SCCM Detection Method: Error 0x87D00327 (-2016410841) Script is not signed

Question

I discovered a problem in SCCM compliance. When using a PS script for detection, an error (0x87D00327 (-2016410841) Script is not signed) is returned. After closer examination of the problem, I found out:
SCCM creates a temporary ps1 file in the C:\Windows\CCM\SystemTemp.
This file is slightly different from the original. The original contains CR+LF at the end of the line, the SCCM file contains only LF at the end of the line. Powershell cannot detect a signed script file with only LF line ending.

Is it possible to confirm this statement that this is indeed the case? And the error is on the SCCM side because it changes the content?

Examples of files

Original Sample:

SCCM script sample:

Answer 1

You need to open a support case at this point as something else is going on here. Using the Open button and selecting the file does not (or at least should not) modify the file in any way -- that's the entire point of the open function. I've used this in multiple production environments without issue and have recently tested in my lab as well.

Answer 2

Hi,

By default, the Powershell execution policy is set as Restricted, you can type in Powershell Get-ExecutionPolicy to know.

If you want sign your scripts, you can change this policy to AllSigned and sign it using a Certificate Code Signing template, don't forget to install this certificate into Trusted Publisher certificate store. Only signed scripts will be allowed to run, you can also bypass this policy but It's not secure and recommended.

You can change the Powershell execution policy under Client Settings > Computer Agent.

Regards,

---

Youssef Saad | New blog: https://youssef-saad.blogspot.com
Please remember to ** “Accept answer” ** for useful answers, thank you!

Answer 3

Assuming you are talking about a detection script within a configuration item, how did you add the script? If you copied and pasted, then yes, the above behavior will occur. You must use the "Open" button when creating or updating the detection script in the CI for it to properly preserve the script and signature.

As an additional note here, don't use Win32_Product. It has known, negative side effects (yes, just querying the class) and for anything except one off use, it's strongly recommended that you don't use it.

Answer 4

Yes, Im talking about a detection script within a configuration item. I have GPO setting set to Allsigned. I try both metod Copy/Paste and Open.../file.ps1. Both metod are ended with same error.
I know, I could change ExecutionPolicy, but I don't want to.
If I run the Signed Script, it runs on the PC without any problems, but not via SCCM Compliance. There is an error in modifying the end of the line.

Answer 5

Hi @PM did you ever resolve this issue? Having the same issue with MECM Version 2309.