gpupdate /force If all else fails, run PowerShell in memory without invoking powershell.exe: Via WMI: wmic process call create "powershell -EncodedCommand <base64 command>" Via VBA / Office macros: CreateObject("WScript.Shell").Run "powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command ""...""", 0, False Via scheduled task (bypass many restrictions): schtasks /create /tn "TempTask" /tr "powershell -Command '...'" /sc once /st 00:00 /f schtasks /run /tn "TempTask" 8. Recovery When Completely Locked Out If you have physical or remote desktop access:
PowerShell can be "blocked" in several ways: execution policy, AppLocker, Device Guard, antivirus, or Group Policy. This guide covers each layer. 1. Identify the Type of Block First, determine how PowerShell is blocked. how to unblock powershell
# Sometimes works from cmd: powershell -Version 2 # PowerShell 2 might not be subject to same CLM rules gpupdate /force If all else fails, run PowerShell
// Compile and run this C# to get full language mode using System.Management.Automation; var ps = PowerShell.Create(); ps.AddScript("$ExecutionContext.SessionState.LanguageMode").Invoke(); If AppLocker blocks PowerShell.exe: Check AppLocker rules: Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty Rules | Where-Object $_.Action -eq 'Deny' Bypass techniques: Rename PowerShell.exe (if hash/cert rules not used): var ps = PowerShell.Create()