What are PowerShell's five execution policies, and what does each allow?
Restricted runs no scripts, AllSigned only signed ones, RemoteSigned requires signatures only for downloaded scripts, Unrestricted runs all (warning for downloaded ones), Bypass runs all silently.
| Policy | Behaviour |
|---|---|
| Restricted | Interactive commands only; no script files (.ps1) at all. Default on Windows client editions. |
| AllSigned | Every script, even one you just wrote locally, must be signed by a trusted publisher; you are prompted the first time a new publisher's script runs. |
| RemoteSigned | Local scripts run freely; scripts from the internet (marked with the Mark of the Web zone identifier) must be signed. Default on Windows Server. |
| Unrestricted | Everything runs; for internet scripts you get a warning prompt. |
| Bypass | Nothing is blocked and nothing is asked; meant for programs that embed PowerShell. |
(Undefined means no policy at a given scope; if all scopes are undefined, the default applies.)
A script without a signature on a client therefore fails with "running scripts is disabled on this system" under Restricted.
Microsoft is explicit that execution policy is not a security boundary. It is a safety feature against running scripts by accident: anyone can pass -ExecutionPolicy Bypass, paste the content into a console, or use "Run with PowerShell", which starts a process with Bypass for that one session. Real control over scripts comes from application control (AppLocker, WDAC).
Go deeper:
Microsoft Learn: about_Execution_Policies — all policies, scopes and precedence.