Controlling the PowerShell Execution Policy Settings in a Domain

Q: How can I centrally control the PowerShell execution policy settings on the Windows machines in my domain to ensure that they aren't overridden by changes made by an administrator locally on a domain member machine?

A: To centrally control the PowerShell execution policies for the machines and users in your domain, you can use the Turn on Script Execution Group Policy Object (GPO) setting. You can configure this setting in both the computer node and the user configuration node of GPOs. If you configure them in both nodes, the computer-level setting will take precedence over the user-level setting. When these settings are enabled, they override other PowerShell execution policies locally set on a machine (i.e., the policies linked to the Process, CurrentUser, and LocalMachine scopes). If you're unfamiliar with PowerShell's execution policies and scopes, see "Use Execution Policies to Control What PowerShell Scripts Can Be Run."

The Turn on Script Execution GPO setting has the following configuration options, as illustrated in Figure 1:

Figure 1: Enabling the Turn on Script Execution GPO Setting

The Turn on Script Execution GPO setting isn't included in the standard Windows GPOs. You can add it by installing the PowerShellExecutionPolicy administrative template. You can download this template from the Administrative Templates for Windows PowerShell web page. You'll be downloading an *.msi package, which you must install on the system where you configure your GPOs.

After the package is successfully installed, you need to load the administrative template. To do so, open the GPO editor, navigate to the Administrative Templates container, right-click it, and choose Add/Remove Templates. In the Add/Remove Templates dialog box, you can add either the PowerShellExecutionPolicy.adm file (the classic administrative template) or the PowerShellExecutionPolicy.admx file (the XML-formatted administrative template). Both files are located in the %systemdrive%/program files/Microsoft Group Policy file system folder.

The Turn on Script Execution GPO setting shows up in the Computer Configuration and User Configuration GPO nodes in the following paths: