Execution Policies

PowerShell's execution policy is a safety feature that controls the conditions under which PowerShell loads configuration files and runs scripts. This feature helps prevent the execution of malicious scripts.

On a Windows computer you can set an execution policy for the local computer, for the current user, or for a particular session. You can also use a Group Policy setting to set execution policies for computers and users.

Execution policies for the local computer and current user are stored in the registry. You don't need to set execution policies in your PowerShell profile. The execution policy for a particular session is stored only in memory and is lost when the session is closed.

The execution policy isn't a security system that restricts user actions. For example, users can easily bypass a policy by typing the script contents at the command line when they cannot run a script. Instead, the execution policy helps users to set basic rules and prevents them from violating them unintentionally.

PowerShell execution policies

AllSigned

Requires that all scripts and configuration files be signed by a trusted publisher, including scripts that you write on the local computer.

Bypass

Nothing is blocked and there are no warnings or prompts.

Default

Sets the default execution policy.

Restricted for Windows clients.

RemoteSigned for Windows servers.

RemoteSigned

The default execution policy for Windows server computers.

Restricted

The default execution policy for Windows client computers.

Undefined

If the execution policy in all scopes is Undefined, the effective execution policy is Restricted for Windows clients and RemoteSigned for Windows Server..

Unrestricted

Warns the user before running scripts and configuration files that are not from the local intranet zone

Execution policy scope

You can set an execution policy that is effective only in a particular scope.

The valid values for Scope are MachinePolicy, UserPolicy, Process, CurrentUser, and LocalMachine. LocalMachine is the default when setting an execution policy.

Managing the execution policy with PowerShell

To get the effective execution policy for the current PowerShell session, use the Get-ExecutionPolicy cmdlet.

Get-ExecutionPolicy

To get all of the execution policies that affect the current session and display them in precedence order:

Get-ExecutionPolicy -List

Change the execution policy

To change the PowerShell execution policy on your Windows computer, use the Set-ExecutionPolicy cmdlet

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned

Remove the execution policy

To remove the execution policy for a particular scope, set the execution policy to Undefined.

Set-ExecutionPolicy -ExecutionPolicy Undefined -Scope LocalMachine