Read-Only PowerShell Now Tells Code From Text ​

October 18, 2026 · InfraScout Team

agent_exec_powershell_readonly now refuses far fewer of the read scripts an assessment actually needs. It tells the code in a script from the text inside it, and it knows more about which commands read and which ones write.

Text in a string is just text ​

Assessment scripts are full of strings that look like commands. An LDAP filter for disabled accounts, a log message that says "removing stale entries", a regular expression that matches Set- lines in a transcript: none of them do anything, but each contains words a command check watches for.

The read-only tool now tells code from data. What sits inside a string is treated as data, so a script that searches for, prints, or matches the name of a write cmdlet runs as written. Code that runs inside a string, such as a $( ) subexpression, is still checked as code.

For you, this means a script you or the AI wrote for an honest read runs on the first try much more often, and the AI does not have to rewrite working scripts to dodge a refusal.

More reads are allowed ​

Several common read patterns now run on the read-only tool:

  • Invoke-Command with a literal -ScriptBlock { … }, including -ComputerName to read from other computers; the script block is checked like any other script
  • Invoke-WebRequest and Invoke-RestMethod GET and HEAD requests, and socket connectivity probes
  • Windows Update Agent reads through the Microsoft.Update.* COM objects, such as listing pending updates
  • netsh … show and the sc.exe query subcommands
  • CIM and WMI methods with a literal Get or Enum name, and closing the sessions a script opened

Because the tool can now reach other computers and web endpoints, it is annotated as open-world, the same as the other tools that reach beyond InfraScout.

Native tools that write are recognized ​

The same understanding works the other way. A script does not need a PowerShell cmdlet to change a host: taskkill, msiexec, fsutil, certutil -CRL, net user /add, icacls /grant, secedit /export, reg save, reg export, schtasks /run, and every sc.exe subcommand that is not a query all change something. The read-only tool recognizes them and refuses the script before it reaches the host.

If a script you rely on uses one of these, replace that step with a read, or move the work to agent_exec_powershell, where an operator runs it deliberately.

Refusals say whether an admin can help ​

Some refusals can be lifted by an administrator with an allow rule on the agent group's command policy, and some cannot. The refusal now tells you which. It mentions the admin route only when an allow rule would actually work; otherwise it points to agent_exec_powershell. The AI can pass that on directly, instead of sending you to an administrator who cannot change the outcome.

Nothing changes in how command policies work. Allow and deny rules, the most-restrictive combination across groups, and the record of every blocked attempt in the executions view all behave as before.

See agent_exec_powershell_readonly for the full reference, and Read-Only PowerShell With an Admin Command Policy for how the tool and its command policy fit together.

Questions or feedback? Reach us at info@infrascout.cloud.