What mechanism in Windows prevents a user from accidentally executing a potentially malicious batch (.bat) or PowerShell (.ps1) script?

UAC prompts for elevation of privilege but does not specifically block the execution of .bat or .ps1 scripts running under the current user context.

DEP enforces a policy at the processor and OS level that prevents code from executing in memory pages designated as data-only, blocking shellcode and malicious payloads that scripts may attempt to load. By flagging non-executable memory regions, DEP interrupts the execution of injected or script-triggered malicious code before it can run. It applies to both 32-bit and 64-bit processes and is configurable via Windows system settings.

ASLR randomizes the base addresses of loaded modules in memory to make exploits harder to target, but it does not prevent script files from being executed.

Windows Firewall controls inbound and outbound network traffic and has no mechanism to block local script execution.