PowerShell has different levels of security
set by an execution policy. If you don’t modify the execution policy,
you won’t be able to run any scripts. These security contexts or
security levels define what PowerShell scripts can run. The following
table shows the available security contexts that you can configure.
Tip
By default, PowerShell scripts cannot run until the execution policy is changed. It’s common to change the policy to remote-signed. You can still run individual commands.
| Execution Policy | Comments |
|---|
| Restricted | No scripts can run. PowerShell does not load configuration files or run scripts.
Tip
This is the default and must be changed to run any scripts.
|
| Unrestricted | All
configuration files are loaded and any scripts can run. If you run an
unsigned script that was downloaded from the Internet, you are prompted
for permission before it runs. |
| Remote-signed | Local
scripts can run without being signed. All scripts and configuration
files downloaded from the Internet must be signed by a trusted
publisher. |
| All-signed | All scripts and configuration files must be signed by a trusted publisher. This includes scripts running on the local computer. |
| Bypass | Nothing is blocked and there are no warnings or prompts. This works like unrestricted without the prompts. |
| Undefined | Removes
the currently assigned execution policy from the current scope. It does
not remove an execution policy that is set in a Group Policy scope. |
You can view and set the execution policy with the following commands.
| PowerShell Command | Comments |
|---|
PS C:\> get-executionpolicy
| Returns the currently assigned execution policy. |
PS C:\> get-executionpolicy
-list
| Lists
the state of the execution policy for all scopes including the machine
policy, the user policy, the process, the current user, and the local
machine. |
set-executionpolicy (restricted
| remotesigned | allsigned | unrestricted | bypass )
PS C:\> set-executionpolicy
remotesigned
| Sets
the execution policy. The example sets the policy to allow local
scripts to run, but requires any scripts downloaded from the Internet
to be signed. |
