title: Running CodeSigned powershell scripts on target machines
body: <p><strong>Goal:</strong> I would like to run my custom powershell scripts that are signed with a valid certificate against target machines with their powershell execution policy set to “AllSigned” without having to install another certificate on the target machine. </p>
  
  <p><strong>Problem:</strong> The powershell scripts will not run until I install the public key of the certificate I used to sign the scripts as a trusted publisher (lets call it MyCert.cer) on the target machine. </p>
  
  <p><strong>Possible Misunderstanding:</strong> I could be misunderstanding the way code siging works with my “problem” above. However I was under the impression that since windows comes with DigiCert certificates installed by default as “Trusted Root Certification Authorities”  (See image below) that all I would need for my signed scripts to work is signing them from a digicert authority. 
  <a href="https://i.stack.imgur.com/RwU8Q.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/RwU8Q.png" alt="Screenshot of TrustedRootCertAuth section of certificates"></a></p>
  
  <p><strong>My Certificate details:</strong> </p>
  
  <ul>
  <li>I purchased a code signing certificate from DigiCert. The certificate is valid and has an “EKU” of “Code Signing (1.3.6.1.5.5.7.3.3)”. </li>
  <li><p>Certificate chain:</p>
  
  <p><a href="https://i.stack.imgur.com/WkWiL.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/WkWiL.png" alt="My Certificates cert chain"></a></p></li>
  </ul>
  
  <p><strong>Final Thoughts:</strong>  I signed the powershell scripts using the cmdlet “Set-AuthenticodeSignature” and my issued code signing certificate. The scripts will run if I install the MyCert.cer public key as a “Trusted Publisher” on the target machine. However, I would like to not have to touch the target machine and be able to run my code signed scripts against said machine. Is this possible? Have I purchased the wrong certificate for my goal? Or is an entry to the Trusted Publishers certificate store required for running code signed scripts?
  Thank you for your time.</p>
  
  <p><strong>Update:</strong> Here is the command I used to sign the powershell scripts.</p>
  
  <p><code>Set-AuthenticodeSignature -Certificate $cert -FilePath $FileToSign -IncludeChain all</code></p>
  
  <p>I wanted to let everyone know that I did include "All" for the includeChain. I have also tried using digiCerts timestamp server for the -TimestampServer parameter. However adding the timestamp does not make a difference for running the script. The -TimestampServer parameter as to my understanding is for when a certificate expires and need to be re-validated. However the certificate I am using is still current and not expired. </p>