Skip to content

System lockdown / WDAC: Use of new audit-only mode prevents use of [pscustomobject] literals, behaves as if ConstrainedLanguage mode were in effect #20768

@mklement0

Description

@mklement0

Prerequisites

Steps to reproduce

If I understand correctly, the new audit-only mode - despite technically reporting ConstrainedLanguage via $ExecutionContext.SessionState.LanguageMode - is meant to be a what-if constrained mode:

  • In effect behave like FullLanguageMode, but log operations that would be prevented if ConstrainedLanguage mode were actually enforced.

However, with respect to [pscustomobject] literals that isn't the case: Their use fails quietly:

#requires -RunAsAdministrator

# Simulate entering audit-only system lockdown
[Environment]::SetEnvironmentVariable("__PSLockdownPolicy", "0x80000008", 'Machine')

# Launch a new process that tries to use a [pscustomobject] literal
Start-Process -Wait pwsh '-NoProfile -C [pscustomobject] @{ foo = 1 } | Out-Host; pause'

# Turn lockdown back off
[Environment]::SetEnvironmentVariable("__PSLockdownPolicy", $null, 'Machine')

The workaround is to simply execute $ExecutionContext.SessionState.LanguageMode = 'FullLanguage' in a session that was started in audit mode. (Is the ability to do so by design?)
However, even that doesn't work in other use cases: see

As an aside:

Expected behavior

A [pscustomobject] instance should be constructed and output.

Actual behavior

No output, i.e. the expression fails quietly (but may be logged - haven't verified that).

Error details

No response

Environment data

PowerShell 7.4.0 on W11 22H2

Visuals

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    In-PRIndicates that a PR is out for the issueIssue-BugIssue has been identified as a bug in the productWG-NeedsReviewNeeds a review by the labeled Working GroupWG-Securitysecurity related areas such as JEA

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions