PowerShell 7.4

Apply these rules to PowerShell 7.4 LTS code, modules, scheduled automation, and administrative endpoints. Establish trust separately for every caller, value, object, path, module, executable, remote host, and serialized artifact before granting it the script's authority.

Enforce code trust

• Assume FullLanguage mode permits arbitrary .NET, COM, provider, native-process, and operating-system access under the PowerShell process identity.
• On managed Windows hosts, use App Control for Business in enforcement mode so PowerShell applies System Lockdown behavior. A session that merely assigns itself ConstrainedLanguage is not equivalent and does not constrain sibling or future runspaces.
• Regard execution policy, AMSI, script scanning, AppLocker-only constrained language, and manual language-mode settings as defense in depth rather than standalone security boundaries. Execution policy is enforced only on Windows.
• Do not normalize -ExecutionPolicy Bypass or automatically call Unblock-File. Review origin and content before changing a file's execution treatment.
• Sign released Windows scripts and modules and verify the expected publisher and a valid Get-AuthenticodeSignature result before loading them. Continue to review signed code because signing supplies provenance, not authorization or correctness.
• Launch production jobs with a fixed script path, -NoProfile, -NonInteractive, a known working directory, and a least-privileged dedicated identity.

Define narrow parameters and authorization checks

• Expose advanced functions with [CmdletBinding()],