So let's go back into our environment, and this time,
we're going to understand the impact of execution policies.
We'll do this by first setting execution‑policy values,
then we'll execute PowerShell commands,
and then we'll execute PowerShell scripts on various
configurations of the execution‑policy values.
So we're back on the Windows machine,
and the first thing we're going to do is set the ExecutionPolicy to Restricted,
which is the default one for Windows.
So I'm going to say Get‑ExecutionPolicy.
And if I do the ‑List version, you can see we only have one ExecutionPolicy,
which is great.
So the first thing we want to do here is test what
happens when we run a PowerShell command,
so Get‑Process.
Works beautifully.
If I say Get‑ChildItem, it works amazingly well too.
So PowerShell commands execute fantastically well when we
are in any of the execution policies.
There is no restriction on PowerShell commands executing.
However, if they are script loaded, then things can be a little bit different.
So I have a couple of scripts we're going to run.
So the first one is going to be what's called Unsigned‑Script,
so this is one that isn't signed with a certificate.
Okay, so in Restricted mode, it tells me it's not going to work.
So let me try a Signed version of that,
which has been signed with an SSL certificate.
Okay, that doesn't work either.
Now I'm pretty sure this one's not going to work,
which is the downloaded from the internet one.
And sure enough, that one fails too.
So in Restricted mode, it's not going to let you execute anything.
So let me clear this out.
Let's set the ExecutionPolicy, this time to RemoteSigned.
Now we know that RemoteSigned requires that if a file has been downloaded,
which is remote from this machine and not created locally,
it needs to be signed.
So let me just check the ExecutionPolicy here in our ‑List.
And sure enough, it's RemoteSigned.
So let's rerun our same commands, so Unsigned.
Okay, Unsigned works.
And you may wonder what that is, that's just the Get‑Process command,
but colored.
Let's do the Signed one.
Okay, that one works, too, because these were created locally.
And then let's do the Downloaded‑Script.
Okay, that one doesn't.
That one doesn't work because it was downloaded,
and it's not digitally signed, and it's from Remote.
Now, I also have another version of the Downloaded‑Script that has been signed.
And sure enough, that one works.
Now I signed that with my own certificate.
So as you can see,
RemoteSigned works for anything that's internally created
locally and if it's externally been signed,
as well.
So how does the signing process work?
Well, I thought it might be useful to understand how to create that kind of idea,
and so I'm going to bring up some PowerShell and paste some commands in.
So the first command I'm going to write here,
you'll see I'm creating a New‑SelfSignedCertificate.
I'm going to call it G‑Authenticode.
And then I've got a FriendlyName of Globomantics,
and I'm going to put it in my Local Certificate Store.
So if I just do $cert, you can see there's my certificate.
What I'm going to do, now, bear in mind,
I could click the Start menu here and then go to the MMC snap‑in.
I'm going to click Yes here.
Make that full screen.
And you know, when we click File, Add or Remove,
click Certificates, Add, Computer account,
Next, and Finish, and click OK.
Well, if I expand into my Personal Certificates, you'll see it's there.
Now what we can do is I can copy and paste that into the various locations,
such as Trusted Root Certificate Authorities,
as well as Trusted Publishers(Certificates).
I'm going to minimize.
I like to use PowerShell,
so I'm going to use some PowerShell commands to do the same thing.
We'll just paste those in here,
and you'll see it's going to add the certificates into that same place.
And then if I want to add that to the publishing option,
I'm going to paste that in too, and press Enter.
Now if I go back to my MMC snap‑in here and just Refresh,
you'll see my G‑Authenticode one is here.
And then if I refresh here in my Trusted, it shows up as well.
So we can use PowerShell to do the same thing, so let me just clear that.
Now that we have that, we can simply set our variables.
So I'm going to create a variable here called $scriptPath,
and I'm going to call it Downloaded‑Signed.
And I'm going to put these in quotes because I know that my
PowerShell script just runs automatically.
What I'm then going to do is I need to retrieve the certificate that we created.
Let me just make sure I've got the $ on the end there for the variable,
so I have a $cert like so,
and then we're going to use a value command called Set‑AuthenticodeSignature.
The file path, which is my downloaded script,
and then, of course, the Certificate and the TimeStamp.
I'm going to press Enter here, and it will tell me it's been signed.
Now, when we look at that file,
there will be a block of SSL certificate inside of it now,
which will represent it being signed.
So if I flick to Visual Studio Code here,
you can see that my Downloaded‑Signed‑Script now has
this block in the bottom of it,
which represents the fact that it's been signed automatically,
so let me minimize that, which is why,
when I say Downloaded‑Signed‑Script and execute it in this mode,
it works well.
Okay, so let's change our execution policy a little bit more.
So remember, we have RemoteSigned, which we used.
We also had Restricted.
Now we could also set it to Unrestricted, or we can say AllSigned.
So let's do Get‑ExecutionPolicy.
So now let's try and run a PowerShell command, so Get‑Process.
Okay, so there's no impact there, so let's try and run our specific commands.
So I have my Unsigned one.
Okay, that fails.
If I do Sign‑Script, that one comes back and complains that it's not trusted,
which means it was previously signed with something else.
But if I go to my Downloaded‑Signed‑Script, now that one executes.
So AllSigned requires everything to be signed, irrelevant to where it's from.
So, what we could do is we could actually fix the issue,
so we could say $scriptPath =.
And we've got my Signed certificate here, so I'm just going do that.
If I loop through my commands a little bit.
If we go back to here, I've got my certificate,
and then I've got my other command I ran,
which was to set the code.
Okay, let's just clear that.
If I now say Signed‑Script, you'll see that now works.
So it's very easy to see the impact of executing various things,
like the mode, will be set to this, and it won't work,
but actually, it might work if you set it this way or you sign it.
Now one last test here.
So let me clear this out.
Let me set the ExecutionPolicy to be Restricted, so we know that nothing works.
So I'm going to say get‑executionPolicy ‑List.
What I'm then going to do is run my other approach,
which is to launch it for a specific session,
and then I'm going to say Unrestricted, like so.
Okay, so that launches my ExecutionPolicy now.
So what I'm able to do at this point is then look through the various commands.
Well, first off, we're going to say Get‑executionPolicy ‑List,
and you can see that the LocalMachine is Restricted,
but my Process is Unrestricted.
So the question would be, which one takes precedence?
So if I try to run a script now, am I going to be Restricted,
or am I going to be Unrestricted?
So let's look in the folder here.
So I've got my list of PowerShell scripts.
So I'm going to say Unsigned, and it works.
Okay, let's try a Signed one.
That works.
Let's try our Downloaded‑Script.
Okay, so now this prompts me and says, hold on a minute,
you can't just run that one.
So I'm going to say Run.
And if I say Downloaded‑Signed, that one just executes.
So you can see it kind of bounces between the two.
That Unrestricted lets you run everything, but does just let you prompt.
But then you also have the LocalMachine, that does Restrict.
So in this instance,
your Process obviously takes precedence and allows access to run.
If I now click exit and then Get‑ExecutionPolicy ‑List,
you'll see that that's been removed.
And so when I try to now execute, it's going to fail.
So it's really,
really important to understand the impact that these execution policies
and scopes can have on the PowerShell scripts that you,
as an administrator,
someone that's performing perhaps forensic information gathering on a machine,
as well as trying to find out what's happened to something.
It's important to know, one, which one for you to use,
and two, if there's been adjustments, what was that for,
and does that mean that something malicious has been executed?