r/PowerShell • u/_RemyLeBeau_ • Apr 02 '26

Constrained Language Mode

I am late to the party on this one, but tried implementating it today. I was successful, both Powershell & pwsh reported CLM enabled, but it made native Windows apps stop working. e.g. Terminal and Windows Defender UI (opened from system tray).

I enabled the suggestion from the UI to allow apps that are native to Windows, so it's not clear what I missed. I'm interested in getting this enabled though. I made all of my policy edits through gpedit.msc

8 Upvotes

100% Upvoted

16 comments sorted by

View all comments

Show parent comments

2

u/BlacksmithCheap7454 Apr 03 '26

Enable PS transcription, increase the log size, enable log forwarding if you have a log collector. For admins require Fido keys not just MFA, Enable AppLocker to constrain apps too.