How to configure Group Policy "Turn on script execution" for Windows 10 LTSB 2016?

Question

How to configure Group Policy "Turn on script execution" for Windows 10 LTSB 2016?

Rafał Łakus 0

Hello!

I am having trouble setting the "Turn on script execution" option in Group Policy -> User Configuration -> Administrative Templates on Windows 10 LTSB 2016. No matter if I choose "Disabled" or "Enabled," it has no effect. When I run Get-ExecutionPolicy -list, the setting shows as "Undefined" for several categories. It works when I set the setting in Group Policy -> Computer Configuration -> Administrative Templates instead.

I have no issues on Windows 7 x64, Windows 10 LTSB 2019, and LTSB 2021 with the "User configuration." Is this a bug in the system? Any help would be greatly appreciated. Thank you.

Anonymous

2024-05-10T13:44:13.1566667+00:00

Hello Rafał Łakus,

Thank you for posting in Q&A forum.

I have done a test in my lab, on Windows server 2022.

No matter I have enabled this policy under user configuration or under computer configuration, I will get the same result after running command Get-ExecutionPolicy -list.

But I can see this policy is enabled via gpresult file when I configure it under user configuration.

For checking User Configurations within gpresult, we can follow steps below.

Logon the machine using normal domain user account (that applies this gpo).

Create a folder named F1 in C drive.

Open CMD (do not run as Administrator).

Type gpresult /h C:\F1\gpo.html and click Enter.

Open gpo.html and check if there are these gpo settings under "User Details".

Would you please check if the user can run the scripts selected in the drop-down list after you enabled it under user configuration.

If you enable this policy setting, the scripts selected in the drop-down list are allowed to run.

The "Allow only signed scripts" policy setting allows scripts to execute only if they are signed by a trusted publisher.

The "Allow local scripts and remote signed scripts" policy setting allows any local scrips to run; scripts that originate from the Internet must be signed by a trusted publisher.

The "Allow all scripts" policy setting allows all scripts to run.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Rafał Łakus 0 Reputation points

2024-05-10T13:55:21.2766667+00:00

Hi Daisy,

Thank for your answer however the problem still exists.

I'm talking specifically about the WIndows 10 LTSB 2016.

Performing tests on the other systems I mentioned, I got the same result as you - everything was set correctly.

The exception is LTSB 2016.

After extracting the Policy to the html file with the gpresult /h command I see the rule is set.
On the UI in gpedit.msc, I can also see my setting.

However, when "checking get-executionpolicy -list", this is not reflected, and ultimately the setting does not work for a different test users with different policies.

The system behaves as if it had not been set, i.e. it blocks PowerShell scripts from running by default.

Info - I'm using local user accounts for this test.

Regards
Rafal
Anonymous

2024-05-13T14:03:56.2166667+00:00

Hello

Good day!

If the issue occurs on more Windows 10 LTSB 2016 machines (or all the Windows 10 LTSB 2016 machines), maybe it is an issue.

You can feedback this issue via Feedback Hub on the machine.

Best Regards,
Daisy Zhou