Is it safe to turn off ability to run scripts or at least set it to AllSigned?

Keep PowerShell at Restricted if scripts are never needed; use AllSigned only if you are prepared to obtain signed scripts and manage trusted publishers, but do not treat either setting as a complete security control.

PowerShell execution policy is a defense-in-depth safety feature, not a security boundary: a determined user or malicious process can bypass it, and it does not universally disable other script engines such as VBScript or JavaScript. Windows 11’s default PowerShell policy is Restricted, which allows interactive commands but blocks PowerShell script files. ^1^

Recommended configuration

First, open PowerShell and inspect every policy scope:

Get-ExecutionPolicy
Get-ExecutionPolicy -List

Then choose one of these configurations:

• No PowerShell scripts required: retain or set Restricted.
• Only centrally reviewed and signed scripts should run: use AllSigned.
• You create or regularly use local scripts: RemoteSigned is generally more practical, but offers less control because locally created scripts need not be signed.

For the current Windows user:

Set-ExecutionPolicy -ExecutionPolicy Restricted -Scope CurrentUser
# Or, if every script must be signed:
Set-ExecutionPolicy -ExecutionPolicy AllSigned -Scope CurrentUser

Get-ExecutionPolicy -List

AllSigned requires every PowerShell script, module, configuration file, and locally written script to be signed by a trusted publisher. It can still run a malicious script if that script has a trusted signature, so signing establishes publisher identity rather than guaranteeing safe content. ^2^

Important scope details:

• CurrentUser affects only your account.
• LocalMachine affects every user and requires PowerShell to be run as administrator.
• A Group Policy setting overrides locally configured scopes.
• Windows PowerShell 5.1 (powershell.exe) and PowerShell 7+ (pwsh.exe) store their policies separately, so inspect both if both are installed. ^3^

For stronger protection

If the objective is to prevent untrusted code rather than merely discourage accidental PowerShell script execution, use Windows application control:

1. Open Windows Security.
2. Select App & browser control.
3. Check whether Smart App Control is available.
4. If available, enable it and test the applications you normally use.

Smart App Control evaluates applications using Microsoft’s security service and signatures, blocking software it considers malicious or untrusted. Availability and suitability can vary, particularly for developers or users who frequently run unsigned tools. ^4^

For managed business devices, App Control for Business provides stronger, enforceable application and script control. With script enforcement enabled, it can block Windows Script Host scripts and constrain PowerShell scripts that are not permitted by policy. ^5^

Also retain the standard protections: keep Windows updated, leave Microsoft Defender and Tamper Protection enabled, keep User Account Control active, and heed SmartScreen warnings. ^6^

In short, Restricted is appropriate for a home PC that does not use PowerShell scripts. AllSigned is stricter but usually adds administrative inconvenience without providing an absolute security boundary; combine either policy with Defender, SmartScreen or Smart App Control, updates, and a non-administrator account for routine use.

References

1. Chapter 1 - Getting started with PowerShell
2. about_Execution_Policies
3. Set-ExecutionPolicy-Description
4. Smart App Control Frequently Asked Questions | Microsoft Support
5. Script enforcement with App Control for Business
6. Protect my PC from viruses | Microsoft Support