Skip to content
Browse

/commands/powershell/get-executionpolicy-list

Get-ExecutionPolicy -List: PowerShell execution policy scopes and which one wins

verified onenvironmentlocal · windows 10.0.26200 arm64 · GNU bash 5.3.15 (Git Bash)updated
tool
PowerShell
versions
Windows PowerShell 5.1, PowerShell 7.x on Windows
os
windows

Get-ExecutionPolicy -List prints the execution policy set at each of the five scopes, in precedence order. The effective policy (what plain Get-ExecutionPolicy returns) is the first scope in that list that is not Undefined; if all are Undefined, the default applies: Restricted on Windows client editions, RemoteSigned on Windows Server.

powershell
Get-ExecutionPolicy -List
Get-ExecutionPolicy                  # effective policy
Get-ExecutionPolicy -Scope CurrentUser

The scopes

ScopeSet byStored in
MachinePolicyGroup Policy (Computer Configuration)registry policy key; cannot be changed with Set-ExecutionPolicy
UserPolicyGroup Policy (User Configuration)registry policy key; cannot be changed with Set-ExecutionPolicy
ProcessSet-ExecutionPolicy -Scope Process, or powershell -ExecutionPolicy X$env:PSExecutionPolicyPreference; ends with the process
CurrentUserSet-ExecutionPolicy -Scope CurrentUser (no admin needed)HKEY_CURRENT_USER
LocalMachineSet-ExecutionPolicy (default scope, needs admin)HKEY_LOCAL_MACHINE

See precedence at work

The block changes only the Process scope of its own PowerShell process:

powershell
(Get-ExecutionPolicy -List).Scope -join ' > '
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Restricted -Force
"Process scope: $(Get-ExecutionPolicy -Scope Process); effective: $(Get-ExecutionPolicy)"
Set-ExecutionPolicy -Scope Process -ExecutionPolicy AllSigned -Force
"Process scope: $(Get-ExecutionPolicy -Scope Process); effective: $(Get-ExecutionPolicy)"
"env var: $env:PSExecutionPolicyPreference"

Output

MachinePolicy > UserPolicy > Process > CurrentUser > LocalMachine
Process scope: Restricted; effective: Restricted
Process scope: AllSigned; effective: AllSigned
env var: AllSigned

Because Process comes before CurrentUser and LocalMachine, it overrides them; only the two Group Policy scopes override Process.

The policies

PolicyEffect
Restrictedno script files run; interactive commands only (Windows client default)
AllSignedevery script must be signed by a trusted publisher
RemoteSignedlocal scripts run; downloaded scripts (with the mark of the web) must be signed or unblocked (Windows Server default)
Unrestrictedall scripts run; downloaded ones ask for confirmation
Bypassnothing is blocked and there are no warnings
Undefinedno policy at this scope

If Set-ExecutionPolicy prints a warning that the setting is overridden by a policy defined at a more specific scope, a higher scope (often Group Policy) is set; Get-ExecutionPolicy -List shows which one.

Sources

Related pages

errors · powershellPowerShell: script.ps1 cannot be loaded because running scripts is disabled on this systemPowerShell refuses to run .ps1 files when the execution policy is Restricted, the Windows default. Set RemoteSigned for the current user or unblock the file.config · powershell$PROFILE: where the PowerShell profile is and how to create it$PROFILE is the path of the current user, current host profile script. It does not exist until you create it with New-Item -Path $PROFILE -ItemType File -Force.cheat sheets · powershellPowerShell cheat sheet: files, objects, filtering, strings and error handlingPowerShell cheat sheet: find commands and help, work with files, filter and sort objects, format strings, hashtables, loops, errors and bash equivalents.