PowerShell Execution Policy Registry Key Guide

PowerShell script execution on a Windows system is governed by the PowerShell Execution Policy, which determines whether scripts are allowed to run and under what conditions. These settings are stored directly in the Windows Registry across machine-wide, user-specific, and Group Policy-managed keys. Understanding these exact registry locations enables administrators to configure, audit, or troubleshoot PowerShell script permissions without launching a PowerShell console.

Primary Registry Key Locations

The core registry keys that store the PowerShell execution policy for standard configurations are:

• Local Machine (System-wide for 64-bit processes): HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell
• Local Machine (System-wide for 32-bit processes on 64-bit Windows): HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell
• Current User (Specific to logged-in user): HKEY_CURRENT_USER\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell

Within these keys, the string value (REG_SZ) named ExecutionPolicy defines the active policy.

Group Policy Registry Keys

When execution policies are managed via Group Policy, they take precedence over the primary keys and are located in the Policies hive:

• Machine Group Policy: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell
• User Group Policy: HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\PowerShell

In the Group Policy registry keys, two values control script execution: * EnableScripts (REG_DWORD): Set to 1 to enable script execution or 0 to disable it. * ExecutionPolicy (REG_SZ): Defines the specific policy string.

Supported Execution Policy Values

The ExecutionPolicy registry string value accepts the following configurations:

• Restricted: Blocks all PowerShell scripts from running; only individual interactive commands are permitted (Windows default).
• RemoteSigned: Local scripts can run without digital signatures; scripts downloaded from the internet must be signed by a trusted publisher.
• AllSigned: All scripts and configuration files must be signed by a trusted publisher.
• Unrestricted: Runs all scripts, displaying a warning prompt for unsigned scripts downloaded from the internet.
• Bypass: Nothing is blocked, and no warnings or prompts appear.
• Undefined: Removes the policy from the current scope, falling back to lower-precedence scopes or the default Restricted setting.

Precedence Order

When determining the effective policy, Windows evaluates registry settings in the following order (highest precedence to lowest):

1. Group Policy Machine (HKLM\SOFTWARE\Policies\...)
2. Group Policy User (HKCU\SOFTWARE\Policies\...)
3. Current User (HKCU\Software\...)
4. Local Machine (HKLM\SOFTWARE\...)