What
When an admin policy helper is delivered as an inline script, the child process environment is stripped before it runs. On Windows the PowerShell binary is resolved only from a fixed list of absolute install locations on C:, never from PATH.
Details
- The
shpath runs with a fixed PATH andLC_ALL=Cafter deletingENV,BASH_ENV,LD_,DYLD_and similar variables. - The
pwshpath rebuildsPSModulePath,PATH,PATHEXTandCOMSPEC, and dropsDOTNET_,COMPLUS_andCOR_variables. - If no stock PowerShell install is found, the helper fails rather than falling back to a PATH lookup.
Evidence
PowerShell not found at any of its stock install locations on C: (fixed absolute candidates only; PATH is never consulted)
Strings lifted out of the shipped bundle, so the claim above can be checked against them.