Login Script - Powershell - Signed Scripts

[SimonInOz]

Hi all,

 

I think I am about to lose my mind over this, so bear with me..

 

Trying to set up a Powershell script, that will run when a student logs in. This is what I have been through so far:

 

Ok, so Powershell runs on the student account, when you try to run Powershell. (I actually had this disabled by software restriction policy, but have enabled it for testing)

 

I have used Group Policy to run a script on login (restricted by scope to a single test user) on a user OU and user login script, not computer.

 

The Powershell script is signed by me, and the signing is evident in the script and is ok when I actually sign it.

 

$cert = (dir cert:currentuser\my\ -CodeSigningCert)Set-AuthentiCodeSignature .\testScript.ps1 $cert

 

I have copied this script into the script folder (users\scripts\logon) in the policies folder

 

script is basically:

 

Get-AppxPackage *people* | Remove-AppxPackage

# SIG # Begin signature block etc, etc signing block

 

Ok, in relation to the logon script properties, I have the following:

 

Script Name:

 

%windir%\System32\WindowsPowerShell\v1.0\powershell.exe

 

Script Parameters:

 

-Noninteractive -ExecutionPolicy allsigned -scope userpolicy –Noprofile -file %~dp0Remove_MC.ps1

 

(I have tried just using the script actual name here "Remove_MC.ps1" this doesn't work either, I have also tried running it from a student accessible share)

 

So, I am sure I have done something basically wrong here, but after a day of scratching my head, and trying to logically solve this, I am stumped.

 

There must be people who have got this working, so would you be kind enough to share that knowledge with me?

 

I would also like to write something to the computer, to see if it is actually running or not. I looked through event viewer, nothing was evident there, failure or otherwise.

 

Any questions, just ask. Thank you all.

Edited September 22, 2020 by SimonInOz

[free780]

Was the certificate self signed that you used to sign the powershell script?

 

If so you need to add the certificate to the Trusted Root Authorities store on your test PC.

 

If you have ADCS setup you can create a code signing cert from ADCS and your PCs if on the same domain will trust the certificate.

[SimonInOz]

Hi, it was done on the Certificate Authority server, used the Code Signing template, then added to my pc. Just thinking, this probably needs to go out to all the pcs via Group Policy right? Or does that happen automagically with the CS server?

 

I would like all the domain pcs to have the cert ideally if that is the case, so do I have to do this manually, or is it automatic?

 

Cheers!

Edited September 22, 2020 by SimonInOz

[mavhc]

Should happen automatically, easy to check on any one computer in the certificate store.

[SimonInOz]

I just checked the cert store on the student pc, and it is not in either personal/certificates or trusted root certificates. How is it pushed out by the CA server?

[mavhc]

Should be automatic, but it's easy enough to add to a gpo

[SparkySX]

To get the cert to deploy automatically, you may need to edit the following group policy items:

[HPlum78]

Dont just go throwing certs in the trusted root/ intermediate store! if you are using certs to code sign then you should be putting these certs into the the Trusted Publishers/ Untrusted Certificates container(s). You can see this in action, go to a machine and run your signed script you should get a message that asks the question 'Do you want to run software from this untrusted publisher?' and then you get a list of options (V) Never Run (A) Always run...... this will then put the cert into the correct container in the current users cert store. Try that way TEST and then decide how you are going to deal with the distribution of the cert, one other thought how are you actually setting the execution policy on your workstations? Edited September 22, 2020 by HPlum78

[mavhc]

The domain CA cert should be auto distributed, the code signing cert is signed by that cert and is different

[HPlum78]

@mavhc yeah I understand what is being driven at just want to be clear that we need to think before shoe horning certs in to cert stores.... Edited September 22, 2020 by HPlum78

[SimonInOz]

Hi,

 

I guess I was really looking for an established process here, I was sure someone would be doing this right. I think I have the signed certificate done right, but I believe I need to set the execution policy to allsigned through GPO? I just need to know how this last few steps actually work from someone that has done it already.

[free780]

You can use Get-AuthenticodeSignature to check the signing is valid.

[HPlum78]

@SimonInOz So i am going to put the link to about_Signing https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_signing?view=powershell-7 this has a link to an old document around Code Signing Best Practices (OLD).

 

here is the about_Execution_Policies link https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7 you should be setting this via a GPO so you know that its the same across your environment.

 

We looked at code signing our scripts a while ago and decided that while we would like to get it done we was a long way off just being able to flick the switch and turn it on there is a little more to consider...

[SimonInOz]

@HPlum78 thanks for the links mate, I think this is probably not going to happen anytime soon. I will have to do more research and find a way to do it right.