[Bug] Powershell constrained language mode issue when using invoke-AppDeployToolkit.exe

[TomDegreef]

Prerequisites

• Ensure you write a short, descriptive title after [Bug] above.
• Make sure to search for any existing issues before filing a new one.
• Verify you are able to reproduce the issue with the latest released version

PSAppDeployToolkit version

4.0.4

Describe the bug

When running invoke-AppDeployToolkit.exe in an environment that has Powershell constrained language mode enabled (in my case due to WDAC being enabled) , we run into a dot sourcing error.

According to the logs, invoke-AppDeployToolkit.exe adds some parameters to the invoke-AppDeployToolkit.ps1 automatically and that's where the issue lies.

in the logfile snippet we can see the following :

Commencing invocation of C:\WINDOWS\ccmcache\7\Invoke-AppDeployToolkit.ps1.
Administrator rights are required. The verb 'RunAs' will be used with the invocation.
No '-File' parameter specified on command-line. Adding parameter '-File "C:\WINDOWS\ccmcache\7\Invoke-AppDeployToolkit.ps1"'...

Using the -file parameter while having a [cmdletbinding] section, the launch method uses dot sourcing and this is being blocked by WDAC.
Unfortunately this is not truly visible in any of the eventlogs but enabling powershell transcript logging does show you the actual error :

PS>C:\WINDOWS\ccmcache\7\Invoke-AppDeployToolkit.ps1
Cannot dot-source this command because it was defined in a different language mode. To invoke this command without importing its contents, omit the '.' operator.
C:\WINDOWS\ccmcache\7\Invoke-AppDeployToolkit.ps1 : Cannot dot-source this command because it was defined in a
different language mode. To invoke this command without importing its contents, omit the '.' operator.
    + CategoryInfo          : InvalidOperation: (:) [Invoke-AppDeployToolkit.ps1], NotSupportedException
    + FullyQualifiedErrorId : DotSourceNotSupported,Invoke-AppDeployToolkit.ps1

A quick fix could be by removing the -File parameter.

Steps to reproduce

1. Enable Powershell Constrained language mode
2. Install a PSADTv4 package using Invoke-AppDeployToolkit.exe without any additional parameters.

Environment data

OsName               : Microsoft Windows 10 Enterprise
OsOperatingSystemSKU : EnterpriseEdition
OsArchitecture       : 64-bit
WindowsVersion       : 2009
WindowsProductName   : Windows 10 Enterprise
WindowsBuildLabEx    : 19041.1.amd64fre.vb_release.191206-1406
OsLanguage           : en-US
OsMuiLanguages       : {en-US}
KeyboardLayout       : 00020409
TimeZone             : (UTC+01:00) Brussels, Copenhagen, Madrid, Paris
HyperVisorPresent    : True
CsPartOfDomain       : True
CsPCSystemType       : Desktop

[sintaxasn]

Hi @TomDegreef,

I've put in a fix for this on develop, and there's a build that will show up here in 15 / 20 mins if you can test: https://github.com/PSAppDeployToolkit/PSAppDeployToolkit/actions/runs/13771190220

We've come across this before and I was sure we had fixed already since 3.x (@vincentverstraeten can confirm), but it may not have made it over to 4.x as an oversight.

[mjr4077au]

Using the -file parameter while having a [cmdletbinding] section, the launch method uses dot sourcing and this is being blocked by WDAC.

@TomDegreef we actually don't have a pressing need for CmdletBinding as none of our parameters are mandatory, it's just to get better error detection if the caller messes up a parameter (-DeployyyyyMode, etc). Based on what you're saying, maybe that's a cleaner approach as the -File parameter properly handles the exit code, etc.

[TomDegreef]

Hi @TomDegreef,

I've put in a fix for this on develop, and there's a build that will show up here in 15 / 20 mins if you can test: https://github.com/PSAppDeployToolkit/PSAppDeployToolkit/actions/runs/13771190220

We've come across this before and I was sure we had fixed already since 3.x (@vincentverstraeten can confirm), but it may not have made it over to 4.x as an oversight.

I think the potential fix caused a new issue ? The powershell transcript :

**********************
Windows PowerShell transcript start
Start time: 20250311105936
Username: LABO\SYSTEM
RunAs User: LABO\SYSTEM
Configuration Name: 
Machine: DG04 (Microsoft Windows NT 10.0.19042.0)
Host Application: C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe -ExecutionPolicy Bypass -NonInteractive -NoProfile -NoLogo -WindowStyle Hidden C:\WINDOWS\ccmcache\b\Invoke-AppDeployToolkit.ps1
Process ID: 8332
PSVersion: 5.1.19041.1
PSEdition: Desktop
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.19041.1
BuildVersion: 10.0.19041.1
CLRVersion: 4.0.30319.42000
WSManStackVersion: 3.0
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1
**********************
PS>C:\WINDOWS\ccmcache\b\Invoke-AppDeployToolkit.ps1
PS>TerminatingError(Show-ADTInstallationProgress): "Cannot process command because of one or more missing mandatory parameters: WindowTitle WindowSubtitle StatusMessage StatusMessageDetail."
>> TerminatingError(Show-ADTInstallationProgress): "Cannot process command because of one or more missing mandatory parameters: WindowTitle WindowSubtitle StatusMessage StatusMessageDetail."
PS>TerminatingError(Show-ADTDialogBox): "Cannot process command because of one or more missing mandatory parameters: Title."
>> TerminatingError(Invoke-AppDeployToolkit.ps1): "Cannot process command because of one or more missing mandatory parameters: Title."
**********************
Windows PowerShell transcript start
Start time: 20250311105947
Username: LABO\SYSTEM
RunAs User: LABO\SYSTEM
Configuration Name: 
Machine: DG04 (Microsoft Windows NT 10.0.19042.0)
Host Application: C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe -ExecutionPolicy Bypass -NonInteractive -NoProfile -NoLogo -WindowStyle Hidden C:\WINDOWS\ccmcache\b\Invoke-AppDeployToolkit.ps1
Process ID: 8332
PSVersion: 5.1.19041.1
PSEdition: Desktop
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.19041.1
BuildVersion: 10.0.19041.1
CLRVersion: 4.0.30319.42000
WSManStackVersion: 3.0
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1
**********************
PS>CommandInvocation(Out-String): "Out-String"
>> ParameterBinding(Out-String): name="InputObject"; value="Cannot process command because of one or more missing mandatory parameters: Title."
C:\WINDOWS\ccmcache\b\Invoke-AppDeployToolkit.ps1 : Cannot process command because of one or more missing mandatory 
parameters: Title.
At line:1 char:1
+ C:\WINDOWS\ccmcache\b\Invoke-AppDeployToolkit.ps1
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [Invoke-AppDeployToolkit.ps1], ParameterBindingException
    + FullyQualifiedErrorId : MissingMandatoryParameter,Invoke-AppDeployToolkit.ps1
C:\WINDOWS\ccmcache\b\Invoke-AppDeployToolkit.ps1 : Cannot process command because of one or more missing mandatory 
parameters: Title.
At line:1 char:1
+ C:\WINDOWS\ccmcache\b\Invoke-AppDeployToolkit.ps1
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [Invoke-AppDeployToolkit.ps1], ParameterBindingException
    + FullyQualifiedErrorId : MissingMandatoryParameter,Invoke-AppDeployToolkit.ps1
C:\WINDOWS\ccmcache\b\Invoke-AppDeployToolkit.ps1 : Cannot process command because of one or more missing mandatory
parameters: Title.
At line:1 char:1
+ C:\WINDOWS\ccmcache\b\Invoke-AppDeployToolkit.ps1
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [Invoke-AppDeployToolkit.ps1], ParameterBindingException
    + FullyQualifiedErrorId : MissingMandatoryParameter,Invoke-AppDeployToolkit.ps1

PS>$global:?
False
**********************
Windows PowerShell transcript end
End time: 20250311105947

the actual PSADT logfile seems to indicate that the -file parameter is still added :

Commencing invocation of C:\WINDOWS\ccmcache\7\Invoke-AppDeployToolkit.ps1.
Administrator rights are required. The verb 'RunAs' will be used with the invocation.
No '-File' parameter specified on command-line. Adding parameter '-File "C:\WINDOWS\ccmcache\7\Invoke-AppDeployToolkit.ps1"'...
Executable Path: C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe
Arguments: -ExecutionPolicy Bypass -NonInteractive -NoProfile -NoLogo -WindowStyle Hidden -File "C:\WINDOWS\ccmcache\7\Invoke-AppDeployToolkit.ps1"
Working Directory: C:\WINDOWS\ccmcache\7\
An error occurred while running Invoke-AppDeployToolkit.ps1. Exit code: 1

[mjr4077au]

@TomDegreef I've fixed it properly ~20 minutes ago, can you please download a build from here? https://github.com/PSAppDeployToolkit/PSAppDeployToolkit/actions/runs/13785039120

Is there any place we can chat? Are you on Discord? I'm interested in your findings regarding using -File and CmdletBinding impacting on this, and documentation pertaining to these things online is rather thin.

[TomDegreef]

@TomDegreef I've fixed it properly ~20 minutes ago, can you please download a build from here? https://github.com/PSAppDeployToolkit/PSAppDeployToolkit/actions/runs/13785039120

Is there any place we can chat? Are you on Discord? I'm interested in your findings regarding using -File and CmdletBinding impacting on this, and documentation pertaining to these things online is rather thin.

Maybe I'm doing something wrong but I now get a new error that doesnt seem wdac related

**********************
Windows PowerShell transcript start
Start time: 20250311115531
Username: LABO\SYSTEM
RunAs User: LABO\SYSTEM
Configuration Name: 
Machine: DG04 (Microsoft Windows NT 10.0.19042.0)
Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -NoLogo -WindowStyle Hidden -Command & (Import-Module -FullyQualifiedName @{ ModuleName = 'C:\WINDOWS\ccmcache\d\PSAppDeployToolkit\PSAppDeployToolkit.psd1'; Guid = '8c3c366b-8606-4576-9f2d-4051144f7ca2'; ModuleVersion = '4.1.0' } -PassThru) { & $CommandTable.'Initialize-ADTModule' -ScriptDirectory 'C:\WINDOWS\ccmcache\d'; $null = & $CommandTable.'Show-ADTInstallationPromptFluent' -Message:'You can customize text to appear at the end of an install or remove it completely for unattended installations.' -ButtonRightText:'OK' -Icon:'Information' -NoWait -Title:'AppControl.AI WDAC Log Collector Core 1.0.16.0' -Subtitle:'PSAppDeployToolkit - App Installation' -Timeout:3300 }
Process ID: 6100
PSVersion: 5.1.19041.1
PSEdition: Desktop
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.19041.1
BuildVersion: 10.0.19041.1
CLRVersion: 4.0.30319.42000
WSManStackVersion: 3.0
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1
**********************
PS>& (Import-Module -FullyQualifiedName @{ ModuleName = 'C:\WINDOWS\ccmcache\d\PSAppDeployToolkit\PSAppDeployToolkit.psd1'; Guid = '8c3c366b-8606-4576-9f2d-4051144f7ca2'; ModuleVersion = '4.1.0' } -PassThru) { & $CommandTable.'Initialize-ADTModule' -ScriptDirectory 'C:\WINDOWS\ccmcache\d'; $null = & $CommandTable.'Show-ADTInstallationPromptFluent' -Message:'You can customize text to appear at the end of an install or remove it completely for unattended installations.' -ButtonRightText:'OK' -Icon:'Information' -NoWait -Title:'AppControl.AI WDAC Log Collector Core 1.0.16.0' -Subtitle:'PSAppDeployToolkit - App Installation' -Timeout:3300 }
**********************
Windows PowerShell transcript start
Start time: 20250311115537
Username: LABO\SYSTEM
RunAs User: LABO\SYSTEM
Configuration Name: 
Machine: DG04 (Microsoft Windows NT 10.0.19042.0)
Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -NoLogo -WindowStyle Hidden -Command & (Import-Module -FullyQualifiedName @{ ModuleName = 'C:\WINDOWS\ccmcache\d\PSAppDeployToolkit\PSAppDeployToolkit.psd1'; Guid = '8c3c366b-8606-4576-9f2d-4051144f7ca2'; ModuleVersion = '4.1.0' } -PassThru) { & $CommandTable.'Initialize-ADTModule' -ScriptDirectory 'C:\WINDOWS\ccmcache\d'; $null = & $CommandTable.'Show-ADTInstallationPromptFluent' -Message:'You can customize text to appear at the end of an install or remove it completely for unattended installations.' -ButtonRightText:'OK' -Icon:'Information' -NoWait -Title:'AppControl.AI WDAC Log Collector Core 1.0.16.0' -Subtitle:'PSAppDeployToolkit - App Installation' -Timeout:3300 }
Process ID: 6100
PSVersion: 5.1.19041.1
PSEdition: Desktop
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.19041.1
BuildVersion: 10.0.19041.1
CLRVersion: 4.0.30319.42000
WSManStackVersion: 3.0
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1
**********************
PS>CommandInvocation(Out-String): "Out-String"
>> ParameterBinding(Out-String): name="InputObject"; value="Cannot use '&' or '.' operators to invoke a module scope command across language boundaries."
Cannot use '&' or '.' operators to invoke a module scope command across language boundaries.
At line:1 char:1
+ & (Import-Module -FullyQualifiedName @{ ModuleName = 'C:\WINDOWS\ccmc ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : CantInvokeCallOperatorAcrossLanguageBoundaries
Cannot use '&' or '.' operators to invoke a module scope command across language boundaries.
At line:1 char:1
+ & (Import-Module -FullyQualifiedName @{ ModuleName = 'C:\WINDOWS\ccmc ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : CantInvokeCallOperatorAcrossLanguageBoundaries
Cannot use '&' or '.' operators to invoke a module scope command across language boundaries.
At line:1 char:1
+ & (Import-Module -FullyQualifiedName @{ ModuleName = 'C:\WINDOWS\ccmc ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : CantInvokeCallOperatorAcrossLanguageBoundaries

PS>$global:?
False
**********************
Windows PowerShell transcript end
End time: 20250311115537
**********************

[TomDegreef]

@TomDegreef I've fixed it properly ~20 minutes ago, can you please download a build from here? https://github.com/PSAppDeployToolkit/PSAppDeployToolkit/actions/runs/13785039120

Is there any place we can chat? Are you on Discord? I'm interested in your findings regarding using -File and CmdletBinding impacting on this, and documentation pertaining to these things online is rather thin.

I've just opened up discord, so if you need me, you can find me there under : tomdegreef

[mjr4077au]

Ta, I've just added you.

[mjr4077au]

I believe with the changes @sintaxasn has made, as well as a few other things thereafter, this one's resolved. Thanks for everyone's time!

[TomDegreef]

When will this be implemented in the official release ?

[mjr4077au]

Some time in the next quarter, not super far away. You can test out a pre-release 4.1.0 build here if you like: https://github.com/PSAppDeployToolkit/PSAppDeployToolkit/actions/runs/14100617057

[alt421]

Hello @mjr4077au

I've experienced the exact issue that is described in this thread. I tried using the latest development build and I am able to successfully install/uninstall my apps (-command parameter is being used to call Invoke-AppDeployToolkit.ps1 instead of -file), however "-WindowStyle Hidden" is not being passed as part of the call resulting in a PowerShell window being presented to the user during interactive install/uninstall.

Here is the exact call from the PS transcript:

Host Application: C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -NoLogo -Command & 'C:\WINDOWS\IMECache\72ed05d9-a135-43ab-87c0-833580904420_2\Invoke-AppDeployToolkit.ps1' -DeploymentType Install -DeployMode Interactive; [System.Environment]::Exit($Global:LASTEXITCODE)

Also, it appears that " [System.Environment]::Exit($Global:LASTEXITCODE)" is being blocked due to PS constrained language mode:

PS>CommandInvocation(Out-String): "Out-String"
>> ParameterBinding(Out-String): name="InputObject"; value="Cannot invoke method. Method invocation is supported only on core types in this language mode."
Cannot invoke method. Method invocation is supported only on core types in this language mode.
At line:1 char:141
+ ... loyMode Interactive; [System.Environment]::Exit($Global:LASTEXITCODE)
+                          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : MethodInvocationNotSupportedInConstrainedLanguage
Cannot invoke method. Method invocation is supported only on core types in this language mode.
At line:1 char:141
+ ... loyMode Interactive; [System.Environment]::Exit($Global:LASTEXITCODE)
+                          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : MethodInvocationNotSupportedInConstrainedLanguage
Cannot invoke method. Method invocation is supported only on core types in this language mode.
At line:1 char:141
+ ... loyMode Interactive; [System.Environment]::Exit($Global:LASTEXITCODE)
+                          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : MethodInvocationNotSupportedInConstrainedLanguage

**********************
Command start time: 20250417082315
**********************
PS>$global:?
False

I am using the following command to initiate installation as part of my Intune win32 app:

%systemroot%\sysnative\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -Command .\Invoke-ServiceUI.ps1 -DeploymentType Install

For completeness, I'm using the development version of PSADT you provided (https://github.com/PSAppDeployToolkit/PSAppDeployToolkit/actions/runs/14100617057) with the development version of ServiceUI Example (https://github.com/PSAppDeployToolkit/PSAppDeployToolkit/tree/develop/examples/ServiceUI) and PSADT Winget Extension (https://github.com/mjr4077au/PSAppDeployToolkit.WinGet/)

Could you let me know if I'm missing something or if this is possibly a bug?