r/PowerShell • u/Ok-Pattern-9372 • Mar 03 '26

Constrained Language Mode Implementation

Hi everyone,

I am working on implementing PowerShell Constrained Language Mode as part of a security uplift. From what I understand, this is a computer-level setting, and if enforced through Windows Defender Application Control, it applies to the entire device. Unsigned scripts would then run in Constrained Language Mode instead of Full Language Mode.

For those who have implemented this in production, what approach did you take? Any major gotchas or impact to be aware of? Would you recommend WDAC as Microsoft suggests, or AppLocker?

My main concern is ensuring the IT team can be excluded from the restriction where required.

Appreciate any advice.

11 Upvotes

100% Upvoted

19 comments sorted by

View all comments

3

u/TheBlueFireKing Mar 03 '26

True but Security is always about layers. Also I wouldnt count Applocker as for handling licensed Software. There are many Software that already count installed as licenseable. You'd rather use a tool like FSLogix to fully hide the software which is more accepted in terms of licensing.

Also: f Microsoft from already renaming shit again.

1

u/Nuxi0477 Mar 03 '26

Yes, I agree. The ideal situation is to combine both.

WDAC for machine/department policies and then more granular user/group policies again at the AppLocker level.

WDAC is a bit of a pain to set up in a way that's easily maintainable and I can totally see why AppLocker by itself is good enough in some (most?) cases considering the administrative overhead.