Wednesday, May 16, 2007

How to sign PowerShell Scripts

Execution Policies: PowerShell supports a concept called "execution policies" in order to help deliver a more secure command line administration experience. Execution policies define the restrictions under which PowerShell loads files for execution and configuration. PowerShell is configured to run in its most secure mode by default. This mode is the "Restricted" execution policy, in which PowerShell operates as an interactive shell only.
The four Execution Policies are:
-Restricted >>>> default execution policy, does not run any scripts, interactive only.
-AllSigned >>>> runs scripts; all the scripts and configuration files must be signed by a publisher that you trust; opens you to the risk of running signed (but malicious) scripts, after confirming that you trust the publisher.
-Remote(ly)Signed >>>> runs scripts; all the scripts and configuration files downloaded from communication applications such as Microsoft Outlook, Internet Explorer, Outlook Express and Windows Messenger must be signed by a publisher that you trust; opens you to the risk of running malicious scripts not downloaded from these applications, without prompting.
-Unrestricted >>>> runs scripts; all the scripts and configuration files downloaded from communication applications such as Microsoft Outlook, Internet Explorer, Outlook Express and Windows Messenger run after confirming that you understand the file originated from the Internet; no digital signature is required; opens you to the risk of running unsigned, malicious scripts downloaded from these applications.
Changing Execution Policy: Run the following from a PowerShell prompt (AllSigned is an example): Set-ExecutionPolicy AllSigned. This command requires administrator privileges. Changes to the execution policy are recognized immediately.

No comments:

Post a Comment