Power shell обнаружил, что вы можете использовать программу чтения с экрана, и отключил

Hey there! If you’re getting started with PowerShell, you might have encountered an annoying issue: your scripts just won’t run because they’re not digitally signed. It’s like trying to enter a high-security building without an ID – no way you’re getting in! This guide is your all-access pass. We’ll dive deep into the world of signing PowerShell scripts. Whether you’re a newbie or a seasoned pro, you’ll find valuable nuggets of info here. Let’s demystify this whole “PowerShell is not digitally signed” puzzle.

Warning: PowerShell detected that you might be using a screen reader and has disabled PSReadLine for compatibility purposes. If you want to re-enable it, run ‘Import-Module PSReadLine’.

i want to see output of this code with showing sign conventions of hand

asked Jan 7 at 6:08

Pandurang Shrirame

Load 4 more related questions


Show fewer related questions

Sorted by:


Reset to default

makecert -r -n "CN=Name" -ss CertStore -sr LocalMachine

[version]Signature=xxxxxxProvider=xxxxxxCatalogFile=MyCatalogFile.cat

Inf2Cat.exe /driver:"<Path to folder containing driver files

certutil.exe -addstore "Root" [PathToCertificatewithFile]
certutil.exe -addstore "TrustedPublisher" [PathToCertificatewithFile]

certutil.exe -delstore "Root" [PathToCertificatewithFile]
certutil.exe -delstore "TrustedPublisher" [PathToCertificatewithFile]

Option Explicit
On Error Resume Next
Dim strCmd,WshShell,strInstalldir
Set WshShell = CreateObject("WScript.Shell")
strInstalldir = WshShell.ExpandEnvironmentStrings( "%SYSTEMROOT%" )
strCmd = "certutil.exe -addstore " & chr(34) & "Root" & chr(34) & " " & chr(34) & strInstalldir & "\DPInst\TestCer.cer" & chr(34)
WshShell.Run strCmd

$CerLocation = $env:SystemRoot + "\DPInst\TestCer.cer"
Import-Certificate -FilePath $CerLocation -CertStoreLocation Cert:\LocalMachine\Root
Import-Certificate -FilePath $CerLocation -CertStoreLocation Cert:\LocalMachine\TrustedPublisher

MSI Packaging In-Depth Training Book

by Alexandru Marin

Troubleshooting Guide

Here are solutions for common errors seen when running signed PowerShell scripts:

Error: “Powershell says The file C:\scripts\myscript.ps1 cannot be loaded. The signature of the certificate cannot be verified…”

Solution: Ensure your root CA certificate is installed correctly in the Trusted Root CA store. Rerun the Install-Certificate command from Step 2.

Error: “The script has an invalid signature. The signature is valid, but it comes from an untrusted source”

Solution: Get the script signed by a trusted CA provider like DigiCert, GoDaddy, etc. instead of using a self-signed cert.

Error: “The file is not digitally signed” in spite of signing the script.

Solution: Close and re-open the PowerShell session and retry running the script. The signed status is sometimes not refreshed in active sessions.

Error: Access is denied. (0x80070005 (E_ACCESSDENIED))

PowerShell Execution Policies

Before we dive into signing, let’s talk about execution policies. These are rules that determine how PowerShell handles scripts. If your policy is set to “Restricted,” even signed scripts won’t run. The “AllSigned” policy is like a VIP pass – only signed scripts can run.

Configuring your PowerShell execution policy is a critical step in setting up your environment for script signing. This policy serves as a gatekeeper, determining which scripts will run on your system. It’s imperative to modify the execution policy to allow for the execution of digitally signed scripts, thus providing a safeguard against running potentially harmful scripts.

Signing a PowerShell script involves cryptographically signing the script contents using a code signing certificate. This validates and establishes the source and integrity of the script. Signing the script ensures PowerShell can verify the script’s publisher and prevents tampering. The digital signature container embeds signing details within the script itself.

Here’s how to ensure your scripts withstand the demands of security-conscious environments:

1. Prepare the PowerShell Script for Signing – Begin by ensuring your script (sign.ps1) is finalized and free of any syntactical errors. Review your code thoroughly to avoid signing an incorrect version.
2. Obtain Your Digital Certificate – You must have a valid digital certificate available to sign your script. This can be from a trusted Certificate Authority or a self-signed certificate, depending on your requirements and the level of trust you need to establish.
3. Use the Set-AuthenticodeSignature Cmdlet – PowerShell is equipped with Cmdlets to facilitate script signing directly within the console. Set-AuthenticodeSignature is the Cmdlet you’ll use to append your digital signature to the script.
4. Verify the Script is Signed – After appending the digital signature, validate the signing process by running a check on the script to confirm the signature is attached and recognized by the system.

Prerequisites for Signing PowerShell Scripts

1. Code Signing Certificate: You need a valid code/digital signing certificate issued from a trusted Certificate Authority. It can be self-signed for testing.
2. Administrative Privileges: You must have administrative privileges on the system to install certificates or make changes to sign scripts.

Step 1: Get a Digital Certificate

To sign scripts, you need a digital certificate. It’s like your unique digital fingerprint. You can get one from a Certificate Authority (CA) or create a self-signed certificate for testing. For scripts that will be distributed or deployed in a production environment, it is advisable to opt for a digital certificate from a Trusted Certificate Authority. Such a certificate carries more weight as it is issued by an external, trusted entity, lending greater credibility to your scripts.

Creating a Self-Signed Certificate

Self-signed certificates are a feasible option for code-signing PowerShell scripts, especially when the scripts are for internal or testing purposes. They are easy to generate and provide a layer of security without incurring the costs associated with certificates from a Certificate Authority (CA). However, they lack the trust factor provided by a third-party CA, which is often important for scripts used in broader and more formal settings. Below are the necessary steps to create a self-signed certificate on a Windows machine:

1. Open PowerShell as an administrator.
2. Use the New-SelfSignedCertificate cmdlet to create a certificate.
3. Specify the certificate parameters such as type, subject name, and expiration date.
4. Once the certificate is created, export it to “Trusted Root” and use it to sign scripts with certificates in PowerShell.

#Parameters
$CertificateName = "PowerShell Code Signing"
#Create a Self-Signed SSL certificate
$Certificate = New-SelfSignedCertificate -CertStoreLocation Cert:\CurrentUser\My -Subject "CN=$CertificateName" -KeySpec Signature -Type CodeSigningCert
#Export the Certificate to "Documents" Folder in your computer
$CertificatePath = [Environment]::GetFolderPath("MyDocuments")+"\$CertificateName.cer"
Export-Certificate -Cert $Certificate -FilePath $CertificatePath
#Add Certificate to the "Trusted Root Store"
Get-Item $CertificatePath | Import-Certificate -CertStoreLocation "Cert:\LocalMachine\Root"
Write-host "Certificate Thumbprint:" $Certificate.Thumbprint

Voilà! You’ve got a certificate. Make a note of the certificate Thumbprint. If you don’t add the certificate to the Trusted Root certification authorities, you’ll see an error message, “File <File-Path> cannot be loaded. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.”

Step 2: Signing Your Script

Now, let’s get to the important part – signing your script. Find your script’s path. Let’s say it’s C:\Temp\Backup.ps1. and locate your certificate. Make sure you obtain and update the Certificate thumbprint from the previous step.

#Set Parameters
$CertificateThumbprint = "D00AC4CE2C766783510D67B5DAD3971891AC9239"
$ScriptPath = "C:\Temp\Backup.ps1"
#Get the Certificate from Cert Store
$CodeSignCert = Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object {$_.Thumbprint -eq $CertificateThumbprint}
#Sign the PS1 file
Set-AuthenticodeSignature -FilePath $ScriptPath -Certificate $CodeSignCert

Boom! Your script is now signed, and the Powershell script is not digitally signed. The error should go away!

You can obtain the certificate thumbprint from the certificate console:

$Cert = Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object {$_.Thumbprint -eq $CertificateThumbprint}
Set-AuthenticodeSignature -FilePath "C:\Path\To\Your\Script.ps1" -Certificate $cert -TimestampServer "http://timestamp.digicert.com"

Replace C:\Path\To\Your\Script.ps1 with the actual path to your script, $cert with the imported code signing certificate and TimestampServer with the name of a trusted timestamp authority.

After completing these steps, your PowerShell script will be digitally signed, ensuring that it is safe to use and has not been tampered with.

Step 3: Verify Signed Script

If you open the signed PS1 file, you’ll find the encrypted signature:

You’ll also find a “Digital Signature” tab on the PS1 file’s properties window.

You can also validate the script with the below script:

Get-AuthenticodeSignature C:\Temp\Backup.ps1 | fl

Managing Certificates for Script Signing

Ensuring the security and integrity of your PowerShell scripts is a continuous process that extends beyond just creating and signing scripts. A critical aspect of maintaining this security posture involves the adept management of digital certificates used for script signing. It’s crucial to not only keep a keen eye on the validity of these certificates but also to have robust procedures in place for renewing certificates and dealing with potentially compromised ones. Let’s delve into the methods you can employ to keep your certificates up-to-date and manage them effectively.

Renewing Certificates

Certificates come with an expiration date, and it’s imperative that you renew your certificates well before they expire to prevent any interruption in your workflow. Renewing certificates for script signing is a task that safeguards the continuity of trust for your scripts. Below, you will find essential steps and considerations for the renewal process:

• Monitor the expiration dates of your certificates regularly using certificate management tools or a manually maintained schedule.
• Start the renewal process early to allow ample time for re-signing any existing scripts and to avoid a lapse in the trust chain.
• Follow the renewal procedures provided by your Certificate Authority; these may vary but generally involve a similar verification process as the initial issuance.
• Post-renewal, promptly update your scripts with the new certificate to ensure that all future script executions are verified against the current, valid certificate.

Revoking and Managing Compromised Certificates

When a certificate used for signing PowerShell scripts is compromised, it poses a serious security risk and must be dealt with immediately. A compromised certificate can allow malicious scripts to appear as trustworthy, potentially causing damage to your systems and reputation. Here’s what you need to do in the event of compromise:

• Immediately revoke the compromised certificate through your Certificate Authority to prevent its further use.
• Communicate with your users regarding the compromise and revocation to maintain transparency.
• Re-sign all affected scripts with a new, secure digital certificate to restore security and trustworthiness.
• Review and enhance your certificate management and security policies to mitigate the chance of future compromises.

Best Practices for PowerShell Script Security

Here are some recommendations for securely signing PowerShell scripts:

• Obtain code signing certificates from trusted providers like DigiCert, Comodo etc
• Use a unique certificate exclusively for PowerShell script signing
• Ensure the root CA and intermediates are added to Trusted Root stores
• Do not share the code signing certificate’s private key
• Keep your scripts up-to-date. Old scripts might have vulnerabilities.
• For production, always use certificates from a trusted CA. Self-signed ones are great for testing, but not for real-world use.

Implementing these practices ensures optimal security when signing and running PowerShell scripts. Microsoft Reference: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_signing?view=powershell-7.4

Wrapping up

Congratulations! You’re now a wizard in signing PowerShell scripts. Signing PowerShell scripts digitally enables secure execution of automation scripts and prevents tampering by malicious actors. It also averts certain PowerShell security controls and allows running scripts seamlessly across systems.

What are the benefits of signing PowerShell scripts?

Signing PowerShell scripts provides assurance of authenticity, establishes trustworthiness, and ensures compliance with organizational security policies. It also helps prevent the execution of unauthorized code, thus maintaining the integrity and security of the scripts.

What should I do if my signing certificate is compromised?

If your certificate is compromised, you should immediately revoke the certificate to prevent its further use. Next, assess the impact and potential breach, communicate with affected parties, and reissue your scripts with a new, secure signing certificate as needed.

Can I run unsigned PowerShell scripts?

Running unsigned scripts is contingent on the execution policy of your PowerShell environment. For security reasons, most production environments require scripts to be signed. However, for testing purposes or on trusted networks, your execution policy may permit running unsigned scripts.

How can I manage the certificates used for PowerShell script signing?

Managing certificates involves monitoring for validity, renewing them before expiration, and revoking them if compromised. Tools are available within the Windows operating system and PowerShell to facilitate these management tasks.

How can I verify a PowerShell script’s signature?

You can manually verify a script’s signature by using the Get-AuthenticodeSignature cmdlet in PowerShell or through the properties of the file in Windows. For automated verifications, scripts and tools such as sigcheck can be used, particularly useful in large-scale or frequent verification scenarios.

What is the Set-AuthenticodeSignature cmdlet and how is it used?

The Set-AuthenticodeSignature cmdlet is used in PowerShell to apply a digital signature to a script. It requires parameters specifying the path to the script and the certificate with which you want to sign it. Mastery of this cmdlet’s parameters facilitates a smooth script signing process.

How do you sign a PowerShell script?

To sign a PowerShell script, you use the Set-AuthenticodeSignature cmdlet and provide it with the script you wish to sign and the signing certificate. Once the cmdlet is applied, it embeds a digital signature into the script.

How do I create a digital certificate for PowerShell script signing?

You can create a self-signed certificate using PowerShell or tools like MakeCert, or you can acquire a certificate from a trusted Certificate Authority (CA). Trusted CA certificates offer broader acceptance for scripts distributed publicly or within professional organizations.

What are the prerequisites for signing PowerShell scripts?

Before you sign PowerShell scripts, you need a valid digital certificate, which can be self-signed or issued by a trusted Certificate Authority (CA). Additionally, you must configure your PowerShell execution policy to allow signed scripts to run on your system.

Table of contents

• Understanding the Need for Signing
• Setting the Stage: PowerShell Execution Policies
• Step-by-Step Guide to Signing a PowerShell Script
• Managing Certificates for Script Signing
• Best Practices for PowerShell Script Security
• Troubleshooting Guide
• Wrapping up

Understanding the Need for Signing

PowerShell scripts can be extremely useful for automating tasks and processes on Windows systems. However, running unsigned PowerShell scripts often results in errors like “PowerShell not digitally signed”, “the file is not digitally signed.” or “is not digitally signed. You cannot run this script on the current system.”. Let’s see how to sign PowerShell scripts to resolve these errors.

Why Sign?

The Risks of Unsigned Scripts

Imagine downloading a script claiming to organize your files but instead, it wreaks havoc. That’s why PowerShell, by default, stops unsigned scripts. It’s like a bouncer for your system’s safety.

Похожее:

Windows 10 1080P, 2K, 4K, 5K HD wallpapers free download | Wallpaper Flare Скачать Все официальные темы Windows с сайта Microsoft 28.11.2019 Подписать файлы с помощью powershell Power shell и его возможности в уходящем году