Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm still pretty new to PowerShell, and recently read this in a blog posting about creating and using PowerShell scripts.

To prevent the execution of malicious scripts, PowerShell enforces an execution policy. By default, the execution policy is set to Restricted, which means that PowerShell scripts will not run. You can determine the current execution policy by using the following cmdlet:

Get-ExecutionPolicy

The execution policies you can use are:

  • Restricted - Scripts won’t run.
  • RemoteSigned - Scripts created locally will run, but those downloaded from the Internet will not (unless they are digitally signed by a trusted publisher).
  • AllSigned - Scripts will run only if they have been signed by a trusted publisher.
  • Unrestricted - Scripts will run regardless of where they have come from and whether they are signed.

You can set PowerShell’s execution policy by using the following cmdlet:

Set-ExecutionPolicy <policy name>

To me, the notation of "unless they are digitally signed by a trusted publisher" in the description of Remote Signed seems to imply that it operates the same as AllSigned. Is there a difference I'm missing somewhere?

share|improve this question
    
Interestingly on this one, there's a good Defcon presentation, here that has some interesting thoughts on bypassing execution policy restrictions. –  Rоry McCune Jan 22 '11 at 10:08

2 Answers 2

up vote 6 down vote accepted

The difference being that RemoteSigned will run scripts locally that aren't signed, whereas AllSigned requires all scripts to be signed regardless of their origin.

share|improve this answer

Obviously AllSigned requires all modules/snapins and scripts to be code-signed. RemoteSigned only requires signing for remote files. What are remote files?

The canonical answer is on the PowerShell blog: http://blogs.msdn.com/b/powershell/archive/2007/03/07/how-does-the-remotesigned-execution-policy-work.aspx

But the bottom line is: RemoteSigned only requires code-signing on modules/snapins and scripts which are flagged as from the "Internet" zone in the 'Zone.Identifier' alternate data stream, unless you have "Internet Explorer Enhanced Security" activated, in which case it also includes "Intranet" flagged files and UNC paths.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.