Execution policy is not a security boundary. Microsoft says so.

Plenty of teams treat RemoteSigned as their script security. Microsoft's own documentation is blunt about it: "The execution policy isn't a security boundary, it's defense in depth."

What execution policy actually does

It controls when PowerShell will load configuration files and run scripts. RemoteSigned, for example, requires a trusted signature on scripts downloaded from the internet, and lets scripts written locally run unsigned. It's there to stop people running scripts by accident.

It doesn't stop a determined user. Microsoft's example is simple: if you can't run a script, you can paste its contents at the prompt. Anyone can also run Unblock-File, start a session with a different policy, or use Bypass. On non-Windows systems the policy is effectively Bypass.

Unblock-File is where the real decision happens

When a downloaded script is blocked, the fix most people reach for is:

Unblock-File -Path .\Fix-Everything.ps1

Microsoft's guidance in the Set-ExecutionPolicy docs is to read the script's code and check it before you unblock it. That's the step that gets skipped. Unblocking takes one second; reading 400 lines from a forum post takes a lot longer.

What the review should cover

Before unblocking or running a script you didn't write, answer:

1. What does it change? Every line that creates, modifies, deletes, restarts or disables something.
2. How far does it reach? One object, a list, or everything a filter returns.
3. Can it be undone?
4. Does it fetch or build code at run time? Look for Invoke-Expression, iex, -EncodedCommand, Invoke-WebRequest piped into anything, or Start-Process on downloaded files. Code that arrives at run time can't be reviewed in advance.
5. Who signed it, if anyone?

Get-AuthenticodeSignature .\Fix-Everything.ps1 | Select-Object Status, SignerCertificate

Signing helps, review decides

AllSigned is stronger, but Microsoft lists its own risk: "running signed, but malicious, scripts". A signature tells you who published a script, not what it does.

ScriptPreflight answers the first four questions for PowerShell without running anything. Where a script builds or downloads code at run time, the report lists it and won't call the script clean, because nobody can review code that doesn't exist yet. Keep your execution policy. Just don't let it be the review.

Sources

• Microsoft Learn: about_Execution_Policies
• Microsoft Learn: Set-ExecutionPolicy