PowerShell security features
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/PowerShell-Docs · commit 77b22df · +25 −10 lines · also on GitHub
11
---
22
description: PowerShell has several features designed to improve the security of your scripting environment.
3
−ms.date: 08/18/2025
3
+ms.date: 07/17/2026
44
title: PowerShell security features
55
---
66
# PowerShell security features
⋯ 64 unchanged lines
7171
loading module files to prevent arbitrary code execution on the system.
7272
7373
App Control for Business is designed as a security feature under the servicing criteria defined by
74
−the Microsoft Security Response Center (MSRC). App Control is the preferred application control
75
−system for Windows.
74
+the Microsoft Security Response Center (MSRC). App Control for Business is the preferred application
75
+control system for Windows. For more information about how PowerShell supports AppLocker and App
76
+Control for Business, see [Use App Control to secure PowerShell][10].
7677
77
−For more information about how PowerShell supports AppLocker and App Control, see
78
−[Use App Control to secure PowerShell][10].
78
+AppLocker is a legacy application control system that's still supported in and Windows 11. AppLocker
79
+isn't a security feature under the servicing criteria defined by MSRC. For more information about
80
+servicing criteria, see [Microsoft Security Servicing Criteria for Windows][12].
7981
8082
### System Lockdown mode
8183
⋯ 64 unchanged lines
146148
147149
## Security Servicing Criteria
148150
149
−PowerShell follows the [Microsoft Security Servicing Criteria for Windows][12]. Only security
150
−features meet the criteria for servicing.
151
+A security boundary provides a logical separation between the code and data of security domains with
152
+different levels of trust. Security features build upon security boundaries to provide robust
153
+protection against specific threats. For security features in this category, Microsoft intends to
154
+address reported vulnerabilities through servicing.
151155
152
−Security features
156
+Security features of PowerShell
153157
154158
- System Lockdown with App Control for Business
155159
- Constrained language mode with App Control for Business
156160
157
−Defense in depth features
161
+For more information, see the [Microsoft Security Servicing Criteria for Windows][12] documentation.
158162
163
+In some cases, a security feature may provide protection against a threat without being able to
164
+provide a robust defense. These security features are typically referred to as _defense-in-depth_
165
+features or mitigations because they provide additional security but may have by-design limitations
166
+that prevent them from fully mitigating a threat. A bypass for a defense-in-depth security feature
167
+by itself does not pose a direct risk because an attacker must also have found a vulnerability that
168
+affects a security boundary, or they must rely on additional techniques, such as social engineering
169
+to achieve the initial stage of a device compromise.
170
+
171
+Defense-in-depth features of PowerShell
172
+
173
+- Constrained language mode with AppLocker or configured through session configuration or by
174
+ manually setting `$ExecutionContext.SessionState.LanguageMode`
159175
- System Lockdown with AppLocker
160
−- Constrained language mode with AppLocker
161176
- Execution Policy
162177
163178
<!-- link references -->
⋯ 12 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/PowerShell-Docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:15 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.