PowerShell security features
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/PowerShell-Docs · commit d836460 · +10 −9 lines · also on GitHub
11
---
22
description: PowerShell has several features designed to improve the security of your scripting environment.
3
−ms.date: 09/19/2024
3
+ms.date: 05/22/2025
44
title: PowerShell security features
55
---
66
# PowerShell security features
⋯ 7 unchanged lines
1414
malicious scripts. You can use a Group Policy setting to set execution policies for computers and
1515
users. Execution policies only apply to the Windows platform.
1616
17
−For more information see [about_Execution_Policies][02].
17
+For more information, see [about_Execution_Policies][02].
1818
1919
## Use of the SecureString class
2020
⋯ 4 unchanged lines
2525
authentication.
2626
2727
PowerShell continues to support the **SecureString** class for backward compatibility. Using a
28
−**SecureString** is still more secure than using a plain text string. By default, PowerShell doesn't
29
−show the unprotected value of a **SecureString** object. However, **SecureString** can be easily
30
−converted to a plain text string. For a full discussion about using **SecureString**, see the
31
−[System.Security.SecureString class][01] documentation.
28
+**SecureString** is still more secure than using a plain text string. PowerShell still relies on the
29
+**SecureString** type to avoid accidentally exposing the contents to the console or in logs. Use
30
+**SecureString** carefully, because it can be easily converted to a plain text string. For a full
31
+discussion about using **SecureString**, see the [System.Security.SecureString class][01]
32
+documentation.
3233
3334
## Module and script block logging
3435
3536
Module Logging allows you to enable logging for selected PowerShell modules. This setting is
3637
effective in all sessions on the computer. PowerShell records pipeline execution events for the
37
−specified modules in the Windows PowerShell log in Event Viewer.
38
+specified modules in the Windows PowerShell event log.
3839
3940
Script Block Logging enables logging for the processing of commands, script blocks, functions, and
4041
scripts - whether invoked interactively, or through automation. PowerShell logs this information to
⋯ 11 unchanged lines
5253
an antimalware scanner, such as Windows Defender, to scan for malicious payloads. Beginning with
5354
PowerShell 5.1, PowerShell running on Windows 10 (and higher) passes all script blocks to AMSI.
5455
55
−PowerShell 7.3 extends the data that's sent to AMSI for inspection. It now includes all invocations
56
−of .NET method members.
56
+PowerShell 7.3 extends the data it sends to AMSI for inspection. It now includes all .NET method
57
+invocations.
5758
5859
For more information about AMSI, see [How AMSI helps][09].
5960
⋯ 63 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/PowerShell-Docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:15 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.