The error message "File [path].ps1 cannot be loaded because it is not digitally signed" is a common hurdle for developers and system administrators working within the Windows environment. This is not a bug or a technical failure of your installation; it is a deliberate security mechanism enforced by the Windows PowerShell Execution Policy. By default, Windows restricts the execution of scripts to prevent malicious code from running without the user's explicit consent.

To quickly resolve this, you can run the command Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser in an elevated PowerShell window. This allows locally written scripts to run while requiring a digital signature for any scripts downloaded from the internet. However, depending on your security requirements and whether you are in a corporate environment, you may need a more nuanced approach.

Understanding the PowerShell Execution Policy Framework

The PowerShell Execution Policy is a safety feature that determines which types of PowerShell scripts can be run on a system. It is important to clarify that this is not a security boundary that can stop a determined attacker—since the policy can be bypassed via command-line flags—but rather a "guardrail" to prevent users from accidentally executing untrusted code.

The Different Policy Levels

Windows defines several levels of execution policies, ranging from maximum restriction to completely open:

  1. Restricted: This is the default setting for Windows client computers. It permits individual commands to run but does not allow any scripts to execute, including configuration files (.ps1xml), network configuration files (.pssc), or PowerShell profile scripts (.ps1).
  2. AllSigned: Only scripts signed by a trusted publisher can run. This includes scripts you write on your local machine. If you use this policy, you must go through the process of signing every script before execution.
  3. RemoteSigned: This is the default policy for Windows servers. It allows scripts created on the local computer to run without a signature. However, scripts downloaded from the internet (including email and instant messaging) must be signed by a trusted publisher before they can be executed.
  4. Unrestricted: All scripts are allowed to run. For scripts downloaded from the internet that are not signed, PowerShell will prompt you for permission before running. This is generally discouraged for long-term use.
  5. Bypass: Nothing is blocked, and there are no warnings or prompts. This is typically used for automated tasks or temporary sessions where the script's source is fully trusted.
  6. Undefined: No policy is set for the specific scope. If all scopes are undefined, the effective policy defaults to Restricted.

The Hierarchy of Execution Policy Scopes

One reason many users fail to fix the "not digitally signed" error is that they apply the fix to the wrong scope. PowerShell checks policies in a specific order of precedence. If a higher-level scope is set (perhaps by your IT department), your local changes will be ignored.

The scopes, in order of precedence (highest to lowest), are:

  • MachinePolicy: Set by a Group Policy for all users of the computer.
  • UserPolicy: Set by a Group Policy for the current user.
  • Process: Affects only the current PowerShell session (window).
  • CurrentUser: Affects only the current user on the local machine.
  • LocalMachine: Affects all users on the local machine.

To see the active policies across all scopes, you should run: Get-ExecutionPolicy -List

If MachinePolicy or UserPolicy shows a value other than Undefined, you are likely on a managed corporate machine, and you will need administrative privileges or GPO changes to override these settings.

Quick Fix: Unblocking Specific Files

If you have a single script that you trust and want to run without changing your entire system's security posture, the safest method is to "unblock" that specific file.

When you download a file from the internet, Windows attaches an NTFS alternate data stream called "Zone.Identifier" to the file, marking it as coming from the "Internet Zone." PowerShell sees this marker and triggers the digital signature requirement under the RemoteSigned policy.

Method 1: Using File Explorer

  1. Locate the .ps1 file in your folder.
  2. Right-click the file and select Properties.
  3. On the General tab, look for the Security section at the bottom.
  4. Check the Unblock box and click OK.

Method 2: Using the Unblock-File Cmdlet

For those who prefer the command line or need to unblock multiple files, the Unblock-File cmdlet is highly efficient. Run the following command: