You run a PowerShell script (.ps1 file) provided by a tutorial, a program or your own work, and Windows PowerShell refuses to load it? This block comes from PowerShell's execution policy, a safety setting that decides whether scripts can run and whether they must be signed. This guide explains how to read this setting, relax it at the smallest level needed and roll it back, based on Microsoft's documentation.
Microsoft states that the execution policy isn't a security boundary: it mainly prevents you from running a script unintentionally. Before changing anything, make sure the script comes from a trusted source and read its contents if you can.
Problem
- A .ps1 script refuses to start in Windows PowerShell with a red message.
- Commands typed one by one work, but no script runs.
- A script downloaded from the internet is refused, while your own scripts work.
- The setting suggested by a tutorial (Set-ExecutionPolicy) fails or changes nothing.
Typical message (the path depends on your script):
File C:\Scripts\exemple.ps1 cannot be loaded because running scripts is disabled on this system. For more information, see about_Execution_Policies at https://go.microsoft.com/fwlink/?LinkID=135170.
Observe before acting
| Observation | Most likely cause | Step |
|---|---|---|
| "running scripts is disabled on this system" | Restricted policy, the default for Windows client versions in Windows PowerShell | Steps 1 to 3 |
| Message saying the file is not digitally signed | RemoteSigned policy and a script marked as downloaded from the internet | Step 4 |
| Set-ExecutionPolicy says the setting is defined by a Group Policy, or the effective value does not change | Setting enforced by a Group Policy (work or school PC) | Step 5 |
| The script works in PowerShell 7 but not in Windows PowerShell (or the reverse) | Different default values depending on the version | Step 1 in each console |
Step 1: read the current execution policy
When to use it: always, before changing a setting. This command changes nothing.
Suggested solution
- Open Windows PowerShell (no administrator rights needed).
- Type:
Get-ExecutionPolicy -List
- Read the five lines, from highest to lowest precedence:
| Scope | Where the setting comes from |
|---|---|
| MachinePolicy | Group Policy for all users of the PC |
| UserPolicy | Group Policy for the current user |
| Process | Current PowerShell session only |
| CurrentUser | Your account only |
| LocalMachine | All users of the PC |
Expected result: if every line shows Undefined, the effective policy is Restricted on a Windows client version: no script runs. If MachinePolicy or UserPolicy shows a value, go straight to step 5.
Step 2: allow scripts only in the open window
When to use it: you need to run a trusted script once, without making a lasting change to the PC.
Suggested solution
- In the Windows PowerShell window where you will run the script, type:
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process
- Confirm the change if PowerShell asks you to.
- Run your script in this same window.
Expected result: the script runs. The setting is only kept in memory: it disappears when the window is closed, so there is nothing to undo.
Step 3: allow your local scripts for your account
When to use it: you regularly use scripts you have written or copied to the PC yourself.
The RemoteSigned value allows scripts created on the PC, but requires a digital signature (or unblocking, see step 4) for scripts downloaded from the internet, including by email or instant messaging. It is a more cautious compromise than Unrestricted or Bypass, which let every script through.
Suggested solution
- In Windows PowerShell, type the following command. The CurrentUser scope only affects your account and does not require administrator rights:
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser
- Confirm the change if PowerShell asks you to. According to Microsoft, the change takes effect immediately: there is no need to restart PowerShell.
- Check with Get-ExecutionPolicy -List that the CurrentUser line shows RemoteSigned.
Expected result: your local scripts run, including in new PowerShell windows.
Rollback: to remove this setting and return to the default behaviour, type:
Set-ExecutionPolicy -ExecutionPolicy Undefined -Scope CurrentUser
To apply the setting to all users of the PC, the scope is LocalMachine: Microsoft states that PowerShell must then be started with Run as administrator. Note that a CurrentUser setting takes precedence over LocalMachine.
Step 4: unblock a downloaded script
When to use it: the policy is already RemoteSigned, but a downloaded script is refused because it is not signed.
Windows marks downloaded files with a named data stream called Zone.Identifier. With RemoteSigned, PowerShell refuses unsigned scripts carrying this mark. The Unblock-File command removes this mark: Microsoft recommends that you review the file and its source before using it.
Suggested solution
- Check that the script really comes from the expected publisher or website, then open it in a text editor to read its contents.
- To confirm that it is marked as downloaded, type (adjusting the path):
Get-Item "C:\Scripts\exemple.ps1" -Stream Zone.Identifier
- If a Zone.Identifier stream is shown and you trust the script, unblock it:
Unblock-File -Path "C:\Scripts\exemple.ps1"
Expected result: the script runs normally. Do not mass-unblock a whole folder of files you have not checked.
Step 5: setting enforced by a Group Policy
When to use it: step 1 shows a value in MachinePolicy or UserPolicy, or Set-ExecutionPolicy says the scope is defined by a Group Policy.
According to Microsoft, the Turn on Script Execution Group Policy setting overrides the settings made in PowerShell, in all scopes, including the Process scope. When disabled, it prevents any script from running.
Suggested solution
- Work or school PC: this setting is intended by your organisation. Do not try to get around it: contact your IT department with the name of the script and what it is for.
- Personal PC running Windows Pro: if you configured this setting yourself, it is in the Local Group Policy Editor (gpedit.msc), under Computer Configuration or User Configuration, then Administrative Templates > Windows Components > Windows PowerShell. Setting it to "Not Configured" hands control back to the PowerShell settings.
Expected result: once the policy has been changed by the authorised person, Get-ExecutionPolicy -List no longer shows an enforced value and steps 2 to 4 apply.
Special cases
| Situation | What to do |
|---|---|
| PowerShell 7 and Windows PowerShell behave differently | They are two separate programs: the PowerShell 7 documentation gives RemoteSigned as the default value on Windows. Run Get-ExecutionPolicy -List in each console. |
| A tutorial recommends Unrestricted or Bypass permanently | Prefer RemoteSigned for your account (step 3): Microsoft points out the risk of running malicious scripts with Unrestricted, and Bypass blocks nothing. |
| The program is blocked by another Windows protection | See App blocked by Smart App Control on Windows 11 or File wrongly blocked by Microsoft Defender (French guide). |
Final check
- ☐ Get-ExecutionPolicy -List shows the expected value at the right scope.
- ☐ The trusted script runs without a red message.
- ☐ No Unrestricted or Bypass policy has been left in place unnecessarily.
- ☐ You know how to undo the setting with the Undefined value.
Sources
- Microsoft Learn: about_Execution_Policies (Windows PowerShell 5.1)
- Microsoft Learn: Set-ExecutionPolicy
- Microsoft Learn: Unblock-File
- Microsoft Learn: about_Execution_Policies (PowerShell 7.6)
Still having the problem?
Reply in this topic with your Windows version (Windows + R keys, then winver), the console used (Windows PowerShell or PowerShell 7), the full output of Get-ExecutionPolicy -List, the exact error message and where the script comes from (written by you, downloaded, supplied by a program). Do not post the contents of a script if it contains passwords, keys or internal addresses.