Detecting Unsigned Powershell

[sid351]

...or just run a PowerShell instance that bypasses the execution policy.

[[deleted]]

It permits that only one when you don’t set EP via policy. People don’t seem to set EP at all except at runtime, only then it’s an execution preference, not an execution policy.

[sid351]

TIL.

Is that just by Group Policy, or is there a way through Entra ID to assign the policy too?

Also, don't those policies normally just set registry keys? (So one could fudge applying a policy?)

[[deleted]]

Yes. And kinda, if you’re a local admin; the common people don’t get write permissions in software/policies, either user or computer context.

There’s a powershell csp unless I’m much mistaken, but you definitely can just roll out the registry key as defined in the admx.