Merge pull request #11981 from MicrosoftDocs/main

04/04/2025 PM Publishing

Author: v-alje

reference/5.1/Microsoft.PowerShell.Core/About/about_Language_Modes.md

@@ -1,7 +1,7 @@
 ---
 description: Explains language modes and their effect on PowerShell sessions.
 Locale: en-US
-ms.date: 10/04/2023
+ms.date: 04/03/2025
 no-loc: [FullLanguage, ConstrainedLanguage, RestrictedLanguage, NoLanguage]
 online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes?view=powershell-5.1&WT.mc_id=ps-gethelp
 schema: 2.0.0
@@ -50,14 +50,17 @@ For example:
 
 ```powershell
 $ExecutionContext.SessionState.LanguageMode
+```
+
+```Output
 ConstrainedLanguage
 ```
 
 However, in sessions with `RestrictedLanguage` and `NoLanguage` modes, you
 can't use the [member-access operator][02] (`.`) to get property values.
 Instead, the error message reveals the language mode.
 
-When you run the `$ExecutionContext.SessionState.LanguageMode` command in a
+When you access `$ExecutionContext.SessionState.LanguageMode` in a
 `RestrictedLanguage` session, PowerShell returns the
 **PropertyReferenceNotSupportedInDataSection** and
 **VariableReferenceNotSupportedInDataSection** error messages.
@@ -68,8 +71,9 @@ When you run the `$ExecutionContext.SessionState.LanguageMode` command in a
   referenced in restricted language mode or a Data section is being
   referenced.
 
-When you run the `$ExecutionContext.SessionState.LanguageMode` command in a
-NoLanguage session, PowerShell returns the **ScriptsNotAllowed** error message.
+When you access `$ExecutionContext.SessionState.LanguageMode` in a
+`NoLanguage` session, PowerShell returns the **ScriptsNotAllowed** error
+message.
 
 - **ScriptsNotAllowed**: The syntax isn't supported by this runspace. This
   might be because it's in no-language mode.
@@ -82,6 +86,9 @@ language mode by getting the value of the **LanguageMode** property.
 
 ```powershell
 (Get-PSSessionConfiguration -Name Test).LanguageMode
+```
+
+```Output
 FullLanguage
 ```
 
@@ -117,11 +124,10 @@ application control policy. For example, there are additional restrictions to
 dot-sourcing and module importing under a policy.
 
 When a PowerShell session is started under a policy, it runs in
-`ConstrainedLanguage` mode. This mode allows for a usable interactive shell
-experience while limiting access to features and APIs that could be abused by a
-malicious actor. Users can run cmdlets and native commands and have access to
-basic language elements. Access to PowerShell, .NET, and COM APIs is
-restricted.
+`ConstrainedLanguage` mode. This mode allows users to have a usable interactive
+shell experience, running cmdlets and native commands, as well as access to
+basic language elements. But the user can't access PowerShell, .NET, or COM
+APIs that could be abused by a malicious actor.
 
 Any script or script-based module executed in this session runs in
 `ConstrainedLanguage` mode. However, any script or script-based module allowed
@@ -146,13 +152,13 @@ For more information, see [JEA Session configurations][01] and
 
 This section describes the language modes in PowerShell sessions.
 
-### FullLanguage mode
+### `FullLanguage` mode
 
 The `FullLanguage` mode permits all language elements in the session.
 `FullLanguage` is the default language mode for default sessions on all
 versions of Windows.
 
-### RestrictedLanguage mode
+### `RestrictedLanguage` mode
 
 In `RestrictedLanguage` mode, users can run commands (cmdlets, functions, CIM
 commands, and workflows), but can't use script blocks. This mode is also used
@@ -175,8 +181,7 @@ additional variables:
 
 - `$PSScriptRoot`
 - `$PSEdition`
-- `$EnabledExperimentalFeatures`
-- Any environment variables, like `$Env:TEMP`
+- Any environment variable, like `$env:TEMP`
 
 Only the following comparison operators are permitted:
 
@@ -186,7 +191,7 @@ Only the following comparison operators are permitted:
 
 Assignment statements, property references, and method calls aren't permitted.
 
-### ConstrainedLanguage mode
+### `ConstrainedLanguage` mode
 
 `ConstrainedLanguage` mode is designed to allow basic language elements such as
 loops, conditionals, string expansion, and access to object properties. The
@@ -221,7 +226,7 @@ The features of `ConstrainedLanguage` mode are as follows:
 The following .NET types are permitted in `ConstrainedLanguage` mode. Users can
 get properties, invoke methods, and convert objects to these types.
 
-Allowed Types:
+Allowed types:
 
 - `[adsi]`
 - `[adsisearcher]`
@@ -230,7 +235,6 @@ Allowed Types:
 - `[AllowEmptyString]`
 - `[AllowNull]`
 - `[ArgumentCompleter]`
-- `[ArgumentCompletions]`
 - `[array]`
 - `[bigint]`
 - `[bool]`
@@ -249,9 +253,6 @@ Allowed Types:
 - `[DscLocalConfigurationManager]`
 - `[DscProperty]`
 - `[DscResource]`
-- `[ExperimentAction]`
-- `[Experimental]`
-- `[ExperimentalFeature]`
 - `[float]`
 - `[guid]`
 - `[hashtable]`
@@ -267,7 +268,6 @@ Allowed Types:
 - `[NullString]`
 - `[Object[]]`
 - `[ObjectSecurity]`
-- `[ordered]`
 - `[OutputType]`
 - `[Parameter]`
 - `[PhysicalAddress]`
@@ -278,24 +278,18 @@ Allowed Types:
 - `[psobject]`
 - `[psprimitivedictionary]`
 - `[PSTypeNameAttribute]`
-- `[ref]`
 - `[regex]`
 - `[sbyte]`
 - `[securestring]`
-- `[semver]`
-- `[short]`
 - `[single]`
 - `[string]`
 - `[SupportsWildcards]`
 - `[switch]`
 - `[timespan]`
-- `[uint]`
 - `[uint16]`
 - `[uint32]`
 - `[uint64]`
-- `[ulong]`
 - `[uri]`
-- `[ushort]`
 - `[ValidateCount]`
 - `[ValidateDrive]`
 - `[ValidateLength]`
@@ -323,7 +317,17 @@ Only the following COM object types are permitted:
 - `Scripting.FileSystemObject`
 - `VBScript.RegExp`
 
-### NoLanguage mode
+Special cases:
+
+- `[ref]` - Casting an object to type `[ref]` or
+  `[Management.Automation.PSReference]` is not permitted. Other uses are
+  permitted.
+- `[ordered]` - The `[ordered] @{}` expression is permitted and creates an
+  object of type `[Collections.Specialized.OrderedDictionary]`. However,
+  accessing methods of the object or directly instantiating an
+  **OrderedDictionary** is not permitted.
+
+### `NoLanguage` mode
 
 PowerShell `NoLanguage` mode disables PowerShell scripting language completely.
 You can't run scripts or use variables. You can only run native commands and

reference/7.4/Microsoft.PowerShell.Core/About/about_Language_Modes.md

@@ -1,7 +1,7 @@
 ---
 description: Explains language modes and their effect on PowerShell sessions.
 Locale: en-US
-ms.date: 10/04/2023
+ms.date: 04/03/2025
 no-loc: [FullLanguage, ConstrainedLanguage, RestrictedLanguage, NoLanguage]
 online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes?view=powershell-7.4&WT.mc_id=ps-gethelp
 schema: 2.0.0
@@ -53,14 +53,17 @@ For example:
 
 ```powershell
 $ExecutionContext.SessionState.LanguageMode
+```
+
+```Output
 ConstrainedLanguage
 ```
 
 However, in sessions with `RestrictedLanguage` and `NoLanguage` modes, you
 can't use the [member-access operator][02] (`.`) to get property values.
 Instead, the error message reveals the language mode.
 
-When you run the `$ExecutionContext.SessionState.LanguageMode` command in a
+When you access `$ExecutionContext.SessionState.LanguageMode` in a
 `RestrictedLanguage` session, PowerShell returns the
 **PropertyReferenceNotSupportedInDataSection** and
 **VariableReferenceNotSupportedInDataSection** error messages.
@@ -71,8 +74,9 @@ When you run the `$ExecutionContext.SessionState.LanguageMode` command in a
   referenced in restricted language mode or a Data section is being
   referenced.
 
-When you run the `$ExecutionContext.SessionState.LanguageMode` command in a
-NoLanguage session, PowerShell returns the **ScriptsNotAllowed** error message.
+When you access `$ExecutionContext.SessionState.LanguageMode` in a
+`NoLanguage` session, PowerShell returns the **ScriptsNotAllowed** error
+message.
 
 - **ScriptsNotAllowed**: The syntax isn't supported by this runspace. This
   might be because it's in no-language mode.
@@ -85,6 +89,9 @@ language mode by getting the value of the **LanguageMode** property.
 
 ```powershell
 (Get-PSSessionConfiguration -Name Test).LanguageMode
+```
+
+```Output
 FullLanguage
 ```
 
@@ -149,13 +156,13 @@ For more information, see [JEA Session configurations][01] and
 
 This section describes the language modes in PowerShell sessions.
 
-### FullLanguage mode
+### `FullLanguage` mode
 
 The `FullLanguage` mode permits all language elements in the session.
 `FullLanguage` is the default language mode for default sessions on all
 versions of Windows.
 
-### RestrictedLanguage mode
+### `RestrictedLanguage` mode
 
 In `RestrictedLanguage` mode, users can run commands (cmdlets, functions, CIM
 commands, and workflows), but can't use script blocks. This mode is also used
@@ -179,7 +186,7 @@ additional variables:
 - `$PSScriptRoot`
 - `$PSEdition`
 - `$EnabledExperimentalFeatures`
-- Any environment variables, like `$Env:TEMP`
+- Any environment variable, like `$env:TEMP`
 
 Only the following comparison operators are permitted:
 
@@ -189,7 +196,7 @@ Only the following comparison operators are permitted:
 
 Assignment statements, property references, and method calls aren't permitted.
 
-### ConstrainedLanguage mode
+### `ConstrainedLanguage` mode
 
 `ConstrainedLanguage` mode is designed to allow basic language elements such as
 loops, conditionals, string expansion, and access to object properties. The
@@ -219,10 +226,10 @@ The features of `ConstrainedLanguage` mode are as follows:
 The following .NET types are permitted in `ConstrainedLanguage` mode. Users can
 get properties, invoke methods, and convert objects to these types.
 
-Allowed Types:
+Allowed types:
 
-- `[adsi]`
-- `[adsisearcher]`
+- `[adsi]` (Windows-only)
+- `[adsisearcher]` (Windows-only)
 - `[Alias]`
 - `[AllowEmptyCollection]`
 - `[AllowEmptyString]`
@@ -277,7 +284,6 @@ Allowed Types:
 - `[psobject]`
 - `[psprimitivedictionary]`
 - `[PSTypeNameAttribute]`
-- `[ref]`
 - `[regex]`
 - `[sbyte]`
 - `[securestring]`
@@ -310,9 +316,9 @@ Allowed Types:
 - `[version]`
 - `[void]`
 - `[WildcardPattern]`
-- `[wmi]`
-- `[wmiclass]`
-- `[wmisearcher]`
+- `[wmi]` (Windows-only)
+- `[wmiclass]` (Windows-only)
+- `[wmisearcher]` (Windows-only)
 - `[X500DistinguishedName]`
 - `[X509Certificate]`
 - `[xml]`
@@ -323,7 +329,13 @@ Only the following COM object types are permitted:
 - `Scripting.FileSystemObject`
 - `VBScript.RegExp`
 
-### NoLanguage mode
+Special cases:
+
+- `[ref]` - Casting an object to type `[ref]` or
+  `[Management.Automation.PSReference]` is not permitted. Other uses are
+  permitted.
+
+### `NoLanguage` mode
 
 PowerShell `NoLanguage` mode disables PowerShell scripting language completely.
 You can't run scripts or use variables. You can only run native commands and