dot-source issue

[nemchik]

I've run into an issue where there is a Group Policy enforced on my computer (at work) and somehow it doesn't like dot-source in PowerShell. I'm not even sure what would need to be changed in the GPO in order to resolve this, and I'm not in direct control of the GPO (but I can make requests).

Anyway the issue I'm affected by is this error

C:\tools\poshgit\dahlbyk-posh-git-fadc4dd\profile.example.ps1 : Cannot dot-source
this command because it was defined in a different language mode. To invoke this
command without importing its contents, omit the '.' operator.
At C:\Users\myusername\Documents\WindowsPowerShell\Microsoft.PowerShell_prof
ile.ps1:3 char:1
+ . 'C:\tools\poshgit\dahlbyk-posh-git-fadc4dd\profile.example.ps1'
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [profile.example.ps1], NotSupp
   ortedException
    + FullyQualifiedErrorId : DotSourceNotSupported,profile.example.ps1

Rename-Item : Cannot rename because item at 'Function:\Prompt' does not exist.
At C:\Users\myusername\Documents\WindowsPowerShell\Microsoft.PowerShell_prof
ile.ps1:4 char:1
+ Rename-Item Function:\Prompt PoshGitPrompt -Force
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Rename-Item], PSInvalidOperat
   ionException
    + FullyQualifiedErrorId : InvalidOperation,Microsoft.PowerShell.Commands.Renam
   eItemCommand

I've done a decent amount of Google-fu with no luck.
So I guess this issue has two possible resolutions;

1. Can anyone point me in the right direction about what exactly needs to be changed in GPO to allow posh-git?
2. Is it possible for posh-git to do its magic without dot-source?

[MarkusAmshove]

Hi nemchik,

can you give us the output of
$PSVersiontable
and
$ExecutionContext.SessionState.LanguageMode (taken from https://technet.microsoft.com/de-de/library/dn433292(v=wps.630).aspx)?

[MarkusAmshove]

I just found this blogpost:
http://itfordummies.net/2015/06/powershell-constrained-mode/

If I set this EnvironmentVariable:

my LanguageMode is "ConstrainedLanguage" and I get the same error message.

I also can't override the Environment Variable in ConstrainedLanguage-Mode, so I had to set it manually in the Environment Variables (Windows-Key + PAUSE -> Advanced system settings -> Environment Variables).

You can try the LanguageMode locally via the Environment Variable if you set "__PSLockdownPolicy" to 0 (works for me).

If posh-git shouldn't use dot-sourcing you'd need to include all the functions in the module file (psm1), but I don't think that it will work in such an restricted shell.
Maybe you can try out the policy from 4->0 to find out which works, then kindly ask your admins to set the GPO :-)

[nemchik]

PS>$PSVersiontable

Name                           Value
----                           -----
PSVersion                      5.0.10240.16384
WSManStackVersion              3.0
SerializationVersion           1.1.0.1
CLRVersion                     4.0.30319.42000
BuildVersion                   10.0.10240.16384
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
PSRemotingProtocolVersion      2.3


PS>$ExecutionContext.SessionState.LanguageMode
ConstrainedLanguage
PS>

I'm trying to get us to ditch the GPO entirely because it's been a nightmare and caused more issues than it's solved, but that's a hard sell.
Anyway I tried adding the environment variable __PSLockdownPolicy to both user and system with a value of 0 and 1 and these did not seem to change the output of the above and still showed the errors mentioned in the OP.

[nemchik]

it seems there are other articles on the internet where people are having similar issues with software restriction policies (which is what I'm running into) and powershell language. This particular link doesnt seem to have a resolution though :(

[MarkusAmshove]

Did you start a new Powershell after setting the environment variables?
What does "$ExecutionContext.SessionState.LanguageMode" then return?

[MarkusAmshove]

You can confirm if the variable is set by executing:
gc Env:__PSLockdownPolicy
and getting a result (0-4)
or having "Test-Path env:__PSLockdownPolicy" return True

[nemchik]

Yes I started a new powershell every time I set or changed the value. Having the environment variable set did not seem to stop the original error from showing. I confirmed just now by again adding the environment variable and then closing and reopening powershell, seeing the error, and then running gc Env:\__PSLockdownPolicy and seeing the expected number.

Unfortunately it doesn't seem to help. Removing my machine from the software restriction GPO does resolve the issue, but I'm only granted that privilege for testing and certain special cases.

[dahlbyk]

@nemchik were you able to resolve this?

[nemchik]

Unfortunately no, the only solution I've found is being removed from the group policy that has the software restriction. Everything works fine when I'm out, but being in the software restriction still causes issues.

[dahlbyk]

I have no idea how to fix it, but I found some stuff written since you opened the issue that confirms what you're seeing as being related to policy:

• https://community.spiceworks.com/topic/1451109-srp-whitelist-causing-odd-behavior-in-powershell-v5
• https://www.sysadmins.lv/blog-en/powershell-50-and-applocker-when-security-doesnt-mean-security.aspx
• https://blogs.msdn.microsoft.com/powershell/2015/06/09/powershell-the-blue-team/ (search for "Constrained PowerShell")

I wonder if the changes being discussed in #328 (essentially writing an Import-Module posh-git into $PROFILE instead of dot-sourcing profile.example.ps1) would mitigate this? You might try copying the contents of profile.example.ps1 directly into your profile, though you may still be prevented from importing the module.

[rkeithhill]

I don't think there is anything we can do in posh-git to make it work under locked GPO policy. Not only was dot sourcing prevented but Rename-Item was also disallowed. Direct use of .NET script is disallowed in constrained language mode as well. I recommend closing this issue.

[dahlbyk]

Agreed. If anyone has more information about steps we could take to mitigate this, please leave a note (or open a PR!) and we'll do what we can.