/errors/powershell/running-scripts-is-disabled-on-this-system
PowerShell: script.ps1 cannot be loaded because running scripts is disabled on this system
- tool
- PowerShell
- exit code
- 1
- versions
- Windows PowerShell 5.1, PowerShell 7.x on Windows
- os
- windows
File C:\path\script.ps1 cannot be loaded because running scripts is disabled on this system means PowerShell's execution policy does not allow script files. On Windows client editions (Windows 10 and 11) the default policy is Restricted: interactive commands work, .ps1 files do not. The usual fix is to allow local scripts for your own account:
Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSignedRemoteSigned runs scripts written on the machine and requires a signature only for scripts downloaded from the internet. It does not need an administrator prompt when the scope is CurrentUser.
Reproduce it
The block sets the policy for its own process only (-Scope Process), which changes nothing on the machine:
'"hello from hello.ps1"' | Set-Content hello.ps1
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Restricted -Force
try { & .\hello.ps1 } catch { $_.Exception.Message; ' -> ' + $_.FullyQualifiedErrorId }
Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned -Force
& .\hello.ps1Output
File /tmp/work/hello.ps1 cannot be loaded because running scripts is disabled on this system. For more information, see about_Execution_Policies at https:/go.microsoft.com/fwlink/?LinkID=135170. -> UnauthorizedAccess hello from hello.ps1
Downloaded scripts under RemoteSigned
Files downloaded by a browser carry a Zone.Identifier alternate data stream (the "mark of the web"). Under RemoteSigned such a script fails with a different message, is not digitally signed, until you unblock it:
'"downloaded script ran"' | Set-Content dl.ps1
Set-Content -Path dl.ps1 -Stream Zone.Identifier -Value "[ZoneTransfer]`r`nZoneId=3"
Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned -Force
try { & .\dl.ps1 } catch { $_.Exception.Message }
Unblock-File -Path .\dl.ps1
& .\dl.ps1Output
File /tmp/work/dl.ps1 cannot be loaded. The file /tmp/work/dl.ps1 is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at https:/go.microsoft.com/fwlink/?LinkID=135170. downloaded script ran
Check the current policy
Get-ExecutionPolicy -ListThe policy is resolved from the most specific scope that is set, in this order: MachinePolicy and UserPolicy (Group Policy), Process, CurrentUser, LocalMachine. If a Group Policy scope is set, Set-ExecutionPolicy for other scopes has no effect.
Options
| Command | Effect |
|---|---|
| Set-ExecutionPolicy -Scope CurrentUser RemoteSigned | Local scripts run for your user; downloaded ones need a signature or Unblock-File |
| powershell -ExecutionPolicy Bypass -File .\script.ps1 | Runs one script without changing any setting |
| Set-ExecutionPolicy -Scope Process Bypass | Allows scripts only in the current PowerShell session |
| Unblock-File .\script.ps1 | Removes the downloaded-from-internet mark from a file you trust |
npm, yarn and other .ps1 shims
Tools installed with npm on Windows create npm.ps1, yarn.ps1 or pnpm.ps1 shims next to .cmd ones. In PowerShell the .ps1 shim takes precedence, so npm itself can fail with this error. Changing the policy as above fixes it; calling npm.cmd explicitly also works.
PowerShell 7 on non-Windows systems does not enforce execution policies: the policy is always Unrestricted there.
Sources
- learn.microsoft.comlearn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies
- learn.microsoft.comlearn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy
- learn.microsoft.comlearn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file