Script Signing

Every PowerShell script ZenPrint runs on your endpoints (check-in, scan, reconcile, capture, poll) is cryptographically signed, and your endpoint verifies that signature before running anything. If a script’s contents have been altered, or it isn’t signed, the endpoint refuses to run it.

The important property: the signing key is not on the ZenPrint server. Scripts are signed ahead of time, and the server only ever hands out the already-signed copies. So even if our server, or the network between you and us, were compromised, no one could substitute a malicious script and have it run on your fleet, because they couldn’t produce a valid signature for it.

Everything is fetched over HTTPS as well, so signing sits on top of normal transport security as a second layer.

What this doesn’t cover

Signing protects the scripts ZenPrint sends you. It can’t protect the bootstrap script you paste into your RMM — that’s the trust anchor, and if someone could swap it out inside your RMM, the checks downstream wouldn’t matter. Treat the bootstrap like any production credential: only download it over HTTPS from your ZenPrint portal, and control who can edit your RMM’s script library.

It also can’t protect against a compromise of the RMM agent itself, which runs whatever it’s told regardless of our checks.