Essential Eight AH-ML3.2 Ensure Windows PowerShell 2.0 is disabled or removed

This control partially meets A.8.9.

E8-AH-ML3.2 requires organisations to implement a specific secure configuration by disabling or removing Windows PowerShell 2.0. Annex A 8.9 requires configurations (including security configurations) of software to be established, documented, implemented, monitored and reviewed, which would encompass ensuring PowerShell 2.0 is not enabled. Annex A 8.9 is a general configuration management control across IT assets, while E8-AH-ML3.2 is a specific configuration hardening requirement.

This control is equivalent to ISM-1621.

E8-AH-ML3.2 requires organisations to ensure Windows PowerShell 2.0 is disabled or removed to reduce exposure to legacy scripting capabilities. ISM-1621 states the same requirement: Windows PowerShell 2.0 is disabled or removed. Both controls align in scope and intent, and implementing one would largely satisfy the other.

This control partially meets ISM-0380.

E8-AH-ML3.2 requires organisations to disable or remove Windows PowerShell 2.0 as a specific hardening action. ISM-0380 requires unneeded user accounts, components, services and functionality of operating systems to be disabled or removed, which would include removing legacy OS components such as PowerShell 2.0 where not required. ISM-0380 is broader OS hardening, while E8-AH-ML3.2 is a single targeted implementation within that broader requirement.

This control partially meets ISM-1247.

E8-AH-ML3.2 requires organisations to disable or remove Windows PowerShell 2.0. ISM-1247 focuses on disabling or removing unneeded server features, including components, services and functionality of server applications. Where PowerShell 2.0 is present as an enabled legacy feature on servers, E8-AH-ML3.2 acts as a specific hardening action that fits within ISM-1247's broader requirement.

This control partially meets ISM-1409.

ISM-1409 requires operating systems to be hardened in accordance with ASD and vendor hardening guidance, applying the most restrictive guidance when conflicts occur. E8-AH-ML3.2 is a specific hardening action (disabling/removing legacy .NET Framework versions) that would commonly be included within an OS hardening baseline on Windows. ISM-1409 is broader because it encompasses the full set of OS hardening requirements, while E8-AH-ML3.2 addresses one discrete configuration item.

This control partially meets ISM-1470.

E8-AH-ML3.2 requires organisations to disable or remove Windows PowerShell 2.0 specifically. ISM-1470 requires disabling or removing unneeded components, services and functionality across multiple application types as part of general hardening. Disabling PowerShell 2.0 is a concrete instance of removing an unneeded/unsafe legacy function, but ISM-1470 is broader in scope than E8-AH-ML3.2.

This control partially meets ISM-1858.

ISM-1858 requires IT equipment to be hardened in accordance with ASD and vendor guidance, prioritising the most restrictive requirements. E8-AH-ML3.2 requires disabling or removing Windows PowerShell 2.0, which is a concrete hardening action commonly present in ASD hardening guidance for Windows. The candidate is narrower because it addresses one specific control setting rather than the full hardening baseline across IT equipment.

This control partially meets ISM-1914.

E8-AH-ML3.2 requires organisations to disable or remove Windows PowerShell 2.0 on Windows systems. ISM-1914 requires approved configurations for operating systems to be developed, implemented and maintained, and an approved Windows baseline would typically mandate disabling legacy components like PowerShell 2.0. ISM-1914 covers the full lifecycle of OS configuration governance, whereas E8-AH-ML3.2 is one specific configuration outcome.

This control partially overlaps ISM-1246.

ISM-1246 requires server applications to be hardened with ASD and vendor guidance, applying the most restrictive guidance where conflicts occur. E8-AH-ML3.2 requires disabling/removing Windows PowerShell 2.0, a specific hardening measure. E8-AH-ML3.2 is a single prescriptive configuration, while ISM-1246 covers broader end-to-end application hardening for servers.

This control partially overlaps ISM-1655.

E8-AH-ML3.2 requires organisations to disable or remove Windows PowerShell 2.0 to reduce attack surface and weaken common living-off-the-land techniques. ISM-1655 requires disabling or removing .NET Framework 3.5, another legacy component often kept for compatibility. Both controls reduce exposure by removing deprecated Windows components, but they apply to different technologies and neither control inherently satisfies the other.

This control supports ISM-1622.

ISM-1622 requires PowerShell to use Constrained Language Mode to reduce capability available to scripts and interactive sessions. E8-AH-ML3.2 requires Windows PowerShell 2.0 to be disabled or removed to eliminate an older, less controllable engine that can weaken PowerShell security controls. Disabling PowerShell 2.0 supports effective enforcement of modern PowerShell protections (including CLM), but it is a different requirement to configuring CLM itself.

This control depends on ISM-1584.

E8-AH-ML3.2 requires organisations to disable or remove Windows PowerShell 2.0. ISM-1584 requires preventing unprivileged users from bypassing, disabling or modifying operating system security functionality. Implementing ISM-1584 supports E8-AH-ML3.2 by ensuring users cannot re-enable or tamper with the PowerShell 2.0 feature once it has been disabled or removed.

This control partially overlaps IT.PRO-04.1.

IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-AH-ML3.2 requires Windows PowerShell 2.0 to be disabled or removed, one component such a baseline takes out.