Batch to EXE

Important notice

• Local-only build. Your script is embedded locally in a Windows EXE together with a small stub, and then packaged into a ZIP for download. No server-side processing is performed.
• Your responsibility. How you use this tool and any EXE/ZIP you create is solely your responsibility. We provide no warranties, and we accept no liability for any damage, data loss, policy violations, or legal issues arising from use.
• Review before distribution. Always audit the resulting EXE and your batch content, especially if you plan to share it or run it with elevated privileges.
• Antivirus & EDR. Some security tools may flag custom stubs or scripts, especially when unsigned or uncommon. If this is a false positive, submit to the vendor or rebuild/sign with a reputable certificate.
• Mark-of-the-Web. Files downloaded from the internet may carry the “Zone.Identifier” alternate stream. If Windows blocks the file, right-click → Properties → Unblock. If a ZIP is blocked, unblock it before extracting.

Why Windows SmartScreen may warn

• Unsigned or low reputation. SmartScreen often shows “Windows protected your PC” for unsigned executables or new binaries with low reputation — even inside a ZIP.
• What the user sees. On launch of the EXE, a blue dialog may appear. The user can select More info → Run anyway if they trust the file.
• How to reduce warnings. Code-sign the EXE with a trusted CA certificate and build reputation over time. EV Code Signing certificates generally establish reputation faster.
• Note: Self-signed certificates are fine for testing but do not eliminate SmartScreen warnings for other users.

Signing with signtool (recommended)

• Install signtool. It’s included with the Windows 10/11 SDK. Typical path:
  C:\Program Files (x86)\Windows Kits\10\bin\<version>\x64\signtool.exe
• Obtain a certificate.
  • Production: Purchase an OV or EV Code Signing certificate (e.g., DigiCert, Sectigo, GlobalSign). EV often yields quicker SmartScreen trust.
  • Testing (self-signed): For local tests only. Example PowerShell flow below.

# (A) Create a self-signed test certificate (local only; won’t satisfy SmartScreen for others)
$cert = New-SelfSignedCertificate `
  -Type CodeSigningCert `
  -Subject "CN=My Company (TEST)" `
  -KeyAlgorithm RSA -KeyLength 3072 -HashAlgorithm SHA256 `
  -CertStoreLocation "Cert:\CurrentUser\My"

# Export to PFX with a password
$pwd = ConvertTo-SecureString 'P@ssw0rd!' -AsPlainText -Force
Export-PfxCertificate -Cert $cert -FilePath "$env:USERPROFILE\Desktop\codesign-test.pfx" -Password $pwd

# (B) Sign your EXE (timestamped; SHA-256)
signtool sign ^
  /f "codesign-test.pfx" /p P@ssw0rd! ^
  /fd SHA256 ^
  /tr http://timestamp.digicert.com /td SHA256 ^
  "MyTool.exe"

# (C) Alternatively, sign using a cert in your store by subject or thumbprint
signtool sign ^
  /sha1 <THUMBPRINT_NO_SPACES> ^
  /fd SHA256 ^
  /tr http://timestamp.digicert.com /td SHA256 ^
  "MyTool.exe"

# (D) Verify signature
signtool verify /pa /v "MyTool.exe"