Windows Agent Binaries Are Now Digitally Signed

July 12, 2026 · InfraScout Team

The Windows agent binaries — both x64 and ARM64 — are now digitally signed with a publicly-trusted certificate as part of the normal release and update channel. If you have downloaded or updated the agent recently, this is already the binary you are running.

What changed

Every Windows agent build now goes through Azure Trusted Signing, a Microsoft-operated public code signing service, using a "Public Trust" certificate profile. The publisher identity attached to the signature is ITdesign Software Projects & Consulting, the legal entity operating InfraScout, based in Vienna, Austria. You do not have to take our word for that — it is exactly what Windows itself will show you.

Right-click the agent executable, open Properties, and check the Digital Signatures tab, or run a quick check from PowerShell:

Get-AuthenticodeSignature -FilePath 'C:\Program Files\InfraScout\infrascout-agent.exe'

Either path shows the same thing: a valid signature, chaining up to a Microsoft-issued public root, with ITdesign Software Projects & Consulting as the signed publisher. Security teams that want to verify identity independently, rather than trust an installer's word for it, can do exactly that.

No more unknown-publisher warnings

The most immediate effect is what you no longer see. An unsigned executable — or one signed with a certificate that has not yet built up a reputation — typically triggers a SmartScreen "Unknown Publisher" prompt on first run. A brand-new code signing certificate does not escape this either: SmartScreen treats it with suspicion until it has been seen "in the wild" enough times to build reputation, so even a properly signed binary can trigger warnings for a while after a certificate first goes into use.

Azure Trusted Signing's Public Trust profile skips that warm-up period, because Microsoft verifies the signer's identity up front as part of issuing through the service. Installing or updating the agent should no longer prompt an unknown-publisher warning.

Antivirus and EDR products that weigh "unsigned" or "unknown publisher" as a risk signal also get a clear, verifiable identity to trust immediately, which reduces false-positive blocks or quarantines during install and update.

Why timestamping keeps the signature valid

Trusted Signing works differently from a traditional code signing certificate you'd buy and hold for a year or more. Instead of one long-lived certificate, it issues short-lived leaf certificates that rotate automatically every few days. That would normally be a problem — a binary signed with a certificate that later expires would eventually look unsigned again — except that every signature also carries an RFC3161 timestamp from Microsoft's timestamp authority, alongside a SHA256 digest of the file.

The timestamp is what makes the signature durable: it proves the file was signed while the certificate was still valid, so Windows continues to trust the signature indefinitely even after that particular leaf certificate expires. You never need to re-download or re-verify an agent installer just because time has passed.

Signing does not replace behavioral detection

Signing eliminates warnings and blocks tied to the binary being unsigned or from an unrecognized publisher. It does not exempt the agent from behavior-based detection. Microsoft Defender and other EDR products also watch what a process does, and the agent's normal job — running remote shell, PowerShell, WMI, and LDAP commands — can still resemble activity a behavioral engine flags for review, regardless of how the binary is signed. If an assessment step gets blocked or quarantined, check whether it was flagged on identity (now resolved) or on behavior, and allow-list accordingly in your EDR console.

Learn more

For download links, enrollment steps, and service installation, see Deploy on Windows.

Questions or feedback? Reach us at info@infrascout.cloud.