For those who can’t wait, here is the solution right away. Next two lines actually work – without using MakeCert.exe: New-SelfSignedCertificate -DnsName STA07 -Type CodeSigning Set-AuthenticodeSignature C:\T\add-signature.ps1 @(gci Cert:\LocalMachine\My -DnsName STA07 -codesigning)[0] First command creates a certificate in your Intermediate Certification Authorities. Second command signs the script. Wow! Innocent error in documentation from our Seattle friends (https://technet.microsoft.com/en-us/library/hh847874.aspx) probably due to luck of testing. But a very satisfying result in the end. Now the whole story. On Monday, 2016-02-22 I converted last PC to Windows 10. A got a nice clean and crispy install. Everything is working well. Everything is in place. I do not want to install any ad hoc software…