Detection, prevention, and respond a good baseline of all three compartments.
Secured by default, using WinRM, by default allowed for administrators group.
It controls how PowerShell scripts can be executed as scripts. PowerShell scripts can also be executed as commands, and there are many bypasses available.
System.Management.Automation.dll - .NET Framework
Extended security features and enforcement capabilities
Whitelisting tool
If AppLocker is enforced in Allow mode, the interactive shell and every PowerShell script that isn't whitelisted will be executed in ConstrainedLanguageMode.
Principle of least privilege, ConstrainedLanguageMode, Logging.