Repository navigation
Startup: the AppLocker probe costs about 40 ms on every pwsh start, also when no AppLocker policy exists #28372
Description
Summary of the new feature / enhancement
On every start, SystemPolicy.GetSystemLockdownPolicy() goes through GetAppLockerPolicy with no path. That writes two files (__PSScriptPolicyTest_*.ps1 and .psm1) to %TEMP%, runs SaferIdentifyLevel (hash and Authenticode criteria) and SaferComputeTokenFromLevel on them, then deletes them. On a machine with no AppLocker policy at all (no SrpV2 policy, AppIDSvc stopped) this takes about 40 ms of every pwsh -Command ... run. Tools and agents that start pwsh for each command pay it every time.
Measurements: PowerShell 7.6.9 x64 (zip), Windows 11 26100, i9-10900K, 30 interleaved runs per variant, median of the paired differences with 95% confidence interval. To isolate the probe I used a startup hook that sets s_cachedSaferSystemPolicy to Allowed before Main, so the cached branch is taken and nothing else changes.
| pwsh -NoProfile -NonInteractive -Command ... | as is | probe skipped | difference |
|---|---|---|---|
| exit | 354 ms | 313 ms | -39.5 ms (37.6 to 44.2) |
| Get-ChildItem -Name src | Select-Object -First 5 | 624 ms | 583 ms | -42.7 ms (32.0 to 48.2) |
Loaded images go from 133 to 126 (pwrshsip, msisip, appxsip, opcservices and others). The same sequence in a small C program costs 56 ms over an empty process; writing and deleting the two files is 3 ms of that and the SAFER call on the .ps1 39 ms. I also found 83 leftover __PSScriptPolicyTest_* files in %TEMP% on this machine.
Related: #11074 (AppLocker start-up discussion, closed) and #24217 (asks for a way to turn off the test files).
Proposed technical implementation details (optional)
I understand from #11074 that AppLocker has no API that says whether a script policy is in effect. Some options:
- Skip the probe when there is no AppLocker script policy on the machine: no rules under HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Script and no %windir%\System32\AppLocker\Script.AppLocker. Both are writable by admins only. Keep the probe otherwise.
- Cache the result per user and boot, and invalidate it when the AppLocker policy files change.
- Keep the probe but reuse one test file with fixed content instead of creating and deleting two on every start. This saves little time (about 3 ms) but avoids the leftovers.
I can measure any of these with the same setup.
Activity