>

Fix 'scripts is disabled on this system' with Set-ExecutionPolicy

Understand PowerShell's execution policy scopes and set the one that lets you run your own local scripts without gutting the security model.

WindowsTerminaldevelopersecurityMedium risk
Run `Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser` in PowerShell to allow local scripts while still requiring signatures for downloaded ones.

01Command

Command
$ Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

02What it does

Execution policy is a safety gate, not a sandbox: it blocks accidental script execution but is trivially bypassed, so it is not an anti-malware control. Policies apply in order of scope precedence: Process (session only, via `powershell -ExecutionPolicy Bypass -File script.ps1`), CurrentUser, LocalMachine — the most specific wins. RemoteSigned lets scripts you wrote locally run unsigned, but anything downloaded from the internet (marked by the Zone.Identifier ADS) must be signed; check that mark with `Get-Item script.ps1 -Stream Zone.Identifier` and clear it with `Unblock-File` for files you trust. Setting a scope back to Undefined removes it, falling through to the next scope, and `Get-ExecutionPolicy -List` shows the effective matrix.

03Risk

RiskMedium risk
RequirementsA non-elevated PowerShell window is enough for -Scope CurrentUser; changing LocalMachine scope requires administrator.
!Warning: Never use Unrestricted or Bypass as a persistent machine-wide policy — Bypass is for one-shot invocations like installers, not your default.

04Undo

Undo
$ Set-ExecutionPolicy -ExecutionPolicy Undefined -Scope CurrentUser

05Sources

  • Set-ExecutionPolicy | Microsoft Learn
    Microsoft · vendor-doc · 2026-09-17
    Evidence: Microsoft documents Set-ExecutionPolicy with the RemoteSigned and Undefined policies and the process, currentuser, localmachine scope parameters.
  • Set-ExecutionPolicy - PowerShell
    SS64 · technical · 2026-09-17
    Evidence: SS64 explains the execution policy scopes and that RemoteSigned requires downloaded scripts to carry a trusted signature while local scripts run freely.

Last verified: 2026-09-17 · Category: Developer

06Related solutions

Install any app from the command line with winget
WindowssystemTerminaldeveloper

Use Windows Package Manager to install, search, and upgrade thousands of applications from the community repository in one command.

Low risk ✓ 2026-09-17
Bulk rename files in PowerShell with Rename-Item
WindowsFilesTerminaldeveloper

One pipeline that renames every matching file in a folder using regular expressions — safer and far more flexible than third-party renamers.

Medium risk ✓ 2026-09-17
Run a Microsoft Defender scan from the command line
WindowsTerminalsecurityDiagnostics

Kick off quick, full, custom, or offline boot scans with PowerShell or the MpCmdRun.exe utility — no GUI clicking required.

Low risk ✓ 2026-09-17