V4.18 - Re-sign PSADT Module?

The Toolkit General Discussion
1

Hi all

I'm after some help with re-signing the PSADT PS Module so I can modify the config.ps1 file - reasoning for that can be found in a previous post of mine here.

mjr4077au suggested using PKI to re-sign it here but can anyone point me to anything that has extra help? - not asking for step by step instructions (although that would be great) but something that can put put me on the right track.

Thanks

2

This is quite an open ended question to ask... and your question isn't exactly clear what you are trying to achieve.
You haven't given us any idea what your level of knowledge is and / or whether you are using your own PKI or a 3rd Parties.

This link may go some way to help:

3

Apologies, I want to be able to modify the config.ps1 file in the PowerShell module directory and then use some of the PSADT commands such as Get-ADTPendingReboot. Currently if I modify that config file and try to run any commands I get the error stating that I've modified the config file and won't run.

I'm not overly familiar with cert signing - I understand the concepts etc but have never done much in that regard. We have our own PKI to use but I will need to do a little research on what I'm doing once I've found what process needs to happen.

I have googled some bits and seen the page you linked but I didn't think it was as simple as just signing the script/config file I would need to re-sign the whole module. I though the team had gone the extra mile as a security step to stop bad actors from being able to modify PSADT as a module and it wasn't just each script that was signed.

4

OK, so with your setup, the Module will be located below the PSAppDeployToolkit (Highlighted here)

image
image770×294 14 KB

The advice is NOT to modify anything below this folder - as a) it is core to the operation and b) will require re-signing - which is what you need to do and why you need to do it

This page, explains what each folder is for:

N.B. Each folder referred to in the table (in the 1st column below PSAppDeployToolkit/), are below the PSAppDeployToolkit/ folder

Maybe the table layout is not as clear as it could be, but these all advise you should NOT modify these files (for the reasons mentioned above).
i.e. What is highlighted here are generally everything that should not be modified (screen grab from Beyond Compare):

image
image937×698 45.6 KB

In this Screen grab, the .\Config\config.psd1 file (5 lines down) is unsigned and is designed to modified by us to apply our configuration changes without causing PSADT to fail to work (because the code signing is no longer valid), where as the .\PSAppDeployToolkit\Config\config.psd1 file ("PSADT Default Configuration file") is advised not to be modified.
I'm just wondering whether you genuinely have a need to re-sign the scripts (because you must modify .\PSAppDeployToolkit\Config\config.psd1) or whether you had overlooked the unsigned version?

5

Thanks for trying to help, yes I definitely need to modify the Modules root config.ps1 in the programfiles windows powershell modules directory.

I just want to be able to install PSADT Module and edit the config, I don't want to have to create a PSADT deployment package which is then modified. I'm using Intune remediation scripts to install the module and then edit the files - I don't want to have to deploy a PSADT package as that would involve deploying files and separating the process into a win32 package.

I could use @mjr4077au suggestion:

"You could also sideload your config and assets into ProgramData or something, then on the Open-ADTSession line, add -ScriptDirectory C:\Path\To\FolderThatContainsAssetsAndConfigFolders"

.....but I thought it would be cleaner and less steps to go wrong by re-signing the module.

6

You're supposed to just use our ADMX templates to set your global config options via Intune or GPO. Editing our default config and resigning the module is equivalent to using a sledgehammer to hit a nail in.

7

Thanks @mjr4077au makes sense

I've created the ADMX config/policy with updated names for dark/light png icon files, copied the dark and light icon png files to the Assets folder in the Modules directory however when running 'Initialize-ADTModule' it can't find the png I've set:

PS C:\WINDOWS\system32> Initialize-ADTModule
Initialize-ADTModule : Failed to resolve the asset [LogoDark] to a valid file path.
At line:1 char:1
+ Initialize-ADTModule
+ ~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (AppIconWhite.png:String) [Initialize-ADTModule], FileNotFoundException
    + FullyQualifiedErrorId : DialogAssetNotFound,Initialize-ADTModule

I'm not sure where it's looking for the PNG file, i've placed AppIconWhite.png and AppIconBlack.png in the following folder since I'm not using a full PSADT package I'm just utilising some PSADT commands from Intune remediation scripts:

C:\Program Files\WindowsPowerShell\Modules\PSAppDeployToolkit\4.1.8\Assets

8

What did you specify in the ADMX for the assets? Are they fully qualified paths?

9

Ahhhh, without any Intune config it used the AppIcon.png in the modules folder so I thought that was where it looked as default - setting the full path worked a treat :smiling_face_with_three_hearts:

Another question which may be related to my setup but not sure so please tell me to log a new post if more appropriate.

How do I get it to honour light/dark mode? Regardless of what theme my device is set to it always uses the same .png

EDIT: If it's the fluent setting - ignore my question, just found it.

EDITEDIT: Even changing the config to make sure it uses 'Fluent' as the DialogStyle it seems to ignore the dark/light setting on the device and use the same icon png regardless