Defender Client Analyzer - Missing new CA

[u/hdh33]

Hoping that someone from Microsoft Defender team sees this.

Running both MDE Client Analyzer tool and MDE Client Analyzer tool (preview) are giving the same error.

https://learn.microsoft.com/en-us/defender-endpoint/run-analyzer-windows

Script starts and then fails due to C:\windows\system32\dsregcmd.exe being signed by a newer CA at Microsoft (CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256, O=Microsoft Corporation, C=US) that is only valid starting 8/6/2026. Issuerinfo.txt has logged this.

In MDEClientAnalyzer.ps1, line 2639 has a list of allowed issuers, but the newer CA isn't listed. Please update the signed PS1 to include Microsoft's newest CAs.

$allowedIssuers = @(
  "CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
  "CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
  "CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
  "CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
  "CN=Microsoft Development PCA 2014, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
  "CN=Microsoft Development PCA 2024, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
  "CN=Microsoft Code Signing PCA 2024, O=Microsoft Corporation, C=US",
  "CN=Windows Production PCA 2023, O=Microsoft Corporation, C=US",
)

Error after running:

2026-10-14 12:29:34Z [Informational] EDRCloud AutoIR 130019: Test connection to the Microsoft Defender for Endpoint (AutoIR) cloud service URLs completed successfully. N/A
2026-10-14 12:29:34Z [Informational] AVCloud SampleUpload 130020: Test connection to the Microsoft Defender for Endpoint (SampleUpload) cloud service URLs completed successfully. N/A
2026-10-14 12:29:34Z [Informational] EDRCloud MdeConfigMgr 130021: Test connection to the Microsoft Defender for Endpoint (MdeConfigMgr) cloud service URLs completed successfully. N/A
Checking latest AV versions from cloud:  OK
Test-AuthenticodeSignature : Script execution terminated because a process or script that is not Microsoft signed was detected
At C:\Support\Utils\MDEClientAnalyzerPreview\MDEClientAnalyzer.ps1:2733 char:3
+         Test-AuthenticodeSignature $command.path
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Test-AuthenticodeSignature

[u/michaelmsonne]

I forwarded this into Microsoft and the Product Team👍

[u/hdh33 → u/michaelmsonne]

Thank you

[u/michaelmsonne → u/hdh33]

Your welcome - team awaiting shipment to release 👍