PowerShell 5 limited to ConstrainedLanguage language mode RRS feed

  • Question

  • After upgrading my work PC from Windows 8.1 Pro to Windows 10 Pro, I have discovered that I am being severely limited in functionality in PowerShell.  Numerous attempts to change properties in various scenarios result in the following error:

    "Cannot set property. Property setting is supported only on core types in this language mode."

    Apparently there's a language mode setting I've never heard of before, and on my system, it's set to ConstrainedLanguage by default, and I need it to be set to FullLanguage.  This property is visible by viewing $host.Runspace.LanguageMode, but I cannot find any useful information about it anywhere online except for in this article, which only describes the modes, and doesn't say how to change it.

    I have no PowerShell profiles to speak of anywhere, and can't find anything in the registry, and there's definitely nothing in group policy setting this.  Can anybody tell me how I can change or reset this?

    Thursday, August 13, 2015 10:28 PM

All replies

  • This is a AppLocker policy.

    Read the section on Constrained Powershell.

    [string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "

    Thursday, August 13, 2015 10:55 PM
  • Thanks.  I did see that article, but we don't have AppLocker enabled, at least not that I can tell.  I did, however, have SRP enabled on my local PC for testing purposes, and after disabling SRP, it went back to FullLanguage.  I thought SRP and AppLocker were two different things, but either they're somehow intertwined, or SRP has the exact same effect as AppLocker on PowerShell 5.0.  Either way, we need to find a way around this, otherwise PowerShell 5.0 will be unusable on all our client RDS servers, as they all have SRP enabled on them.
    Friday, August 14, 2015 1:24 AM
  • Replying to old post here because the answer was not an answer for OP's purpose.

    To use unconstrained language mode under SRP, run Powershell as Admin.

    Tuesday, August 16, 2016 7:11 AM
  • Running this in elevated mode ("Run as Administrator") doesn't work, at least not for a domain admin account.  You would have to actually do a "Run as Another User" and use the local Administrator account.  Or, better yet, log on as local Administrator.  However, some domain commands may not work correctly.  In any case, this isn't a good workaround, especially for Standard Users in a multi-user environment; who wants to give them the local admin account's password?

    I saw in another thread that this is related to AppLocker and/or Software Restriction Policies (SRP).  If PowerShell can detect it can't execute commands from %temp%, it automatically set to Constrained Language mode.  Yes, %temp% is the first thing blocked by SRP as most of the malicious codes run from there.  You'll have to whitelist %temp% then blacklist all the known runnable extensions like *.exe, *.cmd, etc.  It's too convoluted for my taste.  Besides, it's still possible to run codes in *.dat, *.xyz, etc., so this isn't really a good workaround, either.

    Because of this, I think PowerShell usage is going to decline.  If it's a PowerShell script from Microsoft that needs to run for setup, etc., I'll just temporarily disable SRP on my Domain Admin account, run the script, then re-enable SRP.  I've had issues with setting up RDS just because of that!  That's when I then learned about "language mode", of which the terminology didn't make sense to me, i.e., I think of "language mode" as English, Chinese, etc., or something similar to Unicode and SQL Collation.

    • Edited by John Babbitt Friday, May 11, 2018 4:13 PM to better clarify
    Friday, May 11, 2018 3:36 PM