Procedures to enforce Windows PowerShell to run in Constrained Language Mode using Windows Defender Application Control ?

EnterpriseArchitect 4,741 Reputation points
2021-12-01T06:19:24.757+00:00

Hi All,

I need some help and guidance in deploying the Windows Defender Application Control (WDAC) policy to enforce Windows PowerShell to run in Constrained Language Mode for my production servers.

Can someone here, please share the steps?

Because from the link: Deploy Windows Defender Application Control (WDAC) policies using the https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script it does not show the settings to enable the PowerShell constrained language mode.

From: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_language_modes?view=powershell-7.2#constrained-language-constrained-language

Thanks in advance.

Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
4,746 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,854 questions
Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,754 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,721 questions
Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,363 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Limitless Technology 39,351 Reputation points
    2021-12-01T19:42:48.067+00:00

    Hello @EnterpriseArchitect

    The Policy you are looking for is :

    Option 11 Disabled:Script Enforcement
    Default value: Enabled (meaning it will DISABLE the Script Enforcement, to allow you should set a Disabled)

    This option is only supported in Windows 1903 build 18362.145 or later. The Microsoft documentation on this option is incomplete and inconsistent.

    Script enforcement has two main functions:

    It blocks MSI’s. Why MSI’s? Application Control refers primarily to Portable Executables (PE’s), which are files encoded in a PE format including EXE, DLL and SYS files, but not MSI’s. So really, I think, “script” here means “non-PE”.
    It does not block scripts, but it puts PowerShell into Constrained Language mode, which blocks specific elements that expose vulnerabilities (calls to Win32 API’s). Note: a policy will only put PowerShell into Constrained Language mode if it is in Enforced mode. In Audit mode, PowerShell remains in Full Language mode.

    Reference to apply the changes: https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create

    Hope this helps with your query,

    --------
    --If the reply is helpful, please Upvote and Accept as answer--

    1 person found this answer helpful.
    0 comments