PowerShell Constrained mode

Posted on by

Hello,

PowerShell comes with several language mode :

  1. Full Language
  2. Restricted Language
  3. No Language
  4. Constrained Language

You’ll find a lore more informations with :

Get-Help about_Language_Modes

PowerShell-ConstrainedMode-1

If you have a security point of view, you may want to try to impose a “Constrained Language” to all of your users that do not need to use PowerShell for their daily work.

To do this, you need to set an environment variable named “__PSLockdownPolicy” at 4.

[Environment]::SetEnvironmentVariable('__PSLockdownPolicy', '4', 'Machine')

You can also do this by GPO :

PowerShell-ConstrainedMode-2

PowerShell-ConstrainedMode-3

On the computer, you can check if your setting is applied with :

$ExecutionContext.SessionState.LanguageMode

Ok :

PowerShell-ConstrainedMode-5

KO :

PowerShell-ConstrainedMode-4

Note : If the local user is able to modify environment variables, he can override your setting. PowerShell Contrained mode is not a bullet proof way to restrict PowerShell, but it’s a extra layer of defense.

Remove-Item Env:__PSLockdownPolicy

You can also delete the environment variable with the system properties:

PowerShell Constrained mode - System Properties

PowerShell Constrained mode – System Properties

9 thoughts on “PowerShell Constrained mode”

  2. Hi, I have set my environment variable to 4. Running gc Env:__PSLockdownPolicy it returns 4, but when running $ExecutionContext.SessionState.LanguageMode, it returns FullLanguage. Am I missing something???

    Reply ↓

  3. Right. Seems that the available values for the Lockdown policy only allow us to set FullLanguage or ConstrainedLanguage. Anyway to enable NoLanguage?? Seems that the values for the Lockdown attribute are:
    0 = Full Language
    1 = Full Language
    2 = Full Language
    3 = Full Language
    4 = Constrained Language Mode
    5 = Constrained Language Mode
    6 = Constrained Language Mode
    7 = Constrained Language Mode
    8 = Full Language
    ?? = NoLanguage???

    Reply ↓

  4. Hey
    Remove-Item Function not working when Constrained Language Mode is On,
    Use the following cmd command to remove Constrained Language Mode :
    setx __PSLockdownPolicy 0 /m

    (:

    Reply ↓

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.