From 3eba31a267369135c7c2711f9f5fa14d0c21cf00 Mon Sep 17 00:00:00 2001 From: Sean Wheeler Date: Fri, 17 Jul 2026 08:11:23 -0500 Subject: [PATCH 1/3] Expand on defense-in-depth --- .../security/security-features.md | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/reference/docs-conceptual/security/security-features.md b/reference/docs-conceptual/security/security-features.md index 06769569a94..8f63276a8dc 100644 --- a/reference/docs-conceptual/security/security-features.md +++ b/reference/docs-conceptual/security/security-features.md @@ -1,6 +1,6 @@ --- description: PowerShell has several features designed to improve the security of your scripting environment. -ms.date: 08/18/2025 +ms.date: 07/17/2026 title: PowerShell security features --- # PowerShell security features @@ -71,10 +71,12 @@ being enforced. The policy applies certain behaviors when running script blocks, loading module files to prevent arbitrary code execution on the system. App Control for Business is designed as a security feature under the servicing criteria defined by -the Microsoft Security Response Center (MSRC). App Control is the preferred application control -system for Windows. +the Microsoft Security Response Center (MSRC). App Control for Business is the preferred application +control system for Windows. AppLocker is a legacy application control system that is still supported +in Windows 10 and Windows 11. AppLocker is not a security feature under the servicing criteria +defined by MSRC. -For more information about how PowerShell supports AppLocker and App Control, see +For more information about how PowerShell supports AppLocker and App Control for Business, see [Use App Control to secure PowerShell][10]. ### System Lockdown mode @@ -154,12 +156,15 @@ Security features - System Lockdown with App Control for Business - Constrained language mode with App Control for Business -Defense in depth features +Defense-in-depth features +- Constrained language mode with AppLocker or configured manually through `$ExecutionContext` or + session configuration - System Lockdown with AppLocker -- Constrained language mode with AppLocker - Execution Policy +Defense-in-depth features don't provide security boundaries. + [01]: /dotnet/fundamentals/runtime-libraries/system-security-securestring [02]: /powershell/module/microsoft.powershell.core/about/about_execution_policies From 37b3fe7b5b729ef9bb1ee623a15bb756bbd8234e Mon Sep 17 00:00:00 2001 From: Sean Wheeler Date: Fri, 17 Jul 2026 09:00:07 -0500 Subject: [PATCH 2/3] Add definitions and full variable path --- .../docs-conceptual/security/security-features.md | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/reference/docs-conceptual/security/security-features.md b/reference/docs-conceptual/security/security-features.md index 8f63276a8dc..6726c31cef6 100644 --- a/reference/docs-conceptual/security/security-features.md +++ b/reference/docs-conceptual/security/security-features.md @@ -148,6 +148,13 @@ This change is backward compatible. ## Security Servicing Criteria +A security boundary provides a logical separation between the code and data of security domains with +different levels of trust. Security features build upon security boundaries to provide robust +protection against specific threats. In some cases, a security feature may provide protection +against a threat without being able to provide a robust defense. These security features are +typically referred to as defense-in-depth features or mitigations because they provide additional +security but may have by design limitations that prevent them from fully mitigating a threat. + PowerShell follows the [Microsoft Security Servicing Criteria for Windows][12]. Only security features meet the criteria for servicing. @@ -158,13 +165,11 @@ Security features Defense-in-depth features -- Constrained language mode with AppLocker or configured manually through `$ExecutionContext` or - session configuration +- Constrained language mode with AppLocker or configured through session configuration or by + manually setting `$ExecutionContext.SessionState.LanguageMode` - System Lockdown with AppLocker - Execution Policy -Defense-in-depth features don't provide security boundaries. - [01]: /dotnet/fundamentals/runtime-libraries/system-security-securestring [02]: /powershell/module/microsoft.powershell.core/about/about_execution_policies From 4ac337f1e7fe16896a1b36f4d0187865cb5c2e98 Mon Sep 17 00:00:00 2001 From: Sean Wheeler Date: Fri, 17 Jul 2026 13:37:32 -0500 Subject: [PATCH 3/3] Travis feedback --- .../security/security-features.md | 33 +++++++++++-------- 1 file changed, 19 insertions(+), 14 deletions(-) diff --git a/reference/docs-conceptual/security/security-features.md b/reference/docs-conceptual/security/security-features.md index 6726c31cef6..a060832c2be 100644 --- a/reference/docs-conceptual/security/security-features.md +++ b/reference/docs-conceptual/security/security-features.md @@ -72,12 +72,12 @@ loading module files to prevent arbitrary code execution on the system. App Control for Business is designed as a security feature under the servicing criteria defined by the Microsoft Security Response Center (MSRC). App Control for Business is the preferred application -control system for Windows. AppLocker is a legacy application control system that is still supported -in Windows 10 and Windows 11. AppLocker is not a security feature under the servicing criteria -defined by MSRC. +control system for Windows. For more information about how PowerShell supports AppLocker and App +Control for Business, see [Use App Control to secure PowerShell][10]. -For more information about how PowerShell supports AppLocker and App Control for Business, see -[Use App Control to secure PowerShell][10]. +AppLocker is a legacy application control system that's still supported in and Windows 11. AppLocker +isn't a security feature under the servicing criteria defined by MSRC. For more information about +servicing criteria, see [Microsoft Security Servicing Criteria for Windows][12]. ### System Lockdown mode @@ -150,20 +150,25 @@ This change is backward compatible. A security boundary provides a logical separation between the code and data of security domains with different levels of trust. Security features build upon security boundaries to provide robust -protection against specific threats. In some cases, a security feature may provide protection -against a threat without being able to provide a robust defense. These security features are -typically referred to as defense-in-depth features or mitigations because they provide additional -security but may have by design limitations that prevent them from fully mitigating a threat. +protection against specific threats. For security features in this category, Microsoft intends to +address reported vulnerabilities through servicing. -PowerShell follows the [Microsoft Security Servicing Criteria for Windows][12]. Only security -features meet the criteria for servicing. - -Security features +Security features of PowerShell - System Lockdown with App Control for Business - Constrained language mode with App Control for Business -Defense-in-depth features +For more information, see the [Microsoft Security Servicing Criteria for Windows][12] documentation. + +In some cases, a security feature may provide protection against a threat without being able to +provide a robust defense. These security features are typically referred to as _defense-in-depth_ +features or mitigations because they provide additional security but may have by-design limitations +that prevent them from fully mitigating a threat. A bypass for a defense-in-depth security feature +by itself does not pose a direct risk because an attacker must also have found a vulnerability that +affects a security boundary, or they must rely on additional techniques, such as social engineering +to achieve the initial stage of a device compromise. + +Defense-in-depth features of PowerShell - Constrained language mode with AppLocker or configured through session configuration or by manually setting `$ExecutionContext.SessionState.LanguageMode`