How to Change PowerShell Execution Policies in Windows 11

Why does 🪟 Windows 11 block PowerShell scripts by default?

Windows 11 blocks scripts by default to prevent malicious code from running automatically. This acts as a barrier, so only code you have approved executes. Script execution stays disabled until you change the policy, which protects the machine from threats and accidental damage.

An execution policy is a safety feature, not a hard security boundary. It stops you from launching a script by accident, but it does not replace antivirus or good habits about where you download files from.

What happens when you change the execution policy?

Depending on the setting you pick, you either tighten security or expose the computer to more risk. Understand what each policy allows before you lower the security level, and choose the narrowest option that gets your task done.

Understanding PowerShell Execution Policies

PowerShell execution policies determine whether the computer runs scripts. The two you will meet most often are Restricted, which blocks all scripts, and RemoteSigned, which allows locally created scripts but requires downloaded ones to carry a trusted publisher signature. For most people who need to run their own scripts, RemoteSigned is the sensible choice.

• Restricted: Default setting. No scripts allowed.
• RemoteSigned: Scripts created locally run; downloaded scripts must be signed by a trusted publisher.
• AllSigned: Every script must be signed by a trusted publisher.
• Bypass: Nothing is blocked. Use only for specific, trusted automation tasks.
• Unrestricted: All scripts run. This is a major security risk.

How to Check and Change Policies

Before you change anything, check what is active now. Then decide whether the change should apply to your account only or to every user on the PC.

1. Click the Start button, type PowerShell, and open Windows PowerShell (or Terminal, which opens PowerShell by default in Windows 11).
2. Run Get-ExecutionPolicy. PowerShell prints the current policy, for example Restricted on a fresh install.
3. To apply a policy to an individual user account, use Set-ExecutionPolicy RemoteSigned -Scope CurrentUser. This changes only the account you are signed in with, so other users on the PC are not affected.

Pick one of the two options below, depending on the scope you need:

1. To configure the current user only, run Set-ExecutionPolicy RemoteSigned -Scope CurrentUser. This does not need an elevated window, so it is the safer choice on a shared PC.
2. To modify the entire machine, right-click Start, choose Terminal (Admin) or search for PowerShell and select Run as administrator, then click Yes on the User Account Control prompt. In the elevated window, run Set-ExecutionPolicy RemoteSigned -Scope LocalMachine.
3. If PowerShell asks you to confirm the change, read the warning and type Y, then press Enter.
4. Run Get-ExecutionPolicy again to confirm the new value is shown.

The change takes effect right away and needs no restart. If a window that was already open still behaves the old way, close it and open a new one. To undo a change, run the same command again with a stricter policy, such as Restricted.

Safer Alternatives: Unblock-File

If you only need to run one script, unblock that script instead of altering the global policy. Windows marks files downloaded from the internet as coming from another computer, and that mark is what makes RemoteSigned refuse them. Removing the mark from a single file you trust keeps the rest of the system at its stricter setting, which is better security practice. The following command does this:

Unblock-File -Path "C:\Scripts\MyScript.ps1"

Troubleshooting and Group Policy

Troubleshooting and Group Policy. If you get an error saying that script execution is disabled even after you changed the policy, a Group Policy Object (GPO, a centralized administrative rule set) is usually enforcing stricter limits than your local settings. Policies set by Group Policy take priority over anything you set in PowerShell, so the command may appear to succeed and still have no effect. This is common on work or school PCs managed by an organization. In that case, ask your administrator to change the policy, or use the unblock method above for single scripts.

On Windows 11 Pro, Enterprise and Education, you can look in the Local Group Policy Editor under Computer Configuration › Administrative Templates › Windows Components › Windows PowerShell and check the Turn on Script Execution setting. Windows 11 Home does not include that editor.

Registry Editor Method

Registry Editor Method (Requires Administrator Privileges)

Use this method if the PowerShell commands are not an option. Editing the registry incorrectly can cause problems, so create a restore point or back up the key first.

1. Open the Windows Registry Editor. Click Yes if User Account Control asks for permission.
2. Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell
3. Create a new String Value named ExecutionPolicy. Right-click an empty area in the right pane and choose New › String Value, then type the name.
4. Set the value to RemoteSigned. Double-click the new entry, enter the data in the Value data box, and click OK.

Open a new PowerShell window afterwards and check the result. To undo the change, delete the value you created or set it back to its previous data.

Summary

Keeping the right execution policy active secures the machine while letting necessary automation run smoothly. Choose the narrowest scope that works, prefer RemoteSigned over Unrestricted, and check the policy again whenever scripts stop running.