Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to propose to the IT department at my organization that we enable PowerShell remoting on our production machines to make administering them easier. I feel that unrestricted access would be much easier than dealing with signing:

>Set-ExecutionPolicy Unrestricted

Is this a big no-no for production machines? Would this open up a major security hole, or would it be safely restricted to those who already only have administrative privileges on the machine?

share|improve this question
up vote 5 down vote accepted

Personally, I would go with RemoteSigned instead of Unrestricted. You can read about the differences here.

This is the snippet that matters:

-- RemoteSigned: Requires that all scripts and configuration files downloaded from the Internet be signed by a trusted publisher.

-- Unrestricted: Loads all configuration files and runs all scripts. If you run an unsigned script that was downloaded from the Internet, you are prompted for permission before it runs.

RemoteSigned will still let you run in-house scripts without signing, but items distributed via the Internet has to be signed.

All that being said, do you really need to run the actual scripts on the servers? If you're running management tasks from your workstation that modify a server, you don't need to set any of that. These settings only affect scripts run locally on the machine in question.

share|improve this answer
The reason I'd like to run the scripts on the machine is that they'll invoke old .js files that would be a hassle to rewrite and test in PowerShell. Your answer was very helpful and I think RemoteSigned is the way to go. Thanks! – Evan M Sep 22 '11 at 19:53
If you trust everyone all the time to the point that all users NEVER click on stuff and get PWN3D then it could be acceptable, but for the most part, always verify and then trust. Remember it's always one or the other, Secure OR convenient. It can't be both, it's a sliding scale between one or the other. – Brad Nov 22 '15 at 3:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.