Security plays two important roles in PowerShell. The first role is the security of PowerShell itself: scripting languages have long been a vehicle of emailbased malware on Windows, so PowerShell’s security features have been carefully designed to thwart this danger. The second role is the set of securityrelated tasks you are likely to encounter when working with your computer: script signing, certificates, and credentials, just to name a few.
When it comes to talking about security in the scripting and commandline world, a great deal of folklore and superstition clouds the picture. One of the most common misconceptions is that that scripting languages and commandline shells somehow lets users bypass the security protections of the Windows graphical user interface.
The Windows security model (as with any security model that actually provides security) protects resources—not the way you get to them. That is because programs that you run, in effect, are you. If you can do it, so can a program. If a program can do it, then you can do it without having to use that program. For example, consider the act of changing critical data in the Windows Registry. If you use the Windows Registry Editor graphical user interface, it provides an error message when you attempt to perform an operation that you do not have permission for.
The Registry Editor provides this error message because it is unable to delete that key, not because it wanted to prevent you from doing it. Windows itself protects the registry keys, not the programs you use to access them.
Likewise, PowerShell provides an error message when you attempt to perform an operation that you do not have permission for. Not because PowerShell contains
extra security checks for that operation, but because it is also simply unable to perform the operation:
PS >NewItem "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run\New" NewItem : Requested registry access is not allowed. At line:1 char:9
+ NewItem <<<< "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run\New"
While perhaps clear after explanation, this misunderstanding often gets used as a reason to prevent users from running command shells or scripting languages altogether.
