Automox Worklets on Windows run as NT AUTHORITY\SYSTEM, and the Automox agent launches Worklet PowerShell sessions with the Bypass execution policy. In most environments, no execution-policy change is required within the Worklet itself. However, an execution policy enforced through Group Policy can take precedence and prevent scripts from running.
Supported configurations
The following execution policies generally allow Automox Worklets to run:
-
Bypass: Nothing is blocked, and there are no warnings or prompts. -
RemoteSigned: Allows locally created scripts to run. Scripts downloaded from the internet must be signed by a trusted publisher unless they have been unblocked. -
Unrestricted: Allows scripts to run but may display a warning before running scripts identified as downloaded from the internet.
When an organization chooses to configure a persistent device-level execution policy, RemoteSigned provides more restrictions than Bypass or Unrestricted while still allowing locally created scripts to run.
The following policies can prevent unsigned Automox Worklet content from running:
Restricted-
AllSigned, unless all required scripts and supporting files are signed by a trusted publisher - A Group Policy setting that allows only signed scripts or disables script execution
Undefined is not itself a blocking policy. It means that no execution policy is configured at that scope. The effective policy depends on the other configured scopes and the Windows operating system.
Check the effective execution policy
Run the following command from PowerShell:
Get-ExecutionPolicy -List
PowerShell evaluates the scopes in the following order of precedence:
MachinePolicyUserPolicyProcessCurrentUserLocalMachine
If MachinePolicy or UserPolicy has a configured value, the setting is controlled through Group Policy and takes precedence over locally configured execution policies.
To display only the effective execution policy for the current PowerShell session, run:
Get-ExecutionPolicy
Change the local execution policy
When Group Policy is not enforcing the setting, run the following command from an elevated PowerShell window to configure RemoteSigned for all users of the device:
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine
Then confirm the configured and effective settings:
Get-ExecutionPolicy -List Get-ExecutionPolicy
The LocalMachine scope requires an elevated PowerShell session. A successful Set-ExecutionPolicy command might still not change the effective policy when a higher-precedence scope is configured.
If MachinePolicy or UserPolicy is configured, update the applicable Group Policy instead. A Worklet cannot override an execution policy enforced through Group Policy.