How to Fix 'Running Scripts is Disabled on This System' PowerShell Error

Before making changes, you need to understand your current PowerShell execution policy configuration. PowerShell uses multiple scopes that can override each other.

Open PowerShell as Administrator by right-clicking the Start button and selecting "Windows PowerShell (Admin)" or "Terminal (Admin)" on Windows 11. Run this command to see all policy scopes:

Get-ExecutionPolicy -List

This displays five scopes in priority order:

• MachinePolicy: Set by Group Policy (highest priority)
• UserPolicy: Set by Group Policy for current user
• Process: Current PowerShell session only
• CurrentUser: Registry setting for current user
• LocalMachine: Registry setting for all users (default: Restricted)

If you need to run a script immediately without changing permanent settings, use a temporary bypass. This is perfect for testing or one-time script execution.

For a single script execution, run:

PowerShell -ExecutionPolicy Bypass -File .\script.ps1

Replace script.ps1 with your actual script name. Alternatively, to bypass the policy for your current PowerShell session only:

Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process

This allows you to run multiple scripts in the same session without permanent changes.

The recommended permanent solution for individual users is setting RemoteSigned policy for the CurrentUser scope. This allows local scripts to run while requiring digital signatures for downloaded scripts.

Run this command in any PowerShell window (no admin rights needed):

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

When prompted, type Y and press Enter to confirm the change. This policy:

• Allows locally created scripts to run without signatures
• Requires digital signatures for scripts downloaded from the internet
• Only affects the current user account
• Persists across PowerShell sessions and reboots

echo 'Write-Host "Test successful!"' > test.ps1
.\test.ps1

The script should execute without errors.

For system administrators who need to enable script execution for all users, set the LocalMachine scope. This requires Administrator privileges.

Open PowerShell as Administrator and run:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine

Confirm with Y when prompted. This change affects all users on the system and persists in the Windows registry at HKLM:\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell.

For organizations using both Windows PowerShell 5.1 and PowerShell 7.x, set policies for both:

# For Windows PowerShell 5.1
powershell.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine"

# For PowerShell 7.x
pwsh.exe -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine"

Even with RemoteSigned policy, scripts downloaded from the internet may still be blocked due to Windows security zones. These files have an alternate data stream that marks them as potentially unsafe.

To unblock a specific script file:

Unblock-File -Path .\downloaded-script.ps1

For multiple files in a directory:

Get-ChildItem -Path .\Scripts\ -Recurse | Unblock-File

You can also check if a file is blocked before unblocking:

Get-Item .\script.ps1 -Stream Zone.Identifier -ErrorAction SilentlyContinue

If this returns data, the file is marked as downloaded and needs unblocking.

In corporate environments, Group Policy may override local execution policy settings. If MachinePolicy or UserPolicy show non-"Undefined" values, you'll need administrative intervention.

Check for Group Policy control:

Get-ExecutionPolicy -List | Where-Object {$_.Scope -match "Policy" -and $_.ExecutionPolicy -ne "Undefined"}

If Group Policy is controlling execution policies, you have these options:

1. Contact your system administrator to modify the Group Policy setting
2. Use Process scope bypass for temporary needs: Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process
3. Request policy exception for your user account or computer

For administrators managing Group Policy:

1. Open gpedit.msc (Local Group Policy Editor) or Group Policy Management Console
2. Navigate to Computer Configuration > Policies > Administrative Templates > Windows Components > Windows PowerShell
3. Enable Turn on Script Execution
4. Select Allow local scripts and remote signed scripts (equivalent to RemoteSigned)

While enabling script execution, maintain security by following PowerShell best practices. Never use overly permissive policies like Unrestricted or Bypass for permanent settings.

Recommended policy hierarchy:

For production environments, consider signing your scripts:

# Get code signing certificate (requires certificate authority)
$cert = Get-ChildItem -Path Cert:\CurrentUser\My -CodeSigningCert

# Sign a script
Set-AuthenticodeSignature -FilePath .\script.ps1 -Certificate $cert

Monitor execution policy changes with this registry monitoring script:

# Check execution policy registry keys
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" -Name ExecutionPolicy -ErrorAction SilentlyContinue
Get-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" -Name ExecutionPolicy -ErrorAction SilentlyContinue

If the error persists after changing execution policies, several factors might be interfering. Here's a systematic troubleshooting approach.

Check for conflicting policies:

# Detailed policy analysis
foreach ($scope in @('MachinePolicy','UserPolicy','Process','CurrentUser','LocalMachine')) {
    $policy = Get-ExecutionPolicy -Scope $scope
    Write-Host "$scope`: $policy"
}

Verify PowerShell version and edition:

$PSVersionTable

PowerShell 5.1 (Windows PowerShell) and PowerShell 7.x maintain separate execution policies. If you're using PowerShell 7.x, ensure you've set policies for the correct version:

# Check which PowerShell you're running
if ($PSVersionTable.PSVersion.Major -ge 7) {
    Write-Host "Running PowerShell 7.x (pwsh.exe)"
} else {
    Write-Host "Running Windows PowerShell 5.1 (powershell.exe)"
}

Clear PowerShell cache and restart:

# Clear PowerShell module cache
Remove-Item -Path "$env:LOCALAPPDATA\Microsoft\Windows\PowerShell\ModuleAnalysisCache" -Force -ErrorAction SilentlyContinue

Then restart PowerShell completely (close all windows and reopen).

Test with a minimal script:

# Create and test simple script
'Write-Host "Execution policy test successful"' | Out-File -FilePath test-policy.ps1 -Encoding UTF8
.\test-policy.ps1