Select-Object CmdLet fails when used inside a FunctionDefinition of New-PSSessionConfigurationFile - powershell

Question

Consider this example below, where I am creating a constrained management end-point. My objective is to create a "proxy" function over the Get-EventLog CmdLet. This example, works as expected until I add | Select-Object -First 5. When I do this I get the following error message: "A parameter cannot be found that matches parameter name 'First'". Why?
$getAppEventLog = {
#this throws an error, see below
get-eventlog -log application | Select-Object -First 5
#this works
#get-eventlog -log application
}
New-PSSessionConfigurationFile -Path c:\PSScripts\panos.pssc `
-Description 'Delegation EndPoint Repro' `
-ExecutionPolicy Restricted `
-SessionType RestrictedRemoteServer `
-LanguageMode FullLanguage `
-FunctionDefinitions #{Name="Get-AppEventLog";ScriptBlock=$getAppEventLog; Options="AllScope"}
Unregister-pssessionconfiguration -name EventLogManagement -force
Test-PSSessionConfigurationFile -Path c:\PSScripts\panos.pssc
Register-PSSessionConfiguration -Path 'c:\PSScripts\panos.pssc' `
-Name EventLogManagement `
-ShowSecurityDescriptorUI `
-AccessMode Remote `
-Force
Enter-PSSession -ComputerName localhost -ConfigurationName EventLogManagement
Get-AppEventLog
Select-Object : A parameter cannot be found that matches parameter name 'First'.
At line:2 char:51
+ get-eventlog -log application | Select-Object -First 5
+ ~~~~~~
+ CategoryInfo : InvalidArgument: (:) [Select-Object], ParameterBindingException
+ FullyQualifiedErrorId : NamedParameterNotFound,Select-Object
PowerShell Info
PS C:\Windows\system32> $PSVersionTable
Name Value
---- -----
PSVersion 4.0
WSManStackVersion 3.0
SerializationVersion 1.1.0.1
CLRVersion 4.0.30319.34209
BuildVersion 6.3.9600.17400
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0}
PSRemotingProtocolVersion 2.2
After thinking about this, I realized the issue could be reproduced in a simpler way - without the function definition.
When SessionType is equal to RestrictedServer, the following two Cmdlets are available: Get-Command and Select-Object. Therefore, I could reproduce my issue by simply executing something like this:
[localhost]: PS> Get-Command | Select-Object -first 1
A parameter cannot be found that matches parameter name 'first'.
+ CategoryInfo : InvalidArgument: (:) [Select-Object], ParameterBindingException
+ FullyQualifiedErrorId : NamedParameterNotFound,Select-Object
Given that, I can create a session that reproduces the issue, like so:
New-PSSessionConfigurationFile -Path c:\PSScripts\panos.pssc `
-Description 'Delegation EndPoint Repro' `
-ExecutionPolicy Restricted `
-SessionType RestrictedRemoteServer `
-LanguageMode FullLanguage
Unregister-pssessionconfiguration -name EventLogManagement -force
Test-PSSessionConfigurationFile -Path c:\PSScripts\panos.pssc
Register-PSSessionConfiguration -Path 'c:\PSScripts\panos.pssc' `
-Name EventLogManagement `
-ShowSecurityDescriptorUI `
-AccessMode Remote `
-Force
Hence, I can rephrase my original question as: Why does Select-Object Cmdlet does not work in a restricted session, given the above registration parameters.

Answer 1

I've had the same issue, creating a PS endpoint as a wrapper around the PSPKI module. The PSPKI module uses the Select-Object as well, giving the same error.
The solution for me was to update my endpoint .psrc file to include an AliasDefinition for Select-Object to point to the FQDN Select-Object.
AliasDefinitions = #{ Name = 'Select-Object' ; Value = 'Microsoft.PowerShell.Utility\Select-Object' }
See also: https://jamesone111.wordpress.com/2016/07/01/just-enough-admin-and-constrained-endpoints-part-2-startup-scripts/
Grtx,
BvZanten

Answer 2

Instead can you please try to use:
Get-EventLog -log application -newest 5

Answer 3

With a SessionType RestrictedRemoteServer the function Select-Object is not the same as in a Default-SessionType:
RestrictedRemoteServer. Includes only the following proxy functions: Exit-PSSession, Get-Command, Get-FormatData, Get-Help, Measure-Object, Out-Default, and Select-Object. Use the parameters of this cmdlet to add modules, functions, scripts, and other features to the session.
That issue is described here with some workarounds: Constrained PowerShell endpoints – Visible cmdlets, session types, and language modes:
A proxy function is a wrapper function around the original cmdlet that modifies the capabilities of the cmdlet, for example, by adding or removing parameters.