Using a Custom Configuration Policy to Deploy a Patch My PC Certificate

Applies to: Patch My PC Cloud

Overview

A custom configuration policy is the recommended method for deploying Patch My PC (PMPC) code-signing certificates to Intune-managed devices.

This method installs the Patch My PC public code-signing certificate into the local Trusted Publishers certificate store on targeted devices. This allows PowerShell to trust scripts and modules signed by Patch My PC when an AllSigned execution policy is used.

In environments using Windows Defender Application Control (WDAC), AppLocker, or similar application control policies, additional policy configuration may also be required to trust or allow the relevant Patch My PC signer.

The steps below use a custom configuration profile in Intune. For each certificate, the profile creation process is the same, but the OMA-URI and Base64-encoded certificate value are different.

Choose the Certificate(s) to Deploy

Patch My PC uses separate code-signing certificates for different signed components. Select the certificate that matches the content you need devices to trust, then use the corresponding tab in the Create a Custom Configuration Profile section.

• Intune Detection and Requirement Scripts

• Patch My PC Helper Scripts

• PSAppDeployToolkit Module

Important

The values used in the custom configuration profiles below reflect the current Patch My PC code-signing certificates used for newly signed content.

If you are implementing an AllSigned execution policy, WDAC, AppLocker, or similar application control policy after applications have already been deployed, some existing deployed content may have been signed with a previous Patch My PC certificate. In that instance, you may also need to deploy the relevant archived certificate so previously deployed scripts or modules remain trusted.

When deploying an archived certificate with a custom configuration profile, the OMA-URI and Base64 certificate value must match the archived certificate. Use the archived certificate .cer file to identify the certificate thumbprint used in the OMA-URI, and use the archived import script to obtain the Base64-encoded certificate value.

More information about archived certificates and scripts is available from the Download Patch My PC Code-Signing Certificates page.

Create a Custom Configuration Profile

Follow the steps below to create a custom configuration profile in Intune. The profile settings are the same for each Patch My PC code-signing certificate, but the OMA-URI and Base64 certificate value are different for each certificate.

Intune Detection and Requirement Scripts

“Create a Profile” tab

Field	Value
Platform	Windows 10 and later
Profile type	Templates > Custom

“Basics” tab

Field	Value
Name	A descriptive name for the policy. E.g. “Patch My PC Cloud Trusted Publisher Certificate”`
Description	Enter an optional description for the policy

“Configuration Settings” tab

Note

The OMA-URI is built using the certificate thumbprint value. When deploying a different Patch My PC certificate, make sure the thumbprint in the OMA-URI matches the certificate you are deploying.

Field	Value
Name	Enter a descriptive name for the OMA-URI setting e.g. “Patch My PC Cloud Trusted Publisher Certificate”
Description	Enter an optional description for the policy
OMA-URI	./Device/Vendor/MSFT/RootCATrustedCertificates/TrustedPublisher/E2806E45DDA692221BED082D072BAF5973FBC466/EncodedCertificate
Data type	String
Value	MIIHSTCCBTGgAwIBAgIQCCFR6ulgpnd5CTnQhq7j0TANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTI0MDYwNTAwMDAwMFoXDTI3MDYwNDIzNTk1OVowgdExEzARBgsrBgEEAYI3PAIBAxMCVVMxGTAXBgsrBgEEAYI3PAIBAhMIQ29sb3JhZG8xHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRQwEgYDVQQFEwsyMDEzMTYzODMyNzELMAkGA1UEBhMCVVMxETAPBgNVBAgTCENvbG9yYWRvMRQwEgYDVQQHEwtDYXN0bGUgUm9jazEZMBcGA1UEChMQUGF0Y2ggTXkgUEMsIExMQzEZMBcGA1UEAxMQUGF0Y2ggTXkgUEMsIExMQzCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAI4L1foPMR+0UKjzSsQZzLOdoKNJXO9EVFR1j+iVYzQA7wrEe9pwfgns3Bs9NDf9VcIGAcPdApOB46weoZWNE1P8pPhL2V42dh96c/eHUadCCXrv6gPMguKKh0CiaHATdQjAG+GmPwAETrW0gwWRvhQbbLoLYiBnW6z72a0rZ2NUv1s9aXd5sq42PMIiflL/hqWEoXD9clvDERPfAStHbxZwEXJ3EpsI9Y9N7O5hd+PGnskLUTQfs5dt03HWhgCDI0mlXdi02LI2Zem4r5iRzt5NGY0b3sp5E10lC5v8KWgf5VfmjNdV875ILJ6sfEyfvIFwiVn/Q9/UWVklzwVRHPXK9NUO5YXWG792OhKK0KXlLXN1VzrppbAWUZMICEa8a8h6JM9/8071dlcwST2cY20plbXpS9tVxK/6E/YCN9Fopz2+F3dNeeW7okXd2q8Ez90uOKZuj4fZkozrmM+/hGzOVRFFV23XinJDvMI7/I52At48tLE1CLoL4zalnJUQWwIDAQABo4ICAjCCAf4wHwYDVR0jBBgwFoAUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHQYDVR0OBBYEFICQ/SZIAGMkmdGRtx9TQIMONAEmMD0GA1UdIAQ2MDQwMgYFZ4EMAQMwKTAnBggrBgEFBQcCARYbaHR0cDovL3d3dy5kaWdpY2VydC5jb20vQ1BTMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzCBtQYDVR0fBIGtMIGqMFOgUaBPhk1odHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNybDBToFGgT4ZNaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwgZQGCCsGAQUFBwEBBIGHMIGEMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wXAYIKwYBBQUHMAKGUGh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3J0MAkGA1UdEwQCMAAwDQYJKoZIhvcNAQELBQADggIBALlBqZymgkuENodf7tC1viaTZFFzAeuR9DO9u36GeFy4iZ3tKJ4IKznvVGRNYb2F5UTFHTDE0rgJPF+w0w8dnT6R2MB2aXzvyV4MBmezgPIhbx/y1h+M72wLkydNSLt0PJkw8R0BE4M794lZnh8Vmh3/bpfjIq8NYXYx/fNiIwiud8+kLcLsJ53qO2W0nytZh22HccJSXKOaxQxMdBSieV+ff150Q0AKvse87/ZscY3QnTKgPHqhDFGgeVQpCOXayaWWbluVYo5eeVsN+k36QkXDaGctpvEd4pbelMIN3DonD1NrL3Cp1YT5eMs7D9LUp+5SoOkVBj9+b6j5fNHVH+Fwx1F+ATejXO3BB+mt8WkFRQgREwp01UVD2gPtcj8KnY1IIgYGAogB7UraIXXTxJxhUXeSZNW1HpWaa/K7skUUlsYv/4PJTgAB5yvG5ZDJBi9M58MFAzmlH4qdrJRbxMuK9AxAqJKjGwm7B4AZeivSDnhC0UQ0g29tfOLzGXx0AfrdcAnn1U8bCzHg5Qc+Xy1Y6Ybx6MYLvFALS3Q++Rc05INimwTgM8F0PW9Ch7g88zXwad3p0CJrXdfU/b3SdLEcf2e62qM+//+15aVIuClYeam8oC58q+Rfefn5eG3hKpyHzmQdzlSpVbR/9eRRO2kXESPuAL7Xo0sZW8IVSRtM

“Scope tags” tab

Configure as required.

“Assignments” tab

Assign the configuration template to the desired Entra ID group(s).

“Applicability Rules” tab

Configure any desired applicability rules.

“Review + create” tab

Double-check everything before clicking Create.

Patch My PC Helper Scripts

PSAppDeployToolkit Module

Post Processing

Once the client processes the policy, the certificate appears as follows in its Trusted Publishers store.

Double-clicking the certificate allows you to see its properties.