Also, it doesn't really matter to me personally why it's running a unsigned powershell script on my server it's inappropriate for a security software provider to release unsigned scripts at all.
Apologies for the delay in replying, it took a while to actually reproduce this. Can I ask if you have a case open with Support for this, and if so what the SR number is? There's an SR open for a very similar question and I was wondering if it was yours as well...
I tested this with previous versions of the extension and they all behave the same way, so it's not specific to CU10 directly - I'm assuming that the reason you've only just noticed this is that it wasn't checked in previously: it was added as part of CU10, after which you started seeing the notifications.
The engineering and security teams have determined that this is as designed, as mentioned in the document I posted. I've asked for some more detail on this but in the meantime to prevent the notifications you can remove the support centre extension - it can be found under the ePolicy Orchestrator section of the Extensions page in ePO.
In the details you posted I read:
“ … powershell.exe -ExecutionPolicy Bypass -NoExit -NoProfile -Command –“
I see the option 'bypass' is set, which is fine to use here as it fits with the details offered in the MS link you offer. What I'm unsure about is the end of that line it has a seperator '-' but nothing else, is that a truncated/missing/a typo?
Quick question for you!
What is the output when you run this command please?
(Ref the article you posted.)
Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.
Thousands of customers use our Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership: