Add support for new WLDP setting `EnableFileOnlyEntry` by SeeminglyScience · Pull Request #26752 · PowerShell/PowerShell

SeeminglyScience · 2026-02-05T15:08:36Z

PR Summary

Setting will ensure that managed systems will only launch PowerShell when a file to execute is specified and -NoExit is not present. For use in systems where interactive or ad-hoc usage is not expected.

PR Context

PR Checklist

Copilot

Pull request overview

This pull request adds support for a new Windows Lockdown Policy (WLDP) setting called FileOnlyEntry that restricts PowerShell to only execute when a file is specified via the -File parameter and -NoExit is not present. This is intended for managed systems where interactive or ad-hoc PowerShell usage should be prevented.

Changes:

Adds WLDP API integration to query the FileOnlyEntry setting with environment variable fallback for testing
Implements command-line parameter validation to enforce the policy across multiple entry points
Provides test infrastructure and initial test cases for the new functionality

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
src/System.Management.Automation/security/wldpNativeMethods.cs	Adds P/Invoke declaration for `WldpGetApplicationSettingBoolean`, implements `IsFileOnlyEntryEnabled()` with caching and environment variable fallback, and provides reusable `TestBooleanWldpSetting()` helper method
src/Microsoft.PowerShell.ConsoleHost/host/msh/CommandLineParameterParser.cs	Adds FileOnlyEntry checks at multiple points: empty args, `-NoExit`, `-Command`/`-EncodedCommand`/`-CommandWithArgs`, `-File -`, and a final catch-all check
src/Microsoft.PowerShell.ConsoleHost/resources/CommandLineParameterParserStrings.resx	Adds error message string for FileOnlyEntry policy violations
test/tools/Modules/HelpersSecurity/HelpersSecurity.psm1	Adds `SetFileOnlyEntry` and `RevertFileOnlyEntry` parameters to test cmdlet for setting/clearing the environment variable
test/powershell/Modules/Microsoft.PowerShell.Security/FileOnlyEntry.Tests.ps1	Adds new test file with negative test cases for `-NoExit -Command`, `-Command`, `-NoExit -File`, and `-File -` scenarios

Copilot · 2026-02-05T15:17:35Z

+            $PwshParameterTestCases = @(
+                MakeTestCase -NoExit -Command Get-ChildItem
+                MakeTestCase -Command Get-ChildItem
+                # File validation should come after `FileOnlyEntry` check, so
+                # this file should not need to exist for us to get the error
+                # we expect.
+                MakeTestCase -NoExit -File this_file_does_not_exist.ps1
+                MakeTestCase -File -
+            )


The test suite should include test cases to verify that informational commands like -Version and -Help are still allowed when FileOnlyEntry is enabled, since they don't execute any user code. Consider adding test cases like:

pwsh -Version should succeed and display version

pwsh -Help should succeed and display help

pwsh -? should succeed and display help

Copilot · 2026-02-05T15:17:35Z

+    Describe "File Only Entry throws for interactive or non-file scenarios" -Tags 'CI','RequireAdminOnWindows' {
+
+        BeforeAll {
+            function MakeTestCase {
+                param([Parameter(ValueFromRemainingArguments)] [string[]] $ArgumentList)
+                end {
+                    @{
+                        Arguments = $ArgumentList
+                        TestName = 'With args "{0}"' -f ($ArgumentList -join ' ')
+                    }
+                }
+            }
+
+            [SuppressMessage('PSUseDeclaredVarsMoreThanAssignments', 'PwshParameterTestCases')]
+            $PwshParameterTestCases = @(
+                MakeTestCase -NoExit -Command Get-ChildItem
+                MakeTestCase -Command Get-ChildItem
+                # File validation should come after `FileOnlyEntry` check, so
+                # this file should not need to exist for us to get the error
+                # we expect.
+                MakeTestCase -NoExit -File this_file_does_not_exist.ps1
+                MakeTestCase -File -
+            )
+        }
+
+        It "<TestName>" -TestCases $PwshParameterTestCases {
+            param($Arguments)
+
+            $results = $null
+            try {
+                Invoke-LanguageModeTestingSupportCmdlet -SetFileOnlyEntry
+                if ($Arguments[-1] -eq '-') {
+                    $results = 'Get-ChildItem' | & "$PSHOME\pwsh.exe" @Arguments 2>&1
+                } else {
+                    $results = & "$PSHOME\pwsh.exe" @Arguments 2>&1
+                }
+            } finally {
+                Invoke-LanguageModeTestingSupportCmdlet -RevertFileOnlyEntry
+            }
+
+            $results.Exception.Message | Should -Be 'The parameter "-File" is required by policy.'
+        }
+    }


The test suite only covers negative test cases (scenarios that should be rejected). There should also be at least one positive test case to verify that legitimate file-based execution is still allowed when FileOnlyEntry is enabled. For example, a test that verifies pwsh.exe -File valid_script.ps1 succeeds when the policy is enabled.

TravisEz13 · 2026-04-02T17:57:42Z

+
+            if (SetFileOnlyEntry)
+            {
+                Environment.SetEnvironmentVariable("__PSLockdownPolicy_FileOnlyEntry", "1", EnvironmentVariableTarget.Machine);


On modern platforms we can use policies.

daxian-dbw · 2026-04-02T21:39:35Z

+            }
+        }
+
        private void ParseHelper(string[] args)


The current changes allows specifying the following when using -File. We need to consider whether those settings should be supported or not:

-SettingsFile -ConfigurationFile -ConfigurationName

I think those are fine. @TravisEz13 thoughts?

TravisEz13 · 2026-04-02T21:44:57Z

@@ -1360,6 +1393,12 @@ private bool ParseFile(string[] args, ref int i, bool noexitSeen)
            // Process interactive input...
            if (args[i] == "-")


I think we should stop the sever modes too. They have no file only ability

Good call, tbh I assumed the current checks out would be sufficient but turns out it just wrote the error and started server mode anyway.

Only question is if Start-Job should have a custom error message. Right now folks will see this:

OpenError: [localhost] The background process reported an error with the following message: Server mode is disallowed by policy..

I think it's sufficient but open to adding something explicit

sdwheeler · 2026-05-02T13:55:45Z

@TravisEz13 This PR needs user docs.

Both the generic "file must be specified" and "server mode disallowed" error messages were being written which was confusing.

SeeminglyScience added 3 commits February 4, 2026 16:01

Add option for disabling fileless entry

ea7acb2

Update feature name and add escape hatch

8c57852

Add tests

5824e1e

SeeminglyScience requested review from a team, TravisEz13 and jshigetomi as code owners February 5, 2026 15:08

Copilot AI review requested due to automatic review settings February 5, 2026 15:08

Copilot started reviewing on behalf of SeeminglyScience February 5, 2026 15:09 View session

SeeminglyScience added the CL-Engine Indicates that a PR should be marked as an engine change in the Change Log label Feb 5, 2026

Copilot AI reviewed Feb 5, 2026

View reviewed changes

SeeminglyScience added 5 commits February 5, 2026 12:06

Add method documentation

e5efb83

Fix non-windows build error

71a7891

Fix -help and -version

d628430

Add more test cases

8ecbbee

Fix argless test

5458a66

microsoft-github-policy-service Bot added the Review - Needed The PR is being reviewed label Feb 20, 2026

TravisEz13 reviewed Apr 2, 2026

View reviewed changes

TravisEz13 approved these changes Apr 2, 2026

View reviewed changes

adityapatwardhan approved these changes Apr 2, 2026

View reviewed changes

TravisEz13 self-assigned this Apr 2, 2026

TravisEz13 removed the Review - Needed The PR is being reviewed label Apr 2, 2026

TravisEz13 reviewed Apr 2, 2026

View reviewed changes

Comment thread src/Microsoft.PowerShell.ConsoleHost/host/msh/CommandLineParameterParser.cs Outdated

daxian-dbw reviewed Apr 2, 2026

View reviewed changes

TravisEz13 reviewed Apr 2, 2026

View reviewed changes

microsoft-github-policy-service Bot added the Review - Needed The PR is being reviewed label Apr 10, 2026

SeeminglyScience added Backport-7.4.x-Consider Backport-7.5.x-Consider Backport-7.6.x-Consider labels May 13, 2026

Add message specifying -NoExit is disallowed

e962541

SeeminglyScience and others added 5 commits May 27, 2026 14:23

use .HasFlag instead of bitwise operators

4706f4a

Disallow server mode for FileOnlyEntry

87a5f27

Clean up the readability of ConsoleHost.Start

53eb12e

Change where the server mode check occurs

894e5d3

Both the generic "file must be specified" and "server mode disallowed" error messages were being written which was confusing.

Merge branch 'master' into file-only-entry

10dce9f

		@@ -1360,6 +1393,12 @@ private bool ParseFile(string[] args, ref int i, bool noexitSeen)
		// Process interactive input...
		if (args[i] == "-")

Conversation

SeeminglyScience commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

PR Context

PR Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

TravisEz13 Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

daxian-dbw Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

SeeminglyScience Jun 1, 2026

Choose a reason for hiding this comment

Uh oh!

TravisEz13 Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

SeeminglyScience Jun 1, 2026

Choose a reason for hiding this comment

Uh oh!

sdwheeler commented May 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

SeeminglyScience commented Feb 5, 2026 •

edited

Loading