PowerShell security features
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/PowerShell-Docs · commit 56ef545 · +26 −11 lines · also on GitHub
11
---
22
description: PowerShell has several features designed to improve the security of your scripting environment.
3
−ms.date: 09/29/2023
3
+ms.date: 07/08/2024
44
title: PowerShell security features
55
---
66
# PowerShell security features
⋯ 9 unchanged lines
1616
1717
For more information see [about_Execution_Policies][02].
1818
19
+## Use of the SecureString class
20
+
21
+PowerShell has several cmdlets that support the use of the `System.Security.SecureString` class.
22
+And, as with any .NET class, you can use **SecureString** in your own scripts. However, Microsoft
23
+doesn't recommend using **SecureString** for new development. Microsoft recommends that you avoid
24
+using passwords and rely on other means to authenticate, such as certificates or Windows
25
+authentication.
26
+
27
+PowerShell continues to support the **SecureString** class for backward compatibility. Using a
28
+**SecureString** is still more secure than using a plain text string. By default, PowerShell doesn't
29
+show the unprotected value of a **SecureString** object. However, **SecureString** can be easily
30
+converted to a plain text string. For a full discussion about using **SecureString**, see the
31
+[System.Security.SecureString class][01] documentation.
32
+
1933
## Module and script block logging
2034
2135
Module Logging allows you to enable logging for selected PowerShell modules. This setting is
⋯ 19 unchanged lines
4155
PowerShell 7.3 extends the data that's sent to AMSI for inspection. It now includes all invocations
4256
of .NET method members.
4357
44
−For more information about AMSI, see [How AMSI helps][11].
58
+For more information about AMSI, see [How AMSI helps][09].
4559
4660
## Constrained language mode
4761
⋯ 2 unchanged lines
5064
5165
## Application Control
5266
53
−Windows 10 includes two technologies, [Windows Defender Application Control (WDAC)][10] and
67
+Windows 10 includes two technologies, [Windows Defender Application Control (WDAC)][08] and
5468
[AppLocker][07] that you can use to control applications. They allow you to create a lockdown
5569
experience to help secure your PowerShell environment.
5670
5771
For more information about how PowerShell supports AppLocker and WDAC, see
58
−[Using Windows Defender Application Control][01].
72
+[Using Windows Defender Application Control][10].
5973
6074
### Changes in PowerShell 7.4
6175
⋯ 28 unchanged lines
90104
91105
### Security Servicing Criteria
92106
93
−PowerShell follows the [Microsoft Security Servicing Criteria for Windows][13]. The table below
107
+PowerShell follows the [Microsoft Security Servicing Criteria for Windows][12]. The table below
94108
outlines the features that meet the servicing criteria and those that do not.
95109
96110
| Feature | Type |
⋯ 16 unchanged lines
113127
installed in the module's folder under `_manifest/spdx_2.2/manifest.spdx.json`.
114128
115129
For more information about this initiative, see the blog post
116
−[Generating Software Bills of Materials (SBOMs) with SPDX at Microsoft][12].
130
+[Generating Software Bills of Materials (SBOMs) with SPDX at Microsoft][11].
117131
118132
<!-- link references -->
119
−[01]: ./application-control.md
133
+[01]: /dotnet/fundamentals/runtime-libraries/system-security-securestring
120134
[02]: /powershell/module/microsoft.powershell.core/about/about_execution_policies
121135
[03]: /powershell/module/microsoft.powershell.core/about/about_group_policy_settings#turn-on-module-logging
122136
[04]: /powershell/module/microsoft.powershell.core/about/about_language_modes
123137
[05]: /powershell/module/microsoft.powershell.core/about/about_logging_non-windows
124138
[06]: /powershell/module/microsoft.powershell.core/about/about_logging_windows
125139
[07]: /windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker
126
−[10]: /windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control
127
−[11]: /windows/win32/amsi/how-amsi-helps
128
−[12]: https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/
129
−[13]: https://www.microsoft.com/msrc/windows-security-servicing-criteria
140
+[08]: /windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control
141
+[09]: /windows/win32/amsi/how-amsi-helps
142
+[10]: application-control.md
143
+[11]: https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/
144
+[12]: https://www.microsoft.com/msrc/windows-security-servicing-criteria
Microsoft's Markdown source from MicrosoftDocs/PowerShell-Docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:15 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.