title: Signing powershell scripts?
body: <p>We are going through our first go around in signing powershell scripts and just want to make sure we are doing everything correctly (best practices). So we just applied for an EV authenticode code signing cert from entrust.   </p>
  
  <p>So after we install the cert on a machine (personal certificates) and sign whatever scripts we need to sign then we will export the cert (without the private key) and push out the cert into the "Trusted Publishers" container through group policy. To be honest i'm not sure this step is required but i'm kind of using <a href="http://www.hanselman.com/blog/SigningPowerShellScripts.aspx" rel="nofollow">Scott Hanselman's blog post</a> as a template. Scott was doing this with a self-signed cert so i'm not sure if this step is required or not since the cert will be coming from a CA but i don't want users getting an error message the first time they trying to run a signed script.</p>
  
  <p>We are still working through exactly which machine we will install the cert onto but it looks like it might be our TFS Server (which is already tightly controlled). </p>
  
  <p>So does everything look right? Is there any need to export the cert (without the private key) and install it in the "Trusted Root Cert Authorities" container of every pc since its not a self-signed cert</p>
  
  <p><strong>Edit:</strong> I want to make an observation/correction on Keith Hill's accepted answer. I don't think his statement about not having to install the cert on the users pcs is correct (unless you want them to get a warning message when they first try to run a script that you signed). We just got our EV Authenticode cert from entrust and trying to run the cert for the first time we get the following warning message "Do you want to run software from this untrusted publiser?" Now they can choose '[A] Always Run' which will essentially add the public key to the cert store but if you never want them to get this warning message then you should add the public key to the 'Trusted Publishers" either manually or through group policy (which fixes the problem).</p>
  
  <p>If you think about it this makes sense. If you didn't have to add your public key to "Trusted Publishers" then anyone (outside your organization) that has access to a code signing cert could sign a powershell script that could be ran by the world that had their execution policy set to 'AllSigned'. Whats bad i found out in my testing is you can add the public key by answering  '[A] Always Run' to warning discussed above and it will add the public key to the Current Users 'Trusted Publishers' without admin privileges. </p>