ADMX Viewer
AddSystemHard.Policies.AddSystemHard• Machine

Enable PowerShell Constrained Language Mode

Download ADMX

Enable the Constrained Language Mode for PowerShell. This mode disallows several language elements that can be leveraged by attackers to perform sensitive API calls. NOTE: Since this policy only rewrites the __PSLockdownPolicy environment variable, this is not a secure way to enable CLM and is intended for defense-in-depth only. CLM can only be securely enforced by AppLocker and/or WDAC.

Policy Details

Policy Name
PSLockDownPolicy
Registry Key
SYSTEM\CurrentControlSet\Control\Session Manager\Environment
Value Name
__PSLockdownPolicy
Supported On
At least Windows Server 2012 R2, Windows 8.1 or Windows RT 8.1
Policy State Values
Enabled: 4
Disabled: 0
Available Languages
en-usfr-fr