76

I have a problem regarding changing the Execution Policy in my Windows Server 2008+ OS. It is the first time I try to run a script for which I need resource full access and I try the following after starting Powershell in elevated mode:

Set-ExecutionPolicy Unrestricted

But I get this:

Set-ExecutionPolicy : Windows PowerShell updated your execution policy
successfully, but the setting is overridden by a policy defined at a more
specific scope.  Due to the override, your shell will retain its current
effective execution policy of RemoteSigned. Type "Get-ExecutionPolicy -List"
to view your execution policy settings. For more information please see
"Get-Help Set-ExecutionPolicy".
At line:1 char:1
+ Set-ExecutionPolicy Unrestricted
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (:) [Set-ExecutionPolicy], SecurityException
    + FullyQualifiedErrorId : ExecutionPolicyOverride,Microsoft.PowerShell.Commands.SetExecutionPolicyCommand

Though I am Administrator, I cannot change the Execution Policy. What to do?

11 Answers 11

75

The error message indicates that the setting you're trying to define via Set-ExecutionPolicy is overridden by a setting in another scope. Use Get-ExecutionPolicy -List to see which scope has which setting.

PS C:\> Get-ExecutionPolicy -List

        Scope    ExecutionPolicy
        -----    ---------------
MachinePolicy          Undefined
   UserPolicy          Undefined
      Process          Undefined
  CurrentUser          Undefined
 LocalMachine       RemoteSigned

PS C:\> Set-ExecutionPolicy Restricted -Scope Process -Force
PS C:\> Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force
Set-ExecutionPolicy : Windows PowerShell updated your execution policy
successfully, but the setting is overridden by a policy defined at a more
specific scope.  Due to the override, your shell will retain its current
effective execution policy of Restricted. Type "Get-ExecutionPolicy -List"
to view your execution policy settings. ...
PS C:\> Get-ExecutionPolicy -List

        Scope    ExecutionPolicy
        -----    ---------------
MachinePolicy          Undefined
   UserPolicy          Undefined
      Process         Restricted
  CurrentUser       Unrestricted
 LocalMachine       RemoteSigned

PS C:\> .\test.ps1
.\test.ps1 : File C:\test.ps1 cannot be loaded because running scripts is
disabled on this system. ...
PS C:\> Set-ExecutionPolicy Unestricted -Scope Process -Force
PS C:\> Set-ExecutionPolicy Restricted -Scope CurrentUser -Force
Set-ExecutionPolicy : Windows PowerShell updated your execution policy
successfully, but the setting is overridden by a policy defined at a more
specific scope.  Due to the override, your shell will retain its current
effective execution policy of Restricted. Type "Get-ExecutionPolicy -List"
to view your execution policy settings. ...
PS C:\> Get-ExecutionPolicy -List

        Scope    ExecutionPolicy
        -----    ---------------
MachinePolicy          Undefined
   UserPolicy          Undefined
      Process       Unrestricted
  CurrentUser         Restricted
 LocalMachine       RemoteSigned

PS C:\> .\test.ps1
Hello World!

As you can see, both settings were defined despite the error, but the setting in the more specific scope (Process) still takes precedence, either preventing or allowing script execution.

Since the default scope is LocalMachine the error could be caused by a setting in the CurrentUser or Process scope. However, a more common reason is that script execution was configured via a group policy (either local or domain).

A local group policy can be modified by a local administrator via gpedit.msc (Local Group Policy Editor) as described in this answer.

A domain group policy cannot be superseded by local settings/policies and must be changed by a domain admin via gpmc.msc (Group Policy Management) on a domain controller.

For both local and domain policies the setting can be defined as a computer setting:

Computer Configuration
`-Administrative Templates
  `-Windows Components
    `-Windows PowerShell -> Turn on Script Execution

or as a user setting:

User Configuration
`-Administrative Templates
  `-Windows Components
    `-Windows PowerShell -> Turn on Script Execution

The former are applied to computer objects, whereas the latter are applied to user objects. For local polices there is no significant difference between user and computer policies, because user policies are automatically applied to all users on the computer.

A policy can have one of three states (or five states if you count the 3 settings available for the state Enabled separately):

  • Not Configured: policy does not control PowerShell script execution.
  • Enabled: allow PowerShell script execution.
    • Allow only signed scripts: allow execution of signed scripts only (same as Set-ExecutionPolicy AllSigned).
    • Allow local scripts and remote signed scripts: allow execution of all local scripts (signed or not) and of signed scripts from remote locations (same as Set-ExecutionPolicy RemoteSigned).
    • Allow all scripts: allow execution of local and remote scripts regardless of whether they're signed or not (same as Set-ExecutionPolicy Unrestricted).
  • Disabled: disallow PowerShell script execution (same as Set-ExecutionPolicy Restricted).

Changes made via Set-ExecutionPolicy only become effective when local and domain policies are set to Not Configured (execution policy Undefined in the scopes MachinePolicy and UserPolicy).

0
60

The problem is that Windows does not allow all scripts to be executed in Unrestricted mode. Actually, no matter the execution policy for your user (even if administrator), the Local Group Policy will take priority.

And by default the local group script execution policy is such for which scripts are not allowed to be executed. We need to change it!

Changing the Local Group Execution Policy

We do this via the Local Group Policy Editor which you can reach by searching in the Windows Search bar for "group policy". Or do this:

  1. Open the Management Console by hitting Win + r and typing command mmc.
  2. Go to File -> Add Remove Snap In....
  3. In the left pane find Group Policy Object Editor and add it.
  4. Close the form.

Then on the left pane the group editor can be expanded. Expand it and navigate to Computer Configuration -> Administrative Templates -> Windows Components.

enter image description here

Then to Windows PowerShell.

enter image description here

So select Turn on Script Execution. Change configuration to Enabled and specify Allow all scripts in Execution Policy.

enter image description here

Confirm by hitting Ok and close the Management Console.

5
  • 5
    What do you do if Windows Power Shell is not in the list? Commented Sep 25, 2015 at 11:36
  • 2
    I found the answer, you need to download version 4 on Windows Power Shell from here: microsoft.com/en-us/download/confirmation.aspx?id=40855 Commented Oct 6, 2015 at 12:19
  • Additionally, I had to install the hotfix in the answer below by @diganta-kumar Commented Mar 25, 2016 at 16:09
  • I had to run also Set-ExecutionPolicy "Unrestricted" -Scope CurrentUser -Confirm:$false
    – ozba
    Commented May 14, 2019 at 10:19
  • @RobSedgwick i think ur window home yes, so dont try open gpedit.msc e first use mmc with console prompt+admin.
    – KingRider
    Commented Mar 26, 2020 at 13:21
11

A hotfix is now available to install:

2.8.7 for VS 2013: https://github.com/NuGet/Home/releases/download/2.8.7/NuGet.Tools.vsix

3.1.1 for VS 2015: https://github.com/NuGet/Home/releases/download/3.1.1/NuGet.Tools.vsix

https://github.com/NuGet/Home/issues/974

1
  • 4
    Beware that this answer is unrelated to the problem described in the question. It resolves a problem with a Visual Studio extension. Commented Jul 19, 2017 at 16:33
8

If the PowerShell ExecutionPolicy is being set by a Domain Controller through a group policy, you'll have to reset the ExecutionPolicy to "Bypass" in the registry after every boot. I've created a pair of startup scripts to automate the process. Below, I describe my process.

Create a folder called %USERPROFILE%\Documents\StartupScripts and then place a PowerShell script called ExecutionPolicy.ps1 in it with following code:

Push-Location
Set-Location HKLM:\Software\Policies\Microsoft\Windows\PowerShell
Set-ItemProperty . ExecutionPolicy "Bypass"
Pop-Location

Then create a file called %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Startup.cmd and place the following code in it:

PowerShell -Version 3.0 -Command "Set-ExecutionPolicy Unrestricted" >> "%TEMP%\StartupLog.txt" 2>&1
PowerShell -Version 3.0 "%USERPROFILE%\Documents\StartupScripts\ExecutionPolicy.ps1" >> "%TEMP%\StartupLog.txt" 2>&1

This script will run at the start of every login.

4
  • I don't think this gets around the group policy. At least not for me. In my case the key did not exist under HKLM though it did under HKCU. However your script still did not avoid the security.
    – Marc
    Commented Nov 14, 2016 at 10:59
  • 2
    This is terrible advice. Not only does it at best temporarily mitigate the symptom (group policies are re-applied periodically, by default every 90-120 minutes), it also usually means you're violating corporate policies, which may result in legal action. Commented Jul 19, 2017 at 15:02
  • "Process even if the Group Policy objects have not changed" isn't enabled by default, and this policy falls under the security category. If the underlying registry key is changed, it (probably) will never get updated again. The OP specifically was trying to set their EP to "Unrestricted", which this answer satisfies. Anyone playing with PowerShell scripts should know the risk. Commented Sep 10 at 21:32
  • In addition, this question comes up (like it did for me) in the event of GPO tattooing. I no longer have it configured, yet it is still in effect. It requires admin privilege to change, so to cry legal action is far fetched. Commented Sep 10 at 21:37
7

Even if @Ansgar Wiechers's Answer doesn't work.. Then there can be issue with you MachinePolicy Scope. So there can be one workaround for that issue is.. Edit the Registry Value for the ExecutionPolicy Key at

HKEY_LOCAL_MACHINE -> SOFTWARE -> Policies -> Microsoft -> Windows -> Powershell

it worked for me to execute ps script after trying out so many solutions.

1
  • 1
    This just repeats (in less detail) the answer from Andry 4 years prior.
    – TylerH
    Commented Jun 20, 2022 at 13:57
6

If you are running into this with visual studio 2015 recently, check if there are any updates for nuget package manager in tools > extensions and updates>

1
  • 1
    Visual Studio updates are not related to the PowerShell Execution Policy in any way.
    – TylerH
    Commented Jun 20, 2022 at 13:56
6

Add the following to a file named psa.cmd and put in a folder included your PATH :

POWERSHELL -Command "$enccmd=[Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes((Get-Content '%1' | Out-String)));POWERSHELL -EncodedCommand $enccmd"

Now you can run any powershell script as in:

psa script.ps1
1
  • 1
    Good solution. Visual Studio 2015 running the scripts natively sometimes works and sometimes hangs. This works every time. Thanks Marc Commented Apr 25, 2019 at 12:51
3

I just did:

Set-ExecutionPolicy Unrestricted -Scope Process -Force
Set-ExecutionPolicy Unrestricted

and it worked

-1

Last time I jumped into this issue the following code fixed it. Don't forget to run terminal with Administrator priviliges and rerun it before executing script.

Set-ItemProperty -path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell" EnableScripts 1
-1

Here is how I fixed mine: First, I run Get-ExecutionPolicy -List which lists out the scopes and their current state.

    Scope ExecutionPolicy
    ----- ---------------
MachinePolicy       Undefined
   UserPolicy       Undefined
      Process       Undefined
  CurrentUser       Undefined
 LocalMachine       Undefined

As you can see all the scopes are undefined, and I think that is why I was not able to run any script on PowerShell. Now all I have to do is to make the CurrentUser scope unrestricted and to do this, I run Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force.

But also try setting the CurrentUser scope to Restricted and then back to Unrestricted, in case you run into any problems.

ExecutionPolicy Restricted -Scope CurrentUser -Force
ExecutionPolicy Unrestricted -Scope CurrentUser -Force
1
  • This just repeats the accepted answer (in less detail).
    – TylerH
    Commented Aug 2, 2022 at 18:05
-3

Try this if you having problems again and again although changed the restrictions.: Right click on the windows logo > select Powershell(admin) and then you can execute commands.

1
  • 1
    As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Aug 25, 2022 at 4:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.