Configuring PowerShell to always use Constrained Language Mode and script block logging, and transcription functionality

Question

Hi All,

I need some guidance to configure my PowerShell environment to enable the following:

• Constrained Language Mode every script startup
• Module logging, script block logging, and transcription functionality.

What are the steps or the script to do that?

Thanks.

Answer 1

For the first point you can use AppLocker or DeviceGuard to enforce it: https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/ (doc for DeviceGuard/Windows Defender Application Control: https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions)

For the second point, you can use a group policy (Computer configuration/Administrative Templates/Windows Components/Windows PowerShell):

Answer 2

Hi there,

You can place a PowerShell session into Constrained Language mode simply by setting a property:

PS C:\> $ExecutionContext.SessionState.LanguageMode
FullLanguage
PS C:\> $ExecutionContext.SessionState.LanguageMode = "ConstrainedLanguage"
PS C:\> $ExecutionContext.SessionState.LanguageMode
ConstrainedLanguage

PS C:\> [System.Console]::WriteLine("Hello")
Cannot invoke method. Method invocation is supported only on core types in this language mode.
At line:1 char:1

• [System.Console]::WriteLine("Hello")
• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
• CategoryInfo : InvalidOperation: (:) [], RuntimeException
• FullyQualifiedErrorId : MethodInvocationNotSupportedInConstrainedLanguage

You can get more info from here
https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/

---

--If the reply is helpful, please Upvote and Accept it as an answer--