Convert PowerShell Script to EXE

Test the Script Before You Convert It

Never convert an untested script. Once the script sits inside an EXE, the console and the error messages are hidden, so every bug becomes slow and painful to find. Run the .ps1 file as a normal user and as an administrator, feed it the wrong input once on purpose, and only convert it when it behaves the same way every single time.

Install the PS2EXE Module

PS2EXE is a free module published on the PowerShell Gallery. You install it once, on the PC that builds the EXE - the people who receive the finished EXE install nothing. Open PowerShell and run:

Install-Module -Name ps2exe

The first time, PowerShell may ask you to trust the PSGallery repository - answer Yes if you started the install yourself. If module installs are blocked by policy on your machine, allow them for your own account only:

Set-ExecutionPolicy -Scope CurrentUser RemoteSigned

Convert with the Invoke-PS2EXE Command

One command does the conversion. It names the input script and the output file - replace the example names with your own script:

Invoke-PS2EXE -inputFile ".\DiskCleanup.ps1" -outputFile ".\DiskCleanup.exe"

Run it from the folder that holds your script, and the EXE appears next to the .ps1 file. That is the whole conversion - the options in Step 5 are added on this same line when you need them.

Or Use the Win-PS2EXE GUI

Prefer clicking to typing? The module also ships a graphical front end:

Win-PS2EXE

Pick the input file, pick the output file, tick the options you want and press Compile. The GUI produces exactly the same EXE as the command line - it is the same tool with a form on top, so use whichever you find clearer.

Add an Icon, Version Info and Admin Rights

If the EXE will be shared, give it an identity. Add -iconFile ".\tool.ico" for a custom icon, and -title, -product, -company and -version to fill the Details tab of the file properties - named files look more trustworthy to users and to scanners than anonymous ones. If the script changes system settings, add -requireAdmin so Windows asks for elevation when the EXE starts, instead of the script failing halfway. And if the script shows its own window or form, -noConsole stops a black console window appearing behind it - but never use it for a script that asks the user questions in the console, or the EXE will look frozen while it waits for input nobody can type.

Test the EXE Like a Real User

Copy the EXE somewhere neutral - the Desktop or a shared folder - and double-click it. Do not judge it from your PowerShell window. If it needs admin rights, confirm the UAC prompt appears and the job completes after it. Then keep the pair together: script and EXE in the same folder. When the script changes, re-run the conversion and replace the EXE - never hand out a stale build.

The Honest Limits - Read Before You Share

That one fact gives the rule that keeps you safe: never put a secret in a script you convert - no admin password, no service-account password, no API key or token, no Wi-Fi key you would not print on a poster. If a script needs a password, it must ask for it or read it from a proper credential store at run time, never carry it inside the file.

One more honest limit: a brand-new, unsigned EXE that decodes and runs text inside itself has the same shape as real malware delivery, so antivirus and SmartScreen may flag your converted file even though your script is clean. The honest fixes are identity, not tricks: fill in the version information from Step 5, distribute the file from the same place every time, and sign it with a code-signing certificate if you share tools regularly. Never answer a warning by telling users to disable their antivirus.