Fix Conda PowerShell Profile PSSecurityException Safely

Maintained layer, checked 2026-09-01. The 2019 note fixed one machine by setting the current user’s execution policy to Unrestricted. That is broader than this problem normally requires. The workflow below recovers the shell without loading a profile, identifies the effective policy and the exact profile, reviews Conda’s proposed edit, and chooses the narrowest authorized remedy. The complete 2019 export is archived at the end with only invisible trailing whitespace normalized.

A PSSecurityException while PowerShell dot-sources profile.ps1 is a PowerShell startup-policy failure. It does not by itself show that Conda, Python, or an environment is corrupt. Treat the blocked profile, the Conda installation, and the target environment as separate layers.

1. Read the failing path before changing policy

The historical error named:

C:\Users\user\Documents\WindowsPowerShell\profile.ps1

That path belongs to a Windows PowerShell profile. PowerShell 7 (pwsh.exe), Windows PowerShell (powershell.exe), Visual Studio Code, and other hosts can use different profile paths. Microsoft recommends reading the $PROFILE automatic variable in the host that actually fails instead of assuming one fixed file.

Execution policy is a Windows safety feature for profiles and scripts, not a complete security boundary. The relevant question is not “How do I disable it?” but “Which scope is effective, what file is blocked, and is that file trusted?”

2. Recover a clean shell without loading the profile

Open Command Prompt, the Run dialog, or a trusted Conda prompt and start the same PowerShell family with profiles disabled:

powershell.exe -NoProfile
pwsh.exe -NoProfile

Run only the command for the host you use. -NoProfile is a recovery mode: it prevents the broken startup file from loading but does not modify the file or execution policy. If neither command can find conda, use the Anaconda/Miniconda/Miniforge prompt installed with that distribution for the Conda commands below.

Do not delete the profile merely to make the error disappear. It may contain unrelated customizations, and the failing host/path is useful evidence.

3. Inventory the host, profile, command, and policy

In the clean PowerShell session, capture:

$PSVersionTable.PSVersion
$PSHOME
$PROFILE | Select-Object *

Get-ExecutionPolicy
Get-ExecutionPolicy -List
Get-Command conda -All -ErrorAction SilentlyContinue

Get-ExecutionPolicy without a scope reports the effective policy. -List shows MachinePolicy, UserPolicy, Process, CurrentUser, and LocalMachine. Group Policy scopes outrank the locally configurable scopes; a successful Set-ExecutionPolicy command can therefore leave the effective policy unchanged.

Record the output rather than diagnosing from a remembered default. Microsoft documents different default/effective cases, and enterprise policy may intentionally prohibit profiles.

4. Inspect the exact profile and Conda change

Read the active host’s profile as text before executing it:

if (Test-Path -LiteralPath $PROFILE -PathType Leaf) {
    Get-Item -LiteralPath $PROFILE
    Get-Content -LiteralPath $PROFILE
}

The Conda initialization block should point into the installation you intended. Review any commands outside that block too; fixing Conda must not silently authorize an unrelated profile payload.

From a prompt where the intended conda command is available, preview its current proposed edit:

conda --version
conda init powershell --dry-run --verbose

Conda documents --dry-run as display-only. Compare the preview with the existing profile and verify the installation path. Do not paste an initialization block copied from another user, machine, or Conda release.

5. Choose the narrowest authorized remedy

Situation Remedy Boundary
MachinePolicy or UserPolicy is defined Follow the organization’s policy or ask its administrator Do not try to override Group Policy with CurrentUser, Process, Bypass, or copied profile code.
Personal unmanaged Windows machine; reviewed local profile; policy is Restricted Consider RemoteSigned at CurrentUser Persistent for this user, not the whole machine; still review scripts before running them.
RemoteSigned blocks one reviewed file marked as downloaded Verify that exact file, then remove only its Internet-zone mark Do not unblock a directory recursively or treat “signed” as “benign.”
Policy must remain unchanged Use a trusted Conda prompt and conda run No automatic activation in PowerShell; explicit environment per command.
Profile contains an obsolete or unwanted Conda block Preview and run conda init --reverse powershell Removes Conda’s initialization; it does not repair unrelated profile code.

On a personal unmanaged machine, after reviewing the profile, this scoped change is the usual replacement for the archived Unrestricted command:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser
Get-ExecutionPolicy
Get-ExecutionPolicy -List

RemoteSigned allows locally created scripts and requires downloaded scripts to be signed unless they are deliberately unblocked. Do not set persistent Unrestricted or Bypass merely to initialize Conda. AllSigned may be the correct organizational choice; this guide does not weaken it.

6. Unblock only a verified downloaded file

Use this route only when the effective policy is already RemoteSigned and the error identifies a particular trusted file carrying an Internet-zone mark. Replace the placeholder with the exact path reported by PowerShell:

$blockedPath = 'C:\path\reported\by\the\error.ps1'

Get-AuthenticodeSignature -LiteralPath $blockedPath |
    Format-List Status, StatusMessage, SignerCertificate
Get-Item -LiteralPath $blockedPath -Stream *
Unblock-File -LiteralPath $blockedPath -WhatIf

Verify the publisher/source, inspect the contents, and confirm the path is inside the intended installation. If and only if that review is satisfactory:

Unblock-File -LiteralPath $blockedPath

Microsoft says Unblock-File removes the Zone.Identifier stream. That is a trust decision, not a generic error-clearing command. Do not recursively unblock Downloads, a Conda installation, or a profile tree.

7. Back up, initialize, restart, and verify

Before allowing Conda to edit a nonempty profile, make a timestamped adjacent backup:

if (Test-Path -LiteralPath $PROFILE -PathType Leaf) {
    $stamp = Get-Date -Format 'yyyyMMdd-HHmmss'
    Copy-Item -LiteralPath $PROFILE -Destination "$PROFILE.$stamp.bak"
}

conda init powershell --dry-run --verbose
conda init powershell

Close every window of that PowerShell host and start a fresh one; Conda documents that most shells must be restarted after conda init. Then validate the command, environment selection, and interpreter identity:

conda --version
conda info --envs
conda activate PROJECT_ENV
python -c "import sys; print(sys.executable); print(sys.version)"
conda deactivate

Replace PROJECT_ENV with the intended environment. A prompt prefix alone is not acceptance evidence; sys.executable must point inside the expected prefix.

8. Run work without persistent PowerShell initialization

Automatic activation is optional. From a trusted Conda prompt, conda run can execute one command in a named environment without loading a PowerShell profile:

conda run --name PROJECT_ENV --no-capture-output -- python .\script.py

Conda documents --name/--prefix, --cwd, and --no-capture-output for this boundary. Explicit execution is often clearer for scheduled tasks and reproducible automation than depending on an interactive profile. The process still inherits files, network access, and credentials from its caller; a Conda environment is dependency isolation, not a security sandbox.

9. Roll back the Conda profile edit

Preview the supported reverse operation first:

conda init --reverse powershell --dry-run --verbose
conda init --reverse powershell

Restart the shell and inspect $PROFILE again. If unrelated content was changed or the reverse result differs from the recorded preview, stop and compare the timestamped backup instead of overwriting the profile blindly.

If this guide changed CurrentUser policy and that change is no longer wanted, remove only that setting after recording the current list:

Get-ExecutionPolicy -List
Set-ExecutionPolicy -ExecutionPolicy Undefined -Scope CurrentUser
Get-ExecutionPolicy -List

Undefined removes the setting at that scope; the resulting effective policy comes from the next applicable scope. It does not guarantee Restricted or any other particular result.

10. Troubleshoot by observed layer

Observation Likely cause Next evidence
PSSecurityException names profile.ps1 at startup Effective policy blocks that host’s profile $PROFILE, Get-ExecutionPolicy -List, profile contents
Setting CurrentUser succeeds but effective policy does not change Higher-precedence Group Policy MachinePolicy and UserPolicy; administrator guidance
conda is unavailable only with -NoProfile The profile supplied the shell function/PATH Use a trusted Conda prompt; inspect Get-Command conda -All
conda activate says the shell is not configured Initialization missing, reversed, or applied to another host/profile Host executable, $PROFILE, conda init ... --dry-run --verbose
Initialization path references an old installation Stale profile block after reinstall/move Compare Get-Command conda, preview, and profile backup
Conda activates but Python is wrong Different environment or shadowed executable conda info --envs, Get-Command python -All, sys.executable
Only one downloaded module is rejected under RemoteSigned Internet-zone mark or invalid signature Exact error path, signature, alternate streams, provenance

Do not reinstall Anaconda, edit the registry, delete every profile, or widen policy until this table identifies evidence for that layer.

11. Security and automation notes

  • Treat a PowerShell profile as executable code. Review diffs after installers change it.
  • Keep secrets out of profiles and command history; environment activation does not protect them.
  • In managed environments, preserve Group Policy and use approved signed profiles or explicit commands.
  • For automation, pin the environment, print sys.executable, capture the exit status, and avoid relying on a user’s interactive profile.
  • Test both Windows PowerShell and PowerShell 7 only if the project supports both; their profile locations and module environments can differ.
  • Execution policy can reduce accidental script execution, but Microsoft explicitly says it is not a security system that prevents a determined user from running code.

12. Complete 2019 export archive

The following is the complete 2019 WordPress export. Its Unrestricted fix is preserved as historical provenance, not maintained advice. Only invisible trailing whitespace has been normalized for repository formatting.

---
id: 1982
title: 'Run Anaconda Script in Powershell to Error'
slug: 'run-anaconda-script-in-powershell-to-error'
date: '2019-07-05T06:56:14'
modified: '2019-07-05T06:56:17'
status: 'publish'
link: 'https://blog.lazying.art/en/html/computer_internet/software/1982/run-anaconda-script-in-powershell-to-error.html'
author: 'Lachlan Chen'
categories:
  - 'Software'
---

I met this error when open Powershell

+ . <<<< ‘C:\Users\user\Documents\WindowsPowerShell\profile.ps1’
+ CategoryInfo : NotSpecified: (:) [], PSSecurityException
+ FullyQualifiedErrorId : RuntimeException


after running

conda init powershell


It get solved by execute this in Powershell

Set-ExecutionPolicy Unrestricted -Scope CurrentUser

Primary documentation

Leave a Reply