PowerShell Constrained mode


PowerShell comes with several language mode :

  1. Full Language
  2. Restricted Language
  3. No Language
  4. Constrained Language

You’ll find a lore more informations with :

Get-Help about_Language_Modes


If you have a security point of view, you may want to try to impose a “Constrained Language” to all of your users that do not need to use PowerShell for their daily work.

To do this, you need to set an environment variable named “__PSLockdownPolicy” at 4.

[Environment]::SetEnvironmentVariable('__PSLockdownPolicy', '4', 'Machine')

You can also do this by GPO :



On the computer, you can check if your setting is applied with :


Ok :


KO :


Note : If the local user is able to modify environment variables, he can override your setting. PowerShell Contrained mode is not a bullet proof way to restrict PowerShell, but it’s a extra layer of defense.

Remove-Item Env:__PSLockdownPolicy

You can also delete the environment variable with the system properties:

PowerShell Constrained mode - System Properties

PowerShell Constrained mode – System Properties

9 thoughts on “PowerShell Constrained mode

  1. Hi, I have set my environment variable to 4. Running gc Env:__PSLockdownPolicy it returns 4, but when running $ExecutionContext.SessionState.LanguageMode, it returns FullLanguage. Am I missing something???

  2. Right. Seems that the available values for the Lockdown policy only allow us to set FullLanguage or ConstrainedLanguage. Anyway to enable NoLanguage?? Seems that the values for the Lockdown attribute are:
    0 = Full Language
    1 = Full Language
    2 = Full Language
    3 = Full Language
    4 = Constrained Language Mode
    5 = Constrained Language Mode
    6 = Constrained Language Mode
    7 = Constrained Language Mode
    8 = Full Language
    ?? = NoLanguage???

  3. Hey
    Remove-Item Function not working when Constrained Language Mode is On,
    Use the following cmd command to remove Constrained Language Mode :
    setx __PSLockdownPolicy 0 /m


Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.