-
Notifications
You must be signed in to change notification settings - Fork 7.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add WDAC Audit mode logging as experimental feature #19390
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Doesn't have to be code fenced, but we should advertise this as an Experimental Feature in case we need to change the trace messages based on user feedback
var er = new ErrorRecord(se, "Modules_CannotExportMembersAccrossLanguageBoundaries", ErrorCategory.SecurityError, this); | ||
ThrowTerminatingError(er); | ||
if (Context.LanguageMode != PSLanguageMode.ConstrainedLanguageAudit && | ||
Context.EngineSessionState.Module.LanguageMode != PSLanguageMode.ConstrainedLanguageAudit) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
(note to myself) need to take a closer look at this.
This PR has Quantification details
Why proper sizing of changes matters
Optimal pull request sizes drive a better predictable PR flow as they strike a
What can I do to optimize my changes
How to interpret the change counts in git diff output
Was this comment helpful? 👍 :ok_hand: :thumbsdown: (Email) |
@PaulHigin I'm closing this one assuming it's superseded by #19641 |
PR Summary
This PR adds a new language mode and logging messages to PowerShell restrictions when run under Windows WDAC (Windows Defender Application Control) policy.
This addresses Issue #18628
PR Context
PowerShell enforces language mode and other restrictions when it detects it is running under a WDAC (or deprecated AppLocker) system polices (Windows platform only). The enforced restrictions can cause existing script (written without the restrictions in mind) to break in unpredictable ways.
WDAC can run in Audit mode where policy restriction instances are not enforced but logged. These changes updates PowerShell so that when WDAC is in Audit mode, it too logs when restrictions would apply if the policy was being enforced. This will help users to understand what restrictions will apply when their script runs in policy enforcement mode.
PR Checklist
.h
,.cpp
,.cs
,.ps1
and.psm1
files have the correct copyright headerWIP:
or[ WIP ]
to the beginning of the title (theWIP
bot will keep its status check atPending
while the prefix is present) and remove the prefix when the PR is ready.(which runs in a different PS Host).