Powershell Get-Itemproperty returns wrong value

Question

Powershell Get-Itemproperty returns wrong value

Andreas Lundgren 1

Hello all,
I am working on a script to test computers for compliance to a set of specifications.
One of these is that the computer must have the Powershell executionpolicy set to "Remotesigned".
This is that part of the script:

$policy=Get-ItemProperty HKLM:\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell -Name ExecutionPolicy  
$policy32=Get-ItemProperty HKLM:\SOFTWARE\WOW6432Node\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell -Name Executionpolicy

The problem is that $policy returns "Unrestricted" even if the registry says otherwise:

Also, Get-ExecutionPolicy run locally returns "RemoteSigned" as it should.
The script is pushed to the computer by a MDM program and is executed as SYSTEM, 64-bit.
When run locally as administrator, it produces the correct result.
Unfortunately I am stuck running with SYSTEM and can't run as any other user.
I've drawn the conclusion that the execution as SYSTEM has something to do with it but I can't figure out how and why. Any ideas?

Anonymous

2021-03-24T09:45:49.957+00:00

Did you run the command on the local computer or the remote computer?
Andreas Lundgren 1 Reputation point

2021-03-24T10:03:23.887+00:00

The script is transferred to the computer by a MDM agent on the same computer and executed by the same agent, so from the perspective of the script it is local. When done this way it is run as SYSTEM in a 64-bit context and returns wrong data, "Unrestricted".
The exact same script run as local administrator returns "RemoteSigned" as expected.
Anonymous

2021-03-25T07:14:11.77+00:00
I'm not sure if the result is retrieved from the local computer. What about the ComputerName?

Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName -Name ComputerName