Windows running scripts is disabled on this system

Most of the existing answers explain the How, but very few explain the Why. And before you go around executing code from strangers on the Internet, especially code that disables security measures, you should understand exactly what you’re doing. So here’s a little more detail on this problem.

From the TechNet About Execution Policies Page:

Windows PowerShell execution policies let you determine the conditions under which Windows PowerShell loads configuration files and runs scripts.

The benefits of which, as enumerated by PowerShell Basics — Execution Policy and Code Signing, are:

• Control of Execution — Control the level of trust for executing scripts.
• Command Highjack — Prevent injection of commands in my path.
• Identity — Is the script created and signed by a developer I trust and/or a signed with a certificate from a Certificate Authority I trust.
• Integrity — Scripts cannot be modified by malware or malicious user.

To check your current execution policy, you can run Get-ExecutionPolicy. But you’re probably here because you want to change it.

To do so you’ll run the Set-ExecutionPolicy cmdlet.

You’ll have two major decisions to make when updating the execution policy.

Execution Policy Type:

• Restricted^† — No Script either local, remote or downloaded can be executed on the system.
• AllSigned — All script that are ran require to be digitally signed.
• RemoteSigned — All remote scripts (UNC) or downloaded need to be signed.
• Unrestricted — No signature for any type of script is required.

Scope of new Change

• LocalMachine^† — The execution policy affects all users of the computer.
• CurrentUser — The execution policy affects only the current user.
• Process — The execution policy affects only the current Windows PowerShell process.

^{† = Default}

For example: if you wanted to change the policy to RemoteSigned for just the CurrentUser, you’d run the following command:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

Note: In order to change the Execution policy, you must be running PowerShell As Administrator.
If you are in regular mode and try to change the execution policy, you’ll get the following error:

Access to the registry key ‘HKEY_LOCAL_MACHINESOFTWAREMicrosoftPowerShell1ShellIdsMicrosoft.PowerShell’ is denied. To change the execution policy for the default (LocalMachine) scope, start Windows PowerShell with the «Run as administrator» option.

If you want to tighten up the internal restrictions on your own scripts that have not been downloaded from the Internet (or at least don’t contain the UNC metadata), you can force the policy to only run signed scripts. To sign your own scripts, you can follow the instructions on Scott Hanselman’s article on Signing PowerShell Scripts.

Note: Most people are likely to get this error whenever they open PowerShell because the first thing PowerShell tries to do when it launches is execute your user profile script that sets up your environment however you like it.

The file is typically located in:

%UserProfile%My DocumentsWindowsPowerShellMicrosoft.PowerShellISE_profile.ps1

You can find the exact location by running the PowerShell variable

$profile

If there’s nothing that you care about in the profile, and don’t want to fuss with your security settings, you can just delete it and PowerShell won’t find anything that it cannot execute.

While running PowerShell script, if you get running scripts is disabled on this system, it is because the PowerShell execution policy is set up by default as Restricted and doesn’t allow to run script.

It throws an exception message as “cannot be loaded because running scripts is disabled on this system“

PowerShell Scripts Disabled error message as below

.Get-Printers.ps1: File CLGet-Printers.ps1 cannot be loaded because running scripts is disabled on this system. For more information, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170

PowerShell has built-in security features implemented. PowerShell Execution policy is a safety feature which controls the conditions to run scripts and load configuration. Execution Policy in PowerShell is setup to avoid running malicious scripts in your system.

In this article, I will explain different ways to fix file cannot be loaded because running scripts is disabled on this system.

Let’s understand how to enable execution of running PowerShell script using different execution policies.

PowerShell Execution Policy in Restricted mode avoid running script to ensure safety.

Cool Tip: Use Get-ExecutionPolicy to know default policy applied on your system.

Using RemoteSigned Execution Policy

RemoteSigned execution policy is more secure option. On enabled, it allows local scripts to run. All other scripts from outside requires signed by a trusted publisher.

Set-ExecutionPolicy RemoteSigned 

• Set up RemoteSigned execution policy
• Allows to run local script.
• Now if you try to run .ps1 file, it wont give you running script is disabled on this system error.

Cool Tip: How to fix script is not digitally signed error in PowerShell!

Using UnRestricted Execution Policy

UnRestricted is the default execution policy set up on non-windows system. If you enabled this policy on system, PowerShell can run any unsigned script file.

You can change execution policy using Set-ExecutionPolicy cmdlet.

Set-ExecutionPolicy Unrestricted

• Warns the administrator about policy change and security risk associated with UnRestricted mode.
• If you select option, Y or Yes to All, it will apply policy.
• After setting up UnRestricted execution policy, if you try to run ps1 file, it wont give running script is disabled on system error.

Cool Tip: How to use multiline command in PowerShell!

Using ByPass Execution Policy

Using bypass execution policy, nothing is blocked and if you try to run script, it wont give your warning or prompts for confirmation.

With ByPass policy, scripts run temporary with lower security.

powershell -executionpolicy ByPass -File .Get-Printers.ps1

• runs ps1 script file with lower security for and executes it.
• Once your close PowerShell session, it will also closed ByPass with it.

Using PowerShell ISE

If you don’t want to set execution policy and still want to run script inside ps1 file, best work around is to open script file in PowerShell ISE.

Select all the code in script and hit F8 button to execute script.

Note: Don’t use F5 for execution, else it will try to run ps1 file and throws file cannot be loaded error.

This way, you wont require any permissions or any kind of running script is disabled on this system error.

Cool Tip: How to add a newline to string or variable in PowerShell!

Conclusion

I hope above article to fix file cannot be loaded because running scripts is disabled on this system error using set-executionpolicy helpful to solve your problem.

Use RemoteSigned execution policy to avoid running any malicious scripts or if script is local then open PowerShell script and select all code and hit F8 to execute it.

You can find more topics about PowerShell Active Directory commands and PowerShell basics on the ShellGeek home page.

По-умолчанию настройки Windows запрещают запуск скриптов PowerShell. Это необходимо для предотвращения запуска вредоносного кода на PowerShell. Настройки политик запуска PowerShell скриптов определяются в Execution Policy. В этой статье мы рассмотрим доступные политики запуска PS скриптов, как изменить Execution Policy и настроить политики использования PowerShell скриптов на компьютерах в домене.

Выполнение PowerShell скриптов запрещено для данной системы

При попытке выполнить PowerShell скрипт (файл с расширением PS1) на чистой Windows 10, появляется ошибка:

File C:ps.ps1 cannot be loaded because running scripts is disabled on this system. For more information, see about_Execution_Policies at https:/go.microsoft.com/fwlink/?LinkID=135170.
+ CategoryInfo : SecurityError: (:) [], PSSecurityException
+ FullyQualifiedErrorId : UnauthorizedAccess

Не удается загрузить файл.ps1, так как выполнение скриптов запрещено для данной системы.

Текущее значение политики выполнения скриптов PowerShell на компьютере можно получить командой:

Get-ExecutionPolicy

Доступны следующие значения PowerShell Execution Policy:

• Restricted – запрещен запуск скриптов PowerShell, можно выполнять только интерактивные команды в консоли;
• AllSigned – разрешено выполнять только подписанные PS скрипты с цифровой подписью от доверенного издателя (можно подписать скрипт самоподписанным сертификатом и добавить его в доверенные). При запуске недоверенных скриптов появляется предупреждение:

  Do you want to run software from this untrusted publisher? File .ps1 is published by CN=test1 and is not trusted on your system. Only run scripts from trusted publishers

  

• RemoteSigned – можно запускать локальные PowerShell скрипты без ограничения. Можно запускать удаленные PS файлы с цифровой подписью (нельзя запустить PS1 файлы, скачанные из Интернета, запущенные из сетевой папки по UNC пути и т.д.);
• Unrestricted – разрешен запуск всех PowerShell скриптов;

  При запуске сторонних PowerShell скриптов может появляется предупреждение с подтверждением запуска, см. ниже.

• Bypass – разрешён запуск любых PS файлов (предупреждения не выводятся) – эта политика обычно используется для автоматического запуска PS скриптов без вывода каких-либо уведомлений (например при запуске через GPO, SCCM, планировщик и т.д.) и не рекомендуется для постоянного использования;
• Default – сброс настроек выполнения скриптов на стандартную;

  В Windows 10 значение политики выполнения PowerShell по-умолчанию Restricted, а в Windows Server 2016 — RemoteSigned.

• Undefined – не задано. Применяется политика Restricted для десктопных ОС и RemoteSigned для серверных.

Как разрешить запуск скриптов PowerShell с помощью Execution Policy?

Чтобы изменить текущее значение политики запуска PowerShell скриптов, используется командлет Set-ExecutionPolicy.

Например, разрешим запуск локальных скриптов:

Set-ExecutionPolicy RemoteSigned

Подтвердите изменение политики запуска PS1 скриптов, нажав Y или A.

Чтобы запрос не появлялся, можно использовать параметр Force.

Set-ExecutionPolicy RemoteSigned –Force

Если вы установили значение политики PowerShell Execution Policy в Unrestricted, то при запуске удаленных скриптов из сетевых каталогов по UNC пути, скачанных из интернета файлов, все равно будет появляться предупреждение:

Security warning
Run only scripts that you trust. While scripts from the internet can be useful, this script can potentially harm your computer. If you trust this script, use the
Unblock-File cmdlet to allow the script to run without this warning message.
Do you want to run?
[D] Do not run [R] Run once [S] Suspend [?] Help (default is "D")

Как PowerShell различает локальные и удаленные скрипты? Все дело в идентификаторе зоны ZoneId, которую выставляет браузер в альтернативном потоке при загрузке файла (см. статью “Как Windows определяет, что файл скачан из Интернета?”). Вы можете разблокировать такой файл, поставив галку “Разблокирвать” в его свойствах или очиститься метку зоны с помощью комадлета Unblock-File.

Также следует различать различные области действия политик выполнения скриптов PowerShell (scopes):

• MachinePolicy – действует для всех пользователей компьютера, настраивается через GPO;
• UserPolicy – действует на пользователей компьютера, также настраивается через GPO;
• Process — настройки ExecutionPolicy действует только для текущего сеанса PowerShell.exe (сбрасываются при закрытии процесса);
• CurrentUser – политика ExecutionPolicy применяется только к текущему пользователю (параметр из ветки реестра HKEY_CURRENT_USER);
• LocalMachine – политика для всех пользователей компьютера (параметр из ветки реестра HKEY_LOCAL_MACHINE);

Область применения политики можно указать с помощью параметр Scope командлета Set-ExecutionPolicy. Например:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass –Force

Проверим текущие настройки ExecutionPolicy для всех областей:

Get-ExecutionPolicy -List

Scope ExecutionPolicy
----- ---------------
MachinePolicy Undefined
UserPolicy Undefined
Process Bypass
CurrentUser Undefined
LocalMachine RemoteSigned

Значение политики выполнения, которые вы задаете с помощью командлета Set-ExecutionPolicy для областей CurrentUser и LocalMachine, хранятся в реестре. Например, выполните командлет:

Set-ExecutionPolicy -Scope LocalMachine -ExecutionPolicy Restricted –Force

Откройте ветку реестра HKEY_LOCAL_MACHINESOFTWAREMicrosoftPowerShell1ShellIdsMicrosoft.PowerShell и проверьте значение REG_SZ параметра ExecutionPolicy. Оно изменилось на Restricted (допустимые значения параметра Restricted, AllSigned, RemoteSigned, Bypass, Unrestricted и Undefined).

Аналогичные настройки для области CurrentUser находятся в разделе реестра пользователя HKEY_CURRENT_USERSOFTWAREMicrosoftPowerShell1ShellIdsMicrosoft.PowerShell.

Отметим, что чаще всего в корпоративной среде используется ExecutionPolicy со значением AllSigned на уровне LocalMachine. Это обеспечивает максимальный баланс между безопасностью и удобством. Для личного пользования на компьютере можно использовать RemoteSigned. Ну а Bypass политику лучше использовать только для запуска отдельных задач (например для запуска скриптов через GPO или заданий планировщика).

Настройка PowerShell Execution Policy с помощью групповых политик

Вы можете настроить политику выполнения PowerShel скриптов на серверах или компьютерах домена с помощью групповых политик.

1. С помощью редактора доменных GPO (gpmc.msc) создайте новую GPO (или отредактируйте) существующую и назначьте ее на OU с компьютерами, к которым нужно применить политику запуска PowerShell скриптов;
2. В редакторе политики перейдите в раздел Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Windows PowerShell и найдите политику Turn on Script Execution (Включить выполнение сценариев);

   Аналогичная политика есть в пользовательском разделе GPO — User Configuration, но политика компьютера имеет приоритет.

3. Для политики доступны три значения:
   • Allow only signed scripts (Разрешать только подписанные сценарии) — соответствует политике AllSigned;
   • Allow local scripts and remote signed scripts (Разрешать локальные и удаленные подписанные сценарии) — соответствует политике PS RemoteSigned;
   • Allow all scripts (Разрешать все сценарии) — политика Unrestricted.
4. Выберите необходимое значение политики, сохраните GPO и обновите политики на компьютере.
5. Проверьте, что для области MachinePolicy теперь действуют новые настройки выполнения.

После настройки политики выполнения через GPO вы не сможете изменить настройки политики выполнения скриптов вручную. При попытке изменить настройки Execution Policy на компьютере, на который применяется такая GPO, появится ошибка:

Set-ExecutionPolicy : Windows PowerShell updated your execution policy successfully, but the setting is overridden by a policy defined at a more specific scope. Due to the override, your shell will retain its current effective execution policy of RemoteSigned. Type "Get-ExecutionPolicy -List" to view your execution policy settings.

Способы обхода политики PowerShell Execution

Есть несколько трюков, которые могут помочь вам, когда нужно запустить на компьютере PowerShell скрипт, не изменяя настройки политики выполнения. Например, я хочу запустить простой PS1 скрипт, который поверяет, что запущен с правами администратора.

Можно с помощью Get-Content получить содержимое скрипта и перенаправить его в стандартныq поток ввода консоли PS.

Get-Content c:pscheck_process_elevation.ps1 | PowerShell.exe -noprofile –

Либо можно запустить новый процесс powershell.exe с политикой выполнения Bypass:

powershell.exe -noprofile -executionpolicy bypass -file c:pscheck_process_elevation.ps1

In this article, we will talk about the error Running scripts is disabled on this system. PowerShell is a task automation and configuration management framework from Microsoft, consisting of a command-line shell and associated scripting language. PowerShell’s execution policy is a safety feature that controls the conditions under which PowerShell loads configuration files and runs scripts. This feature helps prevent the execution of malicious scripts.

Also Read: How to Format PowerShell command output as List

This error «Running scripts is disabled on this system» comes when the PowerShell execution policy doesn’t allow us to run scripts. On a Windows computer you can set an execution policy for the local computer, for the current user, or for a particular session. You can also use a Group Policy setting to set execution policies for computers and users.

Execution policies for the local computer and current user are stored in the registry. You don’t need to set execution policies in your PowerShell profile. The execution policy for a particular session is stored only in memory and is lost when the session is closed. Let’s try to understand further about this error «Running scripts is disabled on this system».

The execution policy isn’t a security system that restricts user actions. For example, users can easily bypass a policy by typing the script contents at the command line when they cannot run a script. Instead, the execution policy helps users to set basic rules and prevents them from violating them unintentionally.

You will not observe this error «Running scripts is disabled on this system» on non-windows computers as on non-Windows computers, the default execution policy is Unrestricted and cannot be changed. The Set-ExecutionPolicy cmdlet is available, but PowerShell displays a console message that it’s not supported. Before we look at the error «Running scripts is disabled on this system», we need to understand the types of execution policies.

Windows PowerShell has four different execution policies:-

Restricted —

• The default execution policy for Windows client computers. This policy generates the error «Running Scripts is disabled on this System»
• Permits individual commands, but does not allow scripts.
• Prevents running of all script files, including formatting and configuration files (.ps1xml), module script files (.psm1), and PowerShell profiles (.ps1).

AllSigned —

• Scripts can run.
• Requires that all scripts and configuration files be signed by a trusted publisher, including scripts that you write on the local computer.
• Prompts you before running scripts from publishers that you haven’t yet classified as trusted or untrusted.
• Risks running signed, but malicious, scripts.

RemoteSigned —

• The default execution policy for Windows server computers.
• Scripts can run.
• Requires a digital signature from a trusted publisher on scripts and configuration files that are downloaded from the internet which includes email and instant messaging programs.
• Doesn’t require digital signatures on scripts that are written on the local computer and not downloaded from the internet.
• Runs scripts that are downloaded from the internet and not signed, if the scripts are unblocked, such as by using the Unblock-File cmdlet.
• Risks running unsigned scripts from sources other than the internet and signed, but malicious, scripts.
• This is policy we need to set to avoid the error «Running scripts is disabled on this system»

Unrestricted —

• The default execution policy for non-Windows computers and cannot be changed.
• Unsigned scripts can run. There is a risk of running malicious scripts.
• Warns the user before running scripts and configuration files that are not from the local intranet zone.

There are certain scenarios in which you can follow the steps, verify that Execution Policy is set correctly, and still have your scripts fail.

If this happens to you, you are probably on a 64-bit machine with both 32-bit and 64-bit versions of PowerShell, and the failure is happening on the version that doesn’t have Execution Policy set. The setting does not apply to both versions, so you have to explicitly set it twice.

Step 1: Check the Version of Powershell

Check the version of PowerShell before changing the execution policy:-

PS C:Windowssystem32> Get-Host | Select-Object Version

Version
-------
5.1.18362.145

Step 2: Enable the Execution policy

Enable the execution policy using below PowerShell command:-

PS C:Windowssystem32> set-executionpolicy remotesigned

Execution Policy Change
The execution policy helps protect you from scripts that you do not trust. Changing the execution policy might expose
you to the security risks described in the about_Execution_Policies help topic at
https:/go.microsoft.com/fwlink/?LinkID=135170. Do you want to change the execution policy?
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "N"): Y

Step 3: Check the Execution Policy

After enabling the execution policy, check once the status.

PS C:Windowssystem32> Get-ExecutionPolicy
RemoteSigned

For more info on Powershell, Go to: Powershell 5.1