Powershell Script Execution Policies
Tags: powershell, scripting, automation
Published: 2021-05-02 16:18:43

## Prerequisites  
Before learning the content in this post, you should be familiar with PowerShell scripting or should have attempted to run a Powershell script.

## What is Powershell Execution Policy?
Execution Policy for Powershell script restricts execution of a malicious script. 
When you run a powershell script on a Windows client computer, you get this error message - 
![Error while running script](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z1oceu3bpfiyi9t68xyh.png)

The error message says that running scripts on the system is not allowed. This prevents loading any unwanted script.
You can run the command "Get-ExecutionPolicy" to check the execution policy applied to the current session - 
![Get-ExecutionPolicy](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/g9twaf8pjcausyelugmz.png)

## Can you disable or bypass it?
If you want to run a script created on the local computer then obviously you would like to remove this restriction. This could be done by changing the execution policy to "bypass". You can run the command "Set-ExecutionPolicy Bypass". This will avoid blocking any script.
![Bypass Policy](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ewskaodtazxj9hkj7s8a.png)

## What are the types of policies?
There are 5 policies based on different conditions evaluated to restrict the execution of scripts. 
* RemoteSigned - If a script is downloaded from the internet then it must have a digital signature from a trusted publisher. Signature is not needed for scripts that are not downloaded from the internet such as locally created scripts.

* AllSigned - All scripts, including locally created scripts, must be signed by a trusted publisher

* Restricted - All scripts are blocked from running

* Unrestricted - All scripts can run. But shows a warning message while running scripts that are not from the Local intranet zone.

* ByPass - All scripts can run without any warning message.

The default execution policy is "Restricted" for Windows client, "RemoteSigned" for Windows Server, and "Unrestricted" for non-windows computer.

## How are policies applied?
Execution Policies are applied in the form of different scopes. There are 5 scopes -

* MachinePolicy - Execution policy is set through group policy setting for a computer and applied on all users who log onto that computer

* UserPolicy - Policy is set through group policy setting for the current user of the computer.

* Process - Policy is set through an environment variable $env:PSExecutionPolicyPreference. The policy affects only the current Powershell session.

* CurrentUser - Policy is set through this registry key - HKEY_CURRENT_USER\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell

* LocalMachine - Policy is set through this registry key - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell

If Policies are applied through group policy objects then the "Set-ExecutionPolicy" command cannot be used to change existing policy.

## What is the order for policy evaluation?
If multiple policies are applied then Powershell will evaluate policies in the same order of scopes as above. So, the MachinePolicy scope will take precedence. 

## How to check existing policies?
You can run the command "Get-ExecutionPolicy -List" to list policies applied at different scopes.
![List Policies](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sue7d3dior7l37hxsetm.png)