diff --git a/reference/5.1/Microsoft.PowerShell.Core/About/about_Language_Modes.md b/reference/5.1/Microsoft.PowerShell.Core/About/about_Language_Modes.md index 395440d721ea..195a78423759 100644 --- a/reference/5.1/Microsoft.PowerShell.Core/About/about_Language_Modes.md +++ b/reference/5.1/Microsoft.PowerShell.Core/About/about_Language_Modes.md @@ -1,7 +1,7 @@ --- description: Explains language modes and their effect on PowerShell sessions. Locale: en-US -ms.date: 10/04/2023 +ms.date: 04/03/2025 no-loc: [FullLanguage, ConstrainedLanguage, RestrictedLanguage, NoLanguage] online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes?view=powershell-5.1&WT.mc_id=ps-gethelp schema: 2.0.0 @@ -50,6 +50,9 @@ For example: ```powershell $ExecutionContext.SessionState.LanguageMode +``` + +```Output ConstrainedLanguage ``` @@ -57,7 +60,7 @@ However, in sessions with `RestrictedLanguage` and `NoLanguage` modes, you can't use the [member-access operator][02] (`.`) to get property values. Instead, the error message reveals the language mode. -When you run the `$ExecutionContext.SessionState.LanguageMode` command in a +When you access `$ExecutionContext.SessionState.LanguageMode` in a `RestrictedLanguage` session, PowerShell returns the **PropertyReferenceNotSupportedInDataSection** and **VariableReferenceNotSupportedInDataSection** error messages. @@ -68,8 +71,9 @@ When you run the `$ExecutionContext.SessionState.LanguageMode` command in a referenced in restricted language mode or a Data section is being referenced. -When you run the `$ExecutionContext.SessionState.LanguageMode` command in a -NoLanguage session, PowerShell returns the **ScriptsNotAllowed** error message. +When you access `$ExecutionContext.SessionState.LanguageMode` in a +`NoLanguage` session, PowerShell returns the **ScriptsNotAllowed** error +message. - **ScriptsNotAllowed**: The syntax isn't supported by this runspace. This might be because it's in no-language mode. @@ -82,6 +86,9 @@ language mode by getting the value of the **LanguageMode** property. ```powershell (Get-PSSessionConfiguration -Name Test).LanguageMode +``` + +```Output FullLanguage ``` @@ -117,11 +124,10 @@ application control policy. For example, there are additional restrictions to dot-sourcing and module importing under a policy. When a PowerShell session is started under a policy, it runs in -`ConstrainedLanguage` mode. This mode allows for a usable interactive shell -experience while limiting access to features and APIs that could be abused by a -malicious actor. Users can run cmdlets and native commands and have access to -basic language elements. Access to PowerShell, .NET, and COM APIs is -restricted. +`ConstrainedLanguage` mode. This mode allows users to have a usable interactive +shell experience, running cmdlets and native commands, as well as access to +basic language elements. But the user can't access PowerShell, .NET, or COM +APIs that could be abused by a malicious actor. Any script or script-based module executed in this session runs in `ConstrainedLanguage` mode. However, any script or script-based module allowed @@ -146,13 +152,13 @@ For more information, see [JEA Session configurations][01] and This section describes the language modes in PowerShell sessions. -### FullLanguage mode +### `FullLanguage` mode The `FullLanguage` mode permits all language elements in the session. `FullLanguage` is the default language mode for default sessions on all versions of Windows. -### RestrictedLanguage mode +### `RestrictedLanguage` mode In `RestrictedLanguage` mode, users can run commands (cmdlets, functions, CIM commands, and workflows), but can't use script blocks. This mode is also used @@ -175,8 +181,7 @@ additional variables: - `$PSScriptRoot` - `$PSEdition` -- `$EnabledExperimentalFeatures` -- Any environment variables, like `$Env:TEMP` +- Any environment variable, like `$env:TEMP` Only the following comparison operators are permitted: @@ -186,7 +191,7 @@ Only the following comparison operators are permitted: Assignment statements, property references, and method calls aren't permitted. -### ConstrainedLanguage mode +### `ConstrainedLanguage` mode `ConstrainedLanguage` mode is designed to allow basic language elements such as loops, conditionals, string expansion, and access to object properties. The @@ -221,7 +226,7 @@ The features of `ConstrainedLanguage` mode are as follows: The following .NET types are permitted in `ConstrainedLanguage` mode. Users can get properties, invoke methods, and convert objects to these types. -Allowed Types: +Allowed types: - `[adsi]` - `[adsisearcher]` @@ -230,7 +235,6 @@ Allowed Types: - `[AllowEmptyString]` - `[AllowNull]` - `[ArgumentCompleter]` -- `[ArgumentCompletions]` - `[array]` - `[bigint]` - `[bool]` @@ -249,9 +253,6 @@ Allowed Types: - `[DscLocalConfigurationManager]` - `[DscProperty]` - `[DscResource]` -- `[ExperimentAction]` -- `[Experimental]` -- `[ExperimentalFeature]` - `[float]` - `[guid]` - `[hashtable]` @@ -267,7 +268,6 @@ Allowed Types: - `[NullString]` - `[Object[]]` - `[ObjectSecurity]` -- `[ordered]` - `[OutputType]` - `[Parameter]` - `[PhysicalAddress]` @@ -278,24 +278,18 @@ Allowed Types: - `[psobject]` - `[psprimitivedictionary]` - `[PSTypeNameAttribute]` -- `[ref]` - `[regex]` - `[sbyte]` - `[securestring]` -- `[semver]` -- `[short]` - `[single]` - `[string]` - `[SupportsWildcards]` - `[switch]` - `[timespan]` -- `[uint]` - `[uint16]` - `[uint32]` - `[uint64]` -- `[ulong]` - `[uri]` -- `[ushort]` - `[ValidateCount]` - `[ValidateDrive]` - `[ValidateLength]` @@ -323,7 +317,17 @@ Only the following COM object types are permitted: - `Scripting.FileSystemObject` - `VBScript.RegExp` -### NoLanguage mode +Special cases: + +- `[ref]` - Casting an object to type `[ref]` or + `[Management.Automation.PSReference]` is not permitted. Other uses are + permitted. +- `[ordered]` - The `[ordered] @{}` expression is permitted and creates an + object of type `[Collections.Specialized.OrderedDictionary]`. However, + accessing methods of the object or directly instantiating an + **OrderedDictionary** is not permitted. + +### `NoLanguage` mode PowerShell `NoLanguage` mode disables PowerShell scripting language completely. You can't run scripts or use variables. You can only run native commands and diff --git a/reference/7.4/Microsoft.PowerShell.Core/About/about_Language_Modes.md b/reference/7.4/Microsoft.PowerShell.Core/About/about_Language_Modes.md index 57aee59a21cd..74fef858a52a 100644 --- a/reference/7.4/Microsoft.PowerShell.Core/About/about_Language_Modes.md +++ b/reference/7.4/Microsoft.PowerShell.Core/About/about_Language_Modes.md @@ -1,7 +1,7 @@ --- description: Explains language modes and their effect on PowerShell sessions. Locale: en-US -ms.date: 10/04/2023 +ms.date: 04/03/2025 no-loc: [FullLanguage, ConstrainedLanguage, RestrictedLanguage, NoLanguage] online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes?view=powershell-7.4&WT.mc_id=ps-gethelp schema: 2.0.0 @@ -53,6 +53,9 @@ For example: ```powershell $ExecutionContext.SessionState.LanguageMode +``` + +```Output ConstrainedLanguage ``` @@ -60,7 +63,7 @@ However, in sessions with `RestrictedLanguage` and `NoLanguage` modes, you can't use the [member-access operator][02] (`.`) to get property values. Instead, the error message reveals the language mode. -When you run the `$ExecutionContext.SessionState.LanguageMode` command in a +When you access `$ExecutionContext.SessionState.LanguageMode` in a `RestrictedLanguage` session, PowerShell returns the **PropertyReferenceNotSupportedInDataSection** and **VariableReferenceNotSupportedInDataSection** error messages. @@ -71,8 +74,9 @@ When you run the `$ExecutionContext.SessionState.LanguageMode` command in a referenced in restricted language mode or a Data section is being referenced. -When you run the `$ExecutionContext.SessionState.LanguageMode` command in a -NoLanguage session, PowerShell returns the **ScriptsNotAllowed** error message. +When you access `$ExecutionContext.SessionState.LanguageMode` in a +`NoLanguage` session, PowerShell returns the **ScriptsNotAllowed** error +message. - **ScriptsNotAllowed**: The syntax isn't supported by this runspace. This might be because it's in no-language mode. @@ -85,6 +89,9 @@ language mode by getting the value of the **LanguageMode** property. ```powershell (Get-PSSessionConfiguration -Name Test).LanguageMode +``` + +```Output FullLanguage ``` @@ -149,13 +156,13 @@ For more information, see [JEA Session configurations][01] and This section describes the language modes in PowerShell sessions. -### FullLanguage mode +### `FullLanguage` mode The `FullLanguage` mode permits all language elements in the session. `FullLanguage` is the default language mode for default sessions on all versions of Windows. -### RestrictedLanguage mode +### `RestrictedLanguage` mode In `RestrictedLanguage` mode, users can run commands (cmdlets, functions, CIM commands, and workflows), but can't use script blocks. This mode is also used @@ -179,7 +186,7 @@ additional variables: - `$PSScriptRoot` - `$PSEdition` - `$EnabledExperimentalFeatures` -- Any environment variables, like `$Env:TEMP` +- Any environment variable, like `$env:TEMP` Only the following comparison operators are permitted: @@ -189,7 +196,7 @@ Only the following comparison operators are permitted: Assignment statements, property references, and method calls aren't permitted. -### ConstrainedLanguage mode +### `ConstrainedLanguage` mode `ConstrainedLanguage` mode is designed to allow basic language elements such as loops, conditionals, string expansion, and access to object properties. The @@ -219,10 +226,10 @@ The features of `ConstrainedLanguage` mode are as follows: The following .NET types are permitted in `ConstrainedLanguage` mode. Users can get properties, invoke methods, and convert objects to these types. -Allowed Types: +Allowed types: -- `[adsi]` -- `[adsisearcher]` +- `[adsi]` (Windows-only) +- `[adsisearcher]` (Windows-only) - `[Alias]` - `[AllowEmptyCollection]` - `[AllowEmptyString]` @@ -277,7 +284,6 @@ Allowed Types: - `[psobject]` - `[psprimitivedictionary]` - `[PSTypeNameAttribute]` -- `[ref]` - `[regex]` - `[sbyte]` - `[securestring]` @@ -310,9 +316,9 @@ Allowed Types: - `[version]` - `[void]` - `[WildcardPattern]` -- `[wmi]` -- `[wmiclass]` -- `[wmisearcher]` +- `[wmi]` (Windows-only) +- `[wmiclass]` (Windows-only) +- `[wmisearcher]` (Windows-only) - `[X500DistinguishedName]` - `[X509Certificate]` - `[xml]` @@ -323,7 +329,13 @@ Only the following COM object types are permitted: - `Scripting.FileSystemObject` - `VBScript.RegExp` -### NoLanguage mode +Special cases: + +- `[ref]` - Casting an object to type `[ref]` or + `[Management.Automation.PSReference]` is not permitted. Other uses are + permitted. + +### `NoLanguage` mode PowerShell `NoLanguage` mode disables PowerShell scripting language completely. You can't run scripts or use variables. You can only run native commands and diff --git a/reference/7.5/Microsoft.PowerShell.Core/About/about_Language_Modes.md b/reference/7.5/Microsoft.PowerShell.Core/About/about_Language_Modes.md index bf113f57fb7c..f07079946635 100644 --- a/reference/7.5/Microsoft.PowerShell.Core/About/about_Language_Modes.md +++ b/reference/7.5/Microsoft.PowerShell.Core/About/about_Language_Modes.md @@ -1,7 +1,7 @@ --- description: Explains language modes and their effect on PowerShell sessions. Locale: en-US -ms.date: 10/04/2023 +ms.date: 04/03/2025 no-loc: [FullLanguage, ConstrainedLanguage, RestrictedLanguage, NoLanguage] online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes?view=powershell-7.5&WT.mc_id=ps-gethelp schema: 2.0.0 @@ -53,6 +53,9 @@ For example: ```powershell $ExecutionContext.SessionState.LanguageMode +``` + +```Output ConstrainedLanguage ``` @@ -60,7 +63,7 @@ However, in sessions with `RestrictedLanguage` and `NoLanguage` modes, you can't use the [member-access operator][02] (`.`) to get property values. Instead, the error message reveals the language mode. -When you run the `$ExecutionContext.SessionState.LanguageMode` command in a +When you access `$ExecutionContext.SessionState.LanguageMode` in a `RestrictedLanguage` session, PowerShell returns the **PropertyReferenceNotSupportedInDataSection** and **VariableReferenceNotSupportedInDataSection** error messages. @@ -71,8 +74,9 @@ When you run the `$ExecutionContext.SessionState.LanguageMode` command in a referenced in restricted language mode or a Data section is being referenced. -When you run the `$ExecutionContext.SessionState.LanguageMode` command in a -NoLanguage session, PowerShell returns the **ScriptsNotAllowed** error message. +When you access `$ExecutionContext.SessionState.LanguageMode` in a +`NoLanguage` session, PowerShell returns the **ScriptsNotAllowed** error +message. - **ScriptsNotAllowed**: The syntax isn't supported by this runspace. This might be because it's in no-language mode. @@ -85,6 +89,9 @@ language mode by getting the value of the **LanguageMode** property. ```powershell (Get-PSSessionConfiguration -Name Test).LanguageMode +``` + +```Output FullLanguage ``` @@ -149,13 +156,13 @@ For more information, see [JEA Session configurations][01] and This section describes the language modes in PowerShell sessions. -### FullLanguage mode +### `FullLanguage` mode The `FullLanguage` mode permits all language elements in the session. `FullLanguage` is the default language mode for default sessions on all versions of Windows. -### RestrictedLanguage mode +### `RestrictedLanguage` mode In `RestrictedLanguage` mode, users can run commands (cmdlets, functions, CIM commands, and workflows), but can't use script blocks. This mode is also used @@ -179,7 +186,7 @@ additional variables: - `$PSScriptRoot` - `$PSEdition` - `$EnabledExperimentalFeatures` -- Any environment variables, like `$Env:TEMP` +- Any environment variable, like `$env:TEMP` Only the following comparison operators are permitted: @@ -189,7 +196,7 @@ Only the following comparison operators are permitted: Assignment statements, property references, and method calls aren't permitted. -### ConstrainedLanguage mode +### `ConstrainedLanguage` mode `ConstrainedLanguage` mode is designed to allow basic language elements such as loops, conditionals, string expansion, and access to object properties. The @@ -219,10 +226,10 @@ The features of `ConstrainedLanguage` mode are as follows: The following .NET types are permitted in `ConstrainedLanguage` mode. Users can get properties, invoke methods, and convert objects to these types. -Allowed Types: +Allowed types: -- `[adsi]` -- `[adsisearcher]` +- `[adsi]` (Windows-only) +- `[adsisearcher]` (Windows-only) - `[Alias]` - `[AllowEmptyCollection]` - `[AllowEmptyString]` @@ -277,7 +284,6 @@ Allowed Types: - `[psobject]` - `[psprimitivedictionary]` - `[PSTypeNameAttribute]` -- `[ref]` - `[regex]` - `[sbyte]` - `[securestring]` @@ -310,9 +316,9 @@ Allowed Types: - `[version]` - `[void]` - `[WildcardPattern]` -- `[wmi]` -- `[wmiclass]` -- `[wmisearcher]` +- `[wmi]` (Windows-only) +- `[wmiclass]` (Windows-only) +- `[wmisearcher]` (Windows-only) - `[X500DistinguishedName]` - `[X509Certificate]` - `[xml]` @@ -323,7 +329,13 @@ Only the following COM object types are permitted: - `Scripting.FileSystemObject` - `VBScript.RegExp` -### NoLanguage mode +Special cases: + +- `[ref]` - Casting an object to type `[ref]` or + `[Management.Automation.PSReference]` is not permitted. Other uses are + permitted. + +### `NoLanguage` mode PowerShell `NoLanguage` mode disables PowerShell scripting language completely. You can't run scripts or use variables. You can only run native commands and diff --git a/reference/7.6/Microsoft.PowerShell.Core/About/about_Language_Modes.md b/reference/7.6/Microsoft.PowerShell.Core/About/about_Language_Modes.md index e75e37a8bda1..a78a133c4772 100644 --- a/reference/7.6/Microsoft.PowerShell.Core/About/about_Language_Modes.md +++ b/reference/7.6/Microsoft.PowerShell.Core/About/about_Language_Modes.md @@ -1,7 +1,7 @@ --- description: Explains language modes and their effect on PowerShell sessions. Locale: en-US -ms.date: 10/04/2023 +ms.date: 04/03/2025 no-loc: [FullLanguage, ConstrainedLanguage, RestrictedLanguage, NoLanguage] online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes?view=powershell-7.6&WT.mc_id=ps-gethelp schema: 2.0.0 @@ -53,6 +53,9 @@ For example: ```powershell $ExecutionContext.SessionState.LanguageMode +``` + +```Output ConstrainedLanguage ``` @@ -60,7 +63,7 @@ However, in sessions with `RestrictedLanguage` and `NoLanguage` modes, you can't use the [member-access operator][02] (`.`) to get property values. Instead, the error message reveals the language mode. -When you run the `$ExecutionContext.SessionState.LanguageMode` command in a +When you access `$ExecutionContext.SessionState.LanguageMode` in a `RestrictedLanguage` session, PowerShell returns the **PropertyReferenceNotSupportedInDataSection** and **VariableReferenceNotSupportedInDataSection** error messages. @@ -71,8 +74,9 @@ When you run the `$ExecutionContext.SessionState.LanguageMode` command in a referenced in restricted language mode or a Data section is being referenced. -When you run the `$ExecutionContext.SessionState.LanguageMode` command in a -NoLanguage session, PowerShell returns the **ScriptsNotAllowed** error message. +When you access `$ExecutionContext.SessionState.LanguageMode` in a +`NoLanguage` session, PowerShell returns the **ScriptsNotAllowed** error +message. - **ScriptsNotAllowed**: The syntax isn't supported by this runspace. This might be because it's in no-language mode. @@ -85,6 +89,9 @@ language mode by getting the value of the **LanguageMode** property. ```powershell (Get-PSSessionConfiguration -Name Test).LanguageMode +``` + +```Output FullLanguage ``` @@ -149,13 +156,13 @@ For more information, see [JEA Session configurations][01] and This section describes the language modes in PowerShell sessions. -### FullLanguage mode +### `FullLanguage` mode The `FullLanguage` mode permits all language elements in the session. `FullLanguage` is the default language mode for default sessions on all versions of Windows. -### RestrictedLanguage mode +### `RestrictedLanguage` mode In `RestrictedLanguage` mode, users can run commands (cmdlets, functions, CIM commands, and workflows), but can't use script blocks. This mode is also used @@ -179,7 +186,7 @@ additional variables: - `$PSScriptRoot` - `$PSEdition` - `$EnabledExperimentalFeatures` -- Any environment variables, like `$Env:TEMP` +- Any environment variable, like `$env:TEMP` Only the following comparison operators are permitted: @@ -189,7 +196,7 @@ Only the following comparison operators are permitted: Assignment statements, property references, and method calls aren't permitted. -### ConstrainedLanguage mode +### `ConstrainedLanguage` mode `ConstrainedLanguage` mode is designed to allow basic language elements such as loops, conditionals, string expansion, and access to object properties. The @@ -219,10 +226,10 @@ The features of `ConstrainedLanguage` mode are as follows: The following .NET types are permitted in `ConstrainedLanguage` mode. Users can get properties, invoke methods, and convert objects to these types. -Allowed Types: +Allowed types: -- `[adsi]` -- `[adsisearcher]` +- `[adsi]` (Windows-only) +- `[adsisearcher]` (Windows-only) - `[Alias]` - `[AllowEmptyCollection]` - `[AllowEmptyString]` @@ -277,7 +284,6 @@ Allowed Types: - `[psobject]` - `[psprimitivedictionary]` - `[PSTypeNameAttribute]` -- `[ref]` - `[regex]` - `[sbyte]` - `[securestring]` @@ -310,9 +316,9 @@ Allowed Types: - `[version]` - `[void]` - `[WildcardPattern]` -- `[wmi]` -- `[wmiclass]` -- `[wmisearcher]` +- `[wmi]` (Windows-only) +- `[wmiclass]` (Windows-only) +- `[wmisearcher]` (Windows-only) - `[X500DistinguishedName]` - `[X509Certificate]` - `[xml]` @@ -323,7 +329,13 @@ Only the following COM object types are permitted: - `Scripting.FileSystemObject` - `VBScript.RegExp` -### NoLanguage mode +Special cases: + +- `[ref]` - Casting an object to type `[ref]` or + `[Management.Automation.PSReference]` is not permitted. Other uses are + permitted. + +### `NoLanguage` mode PowerShell `NoLanguage` mode disables PowerShell scripting language completely. You can't run scripts or use variables. You can only run native commands and