Forum Discussion
Running a powershell script through a live response session
I have a powershell script, which has been digitally signed and uploaded to the files repository for usage within a 365 Defender Live Response Session.
The powershell script just runs these three commands:
Get-MpComputerStatus
Get-MpThreat
Get-MpPreference
I can run the script with no issues from my local machine as a regular user with no elevated privs.
If I initiate a Live Response session and run the file on the device, I receive the following:
Errors:
. : AuthorizationManager check failed.
At line:1 char:818
+ ... 27}.txt'; . 'C:\ProgramData\Microsoft\Windows Defender Advanced Threa ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : SecurityError: (:) [], PSSecurityException
+ FullyQualifiedErrorId : UnauthorizedAccess
You would think that owning the Security Administrator Role would permit running the script?
Any clues would be greatly appreciated.
Many thanks
I had the exact same issue. I had my code signing certificate installed in the current user's "Trusted Publishers" so I could both sign my script and run my script in Powershell. But when I tried to run the script in Live Response, it gave me the "AuthorizationManager check failed" error.
The code signing certificate needs to be installed into Local Computer/Trusted Publishers. Live Response shell runs as SYSTEM, and it needs to see your code signing certificate in order to trust the Powershell script. I'm still testing, but it sounds like you need to push out your code signing certificate to Local Computer/Trusted Publishers for your entire fleet. (Make sure when you export your code signing certificate to NOT include your private key, otherwise your certificate could be used by others to sign code)
I assumed that getting a code signing certificate from a trusted CA meant I wouldn't have to install my certificate on all computers but that doesn't appear to be the case.
- I've just found this, which may be the answer:
The AuthorizationManager check failed error can be thrown when importing modules or running scripts that were downloaded from the internet on Windows. You can use the Unblock-File cmdlet to ensure that the file can be run. - Commands are really limited during that session so don't think unlock command will work. Because it's been digitally signed, it should be trusted therefore renders that moot
- I'm facing exactly the same issue, and yet to find the solution. signed script works perfectly when run locally, however running the same script on the same machine via live response. fails with the same error - "AuthorizationManager check failed"
I had the exact same issue. I had my code signing certificate installed in the current user's "Trusted Publishers" so I could both sign my script and run my script in Powershell. But when I tried to run the script in Live Response, it gave me the "AuthorizationManager check failed" error.
The code signing certificate needs to be installed into Local Computer/Trusted Publishers. Live Response shell runs as SYSTEM, and it needs to see your code signing certificate in order to trust the Powershell script. I'm still testing, but it sounds like you need to push out your code signing certificate to Local Computer/Trusted Publishers for your entire fleet. (Make sure when you export your code signing certificate to NOT include your private key, otherwise your certificate could be used by others to sign code)
I assumed that getting a code signing certificate from a trusted CA meant I wouldn't have to install my certificate on all computers but that doesn't appear to be the case.- Hi af-00001
Ok, well at least that’s two of us in the same boat! I haven’t found a solution yet, which is really annoying - you’d think if can run via a non-admin user, it should be able to run via the trusted connection. I hope someone from MS eventually see’s this and can offer some help\wisdom- On monday I’m going to see if I can permit the file through 365 Defender
