Execution Policy RemoteSigned interpreted differently in pwsh7.1 / Unblock-File does not work

[DEberhardt]

Invoking Pester (v5.1.0-beta 2) on Pwsh 7.1.0-rc.2 leads to different behaviour regarding Execution Policy RemoteSigned and Unblock-File

Reading about_execution_policies RemoteSigned should allow files to run that have been unblocked, yet exeucting the same files (which are located on my local home server) yields two different results:

Steps to reproduce

Executing Invoke-Pester with files that are not digitally signed, not on a this machine but also not downloaded (i.E. I have written these in the same environment with VSCode...

invoke-pester #errors
unblock-file \\Server\Share\File.ps1 #no output, i.E. OK
invoke-pester #still errors

I have had also tried a Get-ChildItem *.ps1 -Recurse | Unblock-File which did the same (nothing)

Expected behavior

Same environment, when my code base is on my local machine. Works.
Same environment in PowerShell 5.1. Works.

invoke-pester

Starting discovery in 4 files.
Discovery finished in 469ms.
Testing 'TeamsFunctions' in path '\\SERVERNAME\Share\Code\Personal\TeamsFunctions'
[ASSERT ] ERROR: You must call the Connect-SkypeOnline cmdlet before calling any other cmdlets.
[ASSERT ] INFO:  Connect-Me can be used to disconnect, then connect to SkypeOnline, AzureAD & MicrosoftTeams in one step!
[ASSERT ] ERROR: You must call the Connect-SkypeOnline cmdlet before calling any other cmdlets.
[ASSERT ] INFO:  Connect-Me can be used to disconnect, then connect to SkypeOnline, AzureAD & MicrosoftTeams in one step!
[+] Enable-TeamsUserForEnterpriseVoice.Tests.ps1 89ms (11ms|59ms)
[+] Show-FunctionStatus.Tests.ps1 89ms (2ms|68ms)
[+] Format-StringForUse.Tests.ps1 173ms (84ms|65ms)
Tests completed in 12.66s
Tests Passed: 779, Failed: 0, Skipped: 0 NotRun: 0

Actual behavior

invoke-pester

Starting discovery in 4 files.
System.Management.Automation.PSSecurityException: File \\SERVERNAME\Share\Code\Personal\TeamsFunctions\Private\Tests\Enable-TeamsUserForEnterpriseVoice.Tests.ps1 cannot be loaded. The file \\SERVERNAME\Share\Code\Personal\TeamsFunctions\Private\Tests\Enable-TeamsUserForEnterpriseVoice.Tests.ps1 is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at https://go.microsoft.com/fwlink/?LinkID=135170.
 ---> System.UnauthorizedAccessException: File \\SERVERNAME\Share\Code\Personal\TeamsFunctions\Private\Tests\Enable-TeamsUserForEnterpriseVoice.Tests.ps1 cannot be loaded. The file \\SERVERNAME\Share\Code\Personal\TeamsFunctions\Private\Tests\Enable-TeamsUserForEnterpriseVoice.Tests.ps1 is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at https://go.microsoft.com/fwlink/?LinkID=135170.
   --- End of inner exception stack trace ---
   at System.Management.Automation.ExceptionHandlingOps.CheckActionPreference(FunctionContext funcContext, Exception exception)
   at System.Management.Automation.Interpreter.ActionCallInstruction`2.Run(InterpretedFrame frame)
   at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
   at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
   at System.Management.Automation.Interpreter.Interpreter.Run(InterpretedFrame frame)
   at System.Management.Automation.Interpreter.LightLambda.RunVoid1[T0](T0 arg0)
   at System.Management.Automation.PSScriptCmdlet.RunClause(Action`1 clause, Object dollarUnderbar, Object inputToProcess)
   at System.Management.Automation.PSScriptCmdlet.DoEndProcessing()
   at System.Management.Automation.CommandProcessorBase.Complete()
at <ScriptBlock>, C:\Program Files\WindowsPowerShell\Modules\Pester\5.1.0\Pester.psm1: line 2899
at Invoke-File, C:\Program Files\WindowsPowerShell\Modules\Pester\5.1.0\Pester.psm1: line 2908
at Invoke-BlockContainer, C:\Program Files\WindowsPowerShell\Modules\Pester\5.1.0\Pester.psm1: line 2833
at Discover-Test, C:\Program Files\WindowsPowerShell\Modules\Pester\5.1.0\Pester.psm1: line 1407
at Invoke-Test, C:\Program Files\WindowsPowerShell\Modules\Pester\5.1.0\Pester.psm1: line 2352
at Invoke-Pester<End>, C:\Program Files\WindowsPowerShell\Modules\Pester\5.1.0\Pester.psm1: line 4753
at <ScriptBlock>, <No file>: line 1

Environment data

Name                           Value
----                           -----
PSVersion                      7.1.0-rc.2
PSEdition                      Core
GitCommitId                    7.1.0-rc.2
OS                             Microsoft Windows 10.0.19041
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

[DEberhardt]

Also posted this on Pester, for awareness #1736

Is there a command to verify whether a file is currently blocked?
I have not found any and Get-Command -Noun File only yields 2 results. (Get-ChildItem also does not have IsBlocked or IsUnblocked as a parameter either...)

Was Block-File or Get-File or Test-File never thought of?

[vexx32]

What's the result from the WinPS and pwsh sessions for Get-ExecutionPolicy -List?

[DEberhardt]

[rkeithhill]

To see if a file is blocked, run this:

get-item <path> -Stream Zone.Identifier

Or

get-item <path> -Stream * | % Stream

If the stream exists, then check the content of that stream:

PS> get-content <path> Stream Zone.Identifier
[ZoneTransfer]
ZoneId=3

If the ZoneId is 3 (or 4), then the file is blocked.

[mklement0]

If you want to inspect an entire directory (tree) at once (for a single directory, you can omit the Get-ChildItem call and pass * to Get-Item):

Get-ChildItem -File -Recurse | Get-Item -ea Ignore -Stream Zone.Identifier | select Filename, @{ n='StreamContent'; e={ $_ | Get-Content } }

[DEberhardt]

Thank you! This is helpful. However, Ran it, came back empty (nothing blocked?) and still fails with System.Management.Automation.PSSecurityException

[rkeithhill]

Try starting PowerShell 7 like so from the Windows + R run dialog:

pwsh-preview -executionPolicy bypass

Then try Pester. Does it still fail the same way?

Another experiment to try - if your test files are not on a share (copy them to a local folder), does Pester still fail when run without the bypass used above?

[DEberhardt]

With Bypass, it works normally.
Running it from a local source, also is successful.
The combination of RemoteSigned and local share results in the error (despite no files being blocked...)

[rkeithhill]

Is it possible your network share is defined to be in the internet security zone?

[iSazonov]

It is by-design because now we can not use IE API #7458 (comment)

Workaround is to set ByPass policy.