Are there guidelines for building useful scripts in Constrained Language Mode?

Cameron Stillion 1 Reputation point Microsoft Employee
2025-05-22T00:05:57.75+00:00

PowerShell Constrained Language mode exists, at least ostensibly, to ensure that unsafe practices are not performed on locked-down machines. Great idea.

Now, an unfortunate side-effect of this mode is that - all my scripts, which I attempt to execute on such a locked-down machine, implement the -WhatIf parameter, but the code that supports this uses a construct that causes a failure in Constrained Language Mode. i.e. `

if ($PSCmdlet.ShouldProcess(... , ...)) {...}

How unfortunate. Now I can run the rest of my script, just not the safe part. :/ In order to adhere to the rules of Constrained Language Mode, I am forced to remove all the guardrails. hmm.

Now I'm wondering - is there a prescriptive document somewhere with guidelines that can dictate what exactly a "good, secure, but constrained PowerShell script" might look like. What can I use? What can I not use? You don't need to include everything but maybe hit some highlights of commonly used fundamental building blocks that just won't work, and if possible, alternatives. Maybe warn against the pitfalls of things that normally are highly recommended. This would be most helpful.

Windows for business Windows Server User experience PowerShell
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.