PowerShell Execution Policies and Running Scripts from C#

Understanding PowerShell Execution Policies

PowerShell is a powerful task automation and configuration management framework from Microsoft. A key security feature of PowerShell is its execution policy, which determines under what conditions PowerShell will load configuration files and run scripts. These policies are designed to prevent the execution of malicious scripts. If you encounter an error stating "cannot be loaded because running scripts is disabled on this system," it’s almost always related to the execution policy.

PowerShell has several built-in execution policies:

• Restricted: The default policy. Doesn’t allow any scripts to run.
• AllSigned: Only allows scripts signed by a trusted publisher to run.
• RemoteSigned: Allows locally created scripts to run without signature, but requires downloaded scripts from the internet to be signed. This is often a good balance between security and usability.
• Unrestricted: Allows all scripts to run. Use with extreme caution, as it bypasses all security checks.
• Bypass: Nothing is blocked, and there are no warnings or prompts. Primarily for use in automated scripting scenarios.

You can view the current execution policy using the following PowerShell command:

Get-ExecutionPolicy

Setting the Execution Policy

You must have administrator privileges to change the execution policy. To set the policy, use the Set-ExecutionPolicy cmdlet. The syntax is:

Set-ExecutionPolicy -ExecutionPolicy <PolicyName> -Scope <Scope>

• <PolicyName>: The execution policy you want to set (e.g., RemoteSigned, Unrestricted, Bypass).
• <Scope>: Determines who the policy applies to. Common scopes include:
  • CurrentUser: Affects only the current user.
  • LocalMachine: Affects all users on the computer. Requires administrator privileges.
  • Process: Affects only the current PowerShell process. This is a temporary change and won’t persist.
  • MachinePolicy / UserPolicy: Set by Group Policy.

Example:

To set the execution policy to RemoteSigned for the current user:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

Running PowerShell Scripts from C#

When you attempt to run a PowerShell script from a C# application using the System.Management.Automation namespace, the execution policy still applies. If the policy prevents the script from running, your C# application will encounter an error.

Here’s a basic example of how to run a PowerShell script from C#:

using System;
using System.Management.Automation;
using System.Collections.Generic;

class Program
{
    static void Main(string[] args)
    {
        PowerShell ps = PowerShell.Create();
        string scriptPath = "script.ps1"; // Replace with your script path

        try
        {
            ps.AddScript(scriptPath);
            var results = ps.Invoke();

            foreach (PSObject result in results)
            {
                Console.WriteLine(result);
            }

            foreach (ErrorRecord error in ps.Streams.Error)
            {
                Console.WriteLine($"Error: {error.ToString()}");
            }
        }
        catch (RuntimeException ex)
        {
            Console.WriteLine($"Error running script: {ex.Message}");
        }
        finally
        {
            ps.Dispose();
        }
    }
}

Important Considerations:

• Security: Avoid setting the execution policy to Unrestricted in production environments. RemoteSigned is often a good balance.
• Scope: Consider the scope carefully. Using CurrentUser limits the change to the current user, while LocalMachine affects all users.
• Temporary Bypass: For specific, automated tasks, you can temporarily bypass the execution policy for the current PowerShell process using -Scope Process -ExecutionPolicy Bypass. This is less persistent and generally safer than changing the global policy.
• Script Signing: For increased security, consider digitally signing your PowerShell scripts. This allows you to use the AllSigned execution policy and ensure the script hasn’t been tampered with.

By understanding PowerShell execution policies and their impact on running scripts from C#, you can effectively manage security and ensure your automation tasks run smoothly.