{"id":534,"date":"2013-03-19T23:06:37","date_gmt":"2013-03-19T22:06:37","guid":{"rendered":"http:\/\/sccmfaq.wordpress.com\/?p=534"},"modified":"2013-03-19T23:06:37","modified_gmt":"2013-03-19T22:06:37","slug":"sccm-2012-application-detection-with-powershell-and-code-signing","status":"publish","type":"post","link":"https:\/\/blog.hosebei.ch\/?p=534","title":{"rendered":"SCCM 2012 – Application detection with Powershell … and code-signing"},"content":{"rendered":"

With System Center 2012 Configuration Manager, we all know it, the new Application model was released. As long as you deploy MSI, the detection method, is very easy to define. But what, if you want to check a registry key, as needed with .Net installations? No Problem. What, if you want to check if the Installation was successfull with a VB-Script? It’s that easy (Look at this very good Blog Post about the Topic to deploy the App-V 5 Client: http:\/\/scug.be\/sccm\/category\/detection-methods). And with a Powershell script? Uhm… Yes surprisingly, the block of\u00a0scripts also applied to the detection method, and honestly, in my home environment, there is absolutely no doubt to decrease this behaviour below AllSigned, my home is my Castle \ud83d\ude09 I need to code-sign the script!<\/p>\n

So i just made a simple application, it copies a file called eins.txt to c:\\temp\\test\\eins.txt, and the Powershell script then checks the existence of the file. But lets get first to some screenshots, and after that to the codes \ud83d\ude42<\/p>\n

First, you will need to create the Application, and a deployment type, this is how my deployment type is looking:
\n\"Deployment<\/a>The detection method is now configured with a Powershell script, without any code-signing:
\n\"Powershell<\/a>Here is this simple code snippet:
\n$TestFile = Get-ChildItem -Path \"C:\\temp\\test\\eins.txt\"
\n$TestFile.Exists<\/code><\/p>\n

If you deploy an application like this, and the Powershell Execution Policy is set to run only signed scripts, you will find the following error message in the AppDiscovery.log:
\n\"AppDiscovery.log\"<\/a><\/p>\n

In-line script returned error output: & : File C:\\Windows\\CCM\\System\\Temp\\49e933fa-9975-42dd-b248-36689fc53149.ps1
\ncannot be loaded. The file
\nC:\\Windows\\CCM\\System\\Temp\\49e933fa-9975-42dd-b248-36689fc53149.ps1 is not
\ndigitally signed. The script will not execute on the system. For more
\ninformation, see about_Execution_Policies at
\nhttp:\/\/go.microsoft.com\/fwlink\/?LinkID=135170<\/a>.
\nAt line:1 char:3
\n+ & 'C:\\Windows\\CCM\\System\\Temp\\49e933fa-9975-42dd-b248-36689fc53149.ps1'
\n+\u00a0\u00a0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
\n+ CategoryInfo\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : SecurityError: (:) [], PSSecurityException
\n+ FullyQualifiedErrorId : UnauthorizedAccess
\n<\/code>
\nSo what’s next? You’ve got to get a code-signing certificate, you can get it easily from your PKI, hopefully you got one.<\/p>\n

After this, you can sign your Powershell script with the following command:
\nSet-AuthenticodeSignature c:\\temp\\test-file.ps1 @(Get-ChildItem cert:CurrentUserMy -codesigning)[0]<\/code>
\nIf there are more than one code-signing capable certificates in the store, you have to use another term, in my case:
\nSet-AuthenticodeSignature C:\\temp\\test-file.ps1 @(Get-ChildItem cert:CurrentUserMy1A7D1E2B6
\nD87D6B2DD06C2A59106FE91BE11D02E)[0]<\/code><\/p>\n

You should not receive any error messages. I used ISE to make and save the script on Windows 8. Be Aware, in earlier Versions of ISE, there was a Problem with signing script saved from ISE: http:\/\/connect.microsoft.com\/PowerShell\/feedback\/details\/483431\/set-authenticodesignature-fails-on-scripts-created-from-ise
\nThe Workaround was, to open the script from\u00a0ISE in Notepad, copy and paste it in a new Notepad document, then save, sign and use the new script.<\/p>\n

When the script is saved, you can Import it to the detection method:
\n\"Import<\/a>Navigate to your script and open it:
\n\"import\"<\/a>Now, the detection method is working, when your have imported the public key of the code-signing certificate to the Trusted Publisher store of the Destination Computer. And then, you will get your detection mehtod with powershell working:
\n\"software<\/a><\/p>\n

\/Update:
\nThis will not work while on OSD \ud83d\ude41
\nSee this TechNet Post: http:\/\/social.technet.microsoft.com\/Forums\/en-US\/configmanagerosd\/thread\/59a35100-4772-4c99-a1d9-058ac77be1ba<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

With System Center 2012 Configuration Manager, we all know it, the new Application model was released. As long as you deploy MSI, the detection method, is very easy to define. But what, if you want to check a registry key, as needed with .Net installations? No Problem. What, if you want to check if the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,40],"tags":[],"class_list":["post-534","post","type-post","status-publish","format-standard","hentry","category-application-management","category-tools"],"_links":{"self":[{"href":"https:\/\/blog.hosebei.ch\/index.php?rest_route=\/wp\/v2\/posts\/534","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.hosebei.ch\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.hosebei.ch\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.hosebei.ch\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.hosebei.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=534"}],"version-history":[{"count":0,"href":"https:\/\/blog.hosebei.ch\/index.php?rest_route=\/wp\/v2\/posts\/534\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.hosebei.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=534"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.hosebei.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=534"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.hosebei.ch\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=534"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}