Aditya Patwardhan (adityapatwardhan) · Aug 10, 2026 · Aug 26, 2026
diff --git a/src/Microsoft.PowerShell.ConsoleHost/host/msh/CommandLineParameterParser.cs b/src/Microsoft.PowerShell.ConsoleHost/host/msh/CommandLineParameterParser.cs
@@ -14,6 +14,7 @@
 using System.Management.Automation.Internal;
 using System.Management.Automation.Language;
 using System.Management.Automation.Runspaces;
+using System.Management.Automation.Security;
 using System.Security;
 using System.Text;
 
@@ -874,10 +875,27 @@ internal void Parse(string[] args)
             ParseHelper(args);
         }
 
+        internal static bool IsFileOnlyEntryEnabled
+        {
+            get
+            {
+#if UNIX
+                return false;
+#else
+                return SystemPolicy.IsFileOnlyEntryEnabled();
+#endif
+            }
+        }
+
         private void ParseHelper(string[] args)
         {
             if (args.Length == 0)
             {
+                if (IsFileOnlyEntryEnabled)
+                {
+                    SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryRequired);
+                }
+
                 return;
             }
 
@@ -923,6 +941,12 @@ private void ParseHelper(string[] args)
                     _noExit = true;
                     noexitSeen = true;
                     ParametersUsed |= ParameterBitmap.NoExit;
+
+                    if (IsFileOnlyEntryEnabled)
+                    {
+                        SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryNoExitDisabled);
+                        break;
+                    }
                 }
                 else if (MatchSwitch(switchKey, "noprofile", "nop"))
                 {
@@ -944,32 +968,57 @@ private void ParseHelper(string[] args)
                     _socketServerMode = true;
                     _showBanner = false;
                     ParametersUsed |= ParameterBitmap.SocketServerMode;
+                    if (IsFileOnlyEntryEnabled)
+                    {
+                        SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryServerMode);
+                        break;
+                    }
                 }
 #if !UNIX
                 else if (MatchSwitch(switchKey, "v2socketservermode", "v2so"))
                 {
                     _v2SocketServerMode = true;
                     _showBanner = false;
                     ParametersUsed |= ParameterBitmap.V2SocketServerMode;
+                    if (IsFileOnlyEntryEnabled)
+                    {
+                        SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryServerMode);
+                        break;
+                    }
                 }
 #endif
                 else if (MatchSwitch(switchKey, "servermode", "s"))
                 {
                     _serverMode = true;
                     _showBanner = false;
                     ParametersUsed |= ParameterBitmap.ServerMode;
+                    if (IsFileOnlyEntryEnabled)
+                    {
+                        SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryServerMode);
+                        break;
+                    }
                 }
                 else if (MatchSwitch(switchKey, "namedpipeservermode", "nam"))
                 {
                     _namedPipeServerMode = true;
                     _showBanner = false;
                     ParametersUsed |= ParameterBitmap.NamedPipeServerMode;
+                    if (IsFileOnlyEntryEnabled)
+                    {
+                        SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryServerMode);
+                        break;
+                    }
                 }
                 else if (MatchSwitch(switchKey, "sshservermode", "sshs"))
                 {
                     _sshServerMode = true;
                     _showBanner = false;
                     ParametersUsed |= ParameterBitmap.SSHServerMode;
+                    if (IsFileOnlyEntryEnabled)
+                    {
+                        SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryServerMode);
+                        break;
+                    }
                 }
                 else if (MatchSwitch(switchKey, "noprofileloadtime", "noprofileloadtime"))
                 {
@@ -1248,6 +1297,15 @@ private void ParseHelper(string[] args)
                 }
             }
 
+            if (_error is null
+                && !_showVersion
+                && !_showHelp
+                && !ParametersUsed.HasFlag(ParameterBitmap.File)
+                && IsFileOnlyEntryEnabled)
+            {
+                SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryRequired);
+            }
+
             Dbg.Assert(
                     ((_exitCode == ConsoleHost.ExitCodeBadCommandLineParameter) && _abortStartup)
                 || (_exitCode == ConsoleHost.ExitCodeSuccess),
@@ -1345,6 +1403,12 @@ private bool ParseFile(string[] args, ref int i, bool noexitSeen)
             // Process interactive input...
             if (args[i] == "-")
             {
+                if (IsFileOnlyEntryEnabled)
+                {
+                    SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryRequired);
+                    return false;
+                }
+
                 // the arg to -file is -, which is secret code for "read the commands from stdin with prompts"
 
                 _explicitReadCommandsFromStdin = true;
@@ -1477,6 +1541,12 @@ static object ConvertToBoolIfPossible(string arg)
 
         private bool ParseCommand(string[] args, ref int i, bool noexitSeen, bool isEncoded)
         {
+            if (IsFileOnlyEntryEnabled)
+            {
+                SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryRequired);
+                return false;
+            }
+
             if (_commandLineCommand != null)
             {
                 // we've already set the command, so squawk

diff --git a/src/Microsoft.PowerShell.ConsoleHost/host/msh/ConsoleHost.cs b/src/Microsoft.PowerShell.ConsoleHost/host/msh/ConsoleHost.cs
@@ -158,8 +158,6 @@
                 // improve startup performance.
             }
 
-            uint exitCode = ExitCodeSuccess;
-
             Thread.CurrentThread.Name = "ConsoleHost main thread";
 
             try
@@ -185,7 +183,7 @@
                     // or start up the engine and retrieve the information via $psversiontable.GitCommitId
                     // but this returns the semantic version and avoids executing a script
                     s_theConsoleHost.UI.WriteLine($"PowerShell {PSVersionInfo.GitCommitId}");
-                    return 0;
+                    return ExitCodeSuccess;
                 }
 
                 // Servermode parameter validation check.
@@ -216,6 +214,14 @@
                     return ExitCodeBadCommandLineParameter;
                 }
 
+                if (serverModeCount is 1 && CommandLineParameterParser.IsFileOnlyEntryEnabled)
+                {
+                    // User facing error message should already be written by the parser,
+                    // so just trace and exit.
+                    s_tracer.TraceError("Server mode cannot be specified when FileOnlyEntry policy is in place.");
+                    return ExitCodeBadCommandLineParameter;
+                }
+
 #if !UNIX
                 TaskbarJumpList.CreateRunAsAdministratorJumpList();
 #endif
@@ -230,9 +236,10 @@
                         configurationName: null,
                         configurationFile: s_cpp.ConfigurationFile,
                         combineErrOutStream: false);
-                    exitCode = 0;
+                    return ExitCodeSuccess;
                 }
-                else if (s_cpp.SSHServerMode)
+
+                if (s_cpp.SSHServerMode)
                 {
                     ApplicationInsightsTelemetry.SendPSCoreStartupTelemetry("SSHServer", s_cpp.ParametersUsedAsDouble);
                     ProfileOptimization.StartProfile("StartupProfileData-SSHServerMode");
@@ -242,18 +249,20 @@
                         configurationName: null,
                         configurationFile: s_cpp.ConfigurationFile,
                         combineErrOutStream: true);
-                    exitCode = 0;
+                    return ExitCodeSuccess;
                 }
-                else if (s_cpp.NamedPipeServerMode)
+
+                if (s_cpp.NamedPipeServerMode)
                 {
                     ApplicationInsightsTelemetry.SendPSCoreStartupTelemetry("NamedPipe", s_cpp.ParametersUsedAsDouble);
                     ProfileOptimization.StartProfile("StartupProfileData-NamedPipeServerMode");
                     RemoteSessionNamedPipeServer.RunServerMode(
                         configurationName: s_cpp.ConfigurationName);
-                    exitCode = 0;
+                    return ExitCodeSuccess;
                 }
 #if !UNIX
-                else if (s_cpp.V2SocketServerMode)
+
+                if (s_cpp.V2SocketServerMode)
                 {
                     if (s_cpp.Token == null)
                     {
@@ -275,52 +284,51 @@
                         initialCommand: s_cpp.InitialCommand,
                         configurationName: s_cpp.ConfigurationName,
                         token: s_cpp.Token,
-                        tokenCreationTime: s_cpp.UTCTimestamp.Value
-                    );
-                    exitCode = 0;
+                        tokenCreationTime: s_cpp.UTCTimestamp.Value);
+
+                    return ExitCodeSuccess;
                 }
 #endif
-                else if (s_cpp.SocketServerMode)
+
+                if (s_cpp.SocketServerMode)
                 {
                     ApplicationInsightsTelemetry.SendPSCoreStartupTelemetry("SocketServerMode", s_cpp.ParametersUsedAsDouble);
                     ProfileOptimization.StartProfile("StartupProfileData-SocketServerMode");
                     HyperVSocketMediator.Run(
                         initialCommand: s_cpp.InitialCommand,
                         configurationName: s_cpp.ConfigurationName);
-                    exitCode = 0;
+                    return ExitCodeSuccess;
                 }
-                else
+
+                // Run PowerShell in normal console mode.
+                if (hostException != null)
                 {
-                    // Run PowerShell in normal console mode.
-                    if (hostException != null)
-                    {
-                        // Unable to create console host.
-                        throw hostException;
-                    }
+                    // Unable to create console host.
+                    throw hostException;
+                }
 
-                    if (LoadPSReadline())
-                    {
-                        ProfileOptimization.StartProfile("StartupProfileData-Interactive");
+                if (LoadPSReadline())
+                {
+                    ProfileOptimization.StartProfile("StartupProfileData-Interactive");
 
-                        if (UpdatesNotification.CanNotifyUpdates)
-                        {
-                            // Start a task in the background to check for the update release.
-                            _ = UpdatesNotification.CheckForUpdates();
-                        }
-                    }
-                    else
+                    if (UpdatesNotification.CanNotifyUpdates)
                     {
-                        ProfileOptimization.StartProfile("StartupProfileData-NonInteractive");
+                        // Start a task in the background to check for the update release.
+                        _ = UpdatesNotification.CheckForUpdates();
                     }
+                }
+                else
+                {
+                    ProfileOptimization.StartProfile("StartupProfileData-NonInteractive");
+                }
 
-                    s_theConsoleHost.BindBreakHandler();
-                    IsStdOutputRedirected = Console.IsOutputRedirected;
+                s_theConsoleHost.BindBreakHandler();
+                IsStdOutputRedirected = Console.IsOutputRedirected;
 
-                    // Send startup telemetry for ConsoleHost startup
-                    ApplicationInsightsTelemetry.SendPSCoreStartupTelemetry("Normal", s_cpp.ParametersUsedAsDouble);
+                // Send startup telemetry for ConsoleHost startup
+                ApplicationInsightsTelemetry.SendPSCoreStartupTelemetry("Normal", s_cpp.ParametersUsedAsDouble);
 
-                    exitCode = s_theConsoleHost.Run(s_cpp, false);
-                }
+                return unchecked((int)s_theConsoleHost.Run(s_cpp, false));
             }
             finally
             {
@@ -342,11 +350,6 @@
                 }
 #pragma warning restore IDE0031
             }
-
-            unchecked
-            {
-                return (int)exitCode;
-            }
         }
 
         internal static void ParseCommandLine(string[] args)
@@ -3161,4 +3164,4 @@
 
         internal Collection<CommandParameter> InitialCommandArgs { get; set; }
     }
-}   // namespace
+}   // namespace
diff --git a/src/Microsoft.PowerShell.ConsoleHost/resources/CommandLineParameterParserStrings.resx b/src/Microsoft.PowerShell.ConsoleHost/resources/CommandLineParameterParserStrings.resx
@@ -228,4 +228,13 @@ Valid formats are:
   <data name="MissingMandatoryArgument" xml:space="preserve">
     <value>An argument is required to be supplied to the '{0}' parameter.</value>
   </data>
+  <data name="FileOnlyEntryRequired" xml:space="preserve">
+    <value>The parameter "-File" is required by policy.</value>
+  </data>
+  <data name="FileOnlyEntryNoExitDisabled" xml:space="preserve">
+    <value>The parameter "-NoExit" is disallowed by policy.</value>
+  </data>
+  <data name="FileOnlyEntryServerMode" xml:space="preserve">
+    <value>Server mode is disallowed by policy.</value>
+  </data>
 </root>