Comment sécuriser et automatiser vos scripts PowerShell en entreprise

Running uncontrolled PowerShell scripts poses a significant risk in Active Directory and Azure AD environments as automation via PowerShell is essential for managing inventories and cleaning system caches. Allowing unsigned scripts to execute via scheduled tasks without integrity control exposes infrastructure to privilege escalation and malicious runs. To achieve maximum security, a strict execution policy coupled with automated log analysis analysis is crucial in any modern SecOps strategy.

Firstly, configure a strict ExecutionPolicy using Group Policy Objects (GPO) or Microsoft Intune. The RemoteSigned or AllSigned parameters ensure only internally developed or locally signed scripts can run. RemoteSigned only requires signing for scripts downloaded from the internet, while AllSigned applies to all scripts, including internal ones.

The latter is recommended for servers and admin workstations. Note that the Group Policy takes precedence over Intune settings and command-line execution policies. Get-ExecutionPolicy -List displays the value retained at each level.

Secondly, sign your scripts with a code signing certificate. An AllSigned policy only works if your own scripts are signed. The certificate must be from an internal certification authority (AD CS Code Signing template) and deployed via GPO into the trusted publisher store on devices. Without it, each execution prompts confirmation, and scheduled tasks that cannot respond fail. $cert = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert | Select-Object -First 1 $signature = @{ FilePath = .\Clear-TempFiles.ps1 Certificate = $cert HashAlgorithm = SHA256 TimestampServer = http://timestamp.digicert.com } Set-AuthenticodeSignature @ signature ( Get-AuthenticodeSignature .\Clear-TempFiles.ps1 ) . Status # Valid

Three details matter: HashAlgorithm, TimestampServer, and the impact of any modifications. Windows PowerShell 5.1 uses SHA-1 by default, but it still signs scripts. TimestampServer maintains signature validity post-certificate expiration. Any change, even a single space, results in HashMismatch and script denial. This is the desired integrity control.

Sign within your pipeline instead of locally to keep the private key in a secure vault, ensuring only code from the main branch receives a signature. Before this step, the repository passes the same controls as any other code, including static analysis with PSScriptAnalyzer and detection of accidentally commited secrets.