Change PowerShell ExecutionPolicy to RemoteSigned (#4071)

Change PowerShell ExecutionPolicy to RemoteSigned when executing embedded scripts.
microsoft · Dec 1, 2022 · 0be1c41 · 0be1c41
1 parent 550a7d4
commit 0be1c41
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/src/Agent.Worker/DiagnosticLogManager.cs b/src/Agent.Worker/DiagnosticLogManager.cs
@@ -583,7 +583,7 @@ private async Task<string> GetLocalGroupMembership()
 
             string scriptFile = Path.Combine(HostContext.GetDirectory(WellKnownDirectory.Bin), "powershell", "Get-LocalGroupMembership.ps1").Replace("'", "''");
             ArgUtil.File(scriptFile, nameof(scriptFile));
-            string arguments = $@"-NoLogo -Sta -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -Command "". '{scriptFile}'""";
+            string arguments = $@"-NoLogo -Sta -NoProfile -NonInteractive -ExecutionPolicy RemoteSigned -Command "". '{scriptFile}'""";
 
             try
             {

diff --git a/src/Microsoft.VisualStudio.Services.Agent/Capabilities/PowerShellCapabilitiesProvider.cs b/src/Microsoft.VisualStudio.Services.Agent/Capabilities/PowerShellCapabilitiesProvider.cs
@@ -25,7 +25,7 @@ public async Task<List<Capability>> GetCapabilitiesAsync(AgentSettings settings,
             string powerShellExe = HostContext.GetService<IPowerShellExeUtil>().GetPath();
             string scriptFile = Path.Combine(HostContext.GetDirectory(WellKnownDirectory.Bin), "powershell", "Add-Capabilities.ps1").Replace("'", "''");
             ArgUtil.File(scriptFile, nameof(scriptFile));
-            string arguments = $@"-NoLogo -Sta -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -Command "". '{scriptFile}'""";
+            string arguments = $@"-NoLogo -Sta -NoProfile -NonInteractive -ExecutionPolicy RemoteSigned -Command "". '{scriptFile}'""";
 
             string enablePrereleaseVSVersions = AgentKnobs.EnableVSPreReleaseVersions.GetValue(UtilKnobValueContext.Instance()).AsString();
             Environment.SetEnvironmentVariable("IncludePrereleaseVersions", enablePrereleaseVSVersions);