Worklet/Policy Fails as Not Digitally Signed With Script Signing Enabled

Issue

A Worklet or policy fails on a Windows device with an error similar to:

File C:\Program Files (x86)\Automox\execDir...\execcmd....ps1 cannot be loaded. The file
...execcmd....ps1 is not digitally signed. You cannot run this script on the current system.
For more information about running scripts and setting execution policy, see
about_Execution_Policies at https://go.microsoft.com/fwlink/?LinkID=135170.
    + CategoryInfo          : SecurityError: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : UnauthorizedAccess

This happens even though Script Signing is enabled for the organization and the device runs with an AllSigned PowerShell execution policy. In some cases the whole policy fails; in others the policy's evaluation runs but the remediation step fails with this error.

Environment

• Automox (current agent release)
• Windows devices
• Script Signing enabled for the organization
• Devices whose PowerShell execution policy is AllSigned (often enforced by Group Policy)

Overview

When Script Signing is enabled, Automox signs the PowerShell for your Windows Worklets and policies with your organization's Automox signing certificate, and the agent installs that certificate into the device's trusted certificate stores. Under an AllSigned execution policy, Windows will only run a script that meets both of these conditions:

• The script content Automox delivered actually carries a valid signature, and
• The device trusts your organization's Automox signing certificate.

The key detail behind most of these failures: Automox signs a policy's scripts when the policy is saved. Turning Script Signing on does not retroactively sign policies that already existed. A Worklet or policy that was created (or last saved) before you enabled Script Signing keeps unsigned script content until you save it again. On an AllSigned device, that unsigned content is rejected with "is not digitally signed."

Resolution

1. Confirm Script Signing is enabled for the organization

Verify the feature is turned on in your Automox organization settings before troubleshooting individual devices.

2. Re-save any Worklet or policy created before you enabled Script Signing (most common fix)

Signing is applied at save time, so existing policies need to be saved again to pick up a signature:

• Open the affected Worklet or policy in the console.
• Make a change and save it (if nothing needs to change, toggle a field and toggle it back so Save is available).
• This re-signs the policy's scripts and pushes the signed content to your devices on their next run.

Tell-tale for this cause: if both the evaluation and the remediation fail with "not digitally signed," the policy's scripts were never signed. Re-saving resolves it. There is no fleet-wide automatic re-sign when you first enable the feature, so plan to re-save each existing Windows Worklet and policy after turning Script Signing on.

3. Confirm the device trusts your organization's signing certificate

The agent installs your organization's Automox signing certificate during check-in and scan. A device that has not checked in or scanned since Script Signing was enabled may not yet trust the certificate, so even a validly signed script is refused:

• Confirm the device is online and has completed a check-in and scan after Script Signing was enabled.
• If the device has been offline, allow it to check in and scan, then re-run the policy.

4. Understand AllSigned and Group Policy precedence

A machine-wide AllSigned policy applied through Group Policy is enforced no matter what the agent requests for an individual script. This is expected. The correct fix is to make sure the scripts are properly signed (steps 2 and 3) rather than loosening the Group Policy. For the full execution-policy scope precedence (why a machine or Group Policy setting overrides a session setting), see One-Time "Set-ExecutionPolicy" Iteration in a Worklet and Microsoft's about_Execution_Policies.

5. If the evaluation runs but only the remediation fails

Re-save the policy (step 2) and let the device check in and scan again (step 3). If the remediation still fails with "not digitally signed" after a re-save and a fresh check-in, contact Automox Support with the policy and device details so the signed content can be reviewed.

Notes

• Signing happens when a policy is saved. Enabling Script Signing does not sign policies that already exist, so re-save your existing Windows Worklets and policies after you enable the feature.
• A policy's evaluation and remediation scripts are signed together at save time.
• If scripts run fine on a device set to RemoteSigned but fail on a device set to AllSigned, the difference is the execution policy strictness, not the agent. Signing the content (steps 2 and 3) is what lets it run under AllSigned.