search

nsacyber / Windows-Secure-Host-Baseline

Configuration guidance for implementing the Windows 10 and Windows Server 2016 DoD Secure Host Baseline settings. #nsacyber
Other
1.55k stars 289 forks source link

Code signing #37

Open jeffschulman opened 6 years ago

jeffschulman commented 6 years ago

Can the scripts included in the SHB package be signed, so the PowerShell execution policy doesn't need to be set to a less secure level?

iadgovuser1 commented 6 years ago

I can but there is an issue where if you execute the signed PowerShell code on an a disconnect system or network, then there is a significant delay in execution.

iadgovuser1 commented 6 years ago

@jeffschulman what we will do in the future is starting using the releases feature of GitHub and then provide signed and unsigned versions as attachments to the release.

iadgovuser1 commented 6 years ago

You can also run powershell.exe -ExecutionPolicy Bypass. Execution Policy isn't a security feature.