PowerShell Genie

Get-AuthenticodeSignature

Use Get-AuthenticodeSignature to read a file's signature status: Valid, NotSigned, HashMismatch, NotTrusted, NotSupportedFileFormat, or UnknownError.

Command 2 min read Windows PowerShell 5.1 and PowerShell 7

Documentation: Microsoft Learn — Get-AuthenticodeSignature

Written and tested by Dhrub Bharali · Updated

Syntax

1PS> Get-AuthenticodeSignature [-FilePath] <String[]> [<CommonParameters>]
See the command anatomy

Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.

Get-AuthenticodeSignature [-FilePath] <String[]> [<CommonParameters>]
  1. Stage 1Get-AuthenticodeSignature-FilePath

    Try it

    Windows PowerShell

    PowerShell example · browser support is limited.

    Execution scope: The full example below requires PowerShell outside this browser. You can edit this runner to use the supported practice commands; unsupported syntax returns an explanation.

    Interactive simulation · fictional data

    Examples

    Select Status, StatusMessage

    1PS> Get-AuthenticodeSignature C:\Scripts\Backup-Files.ps1 | Select-Object Status, StatusMessage
    Show reference output

    Sample output · fictional data, shaped like the real thing

    SignerCertificate                         Status  StatusMessage  Path
-----------------                         ------  -------------  ----
CN=Microsoft Corporation, O=Microsoft...  Valid   Signature verified  script.ps1

    Get-ChildItem -NoElement

    1PS> Get-ChildItem C:\Scripts\*.ps1 | Get-AuthenticodeSignature | Group-Object Status -NoElement
    Show reference output

    Sample output · fictional data, shaped like the real thing

    Count  Name
-----  ----
2      SampleA
1      SampleB

    Select Status, SignerCertificate

    1PS> Get-AuthenticodeSignature C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Select-Object Status, SignerCertificate
    Show reference output

    Sample output · fictional data, shaped like the real thing

    SignerCertificate                         Status  StatusMessage  Path
-----------------                         ------  -------------  ----
CN=Microsoft Corporation, O=Microsoft...  Valid   Signature verified  script.ps1

    Signature statuses

    Every result carries a Status. Here is what each value means and what to do about it.

    SignatureStatus values returned by Get-AuthenticodeSignature
    StatusWhat it meansWhat to do
    ValidThe file is signed, the signature is intact, and the certificate chain is trusted.The signature verified — treat the file as untampered by this check.
    NotSignedThe file has no digital signature at all.Normal for most scripts. Decide by your execution policy and how much you trust the source.
    HashMismatchThe file was modified after it was signed — content no longer matches the signature.Do not run it. Investigate what changed before trusting the file.
    NotTrustedThe file is signed, but the signing certificate is not trusted on this machine.Trust the publisher's certificate or verify the file's origin another way.
    NotSupportedFileFormatThe file type cannot carry an Authenticode signature.Expected for non-executable formats — nothing is wrong with the file.
    UnknownErrorThe status could not be determined, usually because the certificate chain cannot be built.Check trust configuration — a file Valid on one machine can be UnknownError on another purely because of trust.

    Parameters

    Parameter definitions:

    • -FilePath

    Get-AuthenticodeSignature on Microsoft Learn

    Recap

    Get-AuthenticodeSignature Use Get-AuthenticodeSignature to read a file's signature status: Valid, NotSigned, HashMismatch, NotTrusted, NotSupportedFileFormat, or UnknownError.

    Next: Set-AuthenticodeSignature
    Genie guideGet-AuthenticodeSignature

    Use Get-AuthenticodeSignature to read a file's signature status: Valid, NotSigned, HashMismatch, NotTrusted, NotSupportedFileFormat, or UnknownError. The console below is pre-loaded — run it, then change a value and run it again.

    Explore PowerShell Genie

    Related