In Powershell, How to set execution policy for another non-admin user (as admin)?

the command Set-ExecutionPolicy has a parameter -Scope which only has 5 categories:

 MachinePolicy UserPolicy Process CurrentUser LocalMachine

It appears to have no way to specify a user.

As an administrator, how to set execution policy for another user?

There is a similar question, however it's also unsolved.Set PowerShell Execution Policy for a service account

note that there might be a way to create group policy object for another user in registry, but I'm still experimenting on this.

1 Answer

ExecutionPolicy set at the machine-level has no effect on the EP set at other levels, hence the different policies. ExecutionPolicy set at any other level, has no effect on the machine EP. EP's are a 1:1 thing, they are all independent of each other.

I do this all day long for my team and specific folks and I've shown other customers I support how to do this. My enforced GPO has set EP to restricted at the machine level, but RemoteSigned for the target user accounts and those are set at the user or process level at RemoteSigned.

The machine-level GPO is a 1:1 thing. The user EP, is set via a shortcut pushed to the target user machines. It has a hotkey shortcut assigned as well as pinned to the taskbar in the 6th position. If the user starts the normal PowerShell shortcut, running scripts are blocked. Using the customized user shortcut, they are not.

EP's do not in any way block users from running PowerShell code. Open any PS code in the ISE/VSCode, etc, select all and hit run and it will work as expected. EP, prevents the user from accidentally running scripts. MS has never said the EP is a security boundary/controller, as a point of note they specifically state that it is not.

There are literally dozens of ways to bypass EP settings. The howTo's are all over the web, even from Microsoft.

15 Ways to Bypass the PowerShell Execution Policy

Bypass the PowerShell Execution Policy

One can write there own Powershell host, because is not PowerShell, they are only PowerShell host that run PowerShell code.

Lots of these alternate hosts exist, again all over the web.

MSDN has a section devoted to writing a PowerShell host in the PowerShell SDK documentation, which is a nice starting point.

Other articles on custom hosts: