Skip to content

10/21/2024 PM Publish #11488

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Oct 21, 2024
Merged

10/21/2024 PM Publish #11488

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c17230f
Update HoF (#11482)
sdwheeler Oct 19, 2024
166792a
Corrected the names referring to WDAC to use App Control (#11481)
HotCakeX Oct 21, 2024
9f1ad36
Change WDAC to App Control (#11486)
sdwheeler Oct 21, 2024
823b7d1
Add note to -PassThru (#11487)
sdwheeler Oct 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions redir/.openpublishing.redirection.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,15 @@
{
"redirections": [
{
"redirect_document_id": true,
"redirect_url": "/powershell/scripting/security/app-control/how-to-use-app-control",
"source_path": "../reference/docs-conceptual/security/app-control/how-to-use-wdac.md"
},
{
"redirect_document_id": true,
"redirect_url": "/powershell/scripting/security/app-control/how-app-control-works",
"source_path": "../reference/docs-conceptual/security/app-control/how-wdac-works.md"
},
{
"redirect_document_id": true,
"redirect_url": "/powershell/scripting/security/preventing-script-injection",
Expand Down
5 changes: 5 additions & 0 deletions reference/5.1/Microsoft.PowerShell.Utility/Invoke-WebRequest.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -453,6 +453,11 @@ Accept wildcard characters: False
Indicates that the cmdlet returns the results, in addition to writing them to a file. This parameter
is valid only when the **OutFile** parameter is also used in the command.

> [!NOTE]
> When you use the **PassThru** parameter, the output is written to the pipeline but the file is
> empty. For more information, see
> [PowerShell Issue #15409](https://github.com/PowerShell/PowerShell/issues/15409).

```yaml
Type: System.Management.Automation.SwitchParameter
Parameter Sets: (All)
Expand Down
26 changes: 25 additions & 1 deletion reference/docs-conceptual/community/2024-updates.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
description: List of changes to the PowerShell documentation for 2024
ms.date: 09/05/2024
ms.date: 10/19/2024
title: What's New in PowerShell-Docs for 2024
---
# What's new in PowerShell Docs for 2024
Expand All @@ -11,6 +11,30 @@ community.
Help us make the documentation better for you. Read the [Contributor's Guide][01] to learn how to
get started.

## 2024-September

New content

- [Improve the accessibility of output in PowerShell](/powershell/scripting/learn/shell/output-for-screen-reader)
- [What's new in PSResourceGet?](/powershell/gallery/powershellget/psresourceget-release-notes)
- [about_PSReadLine_Release_Notes](/powershell/module/psreadline/about/about_psreadline_release_notes)

### Top Community Contributors

GitHub stats

- 29 PRs merged (1 from Community)
- 19 issues opened (19 from Community)
- 20 issues closed (20 Community issues closed)

The following people contributed to PowerShell docs this month by submitting pull requests or
filing issues. Thank you!

| GitHub Id | PRs merged | Issues opened |
| --------- | :--------: | :-----------: |
| iRon7 | | 5 |
| jikuja | | 2 |

## 2024-August

- Updates for new releases of PowerShell 7.2.23, 7.4.5 and 7.5-preview.4
Expand Down
10 changes: 5 additions & 5 deletions reference/docs-conceptual/community/hall-of-fame.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
description: List of the GitHub users that have the most contributions to the PowerShell-Doc project.
ms.date: 09/05/2024
ms.date: 10/19/2024
title: Community contributor Hall of Fame
---
# Community Contributor Hall of Fame
Expand All @@ -17,7 +17,7 @@ Pull Requests help us fix those issues and make the documentation better for eve

| PRs Merged | 2015 | 2016 | 2017 | 2018 | 2019 | 2020 | 2021 | 2022 | 2023 | 2024 | Grand Total |
| --------------- | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ----------: |
| Community | 3 | 194 | 446 | 464 | 318 | 161 | 100 | 122 | 108 | 53 | 1969 |
| Community | 3 | 194 | 446 | 464 | 318 | 161 | 100 | 121 | 108 | 54 | 1969 |
| matt9ucci | | | 157 | 80 | 30 | 1 | 6 | | | | 274 |
| nschonni | | | | 14 | 138 | 10 | | | | | 162 |
| kiazhi | | 25 | 79 | 12 | | | | | | | 116 |
Expand All @@ -31,8 +31,8 @@ Pull Requests help us fix those issues and make the documentation better for eve
| NReilingh | | 2 | | 13 | 3 | | | | | | 18 |
| it-praktyk | | | | 16 | 1 | | | | | | 17 |
| vors | | 15 | 1 | | | | | | | | 16 |
| markekraus | | | 11 | 5 | | | | | | | 16 |
| kvprasoon | | 2 | 1 | 7 | 2 | 2 | 2 | | | | 16 |
| markekraus | | | 11 | 5 | | | | | | | 16 |
| purdo17 | | | | 13 | | | | | | | 13 |
| k-takai | | | | 5 | 1 | 7 | | | | | 13 |
| exchange12rocks | | | 7 | 3 | | | 1 | | | | 11 |
Expand All @@ -45,15 +45,15 @@ GitHub issues help us identify errors and gaps in our documentation.

| Issues Opened | 2015 | 2016 | 2017 | 2018 | 2019 | 2020 | 2021 | 2022 | 2023 | 2024 | Grand Total |
| --------------- | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ----------: |
| Community | 3 | 54 | 95 | 211 | 561 | 557 | 365 | 225 | 270 | 157 | 2498 |
| Community | 3 | 54 | 95 | 211 | 561 | 557 | 364 | 225 | 270 | 169 | 2509 |
| mklement0 | | | 19 | 60 | 56 | 61 | 28 | 8 | 20 | 23 | 275 |
| ehmiiz | | | | | | | | 20 | 14 | | 34 |
| iSazonov | | | 1 | 4 | 10 | 8 | 4 | 3 | | 1 | 31 |
| jszabo98 | | | | 2 | 15 | 6 | 1 | | 1 | 2 | 27 |
| iRon7 | | | | | | 2 | 2 | 2 | 10 | 7 | 23 |
| juvtib | | | | | | 15 | 7 | | | | 22 |
| doctordns | | | 5 | 3 | 5 | 7 | 1 | | | | 21 |
| peetrike | | | | 1 | | 4 | 2 | 6 | 4 | 3 | 20 |
| iRon7 | | | | | | 2 | 2 | 2 | 10 | 4 | 20 |
| vexx32 | | | | 3 | 11 | | | 3 | | | 17 |
| JustinGrote | | | | 1 | 3 | 6 | 1 | 1 | 2 | 2 | 16 |
| KirkMunro | | | | 7 | 7 | 1 | | | | | 15 |
Expand Down
103 changes: 51 additions & 52 deletions reference/docs-conceptual/security/app-control/application-control.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,85 +1,84 @@
---
description: This article explains the features of Windows using Windows Defender Application Control (WDAC) that can be used to secure your PowerShell environment.
ms.date: 09/19/2024
title: Use Windows Defender Application Control to secure PowerShell
description: This article explains the features of Application Control that can be used to secure your PowerShell environment.
ms.date: 10/21/2024
title: Use App Control to secure PowerShell
---
# Use Windows Defender Application Control to secure PowerShell
# Use App Control to secure PowerShell

Windows 10 includes two technologies, [Windows Defender Application Control (WDAC)][04] and
[AppLocker][01] that you can use to control applications. They allow you to create a lockdown
experience to help secure your PowerShell environment.
Windows 10 includes two technologies, [App Control for Business][04] and [AppLocker][01],
that you can use to control applications. They allow you to create a lockdown experience to help
secure your PowerShell environment.

**AppLocker** builds on the application control features of Software Restriction Policies. AppLocker
allows you to create rules to allow or deny apps for specific users or groups. You identify the apps
based on unique properties of the files.

**WDAC**, introduced with Windows 10, allows you to control which drivers and applications are
allowed to run on Windows.
**Application Control for Business**, introduced in Windows 10 as Windows Defender Application
Control (WDAC), allows you to control which drivers and applications are allowed to run on Windows.

## Lockdown policy detection

PowerShell detects both AppLocker and WDAC system wide policies. AppLocker doesn't have way to query
the policy enforcement status. To detect if a system wide application control policy is being
enforced by AppLocker, PowerShell creates two temporary files and tests if they can be executed. The
filenames use the following name format:
PowerShell detects both AppLocker and App Control for Business system wide policies. AppLocker
doesn't have way to query the policy enforcement status. To detect if a system wide application
control policy is being enforced by AppLocker, PowerShell creates two temporary files and tests if
they can be executed. The filenames use the following name format:

- `$env:TEMP/__PSAppLockerTest__<random-8dot3-name>.ps1`
- `$env:TEMP/__PSAppLockerTest__<random-8dot3-name>.psm1`

WDAC is the preferred application control system for Windows. WDAC provides APIs that allow you to
discover the policy configuration. WDAC is designed as a security feature under the servicing
criteria defined by the Microsoft Security Response Center (MSRC).

For more information about AppLocker and WDAC, see [Application Controls for Windows][04] and
[WDAC and AppLocker feature availability][02].
App Control for Business is the preferred application control system for Windows. App Control
provides APIs that allow you to discover the policy configuration. App Control is designed as a
security feature under the servicing criteria defined by the Microsoft Security Response Center
(MSRC). For more information, see [Application Controls for Windows][04] and
[App Control and AppLocker feature availability][02].

> [!NOTE]
> When [choosing between WDAC or AppLocker][03], we recommend that you implement application control
> using WDAC rather than AppLocker. Microsoft is continually improving WDAC and Microsoft management
> platforms are extending their support for WDAC. Although AppLocker may continue to receive
> security fixes, it won't receive feature enhancements.
> When [choosing between App Control or AppLocker][03], we recommend that you implement application
> control using App Control for Business rather than AppLocker. Microsoft is no longer investing in
> AppLocker. Although AppLocker may continue to receive security fixes, it won't receive feature
> enhancements.

## WDAC policy enforcement
## App Control policy enforcement

When PowerShell runs under a WDAC policy, its behavior changes based on the defined security policy.
Under a WDAC policy, PowerShell runs trusted scripts and modules allowed by the policy in
`FullLanguage` mode. All other scripts and script blocks are untrusted and run in
When PowerShell runs under an App Control policy, its behavior changes based on the defined security
policy. Under an App Control policy, PowerShell runs trusted scripts and modules allowed by the
policy in `FullLanguage` mode. All other scripts and script blocks are untrusted and run in
`ConstrainedLanguage` mode. PowerShell throws errors when the untrusted scripts attempt to perform
actions that aren't allowed in `ConstrainedLanguage` mode. It can be difficult to know why a script
failed to run correctly in `ConstrainedLanguage` mode.

## WDAC policy auditing
## App Control policy auditing

PowerShell 7.4 added a new feature to support WDAC policies in **Audit** mode. In audit mode,
PowerShell 7.4 added a new feature to support App Control policies in **Audit** mode. In audit mode,
PowerShell runs the untrusted scripts in `ConstrainedLanguage` mode without errors, but logs
messages to the event log instead. The log messages describe what restrictions would apply if the
policy were in **Enforce** mode.

## History of changes

Windows PowerShell 5.1 was the first version of PowerShell to support WDAC. The security features of
WDAC and AppLocker improve with each new release of PowerShell. The following sections describe how
this support changed in each version of PowerShell. The changes are cumulative, so the features
described in the later versions include those from earlier versions.
Windows PowerShell 5.1 was the first version of PowerShell to support App Control. The security
features of App Control and AppLocker improve with each new release of PowerShell. The following
sections describe how this support changed in each version of PowerShell. The changes are
cumulative, so the features described in the later versions include those from earlier versions.

### Changes in PowerShell 7.4

On Windows, when PowerShell runs under a Windows Defender Application Control (WDAC) policy, its
behavior changes based on the defined security policy. Under a WDAC policy, PowerShell runs trusted
scripts and modules allowed by the policy in `FullLanguage` mode. All other scripts and script
blocks are untrusted and run in `ConstrainedLanguage` mode. PowerShell throws errors when the
untrusted scripts attempt to perform disallowed actions. It's difficult to know why a script fails
to run correctly in `ConstrainedLanguage` mode.
On Windows, when PowerShell runs under an App Control policy, its behavior changes based on the
defined security policy. Under an App Control policy, PowerShell runs trusted scripts and modules
allowed by the policy in `FullLanguage` mode. All other scripts and script blocks are untrusted and
run in `ConstrainedLanguage` mode. PowerShell throws errors when the untrusted scripts attempt to
perform disallowed actions. It's difficult to know why a script fails to run correctly in
`ConstrainedLanguage` mode.

PowerShell 7.4 now supports WDAC policies in **Audit** mode. In audit mode, PowerShell runs the
untrusted scripts in `ConstrainedLanguage` mode but logs messages to the event log instead of
PowerShell 7.4 now supports App Control policies in **Audit** mode. In audit mode, PowerShell runs
the untrusted scripts in `ConstrainedLanguage` mode but logs messages to the event log instead of
throwing errors. The log messages describe what restrictions would apply if the policy were in
**Enforce** mode.

### Changes in PowerShell 7.3

- PowerShell 7.3 now supports the ability to block or allow PowerShell script files via the WDAC
API.
- PowerShell 7.3 now supports the ability to block or allow PowerShell script files via the App
Control API.

### Changes in PowerShell 7.2

Expand All @@ -96,14 +95,14 @@ throwing errors. The log messages describe what restrictions would apply if the

## Further reading

- For more information about how WDAC works and what restrictions it enforces, see
[How WDAC works with PowerShell][06].
- For more information about securing PowerShell with WDAC, see [How to use WDAC][05].
- For more information about how App Control works and what restrictions it enforces, see
[How App Control works with PowerShell][06].
- For more information about securing PowerShell with App Control, see [How to use App Control][05].

<!-- link references -->
[01]: /windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker
[02]: /windows/security/threat-protection/windows-defender-application-control/feature-availability
[03]: /windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview#choose-when-to-use-wdac-or-applocker
[04]: /windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control
[05]: how-to-use-wdac.md
[06]: how-wdac-works.md
[01]: /windows/security/application-security/application-control/app-control-for-business/applocker/what-is-applocker
[02]: /windows/security/application-security/application-control/app-control-for-business/feature-availability
[03]: /windows/security/application-security/application-control/app-control-for-business/appcontrol-and-applocker-overview#choose-when-to-use-app-control-or-applocker
[04]: /windows/security/application-security/application-control/app-control-for-business/appcontrol
[05]: how-to-use-app-control.md
[06]: how-app-control-works.md
Loading