ASD ISM 1621 Disable or remove Windows PowerShell 2.0
What it says
Windows PowerShell 2.0 is disabled or removed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure the outdated PowerShell 2.0 is disabled or uninstalled for security.
PowerShell 2.0 is an outdated version of a tool used to automate tasks and manage computer systems. If it remains active on your system, it can expose you to security risks because it's more prone to attacks by hackers trying to exploit its old flaws. Removing or disabling it helps protect your computers from potential threats.
Free. Save your status, tasks and notes.
Why it matters
If PowerShell 2.0 remains enabled, attackers can abuse weaker logging and legacy features, reducing detection and bypassing newer PowerShell protections.
How to implement
The IT team should identify all computers and servers running Windows in the organisation.
They can do this by scanning the network for devices and checking their software versions. This will highlight which systems might still have PowerShell 2.0 installed.
Once systems with PowerShell 2.0 are identified, the IT team should remove or disable it.
They can perform this action by accessing the system settings or using a software management tool to uninstall or turn off this old version, ensuring it cannot be used.
IT managers should educate staff about the risks of running outdated software like PowerShell 2.0.
This can be done through brief training sessions that explain why older software versions are riskier and how newer versions provide better security.
The IT team should install a more secure version of PowerShell on all systems that require it.
This involves downloading the latest version from a trusted source and following installation procedures to ensure it's correctly set up and ready for use.
IT staff should regularly review system software and update it as required.
Setting up a schedule to periodically check all installed programs ensures older, vulnerable software is promptly replaced with safer, updated versions.
Keep it running
Audit Windows Features and GPO/registry settings to confirm PowerShell 2.0 is disabled/removed; alert and remediate immediately if v2 is re-enabled.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of all systems within the organisation and what version of PowerShell each is running.
Look at
The details to ensure PowerShell 2.0 is not present on any machines.
Good evidence
Is documentation showing an absence of PowerShell 2.0 across all devices.
- Check 2 of 5What an auditor asks for
Look at
Specific steps defined for discovering and phasing out outdated software.
Good evidence
Outlines clear, periodic review processes and actions for outdated software removal.
- Check 3 of 5What an auditor asks for
Ask for
Documentation of any training given to staff about software security best practices.
Look at
Attendee lists and date stamps to verify staff awareness activities have occurred.
Good evidence
Shows training was offered regularly and covers the need to avoid legacy software.
- Check 4 of 5What an auditor asks for
Look at
Installation logs or software management reports to confirm current versions installed.
Good evidence
Provides evidence of current PowerShell versions being used after PowerShell 2.0 removal.
- Check 5 of 5What an auditor asks for
Ask for
The results of any recent network scans targeting software versions.
Look at
The scan details to ensure a comprehensive check of the network was made.
Good evidence
Shows results confirming systems are free of legacy PowerShell 2.0 installations.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML3.2, Ensure Windows PowerShell 2.0 is disabled or removed, which asks for the same thing.
ASD Essential Eight: 4 mappings
This control is equivalent to E8-AH-ML3.2.
E8-AH-ML3.2 requires organisations to ensure Windows PowerShell 2.0 is disabled or removed to reduce exposure to legacy scripting capabilities. ISM-1621 states the same requirement: Windows PowerShell 2.0 is disabled or removed. Both controls align in scope and intent, and implementing one would largely satisfy the other.
This control partially overlaps E8-AH-ML3.1.
E8-AH-ML3.1 requires organisations to disable or remove legacy .NET Framework versions (3.5/3.0/2.0) to reduce the attack surface from outdated components. ISM-1621 similarly requires disabling or removing a legacy Windows component (PowerShell 2.0) to prevent the use of weaker/less-auditable functionality often abused by adversaries. They overlap in intent and approach (removing legacy execution/runtime capability), but they apply to different technologies and do not satisfy each other's specific requirement.
This control supports E8-AH-ML2.11.
ISM-1621 requires organisations to disable or remove Windows PowerShell 2.0 to remove an older execution environment that can evade modern monitoring. E8-AH-ML2.11 requires central logging of PowerShell module, script block, and transcription events, improving detection and investigation of malicious PowerShell use. Removing PowerShell 2.0 (ISM-1621) supports E8-AH-ML2.11 by ensuring activity occurs in newer PowerShell versions where these logging capabilities are available and reliable.
This control supports E8-AH-ML3.3.
ISM-1621 requires organisations to disable or remove Windows PowerShell 2.0 so PowerShell cannot fall back to a legacy engine with reduced logging and security capabilities. E8-AH-ML3.3 configures PowerShell to use Constrained Language Mode, which reduces script and API abuse in the remaining PowerShell environment. Disabling PowerShell 2.0 (ISM-1621) strengthens the effectiveness of Constrained Language Mode by preventing downgrade paths, but it is not the same control objective.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.