Fix: running scripts is disabled on this system (execution policy)

You double-click or run a script and get this instead of results:

.\deploy.ps1 : File C:\Projects\deploy.ps1 cannot be loaded because running scripts is disabled on this system.
For more information, see about_Execution_Policies at https://go.microsoft.com/fwlink/?LinkID=135170.
    + CategoryInfo          : SecurityError: (:) [], PSSecurityException
    + FullyQualifiedErrorId : UnauthorizedAccess

Windows PowerShell 5.1 ships with the Restricted policy on client editions of Windows: it will run commands you type, but not script files. PowerShell 7 defaults to RemoteSigned on Windows, so you usually meet the error in the built-in blue PowerShell, or on a machine where a policy was set deliberately. The error also appears when npm, Python virtual environments or other tools try to run their .ps1 helper scripts.

See what is in effect

Get-ExecutionPolicy
Get-ExecutionPolicy -List

        Scope ExecutionPolicy
        ----- ---------------
MachinePolicy       Undefined
   UserPolicy       Undefined
      Process       Undefined
  CurrentUser       Undefined
 LocalMachine      Restricted

Scopes are checked from top to bottom; the first one that is not Undefined wins. If MachinePolicy or UserPolicy is set, your IT department has configured it through Group Policy and the commands below will not override it. Ask them, or run the script with the process-level workaround further down.

The fix: RemoteSigned for your user

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

Answer Y when asked. This does not need administrator rights because it changes only your own user’s setting. RemoteSigned means: scripts you write or copy locally run freely, while scripts downloaded from the internet must carry a digital signature from a trusted publisher. It is the setting Microsoft itself uses as the default for PowerShell 7 on Windows.

Careful: this changes a persistent setting for your account. The way back is Set-ExecutionPolicy -ExecutionPolicy Undefined -Scope CurrentUser, which removes your setting and lets the machine-wide default apply again.

The policy values

• Restricted: no script files at all. The Windows PowerShell 5.1 default on Windows clients.
• AllSigned: every script must be signed, even your own.
• RemoteSigned: local scripts run, downloaded scripts must be signed. The sensible choice for a workstation.
• Unrestricted: everything runs, with a warning for downloaded scripts.
• Bypass: everything runs, no warnings. Meant for automation that has its own safeguards, not for a daily setting.
• Undefined: nothing set at this scope.

Microsoft’s documentation is explicit that the execution policy is not a security boundary. It stops you from running a script by accident; it does not stop a determined attacker. Treat it as a safety catch, not a lock.

Still blocked after RemoteSigned? Unblock the file

Files downloaded with a browser carry a Zone.Identifier mark that tells PowerShell they came from the internet. If a downloaded script is unsigned, RemoteSigned will refuse it with a different message about not being digitally signed. Once you have read the script and trust it, remove the mark:

Unblock-File .\downloaded-script.ps1
Get-ChildItem .\tools\*.ps1 | Unblock-File       # a whole folder

Run one script without changing anything

For a one-off, a scheduled task or a CI runner, set the policy for just that process. Nothing is saved:

pwsh -ExecutionPolicy Bypass -File .\deploy.ps1
powershell.exe -ExecutionPolicy Bypass -File .\deploy.ps1
Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process     # for the current window only

When it is a machine, not a user

On a server that runs scripts under several accounts, an administrator can set the machine-wide value instead:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine

Careful: this needs an elevated prompt and affects every user. Reverse it with Set-ExecutionPolicy -ExecutionPolicy Restricted -Scope LocalMachine (or whatever the previous value was; note it from Get-ExecutionPolicy -List first).

Official documentation

• about_Execution_Policies
• Set-ExecutionPolicy
• Unblock-File