如何仅在未设置时执行PowerShell的Set-ExecutionPolicy？

问题描述 #

我尝试在脚本中执行以下命令设置PowerShell执行策略：

Set-ExecutionPolicy -scope CurrentUser RemoteSigned -Force -ea silent
Set-ExecutionPolicy RemoteSigned -Force -ea silent

但收到错误提示：

Set-ExecutionPolicy : Windows PowerShell updated your execution policy successfully, but the setting is overridden by a policy defined at a more specific scope. Due to the override, your shell will retain its current effective execution policy of Bypass. Type "Get-ExecutionPolicy -List" to view your execution policy settings.

于是我添加了判断逻辑，想在执行策略不是RemoteSigned时才运行设置命令：

if ($(Get-ExecutionPolicy) -ne "RemoteSigned") {
    Set-ExecutionPolicy -scope CurrentUser RemoteSigned -Force -ea silent
    Set-ExecutionPolicy RemoteSigned -Force -ea silent
}

但还是弹出同样的错误，原本以为会跳过if代码块。

之后我尝试修改MachinePolicy级别策略：

Set-ExecutionPolicy -Scope MachinePolicy Unrestricted

又出现报错：

Cannot set execution policy. Execution policies at the MachinePolicy or UserPolicy scopes must be set through Group Policy.

我的个人系统并未使用组策略或AD相关配置，执行Get-ExecutionPolicy -list的结果如下：

Scope ExecutionPolicy
        ----- ---------------
MachinePolicy       Undefined
   UserPolicy       Undefined
      Process       Undefined
  CurrentUser    RemoteSigned
 LocalMachine    RemoteSigned

请问如何实现仅在执行策略未设置时运行Set-ExecutionPolicy，已设置则跳过？

解决方案 #

问题根源 #

直接调用Get-ExecutionPolicy返回的是当前会话生效的执行策略（这里是Bypass），而非你设置的CurrentUser/LocalMachine级别策略。所以你的if判断条件会成立，代码块仍会执行，进而触发错误。

另外，报错提到的“更具体范围覆盖”，大概率是Process范围被临时设为Bypass（比如启动PowerShell时加了-ExecutionPolicy Bypass参数）——这个范围优先级高于CurrentUser/LocalMachine，所以即使你设置了后两个级别，当前会话生效的还是Process级的Bypass。

正确的判断与执行逻辑 #

要针对指定范围判断策略是否已设置，需用Get-ExecutionPolicy -Scope指定具体范围，再单独处理每个级别：

# 检查并设置CurrentUser级别策略
if ((Get-ExecutionPolicy -Scope CurrentUser) -ne "RemoteSigned") {
    Set-ExecutionPolicy -Scope CurrentUser RemoteSigned -Force -ErrorAction SilentlyContinue
}

# 检查并设置LocalMachine级别策略
if ((Get-ExecutionPolicy -Scope LocalMachine) -ne "RemoteSigned") {
    Set-ExecutionPolicy -Scope LocalMachine RemoteSigned -Force -ErrorAction SilentlyContinue
}

额外说明 #

1. Process范围的Bypass：该级别仅对当前PowerShell会话有效，关闭会话后自动失效。若不想让它生效，下次启动PowerShell时不要添加-ExecutionPolicy Bypass参数即可，无需修改设置。
2. MachinePolicy报错：MachinePolicy和UserPolicy由组策略控制，个人系统默认是Undefined，无法通过Set-ExecutionPolicy修改，无需理会该报错。

内容的提问来源于stack exchange，提问作者YorSubs