fix: add -IgnoreLanguageMode switch to bypass CLM check in WDAC-managed environments

[praneeth-0000]

addresses issue #1097

Summary

In environments where Windows Defender Application Control (WDAC) or AppLocker is enabled, PowerShell sessions always report ConstrainedLanguage as the session language mode, even when the module is explicitly trusted by policy and runs with full .NET capability. The module was performing a hard block on any session reporting non-Full language mode, making it impossible to run the assessment on WDAC-managed devices regardless of trust configuration.

Root Cause

Test-ZtLanguageMode reads $ExecutionContext.SessionState.LanguageMode and immediately exits with a terminating error if the value is not FullLanguage. The session-level LanguageMode property is set at process startup by WDAC and never changes.

Fix

Added an -IgnoreLanguageMode switch to Connect-ZtAssessment and Invoke-ZtAssessment, passed through to Test-ZtLanguageMode. When specified:

• The CLM detection produces a yellow warning instead of a terminating red error
• The function returns $true and the assessment proceeds normally
• All existing behavior is unchanged when the switch is not used

Usage

Before (blocks in WDAC environments):

Connect-ZtAssessment
Invoke-ZtAssessment

After (use in WDAC-managed environments where the module is trusted):

Connect-ZtAssessment -IgnoreLanguageMode
Invoke-ZtAssessment -IgnoreLanguageMode

Notes

• This switch is intentionally opt-in. Without it, behavior is unchanged and CLM still blocks by default.
• If the module is not trusted by the WDAC policy and CLM is truly enforced, the assessment may fail mid-run with confusing errors. The warning message communicates this risk to the user.

Screenshots

Connect-ZtAssessment with and without -IgnoreLanguageMode switch

Invoke-ZtAssessment with and without -IgnoreLanguageMode swtich

[Copilot]

Pull request overview

Adds an opt-in -IgnoreLanguageMode switch to allow the assessment to run in WDAC/AppLocker environments that report ConstrainedLanguage at the session level despite the module being trusted, by downgrading the language-mode block from a hard stop to a warning.

Changes:

• Add -IgnoreLanguageMode to Connect-ZtAssessment and Invoke-ZtAssessment public cmdlets (with comment-based help updates).
• Extend Test-ZtLanguageMode to accept -IgnoreLanguageMode and return true with a warning when non-Full language mode is detected.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
src/powershell/public/Invoke-ZtAssessment.ps1	Adds -IgnoreLanguageMode parameter and passes it into Test-ZtLanguageMode.
src/powershell/public/Connect-ZtAssessment.ps1	Adds -IgnoreLanguageMode parameter and passes it into Test-ZtLanguageMode.
src/powershell/private/core/Test-ZtLanguageMode.ps1	Implements -IgnoreLanguageMode behavior (warn + proceed) when language mode isn’t FullLanguage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.