Glossary
Constrained Language Mode
A PowerShell language mode that blocks arbitrary .NET, COM and Win32 API access, enforced automatically by App Control or AppLocker script policies.
Constrained Language Mode (CLM) is a PowerShell language mode that allows core cmdlets and basic language elements but blocks the features most offensive tooling needs: arbitrary .NET types and methods, Add-Type, most COM objects and direct Win32 API calls. The current mode is shown by $ExecutionContext.SessionState.LanguageMode.
CLM is only robust when enforced by application control. With an App Control for Business or AppLocker script policy in place, PowerShell runs untrusted scripts and interactive sessions in Constrained Language Mode, while scripts allowed by the policy (for example, signed by an internal certificate) run in Full Language Mode. Setting the __PSLockdownPolicy environment variable is not a security boundary.
See PowerShell security.