PowerShell Constrained mode

Hello,

PowerShell comes with several language mode :

  1. Full Language
  2. Restricted Language
  3. No Language
  4. Constrained Language

You’ll find a lore more informations with :

Get-Help about_Language_Modes

PowerShell-ConstrainedMode-1

If you have a security point of view, you may want to try to impose a “Constrained Language” to all of your users that do not need to use PowerShell for their daily work.

To do this, you need to set an environment variable named “__PSLockdownPolicy” at 4.

[Environment]::SetEnvironmentVariable('__PSLockdownPolicy', '4', 'Machine')

Note: You need to restart PowerShell for this to take effect.

You can also do this by GPO :

PowerShell-ConstrainedMode-2

PowerShell-ConstrainedMode-3

On the computer, you can check if your setting is applied with :

$ExecutionContext.SessionState.LanguageMode

Ok :

PowerShell-ConstrainedMode-5

KO :

PowerShell-ConstrainedMode-4

Note : If the local user is able to modify environment variables, he can override your setting. PowerShell Contrained mode is not a bullet proof way to restrict PowerShell, but it’s a extra layer of defense.

Remove-Item Env:__PSLockdownPolicy

He can also use the system properties:

PowerShell Constrained mode - System Properties

PowerShell Constrained mode – System Properties

9 thoughts on “PowerShell Constrained mode

  1. Hi, I have set my environment variable to 4. Running gc Env:__PSLockdownPolicy it returns 4, but when running $ExecutionContext.SessionState.LanguageMode, it returns FullLanguage. Am I missing something???

    • You need to restart PowerShell, once it’s running you can’t change the languagemode for the running one.

  2. Right. Seems that the available values for the Lockdown policy only allow us to set FullLanguage or ConstrainedLanguage. Anyway to enable NoLanguage?? Seems that the values for the Lockdown attribute are:
    0 = Full Language
    1 = Full Language
    2 = Full Language
    3 = Full Language
    4 = Constrained Language Mode
    5 = Constrained Language Mode
    6 = Constrained Language Mode
    7 = Constrained Language Mode
    8 = Full Language
    ?? = NoLanguage???

Leave a Reply