#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Set PowerShell execution policy to Bypass for the machine. Persists across reboots.

.DESCRIPTION
    Writes ExecutionPolicy = Bypass for:
      - Windows PowerShell 5.1, 64-bit
      - Windows PowerShell 5.1, 32-bit (WOW64), if the key exists or can be created
      - PowerShell 7+, if pwsh.exe is on PATH

    LocalMachine is the persistent scope. Process dies with the window.
    CurrentUser only covers one account.

    Group Policy wins over this. If "Turn on Script Execution" is set,
    these writes are ignored and Get-ExecutionPolicy -List shows a
    MachinePolicy or UserPolicy value.

    This file cannot launch itself under Restricted. Start it once with:
      powershell -NoProfile -ExecutionPolicy Bypass -File .\Set-ExecutionPolicyBypass.ps1
#>

Set-ExecutionPolicy -Scope Process Bypass -Force
$ErrorActionPreference = 'Stop'

$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
$principal = New-Object Security.Principal.WindowsPrincipal($identity)
if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    throw 'Run this script from an elevated PowerShell window.'
}

function Set-PolicyValue {
    param([string]$Path)
    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }
    New-ItemProperty -LiteralPath $Path -Name ExecutionPolicy -Value Bypass -PropertyType String -Force | Out-Null
    $now = (Get-ItemProperty -LiteralPath $Path -Name ExecutionPolicy).ExecutionPolicy
    Write-Host ("{0} = {1}" -f $Path, $now)
}

Write-Host 'Setting LocalMachine execution policy to Bypass...'

Set-ExecutionPolicy -Scope LocalMachine Bypass -Force
Write-Host ("5.1 current process: {0}" -f (Get-ExecutionPolicy -Scope LocalMachine))

Set-PolicyValue -Path 'HKLM:\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell'
Set-PolicyValue -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell'

$pwsh = Get-Command pwsh -ErrorAction SilentlyContinue
if ($pwsh) {
    Write-Host "Setting PowerShell 7 policy via $($pwsh.Source)"
    & $pwsh.Source -NoProfile -ExecutionPolicy Bypass -Command "Set-ExecutionPolicy -Scope LocalMachine Bypass -Force; Get-ExecutionPolicy -List | Out-String"
} else {
    Set-PolicyValue -Path 'HKLM:\SOFTWARE\Microsoft\PowerShellCore\1\ShellIds\Microsoft.PowerShell'
    Write-Host 'pwsh.exe not on PATH. Wrote the PowerShell 7 LocalMachine key anyway.'
}

Write-Host ''
Write-Host 'Effective policy in this window (open a new window to confirm):'
Get-ExecutionPolicy -List | Format-Table -AutoSize | Out-String | Write-Host

$gpo = Get-ExecutionPolicy -List | Where-Object { $_.Scope -match 'Policy$' -and $_.ExecutionPolicy -ne 'Undefined' }
if ($gpo) {
    Write-Warning 'MachinePolicy or UserPolicy is set. Group Policy overrides LocalMachine. This script did not change that.'
}