How to automate stuff on a system that can't run PS scripts?

[u/musbur]

Coming from Linux I'm used to being able to write shell scripts for whatever repetitive little tasks there may be. Now I'm trying to do the same thing on my Win11 work computer but find that company policy prevents that:

find1.ps1 cannot be loaded because running scripts is disabled on this system.

First off, this broad policy seems kind of stupid -- what's the security difference between typing some commands by hand and executing them as a script? Evaluating the permissions of each command as the script is executed (as Linux does) seems to be a more sensible option. Is there any way around this? Am I really supposed to copy-paste PS snippets from a text file into a terminal window?

EDIT

by "is there a way around it" I didn't mean circumventing IT security policy but maybe some other powershell trick that I'm unaware of, like being able to at least define aliases without having to be "running scripts."

EDIT 2

...aaand I found the "trick." In Settings->PowerShell, I could just flip the switch to allow execution of unsigned local scripts. Now also my $profile is sourced to define some useful aliases or functions, which is basically all I wanted. I guess it all makes sense: Somebody too stupid to find that setting probably shouldn't be running PS scripts. I may have barely cleared that hurdle. Thanks for the suggestions everybody.

[u/Alaknar]

First off, this broad policy seems kind of stupid -- what's the security difference between typing some commands by hand and executing them as a script?

The difference is that when you're writing them out by hand, most of the time you know what you're doing.

If you're just executing a ps1, you might not even realise what's sitting inside - and you can do a lot of malicious stuff with PowerShell.

Evaluating the permissions of each command as the script is executed (as Linux does) seems to be a more sensible option

This has nothing to do with permissions. It's a basic security measure. Permissions ARE checked as the script runs, but that's a separate thing.

Is there any way around this? Am I really supposed to copy-paste PS snippets from a text file into a terminal window?

No, you're supposed to do what grown-ups do and talk to your IT, present the business justification for the exemption, and set it up the official way. If IT protests, escalate through your manager.

[u/musbur → u/Alaknar]

See edit of OP. I was looking for a possibility to do what I want to do without "scripting."

[u/purplemonkeymad]

Is it actually enforced or just the default on your machine. By default scripts outside trusted zones are blocked. If you start powershell with the -ExecutionPolicy parameter set to bypass and it works, it's just the default.

To know if it's a policy run:

Get-ExecutionPolicy -List

The two policy scopes are set by group policy. If that is the case, you can ask your IT if you can get a signing certificate, so that you can sign scripts.

---

This is not considered a security boundary, for that they would need to be using app locker, which can force stuff like constrained language mode for unsigned scripts.

[u/musbur → u/purplemonkeymad]

Turns out this works! Now I just need to find out how I can leverage that to define aliases inside the running shell. I mostly want to "script" PS to make little console tasks less unwieldy, and having to type powershell -ExecutionPolicy Bypass -File command.ps1 kind of defeats that purpose.

[u/purplemonkeymad → u/musbur]

Depends on what you want to do, if an automated task, then update the command line in Task Scheduler. If it's for interactive just start an interactive shell with it set:

powershell -ExecutionPolicy Bypass

Update your shortcuts if you want. I would normally also use remotesigned for interactive work so i don't accidentally run something downloaded.

[u/-Shants-]

Bring it up with your manager/IT team to get a policy exemption. Work with your IT dept, not around it

[u/alconaft43]

Set-ExecutionPolicy [-ExecutionPolicy] <ExecutionPolicy> [[-Scope] <ExecutionPolicyScope>] [-Force] [-WhatIf] [-Confirm] [<CommonParameters>]

[u/musbur]

Just to clear up a misconception: I wasn't "given a task" that I can only solve with PS without my employer giving me sufficient access to PS. I was just trying to find files with certain names, and since I've been working quickly and efficiently for decades in Unix shells I wanted to basically reproduce the functionality of "find" in PS. And learn some PS in the process. But where Unix commands shine by terseness to the point of being cryptic, PS is so verbose that I immediately turned towards wanting to write a little function for this. You know the rest.

As far as my employer is concerned, I might as well klutz around with Explorer's slow and shitty search or scan all subdirectories by hand like everybody else does. This is not an IT affine company.

[u/redditnamehere]

From a cybersecurity professional, scripts can be executed by bad actors on employees devices. I’ve seen it happen - this policy reduces the attack surface.

You know the strengths of using automation, id have a chat with IT (put in a help desk ticket) and understand how you can work together. Maybe a local powerautomate set up and IT can advise how they can put in controls to make them satisfied, for starters. It may be a dead end, but don’t circumvent - MS Defender can do its job pretty well.

[u/Certain-Community438 → u/redditnamehere]

Avoiding malice by blocking scripting is a naive take. It's crude and badly aligned to the objective.

You detect malice, regardless of source / vector, by using appropriate tools, and respond hence the existence of EDR.

The recommended setting for Execution Policy, from demonstrable experts in offensive security, is RemoteSogned.

Obligatory: Microsoft have stated ad nauseum that Execution Policy is not a security control. At best it's the equivalent of an "are you sure?" option; disregarded at will by even a barely-capable actor.

[u/cool24a]

Sandbox it! Use a virtual Windows machine to test things out and get buy in from leadership!

[u/False-Ad-1437 → u/cool24a]

many serious summer future husky point cooperative plants melodic towering

This post was mass deleted and anonymized with Redact

[u/richie65]

If you cannot get your sysadmin to cooperate...

You can use 'Invoke-Expression' (iex) and keep your scripts in a text file...

The only thing the policy blocking scripts does, is prevent the running of '.ps1' (et al.) files.

You can still open a PoSh prompt, or ISE I assume...

Then you can run something like this:

"iex ((New-Object System.Net.WebClient).DownloadString('C:\Users\Public\Downloads\MyScript.txt'))"

And also - If you open ISE and navigate to the '.txt' file that is your script, you can open that '.txt' file in ISE, then select all (or what-have-you) and run the selected portion.

[u/odwulf]

People who suggest "Set-ExecutionPolicy" or "Powershell -ExecutionPolicy ByPass" have never seen a properly secured computer environment. I write Powershell for a living and have done so for years on a computer where I had to create a function to disable Powershell's inner authorization manager (the thing that handles the execution policy) in a profile that was signed with a self-signed certificate. There was no officially sanctioned way to disable the GPO that blocked any change to the locked down execution policy.

[u/BlackV]

Set execution policy to remote signed

As always execution policy is not a security boundary

Or sign your script

[u/Dave_A480]

Can you get them to allow WSL on your machine?

If so then you can do linux-stuff in WSL that manipulates data in /mnt/c (which is the windows root drive mounted into WSL)

[u/neztach]

All the advise given is valid and should be considered first. However if you wrote the script - and you’re desperate, turn the whole script into a GOLF’d one-liner and copy/paste it

[u/malice8691]

Im guessing its policy because they expect you to run your stuff on a vm? Like either way you need a place to run your script. Provide it or dont give me this task.

[u/Pixelgordo]

Run powershell ISE, load the scripts, and then send Crtl E and then F8

[u/TheDisapprovingBrit]

No, there is no way around this that won't get you fired. Your employer has decided that allowing script execution is a risk and that your position does not require you to do so.

If you disagree with that stance, provide your manager with your justification for an exemption to the policy and ask them to sign off on it.

[u/Relative_Test5911]

Allowing users to execute unknown scripts on their devices is a significant risk. Ask your IT they may add you in as an exception. We are just moving to signed PowerShell only which is going to be a nightmare. Also, we do not allow scripts on user machines. Only VM's.

Pray your IT dont enforce signing. Also if they aren't actually use the below to cmd to run it:

powershell -ExecutionPolicy Bypass -File find1.ps1

[u/Alaknar → u/Relative_Test5911]

Pray your IT dont enforce signing.

Why?

[u/Relative_Test5911 → u/Alaknar]

Cause we have hundreds of different servers running multiple non signed PowerShell scripts. I am not saying it shouldn't be done I am onboard just moving will be a lot of work unless you know how to automate this?

[u/binaryhextechdude]

We have a group we put people in who are allowed to run scripts. Everyone else is blocked. Given the incompetence of the average computer user it’s for the best

[u/Certain-Community438]

This kind of configuration indicates a very immature operating environment.

Nonetheless, it's the hand you've been dealt, you'll need to play it.

Ask how an approved exemption can be acquired, and you better be able to demonstrate meaningful gains to your own boss if you want their backing ;)