Once in awhile, we get questions about the best practice for PowerShell’s execution policy when it is included as part of a standard desktop image.
This is one of the main reasons that PowerShell ships with a “Restricted” execution policy. Since you have to explicitly enable or install PowerShell, we’ve frequently been asked why we aren’t more permissive by default. After all, you did just install / enable it! The reason is that separating the execution policy decision from the installation decision gives you a lot more freedom on installing PowerShell. It lets you push PowerShell to your whole enterprise via SMS (or include on a standard image,) and then later selectively configure the Execution Policy via Group Policy or other mechanisms.



