PowerShell Constrained Language mode considerations

Overview

Constrained Language (CL) mode limits PowerShell to approved cmdkits—useful for hardening but it breaks many RMM scripts and installer wrappers.

Why clients care

• Reduces living off the land abuse in mature security programs.
• Often required alongside WDAC or App Control for Business on high-security systems.

Compatibility testing

1. Inventory scripts run at logon, patching, and software deployment.
2. Test in audit/reporting mode before enforcement.
3. Prefer signed scripts and JIT admin for break-glass tasks.

MSP tooling impacts

Many RMM agents rely on full language—coordinate with vendor documentation; some require App Control policies that trust the agent.

Rollout pattern

Pilot ring → expand → enforce, with documented exceptions for developer machines.

Troubleshooting quick hits

• Identify mode via $ExecutionContext.SessionState.LanguageMode.
• Check for Device Guard and AppLocker interactions creating unexpected merge results.

Document all exceptions with security sign-off; CL bypass is a high finding in audits.