PowerShell scripts on Win11

[Bugzi]

Hello,

 

I'd like to ask how other organisations control / secure their end user devices when it comes to running PowerShell scripts within the user-context please.

 

With our new Win11 environment, we have AppLocker deployed via Intune and this puts running PowerShell scripts into language constraint mode.

Doing this has caused us a lot of headaches with trying to make scripts work for exam software as they are still not working with Windows 11 Entra Only and Intune.

 

Could I ask how others are handling this please?

 

Many thanks

[Julian]

Group Policy at Machine level, to require signed Powershell scipts. I use Powershell to deploy some applications (Python, MS Office,...) so I need it runnable, but limited to trusted scipts.

[TechMonkey]

8 minutes ago, Julian said:

Group Policy at Machine level, to require signed Powershell scipts. I use Powershell to deploy some applications (Python, MS Office,...) so I need it runnable, but limited to trusted scipts.

How do you sign your scripts?  The only way I've seen is with a pretty expensive code cert.

[psydii]

With a cert from your AD CA?

[Julian]

1 hour ago, psydii said:

With a cert from your AD CA?

Correct, the school is running its own internal CA, which I used to generate a code signing key. That key was then added to Group policy, as a domain policy, saying that I was trusteed to code sign software.

 

The only problem is that the certificate only lasts 1 year. So, document well what you code sign.

 

[psydii]

as long as the cert was valid when it was signed and hasn't been revoked, it doesn't matter if the cert is expired when you run the code.

[Bugzi]

Thanks everyone. Much appreciated.

 

We don't have GPO anymore as we chose to go with Entra only.

I'll have a look at how to achieve this with Intune, unless anyone has any hints and tips please?

 

Currently I've managed to get some of the scripts to work in constraint mode, thanks to lots of googling and ChatGPT lol

[amartin]

On 31/10/2025 at 19:31, Bugzi said:

Thanks everyone. Much appreciated.

 

We don't have GPO anymore as we chose to go with Entra only.

I'll have a look at how to achieve this with Intune, unless anyone has any hints and tips please?

 

Currently I've managed to get some of the scripts to work in constraint mode, thanks to lots of googling and ChatGPT lol

 

Hi Bugzi,

 

How did you get on trying to achieve this?

 

Thanks

[Bugzi]

25 minutes ago, amartin said:

 

Hi Bugzi,

 

How did you get on trying to achieve this?

 

Thanks

Hello,

 

Currently we have scripts deployed via an Intune app that then gets run as a scheduled task on logon.

The scripts I had to rewrite quite a bit to make them compatible with PowerShell constraint mode as we haven't got round to fixing the internal script signing certificate.

 

Seems to work ok, just be careful when you create scheduled tasks and have laptops as by default they don't run when not on AC power.

 

Thanks

[psydii]

You might be able to use openssl to create a root ca and codesigning certs?

 

openssl - How to create a self-signed code signing certificate from a CSR? - Stack Overflow

 

Deploy the root cert and code signing cert (without their private key) to the computers that need to trust the scripts using intune.  keep the private keys well protected. Load the code signing cert into the private cert store of the user account who has the authority to sign them.  Make sure you have a way to revoke the certs though.

[KK20]

You can create additional domain CA templates for longer duration code signing certificates. That's what I do.  You may need to extend the domain CA default validity period in order for the longer certificates to take effect.  Obviously make sure you have a way of revoking them if you plan to create 10 year certificates!

On 29/10/2025 at 14:36, Julian said:

The only problem is that the certificate only lasts 1 year. So, document well what you code sign.

 

 

for intune, I have looked into cloud PKI in the past, microsoft cloud PKI is now a thing but it is an expensive intune addon, not sure if there is an education cheap intune addon license though.