11---
2- description : This article explains how WDAC works to secure PowerShell and the restrictions it imposes.
2+ description : This article explains how App Control for Business works to secure PowerShell and the restrictions it imposes.
33ms.date : 09/19/2024
4- title : How WDAC works with PowerShell
4+ title : How App Control for Business works with PowerShell
55---
6- # How WDAC works with PowerShell
6+ # How App Control works with PowerShell
77
8- This article explains how ** Windows Defender Application Control ** (WDAC) secures PowerShell and the
8+ This article explains how ** App Control for Business ** secures PowerShell and the
99restrictions it imposes. The secure behavior of PowerShell varies based on the version of Windows
1010and PowerShell you're using.
1111
1212## How PowerShell detects a system lockdown policy
1313
14- PowerShell detects both ** AppLocker** and ** Windows Defender Application Control ** (WDAC) system
15- wide polices. AppLocker is deprecated. WDAC is the preferred application control system for Windows.
14+ PowerShell detects both ** AppLocker** and ** App Control for Business ** system
15+ wide polices. AppLocker is deprecated. App Control is the preferred application control system for Windows.
1616
17- ### Legacy WDAC policy enforcement detection
17+ ### Legacy App Control policy enforcement detection
1818
19- PowerShell uses the legacy WDAC ` WldpGetLockdownPolicy ` API to discover two things:
19+ PowerShell uses the legacy App Control ` WldpGetLockdownPolicy ` API to discover two things:
2020
2121- System wide policy enforcement: ` None ` , ` Audit ` , ` Enforce `
2222- Individual file policy: ` None ` , ` Audit ` (allowed by policy), ` Enforce ` (not allowed by policy)
2323
24- All versions of PowerShell (v5.1 - v7.x) support this WDAC policy detection.
24+ All versions of PowerShell (v5.1 - v7.x) support this App Control policy detection.
2525
26- ### Latest WDAC policy enforcement detection
26+ ### Latest App Control policy enforcement detection
2727
28- WDAC introduced new APIs in recent versions of Windows. Beginning with version 7.3, PowerShell uses
28+ App Control introduced new APIs in recent versions of Windows. Beginning with version 7.3, PowerShell uses
2929the new ` WldpCanExecuteFile ` API to decide how a file should be handled. Windows PowerShell 5.1
3030doesn't support this new API. The new API takes precedence over the legacy API for individual files.
3131However, PowerShell continues to use the legacy API to get the system wide policy configuration. If
@@ -54,7 +54,7 @@ this mode, see the [PowerShell restrictions under lockdown policy][02] section o
5454
5555### Noninteractive mode running under policy enforcement
5656
57- When PowerShell runs a script or loads a module, it uses the WDAC API to get the policy enforcement
57+ When PowerShell runs a script or loads a module, it uses the App Control API to get the policy enforcement
5858for the file.
5959
6060PowerShell version 7.3 or higher uses the ` WldpCanExecuteFile ` API if available. This API returns one
@@ -77,7 +77,7 @@ behavior is:
7777
7878## PowerShell restrictions under lockdown policy
7979
80- When PowerShell detects the system is under a WDAC lockdown policy, it applies restrictions even if
80+ When PowerShell detects the system is under a App Control lockdown policy, it applies restrictions even if
8181the script is trusted and running in ` FullLanguage ` mode. These restrictions prevent known behaviors
8282of PowerShell that could result in arbitrary code execution on a locked-down system. The lockdown
8383policy enforces the following restrictions:
@@ -128,7 +128,7 @@ policy enforces the following restrictions:
128128
129129## PowerShell restrictions under constrained language mode
130130
131- Script or function that isn't approved by the WDAC policy is untrusted. When you run an untrusted
131+ Script or function that isn't approved by the App Control policy is untrusted. When you run an untrusted
132132command, PowerShell either blocks the command from running (new behavior) or runs the command in
133133` ConstrainedLanguage ` mode. The following restrictions apply to ` ConstrainedLanguage ` mode:
134134
@@ -246,7 +246,7 @@ command, PowerShell either blocks the command from running (new behavior) or run
246246## Further reading
247247
248248- For more information about PowerShell language modes, see [ about_Language_Modes] [ 01 ] .
249- - For information about how to configure and use WDAC , see [ How to use WDAC for PowerShell] [ 03 ] .
249+ - For information about how to configure and use App Control , see [ How to use App Control for PowerShell] [ 03 ] .
250250
251251<!-- link references -->
252252[ 01 ] : /powershell/module/microsoft.powershell.core/about/about_language_modes
0 commit comments