Set-ExecutionPolicy Unrestricted in Intune Powershell

Question

Set-ExecutionPolicy Unrestricted in Intune Powershell

stavros mitchell 56

Hello we are setting up a script in the Intune Script Tab. The script needs to be run with Set-ExecutionPolicy Unrestricted before executing
Is there a way to do this from intune?

thanks for the help

Ryan Hogan 0 Reputation points

2023-05-09T16:27:18.68+00:00
You can use a .bat file (UGH) to set the execution policy and then run the script. Package the .bat and Powershell file up in the .intunewin file and set this as your install: cmd.exe c/ "Batchfilename.bat"

In the .bat, might be something like this:

@echo off powershell -command "& {Set-ExecutionPolicy -ExecutionPolicy bypass -Force}" powershell.exe -file "POWERSHELLFILE.ps1" -executionpolicy bypass

5 answers

Your answer

Ryan Hogan 0 Reputation points

2023-05-09T16:27:18.68+00:00

You can use a .bat file (UGH) to set the execution policy and then run the script. Package the .bat and Powershell file up in the .intunewin file and set this as your install: cmd.exe c/ "Batchfilename.bat"

In the .bat, might be something like this:

@echo off powershell -command "& {Set-ExecutionPolicy -ExecutionPolicy bypass -Force}" powershell.exe -file "POWERSHELLFILE.ps1" -executionpolicy bypass

Answer 1

Nick Hogarth 3,521 Volunteer Moderator

Have you tried packaging it using the Intune win32 app method, and then having the install command like powershell.exe -ExecutionPolicy Bypass -File .\Script.ps1 ?

Answer 2

Jason Sandys 31,406 Microsoft Employee Moderator

Buy a signing certificate. Sign your scripts. Anything is like leaving your front door wide open.

Answer 3

Ian V 21

I am in the same situation.

Windows 10 20H2 machine, joined to Azure AD, and managed via MEM (Intune).

Current PowerShell Execution Policy is Undefined, which means None.

If I run a signed script, it still produces an error "cannot be loaded because running scripts is disabled on this system".

I need a way to set the LocalMachine policy to AllSigned via policy or script from Intune, thus applying to a group of machines.

Answer 4

Jason Sandys 31,406 Microsoft Employee Moderator

There's no direct way to do this today to my knowledge although you could create a Win32 app that runs powershell.exe with the -command option and calls the Set-ExecutionPolicy cmdlet. This isn't subject to the execution policy as far as I know.

In the near future, all built-in ADMXs will be unblocked though, and you'll thus be able to use the PowerShell ADMX.

Ian V 21 Reputation points

2021-06-22T22:50:07.707+00:00

Thank you for your response.

So is that why my PowerShell ADMX wasn't working either? Cause there's a block somewhere? I wonder if that's documented.

I've currently tried running an Intune Script (signed as well) that runs "Set-ExecutionPolicy -ExecutionPolicy AllSigned -Scope MachinePolicy -Force" but haven't had success.
I may try the Win32 approach.

Answer 5

Cause there's a block somewhere?

Correct. Windows has always blocked registry values corresponding to many/most standard group policies from being set by an MDM. This is documented in the ADMX ingestion docs; however, this is set to change soon. See https://techcommunity.microsoft.com/t5/intune-customer-success/the-latest-in-group-policy-settings-parity-in-mobile-device/ba-p/2269167.

I've currently tried running an Intune Script

You can't use something that is blocked to unblock itself. Chicken meet egg.

Share via

Set-ExecutionPolicy Unrestricted in Intune Powershell

5 answers

Your answer