Security Warning on downloaded releases of MSO-Scripts

[rayfo]

Download, unzip, and run a recent release of MSO-Scripts.
If the current execution policy is RemoteSigned then it says:

File <path>\TraceCPU.ps1 cannot be loaded. The file <path>\TraceCPU.ps1 is not digitally signed.
You cannot run this script on the current system. For more information about running scripts
and setting execution policy, see about_Execution_Policies at
https://go.microsoft.com/fwlink/?LinkID=135170.

Otherwise it says:

Security warning
Run only scripts that you trust. While scripts from the internet can be useful,
this script can potentially harm your computer.
If you trust this script, use the Unblock-File cmdlet to allow the script to run
without this warning message. Do you want to run <path>\TraceCPU.ps1?
[D] Do not run  [R] Run once  [S] Suspend  [?] Help (default is "D"): d

In fact, you get this warning for each of the .ps1 files executed:
TraceCPU.ps1, INCLUDE.ps1, INCLUDE.WPA.ps1, etc.
This is because PowerShell (since Powershell v5) detects that the script files have an alternate data stream: Zone.Identifier
The Unblock-File cmdlet (since Powershell v3) is able to remove the Zone.Identifier.

Also, the Zone.Identifier affects which Execution Policy you can use to run the scripts directly from PowerShell. You can't use Remote-Signed in this case.

So I see these options:

1. Leave it as-is, and document it in the wiki. Tell them to run Unblock-File (or Explorer > File Properties > General > Unblock), if they don't want to keep pressing 'R' (Run). (Not the best first impression.)
2. Also, the scripts automatically run Unblock-File on the current .ps1 file and on each load of: INCLUDE*.ps1
3. Also place code in the batch files to unblock the current .ps1 script before running it.
4. Or place code in the batch files to unblock this.ps1 and INCLUDE*.ps1, and let PowerShell fend for itself.

Corresponding experience:

1. TraceCPU.bat: Have to press 'R' several times during each run. TraceCPU.ps1: same thing, but may be blocked by execution policy.
2. Same experience as (1), but have to press 'R' only once for bootstrap. After that the script takes care of itself.
3. Same experience as (2), but only for PowerShell. Running TraceCPU.bat (etc.) removes the first Zone.Identifier immediately.
4. TraceCPU.bat: no issues. TraceCPU.ps1: have to press 'R' several times each run, but may be blocked by execution policy.

I'm leaning toward Option 3: TraceCPU.bat unblocks TraceCPU.ps1, and then TraceCPU.ps1 unblocks itself (in case it's still needed) and Include*.ps1
Any other ideas?

[rayfo]

The batch script looks like this. For sub-folders (BETA), replace INCLUDE*.ps1 with ..\INCLUDE*.ps1 :

REM Detect, warn, and remove Mark of the Web.
set TraceThis=%~n0.ps1
set Include=INCLUDE*.ps1
(more < "%~dp0%TraceThis%:Zone.Identifier") >nul 2>nul && (
	echo Unblocking downloaded PowerShell scripts: %TraceThis%, %Include%
	echo https://github.com/microsoft/MSO-Scripts/wiki/Frequently-Asked-Questions#policy
	for %%f in ("%~dp0%TraceThis%","%~dp0%Include%") do echo %%~nxf & echo:>"%%~f:Zone.Identifier"
	echo:
)

[rayfo]

The PowerShell script looks like this:

function CheckMarkOfTheWeb
{
Param (
	$Path
)
	if ($Path -and (Get-Item -Path $Path -Stream 'Zone.Identifier' -ErrorAction SilentlyContinue))
	{
		Write-Warn 'Unblocking all downloaded PowerShell scripts in this folder: *.ps1'
		$Path = Split-Path -Parent -Path $Path
		Get-ChildItem -Path $Path -Recurse -Filter '*.ps1' | Unblock-File -Verbose:(DoVerbose)
		Write-Warn
	}
}

[rayfo]

Note-to-self: Investigate backward compatibility issues.

[rayfo]

Fixed with Pull Request #41

[rayfo]

Later had to wrap this in try/catch, because this line can throw an exception, for example when running from a non-NTFS drive (thumb drive):
Get-Item -Path $Path -Stream 'Zone.Identifier' -ErrorAction SilentlyContinue