What mechanism in Windows prevents a user from accidentally executing a potentially malicious batch (.bat) or PowerShell (.ps1) script?

UAC (User Account Control) prompts for elevation when administrative privileges are needed but does not block malicious code execution at the memory or process level.

DEP works at the hardware and OS level to mark memory pages (such as the stack and heap) as non-executable, blocking the execution of code that has been placed into data regions by a malicious .bat or .ps1 script. When such a script attempts to execute shellcode or injected payloads in a protected memory region, DEP triggers an exception and terminates the process. This prevents attackers from leveraging scripts to run arbitrary code in non-executable memory areas.

ASLR (Address Space Layout Randomization) randomizes memory layout to make exploitation harder, but does not directly block code execution from data regions.

Windows Firewall controls inbound and outbound network traffic and plays no role in preventing local script-based code execution.