search

memstechtips / UnattendedWinstall

Personalized Unattended Answer Files that helps automatically debloat and customize Windows 10 & 11 during the installation process.
MIT License
3.61k stars 402 forks source link

Possible security issue with ExecutionPolicy #94

Closed cyb3rm4gus closed 3 months ago

cyb3rm4gus commented 3 months ago

First of all thx for this script! Debloating windows is a noble cause.

I have a question about .ps1 scripts. Does the script and changes it makes rely on some .ps1 scripts running AFTER the installation on a regular basis? Because if no, then this setting:

Set-ExecutionPolicy -Scope LocalMachine -ExecutionPolicy RemoteSigned -Force Is kinda bad thing to keep in your system, because given that malicious actor (a hacker) has access to the system, they can get a solid foothold by creating & persistently running a .ps1 script that can act as a backdoor / remote access tool. It's not a huge vulnerability overall, given that somehow a hacker still needs to get some access to the system. But it removes one of the layers of security, so if there is no need to keep it that way, I suggest that after the install is done ExecutionPolicy be set as follows:

Set-ExecutionPolicy -Scope LocalMachine -ExecutionPolicy AllSigned -Force

memstechtips commented 3 months ago

I thought it might be needed for the Chris Titus Windows Utility to run, but after testing it, it works with Set-ExecutionPolicy -Scope LocalMachine -ExecutionPolicy AllSigned -Force so I will change it to that.

Thanks

memstechtips commented 3 months ago

Added in https://github.com/memstechtips/UnattendedWinstall/commit/9f13a88f1c5291e348e7ad98c051a1fed5358497