System lockdown / WDAC: Use of new audit-only mode prevents use of [pscustomobject] literals, behaves as if ConstrainedLanguage mode were in effect

[mklement0]

Prerequisites

• Write a descriptive title.
• Make sure you are able to repro it on the latest released version
• Search the existing issues.
• Refer to the FAQ.
• Refer to Differences between Windows PowerShell 5.1 and PowerShell.

Steps to reproduce

If I understand correctly, the new audit-only mode - despite technically reporting ConstrainedLanguage via $ExecutionContext.SessionState.LanguageMode - is meant to be a what-if constrained mode:

• In effect behave like FullLanguageMode, but log operations that would be prevented if ConstrainedLanguage mode were actually enforced.

However, with respect to [pscustomobject] literals that isn't the case: Their use fails quietly:

#requires -RunAsAdministrator

# Simulate entering audit-only system lockdown
[Environment]::SetEnvironmentVariable("__PSLockdownPolicy", "0x80000008", 'Machine')

# Launch a new process that tries to use a [pscustomobject] literal
Start-Process -Wait pwsh '-NoProfile -C [pscustomobject] @{ foo = 1 } | Out-Host; pause'

# Turn lockdown back off
[Environment]::SetEnvironmentVariable("__PSLockdownPolicy", $null, 'Machine')

The workaround is to simply execute $ExecutionContext.SessionState.LanguageMode = 'FullLanguage' in a session that was started in audit mode. (Is the ability to do so by design?)
However, even that doesn't work in other use cases: see

• Constrained Language Audit mode breaks az.resources #20785

As an aside:

• Arguably, [pscustomobject] literals should also work in true ConstrainedLanguage mode, but currently do not - see ConstrainedLanguage mode: [pscustomobject] literals cannot be used, even though the type is white-listed, and an equivalent New-Object call succeeds #20767

Expected behavior

A [pscustomobject] instance should be constructed and output.

Actual behavior

No output, i.e. the expression fails quietly (but may be logged - haven't verified that).

Error details

No response

Environment data

PowerShell 7.4.0 on W11 22H2

Visuals

No response

[JrndD]

Thanks. My session defaulted to ConstrainedLanguage after update.

[microsoft-github-policy-service]

📣 Hey @mklement0, how did we do? We would love to hear your feedback with the link below! 🗣️

🔗 https://aka.ms/PSRepoFeedback

Microsoft Forms