Set-ExecutionPolicy Unrestricted

Hi,

I want to start ps1 scripts over UNC paths or mapped network shares. I tried
to change the execution policy to unrestricted but I always get the
following prompt:

Security Warning
Run only scripts that you trust. While scripts from the Internet can be
useful, this script can potentially harm your
computer. Do you want to run \\blablabla\bla?
[D] Do not run [R] Run once [S] Suspend [?] Help (default is "D"):

This is bad! In my case these scripts are executed by scheduled tasks or
other management tools remotely so that the user input is no option.

Here my questions:
* Can I disable this prompt? If so, all is good again - but I fear it's not
that simple?!
* Can I somehow specify a trusted location (like caspol.exe offers in the
dotnet framework)?
* Do I have to sign all my scripts?
* Do I have to buy a certificate to sign my scripts?
* I have no CA installed in our domain, can I do codesigning - ie creating
certificates somehow - using standard active directory functionality without
having a CA installed?
* Is there a "good" documentation about signing? I read a lot about
self-signing scripts but this is in our environment not very practicable
(deployment of certificates for all sorts of users accounts). What do I have
to do if I get some of these codesigning certificates?

Please, can someone help me out here?

Thanks in advance

Stefan

Stefan Koell wrote:
> Hi,
>
> I want to start ps1 scripts over UNC paths or mapped network shares. I
> tried to change the execution policy to unrestricted but I always get
> the following prompt:
>
> Security Warning
> Run only scripts that you trust. While scripts from the Internet can be
> useful, this script can potentially harm your
> computer. Do you want to run \\blablabla\bla?
> [D] Do not run [R] Run once [S] Suspend [?] Help (default is "D"):
>
> This is bad! In my case these scripts are executed by scheduled tasks or
> other management tools remotely so that the user input is no option.
>
> Here my questions:
> * Can I disable this prompt? If so, all is good again - but I fear it's
> not that simple?!
> * Can I somehow specify a trusted location (like caspol.exe offers in
> the dotnet framework)?
> * Do I have to sign all my scripts?
> * Do I have to buy a certificate to sign my scripts?
> * I have no CA installed in our domain, can I do codesigning - ie
> creating certificates somehow - using standard active directory
> functionality without having a CA installed?
> * Is there a "good" documentation about signing? I read a lot about
> self-signing scripts but this is in our environment not very practicable
> (deployment of certificates for all sorts of users accounts). What do I
> have to do if I get some of these codesigning certificates?
>
> Please, can someone help me out here?
>
> Thanks in advance
>
> Stefan

Try running 'set-psdebug -off'. Assuming that is OK...

Marco

Thanks for your suggestion, unfortunately it doesn't work. I turned it off
but as soon as I tried to dot source a ps1 script with an UNC I immediately
get the prompt again.

Any other suggestions?

"Marco Shaw" <marco.shaw@_NO_SPAM_gmail.com> wrote in message
news:e7Q1S9mjHHA.460@TK2MSFTNGP05.phx.gbl...
> Stefan Koell wrote:
>> Hi,
>>
>> I want to start ps1 scripts over UNC paths or mapped network shares. I
>> tried to change the execution policy to unrestricted but I always get the
>> following prompt:
>>
>> Security Warning
>> Run only scripts that you trust. While scripts from the Internet can be
>> useful, this script can potentially harm your
>> computer. Do you want to run \\blablabla\bla?
>> [D] Do not run [R] Run once [S] Suspend [?] Help (default is "D"):
>>
>> This is bad! In my case these scripts are executed by scheduled tasks or
>> other management tools remotely so that the user input is no option.
>>
>> Here my questions:
>> * Can I disable this prompt? If so, all is good again - but I fear it's
>> not that simple?!
>> * Can I somehow specify a trusted location (like caspol.exe offers in the
>> dotnet framework)?
>> * Do I have to sign all my scripts?
>> * Do I have to buy a certificate to sign my scripts?
>> * I have no CA installed in our domain, can I do codesigning - ie
>> creating certificates somehow - using standard active directory
>> functionality without having a CA installed?
>> * Is there a "good" documentation about signing? I read a lot about
>> self-signing scripts but this is in our environment not very practicable
>> (deployment of certificates for all sorts of users accounts). What do I
>> have to do if I get some of these codesigning certificates?
>>
>> Please, can someone help me out here?
>>
>> Thanks in advance
>>
>> Stefan
>
> Try running 'set-psdebug -off'. Assuming that is OK...
>
> Marco

Stefan Koell wrote:
> Thanks for your suggestion, unfortunately it doesn't work. I turned it
> off but as soon as I tried to dot source a ps1 script with an UNC I
> immediately get the prompt again.
>
> Any other suggestions?

Is set-psdebug set in the script or any scripts it calls?

If you check in IE -> Internet Options -> Security - Local Intranet.
Make sure all the check boxes are checked.

If the check box is not check UNC paths are consider Internet Zone and not
Intranet.

p.s. Not sure why Unrestricted still checks, but This could fix it.

"Stefan Koell" <stefan_koell@hotmail.com> wrote in message
news:OtFKTDnjHHA.2552@TK2MSFTNGP06.phx.gbl...
> Thanks for your suggestion, unfortunately it doesn't work. I turned it off
> but as soon as I tried to dot source a ps1 script with an UNC I
> immediately get the prompt again.
>
> Any other suggestions?
>
> "Marco Shaw" <marco.shaw@_NO_SPAM_gmail.com> wrote in message
> news:e7Q1S9mjHHA.460@TK2MSFTNGP05.phx.gbl...
>> Stefan Koell wrote:
>>> Hi,
>>>
>>> I want to start ps1 scripts over UNC paths or mapped network shares. I
>>> tried to change the execution policy to unrestricted but I always get
>>> the following prompt:
>>>
>>> Security Warning
>>> Run only scripts that you trust. While scripts from the Internet can be
>>> useful, this script can potentially harm your
>>> computer. Do you want to run \\blablabla\bla?
>>> [D] Do not run [R] Run once [S] Suspend [?] Help (default is "D"):
>>>
>>> This is bad! In my case these scripts are executed by scheduled tasks or
>>> other management tools remotely so that the user input is no option.
>>>
>>> Here my questions:
>>> * Can I disable this prompt? If so, all is good again - but I fear it's
>>> not that simple?!
>>> * Can I somehow specify a trusted location (like caspol.exe offers in
>>> the dotnet framework)?
>>> * Do I have to sign all my scripts?
>>> * Do I have to buy a certificate to sign my scripts?
>>> * I have no CA installed in our domain, can I do codesigning - ie
>>> creating certificates somehow - using standard active directory
>>> functionality without having a CA installed?
>>> * Is there a "good" documentation about signing? I read a lot about
>>> self-signing scripts but this is in our environment not very practicable
>>> (deployment of certificates for all sorts of users accounts). What do I
>>> have to do if I get some of these codesigning certificates?
>>>
>>> Please, can someone help me out here?
>>>
>>> Thanks in advance
>>>
>>> Stefan
>>
>> Try running 'set-psdebug -off'. Assuming that is OK...
>>
>> Marco
>

Basically I do the following:
I fire up a command shell
I type Set-PSDebug -off
Then I type (without the surrounding quotes) ".
\\someserver\someshare\sompath\some.ps1"
where the some.ps1 just contains a write-host "Hello World"

and then I get the security warning.

Any ideas? Am I doing something wrong? I have to admit I am still a PS
newbie...

"Marco Shaw" <marco.shaw@_NO_SPAM_gmail.com> wrote in message
news:e7i$eHnjHHA.2440@TK2MSFTNGP06.phx.gbl...
> Stefan Koell wrote:
>> Thanks for your suggestion, unfortunately it doesn't work. I turned it
>> off but as soon as I tried to dot source a ps1 script with an UNC I
>> immediately get the prompt again.
>>
>> Any other suggestions?
>
> Is set-psdebug set in the script or any scripts it calls?

Hi,

I did check the Local Intranet settings as you suggested and there are all 3
checkboxes checked (including the one with the UNCs).

Are you saying, that setting it the execution policy to unrestricted
shouldn't prompt for confirmation, never?

Thanks

"Brandon Shell" <tshell.mask@gmail.com> wrote in message
news:ODURWLnjHHA.4040@TK2MSFTNGP03.phx.gbl...
> If you check in IE -> Internet Options -> Security - Local Intranet.
> Make sure all the check boxes are checked.
>
> If the check box is not check UNC paths are consider Internet Zone and not
> Intranet.
>
> p.s. Not sure why Unrestricted still checks, but This could fix it.
>
> "Stefan Koell" <stefan_koell@hotmail.com> wrote in message
> news:OtFKTDnjHHA.2552@TK2MSFTNGP06.phx.gbl...
>> Thanks for your suggestion, unfortunately it doesn't work. I turned it
>> off but as soon as I tried to dot source a ps1 script with an UNC I
>> immediately get the prompt again.
>>
>> Any other suggestions?
>>
>> "Marco Shaw" <marco.shaw@_NO_SPAM_gmail.com> wrote in message
>> news:e7Q1S9mjHHA.460@TK2MSFTNGP05.phx.gbl...
>>> Stefan Koell wrote:
>>>> Hi,
>>>>
>>>> I want to start ps1 scripts over UNC paths or mapped network shares. I
>>>> tried to change the execution policy to unrestricted but I always get
>>>> the following prompt:
>>>>
>>>> Security Warning
>>>> Run only scripts that you trust. While scripts from the Internet can be
>>>> useful, this script can potentially harm your
>>>> computer. Do you want to run \\blablabla\bla?
>>>> [D] Do not run [R] Run once [S] Suspend [?] Help (default is "D"):
>>>>
>>>> This is bad! In my case these scripts are executed by scheduled tasks
>>>> or other management tools remotely so that the user input is no option.
>>>>
>>>> Here my questions:
>>>> * Can I disable this prompt? If so, all is good again - but I fear it's
>>>> not that simple?!
>>>> * Can I somehow specify a trusted location (like caspol.exe offers in
>>>> the dotnet framework)?
>>>> * Do I have to sign all my scripts?
>>>> * Do I have to buy a certificate to sign my scripts?
>>>> * I have no CA installed in our domain, can I do codesigning - ie
>>>> creating certificates somehow - using standard active directory
>>>> functionality without having a CA installed?
>>>> * Is there a "good" documentation about signing? I read a lot about
>>>> self-signing scripts but this is in our environment not very
>>>> practicable (deployment of certificates for all sorts of users
>>>> accounts). What do I have to do if I get some of these codesigning
>>>> certificates?
>>>>
>>>> Please, can someone help me out here?
>>>>
>>>> Thanks in advance
>>>>
>>>> Stefan
>>>
>>> Try running 'set-psdebug -off'. Assuming that is OK...
>>>
>>> Marco
>>
>

Brandon Shell wrote:
> If you check in IE -> Internet Options -> Security - Local Intranet.
> Make sure all the check boxes are checked.
>
> If the check box is not check UNC paths are consider Internet Zone and
> not Intranet.
>
> p.s. Not sure why Unrestricted still checks, but This could fix it.

I'm suprised... How does the IE zone settings affect how PowerShell runs
its own scripts?! This documented somewhere?

Marco

Its not really powershell... its the machine as a whole. AFAICT anything
that references ZONEs uses IE zones (registry to be more specific)

Can you right click the file and see if it is blocked? (Vista/Longhorn) or
you can Look at the ADS of the file.

"Marco Shaw" <marco.shaw@_NO_SPAM_gmail.com> wrote in message
news:e95TPRnjHHA.3708@TK2MSFTNGP04.phx.gbl...
> Brandon Shell wrote:
>> If you check in IE -> Internet Options -> Security - Local Intranet.
>> Make sure all the check boxes are checked.
>>
>> If the check box is not check UNC paths are consider Internet Zone and
>> not Intranet.
>>
>> p.s. Not sure why Unrestricted still checks, but This could fix it.
>
> I'm suprised... How does the IE zone settings affect how PowerShell runs
> its own scripts?! This documented somewhere?
>
> Marco

> Then I type (without the surrounding quotes) ".
> \\someserver\someshare\sompath\some.ps1"
> where the some.ps1 just contains a write-host "Hello World"
>
> and then I get the security warning.
>
> Any ideas? Am I doing something wrong? I have to admit I am still a PS
> newbie...
>

The thing is, that remote some.ps1 script could then turn back on
'set-psdebug -step' in its first line, then possibly turn it back off in
its last line...

Try 'get-content \\someserver\someshare\sompath\some.ps1' to see if you
can read the script.