Installing PowerShell 7.6.x through its MSI can take 30 minutes or longer. In the verbose Windows Installer log, the delay occurs during the SOFTWARE RESTRICTION POLICY verification step, even though no software restriction policies or AppLocker rules are configured. The log eventually reports a RunEngine wait timeout, then confirms that the MSI has a digital signature and is permitted to run under the system token. Older PowerShell 7.5.x installers and other applications do not show the same behavior. Has anyone identified what changed in PowerShell 7.6 or found a reliable fix?
4 Answers
A suggested workaround was to change the WinTrust Software Publishing State value to 146944 during installation and restore it afterward. In this case it did not improve the install time, so it should not be treated as a confirmed fix. If testing such a change, record the original value first and restore that exact value rather than relying on hard-coded numbers.
Use Windows certificate diagnostics to see whether signature validation is waiting on network access, especially certificate-chain or revocation checks. For example: certutil -urlfetch -verify "D:tempPowerShell-7.6.2-win-x64.msi". However, the ASN1 value too large error can also appear with other MSI files, so that result alone does not prove the installer is the problem.
If these are managed company devices, check whether Intune, Defender, or attack surface reduction rules are inspecting the installer. Those controls can sometimes appear in the MSI log as a software restriction policy check even when traditional AppLocker or Software Restriction Policies are not configured.
One proposed explanation is that Windows is spending a long time validating the MSI's signing certificate and contacting certificate-revocation endpoints. That could fit the timeout in the log, but it is not conclusive: PowerShell 7.6 and older releases appear to use the same certificate and CRL, and allowing the Microsoft domain or changing the revocation-related registry setting may not affect the delay.
I see the same certutil error with PowerShell 7.5.4 and unrelated MSI files. The test behaves the same on a restricted work network and on an unrestricted home network, so a straightforward CRL connectivity problem does not seem to explain the PowerShell 7.6-specific delay.