Problem: PowerShell refuses to run scripts: "running scripts is disabled on this system" —— Trove problem library

What you will run into

Running a PowerShell script fails immediately: File C:\path\setup.ps1 cannot be loaded because running scripts is disabled on this system. Interactive commands (Get-Process etc.) work fine — only "executing a script file" is blocked.

Common triggers: Windows client default Restricted, enterprise group policy lockdown, or a downloaded script carrying the MOTW mark being blocked by RemoteSigned.

Why this happens

PowerShell execution policy is layered: MachinePolicy → UserPolicy → Process → CurrentUser → LocalMachine, with earlier layers winning.

powershell -File xxx.ps1 does not bypass the policy (many assume -File means it will run);

under RemoteSigned, scripts "downloaded from the internet" carry a Zone.Identifier (MOTW mark) and are blocked without a signature — locally created scripts are unaffected.

Two "changes do not take effect" traps: Set-ExecutionPolicy RemoteSigned only changes CurrentUser by default (LocalMachine needs admin, and user-level settings are ineffective while a policy layer is non-Undefined);

when enterprise policies (MachinePolicy/UserPolicy) are non-Undefined, all user-level settings are overridden.

Deterministic takeaway: run Get-ExecutionPolicy -List to see the full stack and find which layer is actually effective; a blocked downloaded script = unblock the MOTW (Unblock-File) instead of disabling the policy; a change not applying = check whether a higher layer overrides it;

fixed diagnostic: check -List before acting.

Step by step

1. Process-level temporary bypass — Required

powershell -NoProfile -ExecutionPolicy Bypass -File .\setup.ps1

2. Current-session level — Required

Set-ExecutionPolicy -Scope Process RemoteSigned
.\setup.ps1

Restored as soon as the window closes.

3. User-level persistent — Required

Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
Get-ExecutionPolicy -List

Affects all sessions of the current user; confirm the CurrentUser row changed.

4. Enterprise / group policy lockdown — Required

When MachinePolicy is not Undefined, user-level commands are ineffective; an admin must relax it in group policy or grant an exception. Don't fight policy by hard-editing the registry locally.

5. Downloaded script blocked by RemoteSigned — Required

Unblock-File .\downloaded.ps1

Removes the MOTW mark (only when you trust the source).

How to confirm it works

The script runs normally (measured output shape):

powershell -ExecutionPolicy Bypass -File payload.ps1 → normal output, exit=0

Inspect current policy and layering: Get-ExecutionPolicy -List; check MOTW: Get-Content -Stream Zone.Identifier .\x.ps1.

Other environments

Symptom

Running a PowerShell script fails immediately:

powershell -File .\setup.ps1
File C:\path\setup.ps1 cannot be loaded because running scripts is disabled on this system.
    + CategoryInfo          : SecurityError: (:) [], ParentContainsRecordException
    + FullyQualifiedErrorId : UnauthorizedAccess

• .\script.ps1 or & .\script.ps1 from the prompt may fail with the same error.
• Interactive commands (Get-Process, Set-Location, ...) work fine; only executing script files is blocked.
• Common triggers: Windows client default Restricted; enterprise Group Policy locking MachinePolicy to Restricted/AllSigned; or a script downloaded from the internet (Zone.Identifier / MOTW) blocked under RemoteSigned without a signature.

Cause

1. Layered policy: MachinePolicy > UserPolicy > Process > CurrentUser > LocalMachine (earlier wins). Get-ExecutionPolicy -List shows every layer. Restricted blocks ALL script files, including local ones.
2. -File does NOT bypass policy: powershell -File x.ps1 is still subject to ExecutionPolicy.
3. RemoteSigned semantics: locally created unsigned scripts run, but scripts downloaded from the internet carry a Zone.Identifier (MOTW) and are blocked without a digital signature.
4. Why the fix "doesn't stick": Set-ExecutionPolicy RemoteSigned defaults to the CurrentUser scope; it has no effect when MachinePolicy/UserPolicy is non-Undefined (enterprise), and LocalMachine changes need admin rights.

Solution

Pick in order "no system change → session → user → enterprise":

1. Process-level bypass (recommended, no registry writes):

   powershell -NoProfile -ExecutionPolicy Bypass -File .\setup.ps1

1. Current session only:

   Set-ExecutionPolicy -Scope Process RemoteSigned
   .\setup.ps1

1. Persistent for current user:

   Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
   Get-ExecutionPolicy -List

1. Enterprise/Group Policy locked (MachinePolicy non-Undefined): user-scope commands won't help; ask an admin to relax policy or request an exception. Do not fight policy by editing the registry locally.
2. Downloaded script blocked under RemoteSigned (UnauthorizedAccess + file came from a browser): Unblock-File .\downloaded.ps1 — only when you trust the source.

Inspect layers: Get-ExecutionPolicy -List; check MOTW: Get-Content -Stream Zone.Identifier .\x.ps1.