PowerShell security features
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/PowerShell-Docs · commit 0d00dc3 · +40 −1 lines · also on GitHub
11
---
22
description: PowerShell has several features designed to improve the security of your scripting environment.
3
−ms.date: 05/22/2025
3
+ms.date: 08/18/2025
44
title: PowerShell security features
55
---
66
# PowerShell security features
⋯ 84 unchanged lines
9191
The creation and publishing of the SBOM is the first step to modernize Federal Government
9292
cybersecurity and enhance software supply chain security. For more information about this
9393
initiative, see the blog post [Generating SBOMs with SPDX at Microsoft][11].
94
+
95
+## Secure data transfer in PowerShell remoting
96
+
97
+Prior to PowerShell v7.6-preview5, a `Session_Key` is used to encrypt a **SecureString** before
98
+sending it a PowerShell remote session. The PowerShell Remoting Protocol (PSRP) performs a
99
+key exchange between client and server when a `SecureString` object needs to be
100
+transferred. The exchange involves the following steps:
101
+
102
+1. The client side generates a public/private key pair and sends the public key to the server.
103
+1. The server generates a session key for symmetric encryption.
104
+1. The server uses the public key to encrypt the session key and sends it to the client.
105
+1. Both the client and server use the new session key to encrypt a **SecureString** object.
106
+
107
+The PowerShell Remoting Protocol (PSRP) uses the `RSAEncryptionPadding.Pkcs1` algorithm during the
108
+key exchange. The algorithm is **NOT** secure, so the key exchange doesn't provide any extra
109
+security.
110
+
111
+> [!IMPORTANT]
112
+> You must use a secure transport layer to ensure secure data transfer over PSRP.
113
+
114
+Beginning in PowerShell v7.6-preview5, the key exchange was deprecated. The version of PSRP was
115
+incremented to v2.4 and includes the following changes:
116
+
117
+- The following PSRP messages are deprecated when both client and server are v2.4 or higher:
118
+
119
+ - PUBLIC_KEY
120
+ - PUBLIC_KEY_REQUEST
121
+ - ENCRYPTED_SESSION_KEY
122
+
123
+- The encryption and decryption steps for `SecureString` are skipped when both client and server are
124
+ v2.4 or higher.
125
+
126
+This change is backward compatible.
127
+
128
+- For old clients or servers (v2.3 or lower), the key exchange is still used when needed.
129
+- PSRP can use a named pipe remote sessions when both client and server are on the same machine.
130
+ Since it's possible for a remote client to connect to named pipe and the data is no longer
131
+ encrypted with a session key, the named pipe (used for `Enter-PSHostProcess`) rejects the remote
132
+ client.
94133
95134
## Security Servicing Criteria
96135
⋯ 27 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/PowerShell-Docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:15 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.