search

microsoft / AaronLocker

Robust and practical application control for Windows
MIT License
604 stars 74 forks source link

How do we get signed scripts? #16

Closed JosephSzymanski closed 4 years ago

JosephSzymanski commented 4 years ago

I downloaded the latest master branch, but the scripts in there aren't signed, so I can't use the RemoteSigned execution policy. Is this intended, or is there a right way to get the signed scripts? I know I can work around this via execution mode unrestricted but obviously that won't work in production. Thanks!

PS C:\aaronlocker\AaronLocker-master\AaronLocker\Support> Get-AuthenticodeSignature .\DownloadAccesschk.ps1

Directory: C:\aaronlocker\AaronLocker-master\AaronLocker\Support

SignerCertificate Status Path

                                      NotSigned                              DownloadAccesschk.ps1
FriedrichWeinmann commented 4 years ago

Hi Joseph, RemoteSigned does NOT require all code to be signed. Only the code it detects as being from the internet or other untrusted sources.

To remove the "from the internet" flag, run the following line:

Get-ChildItem C:\aaronlocker\AaronLocker-master -Recurse | Unblock-File

Also, if you require script-code to be signed - something to consider if you deploy AppLocker - keep in mind, that for most script projects, it is better to re-publish foreign code under your own certificate, after passing it through a suitable validation procedure. That way you are not required to trust both intent and security of a developer you usually know very little about, code signing or no code-signing..

JosephSzymanski commented 4 years ago

Thanks so much for the education on this!