-
Notifications
You must be signed in to change notification settings - Fork 107
PowerShell Best Practices To Follow When Coding
It is important to follow best practices when coding in PowerShell to ensure that your codes are efficient, maintainable, and secure.
🚫 Don't do this
$Var = 5
✅ Do this instead
[System.Int32]$Var = 5
🚫 Don't do this
[String]$Var = 'Hello'
✅ Do this instead
[System.String]$Var = 'Hello'
🚫 Don't do this
$Var = "Hello"
✅ Do this instead
$Var = 'Hello'
This is because double quotes allow for string interpolation, which can be a security risk if the string is not sanitized properly and also slightly slower than single quotes.
🚫 Don't do this
Gci
cls
✅ Do this instead
Get-ChildItem
Clear-Host
🚫 Don't do this
$myvariable
get-childitem
new-item
🚫 or this (camelCase)
$myVariable
get-ChildItem
new-Item
✅ Do this instead
$MyVariable
Get-ChildItem
New-Item
✅ Using regions like this allows you to collapse and expand sections of your code for better readability.
#Region Functions
function Get-MyFunction1 {
# Function code here
}
function Get-MyFunction2 {
# Function code here
}
function Get-MyFunction3 {
# Function code here
}
#EndRegion
You can access the settings page of PowerShell extension in VS Code and enable options that automatically apply some of the aforementioned best practices when you format your code with (CTRL + Shift + F) shortcut.
Global variables are not recommended in general because of security implications. They can be overwritten by the user on console as well.
If you need to define global variables, make sure you set them as constants or read-only so that they cannot be overwritten once they are defined.
If you need custom types in PowerShell and want them to be globally available to your module, It's recommended to use C# and define custom classes with specific and unique Namespace and Class names so that there won't be any possible conflicts with other classes/types that belong to 3rd party modules.
Even though it's not recommended, here is how you can make custom classes globally available in PowerShell. Classes will be available process-wide and therefore also in other runspaces, defining them with the [NoRunspaceAffinity()]
attribute.
[NoRunspaceAffinity()]
Class Items : System.Management.Automation.IValidateSetValuesGenerator {
[System.String[]] GetValidValues() {
$Items = ('Item1', 'Item2', 'Item3')
return [System.String[]]$Items
}
}
[NoRunspaceAffinity()]
Class BasePolicyNames : System.Management.Automation.IValidateSetValuesGenerator {
[System.String[]] GetValidValues() {
[System.String[]]$BasePolicyNames = foreach ($Policy in (&'C:\Windows\System32\CiTool.exe' -lp -json | ConvertFrom-Json).Policies) {
if ($Policy.IsSystemPolicy -ne 'True') {
if ($Policy.PolicyID -eq $Policy.BasePolicyID) {
$Policy.FriendlyName
}
}
}
return $BasePolicyNames
}
}
# Define the types to export with type accelerators.
[System.Reflection.TypeInfo[]]$ExportableTypes = @(
[Items]
[BasePolicyNames]
)
# Get the non-public TypeAccelerators class for defining new accelerators.
[System.Reflection.TypeInfo]$TypeAcceleratorsClass = [psobject].Assembly.GetType('System.Management.Automation.TypeAccelerators')
# Add type accelerators for every exportable type.
$ExistingTypeAccelerators = $TypeAcceleratorsClass::Get
foreach ($Type in $ExportableTypes) {
# !! $TypeAcceleratorsClass::Add() quietly ignores attempts to redefine existing
# !! accelerators with different target types, so we check explicitly.
$Existing = $ExistingTypeAccelerators[$Type.FullName]
if (($null -ne $Existing) -and ($Existing -ne $Type)) {
throw "Unable to register type accelerator [$($Type.FullName)], because it is already defined with a different type ([$Existing])."
}
$TypeAcceleratorsClass::Add($Type.FullName, $Type)
}
- Cmdlet Development Guidelines
- Required Development Guidelines
- Strongly Encouraged Development Guidelines
- Advisory Development Guidelines
-
New-WDACConfig
-
New-SupplementalWDACConfig
-
Remove-WDACConfig
-
Edit-WDACConfig
-
Edit-SignedWDACConfig
-
Deploy-SignedWDACConfig
-
Confirm-WDACConfig
-
New-DenyWDACConfig
-
Set-CommonWDACConfig
-
New-KernelModeWDACConfig
-
Get-CommonWDACConfig
-
Invoke-WDACSimulation
-
Remove-CommonWDACConfig
-
Assert-WDACConfigIntegrity
-
Build-WDACCertificate
-
Test-CiPolicy
-
Get-CiFileHashes
-
ConvertTo-WDACPolicy
-
Set-CiRuleOptions
-
Get-CIPolicySetting
-
Introduction
-
WDAC for Lightly Managed Devices
-
WDAC for Fully managed device - Variant 1
-
WDAC for Fully managed device - Variant 2
-
WDAC for Fully managed device - Variant 3
-
WDAC for Fully managed device - Variant 4
-
WDAC Notes
-
How to Create and Deploy a Signed WDAC Policy
-
Fast and Automatic Microsoft Recommended Driver Block Rules updates
-
WDAC policy for BYOVD Kernel mode only protection
-
EKUs in WDAC, App Control for Business, Policies
-
WDAC Rule Levels Comparison and Guide
-
Script Enforcement and PowerShell Constrained Language
-
How to Use Microsoft Defender for Endpoint Advanced Hunting With WDAC App Control
-
Application Control (WDAC) Frequently Asked Questions (FAQs)
-
Create Bootable USB flash drive with no 3rd party tools
-
Event Viewer
-
Group Policy
-
How to compact your OS and free up extra space
-
Hyper V
-
Overrides for Microsoft Security Baseline
-
Git GitHub Desktop and Mandatory ASLR
-
Signed and Verified commits with GitHub desktop
-
About TLS, DNS, Encryption and OPSEC concepts
-
Things to do when clean installing Windows
-
Comparison of security benchmarks
-
BitLocker, TPM and Pluton | What Are They and How Do They Work
-
How to Detect Changes in User and Local Machine Certificate Stores in Real Time Using PowerShell
-
Cloning Personal and Enterprise Repositories Using GitHub Desktop
-
Device Guard and Virtualization Based Security in Windows
-
Only a Small Portion of The Windows OS Security Apparatus
-
Clean Source principle, Azure and Privileged Access Workstations
-
How to Securely Connect to Azure VMs and Use RDP
-
Basic PowerShell tricks and notes
-
Basic PowerShell tricks and notes Part 2
-
Basic PowerShell tricks and notes Part 3
-
Basic PowerShell tricks and notes Part 4
-
Basic PowerShell tricks and notes Part 5
-
How To Access All Stream Outputs From Thread Jobs In PowerShell In Real Time
-
PowerShell Best Practices To Follow When Coding
-
How To Asynchronously Access All Stream Outputs From Background Jobs In PowerShell
-
Powershell Dynamic Parameters and How to Add Them to the Get‐Help Syntax
-
RunSpaces In PowerShell