Microsoft’s November 2026 security update for Windows 11 comes with an important security improvement that could create unexpected problems for IT administrators, developers, and Windows users who rely on digitally signed PowerShell scripts.
The update, identified as KB5132061, introduces stricter UTF-8 encoding validation for PowerShell script signing and signature verification. Although this change is designed to strengthen Windows security, it may cause some previously working and digitally signed PowerShell scripts to fail signature verification.
For organizations that depend on PowerShell for system administration, automated tasks, security monitoring, and incident response, this change deserves attention.
The good news is that Microsoft has already published guidance and a repair utility to help identify and fix affected scripts.
Let’s understand what has changed, why it matters, and how you can fix the problem.
What Is Windows 11 KB5132061?
KB5132061 is Microsoft’s November 10, 2026, cumulative security update for Windows 11.
It includes several security improvements, bug fixes, and system enhancements. One of the important changes involves PowerShell script security.
Microsoft has strengthened the way Windows validates text encoding when digitally signing PowerShell scripts and verifying their existing signatures.
Previously, Windows could accept certain scripts containing malformed UTF-8 data. In some situations, invalid characters were replaced during the decoding process, allowing signature verification to succeed.
With the November 2026 security update, Windows applies stricter encoding validation. Scripts containing invalid UTF-8 data may now fail signature verification, even if they worked correctly before installing the update.
This is an intentional security-hardening change rather than a conventional software bug.
What Is the PowerShell Script Signing Problem?
PowerShell supports digital signatures through Authenticode. These signatures help administrators verify that a script comes from a trusted publisher and has not been modified after signing.
However, script files can be saved using different text encodings, including UTF-8, UTF-8 with BOM, UTF-16, and legacy character encodings.
Problems can occur when a script contains invalid characters or when Windows interprets its encoding differently from what the script author originally intended.
Following KB5132061, stricter validation can expose these existing encoding problems.
As a result, administrators may experience the following symptoms:
1. Get-AuthenticodeSignature Reports NotSigned
One of the most noticeable problems occurs when checking an existing script’s digital signature.
For example:
Get-AuthenticodeSignature -FilePath "C:\Scripts\Deploy.ps1"Previously signed scripts may now return:
Status : NotSigned
This does not necessarily mean that someone removed the original digital signature. An encoding problem may be preventing Windows from validating it.
2. Set-AuthenticodeSignature Returns UnknownError
Administrators may also encounter problems when attempting to sign affected PowerShell scripts.
For example:
Set-AuthenticodeSignature `
-FilePath "C:\Scripts\Deploy.ps1" `
-Certificate $certThe operation may fail with:
Status : UnknownError
An associated error message may look like this:
No mapping for the Unicode character exists
in the target multi-byte code page.
This indicates that Windows encountered a character encoding problem while processing the script.
3. WDAC May Run Scripts in Constrained Language Mode
The problem can also affect systems using Windows Defender Application Control (WDAC), now known as App Control for Business.
When an affected script fails the required signature validation on an enforced system, PowerShell may execute it in Constrained Language Mode.
This mode restricts certain PowerShell language features and can cause scripts that depend on advanced functionality to stop working as expected.
For organizations running strict application control policies, this can create unexpected disruptions in administrative automation.
Which Windows Versions Are Affected?
Microsoft’s KB5132061 update applies to the following Windows 11 releases:
- Windows 11 version 26H2
- Windows 11 version 25H2
- Windows 11 version 24H2 (Enterprise and Education editions)
Microsoft’s accompanying PowerShell encoding guidance also covers additional Windows versions and server operating systems.
These include:
- Windows 11 version 23H2
- Windows 10 Enterprise LTSC 2021
- Windows Server 2025
- Windows Server 2022
- Windows Server 2019
- Windows Server 2016
Important: Not every computer or PowerShell script will experience this problem. It primarily affects scripts containing encoding issues that become incompatible with the stricter validation rules.
How to Fix the PowerShell Script Signing Issue
Microsoft recommends identifying affected scripts, correcting their encoding, and signing them again when necessary.
Here are the steps administrators can follow.
Step 1: Identify Affected PowerShell Scripts
Microsoft provides a PowerShell utility called `Repair-SignedPowerShellUtf8.ps1` to help identify and repair encoding-related problems.
First, save the repair utility from Microsoft’s official guidance.
Open Windows PowerShell 5.1 and navigate to the directory containing the utility.
Run the following command to scan your PowerShell scripts:
.\Repair-SignedPowerShellUtf8.ps1 `
-Mode Scan `
-Path C:\Scripts `
-Recurse |
Format-Table Path, Issue, SignatureStatus, Action -WrapThis command scans the specified directory and its subdirectories.
It identifies potential encoding problems and reports the current signature status along with a recommended action.
The scan does not modify the original scripts.
Step 2: Convert Affected Scripts to UTF-8 with BOM
If a script contains an encoding problem, Microsoft recommends converting it to valid UTF-8 encoding with a Byte Order Mark (BOM).
For example:
.\Repair-SignedPowerShellUtf8.ps1 `
-Mode ConvertToUtf8Bom `
-Path C:\Scripts\Deploy.ps1The utility creates a separate converted copy:
Deploy.utf8bom.ps1
The original file remains unchanged.
A BOM helps Windows identify the file as UTF-8 when reading its contents.
However, simply adding a BOM is not sufficient to correct malformed UTF-8 data. The script must be properly decoded and converted from its original encoding.
For scripts using legacy encodings, administrators may need to specify the original code page during conversion.
Step 3: Digitally Sign the Converted Script Again
After conversion, review the script to ensure that its content and functionality remain correct.
You will then need an approved code-signing certificate to digitally sign the converted script.
For example:
Set-AuthenticodeSignature `
-FilePath C:\Scripts\Deploy.utf8bom.ps1 `
-Certificate $certHere, `$cert` represents your approved code-signing certificate.
The old signature is removed from the converted copy, so the script must be signed again.
Step 4: Verify the Digital Signature
After signing, verify the script’s digital signature.
Run:
Get-AuthenticodeSignature `
-FilePath C:\Scripts\Deploy.utf8bom.ps1 |
Format-List Status, StatusMessageA successfully signed and verified script should return:
Status : Valid
Once the signature is valid, test the script in a controlled environment before deploying it to production systems.
Step 5: Deploy the Corrected Scripts
After completing the verification process:
- Replace affected scripts through your approved deployment process.
- Update scheduled tasks where necessary.
- Test automated PowerShell jobs.
- Verify execution on WDAC-enforced systems.
- Confirm that all required administrative and automation functions are working correctly.
Do not deploy converted scripts until their contents have been reviewed and their signatures have been successfully verified.
Can You Repair Existing Signatures Without Re-Signing?
Yes, Microsoft also provides a temporary repair option for certain encoding scenarios.
The repair utility supports a `Repair` mode that attempts to correct specific encoding problems while preserving the existing digital signature.
For example:
.\Repair-SignedPowerShellUtf8.ps1 `
-Mode Repair `
-Path C:\Scripts\Deploy.ps1This creates a separate repaired copy rather than overwriting the original file.
If the repair succeeds, the utility reports a valid signature. However, this approach is not guaranteed to work for every script.
For example, scripts containing language-specific text encodings that have been incorrectly interpreted as UTF-8 may require proper conversion and re-signing.
If you do not have access to the original code-signing certificate, contact the script publisher and request a corrected, digitally signed version.
What Should IT Administrators Do Before Deploying KB5132061?
Organizations using PowerShell extensively should review their existing scripts before rolling out the November 2026 security update across their infrastructure.
Here are some recommended precautions.
1. Audit digitally signed scripts
Identify PowerShell scripts used for system administration, security monitoring, automation, and application deployment.
2. Review scheduled tasks
Check whether Windows scheduled tasks depend on digitally signed PowerShell scripts. Pay particular attention to scripts running under service accounts.
3. Check Group Policy scripts
Review PowerShell scripts distributed through Group Policy and other centralized management systems.
4. Validate security automation
Test scripts used for endpoint monitoring, threat detection, incident response, and remediation.
5. Check WDAC policies
Organizations enforcing application control should verify that affected scripts continue to satisfy their execution policies.
6. Maintain original script backups
Keep copies of the original scripts before performing encoding conversions or signature repairs.
7. Test before production deployment
Perform validation in a testing environment before applying changes across production systems.
Why This Update Matters for Cybersecurity Teams
PowerShell is widely used in enterprise environments for Windows administration, security monitoring, incident response, and automated system management.
Security teams frequently depend on signed PowerShell scripts to execute trusted operations.
For example, SIEM and SOAR environments may use PowerShell scripts for:
- Collecting Windows event logs.
- Performing endpoint security checks.
- Investigating suspicious processes.
- Managing Active Directory users and groups.
- Executing incident response procedures.
- Automating security remediation.
- Gathering system information from Windows endpoints.
If a previously trusted script suddenly fails signature verification, these automated processes may be disrupted.
Therefore, cybersecurity teams should include PowerShell script validation in their Windows patch management and security testing procedures.
Frequently Asked Questions (FAQs)
1. Does Windows 11 KB5132061 break all PowerShell scripts?
No. The update does not affect every PowerShell script. It primarily affects scripts containing malformed UTF-8 data or encoding inconsistencies that fail the stricter validation rules.
2. Why does Get-AuthenticodeSignature show NotSigned?
An existing digitally signed script may show NotSigned if Windows cannot validate its signature because of an encoding problem. However, this status can have other causes, so administrators should scan the script before assuming the update is responsible.
3. What is UTF-8 with BOM?
UTF-8 with BOM is a text encoding format that includes a special sequence of bytes at the beginning of a file. This sequence identifies the file as UTF-8 and helps applications determine how to interpret its contents.
4. Do I need to reinstall PowerShell?
No. This issue is related to stricter encoding validation during script signing and signature verification. Reinstalling PowerShell is not the recommended solution.
5. Can I fix the problem without a code-signing certificate?
In some cases, Microsoft’s Repair mode can create a repaired copy while preserving an existing signature. However, this is not guaranteed. If conversion and re-signing are required, you need an approved signing certificate or assistance from the original script publisher.
6. Should I uninstall KB5132061?
Uninstalling the security update is not Microsoft’s recommended solution. Administrators should identify affected scripts and correct their encoding instead of weakening Windows security protections.
Final Thoughts
Microsoft’s KB5132061 update introduces an important security improvement by strengthening UTF-8 encoding validation for PowerShell script signing and signature verification.
Although this change may cause certain previously working scripts to fail, it primarily affects scripts with existing encoding problems rather than all PowerShell scripts.
IT administrators should proactively audit their signed scripts, correct invalid UTF-8 encoding, verify digital signatures, and test their automation workflows before deploying the update across production environments.
Keeping PowerShell scripts properly encoded and digitally signed is an important part of maintaining a secure and reliable Windows infrastructure.
Have you experienced PowerShell signature verification problems after installing the November 2026 Windows update? Share your experience in the comments.
