-
Notifications
You must be signed in to change notification settings - Fork 8.3k
Improve debuggability of the ConstrainedLanguage mode #18628
Copy link
Copy link
Closed
Labels
Committee-ReviewedPS-Committee has reviewed this and made a decisionPS-Committee has reviewed this and made a decisionIssue-Enhancementthe issue is more of a feature request than a bugthe issue is more of a feature request than a bugResolution-No ActivityIssue has had no activity for 6 months or moreIssue has had no activity for 6 months or moreWG-Securitysecurity related areas such as JEAsecurity related areas such as JEA
Metadata
Metadata
Assignees
Labels
Committee-ReviewedPS-Committee has reviewed this and made a decisionPS-Committee has reviewed this and made a decisionIssue-Enhancementthe issue is more of a feature request than a bugthe issue is more of a feature request than a bugResolution-No ActivityIssue has had no activity for 6 months or moreIssue has had no activity for 6 months or moreWG-Securitysecurity related areas such as JEAsecurity related areas such as JEA
Summary of the new feature / enhancement
Today, if PowerShell starts in ConstrainedLanguage, there's no way to tell why did this happen.
The problem is simply manifested as:
There're multiple reasons for why the scripting is restricted and knowing which one exactly is very helpful when troubleshooting the issue.
Proposed technical implementation details (optional)
That'd be great if one could start pwsh in a mode where it would print out the high-level source of the issue (WLDP, AppLocker, cached or not, system or user, file policy enforcement).
The best would be if it could analyze CI policies present on the machine and highlight which one is the culprit (stretch goal.)