Skip to content

/errors/powershell/running-scripts-is-disabled-on-this-system

PowerShell: script.ps1 cannot be loaded because running scripts is disabled on this system

verified onenvironmentlocal · windows 10.0.26200 arm64 · GNU bash 5.3.15 (Git Bash)updated
tool
PowerShell
exit code
1
versions
Windows PowerShell 5.1, PowerShell 7.x on Windows
os
windows

File C:\path\script.ps1 cannot be loaded because running scripts is disabled on this system means PowerShell's execution policy does not allow script files. On Windows client editions (Windows 10 and 11) the default policy is Restricted: interactive commands work, .ps1 files do not. The usual fix is to allow local scripts for your own account:

powershell
Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned

RemoteSigned runs scripts written on the machine and requires a signature only for scripts downloaded from the internet. It does not need an administrator prompt when the scope is CurrentUser.

Reproduce it

The block sets the policy for its own process only (-Scope Process), which changes nothing on the machine:

powershell
'"hello from hello.ps1"' | Set-Content hello.ps1
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Restricted -Force
try { & .\hello.ps1 } catch { $_.Exception.Message; '  -> ' + $_.FullyQualifiedErrorId }
Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned -Force
& .\hello.ps1

Output

File /tmp/work/hello.ps1 cannot be loaded because running scripts is disabled on this system. For more information, see about_Execution_Policies at https:/go.microsoft.com/fwlink/?LinkID=135170.
  -> UnauthorizedAccess
hello from hello.ps1

Downloaded scripts under RemoteSigned

Files downloaded by a browser carry a Zone.Identifier alternate data stream (the "mark of the web"). Under RemoteSigned such a script fails with a different message, is not digitally signed, until you unblock it:

powershell
'"downloaded script ran"' | Set-Content dl.ps1
Set-Content -Path dl.ps1 -Stream Zone.Identifier -Value "[ZoneTransfer]`r`nZoneId=3"
Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned -Force
try { & .\dl.ps1 } catch { $_.Exception.Message }
Unblock-File -Path .\dl.ps1
& .\dl.ps1

Output

File /tmp/work/dl.ps1 cannot be loaded. The file /tmp/work/dl.ps1 is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at https:/go.microsoft.com/fwlink/?LinkID=135170.
downloaded script ran

Check the current policy

powershell
Get-ExecutionPolicy -List

The policy is resolved from the most specific scope that is set, in this order: MachinePolicy and UserPolicy (Group Policy), Process, CurrentUser, LocalMachine. If a Group Policy scope is set, Set-ExecutionPolicy for other scopes has no effect.

Options

CommandEffect
Set-ExecutionPolicy -Scope CurrentUser RemoteSignedLocal scripts run for your user; downloaded ones need a signature or Unblock-File
powershell -ExecutionPolicy Bypass -File .\script.ps1Runs one script without changing any setting
Set-ExecutionPolicy -Scope Process BypassAllows scripts only in the current PowerShell session
Unblock-File .\script.ps1Removes the downloaded-from-internet mark from a file you trust

npm, yarn and other .ps1 shims

Tools installed with npm on Windows create npm.ps1, yarn.ps1 or pnpm.ps1 shims next to .cmd ones. In PowerShell the .ps1 shim takes precedence, so npm itself can fail with this error. Changing the policy as above fixes it; calling npm.cmd explicitly also works.

PowerShell 7 on non-Windows systems does not enforce execution policies: the policy is always Unrestricted there.

Sources