You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: reference/docs-conceptual/security/app-control/application-control.md
+7-8Lines changed: 7 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ based on unique properties of the files.
16
16
**WDAC**, introduced with Windows 10, allows you to control which drivers and applications are
17
17
allowed to run on Windows.
18
18
19
-
PowerShell detects both AppLocker and WDAC system wide policies. AppLocker is a deprecated. WDAC is
19
+
PowerShell detects both AppLocker and WDAC system wide policies. AppLocker is deprecated. WDAC is
20
20
the preferred application control system for Windows. WDAC is designed as a security feature under
21
21
the servicing criteria defined by the Microsoft Security Response Center (MSRC).
22
22
@@ -31,7 +31,7 @@ For more information about AppLocker and WDAC, see [Application Controls for Win
31
31
32
32
## WDAC policy enforcement
33
33
34
-
When PowerShell runs under a WDAC policy, it changes its behavior based on the defined security
34
+
When PowerShell runs under a WDAC policy, its behavior changes based on the defined security
35
35
policy. Under a WDAC policy, PowerShell runs trusted scripts and modules allowed by the policy in
36
36
`FullLanguage` mode. All other scripts and script blocks are untrusted and run in
37
37
`ConstrainedLanguage` mode. PowerShell throws errors when the untrusted scripts attempt to perform
@@ -42,28 +42,27 @@ failed to run correctly in `ConstrainedLanguage` mode.
42
42
43
43
PowerShell 7.4 added a new feature to support WDAC policies in **Audit** mode. In audit mode,
44
44
PowerShell runs the untrusted scripts in `ConstrainedLanguage` mode without errors, but logs messages
45
-
to the event log instead. The log messages describe what restrictions would apply if the policy was
45
+
to the event log instead. The log messages describe what restrictions would apply if the policy were
46
46
in **Enforce** mode.
47
47
48
48
## History of changes
49
49
50
50
Windows PowerShell 5.1 was the first version of PowerShell to support WDAC. The security features of
51
51
WDAC and AppLocker improve with each new release of PowerShell. The following sections describe how
52
52
this support changed in each version of PowerShell. The changes are cumulative, so the features
53
-
described in the later versions include the features from the earlier versions.
53
+
described in the later versions include those from earlier versions.
54
54
55
55
### Changes in PowerShell 7.4
56
56
57
-
On Windows, when PowerShell runs under a Windows Defender Application Control (WDAC) policy, it
58
-
changes its behavior based on the defined security policy. Under a WDAC policy, PowerShell runs
57
+
On Windows, when PowerShell runs under a Windows Defender Application Control (WDAC) policy, its behavior changes based on the defined security policy. Under a WDAC policy, PowerShell runs
59
58
trusted scripts and modules allowed by the policy in `FullLanguage` mode. All other scripts and
60
59
script blocks are untrusted and run in `ConstrainedLanguage` mode. PowerShell throws errors when the
61
60
untrusted scripts attempt to perform disallowed actions. It's difficult to know why a script fails
62
61
to run correctly in `ConstrainedLanguage` mode.
63
62
64
63
PowerShell 7.4 now supports WDAC policies in **Audit** mode. In audit mode, PowerShell runs the
65
64
untrusted scripts in `ConstrainedLanguage` mode but logs messages to the event log instead of
66
-
throwing errors. The log messages describe what restrictions would apply if the policy was in
65
+
throwing errors. The log messages describe what restrictions would apply if the policy were in
67
66
**Enforce** mode.
68
67
69
68
### Changes in PowerShell 7.3
@@ -87,7 +86,7 @@ throwing errors. The log messages describe what restrictions would apply if the
87
86
88
87
- For more information about how WDAC works and what restrictions it enforces, see
89
88
[How WDAC works with PowerShell][06].
90
-
- For more information about using securing PowerShell with WDAC, see [How to use WDAC][05].
89
+
- For more information about securing PowerShell with WDAC, see [How to use WDAC][05].
Copy file name to clipboardExpand all lines: reference/docs-conceptual/security/app-control/how-wdac-works.md
+12-13Lines changed: 12 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -44,21 +44,21 @@ PowerShell can run in both interactive and non-interactive modes.
44
44
45
45
- In interactive mode, PowerShell is a command-line application that takes users command-line input
46
46
as commands or scripts to run. Results are displayed back to the user.
47
-
- In non-interactive mode, PowerShell is used to load modules and run script files without user
48
-
input. Result data streams are either ignored or redirected to file.
47
+
- In non-interactive mode, PowerShell loads modules and runs script files without user
48
+
input. Result data streams are either ignored or redirected to a file.
49
49
50
50
### Interactive mode running under policy enforcement
51
51
52
52
PowerShell runs commands in `ConstrainedLanguage` mode. This mode prevents interactive users from
53
53
running certain commands or executing arbitrary code. For more information about the restrictions in
54
-
this mode, see the [PowerShell restrictions under lockdown policy][02] of this article.
54
+
this mode, see the [PowerShell restrictions under lockdown policy][02]section of this article.
55
55
56
56
### Noninteractive mode running under policy enforcement
57
57
58
58
When PowerShell runs a script or loads a module, it uses the WDAC API to get the policy enforcement
59
59
for the file.
60
60
61
-
PowerShell version 7.3 or higher uses the `WldpCanExecuteFile` API if available. This API return one
61
+
PowerShell version 7.3 or higher uses the `WldpCanExecuteFile` API if available. This API returns one
62
62
of the following results:
63
63
64
64
-`WLDP_CAN_EXECUTE_ALLOWED`: The file is approved by policy and is used in `FullLanguage` mode
@@ -85,19 +85,18 @@ lockdown policy enforces the following restrictions:
85
85
86
86
- Module dot-sourcing with wildcard function export restriction
87
87
88
-
Any module that uses script dot-sourcing and also exports functions using wildcard names results
88
+
Any module that uses script dot-sourcing and exports functions using wildcard names results
89
89
in an error. Blocking wildcard exports prevents script injection from a malicious user who can
90
-
plant an untrusted script that gets dot-sourced into a trusted module. The malicious script could
91
-
get access to private functions of the trusted module.
90
+
plant an untrusted script that gets dot-sourced into a trusted module. The malicious script could then gain access to the trusted module's private functions.
92
91
93
-
**Security recommendation:** Never use script dot-sourcing in a module and to always export module
92
+
**Security recommendation:** Never use script dot-sourcing in a module and always export module
94
93
functions with explicit names (no wildcard characters).
95
94
96
95
- Nested module with wildcard function export restriction
97
96
98
-
If a parent module exports functions using function name wildcard characters, then PowerShell
99
-
removes any function name in a nested module from the function export list. Block wildcard exports
100
-
from nested modules prevents accidental exporting of dangerous nested functions through wildcards
97
+
If a parent module exports functions using function name wildcard characters, PowerShell
98
+
removes any function name in a nested module from the function export list. Blocking wildcard exports
99
+
from nested modules prevents accidental exporting of dangerous nested functions through wildcard
101
100
name matching.
102
101
103
102
**Security recommendation:** Always export module functions with explicit names (no wildcard
@@ -135,7 +134,7 @@ command, PowerShell either blocks the command from running (new behavior) or run
135
134
136
135
-`Add-Type` cmdlet disallowed
137
136
138
-
Blocking `Add-Type` prevents the execution arbitrary .NET code.
137
+
Blocking `Add-Type` prevents the execution of arbitrary .NET code.
139
138
140
139
-`Import-LocalizedData` cmdlet restricted
141
140
@@ -224,7 +223,7 @@ command, PowerShell either blocks the command from running (new behavior) or run
224
223
225
224
- Type method invocation not allowed
226
225
227
-
`ConstrainedLanguage` mode doesn't allow method invocation on unapproved types. Blocking method on
226
+
`ConstrainedLanguage` mode doesn't allow method invocation on unapproved types. Blocking methods on
228
227
unapproved types prevents invocation of .NET type methods that might be dangerous or allow code
0 commit comments