0

I use signed PowerShell scripts within my infrastructure and log all PowerShell activity via Windows EventLog. Sadly it seem that windows does not log a hash or fingerprint of signed scripts or even any information about the status of a script as long as I do not prohibit unsigneds scripts from executing. I'm not quite ready to do that and had hoped to use the logging to find where unsigned scripts are in use.

Is there a way to make widows log not only sript execution but also more information about that script like is it signed, its hash or fingerprint and the validity of that signature or the signature itself?

Many thanks in advance.

3
  • Disallowing unsigned scripts is simply intended to be a convenience for you. This feature only applies to regular users, and nearly all regular users aren't "PowerShell users", so they are probably running a script as part of a logon process or a scheduled task, but not directly. Additionally, an ability to do this doesn't mean much for someone that runs WebClient and streams a Base64-encoded byte array and runs that PowerShell code over the Internet without persisting the code to a script file at all.
    – Greg Askew
    May 8, 2023 at 13:15
  • So what you're saying is the PowerShell execution policy is not a security feature worth fiddling with?
    – twconnell
    May 11, 2023 at 22:09
  • It's not really much of a security feature at all. When your execution policy is AllSigned, it's intended to prevent unauthorized modifications to script files like local logon or startup script. But that's it. It's very narrow. The about_Execution_Policies help topic says: "The execution policy isn't a security system that restricts user actions. For example, users can easily bypass a policy by typing the script contents at the command line when they cannot run a script. Instead, the execution policy helps users to set basic rules and prevents them from violating them unintentionally."
    – Bacon Bits
    Jun 22, 2023 at 14:37

0

You must log in to answer this question.

Browse other questions tagged .