CmdID / PowerShell / Cmdlets / Set
Set-ExecutionPolicy
Sets the PowerShell execution policies for Windows computers. PowerShell reference
From the PowerShell reference 5 parameters
What it does
Sets the PowerShell execution policies for Windows computers. The Set-ExecutionPolicy cmdlet changes PowerShell execution policies for Windows computers. For more information, see about_Execution_Policies. An execution policy is part of the PowerShell security strategy. Execution policies determine whether you can load configuration files, such as your PowerShell profile, or run scripts. And, whether scripts must be digitally signed. The Set-ExecutionPolicy cmdlet's default scope is LocalMachine, which affects everyone who uses the computer. To change the execution policy for LocalMachine, start PowerShell with Run as Administrator. To display the execution policies for each scope, use Get-ExecutionPolicy -List. To see the effective execution policy for your PowerShell session use Get-ExecutionPolicy with no parameters. NOTE: The Execution Policy can also be set by Group Policy. If a Group Policy is set, it overrides the execution policy set locally. Windows PowerShell 5.1 and PowerShell 6.0 and higher store the execution policy setting in different locations and are managed separately. The settings for Windows PowerShell (powershell.exe) don't affect PowerShell (pwsh.exe).
Set-ExecutionPolicy [-ExecutionPolicy] <ExecutionPolicy> [[-Scope] <ExecutionPolicyScope>] [-Force] [-WhatIf] [-Confirm] [<CommonParameters>]Set an execution policy
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine
Get-ExecutionPolicy -ListIdentifySet an execution policy that conflicts with a Group Policy
PS> Set-ExecutionPolicy -ExecutionPolicy Restricted -Scope LocalMachine
Set-ExecutionPolicy : PowerShell updated your local preference successfully, but the setting is
overridden by the Group Policy applied to your system. Due to the override, your shell will retain
its current effective execution policy of "AllSigned". Contact your Group Policy administrator for
more information. At line:1 char:20 + Set-ExecutionPolicy <<<< restrictedIdentifyApply the execution policy from a remote computer to a local computer
Invoke-Command -ComputerName Server01 -ScriptBlock { Get-ExecutionPolicy } | Set-ExecutionPolicyIdentifySet the scope for an execution policy
Set-ExecutionPolicy -ExecutionPolicy AllSigned -Scope CurrentUser
Get-ExecutionPolicy -ListIdentifyRemove the execution policy for the current user
Set-ExecutionPolicy -ExecutionPolicy Undefined -Scope CurrentUser
Get-ExecutionPolicy -ListIdentifySet the execution policy for the current PowerShell session
Set-ExecutionPolicy -ExecutionPolicy AllSigned -Scope ProcessIdentifyUnblock a script to run it without changing the execution policy
PS> Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine
PS> Get-ExecutionPolicy
RemoteSigned
PS> .\Start-ActivityTracker.ps1
.\Start-ActivityTracker.ps1 : File .\Start-ActivityTracker.ps1 cannot be loaded.
The file .\Start-ActivityTracker.ps1 is not digitally signed.
The script will not execute on the system.
For more information, see about_Execution_Policies at https://go.microsoft.com/fwlink/?LinkID=135170.
At line:1 char:1
+ .\Start-ActivityTracker.ps1
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], PSSecurityException
+ FullyQualifiedErrorId : UnauthorizedAccess
PS> Unblock-File -Path .\Start-ActivityTracker.ps1
PS> Get-ExecutionPolicy
RemoteSigned
PS> .\Start-ActivityTracker.ps1
Task 1:IdentifyIts page in the reference: Set-ExecutionPolicy.
Parameters
-ExecutionPolicySpecifies the execution policy. If there are no Group Policies and each scope's execution policy is set to Undefined, then Restricted becomes the effective policy for all users.
The acceptable execution policy values are as follows:
- AllSigned. Requires that all scripts and configuration files are signed by a trusted publisher,
including scripts written on the local computer.
- Bypass. Nothing is blocked and there are no warnings or prompts.
- Default. Sets the default execution policy. Restricted for Windows clients or RemoteSigned
for Windows servers.
- RemoteSigned. Requires that all scripts and configuration files downloaded from the Internet
are signed by a trusted publisher. The default execution policy for Windows server computers.
- Restricted. Doesn't load configuration files or run scripts. The default execution policy for
Windows client computers.
- Undefined. No execution policy is set for the scope. Removes an assigned execution policy from
a scope that is not set by a Group Policy. If the execution policy in all scopes is Undefined,
the effective execution policy is Restricted.
- Unrestricted. Loads all configuration files and runs all scripts. …-ForceSuppresses all the confirmation prompts. Use caution with this parameter to avoid unexpected results.-ScopeSpecifies the scope that's affected by an execution policy. The default scope is LocalMachine. The parameter accepts the following values:
- MachinePolicy - Set by a Group Policy for all users of the computer
- UserPolicy - Set by a Group Policy for the current user of the computer
- Process - Affects only the current PowerShell session
- CurrentUser - Affects only the current user
- LocalMachine - Default scope that affects all users of the computer
NOTE: MachinePolicy and UserPolicy are set by Group Policies. If you try to set the scope to one of these values, PowerShell displays an error message that the scope is set by a Group Policy and can't be changed.
If the Execution Policy isn't defined by Group Policy, the effective execution policy is determined by the order of precedence as follows:
- Process - Highest precedence
- CurrentUser - Second highest precedence
- LocalMachine - Lowest precedence
See the NOTES section for more information about how PowerShell stores execution policies.-ConfirmPrompts you for confirmation before running the cmdlet.-WhatIfShows what would happen if the cmdlet runs. The cmdlet isn't run.