PowerShell Scripting Language
The PowerShell scripting language is an object-oriented programming language associated to the PowerShell command-line shell.
What is PowerShell Scripting Language?
PowerShell is an object-oriented programming language associated to the PowerShell command-line shell.
Object-oriented means, that it uses objects to transfer data. These objects have attributes and defining custom types using familiar object-orientated programming semantics, such as classes, properties, methods, inheritance, etc.
PowerShell is based on the .NET Framework, using all .NET Framework classes.
Components of the PowerShell Scripting Language
PowerShell Commands
PowerShell commands are the smallest unit of PowerShell scripting. Commonly made up of three different entities, a verb, a noun and a parameter list, the composition displays as follows: verb-noun [-parameter list].
PowerShell Pipelines
Considering cmdlets like atoms, the molecules of PowerShell scripting would be pipelines. Cmdlets bound together via the pipe operator „|“ increase their ability and multiply the available options, where the output of the first command will be used as the input of the subsequent command.
PowerShell Modules
PowerShell commands can be bundled up into PowerShell modules in order to organize and share them. After installing a PowerShell module, the contained cmdlets can be called by their name. Usually, all cmdlets of a module follow similar naming conventions.
If you’re unsure, what the cmdlets are called, PowerShell ISE’s IntelliSense comes in handy. Alternatively you can use Get-Command -Module [Insert name of the module] to get a list of all cmdlets of a certain module.
Tools for PowerShell Scripting
PowerShell Editors
Please refer to our article on PowerShell editors for a list of the most common editors for PowerShell.
The default editor PowerShell Integrated Scripting Environment (ISE) offers comfortable editing and testing of scripts in an GUI-based application and can satisfy basic editing needs.
For those with more advanced scripting skills and a wish for auto-formatting, refactoring and code analysis should investigate PowerShell ISE Steroids (w/ISESteroids).
If you are looking for an editor that supports cross-platform, you might consider using Visual Studio Code (VSCode), as it supports multiple coding languages and Microsoft even made a PowerShell extension for it.
Execution and Delegation
Now, these editors are great for the editing, running and scripting part but not for executing or the whole automation of scripts.
To this end, the project Pash has been released. An alternative with almost endless possibilities to automate, delegate, control, supervise, centralize and develop scripts is offered by ScriptRunner.
Execution Policies
To run scripts in general, the execution policy has to allow the execution of scripts. PowerShell has 4 different execution policies that enable the usage of scripts:
- Restricted – Default setting and scripts aren’t able to be run
- RemoteSigned – Locally-created scripts can be run; others have to be signed by a trusted publisher
- AllSigned – Only Scripts signed by trusted publishers will run; even local ones
- Unrestricted – All scripts will run
- Bypass – Nothing is blocked and there are no warning or prompts
- Undefined – Default policy is set (Restricted)
The command for setting a new policy is as simple as running the command, followed by the desired state (here AllSigned):
Set-ExecutionPolicy AllSigned
Security
PowerShell comes with built-in security functions, such as the above-mentioned execution policies. Another feature is the logging and monitoring of modules and scripts, as well as the transcription of input and output of Windows PoSh commands.
Digital signatures serve two purposes at once: they reveal the authentication (who wrote the script) and the integrity (post changes in the script after being signed).
PowerShell can be used in different language modes, which will result in different availabilities of commandlets, such as:
- FullLanguage
- ConstrainedLanguage
- RestrictedLanguage
- NoLanguage
Note that a language change is only tied to the session, so not permanent. To fix that, the use of a centralized solution like Applocker or Device Guard is mandatory.
Credentials can be entered manually but compromise the ability of a script to be automated. One could save the password information in an encrypted storage data, only flaw: it can’t be copied to another machine and only works on the initial machine.
Just Enough Administration (JAE) assigns limited privileges for PowerShell Remoting (available since version 5.0). It offers a Role-based Access Control (RBAC) with a whitelisting system, with the downside of an extensive maintenance of administration processes and requires the same depth of knowledge for the administrator as without it.
Free PowerShell Security Guide.
Learn about the numerous possibilities to use the security potential of Microsoft PowerShell!
