How is the "AllSigned" execution policy rolled out to all company computers, and why does it need a reboot?

Through a GPO: Computer Configuration, Administrative Templates, Windows Components, Windows PowerShell, "Turn on Script Execution" set to "Allow only signed scripts"; as a computer setting it applies at startup.

Setting the policy on each machine with Set-ExecutionPolicy does not scale and a local admin could change it back. A Group Policy:

• applies to every computer in the OU the GPO is linked to, so the choice of OU decides which machines are affected,
• takes precedence over any locally set policy (the GPO scopes MachinePolicy/UserPolicy win over the local ones),
• is enforced again at every policy refresh.

"Allow only signed scripts" corresponds to AllSigned. Because it is under Computer Configuration, it is applied when the machine boots (or with gpupdate /force), so the lab restarts the client and checks with Get-ExecutionPolicy.

Running the unsigned script afterwards gives a different error than before: no longer "scripts are disabled", but that the file is not digitally signed and therefore cannot run on this system. So the next step is a code-signing certificate.

Go deeper:

• Microsoft Learn: about_Execution_Policies — the "Turn on Script Execution" Group Policy setting and how it maps to the policies.
• Wikipedia: Group Policy — computer versus user settings and processing order.