PowerShell comes with several language mode :
- Full Language
- Restricted Language
- No Language
- Constrained Language
You’ll find a lore more informations with :
If you have a security point of view, you may want to try to impose a “Constrained Language” to all of your users that do not need to use PowerShell for their daily work.
To do this, you need to set an environment variable named “__PSLockdownPolicy” at 4.
[Environment]::SetEnvironmentVariable('__PSLockdownPolicy', '4', 'Machine')
Note: You need to restart PowerShell for this to take effect.
You can also do this by GPO :
On the computer, you can check if your setting is applied with :
Note : If the local user is able to modify environment variables, he can override your setting. PowerShell Contrained mode is not a bullet proof way to restrict PowerShell, but it’s a extra layer of defense.
He can also use the system properties: