I tend to set it to RemoteSigned as opposed to Unrestricted as this is just too open for me. This does leave it open for anyone who has control of the machine, however, my thinking is that they could set the execution policy by that point anyway.