Microsoft TSS.zip: TSS_SHA.psm1 Digital Signature Verification Fails (HashMismatch)

Do not execute this TSS package while TSS_SHA.psm1 reports HashMismatch; Microsoft documents that all scripts and executables included in TSS are signed by Microsoft, so this result does not match the documented package state.^1^

What can be concluded

• Known issue: The available TSS documentation does not identify a known TSS_SHA.psm1 signature issue for the October 28, 2026 package.
• ZIP hash: No Microsoft-published SHA-256 value is available in the cited TSS documentation, so 7D4937CCF04B92DB1715581DF032CFF995458A59DCE86FB7F376FA4867B2B15D cannot be confirmed as the intended release hash from public information.
• Corrected package: No TSS release notice or corrected-package announcement is identified here.
• Whether to execute: Wait for Microsoft to validate or replace the package. A Microsoft signer certificate embedded in the file is not enough when the signed content fails verification.
• Extraction corruption: Your matching hashes for the archived and extracted copies already rule out an extraction-time change; repeating extraction or Defender scans would not resolve the signature discrepancy.

Get-AuthenticodeSignature is the supported Windows PowerShell mechanism for obtaining a file’s Authenticode status. It may use a Windows catalog signature when a file has both embedded and catalog signatures.^2^

Preserve evidence for Microsoft

Keep the original ZIP unchanged and capture the package hash, module hash, and complete signature object:

$zip  = 'C:\Downloads\TSS.zip'
$file = 'C:\TSS\TSS_SHA.psm1'

Get-FileHash -LiteralPath $zip  -Algorithm SHA256
Get-FileHash -LiteralPath $file -Algorithm SHA256

$sig = Get-AuthenticodeSignature -LiteralPath $file
$sig | Format-List Status, StatusMessage, Path, SignatureType
$sig.SignerCertificate |
    Format-List Subject, Issuer, Thumbprint, SerialNumber, NotBefore, NotAfter

Also record:

$PSVersionTable
Get-ComputerInfo |
    Select-Object WindowsProductName, WindowsVersion, OsBuildNumber

Attach the text output—not just screenshots—to a Microsoft support request or the Q&A report. Include:

1. Download date and approximate UTC time.
2. The official download target used: https://aka.ms/getTSS.
3. Both SHA-256 values.
4. The full StatusMessage, certificate thumbprint, OS build, and PowerShell version.
5. Confirmation that the archived and extracted module hashes match.
6. Confirmation that no TSS component was executed.

Ask Microsoft Support to verify the ZIP against the artifact held by the TSS publishing team and either publish its authoritative hash or republish the package. The public TSS page identifies https://aka.ms/getTSS as the official download location, but it does not provide a release manifest or checksum for independently validating this particular ZIP.^1^

Do not bypass the result by changing execution policy, removing the signature block, or copying TSS_SHA.psm1 from an unverified source. Execution-policy changes documented for normal TSS operation are prerequisites for an intact package, not a remedy for a failed signature.

References

1. Introduction to TroubleShootingScript toolset (TSS)
2. Get-AuthenticodeSignature-Syntax