Modifying the PowerShell execution policy

If this is the first time that you are using Microsoft PowerShell on the computer on which you installed PowerCLI, you have to change the execution policy to be able to start PowerCLI.

The Microsoft PowerShell execution policies define when you can run scripts or load configuration files. The possible values for the execution policy are Restricted, AllSigned, RemoteSigned, Unrestricted, Bypass, and Undefined.

Policy	Description
Restricted	This is the default execution policy. It allows you to run commands at the Command Prompt, but disables the execution of scripts. It will also disable the start of PowerCLI.
AllSigned	With the AllSigned execution policy, scripts can run, but they must be signed by a trusted publisher. If you run a script by a publisher that is not trusted yet, you will see a prompt asking whether you trust the publisher of the script.
RemoteSigned	The RemoteSigned execution policy allows you to run scripts that you have written on the local computer. Any script downloaded from the Internet must be signed by a trusted publisher or must be unblocked.
Unrestricted	When the execution policy is set to Unrestricted, unsigned scripts can run. If you run a script that has been downloaded from the Internet, you will get a security warning saying that this script can potentially harm your computer and asking whether you want to run this script.
Bypass	The Bypass execution policy blocks nothing and displays no warnings or prompts. This execution policy is designed for configurations in which a Microsoft PowerShell script is built into a larger application that has its own security model.
Undefined	The Undefined execution policy removes the execution policy from the current scope. If the execution policy in all scopes is Undefined, the effective execution policy is Restricted, which is the default execution policy. The Undefined execution policy will not remove an execution policy that is set in a Group Policy scope.

You can check the current execution policy setting with the following command:

PowerCLI C:\> Get-ExecutionPolicy

Get-ExecutionPolicy is a Microsoft PowerShell commandlet (cmdlet). Cmdlets are commands built into PowerShell or PowerCLI. They follow a verb-noun naming convention. The get cmdlets retrieve information about the item that is specified as the noun part of the cmdlet.

Set the execution policy to RemoteSigned to be able to start PowerCLI and run scripts written on the local computer with the Set-ExecutionPolicy -ExecutionPolicy RemoteSigned command.

Note

You have to run the Set-ExecutionPolicy -ExecutionPolicy RemoteSigned command from a PowerShell or PowerCLI session that you started using the Run as Administrator option, or you will get the following error message:

Set-ExecutionPolicy : Access to the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell' is denied.

If you are using both the 32-bit and the 64-bit versions of PowerCLI, you have to run this command in both versions.

In the following screenshot of the PowerCLI console, you will see the output of the Set-ExecutionPolicy -ExecutionPolicy RemoteSigned command if you run this command in a PowerCLI session started with Run as Administrator.

You can get more information about execution policies by typing the following command:

PowerCLI C:\> Get-Help about_Execution_Policies

To get more information about signing your scripts, type the following command:

PowerCLI C:\> Get-Help about_signing

Note

If you get an error message saying Get-Help could not find about_Execution_Policies in a help file, you have to run the Update-Help cmdlet in a PowerShell, or PowerCLI session started with Run as Administrator first. The Update-Help cmdlet downloads the newest help files for Microsoft PowerShell modules and installs them on your computer. Because Microsoft updates the Microsoft PowerShell help files on a regular basis, it is recommended to run the Update-Help cmdlet on a regular basis also.