Privacy and Security Change PowerShell Script Execution Policy in Windows 11


PS1_banner.png

This tutorial will show you different ways on how to set the PowerShell script execution policy for the current user, local machine, or current process in Windows 10 and Windows 11.

PowerShell's execution policy is a safety feature that controls the conditions under which PowerShell loads configuration files and runs scripts. This feature helps prevent the execution of malicious scripts.

On a Windows computer you can set an execution policy for the local computer, for the current user, or for a particular session. You can also use a Group Policy setting to set execution policies for computers and users.

Execution policies for the local computer and current user are stored in the registry. You don't need to set execution policies in your PowerShell profile. The execution policy for a particular session is stored only in memory and is lost when the session is closed.

The execution policy isn't a security system that restricts user actions. For example, users can easily bypass a policy by typing the script contents at the command line when they cannot run a script. Instead, the execution policy helps users to set basic rules and prevents them from violating them unintentionally.

Enforcement of these policies only occurs on Windows platforms. The PowerShell execution policies are as follows:

Execution Policy​
Description​
AllSigned
  • Scripts can run.
  • Requires that all scripts and configuration files be signed by a trusted publisher, including scripts that you write on the local computer.
  • Prompts you before running scripts from publishers that you haven't yet classified as trusted or untrusted.
  • Risks running signed, but malicious, scripts.
Bypass
  • Nothing is blocked and there are no warnings or prompts.
  • This execution policy is designed for configurations in which a PowerShell script is built in to a larger application or for configurations in which PowerShell is the foundation for a program that has its own security model.
Default
  • Sets the default execution policy.
  • Restricted for Windows clients.
  • RemoteSigned for Windows servers.
RemoteSigned
  • The default execution policy for Windows server computers.
  • Scripts can run.
  • Requires a digital signature from a trusted publisher on scripts and configuration files that are downloaded from the internet which includes email and instant messaging programs.
  • Doesn't require digital signatures on scripts that are written on the local computer and not downloaded from the internet.
  • Runs scripts that are downloaded from the internet and not signed, if the scripts are unblocked, such as by using the Unblock-File cmdlet.
  • Risks running unsigned scripts from sources other than the internet and signed scripts that could be malicious.
Restricted
  • The default execution policy for Windows client computers.
  • Permits individual commands, but does not allow scripts.
  • Prevents running of all script files, including formatting and configuration files (.ps1xml), module script files (.psm1), and PowerShell profiles (.ps1).
Undefinded
  • There is no execution policy set in the current scope.
  • If the execution policy in all scopes is Undefined, the effective execution policy is Restricted for Windows clients and RemoteSigned for Windows Server.
Unrestricted
  • The default execution policy for non-Windows computers and cannot be changed.
  • Unsigned scripts can run. There is a risk of running malicious scripts.
  • Warns the user before running scripts and configuration files that are not from the local intranet zone.

You can set an execution policy that is effective only in a particular scope.

The valid values for Scope are MachinePolicy, UserPolicy, Process, CurrentUser, and LocalMachine. LocalMachine is the default when setting an execution policy.

The Scope values are listed in precedence order. The policy that takes precedence is effective in the current session, even if a more restrictive policy was set at a lower level of precedence.

Scope​
Description​
MachinePolicySet by a Group Policy for all users of the computer. Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > "Turn on Script Execution"
UserPolicySet by a Group Policy for the current user of the computer. User Configuration > Administrative Templates > Windows Components > Windows PowerShell > "Turn on Script Execution"
ProcessThe Process scope only affects the current PowerShell session. The execution policy is saved in the environment variable $env:PSExecutionPolicyPreference, rather than the registry. When the PowerShell session is closed, the variable and value are deleted.
CurrentUserThe execution policy affects only the current user. It's stored in the HKEY_CURRENT_USER registry subkey.
LocalMachineThe execution policy affects all users on the current computer. It's stored in the HKEY_LOCAL_MACHINE registry subkey.

Reference:
learn.microsoft.com

about_Execution_Policies - PowerShell

Describes the PowerShell execution policies and explains how to manage them.
learn.microsoft.com

If you set the execution policy for the scopes LocalMachine or the CurrentUser, the change is saved in the registry and remains effective until you change it again.

If you set the execution policy for the Process scope, it's not saved in the registry. The execution policy is retained until the current process and any child processes are closed.


Contents

  • Option One: See All Current PowerShell Script Execution Policies
  • Option Two: Set PowerShell Script Execution Policy to "RemoteSigned" or "Restricted" for Current User in Settings
  • Option Three: Set PowerShell Script Execution Policy for Current User in PowerShell
  • Option Four: Set PowerShell Script Execution Policy for Current User using REG file
  • Option Five: Set PowerShell Script Execution Policy for Local Machine in PowerShell
  • Option Six: Set PowerShell Script Execution Policy for Local Machine using REG file
  • Option Seven: Set PowerShell Script Execution Policy for Process in PowerShell




Option One

See All Current PowerShell Script Execution Policies


1 Open Windows Terminal, and select Windows PowerShell.

2 Copy and paste the command below into Windows Terminal, and press Enter. (see screenshot below)

Get-ExecutionPolicy -List​

3 You will now see all execution policies listed in precedence order.

Get-ExecutionPolicy-List.png





Option Two

Set PowerShell Script Execution Policy to "RemoteSigned" or "Restricted" for Current User in Settings


1 Open Settings (Win+I).

2 Click/tap on Privacy & security on the left side, and click/tap on For developers on the right side. (see screenshot below)

Starting with Windows 11 version 22H2 KB5030310 Build 22621.2361, For developers is now in Settings > System.



PowerShell_script_execution_policy_Settings-1.png

3 Click/tap on PowerShell to expand it open. (see screenshot below step 4)

4 Turn On (RemoteSigned) or Off (default - Restricted) Change execution policy to allow local PowerShell scripts to run without signing. Require signing for remote scripts for what you want. (see screenshot below)

PowerShell_script_execution_policy_Settings-2.png

5 You can now close Settings if you like.




Option Three

Set PowerShell Script Execution Policy for Current User in PowerShell


1 Open Windows Terminal, and select Windows PowerShell.

2 Copy and paste the command below for the execution policy your want to set into Windows Terminal, and press Enter. (see screenshot below)

AllSigned: Set-ExecutionPolicy AllSigned -Scope CurrentUser -Force​

Bypass: Set-ExecutionPolicy Bypass -Scope CurrentUser -Force​

Default: Set-ExecutionPolicy Default -Scope CurrentUser -Force​

RemoteSigned: Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -Force​

Restricted: Set-ExecutionPolicy Restricted -Scope CurrentUser -Force​

Undefined: Set-ExecutionPolicy Undefined -Scope CurrentUser -Force​

Unrestricted: Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force​

3 You can now close Windows Terminal if you like.

PowerShell_execution_policy_for_CurrentUser_command.png





Option Four

Set PowerShell Script Execution Policy for Current User using REG file


1 Do step 2 (Restricted), step 3 (AllSigned), step 4 (RemoteSigned), step 5 (Unrestricted), step 6 (Bypass), or step 7 (Undefined) below for what you would like to do.


 2. Set PowerShell Script Execution Policy to "Restricted" for Current User

A) Click/tap on the Download button below to download the file below, and go to step 8 below.​

CurrentUser_Restricted_PowerShell_ExcutionPolicy.reg​


(Contents of REG file for reference)
Code: 
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell]
"ExecutionPolicy"="Restricted"


 3. Set PowerShell Script Execution Policy to "AllSigned" for Current User

A) Click/tap on the Download button below to download the file below, and go to step 8 below.​

CurrentUser_AllSigned_PowerShell_ExcutionPolicy.reg​


(Contents of REG file for reference)

Code: 
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell]
"ExecutionPolicy"="AllSigned"


 4. Set PowerShell Script Execution Policy to "RemoteSigned" for Current User

A) Click/tap on the Download button below to download the file below, and go to step 8 below.​

CurrentUser_RemoteSigned_PowerShell_ExcutionPolicy.reg​


(Contents of REG file for reference)

Code: 
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell]
"ExecutionPolicy"="RemoteSigned"


 5. Set PowerShell Script Execution Policy to "Unrestricted" for Current User

A) Click/tap on the Download button below to download the file below, and go to step 8 below.​

CurrentUser_Unrestricted_PowerShell_ExcutionPolicy.reg​


(Contents of REG file for reference)

Code: 
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell]
"ExecutionPolicy"="Unrestricted"


 6. Set PowerShell Script Execution Policy to "Bypass" for Current User

A) Click/tap on the Download button below to download the file below, and go to step 8 below.​

CurrentUser_Bypass_PowerShell_ExcutionPolicy.reg​


(Contents of REG file for reference)

Code: 
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell]
"ExecutionPolicy"="Bypass"


 7. Set PowerShell Script Execution Policy to "Undefined" for Current User

This is the default setting.


A) Click/tap on the Download button below to download the file below, and go to step 8 below.​

CurrentUser_Undefined_PowerShell_ExcutionPolicy.reg​


(Contents of REG file for reference)
Code: 
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell]
"ExecutionPolicy"=-

8 Save the .reg file to your desktop.

9 Double click/tap on the downloaded .reg file to merge it.

10 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

11 You can now delete the downloaded .reg file if you like.




Option Five

Set PowerShell Script Execution Policy for Local Machine in PowerShell


You must be signed in as an administrator to use this option.

If you get a message in red like below when setting a PowerShell execution policy, then it just means that your (current user) set execution policy will be used instead of this local machine setting. If you like, you can set your (current user) execution policy to Undefined to no longer see this message in red when setting the local machine policy.

message.png


1 Open Windows Terminal (Admin), and select Windows PowerShell.

2 Copy and paste the command below for the execution policy your want to set into Windows Terminal, and press Enter. (see screenshot below)

AllSigned: Set-ExecutionPolicy AllSigned -Scope LocalMachine -Force​

Bypass: Set-ExecutionPolicy Bypass -Scope LocalMachine -Force​

Default: Set-ExecutionPolicy Default -Scope LocalMachine -Force​

RemoteSigned: Set-ExecutionPolicy RemoteSigned -Scope LocalMachine -Force​

Restricted: Set-ExecutionPolicy Restricted -Scope LocalMachine -Force​

Undefined: Set-ExecutionPolicy Undefined -Scope LocalMachine -Force​

Unrestricted: Set-ExecutionPolicy Unrestricted -Scope LocalMachine -Force​

3 You can now close Windows Terminal (Admin) if you like.

PowerShell_execution_policy_for_LocalMachine_command.png





Option Six

Set PowerShell Script Execution Policy for Local Machine using REG file


1 Do step 2 (Restricted), step 3 (AllSigned), step 4 (RemoteSigned), step 5 (Unrestricted), step 6 (Bypass), or step 7 (Undefined) below for what you would like to do.


 2. Set PowerShell Script Execution Policy to "Restricted" for Local Machine

A) Click/tap on the Download button below to download the file below, and go to step 8 below.​

LocalMachine_Restricted_PowerShell_ExcutionPolicy.reg​


(Contents of REG file for reference)
Code: 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell]
"ExecutionPolicy"="Restricted"


 3. Set PowerShell Script Execution Policy to "AllSigned" for Local Machine

A) Click/tap on the Download button below to download the file below, and go to step 8 below.​

LocalMachine_AllSigned_PowerShell_ExcutionPolicy.reg​


(Contents of REG file for reference)

Code: 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell]
"ExecutionPolicy"="AllSigned"


 4. Set PowerShell Script Execution Policy to "RemoteSigned" for Local Machine

A) Click/tap on the Download button below to download the file below, and go to step 8 below.​

LocalMachine_RemoteSigned_PowerShell_ExcutionPolicy.reg​


(Contents of REG file for reference)

Code: 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell]
"ExecutionPolicy"="RemoteSigned"


 5. Set PowerShell Script Execution Policy to "Unrestricted" for Local Machine

A) Click/tap on the Download button below to download the file below, and go to step 8 below.​

LocalMachine_Unrestricted_PowerShell_ExcutionPolicy.reg​


(Contents of REG file for reference)

Code: 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell]
"ExecutionPolicy"="Unrestricted"


 6. Set PowerShell Script Execution Policy to "Bypass" for Local Machine

A) Click/tap on the Download button below to download the file below, and go to step 8 below.​

LocalMachine_Bypass_PowerShell_ExcutionPolicy.reg​


(Contents of REG file for reference)

Code: 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell]
"ExecutionPolicy"="Bypass"


 7. Set PowerShell Script Execution Policy to "Undefined" for Local Machine

This is the default setting.


A) Click/tap on the Download button below to download the file below, and go to step 8 below.​

LocalMachine_Undefined_PowerShell_ExcutionPolicy.reg​


(Contents of REG file for reference)
Code: 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell]
"ExecutionPolicy"=-

8 Save the .reg file to your desktop.

9 Double click/tap on the downloaded .reg file to merge it.

10 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

11 You can now delete the downloaded .reg file if you like.




Option Seven

Set PowerShell Script Execution Policy for Process in PowerShell


The execution policy set using this option only affects the current PowerShell session for the current process until you close the current PowerShell window.


1 Open Windows Terminal, and select Windows PowerShell.

2 Copy and paste the command below for the execution policy your want to set into Windows Terminal, and press Enter. (see screenshot below)

AllSigned: Set-ExecutionPolicy AllSigned -Scope Process -Force​

Bypass: Set-ExecutionPolicy Bypass -Scope Process -Force​

Default: Set-ExecutionPolicy Default -Scope Process -Force​

RemoteSigned: Set-ExecutionPolicy RemoteSigned -Scope Process -Force​

Restricted: Set-ExecutionPolicy Restricted -Scope Process -Force​

Undefined: Set-ExecutionPolicy Undefined -Scope Process -Force​

Unrestricted: Set-ExecutionPolicy Unrestricted -Scope Process -Force​

3 You can now close Windows Terminal if you like.

PowerShell_execution_policy_for_Process_command.png



That's it,
Shawn Brink


Related Tutorials

 

Attachments

Last edited:
Click to expand...
Now we need a tutorial, how to restrict PowerShell to Constrained Language mode. :wink:
teamt5.org

A Deep Dive into PowerShell's Constrained Language Mode - TeamT5

## What is Constrained Language Mode and Why it Matters When PowerShell was [first announced in 2006](https://betanews.com/2006/11/14/windows-powershell-1-0-released/), it was meant to be a flexible command-line shell that features an easy-to-understand yet advanced scripting engine for IT...
teamt5.org teamt5.org

Powershell Constrained Language Mode Bypass - Red Team Notes

Understanding ConstrainedLanguageMode
www.ired.team www.ired.team
Code: 
reg add "HKLM\System\CurrentControlSet\Control\Session Manager\Environment" /v "__PSLockDownPolicy" /t REG_SZ /d "4" /f
 

My Computer

System One

  • OS
    Windows 11 Home
    Computer type
    PC/Desktop
    CPU
    AMD Ryzen 5 8600G (07/24)
    Motherboard
    ASROCK B650M-HDV/M.2 3.18 (07/24)
    Memory
    2x32GB Kingston FURY DDR5 5600 MHz CL36 @4800 CL40 (07/24)
    Graphics Card(s)
    ASROCK Radeon RX 6600 Challenger D 8G @60FPS (08/24)
    Sound Card
    Creative Sound BlasterX AE-5 Plus (05/24)
    Monitor(s) Displays
    24" Philips 24M1N3200ZS/00 (05/24)
    Screen Resolution
    1920×1080@165Hz via DP1.4
    Hard Drives
    Kingston KC3000 NVMe 2TB (05/24)
    ADATA XPG GAMMIX S11 Pro 512GB (07/19)
    PSU
    Seasonic Core GM 550 Gold (04/24)
    Case
    Fractal Design Define 7 Mini with 3x Noctua NF-P14s/12@555rpm (04/24)
    Cooling
    Noctua NH-U12S with Noctua NF-P12 (04/24)
    Keyboard
    HP Pavilion Wired Keyboard 300 (07/24) + Rabalux 76017 Parker (01/24)
    Mouse
    Logitech M330 Silent Plus (04/23)
    Internet Speed
    500/100 Mbps via RouterOS (05/21) & TCP Optimizer
    Browser
    Edge & Brave for YouTube & LibreWolf for FB
    Antivirus
    NextDNS blocking 99% TLDs
    Other Info
    Backup: Hasleo Backup Suite (PreOS)
    Headphones: Sennheiser RS170 (09/10)
    Phone: Samsung Galaxy Xcover 7 (02/24)
    Chair: Huzaro Force 4.4 Grey Mesh (05/24)
    Notifier: Xiaomi Mi Band 9 Milanese (10/24)
    2nd Monitor: AOC G2460VQ6 @75Hz (02/19)
hi
i guess the default is , isn't it?
this
Code: 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\ScriptedDiagnostics]
"ExecutionPolicy"="Unrestricted"
 

My Computer

System One

  • OS
    Windows 11 pro 64bit
Drugo said:
hi
i guess the default is , isn't it?
this
Code: 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\ScriptedDiagnostics]
"ExecutionPolicy"="Unrestricted"
Click to expand...

The default is "undefined" or "default". Either one.

It just depends on which policy you want to use though.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro for Workstations
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom self build
    CPU
    Intel i7-8700K 5 GHz
    Motherboard
    ASUS ROG Maximus XI Formula Z390
    Memory
    64 GB (4x16GB) G.SKILL TridentZ RGB DDR4 3600 MHz (F4-3600C18D-32GTZR)
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING (11GB GDDR5X)
    Sound Card
    Integrated Digital Audio (S/PDIF)
    Monitor(s) Displays
    2 x Samsung Odyssey G75 27"
    Screen Resolution
    2560x1440
    Hard Drives
    1TB Samsung 990 PRO M.2,
    4TB Samsung 990 PRO M.2,
    8TB WD MyCloudEX2Ultra NAS
    PSU
    Seasonic Prime Titanium 850W
    Case
    Thermaltake Core P3 wall mounted
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master 3
    Internet Speed
    1 Gbps Download and 35 Mbps Upload
    Browser
    Google Chrome
    Antivirus
    Microsoft Defender and Malwarebytes Premium
    Other Info
    Logitech Z625 speaker system,
    Logitech BRIO 4K Pro webcam,
    HP Color LaserJet Pro MFP M477fdn,
    CyberPower CP1500PFCLCD
    Galaxy S23 Plus phone
  • Operating System
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Surface Laptop 7 Copilot+ PC
    CPU
    Snapdragon X Elite (12 core) 3.42 GHz
    Memory
    16 GB LPDDR5x-7467 MHz
    Monitor(s) Displays
    15" HDR
    Screen Resolution
    2496 x 1664
    Hard Drives
    1 TB SSD
    Internet Speed
    Wi-Fi 7 and Bluetooth 5.4
    Browser
    Chrome and Edge
    Antivirus
    Windows Defender
You must log in or register to reply here.

Similar Windows 11 Tutorials

  • Article Article
Personalization Add "Edit or Run with" to PS1 File Context Menu in Windows 11
Replies
0
Views
6K
Brink
Brink
  • Article Article
Accounts Add Run as administrator to Context Menu of PS1 Files in Windows 11
Replies
0
Views
11K
Brink
Brink
  • Article Article
System Change Power Plan Settings in Windows 11
Replies
3
Views
45K
Try3
Try3
  • Article Article
Accounts Add Change Owner to Context Menu in Windows 11
Replies
10
Views
11K
Brink
Brink
  • Article Article
System Change Power Button Action in Windows 11
Replies
1
Views
56K
Brink
Brink
  • Article Article
System Change Power Plan in Windows 11
Replies
4
Views
105K
Brink
Brink
  • Article Article
System Change Lid Close Action in Windows 11
Replies
1
Views
125K
Brink
Brink

Latest Support Threads

Latest Tutorials

Back
Top Bottom