2

I've been running PowerShell as admin for a while on this Windows Server 2008 R2 server. Today I noticed that the security dialog shows that the publisher for it is Unknown. I'm fairly certain Microsoft publishes PowerShell. I'm also fairly certain that's what used to be displayed, so now I'm concerned that my PowerShell installation is corrupt.

There doesn't seem to be a simple way to re-install or repair PowerShell on Windows Server 2008 R2. I installed WMF 4.0 but the problem persists.

How do I make sure I run the trusted PowerShell.exe?

  • 1. Are you sure you are running C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe or is the binary in another location? 2. Submit the binary to virustotal.com... – Ryan Ries Aug 3 '16 at 17:30
  • @RyanRies location is good, virustotal reports no problem. – Guillaume CR Aug 3 '16 at 17:44
  • @GuillaumeCR Try running sfc /verifyonly from an elevated prompt to check for issues with your system files. If any are detected you can attempt to repair them with sfc /scannow. (A reboot may be required for the latter.) – Viertaxa Aug 3 '16 at 18:07
  • @Viertaxa Windows Resource Protection did not find any integrity violations. – Guillaume CR Aug 3 '16 at 19:23
  • Delete your shortcut and recreate a new one. If that fails, go to the actual powershell.exe file in %windowsdir% and manually spy it's file specifications. If the details are wrong there, please advise. – Colyn1337 Aug 3 '16 at 22:24
0

Run the following:

sigcheck.exe -i C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

sigcheck.exe is a SysInternals tool you have to download

It should show you the certificates used to digitally sign the PowerShell executable.

I think not all the certificates have to be valid, but at least one.

  • Verified: Unsigned Link date: 3:01 PM 8/26/2015 Publisher: n/a Company: Microsoft Corporation Description: Windows PowerShell Product: Microsoft« Windows« Operating System Prod version: 10.0.10514.6 File version: 10.0.10514.6 (th2_release_svc.150826-1230) MachineType: 64-bit – Guillaume CR Aug 8 '16 at 14:44
  • Ran with both the 32 and 64 bit version. Same results. – Guillaume CR Aug 8 '16 at 14:55
  • Verified: Unsigned doesn't sound right, it should say Verified: Signed, the rest looks okay, but are all certificates valid? – Peter Hahndorf Aug 8 '16 at 16:08
  • Sigcheck did not display any certs, I assume because it detected the exe was not signed. – Guillaume CR Aug 8 '16 at 18:06
  • I would compare a file hash for PowerShell.exe with another machine and the same version and upload it to VirusTotal. I wouldn't trust it at this point – Peter Hahndorf Aug 8 '16 at 18:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.