Forum Discussion
MDEClientAnalyzer fails because dsregcmd.exe is distrusted
I have the problem that the MDEClientAnalyzer script always fails on my Windows 11 Enterprise 25H2 system because it fails to verify the signature of
C:\Windows\System32\dsregcmd.exe
That file is correctly signed by
667BBA1E1F478221AA65DE4F75187A751B03A453 CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
with issuer
CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256, O=Microsoft Corporation, C=US
This issuer is not included in the white-list of the MDEClientAnalyzer.ps1 script and thus distrusted.
Microsoft As this is clearly a bug - please update MDEClientAnalyzer scripts!
4 Replies
I had the same problem. The script was updated yesterday and the error is now gone.
But instead I recieve "You cannot call a method on a null-valued expression.
At C:\MDE\MDEClientAnalyzer.ps1:4381 char:2
+ $CertAsBytes = ([System.Security.Cryptography.X509Certificates.X5 ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull"
I haven't tried to figure out why..Windows systems with October 2026 CU installed are affected as MS released the new Code Signing PCA 2026 certificate and the script does not have it listed. Same crap with linux utilities.
From Issuerinfo.txt:
EnhancedKeyUsageList : {Windows System Component Verification (1.3.6.1.4.1.311.10.3.6), Code Signing (1.3.6.1.5.5.7.3.3)}
DnsNameList : {Microsoft Windows}
SendAsTrustedIssuer : False
EnrollmentPolicyEndPoint : Microsoft.CertificateServices.Commands.EnrollmentEndPointProperty
EnrollmentServerEndPoint : Microsoft.CertificateServices.Commands.EnrollmentEndPointProperty
PolicyId :
Archived : False
Extensions : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid...}
FriendlyName :
IssuerName : System.Security.Cryptography.X509Certificates.X500DistinguishedName
NotAfter : 8/5/2027 8:49:20 PM
NotBefore : 8/6/2026 8:49:20 PM
HasPrivateKey : False
PrivateKey :
PublicKey : System.Security.Cryptography.X509Certificates.PublicKey
RawData : {48, 130, 5, 37...}
SerialNumber : 3300000017D4DFD9E3950BE7EF000000000017
SubjectName : System.Security.Cryptography.X509Certificates.X500DistinguishedName
SignatureAlgorithm : System.Security.Cryptography.Oid
Thumbprint : 667BBA1E1F478221AA65DE4F75187A751B03A453
Version : 3
Handle : 2529724754528
Issuer : CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256, O=Microsoft Corporation, C=US
Subject : CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
That's a first for me. Is this happening on every device? If yes, then you can try adding the file hash in the IoC to trust it.
I am not a global admin, so I have only three systems I control, and 2 of them are affected, thus have
dsregcmd.exe signed by a certificate issued by "CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256, O=Microsoft Corporation, C=US". This intermediate cert has been issued on August 4th 2026. So Microsoft had two months to update the script but nothing happened :(
Just for the record the original error message I get is:
Test-AuthenticodeSignature : Script execution terminated because a process or script that is not Microsoft signed was
detected
In C:\MDEClientAnalyzer\MDEClientAnalyzer.ps1:2733 Zeichen:3
+ Test-AuthenticodeSignature $command.path
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
+ FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Test-AuthenticodeSignature
This error message itself is a problem as it very generic. To identify the root cause I had to manually debug
MDEClientAnalyzer.ps1
A clean and useful error message should output the cause thus the path C:\Windows\System32\dsregcmd.exe and the distrusted issuer it found.
