ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 22:55 UTC Customize Public modeDiscuss ChangeIntel on Discord

PowerShell security features

This page's changes and edits · All guidance changes

Microsoft's edit ·

Reorg security docs and add more WDAC content (#11416)

Microsoft's commit message in MicrosoftDocs/PowerShell-Docs · commit bf63c8b · +37 −59 lines · also on GitHub

11 ---
22 description: PowerShell has several features designed to improve the security of your scripting environment.
3 −ms.date: 07/08/2024
3 +ms.date: 09/19/2024
44 title: PowerShell security features
55 ---
66 # PowerShell security features
⋯ 26 unchanged lines
3333 ## Module and script block logging
3434
3535 Module Logging allows you to enable logging for selected PowerShell modules. This setting is
36 −effective in all sessions on the computer. Pipeline execution events for the specified modules are
37 −recorded in the Windows PowerShell log in Event Viewer.
36 +effective in all sessions on the computer. PowerShell records pipeline execution events for the
37 +specified modules in the Windows PowerShell log in Event Viewer.
3838
3939 Script Block Logging enables logging for the processing of commands, script blocks, functions, and
40 −scripts - whether invoked interactively, or through automation. This information is logged to the
41 −**Microsoft-Windows-PowerShell/Operational** event log.
40 +scripts - whether invoked interactively, or through automation. PowerShell logs this information to
41 +the **Microsoft-Windows-PowerShell/Operational** event log.
4242
4343 For more information, see the following articles:
4444
⋯ 3 unchanged lines
4848
4949 ## AMSI Support
5050
51 −The Windows Antimalware Scan Interface (AMSI) is an API that allows application actions to be passed
52 −to an antimalware scanner, such as Windows Defender, to be scanned for malicious payloads. Beginning
51 +The Windows Antimalware Scan Interface (AMSI) is an API that allows applications to pass actions to
52 +an antimalware scanner, such as Windows Defender, to scan for malicious payloads. Beginning
5353 with PowerShell 5.1, PowerShell running on Windows 10 (and higher) passes all script blocks to AMSI.
5454
5555 PowerShell 7.3 extends the data that's sent to AMSI for inspection. It now includes all invocations
⋯ 3 unchanged lines
5959
6060 ## Constrained language mode
6161
62 −**ConstrainedLanguage** mode protects your system by limiting the cmdlets and .NET types that can be
63 −used in a PowerShell session. For a full description, see [about_Language_Modes][04].
62 +**ConstrainedLanguage** mode protects your system by limiting the cmdlets and .NET types
63 +allowed in a PowerShell session. For a full description, see [about_Language_Modes][04].
6464
6565 ## Application Control
6666
6767 Windows 10 includes two technologies, [Windows Defender Application Control (WDAC)][08] and
68 −[AppLocker][07] that you can use to control applications. They allow you to create a lockdown
69 −experience to help secure your PowerShell environment.
68 +[AppLocker][07] that you can use to control applications. PowerShell detects if a system wide
69 +application control policy is being enforced. The policy applies certain behaviors when running
70 +script blocks, script files, or loading module files to prevent arbitrary code execution on the
71 +system.
7072
73 +WDAC is designed as a security feature under the servicing criteria defined by the Microsoft
74 +Security Response Center (MSRC). WDAC is the preferred application control system for Windows.
75 +
7176 For more information about how PowerShell supports AppLocker and WDAC, see
7277 [Using Windows Defender Application Control][10].
7378
74 −### Changes in PowerShell 7.4
75 −
76 −On Windows, when PowerShell runs under a Windows Defender Application Control (WDAC) policy, it
77 −changes its behavior based on the defined security policy. Under a WDAC policy, PowerShell runs
78 −trusted scripts and modules allowed by the policy in Full Language mode. All other scripts and
79 −script blocks are untrusted and run in Constrained Language mode. PowerShell throws errors when the
80 −untrusted scripts attempt to perform disallowed actions. It's difficult to know why a script fails
81 −to run correctly in Constrained Language mode.
82 −
83 −PowerShell 7.4 now supports WDAC policies in **Audit** mode. In audit mode, PowerShell runs the
84 −untrusted scripts in Constrained Language mode but logs messages to the event log instead of
85 −throwing errors. The log messages describe what restrictions would apply if the policy was in
86 −**Enforce** mode.
87 −
88 −### Changes in PowerShell 7.3
89 −
90 −- PowerShell 7.3 now supports the ability to block or allow PowerShell script files via the WDAC API.
91 −
92 −### Changes in PowerShell 7.2
79 +## Software Bill of Materials (SBOM)
9380
94 −- There was a corner-case scenario in AppLocker where you only have **Deny** rules and constrained
95 − mode isn't used to enforce the policy that allows you to bypass the execution policy. Beginning in
96 − PowerShell 7.2, a change was made to ensure AppLocker rules take precedence over a
97 − `Set-ExecutionPolicy -ExecutionPolicy Bypass` command.
81 +Beginning with PowerShell 7.2, all install packages contain a Software Bill of Materials (SBOM). The
82 +PowerShell team also produces SBOMs for modules that they own but ship independently from
83 +PowerShell.
9884
99 −- PowerShell 7.2 now disallows the use of the `Add-Type` cmdlet in a **NoLanguage** mode PowerShell
100 − session on a locked down machine.
85 +You can find SBOM files in the following locations:
10186
102 −- PowerShell 7.2 now disallows scripts from using COM objects in AppLocker system lock down
103 − conditions. Cmdlets that use COM or DCOM internally aren't affected.
87 +- In PowerShell, find the SBOM at `$PSHOME/_manifest/spdx_2.2/manifest.spdx.json`.
88 +- For modules, find the SBOM in the module's folder under `_manifest/spdx_2.2/manifest.spdx.json`.
10489
105 −### Security Servicing Criteria
90 +The creation and publishing of the SBOM is the first step to modernize Federal Government
91 +cybersecurity and enhance software supply chain security. For more information about this initiative,
92 +see the blog post [Generating Software Bills of Materials (SBOMs) with SPDX at Microsoft][11].
10693
107 −PowerShell follows the [Microsoft Security Servicing Criteria for Windows][12]. The table below
108 −outlines the features that meet the servicing criteria and those that do not.
94 +## Security Servicing Criteria
10995
110 −| Feature | Type |
111 −| ------------------------------------------ | ---------------- |
112 −| System Lockdown - with WDAC | Security Feature |
113 −| Constrained language mode - with WDAC | Security Feature |
114 −| System Lockdown - with AppLocker | Defense in Depth |
115 −| Constrained language mode - with AppLocker | Defense in Depth |
116 −| Execution Policy | Defense in Depth |
96 +PowerShell follows the [Microsoft Security Servicing Criteria for Windows][12]. Only security
97 +features meet the criteria for servicing.
11798
118 −## Software Bill of Materials (SBOM)
99 +Security features
119100
120 −Beginning with PowerShell 7.2, all install packages contain a Software Bill of Materials (SBOM). The
121 −SBOM is found at `$PSHOME/_manifest/spdx_2.2/manifest.spdx.json`. The creation and publishing of the
122 −SBOM is the first step to modernize Federal Government cybersecurity and enhance software supply
123 −chain security.
101 +- System Lockdown with WDAC
102 +- Constrained language mode with WDAC
124103
125 −The PowerShell team is also producing SBOMs for modules that they own but ship separately from
126 −PowerShell. SBOMs will be added in the next release of the module. For modules, the SBOM is
127 −installed in the module's folder under `_manifest/spdx_2.2/manifest.spdx.json`.
104 +Defense in depth features
128105
129 −For more information about this initiative, see the blog post
130 −[Generating Software Bills of Materials (SBOMs) with SPDX at Microsoft][11].
106 +- System Lockdown with AppLocker
107 +- Constrained language mode with AppLocker
108 +- Execution Policy
131109
132110 <!-- link references -->
133111 [01]: /dotnet/fundamentals/runtime-libraries/system-security-securestring
⋯ 5 unchanged lines
139117 [07]: /windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker
140118 [08]: /windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control
141119 [09]: /windows/win32/amsi/how-amsi-helps
142 −[10]: application-control.md
120 +[10]: app-control/application-control.md
143121 [11]: https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/
144122 [12]: https://www.microsoft.com/msrc/windows-security-servicing-criteria

Microsoft's Markdown source from MicrosoftDocs/PowerShell-Docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:15 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 22:55 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.