Understanding Powershell ExecutionPolicy and securing Powershell CmdLets/Scripts with Code-Signing Certificate

One of the great things about Powershell is that its powerful and at the same time very safe. Powershell script cannot be executed as is unless user provides permission to execute PS script/cmdlet/module. This is generally set through Powershell Execution Policy. There are four types of Execution Policy:

• Allsigned
• RemoteSigned
• Restricted
• Unrestricted

AllSigned - Scripts will run only if they have been signed by a trusted publisher.

RemoteSigned - Scripts created locally will run, but those downloaded from the Internet will not (unless they are digitally signed by a trusted publisher).
Restricted - Scripts won’t run.
Unrestricted - Scripts will run regardless of where they have come from and whether they are signed.

Ideally, all PS scripts should be digitally signed by a code-signing certificate. But in case, you don't want to buy an expensive code-signing certificate from a Certification Authority (CA), you can create a Self-Signed certificate and then add it to your Trusted store. Generally, these are the steps you will need to execute to create a self-signed certificate.

myScript.ps1 is a simple Powershell scripts that only prints hello world to console.

But once the script is digitally signed, a signature is added at the end that the script is from trusted authority and there have been to modification to the original script.

Remember, you need to add your self-signed certificate to Trusted Root in your Windows. Generally,

1. Open RUN type mmc 
2. File > Add or Remove Snap-in..
3. Select Certificate from snap-in menu, click Add (against my user account)
4. Expand Certificate - Current User
5. Expand Personal > Certificate
6. Find you certificate in here (in this case its Imran Aftab Rana)
7. Simply drag-n-drop it to Certificate - Current User > Certificate

Step 1:

Step 2.0:

Step 3:

Step 3:

Step 4, 5 & 6:

Step 7:

Step 7:

Finally, you can open Powershell in Administrator mode and run the script as follow:

The end result should look something like this: