diff --git a/reference/docs-conceptual/security/security-features.md b/reference/docs-conceptual/security/security-features.md index 06769569a94..a060832c2be 100644 --- a/reference/docs-conceptual/security/security-features.md +++ b/reference/docs-conceptual/security/security-features.md @@ -1,6 +1,6 @@ --- description: PowerShell has several features designed to improve the security of your scripting environment. -ms.date: 08/18/2025 +ms.date: 07/17/2026 title: PowerShell security features --- # PowerShell security features @@ -71,11 +71,13 @@ being enforced. The policy applies certain behaviors when running script blocks, loading module files to prevent arbitrary code execution on the system. App Control for Business is designed as a security feature under the servicing criteria defined by -the Microsoft Security Response Center (MSRC). App Control is the preferred application control -system for Windows. +the Microsoft Security Response Center (MSRC). App Control for Business is the preferred application +control system for Windows. For more information about how PowerShell supports AppLocker and App +Control for Business, see [Use App Control to secure PowerShell][10]. -For more information about how PowerShell supports AppLocker and App Control, see -[Use App Control to secure PowerShell][10]. +AppLocker is a legacy application control system that's still supported in and Windows 11. AppLocker +isn't a security feature under the servicing criteria defined by MSRC. For more information about +servicing criteria, see [Microsoft Security Servicing Criteria for Windows][12]. ### System Lockdown mode @@ -146,18 +148,31 @@ This change is backward compatible. ## Security Servicing Criteria -PowerShell follows the [Microsoft Security Servicing Criteria for Windows][12]. Only security -features meet the criteria for servicing. +A security boundary provides a logical separation between the code and data of security domains with +different levels of trust. Security features build upon security boundaries to provide robust +protection against specific threats. For security features in this category, Microsoft intends to +address reported vulnerabilities through servicing. -Security features +Security features of PowerShell - System Lockdown with App Control for Business - Constrained language mode with App Control for Business -Defense in depth features +For more information, see the [Microsoft Security Servicing Criteria for Windows][12] documentation. +In some cases, a security feature may provide protection against a threat without being able to +provide a robust defense. These security features are typically referred to as _defense-in-depth_ +features or mitigations because they provide additional security but may have by-design limitations +that prevent them from fully mitigating a threat. A bypass for a defense-in-depth security feature +by itself does not pose a direct risk because an attacker must also have found a vulnerability that +affects a security boundary, or they must rely on additional techniques, such as social engineering +to achieve the initial stage of a device compromise. + +Defense-in-depth features of PowerShell + +- Constrained language mode with AppLocker or configured through session configuration or by + manually setting `$ExecutionContext.SessionState.LanguageMode` - System Lockdown with AppLocker -- Constrained language mode with AppLocker - Execution Policy