Building on PowerShell: Execution Policies

re: Building on PowerShell: Execution Policies

David Noble — Sat, 29 May 2010 00:06:59 GMT

I may be missing something, but it does not appear to me that execution policies work very well with Windows Server 2008 R2 DFS domain shares. Perhaps you know. Why does PowerShell prevent me from running unsigned scripts and loading unsigned configuration files from \\domain\share after I

set-executionpolicy remotesigned

set-location c:\windows\microsoft.net\framework\v2.0.50727

.\caspol.exe -pp off -m -ag 1 -url file://domain/share/* FullTrust -Exclusive on

What's the caspol magic required to enable running unsigned scripts and loading unsigned configuration files from a DFS domain share?

re: Building on PowerShell: Execution Policies

Martin Zugec — Tue, 23 Feb 2010 14:42:02 GMT

Hi Lee,

first let me tell you that I really like idea of execution policies and I understand how import it is. What I don't like however is that fact how they are implemented.

What drives me crazy is following message:

"Security Warning

Run only scripts that you trust. While scripts from the Internet can be useful, this script

can potentially harm your computer."

It is extremely hard to identify sometimes why the script doesn't want to run. Consider following example:

PS C:\> 'write-host "Hello world!"' > c:\temp\test.ps1

PS C:\> C:\temp\test.ps1

Hello world!

PS C:\> . \\127.0.0.1\c$\temp\test.ps1

Security Warning

Run only scripts that you trust. While scripts from the Internet can be useful, this script can potentially harm your

computer. Do you want to run \\127.0.0.1\c$\temp\test.ps1?

[D] Do not run [R] Run once [S] Suspend [?] Help (default is "D"):

At few different customers, I had to fiddle not just with Trusted sites, but also with some registry\GPO settings, environment variables (zone mask) etc etc...

In case you use Powershell to write just few functions, it's fine. In case you try to implement it as enterprise standart with hundreds or thousands of scripts, it can become very painful :( Only quick solution in this case is to use Bypass execution policy, which is of course something no one wants to do

Martin

re: Building on PowerShell: Execution Policies

Joe — Sat, 13 Feb 2010 08:35:59 GMT

"Would you like to update the execution policy to allow these scripts to run?"

To me this sentenece is absolutly misleading. Of course do I want these scripts to run. But it's most probably not everyones expectation that after clicking "yes" several - possibly thousands - of other scripts are then also alowed to run.