Code signing certificates

Hi all,

We want to create a code signing certificate for use by the coders in our IT department. The code will only be used in-house. It is actually for PowerShell tasks like logon scripts etc...

I have a couple of questions:

1. How do we request the department certificate \using the Windows Enterprise infrastructure? We have a 2008 R2 Enterprise CA. 

2. What happens when the certificate expires? Does all of the code need resigning again or is the date only checked at the time of signing?

3. If we wish our certificates to be trusted, do we need to distribute the public key in Group Policy under both Computer and User? Some scripts will be used during computer logon and some during user logon.

Thanks