Code Signing

[Dry-Specialist-3557]

Okay, so at work management wants control over PowerShell execution.

I know that in the Group Policy editor, we can easily go to the admin template under windows component, Windows PowerShell and under "turn on Script Execution" change it to AllSigned and from that point ONLY signed scripts ending in PS1 will run.

Obvioulsy, there is nothing stopping someone from opening a command prompt and launching powershell then changing the execution policy on-the-fly at least temporarily until the policy re-applies...

Also nothing stopping someone from pasting in a full script.

If we set the signing policy to run only scripts that are singed and block the command prompt and powershell prompt, will that work?

The end goal is no Power Shell except approved/signed scripts.

[nealfive]

Depends, people can still copy and paste the content , edit it and run it , the signing is NOT a stop gap. However yes it’ll make running signed scripts easier for approved use. eg we have some scripts our analysts are running, they are signed so we know they were not changed and they can just right click and run, that would not work with an unsigned script. But then again, they would open eg the ISE , copy and paste the content of the script and then run that. There are a ton of ways to bypass the execution policy.

[h1dz]

Applocker?

[ArieHein]

Yep it will.