[release/v7.6.6] Add support for new WLDP setting EnableFileOnlyEntry - #27922
Merged
Patrick Meinecke (SeeminglyScience) merged 1 commit intoSep 1, 2026
Conversation
Patrick Meinecke (SeeminglyScience)
requested a review
from Justin Chung (jshigetomi)
as a code owner
September 1, 2026 01:19
Patrick Meinecke (SeeminglyScience)
requested review from
a team and
Travis Plunk (TravisEz13)
as code owners
September 1, 2026 01:19
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Copilot started reviewing on behalf of
Patrick Meinecke (SeeminglyScience)
September 1, 2026 01:19
View session
Contributor
There was a problem hiding this comment.
Pull request overview
Backport to release/v7.6.6 that adds support for a new WLDP setting (EnableFileOnlyEntry / “FileOnlyEntry”) to enforce that PowerShell only starts when -File is provided, and blocks interactive/non-file entry points such as -Command, -EncodedCommand, -NoExit, and server modes when the policy is enabled.
Changes:
- Add native WLDP query support for a boolean application setting (“FileOnlyEntry”) with an environment-variable fallback for testing.
- Enforce FileOnlyEntry restrictions in the console host command-line parser (and an extra guard for server mode startup).
- Add Windows admin-only Pester coverage plus a test helper switch to toggle the setting via machine environment variables.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| test/tools/Modules/HelpersSecurity/HelpersSecurity.psm1 | Extends the test support cmdlet to set/revert the FileOnlyEntry debug env var. |
| test/powershell/Modules/Microsoft.PowerShell.Security/FileOnlyEntry.Tests.ps1 | Adds Pester coverage validating blocked entry modes and expected policy error messages. |
| src/System.Management.Automation/security/wldpNativeMethods.cs | Introduces a WLDP boolean setting query and caches the FileOnlyEntry enabled state. |
| src/Microsoft.PowerShell.ConsoleHost/resources/CommandLineParameterParserStrings.resx | Adds localized strings for FileOnlyEntry policy enforcement errors. |
| src/Microsoft.PowerShell.ConsoleHost/host/msh/ConsoleHost.cs | Adds a server-mode guard when FileOnlyEntry is enabled; minor control-flow refactor to return exit codes directly. |
| src/Microsoft.PowerShell.ConsoleHost/host/msh/CommandLineParameterParser.cs | Enforces FileOnlyEntry policy across relevant CLI switches and missing--File scenarios. |
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+98
to
+115
| private static bool TestBooleanWldpSetting(string settingName) | ||
| { | ||
| int hr = WldpNativeMethods.WldpGetApplicationSettingBoolean( | ||
| AppManifestId, | ||
| settingName, | ||
| out bool result); | ||
|
|
||
| PSEtwLog.LogWDACQueryEvent( | ||
| "WldpGetApplicationSettingBoolean", | ||
| settingName, | ||
| hr, | ||
| result ? 1 : 0); | ||
|
|
||
| if (hr is not 0) | ||
| { | ||
| result = false; | ||
| } | ||
|
|
Aditya Patwardhan (adityapatwardhan)
approved these changes
Sep 1, 2026
Patrick Meinecke (SeeminglyScience)
merged commit Sep 1, 2026
12c3b77
into
PowerShell:release/v7.6.6
36 checks passed
9 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #26752 to release/v7.6.6
Triggered by Patrick Meinecke (@SeeminglyScience) on behalf of Patrick Meinecke (@SeeminglyScience)
Original CL Label: CL-Engine
/cc @PowerShell/powershell-maintainers
Impact
REQUIRED: Choose either Tooling Impact or Customer Impact (or both). At least one checkbox must be selected.
Tooling Impact
Adds support for a new WLDP (Windows Lockdown Policy) setting enabling
FileOnlyEntryrestriction, for use in managed/locked-down deployments.Customer Impact
Regression
REQUIRED: Check exactly one box.
This is not a regression.
Testing
Cherry-picked cleanly with no conflicts. Original PR validated with a companion policy manifest change; this is a prerequisite for the FileOnlyEntry crash fix (PR #27880) also queued for backport.
Risk
REQUIRED: Check exactly one box.
Adds a new opt-in WLDP setting check that only affects behavior when the setting is explicitly enabled in a managed environment; default behavior is unchanged. Windows-specific security-adjacent code path, but additive and gated behind the new setting.