--- title: Configuring Trusted Agent with PowerShell slug: neurons-for-itsm/admin-user-help/enu/latest/configuring-trusted-agent-with-powershell createdAt: 2026-07-14T19:16:35.952Z --- **Role**: Administrators. **Minimum Version**: Ivanti Neurons for ITSM 2024.2. You can configure an agent to automate specific tasks or workflows by executing external PowerShell scripts. Using PowerShell script an agent can receive and process requests to execute. ## Prerequisites A self-signed certificate is required during the configuration procedure. The certificate is required to sign the PowerShell script so it can be executed securely. Ensure that you have completed the following prerequisites before you configure Trusted Agent for PowerShell. :::hint{type="info"} To validate the self-signed certificate, you will need a PowerShell script (.ps1) file, and locate this file on the system you are working on, taking note of the file path. ::: ::::ExpandableHeading ## Create a Self-Signed Certificate Self-signed certificate is required for signing the PowerShell script. 1. Open Windows PowerShell ISE, and then enter the following code in the **Script Pane** (you need to provide a name for the certificate). :::CodeblockTabs{indent="1"} ```bash #certificate  name should be provided $CertificateName = "" #Create a Self-Signed SSL certificate $Certificate = New-SelfSignedCertificate -CertStoreLocation Cert:\CurrentUser\My -Subject "CN=$CertificateName" -KeySpec Signature -Type CodeSigningCert Write-host "Certificate Thumbprint:" $Certificate.Thumbprint ``` ::: 2. Run the code. :::Paragraph{indent="1"} This creates a code signing certificate in your Personal\Certificates folder in Windows Certificate Manager. ::: 3. Open the Windows Certificate Manager console (search "Manage user certificates" to locate this app), and locate the certificate file in the Personal\Certificares folder. 4. Copy the certificate file to the Trusted Root Certification Authorities\Certificates folder. 5. Copy the certificate thumbprint: :::Paragraph{indent="1"} a. Select the certificate file in Trusted Root Certification Authorities\Certificates. ::: :::Paragraph{indent="1"} b. Right-click, select **Open**, and then select the **Details** tab. ::: :::Paragraph{indent="1"} c. Scroll down to find the **Thumbprint** entry, select it, and then copy it from the text field. ::: 6. In Windows PowerShell ISE, run the following script, entering the thumbprint you copied in the previous step, and the file path to the PowerShell script (.ps1) file you created as mentioned in the note under "Prerequisites": :::Paragraph{indent="1"} This verifies and signs the code signing certificate in the Trusted Root Certification Authorities\Certificates folder. ::: :::CodeblockTabs{indent="1"} ```bash $thumbprint = "" $ScriptPath = "" #Get the Certificate from Cert Store$CodeSignCert = Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object {$_.Thumbprint -eq $thumbprint} #Sign the PS1 fileSet-AuthenticodeSignature -FilePath $ScriptPath -Certificate $CodeSignCert ``` ::: :::: :::ExpandableHeading ## Export the Self-signed Certificate 1. In Windows Certificate Manager, select the certificate you copied to the Trusted Root Certification Authorities\Certificates folder. 2. Right-click and select **All Tasks > Export**. The Export Wizard opens. 3. Click **Next**, select **No, do not export the private key**, and then click **Next** again. 4. Select **DER encoded binary X.509 (.CER)**, and then click **Next**. 5. Enter a file name, click **Browse** and navigate to the folder you want to save in, and then click **Save**. 6. Click **Next**, check the settings are as expected, and then click **Finish**. ::: ## Configure a Script Policy and Add a PowerShell Execution Follow the procedures below to add a script only connection, and then add a new PowerShell execution. ::::ExpandableHeading ## Configure a Script Policy Once you have completed the prerequisites and have a validated self-signed certificate, add a new script only policy. 1. Log in to Neurons for ITSM as an Administrator. 2. Open the Configuration console and click **Extend** >** Integration Tools** > **Trusted Agent Connection**. 3. Click **New trusted agent connection** to open the **Trusted Agent Connections** form. :::hint{type="info" indent="1"} The **New trusted agent connection** button is enabled only at the first use. ::: 4. Enter the connection settings in the **Configuration** section of the **Trusted Agent for Connections** form. | Field | Description | | --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Setting Name** | A unique name for this script policy. | | **Policy Type** | Select **Script**.
When this option is selected, the **Update Validation Certificate** section is displayed. | | **Upload validation certificate** | Upload the self-signed certificate you created earlier for [Prerequisites](docId\:NJlU9ljFcpI3URiGwigLQ). Only **.cer** file type is accepted.
Click **Select a File**, and then navigate to the folder where you saved the self-signed certificate, select the file, and then click **Open**. | ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/8CDUvbo2Qz1x8-TQVyqJ7_addscriptconnection.png" alt="screenshot of the trusted agent connection form with script only connection set" position="flex-start" size="40" initialPath="../../Resources/Images/trustedAgents-images/add_script_connection.png" githubPath="Content/Resources/Images/trustedAgents-images/add_script_connection.png" showCaption="false" indent="1"} 5. Click **Push Policy Settings**. :::: ::::ExpandableHeading ## Add a PowerShell Script :::hint{type="info"} You must configure and push a script policy before you can add a PowerShell execution. ::: 1. Open the Configuration console and click **Extend** >** Integration Tools** > **Trusted Agent Connection**. 2. Click **New PowerShell Execution** to open the **New PowerShell Execution** form. 3. Enter the configuration settings in the **Configuration** section of the form. | Field | Description | | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Setting Name** | A unique name for this PowerShell execution. | | **Trusted Agent** | Select the script policy | | **Upload signed PowerShell** | Click **Select a File** and upload the signed PowerShell script file for the agent. Only **.ps1** file type is accepted.
If you attempt to upload a PowerShell script that is not signed, a fail message is displayed when you attempt to save the configuration. | ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/PhLlySLqxIz6XfdOm0FnP_newpowershellexecutionconfigform.png" alt="screenshot of the new posershell execution configuration form" position="flex-start" size="40" initialPath="../../Resources/Images/trustedAgents-images/new_powershell_execution_config_form.png" githubPath="Content/Resources/Images/trustedAgents-images/new_powershell_execution_config_form.png" showCaption="false" indent="1"} 4. Click **Save**. :::: ## Upgrade to a Hybrid Policy You can upgrade an existing LDAP policy to hybrid with both PowerShell and LDAP features. :::hint{type="info"} When you update an LDAP policy to hybrid, you cannot revert the policy back to LDAP only. ::: ::::ExpandableHeading ## Upgrade to Hybrid :::hint{type="info"} Before starting this procedure, you need to complete the procedures as described in [Prerequisites](docId\:NJlU9ljFcpI3URiGwigLQ) above to provide a self-signed certificate for the hybrid configuration. ::: 1. From the Configuration console, click **Extend > Integration Tools > Trusted Agent Connection**. 2. Select the LDAP policy to open the **Trusted Agent Connections** form. 3. Click the **Policy Type** drop-down and select **Hybrid**. 4. Click **Select a File**, and then navigate to the folder where you saved the self-signed certificate, select the file, and then click **Open**. 5. Click **Update Policy Settings**. :::: :::ExpandableHeading ## Add a PowerShell Script Add the PowerShell script you want to execute. 1. Click **Extend > Integration Tools > Trusted Agent Connection**. 2. Click **New PowerShell Execution** to open the **New PowerShell Execution** form. 3. Enter the configuration settings in the **Configuration** section of the form. | Field | Description | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Setting Name** | A unique name for this PowerShell execution. | | **Trusted Agent** | Select the script policy | | **Upload signed PowerShell** | Click **Select a File** and upload the signed PowerShell script file for the agent. Only **.ps1** file type is accepted.
If you attempt to upload a PowerShell script that is not signed, a failure message is displayed when you attempt to save the configuration. | ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/PhLlySLqxIz6XfdOm0FnP_newpowershellexecutionconfigform.png" alt="screenshot of the new posershell execution configuration form" position="flex-start" size="40" initialPath="../../Resources/Images/trustedAgents-images/new_powershell_execution_config_form.png" githubPath="Content/Resources/Images/trustedAgents-images/new_powershell_execution_config_form.png" showCaption="false" indent="1"} 4. Click **Save**. ::: ## Create a New Hybrid Policy. You can create a new hybrid policy with both PowerShell and LDAP features. :::hint{type="info"} Before starting this procedure, you need to complete the procedures as described in [Prerequisites](docId\:NJlU9ljFcpI3URiGwigLQ) above to provide a self-signed certificate for the hybrid configuration. ::: ::::ExpandableHeading ## Create a Hybrid Policy :::hint{type="info"} This procedure must be completed prior to installing Trusted Agent as described in [Install Trusted Agent](docId\:a0hAYNshu5n26tGcUdpSS). Also note that In the current version of Neurons for ITSM, you can add only one Trusted Agent connection. ::: 1. In the Configuration console, select **Extend > Integration Tools > Trusted Agent Connections**. :::Paragraph{indent="1"} The **Trusted Agent Connections** form is displayed. You configure a new connection or edit an existing connection using this form. ::: 2. Click **New trusted agent connection** to open the **Trusted Agent Connections** form. 3. Enter the connection settings in the **Configuration** section of the **Trusted Agent for Connections** form. ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/jLT41qzy7PBl5ORetoRoq_blanktrustedagentconnectionshybridform.png" alt="screenshot of the trusted agent connections form, with htbrid selected" position="flex-start" size="40" initialPath="../../Resources/Images/trustedAgents-images/blank_trusted_agent_connections_hybrid_form.png" githubPath="Content/Resources/Images/trustedAgents-images/blank_trusted_agent_connections_hybrid_form.png" showCaption="false" indent="1"} | Field | Description | | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Setting Name** | A unique name for this LDAP server connection. | | **Policy Type** | Select **Hybrid**.
When this option is selected, the **Update Validation Certificate** section is displayed. | | **Upload validation certificate** | Upload the self-signed certificate you created earlier for [Prerequisites](docId\:NJlU9ljFcpI3URiGwigLQ). Only **.cer** file type is accepted.
- Click **Select a File**, and then navigate to the folder where you saved the self-signed certificate, select the file, and then click **Open**. | | **Server** | The LDAP domain controller host IP address. | | **Base DN** | Optional. The distinguished name for the LDAP object in the LDAP server. This value is not case sensitive. | | **User Name** | If the server requires authentication, enter the LDAP domain server name. | | **Password** | If the server requires authentication, enter the LDAP domain server password. | | **Encryption Method** | Select an encryption method:
- **No encryption**
- **Use SSL encryption (ldaps\://)**
- **Use StartTLS extension** | | **Authentication Type** | Select an authentication type:
- For **No encryption** method, select **Ntlm**.
- For **SSL** or **TLS** method, select **Simple (Basic) authentication**. | | **Api Key** | Optional: The SignalR API key required to enable external authentication.
The SignalR API key is required if you want to enable users to login externally, if you do not want to enable external authentication this key is not required. For information on SignalR, see [https://learn.microsoft.com/en-us/aspnet/signalr/overview/getting-started/introduction-to-signalr.](https://learn.microsoft.com/en-us/aspnet/signalr/overview/getting-started/introduction-to-signalr)
To generate the API key, see step 4 below.
Paste the generated API key into this field.
When the key is provided, and the LDAP settings are pushed successfully, the **Enable Authentication** switch is displayed.
:inlineImage[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/oiQLV3gAQIX50qWo5ETKi_externalauthenticationselector.png" alt="screenshot of the external authentication selector" caption size="40"}
This switch can be toggled ON *after the Trusted Agent is installed*. If you toggle the switch ON before the Trusted Agent is installed a warning is displayed. Refer to [Enable External Authentication](docId\:wFPurW9Ip9CEtaLCzxUQl). | 4. Optional: Generate a SignalR API Key to enable external authentication: :::hint{type="info" indent="1"} This step is only required if you want to enable external authentication. For information on SignalR, see [https://learn.microsoft.com/en-us/aspnet/signalr/overview/getting-started/introduction-to-signalr](https://learn.microsoft.com/en-us/aspnet/signalr/overview/getting-started/introduction-to-signalr). ::: :::Paragraph{indent="2"} a. In the Configuration Console, select **Security Controls > API Keys**. ::: :::Paragraph{indent="2"} b. In the **API Keys** workspace, select **Add Key Group**. ::: :::Paragraph{indent="2"} c. In the **Name** field, enter Signalr, and then enter a brief description in the **Description** field. ::: :::Paragraph{indent="2"} d. Click **Save Key Group**. ::: :::Paragraph{indent="2"} e. Select the Signalr group in the **Key Groups** list. ::: :::Paragraph{indent="2"} f. In the **API Keys** pane, select **Add API Key**. ::: :::Paragraph{indent="2"} g. Select the **Activated** checkbox if not already selected. ::: :::Paragraph{indent="2"} h. Enter a description, on behalf of, and role information if required. ::: :::Paragraph{indent="2"} i. Click **Save Key**. ::: :::Paragraph{indent="2"} j. Copy the generated API key identifier to the clipboard. ::: :::Paragraph{indent="2"} k. Return to the **Trusted Agent for LDAP Connections** form, and then paste the key into the **Api Key** field. ::: 5. Click **Push Policy Settings**. :::Paragraph{indent="1"} While the LDAP settings for the Trusted Agent are being processed, the **Status** is displayed as **Pending**. :inlineImage[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/tSTAsqBSMWVst4aZFMVPy_statuspending1.png" alt="image showing agent policy status pending" caption size="45" width="452" height="93"} ::: :::hint{type="info" indent="1"} The **Push Policy Settings** button changes to **Update Policy Settings**, and is disabled while the settings are being processed. ::: :::Paragraph{indent="1"} The settings push can take up to 20 minutes to complete. Click **Refresh** to check if the push has completed. When completed successfully, the **Status** is displayed as **Success**. A pop-up message is also displayed. :inlineImage[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/CtWyOd4BeCx0dDrnyvL0-_statussuccess1.png" alt="image showing agent policy status successful" caption size="45" width="454" height="95"} ::: ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/MklU7GwvEtX8f5RkoRDZW_policyconnectionsuccessmessage.png" alt="Image showing massage informong that Push LDAP Settings are successful" position="flex-start" size="40" initialPath="../../Resources/Images/trustedAgents-images/policy_connection_success_message.png" githubPath="Content/Resources/Images/trustedAgents-images/policy_connection_success_message.png" showCaption="false" indent="1"} :::hint{type="info" indent="1"} Occasionally the status may revert to **Pending**. If this happens, push the LDAP settings again by clicking **Update Policy Settings**, and then click **Refresh**. The status changes to **Success**. ::: :::Paragraph{indent="1"} If the push fails, a **Failed** pop-up message is displayed. ::: ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/HbDQRYIRA3TmGtwYePk6i_policyconnectionfailedmessage404x55.png" alt="Image showing massage informong that Push LDAP Settings have failed" position="flex-start" size="40" initialPath="../../Resources/Images/trustedAgents-images/policy_connection_failed_message_404x55.png" githubPath="Content/Resources/Images/trustedAgents-images/policy_connection_failed_message_404x55.png" showCaption="false" indent="1"} :::Paragraph{indent="1"} If a failed push occurs, check your settings are correct, and then: ::: :::Paragraph{listStyleType="disc" indent="2"} Push the settings again. ::: :::Paragraph{listStyleType="disc" indent="2"} If the push still fails, refresh the page in the browser, and push the settings again. ::: :::Paragraph{indent="1"} When processing is complete, an enrollment key, comprising of the tenant ID and activation key, is displayed in the **Enrollment Key** field. ::: 6. Under the **Download URL for Installer (Windows)** section, click **Download** to download the installer files. :::hint{type="info" indent="1"} Copy the IvantiCloudAgent.exe and IvantiCloudAgent.exe.options files to the server on the private network where Trusted Agent is to be installed. ::: **When completed successfully, proceed to installing the Trusted Agent before continuing with the remaining procedures in this topic, refer to **[Install Trusted Agent](docId\:a0hAYNshu5n26tGcUdpSS) :::: :::ExpandableHeading ## Add a PowerShell Script To add a PowerShell execution script, refer to [Add a PowerShell Script](docId\:NJlU9ljFcpI3URiGwigLQ). ::: :::ExpandableHeading ## Complete the Procedures to Enable and Verify the Trusted Agent - [Connect Trusted Agent to the Directory Server and Test the Connection](docId\:wFPurW9Ip9CEtaLCzxUQl). - [Configure Root Nodes, Save and Synchronize Directory Information and Enable External Authentication](docId\:wFPurW9Ip9CEtaLCzxUQl). - [Check the LDAP Import Log, Verify Employee Import and External Authentication](docId\:wFPurW9Ip9CEtaLCzxUQl). - [Synchronizing Existing LDAP Settings for Trusted Agent](docId\:wFPurW9Ip9CEtaLCzxUQl) ::: ## Invoke a PowerShell operation with Trusted Agent Invoke an agent that executes with PowerShell script to update a business object. 1. Log in to Neurons for ITSM as an Administrator. 2. From the **Service Desk** console, open the **Incident** workspace. 3. Open an incident, click **More**, and select **Edit Actions**. 4. Create a quick action using Graphical Action Designer. :::Paragraph{indent="1"} By default, **Start Block** is selected. ::: 5. Enter the **Settings** details for the *mandatory* fields **Name**, **Description**, **Enter Category**,** Publish To**, and **UI Options** in the Graphical Action Designer. :::hint{type="info" indent="1"} Manually enter "Trusted Agent" or "TrustedAgent" (the white space is not required for function) if the **Trusted Agent** category is not present in the **Enter Category** option. ::: ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/aNvIKvYKUa80xJ4lkcCwl_ta-category.png" position="flex-start" size="40" initialPath="../../Resources/Images/trustedAgents-images/PowerShell/TA-Category.png" githubPath="Content/Resources/Images/trustedAgents-images/PowerShell/TA-Category.png" showCaption="false" indent="1"} 6. Drag the **Run Program** from the **Common Actions** to the block. - Enter a unique name in the **Block Label** field. - Select the PowerShell script in the **Connection** drop-down. - In the **Arguments** field specify the argument that needs to be parsed through the Powershell script. :::hint{type="info"} Declare arguments, for example: declare a 10, b 5 variables. You can also declare a variable and expression, for example, a 10, UserEmail $(PrimaryEmail), where UserEmail is a parameter in the script, and $(PrimaryEMail) is a field in the business object. ::: - Select the **Output Field** to verify if the PowerShell request was successfully submitted. ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/Ird34IaCQKIEGkZ4B7jgG_trustedagentquickaction.png" position="flex-start" size="40" initialPath="../../Resources/Images/trustedAgents-images/trusted_agent_quick_action.png" githubPath="Content/Resources/Images/trustedAgents-images/trusted_agent_quick_action.png" showCaption="false" indent="1"} 7. Link the **Start block** to the **Run Program** block and click **Save**. 8. Go back to the Incident page, click **More** > **TrustedAgent**, and select the action you created. ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/1NMtIH54wWkKwYk5VVxGo_qa-trusted-agent.png" position="flex-start" size="40" initialPath="../../Resources/Images/trustedAgents-images/PowerShell/QA-trusted-agent.png" githubPath="Content/Resources/Images/trustedAgents-images/PowerShell/QA-trusted-agent.png" showCaption="false" indent="1"} Now the agent will get triggered and update the associated incident as per the PowerShell script actions. ## Verify Execution To verify the execution of the agent: 1. From the Configuration console click **Extend > Integration Tools > Trusted Agent Monitoring**. 2. In the **Operational Logs**, select a PowerShell executed operation and verify the **Log Entry** for the associated operation. ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/tMmN3y_IbcU94KMZfZIEp_ta-logs.png" position="flex-start" size="40" initialPath="../../Resources/Images/trustedAgents-images/PowerShell/TA-logs.png" githubPath="Content/Resources/Images/trustedAgents-images/PowerShell/TA-logs.png" showCaption="false" indent="1"} The **Log Entry** shows whether the script executed successfully with the expected result. ## Creating a workflow for PowerShell Script Execution with Trusted Agent 1. Select a business object and create a [workflow](docId\:p4kB1HCF81WNxmoQhBcjs). :::hint{type="info" indent="1"} Ensure the Run Program quick action is created and selected in the Run Program Block Properties. ::: ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/_e10gtOjS4UOM4GSvajd4_workflow-configuration.png" position="flex-start" size="40" initialPath="../../Resources/Images/trustedAgents-images/Workflow-Configuration.png" githubPath="Content/Resources/Images/trustedAgents-images/Workflow-Configuration.png" showCaption="false" indent="1"} 2. Set the workflow configuration before saving it. 3. In the respective business object workspace, select a record, and trigger the workflow. :::Paragraph{indent="1"} Once the workflow is executed, refresh the business object to view the powershell execution request status. ::: ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/wCw_YsvUhf8lARG3XgVcZ_triggering-workflow.png" position="flex-start" size="40" initialPath="../../Resources/Images/trustedAgents-images/Triggering-workflow.png" githubPath="Content/Resources/Images/trustedAgents-images/Triggering-workflow.png" showCaption="false" indent="1"}