PR Summary

Fixes #28372.

On every start, SystemPolicy.GetSystemLockdownPolicy() finds the system-wide AppLocker policy by writing two __PSScriptPolicyTest_* files to %TEMP%, checking them with SaferIdentifyLevel/SaferComputeTokenFromLevel, and deleting them. When the machine has no AppLocker script rules and no Software Restriction Policy, the answer is always "allowed".

This adds a check before the test files are written. They are skipped only when none of these has a policy:

• %windir%\System32\AppLocker\Script.AppLocker, the compiled effective AppLocker script policy (group policy, local policy or MDM);
• HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Script (AppLocker script rules from group policy);
• SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers in HKLM and HKCU (Software Restriction Policies, which the SAFER call also enforces).

A location counts as "no policy" only if it does not exist. The one exception is the CodeIdentifiers key: Windows can create it with just AuthenticodeEnabled and nothing else, and that key with no subkeys and no other values does not define an SRP policy (creating one adds DefaultLevel, TransparentEnabled, rule subkeys and so on). If anything exists or cannot be read, the test files are written as before. WDAC and the per-file checks are unchanged.

PR Context

Measured on Windows 11 26100 (i9-10900K), Release builds of master 1aac7f5 with and without this change (the two outputs differ only in System.Management.Automation.dll), 40 interleaved runs, median of the paired differences with 95% confidence interval:

On this machine (no AppLocker or SRP policy) the build without the change writes two test files to %TEMP% per start and the build with it writes none; both report GetSystemLockdownPolicy() = None and FullLanguage.

Tests:

• xUnit SystemPolicyTests (new): the registry check against a temporary HKCU key (missing, empty, only AuthenticodeEnabled, other value, rule subkey), the file check, and that HasAppLockerOrSaferScriptPolicy() matches the machine.
• Pester AppLockerProbe.Tests.ps1 (new): starts pwsh with a private TEMP and checks that the test files are written if and only if HasAppLockerOrSaferScriptPolicy() is true.
• Ran Start-PSxUnit for SystemPolicy and SecuritySupport (4 passed) and Start-PSPester for test/powershell/engine/Security and the ConstrainedLanguage*.Tests.ps1 files (23 passed, 0 failed; the 101 tests tagged RequireAdminOnWindows did not run because I ran unelevated).

I could not test with a real AppLocker or SRP policy because writing those policy keys needs admin rights. To check enforcement on a test machine (as admin):

1. AppLocker: start AppIDSvc, create the default script rules and set Script rules to Enforce (secpol.msc or Set-AppLockerPolicy), run gpupdate /force, and confirm Script.AppLocker exists. As a standard user, pwsh -c '$ExecutionContext.SessionState.LanguageMode' should print ConstrainedLanguage with and without this change, and the new Pester test should pass (test files written).
2. SRP: in secpol.msc create Software Restriction Policies with Security Level "Disallowed" (default path rules allow Windows and Program Files). Same check: ConstrainedLanguage for both builds, test files written.
3. Remove the policies: FullLanguage, and with this change no test files in %TEMP%.

I used GitHub Copilot to investigate this and to help write the change and tests; I reviewed the code and ran the tests above myself.

PR Checklist

• PR has a meaningful title
  • Use the present tense and imperative mood when describing your changes
• Summarized changes
• Make sure all .h, .cpp, .cs, .ps1 and .psm1 files have the correct copyright header
• This PR is ready to merge. If this PR is a work in progress, please open this as a Draft Pull Request and mark it as Ready to Review when it is ready to merge.
• Breaking changes
  • None
  • OR
  • Experimental feature(s) needed
    • Experimental feature name(s):
• User-facing changes
  • Not Applicable
  • OR
  • Documentation needed
    • Issue filed:
• Testing - New and feature
  • N/A or can only be tested interactively
  • OR
  • Make sure you've added a new test if existing tests do not effectively test the code changed