Forum Discussion
MDEClientAnalyzer fails because dsregcmd.exe is distrusted
That's a first for me. Is this happening on every device? If yes, then you can try adding the file hash in the IoC to trust it.
I am not a global admin, so I have only three systems I control, and 2 of them are affected, thus have
dsregcmd.exe signed by a certificate issued by "CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256, O=Microsoft Corporation, C=US". This intermediate cert has been issued on August 4th 2026. So Microsoft had two months to update the script but nothing happened :(
Just for the record the original error message I get is:
Test-AuthenticodeSignature : Script execution terminated because a process or script that is not Microsoft signed was
detected
In C:\MDEClientAnalyzer\MDEClientAnalyzer.ps1:2733 Zeichen:3
+ Test-AuthenticodeSignature $command.path
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
+ FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Test-AuthenticodeSignature
This error message itself is a problem as it very generic. To identify the root cause I had to manually debug
MDEClientAnalyzer.ps1
A clean and useful error message should output the cause thus the path C:\Windows\System32\dsregcmd.exe and the distrusted issuer it found.