How to Restrict PowerShell Execution Policies using Group Policy (GPO)

The Danger of Unrestricted Scripts

PowerShell is the most powerful administrative tool built into the Windows operating system. It has deep, programmatic access to the kernel, the registry, Active Directory, and the file system. Because of this power, it is also the primary weapon of choice for modern malware. A malicious actor can write a 10-line PowerShell script that quietly encrypts every file on a network drive (Ransomware) and sends it out as a spear-phishing attachment.

To prevent users (or malware acting on their behalf) from blindly running dangerous scripts, Microsoft created Execution Policies. By default on consumer Windows, the policy is often Restricted (no scripts can run). However, in many corporate environments, lazy administrators change the policy to Bypass or Unrestricted to allow their login scripts to run, accidentally leaving the entire network vulnerable.

To secure a corporate environment, you must forcefully manage the PowerShell Execution Policy across all workstations using Active Directory Group Policy (GPO).

Step 1: Accessing the Group Policy Editor

You must configure this policy on a Domain Controller.

1. Log into a Domain Controller or a management server with RSAT installed.
2. Open the Group Policy Management Console (gpmc.msc).
3. Create a new Group Policy Object (e.g., Security-PowerShell-Restriction) and link it to the Organizational Unit (OU) containing your workstations.
4. Right-click the new GPO and select Edit.

Step 2: Locating the PowerShell Policy

The Execution Policy is a Computer-level setting, meaning it applies to the machine itself, regardless of which user logs in.

1. Navigate down the following path:
2. Computer Configuration > Policies > Administrative Templates > Windows Components > Windows PowerShell.
3. On the right side of the window, locate the setting named Turn on Script Execution and double-click it.

Step 3: Defining the Restriction Level

This is where you strike the balance between security and usability.

1. Set the toggle at the top left to Enabled.
2. In the Options panel below, you must select the Execution Policy dropdown.

Understanding the Options:

• Allow all scripts: This is the equivalent of Unrestricted. Never choose this. It disables the security feature entirely.
• Allow local scripts and remote signed scripts: This is the equivalent of RemoteSigned. This is the industry best practice. It allows your IT staff to write and run scripts locally on the machine, but if a script is downloaded from the internet (like a malicious email attachment), PowerShell will refuse to run it unless it has been digitally signed by a trusted certificate authority.
• Allow only signed scripts: This is the equivalent of AllSigned. This is highly secure, but incredibly frustrating. Every script, even a two-line script you just typed yourself, must be cryptographically signed before it will execute.

Select Allow local scripts and remote signed scripts and click OK.

Verifying the Policy Enforcement

Once the Group Policy replicates across the network, the workstations will enforce the new rule.

To verify the security is active, log into a workstation, open PowerShell, and run:

Get-ExecutionPolicy -List

You will see that the MachinePolicy scope is now hardcoded to RemoteSigned. If a local Administrator attempts to override this by running Set-ExecutionPolicy Unrestricted, PowerShell will throw an access denied error, stating that the execution policy is securely managed by Group Policy and cannot be bypassed locally.