How to use and configure the PowerShell execution Policy

PowerShell execution policy it's a feature that helps to prevent malicious scripts in the computer.  The execution policy it's not a security that will prevent users to run a script.

It's a basic rule that can use it to protect the computer from running malicious scripts and violating them unintentionally. 

For non-Windows computers execution policy is Unrestricted and can't be change. However the default execution Policy in Windows 10,1 is Restricted.

Let's see what are the execution policies and how can use it.

Types of the Execution Policies

There are 7 types of PowerShell Execution Policy. Each one provide a very specific set of rule. 

AllSigned
Run only scripts that have been signed with an SSL Certificate. The Certificate can be self-signed as well.

Bypass
It's not block anything. You cam run any script in the computer.

Default
The Default Policy for Windows 10,11 is Restricted and for the Windows Servers RemoteSigned

Restricted
With this Policy you can run individual commands but not a script.

RemoteSigned
It's the default policy of the Windows Servers. You can run a script that it's created local. However any script that it's downloaded from the internet must be digital signed to run it.

Undefined
It's not applied any  policy for the current scope.

Unrestricted
You can run a PowerShell Script without any policy but you will get a warning message 

Types of Execution Policy Scopes 

We are saw the 7 execution Policies. Let's see the scopes that we can apply the execution policies.

There are 5 execution Policy Scopes

MachinePolicy

You can apply MachinePolicy via GroupPolicy for all users in the Computer.

UserPolicy

You can apply UserPolicy via GroupPolicy for the current user in the Computer.

Process

Applies to the PowerShell session that it's open. When you will close the PowerShell session the Policy deleted

CurrentUser

Applies to the current user of the Computer

LocalMachine

Applies in all users of the computer and store settings in registry HKEY_LOCAL_MACHINE

How List all the  Execution Policy Scopes

If you would like to see all the Execution Policies you can use the command

Get-ExecutionPolicy -List

How List the current Execution Policy

If you want to see the PowerShell execution policy that it's applied in the computer you can type 

Get-ExecutionPolicy

How to change the Execution Policy

Let's try to change the current execution policy with the Set-ExecutionPolicy

Set-ExecutionPolicy Unrestricted

We can change the execution policy for a specific Scope as well. Let's change the execution policy for the Scope CurrentUser to AllSigned

Set-ExecutionPolicy AllSigned -Scope CurrentUser

Now we will list the current execution policy for the Currentuser and the LocalMachine. As you can see is different

How to Bypass the Execution Policy

If you have a specific reason you can bypass the execution policy when you run a script. However, because it's not secure to leave the execution policy in Bypass you can use the following command to run set the execution policy in Bypass only for the specific PowerShell session.

So when you will close the PowerShell session the execution policy will be deleted and it will not applied in a new PowerShell Session. 

Set-ExecutionPolicy Bypass -Scope Process

How to apply the Execution Policy through Group Policy

If you have lot of Computers and Servers that you should apply specific Execution Policy you can deploy it through Group Policy.

• Login to your Domain Controller

• Open the Group Policy Management
• Go to the Computer Configuration - - Windows Components - Windows PowerShell
• From the right side open the Properties of the Turn on Script Execution.

• Check the Enable, and select one of the 3 avaialable options.
  • Allow only signed Scripts (AllSigned)
  • Allow local scripts and remote signed scripts (RemoteSigned)
  • Allow all scripts (Unrestricted)
• When you will select the Execution Policy that you need then click OK.

That's it !!!

PowerShell execution policies is a gatekeeper of the scripts. It's not a security pillar of your environemnt. However you can increase your security level with a few changes in PowerShell and reduce the chance of your system being compromised from a malicious code.