PowerShell Execution Policy

A PowerShell execution policy is a safety control that determines the conditions under which PowerShell loads configuration profiles and executes script files. Execution policies are designed to prevent administrators from unintentionally running untrusted scripts; they are administrative guardrails rather than strict security boundaries, as users can bypass them through command-line parameters or process-level switches.

Execution Policy Levels

PowerShell defines six distinct execution policy levels that control how local and remote scripts are handled:

$effectivePolicy = Get-ExecutionPolicy

Write-Output "Effective Execution Policy: $effectivePolicy"

Effective Execution Policy: RemoteSigned

How PowerShell Determines "Downloaded"

A file is considered "downloaded from the internet" based on its Zone.Identifier alternate data stream (also known as the Mark of the Web, or MotW), which Windows attaches automatically to files saved by a browser or email client.

Get-Item -Path "C:\Scripts\tool.ps1" -Stream Zone.Identifier

FileName: C:\Scripts\tool.ps1
Stream                   Length
------                   ------
Zone.Identifier             26

Under a RemoteSigned execution policy, PowerShell checks for this stream. If present and the file lacks a valid Authenticode digital signature, PowerShell halts execution with an unauthorized access error.

File C:\Scripts\Deploy.ps1 cannot be loaded. The file C:\Scripts\Deploy.ps1 is not 
digitally signed. You cannot run this script on the current system.

Scopes and Evaluation Precedence

PowerShell determines the effective execution policy by evaluating five hierarchical scopes. The policy configured at the highest-precedence scope overrides all scopes below it.

Get-ExecutionPolicy -List

        Scope ExecutionPolicy
        ----- ---------------
MachinePolicy       Undefined
   UserPolicy       Undefined
      Process          Bypass
  CurrentUser    RemoteSigned
 LocalMachine      Restricted

Precedence Hierarchy (Highest to Lowest)

1. MachinePolicy: Set via Active Directory Group Policy (Computer Configuration). Overrides all other settings; stored in registry under HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell.
2. UserPolicy: Set via Active Directory Group Policy (User Configuration). Overrides local machine configurations; stored in HKCU:\SOFTWARE\Policies\Microsoft\Windows\PowerShell.
3. Process: Scoped only to the current PowerShell process instance ($env:PSExecutionPolicyPreference). Reverts to default once the session closes.
4. CurrentUser: Applied to the logged-in user profile; stored in HKCU:\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell. Requires no administrative rights to change.
5. LocalMachine: Applied globally to all users on the computer; stored in HKLM:\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell. Requires an elevated administrator session to modify.

Setting Execution Policy with Set-ExecutionPolicy

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

where:

• -ExecutionPolicy is the policy level to apply.
• -Scope is the scope to apply it at (defaults to LocalMachine if omitted, which requires admin rights).

Setting Policy for a Single Session Only

Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process

Complete User Scope Example

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser -Force

Get-ExecutionPolicy -Scope CurrentUser

RemoteSigned

Bypassing Execution Policy

Rather than changing the persistent policy, you can override it for a single script invocation or session.

Command-Line Invocation Bypass

powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Scripts\deploy.ps1"

where:

• -NoProfile skips loading PowerShell profile files, speeding up startup and avoiding interference from custom user settings.
• -ExecutionPolicy Bypass overrides the system execution policy strictly for the lifetime of the spawned process, without modifying any stored setting.
• -File specifies the target script to execute.

In-Session Process Elevation

$previousPolicy = Get-ExecutionPolicy -Scope Process

Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process -Force
Write-Output "Process execution policy set to: $(Get-ExecutionPolicy)"

& ".\Deploy.ps1"

Set-ExecutionPolicy -ExecutionPolicy $previousPolicy -Scope Process -Force
Write-Output "Process execution policy reverted to: $(Get-ExecutionPolicy)"

Process execution policy set to: Bypass
Deployment complete.
Process execution policy reverted to: RemoteSigned

Unblocking Downloaded Scripts with Unblock-File

Rather than changing the execution policy, a more targeted fix for a specific downloaded script is to remove its "downloaded from the internet" flag using Unblock-File. This removes the Zone.Identifier stream, marking the script as a trusted local file.

Get-Item -Path ".\Deploy.ps1" -Stream "Zone.Identifier" -ErrorAction SilentlyContinue

Unblock-File -Path ".\Deploy.ps1" -Verbose

Get-Item -Path ".\Deploy.ps1" -Stream "Zone.Identifier" -ErrorAction SilentlyContinue

FileName                   Stream                   Length
--------                   ------                   ------
C:\Scripts\Deploy.ps1      Zone.Identifier              68

VERBOSE: Performing the operation "Unblock-File" on target "C:\Scripts\Deploy.ps1".

Unblocking Multiple Files at Once

Get-ChildItem -Path "C:\Scripts" -Filter "*.ps1" -Recurse | Unblock-File

Practical Usage

Preparing a Downloaded Script Toolkit for Use

A common onboarding task is safely unblocking a set of downloaded automation scripts before distributing them to a team, verifying policy settings along the way.

param([string]$ToolkitPath)

Write-Output "Current execution policy (effective): $(Get-ExecutionPolicy)"

$blockedFiles = Get-ChildItem -Path $ToolkitPath -Filter "*.ps1" -Recurse |
    Where-Object { Get-Item -Path $_.FullName -Stream Zone.Identifier -ErrorAction SilentlyContinue }

if ($blockedFiles) {
    Write-Output "Unblocking $($blockedFiles.Count) script(s)..."
    $blockedFiles | Unblock-File
} else {
    Write-Output "No blocked scripts found."
}

Write-Output "Toolkit ready for use."

Current execution policy (effective): RemoteSigned
Unblocking 4 script(s)...
Toolkit ready for use.