Skip to content

Add support for new WLDP setting EnableFileOnlyEntry #26752

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Patrick Meinecke (SeeminglyScience) merged 16 commits into from
Aug 10, 2026
Merged

Add support for new WLDP setting EnableFileOnlyEntry #26752

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
ea7acb2
Add option for disabling fileless entry
SeeminglyScience Oct 22, 2025
8c57852
Update feature name and add escape hatch
SeeminglyScience Oct 28, 2025
5824e1e
Add tests
SeeminglyScience Jan 27, 2026
e5efb83
Add method documentation
SeeminglyScience Feb 5, 2026
71a7891
Fix non-windows build error
SeeminglyScience Feb 5, 2026
d628430
Fix `-help` and `-version`
SeeminglyScience Feb 5, 2026
8ecbbee
Add more test cases
SeeminglyScience Feb 5, 2026
5458a66
Fix argless test
SeeminglyScience Feb 12, 2026
e962541
Add message specifying `-NoExit` is disallowed
SeeminglyScience May 27, 2026
4706f4a
use `.HasFlag` instead of bitwise operators
SeeminglyScience May 27, 2026
87a5f27
Disallow server mode for FileOnlyEntry
SeeminglyScience May 29, 2026
53eb12e
Clean up the readability of `ConsoleHost.Start`
SeeminglyScience May 29, 2026
894e5d3
Change where the server mode check occurs
SeeminglyScience Jun 1, 2026
10dce9f
Merge branch 'master' into file-only-entry
SeeminglyScience Jun 1, 2026
9c566a6
Merge branch 'master' into file-only-entry
SeeminglyScience Aug 4, 2026
fe66511
Fix test for new message
SeeminglyScience Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
70 changes: 70 additions & 0 deletions src/Microsoft.PowerShell.ConsoleHost/host/msh/CommandLineParameterParser.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
using System.Management.Automation.Internal;
using System.Management.Automation.Language;
using System.Management.Automation.Runspaces;
using System.Management.Automation.Security;
using System.Security;
using System.Text;

Expand Down Expand Up @@ -878,10 +879,27 @@ internal void Parse(string[] args)
ParseHelper(args);
}

internal static bool IsFileOnlyEntryEnabled
{
get
{
#if UNIX
return false;
#else
return SystemPolicy.IsFileOnlyEntryEnabled();
#endif
}
}

private void ParseHelper(string[] args)

@daxian-dbw Dongbo Wang (daxian-dbw) Apr 2, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The current changes allows specifying the following when using -File. We need to consider whether those settings should be supported or not:

-SettingsFile
-ConfigurationFile
-ConfigurationName

@SeeminglyScience Patrick Meinecke (SeeminglyScience) Jun 1, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think those are fine. Travis Plunk (@TravisEz13) thoughts?

{
if (args.Length == 0)
{
if (IsFileOnlyEntryEnabled)
{
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryRequired);
}

return;
}

Expand Down Expand Up @@ -927,6 +945,12 @@ private void ParseHelper(string[] args)
_noExit = true;
noexitSeen = true;
ParametersUsed |= ParameterBitmap.NoExit;

if (IsFileOnlyEntryEnabled)
{
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryNoExitDisabled);
break;
}
}
else if (MatchSwitch(switchKey, "noprofile", "nop"))
{
Expand All @@ -948,32 +972,57 @@ private void ParseHelper(string[] args)
_socketServerMode = true;
_showBanner = false;
ParametersUsed |= ParameterBitmap.SocketServerMode;
if (IsFileOnlyEntryEnabled)
{
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryServerMode);
break;
}
}
#if !UNIX
else if (MatchSwitch(switchKey, "v2socketservermode", "v2so"))
{
_v2SocketServerMode = true;
_showBanner = false;
ParametersUsed |= ParameterBitmap.V2SocketServerMode;
if (IsFileOnlyEntryEnabled)
{
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryServerMode);
break;
}
}
#endif
else if (MatchSwitch(switchKey, "servermode", "s"))
{
_serverMode = true;
_showBanner = false;
ParametersUsed |= ParameterBitmap.ServerMode;
if (IsFileOnlyEntryEnabled)
{
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryServerMode);
break;
}
}
else if (MatchSwitch(switchKey, "namedpipeservermode", "nam"))
{
_namedPipeServerMode = true;
_showBanner = false;
ParametersUsed |= ParameterBitmap.NamedPipeServerMode;
if (IsFileOnlyEntryEnabled)
{
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryServerMode);
break;
}
}
else if (MatchSwitch(switchKey, "sshservermode", "sshs"))
{
_sshServerMode = true;
_showBanner = false;
ParametersUsed |= ParameterBitmap.SSHServerMode;
if (IsFileOnlyEntryEnabled)
{
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryServerMode);
break;
}
}
else if (MatchSwitch(switchKey, "noprofileloadtime", "noprofileloadtime"))
{
Expand Down Expand Up @@ -1263,6 +1312,15 @@ private void ParseHelper(string[] args)
}
}

if (_error is null
&& !_showVersion
&& !_showHelp
&& !ParametersUsed.HasFlag(ParameterBitmap.File)
&& IsFileOnlyEntryEnabled)
{
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryRequired);
}

Dbg.Assert(
((_exitCode == ConsoleHost.ExitCodeBadCommandLineParameter) && _abortStartup)
|| (_exitCode == ConsoleHost.ExitCodeSuccess),
Expand Down Expand Up @@ -1360,6 +1418,12 @@ private bool ParseFile(string[] args, ref int i, bool noexitSeen)
// Process interactive input...
if (args[i] == "-")

@TravisEz13 Travis Plunk (TravisEz13) Apr 2, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should stop the sever modes too. They have no file only ability

@SeeminglyScience Patrick Meinecke (SeeminglyScience) Jun 1, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good call, tbh I assumed the current checks out would be sufficient but turns out it just wrote the error and started server mode anyway.

Only question is if Start-Job should have a custom error message. Right now folks will see this:

OpenError: [localhost] The background process reported an error with the following message: Server mode is disallowed by policy..

I think it's sufficient but open to adding something explicit

{
if (IsFileOnlyEntryEnabled)
{
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryRequired);
return false;
}

// the arg to -file is -, which is secret code for "read the commands from stdin with prompts"

_explicitReadCommandsFromStdin = true;
Expand Down Expand Up @@ -1492,6 +1556,12 @@ static object ConvertToBoolIfPossible(string arg)

private bool ParseCommand(string[] args, ref int i, bool noexitSeen, bool isEncoded)
{
if (IsFileOnlyEntryEnabled)
{
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryRequired);
return false;
}

if (_commandLineCommand != null)
{
// we've already set the command, so squawk
Expand Down
85 changes: 44 additions & 41 deletions src/Microsoft.PowerShell.ConsoleHost/host/msh/ConsoleHost.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,8 +165,6 @@ internal static int Start(
// improve startup performance.
}

uint exitCode = ExitCodeSuccess;

Thread.CurrentThread.Name = "ConsoleHost main thread";

try
Expand All @@ -192,7 +190,7 @@ internal static int Start(
// or start up the engine and retrieve the information via $psversiontable.GitCommitId
// but this returns the semantic version and avoids executing a script
s_theConsoleHost.UI.WriteLine($"PowerShell {PSVersionInfo.GitCommitId}");
return 0;
return ExitCodeSuccess;
}

// Servermode parameter validation check.
Expand Down Expand Up @@ -223,6 +221,14 @@ internal static int Start(
return ExitCodeBadCommandLineParameter;
}

if (serverModeCount is 1 && CommandLineParameterParser.IsFileOnlyEntryEnabled)
{
// User facing error message should already be written by the parser,
// so just trace and exit.
s_tracer.TraceError("Server mode cannot be specified when FileOnlyEntry policy is in place.");
return ExitCodeBadCommandLineParameter;
}

#if !UNIX
TaskbarJumpList.CreateRunAsAdministratorJumpList();

@daxian-dbw Dongbo Wang (daxian-dbw) Aug 6, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: maybe skip this call when IsFileOnlyEntryEnabled? The run as administrator scenario doesn't seem make much sense if interactive usage is disallowed.

@SeeminglyScience Patrick Meinecke (SeeminglyScience) Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In this case I'd rather keep as much the same as possible but it's definitely an option if we want to optimize around the scenario. Definitely something to consider down the line

#endif
Expand All @@ -237,9 +243,10 @@ internal static int Start(
configurationName: null,
configurationFile: s_cpp.ConfigurationFile,
combineErrOutStream: false);
exitCode = 0;
return ExitCodeSuccess;
}
else if (s_cpp.SSHServerMode)

if (s_cpp.SSHServerMode)
{
ApplicationInsightsTelemetry.SendPSCoreStartupTelemetry("SSHServer", s_cpp.ParametersUsedAsDouble);
ProfileOptimization.StartProfile("StartupProfileData-SSHServerMode");
Expand All @@ -249,18 +256,20 @@ internal static int Start(
configurationName: null,
configurationFile: s_cpp.ConfigurationFile,
combineErrOutStream: true);
exitCode = 0;
return ExitCodeSuccess;
}
else if (s_cpp.NamedPipeServerMode)

if (s_cpp.NamedPipeServerMode)
{
ApplicationInsightsTelemetry.SendPSCoreStartupTelemetry("NamedPipe", s_cpp.ParametersUsedAsDouble);
ProfileOptimization.StartProfile("StartupProfileData-NamedPipeServerMode");
RemoteSessionNamedPipeServer.RunServerMode(
configurationName: s_cpp.ConfigurationName);
exitCode = 0;
return ExitCodeSuccess;
}
#if !UNIX
else if (s_cpp.V2SocketServerMode)

if (s_cpp.V2SocketServerMode)
{
if (s_cpp.Token == null)
{
Expand All @@ -284,50 +293,49 @@ internal static int Start(
token: s_cpp.Token,
tokenCreationTime: s_cpp.UTCTimestamp.Value);

exitCode = 0;
return ExitCodeSuccess;
}
#endif
else if (s_cpp.SocketServerMode)

if (s_cpp.SocketServerMode)
{
ApplicationInsightsTelemetry.SendPSCoreStartupTelemetry("SocketServerMode", s_cpp.ParametersUsedAsDouble);
ProfileOptimization.StartProfile("StartupProfileData-SocketServerMode");
HyperVSocketMediator.Run(
initialCommand: s_cpp.InitialCommand,
configurationName: s_cpp.ConfigurationName);
exitCode = 0;
return ExitCodeSuccess;
}
else

// Run PowerShell in normal console mode.
if (hostException != null)
{
// Run PowerShell in normal console mode.
if (hostException != null)
{
// Unable to create console host.
throw hostException;
}
// Unable to create console host.
throw hostException;
}

if (LoadPSReadline())
{
ProfileOptimization.StartProfile("StartupProfileData-Interactive");
if (LoadPSReadline())
{
ProfileOptimization.StartProfile("StartupProfileData-Interactive");

if (UpdatesNotification.CanNotifyUpdates)
{
// Start a task in the background to check for the update release.
_ = UpdatesNotification.CheckForUpdates();
}
}
else
if (UpdatesNotification.CanNotifyUpdates)
{
ProfileOptimization.StartProfile("StartupProfileData-NonInteractive");
// Start a task in the background to check for the update release.
_ = UpdatesNotification.CheckForUpdates();
}
}
else
{
ProfileOptimization.StartProfile("StartupProfileData-NonInteractive");
}

s_theConsoleHost.BindBreakHandler();
IsStdOutputRedirected = Console.IsOutputRedirected;
s_theConsoleHost.BindBreakHandler();
IsStdOutputRedirected = Console.IsOutputRedirected;

// Send startup telemetry for ConsoleHost startup
ApplicationInsightsTelemetry.SendPSCoreStartupTelemetry("Normal", s_cpp.ParametersUsedAsDouble);
// Send startup telemetry for ConsoleHost startup
ApplicationInsightsTelemetry.SendPSCoreStartupTelemetry("Normal", s_cpp.ParametersUsedAsDouble);

exitCode = s_theConsoleHost.Run(s_cpp, false);
}
return unchecked((int)s_theConsoleHost.Run(s_cpp, false));
}
finally
{
Expand All @@ -349,11 +357,6 @@ internal static int Start(
}
#pragma warning restore IDE0031
}

unchecked
{
return (int)exitCode;
}
}

internal static void ParseCommandLine(string[] args)
Expand Down
9 changes: 9 additions & 0 deletions src/Microsoft.PowerShell.ConsoleHost/resources/CommandLineParameterParserStrings.resx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,4 +228,13 @@ Valid formats are:
<data name="MissingMandatoryArgument" xml:space="preserve">
<value>An argument is required to be supplied to the '{0}' parameter.</value>
</data>
<data name="FileOnlyEntryRequired" xml:space="preserve">
<value>The parameter "-File" is required by policy.</value>
</data>
<data name="FileOnlyEntryNoExitDisabled" xml:space="preserve">
<value>The parameter "-NoExit" is disallowed by policy.</value>
</data>
<data name="FileOnlyEntryServerMode" xml:space="preserve">
<value>Server mode is disallowed by policy.</value>
</data>
</root>
Loading
Loading