Enable and Run Signed PowerShell Scripts in Windows

Last updated: Nov 24, 2024

By default, PowerShell scripts are restricted from running for security reasons. While the -ExecutionPolicy Bypass switch can override this restriction, it's not the most secure option. If you want to enhance security, it's worth exploring how to allow only signed scripts to run. Here, we'll look at how to create and authorize only signed scripts.

Group Policy to allow signed scripts only

Open the Group Policy editor:

Open the Run dialog and type gpedit.msc to access the Group Policy Editor in Windows.

Go to User Configuration > Administrative Templates > Windows Components > Windows PowerShell:

View of the Local Group Policy Editor highlighting the 'Turn on Script Execution' setting under Windows PowerShell options.

Edit the Turn on Script Execution policy:

Group Policy Editor window with the Turn on Script Execution setting enabled and Allow only signed scripts selected as the execution policy

Create Certificate

To sign our scripts, we need a certificate. Here's how to create a self-signed certificate.

Open Windows PowerShell as administrator:

Windows menu showing the Run as administrator option for PowerShell

Set a name for your new certificate in the variable $CertificateName:

PS C:\Users\Administrator\Desktop> $CertificateName = "STD Certificate"

Define where you want to create your certificate:

PS C:\Users\Administrator\Desktop> $OutPutPFXFilePath = "C:\Users\administrator\Desktop\MyNewSigningCertificate.pfx"

Set password for the pfx container:

PS C:\Users\Administrator\Desktop> $MyStrongPassword = ConvertTo-SecureString -String "MyPassword" -Force -AsPlainText

Finaly, create the certificate with a lifetime of 10 years and a key size of 4096 bits:

PS C:\Users\Administrator\Desktop> New-SelfSignedCertificate -subject $CertificateName -Type CodeSigning -NotAfter (Get-Date).AddYears(10) -KeyLength 4096 | Export-PfxCertificate -FilePath $OutPutPFXFilePath -password $MyStrongPassword

Signing the script

Load the certificate:

PS C:\Users\Administrator\Desktop> $MyCertFromPfx = Get-PfxCertificate -FilePath 'C:\Users\administrator\Desktop\MyNewSigningCertificate.pfx'
Enter password : ********

Signing the script:

PS C:\Users\Administrator\Desktop> Set-AuthenticodeSignature -PSPath 'C:\Users\administrator\Desktop\script.ps1' -Certificate $MyCertFromPfx

PowerShell command output for signing a script with Set-AuthenticodeSignature

Importing the certificate

To be correctly recognized, a self-signed certificate must be imported on the computers on which we want to run the PowerShell scripts. Type the following commands with administrator rights.

Set variables

Set the pfx password and certificate path:

PS C:\Users\Administrator\Desktop> $MyStrongPassword = ConvertTo-SecureString -String "MyPassword" -Force -AsPlainText PS C:\Users\Administrator\Desktop> $CertPath = "C:\Users\administrator\Desktop\MyNewSigningCertificate.pfx"

Import to Trusted Root Certification Authorities store

Import the certificate into the Trusted Root Certification Authorities local computer store:

PS C:\Users\Administrator\Desktop> Import-PfxCertificate -FilePath $CertPath "cert:\LocalMachine\Root" -Password $MyStrongPassword

Trusted Root Certification Authorities with a highlighted certificate for code signing

Import to Trusted Publishers store

Import the certificate to the Trusted Publishers local computer store:

PS C:\Users\Administrator\Desktop> Import-PfxCertificate -FilePath $CertPath "cert:\LocalMachine\TrustedPublisher" -Password $MyStrongPassword

Trusted Publishers section with a highlighted code signing certificate

Check script signature

We can check whether the script is correctly signed using the Get-AuthenticodeSignature command:

PS C:\Users\Administrator\Desktop> Get-AuthenticodeSignature 'C:\Users\administrator\Desktop\script.ps1' PowerShell command to validate script signature with a valid status

PowerShell command to validate script signature with a valid status

If the script has been altered after being signed, the HashMismacth status appears and the script cannot be executed:

PowerShell command showing a hash mismatch error while validating script signature

References

https://www.scriptinglibrary.com

Computing

Music

Misc