrainedLanguage
```

However, in sessions with `RestrictedLanguage` and `NoLanguage` modes, you
can't use the [member-access operator][02] (`.`) to get property values.
can't use the [member-access operator][03] (`.`) to get property values.
Instead, the error message reveals the language mode.

When you access `$ExecutionContext.SessionState.LanguageMode` in a
Expand Down Expand Up @@ -150,7 +150,7 @@ running a defined set of commands and can't directly access APIs, the file
system, or other system resources.

For more information, see [JEA Session configurations][01] and
[New-PSSessionConfigurationFile][05].
[New-PSSessionConfigurationFile][06].

## Language mode features and limitations

Expand Down Expand Up @@ -223,6 +223,12 @@ The features of `ConstrainedLanguage` mode are as follows:
- Users can get all properties of allowed types. Users can set the values of
properties only on allowed types.

> [!IMPORTANT]
> You must use `ConstrainedLanguage` mode in System Lockdown mode with App
Comment thread
sdwheeler marked this conversation as resolved.
> Control for Business to ensure that `ConstrainedLanguage` mode can't be
> bypassed. For more information about how PowerShell supports AppLocker and
> App Control, see [Use App Control to secure PowerShell][02].

The following .NET types are permitted in `ConstrainedLanguage` mode. Users can
get properties, invoke methods, and convert objects to these types.

Expand Down Expand Up @@ -346,12 +352,13 @@ Beginning in PowerShell 7.2, the `New-Object` cmdlet is disabled in

## See also

- [about_Session_Configuration_Files][03]
- [about_Session_Configurations][04]
- [about_Session_Configuration_Files][04]
- [about_Session_Configurations][05]

<!-- link references -->
[01]: /powershell/scripting/learn/remoting/jea/session-configurations
[02]: about_Member-Access_Enumeration.md
[03]: about_Session_Configuration_Files.md
[04]: about_Session_Configurations.md
[05]: xref:Microsoft.PowerShell.Core.New-PSSessionConfigurationFile
[02]: /powershell/scripting/security/app-control/application-control
[03]: about_Member-Access_Enumeration.md
[04]: about_Session_Configuration_Files.md
[05]: about_Session_Configurations.md
[06]: xref:Microsoft.PowerShell.Core.New-PSSessionConfigurationFile
25 changes: 16 additions & 9 deletions reference/7.5/Microsoft.PowerShell.Core/About/about_Language_Modes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
description: Explains language modes and their effect on PowerShell sessions.
Locale: en-US
ms.date: 01/18/2026
ms.date: 01/23/2026
no-loc: [FullLanguage, ConstrainedLanguage, RestrictedLanguage, NoLanguage]
online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes?view=powershell-7.5&WT.mc_id=ps-gethelp
schema: 2.0.0
Expand Down Expand Up @@ -60,7 +60,7 @@ ConstrainedLanguage
```

However, in sessions with `RestrictedLanguage` and `NoLanguage` modes, you
can't use the [member-access operator][02] (`.`) to get property values.
can't use the [member-access operator][03] (`.`) to get property values.
Instead, the error message reveals the language mode.

When you access `$ExecutionContext.SessionState.LanguageMode` in a
Expand Down Expand Up @@ -150,7 +150,7 @@ running a defined set of commands and can't directly access APIs, the file
system, or other system resources.

For more information, see [JEA Session configurations][01] and
[New-PSSessionConfigurationFile][05].
[New-PSSessionConfigurationFile][06].

## Language mode features and limitations

Expand Down Expand Up @@ -223,6 +223,12 @@ The features of `ConstrainedLanguage` mode are as follows:
- Users can get all properties of allowed types. Users can set the values of
properties only on allowed types.

> [!IMPORTANT]
> You must use `ConstrainedLanguage` mode in System Lockdown mode with App
> Control for Business to ensure that `ConstrainedLanguage` mode can't be
> bypassed. For more information about how PowerShell supports AppLocker and
> App Control, see [Use App Control to secure PowerShell][02].

The following .NET types are permitted in `ConstrainedLanguage` mode. Users can
get properties, invoke methods, and convert objects to these types.

Expand Down Expand Up @@ -346,12 +352,13 @@ Beginning in PowerShell 7.2, the `New-Object` cmdlet is disabled in

## See also

- [about_Session_Configuration_Files][03]
- [about_Session_Configurations][04]
- [about_Session_Configuration_Files][04]
- [about_Session_Configurations][05]

<!-- link references -->
[01]: /powershell/scripting/learn/remoting/jea/session-configurations
[02]: about_Member-Access_Enumeration.md
[03]: about_Session_Configuration_Files.md
[04]: about_Session_Configurations.md
[05]: xref:Microsoft.PowerShell.Core.New-PSSessionConfigurationFile
[02]: /powershell/scripting/security/app-control/application-control
[03]: about_Member-Access_Enumeration.md
[04]: about_Session_Configuration_Files.md
[05]: about_Session_Configurations.md
[06]: xref:Microsoft.PowerShell.Core.New-PSSessionConfigurationFile
25 changes: 16 additions & 9 deletions reference/7.6/Microsoft.PowerShell.Core/About/about_Language_Modes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
description: Explains language modes and their effect on PowerShell sessions.
Locale: en-US
ms.date: 01/18/2026
ms.date: 01/23/2026
no-loc: [FullLanguage, ConstrainedLanguage, RestrictedLanguage, NoLanguage]
online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes?view=powershell-7.6&WT.mc_id=ps-gethelp
schema: 2.0.0
Expand Down Expand Up @@ -60,7 +60,7 @@ ConstrainedLanguage
```

However, in sessions with `RestrictedLanguage` and `NoLanguage` modes, you
can't use the [member-access operator][02] (`.`) to get property values.
can't use the [member-access operator][03] (`.`) to get property values.
Instead, the error message reveals the language mode.

When you access `$ExecutionContext.SessionState.LanguageMode` in a
Expand Down Expand Up @@ -150,7 +150,7 @@ running a defined set of commands and can't directly access APIs, the file
system, or other system resources.

For more information, see [JEA Session configurations][01] and
[New-PSSessionConfigurationFile][05].
[New-PSSessionConfigurationFile][06].

## Language mode features and limitations

Expand Down Expand Up @@ -223,6 +223,12 @@ The features of `ConstrainedLanguage` mode are as follows:
- Users can get all properties of allowed types. Users can set the values of
properties only on allowed types.

> [!IMPORTANT]
> You must use `ConstrainedLanguage` mode in System Lockdown mode with App
> Control for Business to ensure that `ConstrainedLanguage` mode can't be
Comment thread
sdwheeler marked this conversation as resolved.
> bypassed. For more information about how PowerShell supports AppLocker and
> App Control, see [Use App Control to secure PowerShell][02].

The following .NET types are permitted in `ConstrainedLanguage` mode. Users can
get properties, invoke methods, and convert objects to these types.

Expand Down Expand Up @@ -346,12 +352,13 @@ Beginning in PowerShell 7.2, the `New-Object` cmdlet is disabled in

## See also

- [about_Session_Configuration_Files][03]
- [about_Session_Configurations][04]
- [about_Session_Configuration_Files][04]
- [about_Session_Configurations][05]

<!-- link references -->
[01]: /powershell/scripting/learn/remoting/jea/session-configurations
[02]: about_Member-Access_Enumeration.md
[03]: about_Session_Configuration_Files.md
[04]: about_Session_Configurations.md
[05]: xref:Microsoft.PowerShell.Core.New-PSSessionConfigurationFile
[02]: /powershell/scripting/security/app-control/application-control
[03]: about_Member-Access_Enumeration.md
[04]: about_Session_Configuration_Files.md
[05]: about_Session_Configurations.md
[06]: xref:Microsoft.PowerShell.Core.New-PSSessionConfigurationFile
4 changes: 3 additions & 1 deletion reference/docs-conceptual/security/remoting/jea/security-considerations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,7 +187,9 @@ configured session.
### Don't allow commands that can create new runspaces.

> [!WARNING]
> The `*-Job` cmdlets can create new runspaces without the restrictions.
> The Windows Compatibility feature in PowerShell 7 creates a new runspace to host Windows
> PowerShell. Don't allow any commands that would run via the Windows Compatibility feature. The
> `*-Job` cmdlets can create new runspaces without the restrictions.

### Don't allow the `Trace-Command` cmdlet.

Expand Down
4 changes: 3 additions & 1 deletion reference/docs-conceptual/security/securing-restricted-sessions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,9 @@ restricted session implementation.
### Don't allow commands that can create new runspaces

> [!WARNING]
> The `*-Job` cmdlets can create new runspaces without the restrictions.
> The Windows Compatibility feature in PowerShell 7 creates a new runspace to host Windows
> PowerShell. Don't allow any commands that would run via the Windows Compatibility feature. The
> `*-Job` cmdlets can create new runspaces without the restrictions.

### Don't allow the `Trace-Command` cmdlet.

Expand Down