PowerShell execution policy in Learn PowerShell Scripting in a Month of Lunches, Second Edition: Write and organize scripts and tools

Q: How deeply does Learn PowerShell Scripting in a Month of Lunches, Second Edition: Write and organize scripts and tools cover PowerShell execution policy?

Explains policy values, scope precedence, inspection, modification, and limitations, but defers detailed script-signing mechanics.

A PowerShell execution policy is a control that restricts whether PowerShell scripts are permitted to run.

PowerShell execution policy controls whether script files such as .ps1 and .psm1 may run. It is a practical guard against accidental execution, not a security boundary: an intentional user can start PowerShell with a bypass setting. section 7.2 section 7.2.1

Check the effective policy before running scripts, then choose the narrowest operational setting that fits:

Run Get-ExecutionPolicy to see the policy the current shell obeys; use Get-ExecutionPolicy -List to inspect every scope. section 7.2.2
Use Restricted to block scripts, RemoteSigned to allow local scripts while requiring signatures for scripts marked as remote, or AllSigned to require trusted signatures. section 7.2 section 7.5
Use Set-ExecutionPolicy -ExecutionPolicy RemoteSigned for a machine-level change when appropriate; changing LocalMachine normally requires an elevated shell. section 7.2.3
Prefer Group Policy for organization-wide settings, and modify only desktops or centralized management servers that need to run scripts; leave most servers Restricted. section 7.2 section 21.3

Diagnose a blocked script

If C:\work\test.ps1 reports that script execution is disabled, run Get-ExecutionPolicy -List to locate the effective restriction. If LocalMachine is Restricted and you control that setting, open PowerShell as Administrator and set an approved policy such as RemoteSigned. Group Policy–managed settings require Group Policy instead. section 7.2.2 section 7.2.3

Table 7.1 Execution policies (view table figure)

Policy	Description
`Restricted`	This is the default setting for Windows clients. It means no PowerShell script files will be executed, including profile scripts.
`AllSigned`	This requires any PowerShell script file containing a valid digital signature from a code-signing certificate issued by a trusted certificate authority. We’ll cover script signing in chapter 21.
`RemoteSigned`	PowerShell will run any script created locally, signed or not, but will require any other script to be digitally signed. This is the default server setting starting with Windows Server 2012 R2.
`Unrestricted`	PowerShell will run any script with very few questions asked. You might get a prompt when running a script that PowerShell detects as something downloaded from outside your machine. This is the default setting for UNIX and Linux.
`Bypass`	PowerShell will run anything with no questions asked. This policy implies that you’ve taken your steps to ensure script safety and integrity.
`Undefined`	No execution policy can be found. PowerShell will move down the scope list and use the first effective policy it finds. We’ll discuss this further in a moment.

Compare Restricted, AllSigned, RemoteSigned, Unrestricted, and Bypass when selecting a policy for a particular environment. section 7.2

How Learn PowerShell Scripting in a Month of Lunches, Second Edition: Write and organize scripts and tools covers it

Also explained in

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Learn PowerShell Scripting in a Month of Lunches, Second Edition: Write and organize scripts and tools. The section links point to the parts of the book it draws on.