PowerShell: running scripts is disabled
Documentation: Microsoft Learn
Check execution-policy scopes, script signatures and downloaded-file marks when a PowerShell script is blocked.
What it means
PowerShell resolved the script path and then declined to run the file. The execution policy in effect for this session does not permit script files from this source. No code inside the file was executed.
Likely causes
- The effective policy is Restricted, which is the shipped default on Windows client editions
- The file arrived from the internet or a network share and carries a Zone.Identifier mark of the web, which RemoteSigned rejects for unsigned scripts
- A Group Policy setting at MachinePolicy or UserPolicy scope overrides whatever you set at CurrentUser scope
- The script is signed under AllSigned but the signing certificate is not trusted on this machine
Check
Run these checks before changing anything.
What these checks establish
Compare all scopes and the effective policy. A Zone.Identifier check concerns downloaded-file marking on Windows; its absence does not establish that every policy or application-control requirement is satisfied.
Fix
Use the exact error to distinguish policy, signature and application-control requirements. Review a downloaded file before removing its zone marker. A CurrentUser change cannot override MachinePolicy or UserPolicy. If a trusted signature is required, obtain the approved signed artifact and validate that signature.
Verify: Retry the approved artifact under the intended identity and effective policy. Confirm the original restriction is resolved without bypassing a different control.
