Using Signed Scripts

Topic

This article explains how to import and run signed scripts in NinjaOne.

Environment

NinjaOne

Description

A signed script includes a code signature that verifies who published it and confirms that no one has modified the file since signing. This article explains how to import and run a signed script in NinjaOne.

This article does not cover the process of signing a script. For an explanation of that procedure, refer to Adam the Automator's guide: How to Sign PowerShell Script (external link).

Index

Select a category to learn more:

Certificate Options
Signing Your Script
Importing a Signed Script into NinjaOne
Running a Signed Script
Using the Signature for Allowlisting
Additional Resources

Certificate Options

There are two options for a signing certificate:

Certificate from a public Certificate Authority (CA). These certificates are automatically trusted on endpoints because the CA is already in the Windows trusted root store.
Self-signed certificate. There is no cost for these certificates, but the certificate must be manually deployed and trusted on each endpoint before signed scripts will validate.

Signing Your Script

Script signing happens outside of NinjaOne, using your certificate and PowerShell's cmdlet (or your CA's equivalent tooling).

For step-by-step instructions, refer to Adam the Automator's guide: How to Sign PowerShell Script (external link).

Do not edit a script after it's signed. Any modification invalidates the signature. To change a signed script, edit the source file and re-sign it as a new file.

Importing a Signed Script into NinjaOne

You must import signed scripts as a file. Do not copy and paste script content into the script editor, as this strips the signature and imports the script as unsigned.

To import a signed script:

Navigate to Administration → Library → Automation and click Add Automation.
Click Import from file.
Select your signed .ps1 file.

Running a Signed Script

A signed script runs the same way as any other script in your Automation Library. NinjaOne preserves the file as-is on execution, so the signature remains intact.

Using the Signature for Allowlisting

Your security product uses the certificate for your signed script to build an allowlist rule. Rules based on the certificate rather than a file hash will remain valid even if the script's content changes across versions, as long as the script is re-signed with the same certificate.

Additional Resources

For the full script-signing walkthrough, refer to Adam the Automator's guide: How to Sign PowerShell Script (external link).

For information about NinjaOne PowerShell commands, refer to: NinjaOne Endpoint Management: Index of PowerShell Commands and Articles.