When trying to run a PowerShell script, the error pops up"Cannot load becauserScript execution is disabled on this system"🇧🇷 Next we need to change the execution policy in PowerShell. To protect your computer from malicious scripts, PowerShell's execution policy is set to Restricted by default.
This default setting prevents you from running PowerShell scripts on your computer, including scripts you have written yourself. Fortunately, we can easily change the policy with a single command in PowerShell.
In this article
In this article, I will explain how to quickly fix the error running scripts are disabled on this system, what are the different policies and how to change them on all computers using a group policy.
FixScript execution is disabled on this system
Let's start with a quick fix. The following method only solves the problem temporarily, so you can run your script and continue. For a more sustainable solution, scroll a little to the next chapter.
- Open PowerShell or Windows Terminal
- Enter the following command to run your script
powershell -ExecutionPolicy Bypass -Arquivo script.ps1
The above method only bypasses the execution policy temporarily. This works great for a single file, but requires you to use the above command every time you want to run the file. A more sustainable solution is to change the execution policy.
Permanently changing the execution policy
If you work with PowerShell scripts a lot, you probably want to permanently change the execution policy. However, before we look at how the policy can be changed, let's first explain its purpose and the different policies available.
The execution policy is not designed as a security system to prevent users from running PowerShell scripts. Any user can just ignore the policy in their current PowerShell session, or even copy and paste the contents of the script directly into the console. So what is the purpose of politics? Well, it's designed to prevent unintentional execution of PowerShell scripts.
When changing the policy, we have five options to choose from:
| execution policy | description |
|---|---|
| Restricted | Standardoption- Do not allow PowerShell scripts to run |
| unrestricted | Can run any script, show warning for downloaded scripts |
| RemoteSigned | Requires a digital signature for downloaded scripts. You could Running locally written scripts. You can unlock downloaded scripts to let them go without a signature |
| Evade | You can run all scripts and no warning will be displayed |
| all signed | You can only run signed scripts from trusted publishers |
Most people tend to set the policy to unrestricted, which allows you to run any PowerShell script. However, a better option is to use the RemoteSigned policy. This allows you to run any locally written script, but you must first unlock any downloaded scripts. The additional treatment prevents users from accidentally downloading and running malicious PowerShell scripts on their systems.
All Users x Current User
If the policy changes, we can also determine the scope of the change. The following scopes are available for the policy:
| Reach | description |
|---|---|
| current user | The policy is only set for the currently logged in user |
| local machine | The policy is changed for all users on the computer |
| procedure | The policy is only changed for the current PowerShell session |
Set execution policy for current user
So the most common scenario is that you want to change the PowerShell execution policy for the current user. This will fix the "Script execution is disabled on this system" error for the logged in user. Let's set the policy toRemoteSigned, which means that downloaded scripts require the user to do an extra step.
- OpenPower Shell
- Enter the following commandand pressureEnter
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser
- Optional - Verify the configuration with the command
Get-ExecutionPolicy
You can now run any locally created PowerShell script without the errorScript execution is disabled on this system.
When trying to run a downloaded PowerShell script with the RemoteSigned execution policy, you get an error that the file cannot be loaded. The PowerShell script is not digitally signed:
To fix this, you must first unlock the file. Of course we can use a PowerShell cmdlet for this,unlock file🇧🇷 Just type the cmdlet followed by the filename/path:
Unblock file - path .\CreateTestFiles.ps1
Set execution policy for all users
We can also change the policy for all users on a computer. To do this, you need elevated permissions (administrator rights).
- Right-click Startor pressTecla power Windows + X
- ChooseWindows PowerShell (Administrator)or Terminal for Windows (Admin)
- Enter the following command:
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine
We can check the results using the cmdletGet-ExecutionPolicy-Listshowing the policy for each area. It's good to know that the CurrentUser policy takes precedence over the LocalMachine policy. So if you set the CurrentUser policy to Restricted and the LocalMachine to RemoteSigned, the user will still not be able to run PowerShell scripts because the policy set in the CurrentUser scope overrides the LocalMachine policy.
Change policy for current sessions only
Another option is to change the policy for the current PowerShell session only. This method is useful when you need to run some PowerShell scripts but don't want to permanently change the policy. You can use the Ignore option for any script, but you can also limit the change to just the current PowerShell session. use the scopeprocedureTherefore:
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Processo
Set PowerShell execution policy with GPO
If you need to change the policy on multiple computers, it's best to use Group Policy to do this. Group Policy lets you change Windows settings on multiple computers that are members of a domain. Another benefit of the policy is that the setting on the computer cannot be overridden.
- open thisGroup Policy Management Editorand create a new policy.
- Expand Computer Configuration
- navigate toPolicies > Administrative Templates > Windows Components > Windows PowerShell
- open the settingEnable script execution
- Change the setting toAble to
- ChooseExecution policy Allow local scripting and signed remote scripting🇧🇷 This is the same asRemoteSignedthat we defined earlier.
We can verify the configuration on one of the clients that are members of the OU we just applied the configuration to. First, make sure that the latest policy is applied on the computer that uses theGPUpdateCommand. Optionally you can use theRSOP command to check policy, or just make sure the execution policy is set with the following command:
Get-ExecutionPolicy -list# Result pane ExecutionPolicy ----- ---------------MachinePolicy RemoteSigned UserPolicy RemoteSigned Process undefined CurrentUser undefined LocalMachine undefined
As already mentioned, policies have the advantage that users can no longer change the policy. If you use the cmdletdefined execution policy, you get an error message that the policy has changed, but the setting has been replaced with a policy defined in a more specific scope:
Packaging
The best way to set execution policy in PowerShell is to use Group Policy. This allows all existing and new machines in your domain to be configured with the correct policy. Of course, you can create a different policy for the IT department.
I hope this article helped you to fix "cannot load because script execution is disabled on this system" error. If you have any questions, just leave a comment below. If you want to learn more about PowerShell, be sure to readthis guide to get you started.
0Actions