Skip to content

Commit 4eed701

Browse files
committed
Address steve's feedback
1 parent 75a8e45 commit 4eed701

File tree

1 file changed

+9
-11
lines changed

1 file changed

+9
-11
lines changed

1-Draft/RFCXXXX-Policy.md

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,10 @@ With `-settingsfile` parameter users can assign custom settings from the config
104104

105105
##### Computer-wide and user policy settings
106106

107-
**No** user can overwrite computer-wide and user policy settings using `-settingsfile`
107+
Admin/root users can overwrite computer-wide and user policy settings using `-settingsfile`,
108+
only when not in System Lock-down mode.
109+
110+
This will have performance impact on startup, but only when `-settingsfile` is specified.
108111

109112
#### Priorities for Regular settings in descending order
110113

@@ -140,6 +143,8 @@ A set of configuration settings in GPO scheme and file scheme for policy setting
140143
| | Transcription | OutputDirectory | String | Computer, Then User |
141144
| | UpdatableHelp | DefaultSourcePath | String | Computer Wide |
142145

146+
I filed [#9632](https://github.com/PowerShell/PowerShell/issues/9632) on UpdatableHelp-DefaultSourcePath to make it allow User settings.
147+
143148
#### JSON file settings format
144149

145150
```json
@@ -196,17 +201,10 @@ A set of configuration settings in GPO scheme and file scheme for policy setting
196201
We could attempt to resolve policy conflicts between PowerShell 7 policy and Windows PowerShell policy.
197202
This would make the `Precedence for Policy settings` not just a simple list but a complex set of rules that would not be easily understood. See [this conversation](https://github.com/PowerShell/PowerShell/issues/9309?#issuecomment-480643922).
198203

199-
### Allow admins to overwrite computer-wide settings
200-
201-
In System Lock-down mode, we attempt to protect from the admin,
202-
so allowing computer-wide or policy setting to be overwritten at the command-line is dangerous.
203-
204-
We could try to check for System Lock-down mode and
205-
admin user and allow `-settingsfile` to overwrite computer-wide settings.
206-
207-
But, performing the system lock-down check this early would hurt startup performance.
204+
### Allowing environment variable in the JSON
208205

209-
I don't recommend this approach.
206+
A new RFC should be drafted about how to allow environment variables in the JSON.
207+
This would allow consistent files across platforms.
210208

211209
### Comment A
212210

0 commit comments

Comments
 (0)