Code signing adds a verifiable digital signature to a script, identifying its signer and revealing changes made after signing. It is a practical habit for protecting automation, especially when scripts leave your organization, and works alongside source control. section 21.0 section 21.1
A signed script provides two related checks:
- It authenticates the author, helping trace a script to its creator without guaranteeing that the script is safe or well designed. section 21.1
- It verifies integrity, allowing PowerShell to identify accidental or malicious changes made after signing. section 21.1
- It requires an environment that enforces signatures; signing files alone is insufficient. section 21.3
Choose a certificate for the deployment context
A commercial certificate authority typically issues Class 3 code-signing certificates after rigorous identity verification, often to organizations. An internal public key infrastructure and certificate authority suit organizational code, while a self-signed certificate is convenient for code used only by its individual maintainer and should be replaced before distributing it to others. section 21.2
Make PowerShell enforce signatures
On a machine that runs scripts, configure the execution policy in an elevated PowerShell session. Use AllSigned where scripts should require signatures; remote servers that rarely run interactive scripts may remain Restricted. Group Policy can configure execution policies in an Active Directory domain. section 21.3
Set-Executionpolicy AllSigned -force
Use the supplied command to require signed scripts while suppressing the confirmation prompt. section 21.3
