Messages

1

Support and General Questions (Enterprises Using ConfigMgr and Intune) / Re: Changes to Code Signing

« on: June 25, 2021, 09:40:28 AM »

Thanks Andrew!

2

Support and General Questions (Enterprises Using ConfigMgr and Intune) / Changes to Code Signing

« on: June 25, 2021, 08:59:31 AM »

We are in the situation where we have an "all purposes" certificate, rather than a "code signing" certificate as our WSUS cert.  This cert is placed in the appropriate stores and was specified for use by PMPC (signing the detection script, etc.).  We knew from articles on these forums that this wasn't going to work, as PMPC requires a true "code signing" certificate.  Because our SCCM environment client settings are configured for "bypass" on PowerShell scripts, this wasn't a problem.  Detection script signing would fail, but it wouldn't matter.  The only evidence of the failures was that our PMPC reports would show, "An error occurred while signing the file, but there is no error message to display."  The report would show that the application creation failed, but it was still present in SCCM.  It just didn't have the detection script signed.

We knew that we needed to get around to fixing this, especially since we are doing initial steps into Intune, and at that point, the detection script signing would be necessary.

However... on June 16th, PMPC released an update to the publishing service, which was installed automatically during a sync.  The release notes show that some functionality was added to re-sign updates, as well as an option to do a registry key related to signing with Powershell vs. .NET.  None of this seems quite applicable to our situation (using an all-purposes certificate), but for some reason, even without setting any registry key, the signing seems to now be working.  No errors in the publishing logs.  No errors in the reports. 

Looking at the publishing logs, I see:

Creating PowerShell detection script.   Worker   6 (0x0006)
Signing C:\Program Files\Patch My PC\Patch My PC Publishing Service\Detection Method Scripts\VLC Media Player 3.0.16 (EXE-x64).ps1 with the code signing certificate [Thumbprint=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX][Store=LocalMachine\WSUS]   CertManager   6 (0x0006)
Signing with Windows native method...   CertManager   6 (0x0006)

So, it appears that the detection scripts are now getting signed.  Is this just a happy undocumented extra bonus?

3

Support and General Questions (Enterprises Using ConfigMgr and Intune) / Re: Should I worry? Publishing SCCM Applications Gives Weird Error

« on: April 16, 2021, 09:11:01 AM »

For other users that may experience this problem, the issue was due to the WSUS certificate we are using.  We currently have an "all purposes" certificate, which in theory includes code-signing.  However, PMPC requires that the certificate is a true code-signing certificate.  This hasn't been a problem in the past because out SCCM client settings for PowerShell scripts are set to "bypass".  We're in the process of updating that certificate to a code-signing one, and re-deploying that certificate in place of our current one via GPO.

4

Support and General Questions (Enterprises Using ConfigMgr and Intune) / Re: Should I worry? Publishing SCCM Applications Gives Weird Error

« on: March 05, 2021, 02:19:47 PM »

Yes.  It's still happening when publishing apps to SCCM:

Updating SCCM applications for BoxSync 4.0.8016 (x86)   Worker   6 (0x0006)
Getting file from cache.   Downloader   6 (0x0006)
Starting download for: https://patchmypc.com/scupcatalog/downloads/icons/BoxDrive.png   Downloader   6 (0x0006)
Configured Download Timeout: 15 minutes and 0 seconds   WebClientEx   6 (0x0006)
Creating PowerShell detection script.   Worker   6 (0x0006)
An error occurred while signing the PowerShell detection script, but there is no error message to display.   CertManager   6 (0x0006)
Copying ScriptRunner   Worker   6 (0x0006)
Moving application to Applications\PMPC   Worker   6 (0x0006)
Triggering a RefreshPackageSource for packageID: CAS02C19   Worker   6 (0x0006)
Successfully triggered SCCM package source refresh   Worker   6 (0x0006)
Successfully updated SCCM application:  BoxSync 4.0.8009 (x86) -> BoxSync 4.0.8016 (x86)    Worker   6 (0x0006)

5

Support and General Questions (Enterprises Using ConfigMgr and Intune) / Should I worry? Publishing SCCM Applications Gives Weird Error

« on: February 10, 2021, 04:31:17 PM »

I just did my first test after configuring PMPC to publish applications to SCCM (Base Install).  The applications do get published to SCCM, and a test of deploying one of the applications to my PC worked fine (7-Zip .MSI version).  However, the PMPC publishing service logs show the following error for every application that gets sent to SCCM:

"An error occurred while signing the PowerShell detection script, but there is no error message to display."

I do have the option configured in the Base Install Options to "Code-sign the PowerShell detection method script using the WSUS Signing Certificate".

Since the deployment/installation was a success, should I worry about the error message?