Review unsigned PowerShell scripts in a repository
Documentation: Microsoft Learn
Check PowerShell script signatures without executing the files. Identify unsigned scripts and review their signature status.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-ChildItem -Path . -Filter *.ps1 -File -Recurse | ForEach-Object {
$sig = Get-AuthenticodeSignature -LiteralPath $_.FullName
[pscustomobject]@{ Path= $_.FullName; Status= $sig.Status; Signer=if($sig.SignerCertificate){ $sig.SignerCertificate.Subject}else{ $null } } } | Where-Object Status -ne 'Valid' | Sort-Object Status,Path- Stage 1Get-ChildItem
-Path -Filter -File -Recurse - Stage 2ForEach-Object
Positional values or no named parameters - Stage 3Where-Object
-ne - Stage 4Sort-Object
Positional values or no named parameters
How it works
Check PowerShell script signatures without executing the files. Identify unsigned scripts and review their signature status. The report keeps the signature status and signer together so unsigned, hash-mismatched and trust-chain failures are not flattened into one bucket.
Adapting it
Include .psm1 and .psd1 when module files are in scope. Export the objects to CSV for a remediation queue rather than formatting them first.
Primary documentation
Get-ChildItem reference · Where-Object reference · ForEach-Object reference
