Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 920003" data-attributes="member: 32260">Yes, it is not a bug. Microsoft chose &quot;Restricted&quot; as the default setting - it is not an Administrator Policy. This setting can be bypassed with standard rights to run scripts by a command-line without user interaction. So, any malware can run PowerShell scripts without a problem, and the PowerShell scripts can be accidentally run by the user via BAT, CMD, Windows Script Host, shortcuts, etc.Let&#039;s suppose that you use Windows standard settings + the H_C setting &lt;Block PowerShell Scripts&gt; = ON. When you will run the command get-executionpolicy -list in the Powershell console, then you will see the full list of PowerShell restrictions, like the below:&nbsp; &nbsp; &nbsp; &nbsp; Scope ExecutionPolicy&nbsp; &nbsp; &nbsp; &nbsp; ----- ---------------MachinePolicy&nbsp; &nbsp; &nbsp; Restricted&nbsp; &lt;---------------&nbsp; This comes from the H_C setting&nbsp;&nbsp; UserPolicy&nbsp; &nbsp; &nbsp;&nbsp; Undefined&nbsp; &nbsp; &nbsp; Process&nbsp; &nbsp; &nbsp;&nbsp; Undefined&nbsp; CurrentUser&nbsp; &nbsp; &nbsp;&nbsp; UndefinedLocalMachine&nbsp; &nbsp;&nbsp; Restricted &lt;---------------- This is the default Windows settingAs it can be seen the H_C setting does not overwrite the default Windows setting, but only overrides it.When you set &lt;Block PowerShell Scripts&gt; = OFF in H_C, then the settings will look like (PowerShell console has to be closed and run again):&nbsp; &nbsp; &nbsp; &nbsp; Scope ExecutionPolicy&nbsp; &nbsp; &nbsp; &nbsp; ----- ---------------MachinePolicy&nbsp; &nbsp; &nbsp;&nbsp; Undefined&nbsp; &lt;---------------&nbsp; This comes from the H_C setting&nbsp;&nbsp; UserPolicy&nbsp; &nbsp; &nbsp;&nbsp; Undefined&nbsp; &nbsp; &nbsp; Process&nbsp; &nbsp; &nbsp;&nbsp; Undefined&nbsp; CurrentUser&nbsp; &nbsp; &nbsp;&nbsp; UndefinedLocalMachine&nbsp; &nbsp; &nbsp; Restricted &lt;---------------- This is the default Windows setting</blockquote>

[QUOTE="Andy Ful, post: 920003, member: 32260"] Yes, it is not a bug. Microsoft chose "Restricted" as the default setting - it is not an Administrator Policy. This setting can be bypassed with standard rights to run scripts by a command-line without user interaction. So, any malware can run PowerShell scripts without a problem, and the PowerShell scripts can be accidentally run by the user via BAT, CMD, Windows Script Host, shortcuts, etc. Let's suppose that you use Windows standard settings + the H_C setting <Block PowerShell Scripts> = ON. When you will run the command [B][COLOR=rgb(0, 168, 133)] get-executionpolicy -list [/COLOR][/B]in the Powershell console, then you will see the full list of PowerShell restrictions, like the below: Scope ExecutionPolicy ----- --------------- MachinePolicy [B][COLOR=rgb(184, 49, 47)]Restricted[/COLOR][/B] <--------------- This comes from the H_C setting UserPolicy Undefined Process Undefined CurrentUser Undefined LocalMachine [B][COLOR=rgb(0, 168, 133)] Restricted[/COLOR][/B] <---------------- This is the default Windows setting As it can be seen the H_C setting does not overwrite the default Windows setting, but only overrides it. When you set <Block PowerShell Scripts> = OFF in H_C, then the settings will look like (PowerShell console has to be closed and run again): Scope ExecutionPolicy ----- --------------- MachinePolicy [B][COLOR=rgb(184, 49, 47)]Undefined[/COLOR][/B] <--------------- This comes from the H_C setting UserPolicy Undefined Process Undefined CurrentUser Undefined LocalMachine [B][COLOR=rgb(0, 168, 133)]Restricted[/COLOR][/B] <---------------- This is the default Windows setting [/QUOTE]

Verification