EPO 5.10 Update 10 Unsigned powershell

[enxl]

CU7

[enxl]

Also, it doesn't really matter to me personally why it's running a unsigned powershell script on my server it's inappropriate for a security software provider to release unsigned scripts at all. 

[enxl]

So the powershell script is generated by the support center extension.

Please explain how it's acceptable for that script to be unsigned?

[JoeBidgood]

Apologies for the delay in replying, it took a while to actually reproduce this. Can I ask if you have a case open with Support for this, and if so what the SR number is? There's an SR open for a very similar question and I was wondering if it was yours as well...

I tested this with previous versions of the extension and they all behave the same way, so it's not specific to CU10 directly - I'm assuming that the reason you've only just noticed this is that it wasn't checked in previously: it was added as part of CU10, after which you started seeing the notifications.

The engineering and security teams have determined that this is as designed, as mentioned in the document I posted. I've asked for some more detail on this but in the meantime to prevent the notifications you can remove the support centre extension - it can be found under the ePolicy Orchestrator section of the Extensions page in ePO.

Regards -

Joe

[Hawkmoon]

Hi enxl,

In the details you posted I read:

“ … powershell.exe -ExecutionPolicy Bypass -NoExit -NoProfile -Command –“

I see the option 'bypass' is set, which is fine to use here as it fits with the details offered in the MS link you offer. What I'm unsure about is the end of that line it has a seperator '-' but nothing else, is that a truncated/missing/a typo?

Quick question for you!
What is the output when you run this command please?
(Ref the article you posted.)

Get-ExecutionPolicy -List