PowerShell execution policy it's a feature that helps to prevent malicious scripts in the computer. The execution policy it's not a security that will prevent users to run a script.
It's a basic rule that can use it to protect the computer from running malicious scripts and violating them unintentionally.
For non-Windows computers execution policy is Unrestricted and can't be change. However the default execution Policy in Windows 10,1 is Restricted.
Let's see what are the execution policies and how can use it.
Types of the Execution Policies
There are 7 types of PowerShell Execution Policy. Each one provide a very specific set of rule.
AllSigned
Run only scripts that have been signed with an SSL Certificate. The Certificate can be self-signed as well.
Bypass
It's not block anything. You cam run any script in the computer.
Default
The Default Policy for Windows 10,11 is Restricted and for the Windows Servers RemoteSigned
Restricted
With this Policy you can run individual commands but not a script.
RemoteSigned
It's the default policy of the Windows Servers. You can run a script that it's created local. However any script that it's downloaded from the internet must be digital signed to run it.
Undefined
It's not applied any policy for the current scope.
Unrestricted
You can run a PowerShell Script without any policy but you will get a warning message
Types of Execution Policy Scopes
We are saw the 7 execution Policies. Let's see the scopes that we can apply the execution policies.
There are 5 execution Policy Scopes
MachinePolicy
You can apply MachinePolicy via GroupPolicy for all users in the Computer.
UserPolicy
You can apply UserPolicy via GroupPolicy for the current user in the Computer.
Process
Applies to the PowerShell session that it's open. When you will close the PowerShell session the Policy deleted
CurrentUser
Applies to the current user of the Computer
LocalMachine
Applies in all users of the computer and store settings in registry HKEY_LOCAL_MACHINE
How List all the Execution Policy Scopes
If you would like to see all the Execution Policies you can use the command
Get-ExecutionPolicy -List
How List the current Execution Policy
If you want to see the PowerShell execution policy that it's applied in the computer you can type
Get-ExecutionPolicy
How to change the Execution Policy
Let's try to change the current execution policy with the Set-ExecutionPolicy
Set-ExecutionPolicy Unrestricted
We can change the execution policy for a specific Scope as well. Let's change the execution policy for the Scope CurrentUser to AllSigned
Set-ExecutionPolicy AllSigned -Scope CurrentUser
Now we will list the current execution policy for the Currentuser and the LocalMachine. As you can see is different
How to Bypass the Execution Policy
If you have a specific reason you can bypass the execution policy when you run a script. However, because it's not secure to leave the execution policy in Bypass you can use the following command to run set the execution policy in Bypass only for the specific PowerShell session.
So when you will close the PowerShell session the execution policy will be deleted and it will not applied in a new PowerShell Session.
Set-ExecutionPolicy Bypass -Scope Process
How to apply the Execution Policy through Group Policy
If you have lot of Computers and Servers that you should apply specific Execution Policy you can deploy it through Group Policy.
-
Login to your Domain Controller
- Open the Group Policy Management
- Go to the Computer Configuration - - Windows Components - Windows PowerShell
- From the right side open the Properties of the Turn on Script Execution.
- Check the Enable, and select one of the 3 avaialable options.
- Allow only signed Scripts (AllSigned)
- Allow local scripts and remote signed scripts (RemoteSigned)
- Allow all scripts (Unrestricted)
- When you will select the Execution Policy that you need then click OK.
That's it !!!
PowerShell execution policies is a gatekeeper of the scripts. It's not a security pillar of your environemnt. However you can increase your security level with a few changes in PowerShell and reduce the chance of your system being compromised from a malicious code.