Script Signing

Every PowerShell script ZenPrint runs on your endpoints (check-in, scan, reconcile, capture, poll) is cryptographically signed, and your endpoint verifies that signature before running anything. If a script’s contents have been altered, or it isn’t signed, the endpoint refuses to run it.

The important property: the signing key is not on the ZenPrint server. Scripts are signed ahead of time, and the server only ever hands out the already-signed copies. So even if our server, or the network between you and us, were compromised, no one could substitute a malicious script and have it run on your fleet, because they couldn’t produce a valid signature for it.

Everything is fetched over HTTPS as well, so signing sits on top of normal transport security as a second layer.

What this doesn’t cover

Signing protects the scripts ZenPrint sends you. It can’t protect the bootstrap script you paste into your RMM. That’s the trust anchor, and if someone could swap it out inside your RMM, the checks downstream wouldn’t matter. Treat the bootstrap like any production credential: only download it over HTTPS from your ZenPrint portal, and control who can edit your RMM’s script library.

It also can’t protect against a compromise of the RMM agent itself, which runs whatever it’s told regardless of our checks.