Hi ALl

The "Allow Only Signed Scripts" would prevent us from running any powershell script without it being signed, even scripts that we are using locally for reporting or configuration. Will people who need it have the ability to get their certs signed without a long wait period or can we change it to "Allow local scripts and remote signed scripts"? If we are worried about people using local scripts and causing damage, keep in mind that you would still need same admin rights to use powershell to make changes that would need to make the same changes with powershell. 

Also the GPO settings can be set in User policy If we do have to use "Allow Only Signed Scripts", can we set it as a UserPolicy instead of ComputerPolicy and not apply it to the Administrators OU? 

Thanks

Help signing

For Group Policy questions please post in the GP forum.

Hi ALl

The "Allow Only Signed Scripts" would prevent us from running any powershell script without it being signed, even scripts that we are using locally for reporting or configuration. Will people who need it have the ability to get their certs signed without a long wait period or can we change it to "Allow local scripts and remote signed scripts"? If we are worried about people using local scripts and causing damage, keep in mind that you would still need same admin rights to use powershell to make changes that would need to make the same changes with powershell. 

Also the GPO settings can be set in User policy If we do have to use "Allow Only Signed Scripts", can we set it as a UserPolicy instead of ComputerPolicy and not apply it to the Administrators OU? 

Thanks

Matt is correct about per-computer but note that that also means that computer policy trumps user policy.

The default for PowerShell is "restricted" except as noted in 2012.  It is recommended that this be set by GP to a specific corporate rule.  "RemoteSigned" is a good mid-ground.

Setting this may still show issues if you trusts is not set up correctly.  There can still be issues.  Note that and address it after you have selected a policy.

Thanks Matt,

After enabling the "Allow Local scripts and remote signed scripts", can the local scripts which are not signed or doesn't have any CA... can that be run?

Also, will that be user related settings or computer?

Thanks Matt,

After enabling the "Allow Local scripts and remote signed scripts", can the local scripts which are not signed or doesn't have any CA... can that be run?

Also, will that be user related settings or com

Hi Matt, 

Sorry, I want to ask about to ask for 

After enabling the "Allow only signed scripts" can the local sripts run which don't have signed or CA.

Hi Matt, 

Sorry, I want to ask about to ask for 

After enabling the "Allow only signed scripts" can the local sripts run which don't have signed

The "zone identifier" only exists on files downloaded from "untrusted" networks.  You should never see this in a domain that is working correctly.

All files downloaded from remote networks are blocked by default unless they are strongly signed with a trusted publisher.  Nearly all MS files are signed and, as such, are nerve blocked.

Script execution can be disable absolutely and even "bypass" won't work.