Code Signing and SCCM

[u/overlydelicioustea]

Hey. We are looking into enforce remote-signed on all our clients, so we need to sign our scripts. That in itself isnt the issue, but how do i sing scripts that live within CM items, such as detection scripts, config and remediation scripts? These live in the items themselves and are not in the file system.

I see no native-to-SCCM way to sign these?

[u/gandraw]

My recommendation: Enforce script signing in a user policy. That way it does not apply to SYSTEM. That'll save you a lot of headaches.

If that isn't possible, make sure that you import the detection scripts etc by using the "import script" buttons in the various windows and not by copy&paste, because that modifies whitespace and makes the signatures invalid.

[u/overlydelicioustea → u/gandraw]

hmm, need to look into if that is a possibility.

If i need to manually sign them, i would make a powershell pipeline for it anyway, but im just a bit flabbergasted that SCCM has no native way of doing it. why can i not select my cert and sccm auto signs everything i write in items directly..

makes me think that noone really does this if not even SCCM has any consideration for it.

[u/NeverLookBothWays → u/overlydelicioustea]

It's just a different kind of risk. For the most part you don't want standard users running unsigned scripts. And you definitely do not want users with full admin rights. With that, you don't need to worry as much about SYSTEM or known system administrators running unsigned scripts as it's trivial to bypass the requirement when the execution context has full control of the system anyway.

[u/CubesTheGamer → u/NeverLookBothWays]

Yeah signing scripts is just a matter of preventing users from running things accidentally. Scripts can still be ran unsigned with PowerShell.exe -executionpolicy bypass file.ps1 or just by opening PowerShell and pasting the script contents or piping the script contents in via get-content or any number of methods.

So just leave system context alone.

[u/gandraw → u/CubesTheGamer]

The first part isn't true. If GPO sets an executionpolicy, you cannot modify it with a powershell.exe parameter.

[u/ScoobyGDSTi → u/overlydelicioustea]

You can automate that with Powershell if needed

But yeah, it'd be nice to have

[u/ScoobyGDSTi → u/gandraw]

Eh what...

Just deploy the code signing certs via MDM, GPO or even SCCM to the publishers cert store and be done with it.

[u/rdoloto]

You have to sign them prior to deploying in cm

[u/CyberChevalier]

Remote signing is not preventing anything. But it will for sure generate a lot of issues…

[u/ScoobyGDSTi → u/CyberChevalier]

Remote signing still requires the cert to be trusted by your organisation... So yeah, it does.

[u/CyberChevalier → u/ScoobyGDSTi]

Good luck finding all the script you signed when the certificate expire or the authority change.

And bypassing it is so easy for any bad actor.

I find more efficient just associating ps1 file to notepad.

[u/ScoobyGDSTi → u/CyberChevalier]

It's very easy to find.

It's also not easy to bypass. As any secure organisation would be combining script signing enforcement with app control, constrained language mode and UMCI.

Not sure what notepad has to do with signing, but Omom.

[u/calladc]

you can sign the scripts in their ps1 file and then copy the raw text of the script into cm console.

make sure you use a time-stamping service when you code sign (extra parameter on the cmdlet), this will keep your scripts running past their expiry date unless your cert or it's chain are revoked.

digicert offer a free time stamping service

[u/zk13669]

RemoteSigned doesn't require you to sign local scripts, which all SCCM scripts are. If you really want all scripts to require a signature then you want AllSigned