Signing a script is done by using the Set-AuthenticodeSignature-cmdlet and a code-signing certificate.

#Get the first available personal code-signing certificate for the logged on user
$cert = @(Get-ChildItem -Path Cert:\CurrentUser\My -CodeSigningCert)[0]
    
#Sign script using certificate
Set-AuthenticodeSignature -Certificate $cert -FilePath c:\MyScript.ps1

You can also read a certificate from a .pfx-file using:

$cert = Get-PfxCertificate -FilePath "C:\MyCodeSigningCert.pfx"

The script will be valid until the cetificate expires. If you use a timestamp-server during the signing, the script will continue to be valid after the certificate expires. It is also useful to add the trust chain for the certificate (including root authority) to help most computers trust the certificated used to sign the script.

Set-AuthenticodeSignature -Certificate $cert -FilePath c:\MyScript.ps1 -IncludeChain All -TimeStampServer "http://timestamp.verisign.com/scripts/timstamp.dll"

It's recommended to use a timestamp-server from a trusted certificate provider like Verisign, Comodo, Thawte etc.

To change the execution policy for the default scope (LocalMachine), use:

Set-ExecutionPolicy AllSigned

To change the policy for a specific scope, use:

Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy AllSigned

You can suppress the prompts by adding the -Force switch.

Often you might need to execute an unsigned script that doesn't comply with the current execution policy. An easy way to do this is by bypassing the execution policy for that single process. Example:

powershell.exe -ExecutionPolicy Bypass -File C:\MyUnsignedScript.ps1

Or you can use the shorthand:

powershell -ep Bypass C:\MyUnsignedScript.ps1

Other Execution Policies:

Unrestricted* Caveat: If you run an unsigned script that was downloaded from the Internet, you are prompted for permission before it runs.

More Information available here.

Getting the effective execution policy for the current session:

PS> Get-ExecutionPolicy
RemoteSigned

List all effective execution policies for the current session:

PS> Get-ExecutionPolicy -List

        Scope ExecutionPolicy
        ----- ---------------
MachinePolicy       Undefined
   UserPolicy       Undefined
      Process       Undefined
  CurrentUser       Undefined
 LocalMachine    RemoteSigned

List the execution policy for a specific scope, ex. process:

PS> Get-ExecutionPolicy -Scope Process
Undefined

Get information about the Authenticode signature from a signed script by using the Get-AuthenticodeSignature-cmdlet:

Get-AuthenticodeSignature .\MyScript.ps1 | Format-List *

When signing personal scripts or when testing code signing it can be useful to create a self-signed code signing certificate.

New-SelfSignedCertificate -FriendlyName "StackOverflow Example Code Signing" -CertStoreLocation Cert:\CurrentUser\My -Subject "SO User" -Type CodeSigningCert

In earlier versions, you can create a self-signed certificate using the makecert.exe tool found in the .NET Framework SDK and Windows SDK.

A self-signed ceriticate will only be trusted by computers that have installed the certificate. For scripts that will be shared, a certificate from a trusted certificate authority (internal or trusted third-party) are recommended.