Security feature that prevents execution of malicious scripts.
They are not meant to restrict user actions, as a user can easily bypass the policy by typing the script directly in PowerShell, invoking the script or specifying the script as a command.
The execution policy can be viewed with the Get-ExecutionPolicy command.
Types
| Policy | Description |
|---|---|
| AllSigned | All scripts can run, but a trusted publisher must sign scripts and configuration files. |
| This includes both remote and local scripts. | |
| We receive a prompt before running scripts signed by publishers that we have not yet listed as either trusted or untrusted. | |
| Bypass | No scripts or configuration files are blocked, and the user receives no warnings or prompts. |
| Default | This sets the default execution policy. |
Restricted for Windows desktop machines and RemoteSigned for Windows servers. | |
| RemoteSigned | Scripts can run but requires a digital signature on scripts that are downloaded from the internet. |
| Digital signatures are not required for scripts that are written locally. | |
| Restricted | This allows individual commands but does not allow scripts to be run. |
| All script file types, including configuration files (.psxml), module script files (.psm1), and PowerShell profiles (.ps1) are blocked. | |
| Undefined | No execution policy is set for the current scope. |
If the execution policy for ALL scopes is set to undefined, then the default execution policy of Restricted will be used. | |
| Unrestricted | This is the default execution policy for non-Windows computers, and it cannot be changed. |
| This policy allows for unsigned scripts to be run but warns the user before running scripts that are not from the local intranet zone. |