PowerShell execution policy in RMM context
Overview
Remote execution is powerful—lock down signing and storage.
Approach
RemoteSigned on endpoints where possible; scripts deployed from signed RMM packages not email attachments.
Audit
Log script execution where product supports; hunt unusual Invoke-Expression chains.
Credential hygiene
Prefer gMSA/short-lived tokens in automation—not static domain admin in variable.
Testing
Syntax validate in CI for .ps1 PRs if mature enough.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...