Execution Policy
Identify which policy applies before changing a setting or unblocking a script.
Documentation: Microsoft Learn
Overview
Execution policy controls when PowerShell loads scripts and configuration files. On Windows, several scopes can hold values. A CurrentUser change may have no effect when MachinePolicy or UserPolicy supplies the effective setting.
Start with Get-ExecutionPolicy -List and then Get-ExecutionPolicy for the effective value. Read the actual error: a policy restriction, an invalid signature, an application-control rule and a file permission failure do not have the same remedy.
Under RemoteSigned, an internet zone marker can matter for an unsigned downloaded script. Review its origin and content before using Unblock-File. That command removes the marker; it does not review the script or make its behavior safe.
Execution policy is not a security boundary or a replacement for permissions and application control. Use the organization’s intended policy and a signed release where required. A local setting cannot override a Group Policy requirement.
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
[pscustomobject]@{
Policy = 'RemoteSigned'
Meaning = 'local scripts run; downloaded scripts need a signature'
Scope = 'CurrentUser'
NotSecurity = 'it stops accidents, not attackers'
} | Format-List- Stage 1[pscustomobject]@{
Positional values or no named parameters - Stage 2Format-List
Positional values or no named parameters
What happens
Compare the listed scopes with the effective policy. If they differ from your expectation, explain precedence before attempting another change. For a signed script, inspect its signature status as a separate check.
Worth remembering
Diagnose the actual restriction and effective scope. Do not treat Bypass as a universal troubleshooting fix.
Check your understanding
There is no runnable lab on this page — these run in your own terminal, so predict the answer first, then verify.
Q1. You download a .ps1 file and PowerShell refuses with "cannot be loaded because running scripts is disabled". Which command shows the current policy, and what value do you most likely see on a fresh Windows client?
Answer: Get-ExecutionPolicy — and you most likely see Restricted, the default on Windows clients, which blocks all script files.
Q2. True or false: setting the policy to Unrestricted makes every script safe to run.
Answer: False — it only removes the block. A malicious script runs just as happily under Unrestricted; you still have to trust the script’s contents.
Q3. A blog tells you to run everything with -ExecutionPolicy Bypass "to avoid errors". Why is that advice dangerous?
Answer: Bypass skips every execution-policy check for that process — it silences the guard instead of answering it. Read the policy first, then change it deliberately with Set-ExecutionPolicy if you have a reason.
Primary documentation
Try it
Illustrative output · values vary by environment
Example reader
Inspect this page's example
Run supported commands against the practice data, or inspect the example without executing it.
Ready to inspect.
Prints what RemoteSigned means and what execution policy does not do.
Show reference output
Illustrative output · values vary by environment
Policy : RemoteSigned Meaning : local scripts run; downloaded scripts need a signature Scope : CurrentUser NotSecurity : it stops accidents, not attackers
Keep going
Next: Providers and PSDrivesCheck your understanding
Set-ExecutionPolicy changes one scope, but scripts still fail. What do you inspect?
Run Get-ExecutionPolicy -List and inspect the effective policy. Group Policy can take precedence. Execution policy is not an authorization boundary.