How to Fix PowerShell Script Signature Errors After KB5132061.

After installing the November 10, 2026—KB5132061 security update, some previously signed PowerShell scripts may fail signature verification or stop running because of encoding issues.

According to Microsoft, this happens because Windows now performs stricter encoding validation when signing or verifying PowerShell scripts.

In this guide, you'll learn how to identify and fix PowerShell script signature errors by converting affected scripts to UTF-8 with BOM and signing them again. You'll also learn how to attempt a temporary repair without re-signing.

Symptoms of the PowerShell Script-Signing Issue

After installing the November 10, 2026 Windows security updates, you may experience one or more of the following:

• Get-AuthenticodeSignature returns NotSigned for a previously signed script.
• Set-AuthenticodeSignature returns UnknownError with the message: "No mapping for the Unicode character exists in the target multi-byte code page."
• Scripts affected by the issue may run in ConstrainedLanguage mode on devices using App Control for Business.

Note: Not every NotSigned error is caused by this issue. You should first check the script's encoding before attempting to repair it.

The issue can affect Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2, Windows 10 Enterprise LTSC 2021, and Windows Server 2016, 2019, 2022, and 2025.

The November 10 security update KB varies by Windows version. For Windows 11 24H2, 25H2, and 26H2, the update is KB5132061. For Windows Server, see the corresponding updates below:

How to Fix PowerShell Script Signature Errors After the November 2026 Updates

Microsoft provides a PowerShell repair script, Repair-SignedPowerShellUtf8.ps1, to detect potential encoding problems and create a repaired or converted copy.

The recommended permanent solution is to convert the script to valid UTF-8 with BOM, verify its contents, and digitally sign it again.

Step 1. Scan the Affected File Using Microsoft’s Sample Script

1. Open Microsoft's KB5136213 — PowerShell Repair Script page.

2. Copy the complete PowerShell script provided by Microsoft and save it as: Repair-SignedPowerShellUtf8.ps1

3. Open Windows PowerShell 5.1 and navigate to the folder where you saved the script.

Important: Use an approved copy of the Microsoft script in a Windows PowerShell 5.1 FullLanguage session. If your organization's security policies block it, follow the approved process instead of disabling those protections.

4. Run the following command to scan the PowerShell script for encoding problems. Replace C:\Scripts\script.ps1 with the affected script:

.\Repair-SignedPowerShellUtf8.ps1 -Mode Scan -Path 'C:\Scripts\script.ps1' |
    Format-Table Path, Issue, SignatureStatus, Action -Wrap

Info: The Repair-SignedPowerShellUtf8.ps1 script scans PowerShell files for potential encoding issues, attempts a temporary repair while retaining the existing signature, or creates a UTF-8-with-BOM copy for review and re-signing. The script does not overwrite the source file or an existing output file.

Step 2. Check the Scan Results

Find the Issue value in the scan output, then use the table below to choose the next step. The scan can flag a potential encoding problem, but it cannot confirm the file’s original encoding.

Step 3. Convert the Script to UTF-8 with BOM

1. Run the following command to convert the affected script. Replace C:\Scripts\script.ps1 with the affected script:

Important: If the scan reports CodePageTextReadAsUtf8, confirm the file’s original encoding and add -SourceCodePage to the conversion command. For example, add -SourceCodePage 932 only if you have confirmed that the file was saved in Shift-JIS.

.\Repair-SignedPowerShellUtf8.ps1 -Mode ConvertToUtf8Bom -Path 'C:\Scripts\script.ps1'

2. The tool creates a new file named: C:\Scripts\script.utf8bom.ps1

The original file remains unchanged, and the old digital signature is removed from the converted copy.

3. Compare the converted script with a trusted copy of the original source, especially if the tool reports that it replaced invalid bytes. Correct any unintended changes before signing the converted file.

Step 4. Digitally Sign the Converted Script

After confirming that the converted script contains the correct text, sign it using your approved code-signing certificate.

For example, if $cert already contains the appropriate certificate with an accessible private key, run:

Set-AuthenticodeSignature -FilePath 'C:\Scripts\script.utf8bom.ps1' -Certificate $cert

Then verify the signature:

Get-AuthenticodeSignature -FilePath 'C:\Scripts\script.utf8bom.ps1' |
    Format-List Status, StatusMessage

If the signature is valid, the result should display: Status : Valid

If your organization uses a centralized code-signing process, use that process instead.

Finally, test the script on an updated computer using the account and security policies under which it normally runs.

Optional: Repair the Script Without Re-Signing

If you can’t re-sign the script right away, Microsoft's repair tool can attempt to restore the validity of an existing signature without creating a new one. This option applies only to certain affected, previously signed scripts.

Important: This temporary repair isn’t guaranteed to work and doesn’t support every encoding issue. If the scan reports Utf8WithoutBom, run Repair on a computer that uses the same system code page as the computer on which the script was originally signed.

For more information, see Microsoft's Encoding Guidance for Signed PowerShell Scripts (KB5135999).

1. Open Windows PowerShell 5.1 and navigate to the folder containing the Microsoft repair script.

2. Run the following command, replacing C:\Scripts\script.ps1 with the path to the affected script:

.\Repair-SignedPowerShellUtf8.ps1 -Mode Repair -Path 'C:\Scripts\script.ps1'

3. Check the RepairedPath in the output to locate the repaired copy. By default, it is saved as C:\Scripts\script.repaired.ps1. Continue only if the tool reports SignatureStatus : Valid.

4. Review and test the repaired file before deploying it. If the repair fails, convert and re-sign the script using the previous method, or request a corrected, digitally signed copy from its publisher.

What to Do If the Script Still Fails

If the script still fails after conversion or repair:

1. Run Get-AuthenticodeSignature again and verify that the signature status is Valid.
2. Confirm that the script contents weren't modified after signing.
3. Check whether the signing certificate is trusted and appropriate for code signing.
4. If App Control for Business is enabled, review the relevant App Control events and policies.
5. If you cannot obtain a valid signature, contact the script publisher for a corrected version.

Don't disable PowerShell execution policies or App Control protections simply to bypass a signature error.

Summary

If your signed PowerShell scripts stop working after the November 2026 Windows security updates, use Microsoft's Repair-SignedPowerShellUtf8.ps1 tool to check for encoding issues. For a permanent fix, convert the affected script to UTF-8 with BOM, review its contents, and sign it again. If re-signing isn't immediately possible, you can attempt Microsoft's temporary repair method to preserve the existing signature, provided the script meets the required conditions.

That's it! Let me know if this guide has helped you by leaving your comment about your experience. Please like and share this guide to help others.

Still having trouble fixing this issue?

💬 Get WinTips Remote Support →

If this article was useful for you, please consider supporting us by making a donation. Even $1 can a make a huge difference for us in our effort to continue to help others while keeping this site free:

• Author
• Recent Posts

Konstantinos Tsoukalas

Konstantinos is the founder and administrator of Wintips.org. Since 1995 he works and provides IT support as a computer and network expert to individuals and large companies. He is specialized in solving problems related to Windows or other Microsoft products (Windows Server, Office, Microsoft 365, etc.).

Latest posts by Konstantinos Tsoukalas (see all)

• How to Fix PowerShell Script Signature Errors After KB5132061. - November 13, 2026
• How to Restrict Non-Admin Access to Azure Portal, CLI, and Entra admin center - November 11, 2026
• How to Install and Register PnP PowerShell for SharePoint Online. - November 9, 2026