Disable These 3 Windows Settings Now! (For Security)

You’ll be glad you watched this 🧐

Commands Mentioned:
• Get Language Mode: $ExecutionContext.SessionState.LanguageMode
• Environment Variable Name: __PSLockDownPolicy (Note: You will need to open a new PowerShell window to see if it applied)

Mentioned Links:

▼ Time Stamps: ▼
0:00 - Why Though?
1:00 - What We'll Be Doing
1:46 - Remove PowerShell 2.0
2:22 - Constrained Language Mode
4:22 - About Execution Policy
5:41 - Setting Up Execution Policy
8:28 - PowerShell 7 Execution Policy
9:27 - Setting PowerShell 7 Policy

▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬
▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬

[ThioJoe]

Also this should work on both Windows 10 and 11

[Marfig]

It needs to be said that the Constrained Language will have a large impact on your system ability to run legitimate powershell scripts. I really don't advise this option at all. You should only do this on dedicated computer systems where you know Powershell is not being used as a means to install or manage software or the system itself. This option will otherwise break tools like Chocolatey, the SQL Server installation process, and a lot more. Don't do this on your daily usage computer. There is a lot of Windows software out there that relies on Powershell features for its own maintenance or installation processes.

[Cohors]

One of the best things you can do is enable logging for PowerShell, which is disabled by default for some unholy reason. That way when someone does get past any blocks you set up you or someone else can go back and see what was done.

[paland]

Very nice. I've been a programmer for 40 years now and this is something I didn't know. I am retired now so I am not as up to date as I used to be when working in the IT environment.

[Dark_Detective]

Very useful information. I wish Microsoft took Windows security more seriously. Like why have Powershell 2.0 even enabled by default? Anyone who needs it can just enable it on their own. Massive security risk.

[ThebedwarsEditmaker]

Thio never disapponts at making me tired by waking me up at 3 am

[TheAndroidGingerbreadGuy]

Thio Joe may not be a driver, but he never fails to deliver 💯💯💥💯

[lev]

Method 2, Microsoft's comment: "As part of the implementation of Constrained Language, PowerShell included an environment variable for debugging and unit testing called __PSLockdownPolicy. While we have never documented this, some have discovered it and described this as an enforcement mechanism. This is unwise because an attacker can easily change the environment variable to remove this enforcement. In addition, there are also file naming conventions that enable FullLanguage mode on a script, effectively bypassing Constrained Language."

[Lurkzz]

For many years now I've woken up to youtube autoplaying ThioJoe videos. This time no different, I started watching Warhammer videos, fell asleep and now woke up to the voice of Thio. It's almost nostalgic and homely at the same time. Great video as always, will need to check these tips out.

[JohnSmith-xqpz]

If only Microsoft had somebody like ThioJoe on the team...

[donnikubbitz]

"You don't have permission..."
I created a "New Folder" in my D drive and named it "Policy Definitions", put it into "Windows:\" and it now magically has a grip of files in it. I can do nothing with it including saving anything to it. I also thought I told my pc, when I first built it, to NEVER claim I am not the administrator and to never ask for one.
It really sucks that we don't get a save direction. I NEVER put anything I can avoid onto my C drive bc it's only 120 gigs. I now see that there's a ton of stuff that I use that can only be on the C drive. I just want to undo the folder but it tells my I am NOT the admin and it somehow got a grip of files put into it when I moved it from the D drive, where I created it, into the C drive. I'm hyper concerned I just screwed something up and cannot complete the Policy Plus/Definitions step. F me!

[the_dark_defender]

Your videos are always informative and helpful. I especially appreciate that you take the time to put complicated commands in the description so they may be copied and pasted.

[TheFrLaNc]

What you forgot to mention @ThioJoe is that this will severely disable the ability to use PowerShell and bug out command history, especially when you set the constrained language option. If you're a PowerShell frequent user I advise against this since it will break both it and its usage.

[MJ-gejz]

Thx Thio, this was very helpful. A small adjustment with potential big headache savings. You move so fast on your How To Step by Step. I had to pause your instruction several times.

[russellgale]

Nice security tips! I wasn't aware of these settings. Thanks!

[paulgraunke]

Lots to think about. I use PS (v7.x) scripts to manage two Windows systems, Home (v 10) and Pro (v 11). I configured an execution policy for PS that gave me some peace of mind. But now I realize that peace of mind was unwarranted. It looks like I will have to sign all my scripts after making the necessary security tweaks.

[teresjoshy]

Must share this to everyone who has a windows pc

[adampriebe]

Great info! You should do a video on the Microsoft Security Baselines sometime; they have an extensive inventory of useful settings like this and they're from Microsoft themselves. Lots of companies use these as a starting point for securing corporate devices.

[jeff__w]

Very useful information! I appreciated how crystal clear the video is—it’s extremely easy to follow. Thanks!

[Moshiur_Rahman]

Congratulations for 3M subscriber!!!!🎉🎉🎉