We imported 500 PowerShell scripts. None of them can run.

Script libraries are a standard RMM feature and a standard RMM number: hundreds of ready-to-run automations, out of the box. We consolidated our own catalogue this week — roughly 500 scripts plus a curated set — into the platform's Scripts workspace.

Every one of them arrived as an unsigned draft. Nothing in that import can execute on an endpoint. That is not an unfinished state we are working through; it is the design.

What a ready-to-run library actually is

Restate the feature honestly and it changes character: several hundred pieces of code, authored elsewhere, pre-authorized to run with the highest privileges available, on every machine under management. Described that way it stops sounding like convenience and starts sounding like the thing security teams spend their careers trying to prevent.

The risk is not that a vendor's catalogue is malicious. It is that "in the library" gets treated as equivalent to "vetted for your environment," and those are entirely different claims. A script that is perfectly correct in general can be exactly wrong against one client's line-of-business application, and nobody re-reads a script that the interface has already framed as approved.

"It shipped with the product" is not a security review, and importing something is not the same as deciding to run it.

What import actually does

• Each script lands tenant-scoped, so a library entry belongs to a specific tenant's workspace rather than floating above all of them.
• Each lands unsigned and in draft. In our model an endpoint executes a job only if it is cryptographically signed against a registered capability, so an unsigned draft is not a permissions setting — it is structurally unable to run.
• Provenance is immutable: where a script came from survives the import and cannot be edited away later to make it look homegrown.
• Parameter assessment reports what a script actually expects, so a technician is not reverse-engineering the arguments from the source under time pressure.
• Readiness is displayed truthfully — a script that has not been through signing shows as exactly that, rather than as a green button.

The friction is the point

Somebody has to read a script, decide it is right for this environment, and sign it before it can touch a machine. That is slower than a library where everything is live on arrival, and it is the entire difference between a catalogue of options and several hundred pre-authorized paths to SYSTEM that nobody at your company has read.