To say that the Windows operating system can be manipulated by PowerShell is a gross understatement. They are fully intertwined, and PowerShell can be useful for so many tasks on your servers. However, the ability to run PowerShell scripts is disabled by default on many machines. The first stumbling block that many new PowerShell administrators bump into is the Execution Policy. It's quite simple: in order to allow PowerShell scripts to run on your server, the Execution Policy must be adjusted to allow that to happen. Let's introduce our first task in PowerShell by using some commands in this recipe that will set this policy for us.
This is also a good introduction to the idea of the verb-noun syntax that PowerShell utilizes. For example, we are going to make use of cmdlets called Get-ExecutionPolicy and Set-ExecutionPolicy. The Get-(parameter name) and Set-(parameter name) cmdlets are very common across all facets of cmdlets available in PowerShell. Wrap your mind around this verb-noun syntax and you will be well on your way to figuring out PowerShell on your machines.
Follow these steps to set the PowerShell Execution Policy:
- Right-click on the PowerShell icon and choose Run as administrator.
- Type
Get-ExecutionPolicyand press Enter in order to see the current setting of the PowerShell Execution Policy.
- You can see that the current Execution Policy is set to RemoteSigned. Here is a short description of the different options for the policy:
- Remote Signed: This is the default setting in Server 2016, which allows PowerShell scripts that are locally created to run. If you try running remote scripts, they must be signed by a trusted publisher in order to execute successfully.
- All Signed: With this setting, all scripts will only be allowed to run if they are signed by a trusted publisher.
- Restricted: With this setting, PowerShell is locked down so that scripts will not run.
- Unrestricted: This setting will allow PowerShell to run scripts, with or without signing.
- For the purposes of our recipe and to make sure scripts will run for us as we progress through these recipes, let's set our Execution Policy to unrestricted. Go ahead and use this command:
Set-ExecutionPolicy Unrestricted
The PowerShell Execution Policy is a simple setting and easy to change, but can make a world of difference when it comes to running your first scripts. If configured to be more restrictive than you intend, you will have trouble getting your scripts to run and may think that you have mistyped something, when in fact the issue is only the policy. On the other hand, in an effort to make your servers as secure as possible, on machines where you don't need to execute PowerShell scripts, it makes sense to restrict this access. You may also want to read some additional information on the signing of scripts to see whether creating and executing signed scripts would make more sense in your own environment. There are some in-built server functions that rely on a certain level of security with your Execution Policy. Setting your policy to unrestricted on all of your servers could result in some functions not working properly, and you may have to increase that level of security back to remote signed.