88

I am trying to execute a script from shared folder that I trust:

PowerShell -file "\\server\scripts\my.ps1"

But I get a security warning, and have to press 'R' to continue

Security Warning Run only scripts that you trust. While scripts from the Internet can be useful, this script can potentially harm your computer. Do you want to run \server\scripts\my.ps1? [D] Do not run [R] Run once [S] Suspend [?] Help (default is "D"): d

Can I ignore this warning? The desired pseudo code I want is:

PowerShell -IGNORE_SECURITY_WARNING -file "\\server\scripts\my.ps1"

14 Answers 14

96

This is touched in "PowerShell Execution Policies in Standard Images" on Lee Holmes' Blog and "PowerShell’s Security Guiding Principles" on the Windows Power Shell Blog .

Summary Some machines treat UNC paths as the big bad internet, so PowerShell treats them as remote files. You can either disable this feature on those servers (UncAsIntranet = 0,) or add the remote machines to your trusted hosts.

If you want to do neither, PowerShell v2 supports an -ExecutionPolicy parameter that does exactly what your pseudocode wants. PowerShell -ExecutionPolicy Bypass -File (...).

5
  • 4
    Thank you! -ExecutionPolicy Bypass is exactly what I was looking for.
    – alex2k8
    Commented Apr 8, 2009 at 9:26
  • 1
    @LeeHomes I was looking for something else but -ExecutionPolicy ByPass fixed my problem. You saved me lot of googling and time. Thanks
    – Suhas
    Commented Oct 16, 2013 at 13:23
  • 2
    Just to clarify - "add to trusted hosts" means in the system's internet options, available via control panel or in internet explorer. The name appears to be a string match. my share name is \\foo-files. Adding the name foo-files.example.com to trusted hosts did not work, i had to just add the name foo-files.
    – Dan Pritts
    Commented Apr 30, 2014 at 16:27
  • 1
    Re: -ExecutionPolicy This command only whitelists the script for the instance in which it's being run, offering no help to those running scripts usign the "Run" button in PowerShell ISE. Is there a way to globally trust this file that 1. Is persistent -- and -- 2. Doesn't involved executing the script. Futher caution... Changing the Local Intranet zone and/or Trusted Zones on a domain can have unintended side-effects on websites which rely on specific browser features to work. For example, ActiveX, http and ws traffic can be unobviously blocked depending on the origin vs. zone.
    – tresf
    Commented Dec 5, 2016 at 19:37
  • where do I put this UncAsIntranet?
    – McVitas
    Commented May 13, 2020 at 10:31
55

To avoid warnings, you can:

Set-ExecutionPolicy bypass
2
  • 4
    Warning: This sets ExecutionPolicy on the entire machine, which is a big security risk. @LeeHolmes solution up above sets ExecutionPolicy just for that session, which is a lower risk. Commented Sep 4, 2014 at 21:48
  • I find the security implications to be atrocious however this is the only way I've found to edit a remote file with PowerShell ISE and not have a popup each time the run button is clicked... at least without changing Internet Security settings which -- in the case of the target environment -- would break ActiveX content as well as some poorly-chosen-but-needed cross-domain security settings that only work in the default Local Intranet Zone.
    – tresf
    Commented Dec 5, 2016 at 19:54
52

If you're running into this error from a downloaded powershell script, you can unblock the script this way:

  1. Right-click on the .ps1 file in question, and select Properties

  2. Click Unblock in the file properties

    enter image description here

  3. Click OK

3
  • 2
    Thanks!! This worked for me, i was being prompted every launch even with Set-ExecutionPolicy Unrestricted Commented Dec 9, 2013 at 8:52
  • 2
    At least on my machine, Unblock-File does not seem to help with a UNC path as illustrated in the original question nor does the Unblock button appear in the file's property dialog. I assume this is because your file is hosted locally C:\..., which makes this answer invalid to the original question (albeit helpful to >=28 others)
    – tresf
    Commented Dec 5, 2016 at 19:40
  • 1
    Definitely helped for me. Due to limitations in our environment we had to install modules manually (stackoverflow.com/a/37488195/74276) then install them on the server (learn.microsoft.com/en-us/powershell/scripting/developer/module/…). Then we found that we had to run "Get-ChildItem | Unblock-File" to unblock all files in the module folder (under the version number folder). Commented Apr 23, 2020 at 12:12
17

Just assign 1 to SEE_MASK_NOZONECHECKS env variable

$env:SEE_MASK_NOZONECHECKS = 1
Start-Process $msi_file_path /qn -Wait | out-null
3
  • 2
    Start-Process doesn't support -ExecutionPolicy Bypass so it was failing on an UNC path, even with UAC disabled. But with this trick it works. Upvoting with all my hands. Commented Apr 17, 2017 at 9:16
  • You sir win the night.
    – ojblass
    Commented Dec 30, 2017 at 2:52
  • You made my day, seriously this guy deserves a pay raise
    – Borja Tur
    Commented Feb 15, 2023 at 10:07
4

Try this, edit the file with:

notepad foo.ps1:Zone.Identifier

And set 'ZoneId=0'

2
  • 4
    Or, in V3, Unblock-File (though this comment and this answer both have nothing to do with the IO's question) Commented Aug 3, 2012 at 12:21
  • For some reason, I couldn't see Unblock-File even with v4, but the Zone.Identifier workaround did the thing. The file was also created on the host, but still the prompt with the system execution policy 'RemoteSigned'.
    – LeeM
    Commented Mar 23, 2018 at 8:59
4

I made this powershell script to unblock all files on a share on my server

Get-ChildItem "\\ServerName\e$\MyDirectory\" -Recurse -File | % {
       Unblock-File -Path $_.FullName
}
1
  • Unblock-File did not work in my tests (Windows 10, PowerShell ISE).
    – tresf
    Commented Dec 5, 2016 at 19:44
3

None of this worked in my specific instance. What did was changing to a NetBIOS name from the FQDN.

Instead of:
\\server.domain.net\file.ps1
use:
\\server\file.ps1

Using the name bypasses the "automatically detect intranet network" config in IE.

See Option 1 in the blog here: http://setspn.blogspot.com/2011/05/running-powershell-scripts-from-unc.html

2

You want to set the execution policy on your machine using Set-ExecutionPolicy:

Set-ExecutionPolicy Unrestricted

You may want to investigate the various execution policies to see which one is right for you. Take a look at the "help about_signing" for more information.

3
  • That will change the execution policy permanently, which may nor be desired for a one-off use.
    – Joey
    Commented Nov 16, 2010 at 0:38
  • 3
    setting ExecutionPolicy to Unrestricted allows network script execution, but does not bypass the prompt.
    – Yevgeniy
    Commented Jul 10, 2013 at 16:37
  • 2
    You want to use "bypass" instead of "unrestricted". "Bypass" is even LESS restrictive than "unrestricted" and gets rid of the security prompting. Commented Dec 20, 2013 at 16:22
1

Did you download the script from internet?

Then remove NTFS stream from the file using sysinternal's streams.exe on command line.

cmd> streams.exe .\my.ps1

Now try to run the script again.

1
  • 4
    Or, in V3, Unblock-File (though this comment and this answer both have nothing to do with the IO's question) Commented Aug 3, 2012 at 12:20
1

For those who want to access a file from an already loaded PowerShell session, either use Unblock-File to mark the file as safe (though you already need to have set a relaxed execution policy like Unrestricted for this to work), or change the execution policy just for the current PowerShell session:

Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process
0

Assume that you need to launch ps script from shared folder

copy \\\server\script.ps1 c:\tmp.ps1 /y && PowerShell.exe -ExecutionPolicy Bypass -File c:\tmp.ps1 && del /f c:\tmp.ps1

P.S. Reduce googling)

0

It is very simple to do, open your PowerShell and write the following command if you have number of ps1 files. here you have to change the path with your path.

PS C:\Users> Get-ChildItem -Path "D:\downlod" -Recurse | Unblock-File
1
  • no. The files are not blocked and I still get prompts when I run it from \\tsclient\h via ISE
    – McVitas
    Commented May 13, 2020 at 10:35
0

Try set-executionpolicy "Policyname" -force switch and the warnings pop-up should not come.

0

For my part, I was running my script by a command, and was accessing it by an alias name. Just changing the alias by the real path ("\\ServerName\" -> "C:\") in my command worked for me, since it is considered local, and so safe

1
  • Please use code blocks to make this more readable
    – snowpeak
    Commented Apr 1, 2023 at 19:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.