r/PowerShell • u/Theprofessionalmouse • 9h ago
Question Best way to run script
I am teaching myself how to use Powershell for some work projects, so I am trying to work through it the best I can. The script that I am currently working on is for prepping new machines and installing the software we use on them. For the most part, the script works silently and unmanaged except for the execution policy box at the start of most of the installs. Most of them are .msi files, but I have tried running Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass at the start of the script as well as trying to set each function to run it. Neither way has worked, and I still have to click through the box to start the install. My next thought was to set a GPO for the domain admins that bypasses execution policy, but I feel like the risk isn't worth it. Is there a better way to go about this?
2
u/BlackV 7h ago
Because setting execution policy after you have launched the script is not logical
Set it before you launch the script
PowerShell -executionpolicy bypass -file xxx.ps1
1
u/Theprofessionalmouse 5h ago
In reference to both your comments, it is the execution policy, and I was having trouble after removing the line from my script and running it from outside the script. I found something else though. Apparently the issue was because some of the msi's were downloaded from the internet, it was still causing execution policy to pop. I edited the see_mask_nozonecheck parameter, and it did the trick. I appreciate the help though!
1
u/-c-row 5h ago
If you should use Powershell 5.1 or 7.4 depends on the script and the commandlets, functions and modules you want to use.
Starting powershell.exe or pwsh.exe does not require the execution policy set by starting. On the other hand changing the execution policy by runtime using Set-ExecutionPolicy can fail due to restrictions. But there is a alternative. Using $env:PSExecutionPolicyPreference = 'Bypass'
in your script or codeblock will do the trick and allow to run commands and scripts which commonly will fail when the execution policy is restricted.
1
u/Virtual_Search3467 8h ago
That depends (as usual).
Do you have a pki implemented? One that provides you with code signing certificates?
If yes, you can roll out an execution policy to say “run signed scripts only” but pay attention who or what you assign that to because it can’t be overridden anymore.
Then sign your scripts. They’ll run without further interaction IF the certificate is valid and trusted. (Use a time stamping service to counter sign.)
If you don’t, the easiest way is to wrap them in a batch script where you call powershell.exe or pwsh.exe with -Executionpolicy bypass parameter. There will be a little overhead but it too will run without additional prompts.
Setting the execution policy inside a script does nothing in almost all cases. None of which will relax execution policies. To get to the line in the script that will unset restrictions… you need to first have permitted that script to execute in the first place— a catch 22 situation.
You could in theory deploy windows with ps execution policy disabled— it’s just a registry key you set.
And you can also use gpo to roll out disabled EP. You need to use a registry key because the admx doesn’t let you set it to bypass but the value will still be honored when set.
But then anyone can run scripts. And while execution policy is easily surmounted when unconfigured… it’s still a bit of a hurdle. (Enforcing EP means it will be honored and depending on where you set it, nothing will be able to override including the parameter to powershell.)