Windows – Set PowerShell Execution Policy for a service account

powershellsecurity-policywindows-server-2016

I would like to adjust the PowerShell Execution Policy for a service account, i.e. the IIS user (or let alone those new SSIS virtual accounts). However, it looks like you can only adjust the policy system-wide like so

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned

or for the current user like so

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

Do I look at the wrong place, can this be found in the Registry, or is it a Group Policy?

What's the correct way to do this?

Best Answer

As defined in the help files.

Execution Policy

Scope You can set an execution policy that is effective only in a particular scope. The valid values for Scope are MachinePolicy, UserPolicy, Process, CurrentUser, and LocalMachine. LocalMachine is the default when setting an execution policy. The Scope values are listed in precedence order. The policy that takes precedence is effective in the current session, even if a more restrictive policy was set at a lower level of precedence.

MachinePolicy Set by a Group Policy for all users of the computer.

UserPolicy Set by a Group Policy for the current user of the computer.

Process The Process scope only affects the current PowerShell session. The execution policy is saved in the environment variable $env:PSExecutionPolicyPreference, rather than the registry. When the PowerShell session is closed, the variable and value are deleted.

CurrentUser The execution policy affects only the current user. It's stored in the HKEY_CURRENT_USER registry subkey.

LocalMachine The execution policy affects all users on the current computer. It's stored in the HKEY_LOCAL_MACHINE registry subkey.

However, enforced Domain-wide GPO's that include ExecutionPolicy settings, will take precedence over anything you set.

Related Question