The discussion walks through accelerated release cadences, DSC version 3.4 planning, community stewardship initiatives for abandoned modules, and documentation updates detailing version 7 UUID support in PowerShell 7.7. Live demos showcase relocatable user scoped module paths using Get-PSContentPath, machine wide configuration fixes for MSIX installations in ProgramData, and dramatic concurrency speed improvements when resolving dependencies in PSResourceGet. The call wraps with a critical security alert regarding recent typosquatting attempts discovered across PowerShell Gallery and advice on how engineers can avoid malicious packages.

👉 https://github.com/PowerShell/PowerShell-RFC/blob/master/CommunityCall/notes/20260820_ChatTranscript.md

Query CVE Information Using the PoshCVE Module

Harm Veenstra, Microsoft MVP and author of the PowerShellisFun.com blog, walks through the PoshCVE module by Dan Hough, a tool designed to streamline searching and reporting on public security flaws directly from the console.

👉 https://powershellisfun.com/2026/08/20/query-cve-information-using-the-powershell-poshcve-module/

What PowerShell Taught TJ Turner About IT

Andrew Pla recently joined the PowerShell Podcast at Microsoft’s TechMentor conference in Redmond, Washington, to sit down with TJ Turner for a wide ranging discussion on career growth and systems administration. The episode traces TJ’s professional journey from early infrastructure work through the education, finance, and retail sectors to his current role as a Cloud Evangelist at TD SYNNEX. Along the way, the conversation explores the human side of technology and the critical lessons that never appear in standard product documentation.

Building Help Documents with Microsoft.PowerShell.Platyps

Jeffery Hicks recently published a guide in Behind the PowerShell Pipeline exploring how to build new module documentation using the modern Microsoft.PowerShell.Platyps module. The post walks through establishing a dedicated documentation folder structure and generating initial Markdown help files with New-MarkdownCommandHelp while sharing a script to elegantly handle path resolution quirks. Jeffery details how engineers can leverage inline updating with New-CommandHelp to dynamically inject custom notes, format code examples, and append alias information before converting the updated command help objects into standard Markdown files ready for online publishing.

👉 https://buttondown.com/behind-the-powershell-pipeline/archive/module-documentation-with/

Ten Years of the PowerShell Curl Alias

Daniel Stenberg, creator of curl, reflected on LinkedIn about the decade-long persistence of the PowerShell aliases mapping curl and wget to Invoke-WebRequest. He revisits his 2016 pull request to remove the shortcuts shortly after PowerShell went open source on GitHub, a PR that maintainers closed within 34 minutes, citing backward compatibility for existing scripts. The aliases were later dropped from PowerShell Core 6.0, and Windows has shipped a real curl.exe since 2018. But Windows PowerShell 5.1 remains the default powershell.exe on every Windows machine, so developers are still tripping over the shadowed commands ten years later. Quick fixes: call curl.exe explicitly, remove the alias in your profile, or switch to PowerShell 7.

👉 View Daniel Stenberg’s LinkedIn Post

How We Enabled PSReadLine for Screen Reader Accessibility

Andy Jordan presented at PowerShell Conference Europe to detail the engineering journey of fixing screen reader accessibility within the PSReadLine module. The session walks through the historical challenge where PSReadLine would invisibly rerender entire terminal buffers while typing, resulting in a broken audio loop for engineers relying on tools like NVDA or Narrator. Andy explained how a feature request from the Visual Studio Code team prompted a renewed focus on the issue, leading the group to discard a messy control character prototype in favor of a clean common prefix diff algorithm that only writes new buffer changes to the screen. The presentation wraps up by highlighting how direct requirements from partner product teams and a willingness to prototype can effectively push long standing accessibility bugs to resolution.

What to Expect at PowerShell Summit 2027

The Sessionize Call for Papers outlines the upcoming PowerShell Summit 2027 scheduled for April 5 to 8, 2027, at the Lake Buena Vista Sheraton Hotel in Orlando, Florida. The event brings together technologists and automators for four days of deep technical content, hands on labs, and community collaboration spanning automation, cloud computing, and security topics. The submission window runs through August 31, 2026, welcoming diverse session formats ranging from 25 minute fast focus talks to four hour interactive labs.

👉 https://sessionize.com/pshsummit27

Hybrid Identity Protection Conference 2026

Semperis announced the upcoming Hybrid Identity Protection Conference scheduled for September 8 to 10, 2026, at the Embassy Suites by Hilton Nashville Downtown in Nashville, Tennessee. The event brings together identity security practitioners and Active Directory experts for three days of practical insights, crisis management strategies, and real world discussions on defending hybrid infrastructure. The program features dedicated tracks covering CISO leadership, identity masterclasses, and emerging AI defense challenges to help organizations prepare for complex threat landscapes.

👉 Hybrid Identity Protection Conference 2026

Github Roundup

Nathan McNulty shipped azd-risk-based-ca v1.0.0 this morning. He’d been building toward it all week, pushing on azd-emergency-access, azd-maester, azd-entra-health-monitoring, and research-passkeys, and the azd- prefix everywhere is the tell. He’s building out a family of Azure Developer CLI templates for Entra security patterns, and a v1.0.0 is a real “this is done enough to use” moment. 👉 https://github.com/nathanmcnulty/azd-risk-based-ca/releases/tag/v1.0.0

• Fabien Tschanz cut Microsoft365DSC 1.26.819.1 on Wednesday after a marathon push day. If anyone in your world does Microsoft 365 desired state work, that’s the update to grab. 👉 https://github.com/Microsoft365DSC/Microsoft365DSC/releases/tag/1.26.819.1

• Doug Finke released psaisuite v0.8.5 on Tuesday. That’s four psaisuite point releases in two weeks, and the AI provider abstraction module is clearly his current center of gravity, not PSPandas. 👉 https://github.com/dfinke/psaisuite/releases/tag/v0.8.5

• Mark Orr released VM-Pilot v0.7.1 Monday with a follow up push Tuesday. 👉 https://github.com/markorr321/VM-Pilot/releases/tag/v0.7.1

• Simon Wåhlin released PSBicep v3.0.2. 👉 https://github.com/PSBicep/PSBicep/releases/tag/v3.0.2

• Jorge Suarez released WinGet-Manifest-Fetcher v1.6.0 on Saturday. 👉 https://github.com/jorgeasaurus/WinGet-Manifest-Fetcher/releases/tag/v1.6.0

Away from the release notes:

• Chrissy LeMaire had a giant dbatools Tuesday with five pushes in the span of a few hours on 8/20. Something’s brewing. 👉 https://github.com/dataplat/dbatools

• Steve Lee, Sean Wheeler, and Emanuel Palm all had heads down Wednesday work days, Steve on PowerShell/DSC, Sean grinding PowerShell-Docs with real substantive PRs, Emanuel deep in AzBobbyTables. Three Microsoft and adjacent folks with actual engineering days on the same date is worth watching for a coordinated announcement. 👉 https://github.com/PowerShell/DSC

• Justin Grote forked something interesting called TaskCmdlet from jborean93/PwshAsync. Async and Task based PowerShell cmdlets from Justin is worth a bookmark. 👉 https://github.com/JustinGrote/TaskCmdlet

• Michał Machniak had another big DSC v3 weekend on ADSGroupPolicyDSCv3 and then went quiet mid week, which is his consistent pattern. He sprints on weekends. 👉 https://github.com/mimachniak/ADSGroupPolicyDSCv3

• Sam Erde was in his VS Code extension pack on 8/17. 👉 https://github.com/SamErde/PSPreworkout-VSCode-Extension-Pack

• Tony Redmond did his usual Office365itpros push streak on 8/15 and 8/16. He commits like he blogs, constant. 👉 https://github.com/12Knocksinna/Office365itpros

• David Sass is still hammering the ATS scanner and started contributing to killed-by-microsoft, the graveyard site of deprecated Microsoft products. Delightful side quest. 👉 https://github.com/fabianoriccardi/killed-by-microsoft

Events

MMS Midway | October 25 to 28, 2026 | San Diego, California

The classic endpoint management and PowerShell conference moves to San Diego this fall.

👉 https://mmsmoa.com/

SpiceWorld 2026 | November 12 to 13, 2026 | Austin, Texas

Jeff Hicks is returning to Austin this fall to talk PowerShell at the annual Spiceworks community event.

👉 https://www.spiceworks.com/spiceworld/

Zero Trust World 2027 | February 17 to 19, 2027 | Orlando, Florida

👉 https://ztw.com/

PowerShell + DevOps Global Summit 2027 | April 5 to 8, 2027 | Orlando, Florida

The flagship US PowerShell event moves to the Sheraton Lake Buena Vista in Orlando.

👉 https://powershellsummit.org/

PSConfEU 2027 | Dates and location to be announced SynEdgy is organizing the eleventh edition of PowerShell Conference

👉 https://psconf.eu/

Live dbatools AMA Webinar with the Core Team | Wednesday, October 7 at 12:00 pm GMT

An open Ask Me Anything with the people behind dbatools, the open source PowerShell toolkit for SQL Server administration, migration, and automation. Whether you already lean on dbatools every day or are still on the fence about getting started, this is the format where you get to put your specific questions in front of the people who wrote the answers. Speakers include Rob Sewell, Jess Pomfret, Chrissy LeMaire, Andreas Jordan, and Cláudio Silva.
When: Wednesday, October 7 at 12:00 pm GMT
Where: Online, see the link for details

👉 https://shorturl.at/N53tz

J. Shigetomi published the version 7.6.5 release of PowerShell on the official GitHub repository to deliver a targeted servicing update for the engine. The patch resolves a specific dot sourcing behavior issue encountered when executing advanced function scripts using the pwsh -file command. The release also ships with several build and packaging improvements including an update to the .NET SDK 10.0.302 along with targeted fixes for deployment pipelines and minimum package sizes for arm64 architectures.

👉 v7.6.5 Release of PowerShell

Microsoft AI Unveils MAI Thinking 1

Microsoft AI introduced MAI Thinking 1 as a new medium sized reasoning model designed to handle intensive enterprise workflows and complex problem solving. The sparse mixture of experts model features 35 billion active parameters within a one trillion total parameter architecture and includes a 256k token context window. Microsoft highlights that the model achieves competitive scores on software engineering benchmarks and advanced mathematical evaluations while utilizing clean and traceable training data.

👉https://microsoft.ai/news/introducing-mai-thinking-1/

I Finally Built the Impossible Windows App

Chris Titus in his latest YouTube video shared the release of a completely rewritten, native .NET version of his popular Windows Utility while maintaining full compatibility with open source WinUtil configurations. Instead of executing PowerShell behind the scenes to apply tweaks, the new application translates those configurations directly into native .NET implementations to deliver faster execution, automated updates, system detection, and an integrated Windows 11 ISO creator.

Why Active Directory Alone Is No Longer Enough

Jorge Lopez on the Microsoft Entra Blog outlined five core signs that organizations have outgrown legacy on premises Active Directory in favor of modern cloud identity platforms. The discussion highlights the shifting realities of modern business infrastructure where cloud applications, diverse workforces, and AI agents demand flexible security models that extend beyond traditional network perimeters.

👉 Why Active Directory alone is no longer enough

PowerShell Scripting Hidden Secrets at PSConf EU

Jeff Hicks recently presented at the PowerShell Conference Europe to share a collection of less commonly used scripting techniques and console shortcuts designed to improve administrative efficiency. The session walks through practical command line workflows and advanced features that many engineers overlook during daily automation tasks. Jeffery balanced the presentation by covering both interactive console tips and deeper scripting capabilities to help practitioners get more out of their tooling.

Updating Help with the Modern Platyps Module

Jeff Hicks in Behind the PowerShell Pipeline continues his deep dive into the rewritten Microsoft.PowerShell.Platyps module designed for modern help documentation. The guide focuses on maintaining documentation for an updated stand alone function, demonstrating how the Update-MarkdownCommandHelp cmdlet syncs parameter and output changes directly into markdown. Jeff walks through automatic backup file creation, previewing help, exporting to MAML format, and highlights where the new tooling still struggles to detect defined command aliases.

👉 More Platyps Production

RBAC for PowerShell and IT Operations

ScriptRunner recently shared a video focused on role based access control for PowerShell and IT operations to help organizations manage permissions and secure automation workflows. This is more of a product promo-ish short one, but I thought it would be worth sharing :)

Microsoft.PowerShell.Archive Version 1.2.6 Rolls Out

MVP Andres Bohren at the Icewolf blog highlights the recent release of the Microsoft.PowerShell.Archive module version 1.2.6 from the PowerShell Team.

👉 https://blog.icewolf.ch/archive/2026/08/08/Microsoft-PowerShell-Archive-1-2-6-released/

PowerShell Framework Collective with Fred Weinmann

Fred Weinmann recently joined the PowerShell Podcast to walk through the PowerShell Framework Collective and share his personal approach to building the tools that build automation scripts. The discussion centers on investing in robust scaffolding around code to make automation faster, cleaner, and more consistent across enterprise environments. Fred breaks down four core architectural wins from his framework stack, highlighting friendly error handling and structured development practices.

Expanding Purview DLP and Information Protection to Foreign Platforms

Tony Redmond on Office 365 for IT Pros examined the recent Microsoft Purview update expanding data loss prevention and information protection auto labeling to external platforms like Google Workspace and Box. The rollout relies on Microsoft Defender for Cloud Apps connectors to process external files, requiring careful coordination with tenant administrators and security teams.

👉 Control External Services Data with Purview

Events

MMS Midway | October 25 to 28, 2026 | San Diego, California

The classic endpoint management and PowerShell conference moves to San Diego this fall.

👉 https://mmsmoa.com/

SpiceWorld 2026 | November 12 to 13, 2026 | Austin, Texas

Jeff Hicks is returning to Austin this fall to talk PowerShell at the annual Spiceworks community event.

👉 https://www.spiceworks.com/spiceworld/

Zero Trust World 2027 | February 17 to 19, 2027 | Orlando, Florida

👉 https://ztw.com/

PowerShell + DevOps Global Summit 2027 | April 5 to 8, 2027 | Orlando, Florida

The flagship US PowerShell event moves to the Sheraton Lake Buena Vista in Orlando.

👉 https://powershellsummit.org/

PSConfEU 2027 | Dates and location to be announced SynEdgy is organizing the eleventh edition of PowerShell Conference

👉 https://psconf.eu/

Live dbatools AMA Webinar with the Core Team | Wednesday, October 7 at 12:00 pm GMT

An open Ask Me Anything with the people behind dbatools, the open source PowerShell toolkit for SQL Server administration, migration, and automation. Whether you already lean on dbatools every day or are still on the fence about getting started, this is the format where you get to put your specific questions in front of the people who wrote the answers. Speakers include Rob Sewell, Jess Pomfret, Chrissy LeMaire, Andreas Jordan, and Cláudio Silva.
When: Wednesday, October 7 at 12:00 pm GMT
Where: Online, see the link for details

👉 https://shorturl.at/N53tz

Yesterday, I released a new video on my PowerShell Engineer channel introducing the PowerShell Engineer Standard and a specialized small language model named PSEng that makes amazing PowerShell directly on your computer for just the cost of your own electricity.

Watch the video, and check out my post:

.

Transfer Meeting Ownership with Invoke-ChangeMeetingOrganizer

Tony Redmond over at Office 365 for IT Pros breaks down the new Invoke-ChangeMeetingOrganizer Exchange Online PowerShell cmdlet designed to solve the headache of transferring meetings when employees leave a company. The guide explains how administrators can use the tool to switch organizers and push calendar updates to attendees automatically while stressing that reliable transfers require using Microsoft Graph to retrieve specific event identifiers. Tony ultimately highlights a major oversight with the current release by warning that the cmdlet fails to update the underlying Teams join data and forces new organizers to manually generate a replacement online meeting space.

👉 https://office365itpros.com/2026/08/06/invoke-changemeetingorganizer/

Securing Active Directory from the Ground Up

Evgenij Smirnov recently joined Andrew Pla on the PowerShell Podcast to discuss his thirty years of experience in Active Directory and security consulting. The conversation explores common escalation paths attackers use to compromise organizations and digs into what actually gets real world AD environments popped. Evgenij highlights critical vulnerabilities like over permissioned accounts and exposed certificate authorities while explaining how to engineer systems so security is never an afterthought. He also warns listeners about the severe risks of keeping unencrypted domain controller backups and shares practical advice for locking down infrastructure before an incident occurs.

Microsoft.Graph PowerShell Modules 2.39.0 Released

Andres Bohren has the practical rundown on the Microsoft.Graph and Microsoft.Graph.Beta 2.39.0 modules that Microsoft dropped in the PowerShell Gallery. Release notes were not published at the time of writing, which is annoying but not unusual, so Andres does what Andres does and gives you the exact PSResourceGet commands to check installed versions, uninstall the old set cleanly, and pull the new modules from the gallery. He also includes the reminder most people forget until Azure Automation starts complaining, which is that you also need to push the update to your Azure Automation runtime environments if you are running scripts that authenticate against Graph on a schedule. Short, direct, and ready to paste into your terminal.

👉 https://blog.icewolf.ch/archive/2026/08/04/microsoft-graph-powershell-modules-2-39-0-released/

Test Your Console Muscle Memory with PwshTyper

Harm Veenstra over at the PowerShell is fun blog showcases a unique way to test your console muscle memory using Shaun Lawrie’s PwshTyper module. The tool requires PowerShell 7.4 or higher and leverages PwshSpectreConsole to bring a fully featured typing speed tester directly into the terminal window. Users can launch the test using the Invoke-PwshTyper cmdlet and choose between standard word categories like commandlets or jump into specialized finger isolation modes to really challenge their daily typing habits.

👉 https://powershellisfun.com/2026/08/05/powershell-typing-speed-tester/

Locksmith 2 Gains Richer Formatting and Triage Options

Jake Hildreth recently updated the open source Locksmith 2 Active Directory Certificate Services toolkit with a suite of presentation enhancements across multiple pull requests, alongside a community contribution from Mason Moser. The changes focus heavily on output structure rather than new detections, introducing default formatting views for findings and a detailed per technique system like ESC8Detailed. Additionally, results are now severity sorted with custom banners and risk metrics to transform raw terminal dumps into prioritized security reports.

👉 https://github.com/jakehildreth/Locksmith2

Tagging PowerShell Functions with the AST

Jeff Hicks at Behind the PowerShell Pipeline shares a new approach to tagging PowerShell functions using the Abstract Syntax Tree. Moving away from alternate data streams that risk data loss across storage drives, this method parses code tokens directly from a loaded script block to extract custom metadata. The walkthrough demonstrates how to initialize token variables and run the ParseInput method to target specific comment labels like #cmdTags inside a function definition. It concludes by showing how these extracted tags were integrated into the PSScriptTools module to create custom views and filter commands by category.

👉 https://buttondown.com/behind-the-powershell-pipeline/archive/another-script-tagging-technique/

Entra News #160 with Merill and Joshua Fernando

Merill and Joshua’s August 2 edition is dense with SMS and voice retirement news and a lot of quieter architectural work worth catching. Highlights include the new device sync capability for Entra Cloud Sync in public preview, the beta Graph procedure for opting out of the SMS to passkey automatic migration where you set optOutSettings.passkeyDynamicMigration to true for a September through February exclusion, guidance on hardening GitHub and GitLab federated credentials by moving off mutable subject identifiers, and a fresh tenant estate architecture series with seven new articles covering primary tenants, isolated critical system tenants, business partner isolation, and hybrid identity. The Maester 2.2 release is also flagged, along with a batch of PoShaKucha talks from PSConf EU 2026 that are worth your time.

Entra.News - Your weekly dose of Microsoft Entra

Entra 🆔 News #160 → This week in Microsoft Entra

👋 Hi, Merill and Joshua here with this week’s roundup of the latest news on Microsoft Entra from around the globe 🌍…

Read more

21 days ago · 62 likes · Joshua Fernando and Merill Fernando

Events

MMS Midway | October 25 to 28, 2026 | San Diego, California

The classic endpoint management and PowerShell conference moves to San Diego this fall.

👉 https://mmsmoa.com/

SpiceWorld 2026 | November 12 to 13, 2026 | Austin, Texas

Jeff Hicks is returning to Austin this fall to talk PowerShell at the annual Spiceworks community event.

👉 https://www.spiceworks.com/spiceworld/

Zero Trust World 2027 | February 17 to 19, 2027 | Orlando, Florida

👉 https://ztw.com/

PowerShell + DevOps Global Summit 2027 | April 5 to 8, 2027 | Orlando, Florida

The flagship US PowerShell event moves to the Sheraton Lake Buena Vista in Orlando.

👉 https://powershellsummit.org/

PSConfEU 2027 | Dates and location to be announced SynEdgy is organizing the eleventh edition of PowerShell Conference

👉 https://psconf.eu/

Live dbatools AMA Webinar with the Core Team | Wednesday, October 7 at 12:00 pm GMT

An open Ask Me Anything with the people behind dbatools, the open source PowerShell toolkit for SQL Server administration, migration, and automation. Whether you already lean on dbatools every day or are still on the fence about getting started, this is the format where you get to put your specific questions in front of the people who wrote the answers. Speakers include Rob Sewell, Jess Pomfret, Chrissy LeMaire, Andreas Jordan, and Cláudio Silva.
When:
Where: Online, see the link for details

👉 https://shorturl.at/N53tz

Ask any AI assistant for a script that disables stale Active Directory accounts. You’ll get something that looks right. Comment-based help, a param() block, maybe even a -WhatIf. It reads like code a competent engineer wrote.

Then you run it, and it dies on Get-ADUser -IncludeDisabled, because there is no such parameter and there never was.

That’s the defect that matters, and it isn’t a style problem. Ugly code announces itself. An invented parameter reads perfectly, survives review, and fails at 2am in front of the person who inherited your script. It’s worse than bad code because nothing about it looks wrong.

I’ve been collecting these for a while. New-ScheduledTaskTrigger -StartBoundary, -StartDate, -Monthly: an entire coherent family of parameters that do not exist, invented by a model that had clearly absorbed the shape of what scheduled-task parameters look like. Add-DnsServerRecursionScope -Forwarders, where the real parameter is -Forwarder, singular. Get-GPO -Identity, twelve times, where the real ones are -Name, -Guid, and -All.

Check out the video demo of some of these tools here:

The drive back from the Ozarks

The idea showed up on a highway last month.

We were driving back from the Ozarks, my wife and daughter and son in the car, crossing rural Missouri and then rural Illinois on the way to Springfield. There’s a long stretch of that drive where there’s nothing to do but think, and what I kept turning over was the list. Not a list of things AI gets wrong, exactly. A list of things I’d want in writing before I let any assistant, or any junior engineer, hand me a script I was going to run against production. Like, a PowerShell list that’s similar to what I do with my TeacherMagic tool.

Not style preferences. The non-negotiables. The things that, if they’re missing, I don’t care how clean the formatting is.

By the time we hit the hotel I had most of it in my head. My wife and daughter went down to the pool. I sat in the room with my son while he played Fortnite, opened the laptop, and wrote the first version of what became AGENTS.md. Then, because a standard nobody applies is just a blog post, I built the first working demo of the Chrome extension in the same sitting.

That was the whole origin. A drive, a hotel room, and a kid with a headset on.

The research says it’s not just me

A study by Zhang et al. (arXiv:2601.06419) found that more than 60% of PowerShell generated by GPT-4o and o3-mini is insecure without structured guidance, and that two thirds of GPT-4o’s PowerShell violates a PSScriptAnalyzer rule.

The number I keep coming back to is this one: GPT-4o scores 3% at noticing when a function that changes system state is missing ShouldProcess.

Models are reasonable judges of what’s present. They’re close to blind about what’s absent. A linter can only find what’s there. Something else has to say what should have been.

The non-negotiables

The PowerShell Engineer Standard is a single markdown file. Twenty-one sections, about 1,100 lines: naming, parameters and validation, splatting, pipeline output, error handling, ShouldProcess, help quality, Pester v5, module structure, performance, security, cross-platform, classes, accessibility, localization, style, GUIs, prose voice, and file formats.

Section 0 is the part I wrote first, on the drive. Thirteen items. Every function has to satisfy all of them, and if it can’t, the model is supposed to stop and say so rather than ship something that looks finished.

Here they are, one at a time. Each of these gets its own deep dive later, as will every other section of the Standard. This is the tour, not the manual.

Advanced function: [CmdletBinding()] plus a param() block. Without it you don’t get -Verbose, -ErrorAction, or any of the other common parameters — and without SupportsShouldProcess on top of it, no -WhatIf. A script that skips this isn’t a command, it’s a text file that runs.

Approved verb, singular noun, prefix applied in module context. Get-Verb is the whole list. Singular nouns because Get-PSEUsers implies it can’t return one. The prefix is what keeps your Get-Config from colliding with everyone else’s.

[OutputType()] declared. It costs one line and it’s the cheapest way to tell tooling, and the next reader, what comes out without executing anything.

Emits objects, never formatted strings. A [pscustomobject] or a class. The moment a function returns pretty text, it stops being composable and the next person has to parse your output back into data.

Validation expressed as parameter attributes, not if blocks. [ValidateSet] gets you tab completion and accepted values in Get-Help for free; [ValidateRange] and [ValidateScript] at least put the constraint somewhere discoverable. Bury it in an if and nobody finds it until it throws.

Comment-based help with a runnable .EXAMPLE. Runnable meaning copy, paste, press enter, no edits. If the example needs fixing before it works, it’s decoration.

SupportsShouldProcess on anything that changes state. This is the one models are worst at, because supplying it means noticing that something required is absent rather than that something present is wrong. Declare it, gate the mutation only, and -WhatIf becomes an audit of the run instead of a promise you made in the help text.

Terminating errors are catchable, non-terminating errors don’t masquerade as success. If you have to catch it, pass -ErrorAction Stop on that call. catch { } with nothing in it is a defect, not a style choice.

No secret reaches an output stream, a native-command argument, or source control. Module logging records bound parameter values and transcription captures the verbose stream, so Write-Verbose "pass: $plain" writes the password to the log on every endpoint that runs it. Native command arguments are visible in the process table — to any local user on Linux and macOS, and to anyone with sufficient rights to query Win32_Process on Windows.

PSScriptAnalyzer clean against the project settings file. Not “clean-ish.” Not “warnings suppressed.” Clean, or suppressed with an inline comment saying why.

Comments and help written in the voice of section 19, not in marketing register. No “leverage.” No “robust.” No “In today’s fast-paced world.” Prose ships with the module and it’s where generated work gives itself away fastest.

No invented cmdlets, parameters, modules, or properties. Section 0.1, and the reason the whole document exists. More on this in a second.

Full cmdlet names and named parameters. No aliases, no positional arguments. Where-Object, not ?. You wrote it once and someone will read it fifty times at three in the morning.

Section 0.1 does the real work

The one that earns its place is Do not invent API surface.

It doesn’t ask a model to guess better. Guessing better isn’t a thing you can instruct. It asks the model to say when it’s unsure, in the code, where you’ll actually see it:

# VERIFY: confirm -IncludeDisabled exists in your module version
Get-Command Get-ADUser -Syntax
(Get-Command Get-ADUser).Parameters.Keys

The same rule covers .NET surface, which gets invented just as often and checked far less. A constructor overload that was never there, a static method that sounds right, an enum value that fits the pattern. All of it reads fine and throws on the first run.

Stating uncertainty costs you five seconds. An invented parameter costs you a debugging session, and costs the model your trust in everything else in the file.

None of this is a new opinion, and the Lineage section says so outright. Roughly a third of the document is already mechanically enforced by rules shipping in PSScriptAnalyzer. Most of sections 2 through 7 come from Microsoft’s own cmdlet development guidelines. PoshCode’s Practice and Style guide got there first on formatting. The parts that are genuinely new, security and accessibility and localization and writing for generation rather than for reading, are named explicitly, with a note that this is where to aim criticism.

The whole thing is MIT. Take it, fork it, bend it to your house rules.

Start here: drop AGENTS.md in the repo

If you take one thing from this article, take this one, because it’s free and it’s permanent.

AGENTS.md is the emerging convention for repo-level agent instructions, and it’s the delivery channel with the least friction by a wide margin. You put the file in the root of your repository. That’s the install.

From then on, most agents that read repository context pick it up: Codex, Cursor, Copilot’s agent mode, and a growing list of others. There’s no extension to install, no API key, no per-request token cost you’re paying out of pocket, and nothing for your teammates to configure. They clone the repo and the standard comes with it.

Claude Code is the exception worth knowing about. It reads CLAUDE.md and ignores AGENTS.md entirely. No warning, no error. It just runs with no project instructions and you wonder why the output got worse. Don’t rename the file, or you’ve solved it for Claude Code and broken it for everything else. Add a CLAUDE.md alongside it that pulls the real file in: @AGENTS.md on a single line, or ln -s AGENTS.md CLAUDE.md if your team is fine with symlinks in git. One source of truth, two filenames.

That last part is the reason I’d start here even if you plan to use everything else. A standard that lives in one engineer’s browser extension is that engineer’s preference. A standard that lives in the repo is the project’s, and every agent that touches the project is conformant by default.

The /adopt command writes the whole set for you: AGENTS.md, the CLAUDE.md shim, Copilot instructions, Cursor rules, PSScriptAnalyzerSettings.psd1, and a CI workflow. Or you can copy the one file by hand and be done in ten seconds.

The Chrome extension

This was the second thing built in that hotel room.

It’s a side panel that sits next to ChatGPT, Claude, Gemini, or Copilot in the browser. You describe what you want. It builds the prompt, carrying the relevant slices of the Standard, and hands it to whichever assistant you’re already paying for. No new subscription, no API key, no data going anywhere except to the assistant you chose.

Download the Extension Now

The word “relevant” is doing work in that paragraph, and it’s a correction I had to make early. You should almost never inject the whole Standard. Twelve thousand tokens of rules for a request that needed four of them is waste, and worse, it buries the sections that mattered under the ones that didn’t. So the assembler picks a baseline plus whatever the task and your workspace imply. Mention a PowerShell 5.1 target and the cross-platform section comes along quietly, because that’s where the ternary operator and ForEach-Object -Parallel warnings live.

The Firefox version is published and works the same way. The Edge version is built and sitting in review, which is its own kind of character-building experience.

The custom GPT, back from the dead

I built a custom GPT years ago, back when custom GPTs were the new thing. It was trained on my book, PowerShell for Systems Engineers, and it was reasonably good at what the book covered.

Then I stopped touching it, the way you do.

It’s now been rebuilt on the PowerShell Engineer Standard. Same place, same link, entirely different behavior. It still has the book’s material underneath, which turns out to matter, because the book explains why the practices exist and the Standard only tells you what they are. The combination answers better than either does alone.

If you already live in ChatGPT and don’t want another extension, this is your path in.

VS Code, and Open VSX

The VS Code extension is where the loop actually closes, and it’s the one I’d point a working engineer at after AGENTS.md.

It’s published on both the Visual Studio Marketplace and Open VSX, so it works in VS Code, VSCodium, Cursor, Windsurf, and anything else building on the open registry.

Two ways to use it. The first is @pse in Copilot Chat, which is the conversational path: ask, get an answer built against the Standard. The second is the one that matters more. The extension registers its tools globally, so Copilot’s agent mode can call them on its own, without you remembering to ask. The agent decides it’s writing PowerShell, reaches for the Standard, and applies it.

The advantage this has over the browser extension is context it can actually read. It sees your module manifest. It sees the function names that already exist in your project. So it knows your prefix without being told, it knows which of your own commands it can call, and it stops inventing a helper function you never wrote.

The PSScriptAnalyzer piece, and what it doesn’t mean

The extension runs PSScriptAnalyzer against the Standard’s settings file, inline, as you work. That part’s straightforward.

What I keep having to say out loud is what happens when it comes back clean.

No rule fired. That is a floor, not proof of correctness.

That exact framing is in the VS Code output, in the MCP server’s response, in the GitHub Action’s job summary, and, deliberately, in the tool description that Copilot’s agent mode reads before it decides how much to trust the result. If a tool doesn’t tell a model what its output doesn’t mean, the model will happily overclaim on its behalf. A clean analyzer run says no rule matched. It says nothing at all about whether Get-ADUser -IncludeDisabled exists.

There’s a matching rule about execution, and it lives in a separate file so the distinction can’t erode by accident. Static analysis parses without running anything, so it runs automatically. Pester executes the code under test, so it never runs unless you say yes, per invocation, every time.

PSEng, built on Phi

If the Standard costs twelve thousand tokens to carry in context, the obvious question is whether a model can just learn it instead.

Why Phi

Phi is Microsoft Research’s family of small language models, and the thesis behind it is the reason it’s the right base for this.

The original Phi paper was titled Textbooks Are All You Need. The argument was that data quality beats data quantity by a wider margin than anyone expected, and that a small model trained on carefully curated, textbook-grade material can hold its own against models many times its size. Phi-4 is the 14-billion-parameter result of running that thesis for several generations, and Microsoft released it under the MIT license, weights and all.

Which means: a Microsoft-built small model, trained on the premise that a good textbook beats a big pile of scraped text, released under a license that lets you fine-tune it, and pointed at a standard for writing Microsoft’s own shell language. Small enough to train on hardware you already own. Every piece of that lined up.

What comes out the other side

The first version was trained on a different open-weight base, before Phi. The method is the same either way. The training set is PowerShell that scores 100/100 against a frozen rubric, generated and scored entirely on a laptop, with no hosted API anywhere in the pipeline.

The useful way to describe the result isn’t a score. It’s what changes in the code.

Ask a general purpose assistant for an account-cleanup function and you tend to get output with a specific set of holes. It reports progress with Write-Host, so nothing it tells you can be captured, piped, or exported. You get a screen of green text and no audit trail. It calls the mutating cmdlet without -ErrorAction Stop inside its try, so a non-terminating failure sails past the catch and it prints a success message for an account it didn’t actually disable. It catches errors generically, flattens them to a string, and throws away the error record. It emits nothing at all, so you can’t pipe the results into Export-Csv to hand your auditor.

Every one of those is something I’ve watched a frontier model do this month.

The tuned model produces the other shape by default: SupportsShouldProcess with ConfirmImpact set, a typed catch on the specific exception the AD module actually throws, Get-ADUser splatted rather than run off the edge of the screen, and one [pscustomobject] per account evaluated rather than per account changed, so a -WhatIf run is a report you can file.

That last detail is the one I’d point at. Nobody asked for it. It’s an engineering judgment about what the person running this at 2am will need afterwards, and it’s in the Standard because that’s the kind of thing a standard is for.

What it does not fix is the invented parameter. That’s still where nearly all of its remaining errors live, and it’s the honest limit of this approach. Fine-tuning is good at teaching behaviour and bad at storing facts. A model trained on Get-Help dumps absorbs the general shape of parameter names and produces fluent, plausible, wrong code. So the surface information is used as a filter instead. Every candidate is checked against real installed modules before it can enter the training set, and anything invented is thrown out rather than learned.

Conformance is solved. Hallucination isn’t, and I’d rather say that than let you find out yourself.

The part your security team cares about

Here’s where a local model stops being a technical curiosity.

Look at what’s actually in the script you’d paste into a chat window. Server names. OU distinguished names. Service account names. Your naming conventions, your network topology, which security groups gate what. A stale-account cleanup script is a small map of how your directory is organised, and the error message you paste back to ask “why doesn’t this work?” is usually more revealing than the script was.

That’s not a hypothetical objection. It’s the reason the answer is no.

PSEng runs on the machine in front of you. Not “encrypted in transit.” Not “we don’t train on your data.” Nothing is transmitted, because there is nothing to transmit. No API key, no account, no network call, no vendor.

What that buys, concretely:

• It works air-gapped. Isolated networks, classified environments, OT and manufacturing segments, anywhere with no route to the internet by design. Most AI tooling can’t be deployed there at all. This can.

• Procurement has nothing to review. No data-processing agreement, no sub-processor list, no retention policy, no data-residency question. The review that normally takes a quarter doesn’t apply to software that never phones home.

• It doesn’t have outages. When a provider goes down, and they do, your scripting assistant is still sitting on your laptop.

• The cost doesn’t scale with use. No per-token billing, no seat count, no awkward invoice conversation when the team starts using it properly.

There’s a second, quieter benefit that only shows up once you’re using it. A model that knows the Standard doesn’t need to be told the Standard, which means the entire context window is available for your code. Twelve thousand tokens of rules is most of a small model’s working memory. Hand the prompted version a 500 line script to refactor and it doesn’t fit. Hand it to this one and it does.

The trade is real and worth stating plainly. A small local model is not as generally capable as a frontier model. It writes PowerShell to a standard. It won’t help you with your Terraform.

But for the specific job of “write me a function that follows our rules and doesn’t invent cmdlets,” the gap is much narrower than you’d expect. And in a regulated environment, the model you’re actually allowed to use beats the one you aren’t.

Get it

The preview is up on Hugging Face: huggingface.co/jimtyler/pseng-14b-preview

It’s a LoRA adapter, about 213 MB, MIT licensed. The model card has the exact commands, including the one that builds the quantized Phi-4 base it expects.

It runs on Apple Silicon only. The training and the runtime both use MLX, Apple’s array framework, so a Mac with an M-series chip is the requirement. I am working on one good enough for Windows, but I am working with the hardware I have, and it’s worth being blunt about rather than letting you find out after the download. The reason is prosaic: MLX is what made training a 14 billion parameter model on a laptop practical in the first place, and the laptop I had was a Mac. A GGUF build would open this up to Windows through Ollama or LM Studio, and it’s on the list.

Call it what it is: a preview. It was trained on 517 examples, stopped early on a noisy validation curve, and it has not yet been scored against the frozen benchmark. It still invents a parameter now and then, which is the whole reason section 0.1 exists and the reason you check anything you don’t recognize before you run it. I’ve got work to do!

What’s on the horizon

Several of these are built and queued rather than theoretical, and I’ve kept them out of this article mostly for space.

An MCP server, so any MCP-speaking client carries the Standard without an extension. A GitHub Copilot extension and an M365 Copilot agent, each shaped for the context its host expects. A Claude Skill. A GitHub Action at the other end of the loop, running PSScriptAnalyzer against the Standard’s settings and annotating your pull requests. Actually, a lot of these things are done and maybe not published.

One rule holds all of it together, and it’s the reason adding channels doesn’t multiply the maintenance: a single core/ package owns the assembler, the Standard payload, the file templates, and the verification engine. Every channel derives from it, and the test suite fails if any of them drift.

Then there are the deep dives. Every section of the Standard gets its own article, starting with the thirteen non-negotiables above, because a checklist tells you what and I’d rather you knew why.

And in the meantime, if you hit a cmdlet or a parameter you don’t recognize in generated code, whoever generated it, check it before you run it. That habit is worth more than every tool on this list. Let’s go, fellow PowerShell Engineers!

The PowerShell Engineer Standard is MIT-licensed and lives at powershellengineer.com/standard. Not affiliated with or endorsed by Microsoft. PowerShell is a trademark of Microsoft Corporation.

Merill Fernando opened a request for comments on the Maester GitHub repository proposing a major architectural shift for the upcoming release. The team plans to move built in checks away from Pester wrappers and into a native test model so the engine can fully manage the complete lifecycle of each security assessment. Under the new design every check will consist of a PowerShell script and a Markdown file with execution metadata declared directly on the test function. This structured approach allows the core engine to centrally handle prerequisites like verifying active connections and licenses while maintaining backward compatibility for organizations running existing custom Pester tests. Seems kind of similar to what I’m doing with Guerrilla.

👉 https://github.com/maester365/maester/discussions/2050

Active Directory Meets Source Control with Fred Weinmann

Fred Weinmann recently joined Andrew on The PowerShell Podcast to kick off a multi episode series exploring his extensive open source module portfolio. This initial installment focuses exclusively on the Active Directory Management Framework which is a configuration driven system Fred originally built while working as a Microsoft field engineer for a massive enterprise customer.

Jake Hildreth Brings The Elm Architecture to PowerShell with PSTea

Jake Hildreth has released PSTea, an open source PowerShell module that implements The Elm Architecture, the Model-View-Update pattern, for building interactive terminal user interfaces. The clever part is portability. The same application code that runs as a TUI in your console will also serve to a browser over WebSocket and xterm.js without changing a single line, so one app runs in two places. Jake cites BubbleTea, LipGloss, and Textual as influences, along with the Commodore 64 and DOS for good measure, and the module gives you a clean Init, Update, and View loop driven by keypress messages. It has been in development quietly for months and just surfaced publicly, making it the framework worth watching underneath his growing collection of terminal tools.

👉 https://github.com/jakehildreth/PSTea

Mark Orr Rebuilds the Autopilot Import GUI for v1 and v2

Mark Orr has published Get-WindowsAutopilotImportCommunity, a graphical front end for Andrew S. Taylor’s community Autopilot script that finally handles both enrollment generations in one place. It is a ground up rewrite of Ugur Koç’s original import GUI, which wrapped Michael Niehaus’ Get-WindowsAutoPilotInfo and therefore only ever spoke Autopilot v1 with its hardware hash. Mark’s version runs on the community script and supports Autopilot v1 hardware hashes alongside Autopilot v2 Device Preparation identifiers, so the tool keeps working as tenants move to the newer model. He also traded the old fixed size window for a resizable, grid based layout with sidebar navigation, and the code ties into orr365.tools, the new home he stood up for his tooling this week.

👉 https://github.com/markorr321/Get-WindowsAutopilotImportCommunity

Exchange Online PowerShell 3.10.1 Fixes CBA Bug

Tony Redmond explores the recent release of Exchange Online Management version 3.10.1 and its fix for a breaking certificate based authentication flow bug. Tony details his troubleshooting experience after automation scripts suddenly began throwing 401 forbidden errors on REST based cmdlets despite successfully establishing a session.

👉 Exchange Online Management 3.10.1 Update

Hijacking the Windows Lock Screen with PowerShell

Frank Lindenblatt recently took the stage at the PowerShell Conference Europe to deliver a fast paced presentation on engineering a reliable custom lock screen slideshow. He explained that the default Windows personalization settings and classic screen savers proved too inconsistent for reliably displaying informational slides to corporate users.

PSScriptTools Adds Console Formatting Commands

Jeffery Hicks recently took to LinkedIn to announce a new release of his PSScriptTools module for the PowerShell Gallery. The update introduces several new commands that allow engineers to examine enums, generate formatted boxes, and visualize process trees directly in the terminal. He also highlighted the addition of horizontal rule lines for clearer output structuring and noted that administrators can run Open-PSScriptToolsHelp to pull up the complete module documentation.

👉 https://www.linkedin.com/feed/update/urn:li:activity:7488612147288014848/

👉 https://github.com/jdhitsolutions/PSScriptTools

Visualizing Nested Properties with DumPS

Harm Veenstra recently published a new guide on his PowerShell is fun blog detailing how to leverage the dumPS module to simplify debugging directly in the terminal. The tool solves the common frustration of reading deeply nested object properties when you are working outside of Visual Studio Code. Harm demonstrates how to install the package and pipe standard commands into the Out-Dump cmdlet to generate color coded and structured output while easily preserving the original objects in the pipeline.

👉 https://powershellisfun.com/2026/07/24/using-dumps-in-powershell-for-easy-reading-of-all-properties/

Navigating IT Chaos in Game Development

Michael Adams recently joined Brock on the PDQ Patch Notes series to unpack his two decades of horizontal career growth across various tech sectors. The conversation explores the unique challenges of managing infrastructure for a remote game development studio where maintaining peak performance hardware and surviving production crunches require significant operational agility.

Events

MMS Midway | October 25 to 28, 2026 | San Diego, California

The classic endpoint management and PowerShell conference moves to San Diego this fall.

👉 https://mmsmoa.com/

SpiceWorld 2026 | November 12 to 13, 2026 | Austin, Texas

Jeff Hicks is returning to Austin this fall to talk PowerShell at the annual Spiceworks community event.

👉 https://www.spiceworks.com/spiceworld/

Zero Trust World 2027 | February 17 to 19, 2027 | Orlando, Florida

👉 https://ztw.com/

PowerShell + DevOps Global Summit 2027 | April 5 to 8, 2027 | Orlando, Florida

The flagship US PowerShell event moves to the Sheraton Lake Buena Vista in Orlando.

👉 https://powershellsummit.org/

PSConfEU 2027 | Dates and location to be announced SynEdgy is organizing the eleventh edition of PowerShell Conference

👉 https://psconf.eu/

PowerShell 7.7 Preview 3 Brings Time Sortable UUIDs

PowerShell version 7.7 preview 3 is now available and running on the .NET 11 preview 6 framework. The biggest change updates the New Guid cmdlet to generate version 7 time sortable UUIDs by default. Scripts requiring purely random output must now call the system guid class directly. The team also fixed progress bar rendering for double width unicode characters and optimized packaging to deliver a minimum size payload for arm64 deployments.

👉 v7.7.0-preview.3 Release of PowerShell

July 2026 PowerShell Community Call and Platform Updates

The July 2026 PowerShell Community Call highlighted several important milestones. The team announced that PowerShell versions 7.4 and 7.5 will reach end of life in November. A preview for PowerShell 7.7 featuring .NET 11 integration is arriving soon. The team also released Platypus version 1.0.2 to resolve structural issues with MAML formatting. Furthermore the intermittent Lucene search indexing issue on the PowerShell Gallery has been successfully resolved.

👉 July 2026 Community Call Transcript

Jake Hildreth on PSConf EU and Stepper Updates

Jake Hildreth recently joined the PowerShell Podcast to discuss his experiences presenting at the PowerShell Conference Europe and to highlight new updates to his open source Stepper module. The tool allows engineers to build resumable step by step scripts that eliminate the need to restart long running automation tasks if a failure occurs. Jake detailed recent additions including automatic logging and named steps before shifting the conversation to strongly advocate for taking dedicated time away from the keyboard to prevent industry burnout.

👉 The PowerShell Podcast E238

Jorge Suarez Put an Entire Slide Deck Inside Your Terminal

Jorge Suarez shipped a cross-platform PowerShell module that builds and delivers ANSI-rendered slide decks without ever leaving the console. Install-Module TerminalSlides, PowerShell 7.4+, MIT.

The slide DSL covers text, bullets, code, charts, diagrams, tables, quotes, boxes, notes, and images, driven by a fluent deck-building API. Eight built in themes ship out of the boxwith custom theme authoring if none of those fit. Interactive mode gives you keyboard navigation and a progress bar; non-interactive export targets CI and doc pipelines. Import and export runs through PSD1, JSON, Markdown, HTML, ANSI, and plain text.

👉 GitHub · Docs · PSGallery

David Sass Built a Resume Scanner That Never Phones Home

ATSScannerButWithPrivacy

Every “free ATS resume checker” on the web wants your resume uploaded to their server. David Sass built the version that doesn’t. ATS Scanner runs locally, parses your .pdf or .docx, and reports how it will fare against real applicant tracking systems, with your document staying on your machine the entire time. Check it out below.

👉 GitHub

Enums for Everyone

Jeff Hicks explores how to properly use enums in your scripting projects. It clarifies the subtle distinction between standard .NET properties and true enumeration classes. You can also easily build custom enums directly from the console using a simple one line command to improve your coding efficiency.

👉 Enums for Everyone

Teams PowerShell 7.9 Adds WAM and Federated Chat Controls

Tony Redmond breaks down what shipped in the July 19 release of the Microsoft Teams PowerShell module. Two things matter here. First, Connect MicrosoftTeams now runs through Windows Account Manager for authentication, joining the Graph SDK and Exchange Online modules on that path, and yes, that means new fun with the ongoing assembly clash issue. Second, and more usefully, the module now exposes Set CsTenantFederationConfiguration options to lock down federated group chats through EnableExternalAccessRestrictionsForChatParticipants and EnableMutualFederationForChatParticipants. If federation control has been on your list, this is the release that gives it to you.

👉 https://office365itpros.com/2026/07/24/federated-chat-controls/

Mark Orr turned a click heavy portal chore into one command

Access-Package-OnDemand handles the Entra ID Entitlement Management workflow the portal is worst at: granting access to someone you already know needs it. Start-AccessPackageOnDemand gives you sign-in, package picker, batch email entry, and canned justifications in one pass. Best part is inline resolution: every address is checked against the directory and existing assignments and color-labeled before you submit, so typos and already-provisioned users surface first. Auto end-dates, stuck-request recovery, cross-platform MSAL auth. PowerShell 7 required. Delivery is async and takes three to six minutes, which is Microsoft's clock, not his.

👉 Access Packages On-Demand with PowerShell

Permissions Creep Can Kill Your Graph SDK Session

Tony Redmond hit a wall running Connect MgGraph with the Scopes parameter and traced it to something every long running tenant is heading toward. The Microsoft Graph Command Line Tools app collects delegated permissions every time someone consents to a new scope, and there is an undocumented ceiling somewhere around 140 permissions.

👉 https://office365itpros.com/2026/07/23/permissions-creep-sdk/

Events

MMS Midway | October 25 to 28, 2026 | San Diego, California

The classic endpoint management and PowerShell conference moves to San Diego this fall.

👉 https://mmsmoa.com/

SpiceWorld 2026 | November 12 to 13, 2026 | Austin, Texas

Jeff Hicks is returning to Austin this fall to talk PowerShell at the annual Spiceworks community event.

👉 https://www.spiceworks.com/spiceworld/

Zero Trust World 2027 | February 17 to 19, 2027 | Orlando, Florida

👉 https://ztw.com/

PowerShell + DevOps Global Summit 2027 | April 5 to 8, 2027 | Orlando, Florida

The flagship US PowerShell event moves to the Sheraton Lake Buena Vista in Orlando.

👉 https://powershellsummit.org/

PSConfEU 2027 | Dates and location to be announced SynEdgy is organizing the eleventh edition of PowerShell Conference

👉 https://psconf.eu/

PSGuerrilla is Now Guerrilla

PSGuerrilla is now Guerrilla. If you have it installed, that’s the part that affects you: the PSGallery package name changed, so it’s Install-PSResource Guerrilla now. The old PSGuerrilla listing stays up pointing at the new one, but it won’t get updates. Gallery names are permanent and there’s no redirect, so this is a one time move I had to make by hand.

Why drop the PS? Because the prefix names the implementation language, not the job. That’s the right call for a utility library (PSReadLine really is PowerShell plumbing) and the wrong call for something trying to be a tool in its own right. Pester didn’t need it. dbatools didn’t need it. The tell was that everything around the project had already dropped it without asking me: the domain has been guerrilla.army for a while, the philosophy has always been Guerrilla Zero Trust, and the module manifest was the last thing still introducing itself by its shell. The rename is the small story.

The bigger one is that I deleted about half the module. Guerrilla had sprawled into monitors, alert channels, schedulers, and threat feeds. That’s detection, which is a job other platforms do full time and better. I really wanted to do some monitoring piece to this project, but they are two different things that I feel like had to be separated. The exported surface went from 67 commands to 34, and everything that survived serves one loop: assess, score, compare, report. Deleting code you wrote is harder than writing it (like scary in a way, but also I hate scoping something back because I always want to go big). It was still the right call, and the module is better for being smaller.

What’s left, honestly stated: 636 checks across Active Directory, Entra ID / M365, and Google Workspace, mapped to CISA SCuBA, EIDSCA, CIS, NIST SP 800-53, and MITRE ATT&CK. 1,829 golden fixtures gate every release, because a check that renders a verdict nobody tested is just an opinion with a color attached (this is how I’m checking things that I can’t yet validate in a production environment because I don’t have it in a production environment). When a check cannot assess something, it says Not Assessed and stays out of the score. Absence of evidence is never a pass. I’ll be talking through the whole philosophy behind it next week at Midwest Tech Talk.

That said, I could really use your help! I would love to add more contributors to Guerrilla to make useful for everyone around the world. Check out the repo here: https://github.com/jimrtyler/guerrilla

Microsoft Ships a Record 570 CVEs and Three Zero Days in One Patch Tuesday

Tuesday’s Patch Tuesday came in at 570 vulnerabilities across Windows, SharePoint Server, Office, .NET, Visual Studio, SQL Server, and the rest of the Microsoft catalog. That is roughly triple last month and easily the largest single release on record. Three of them are zero days. Two are being actively exploited: CVE-2026-56155, an AD FS elevation of privilege bug that Microsoft’s own DART team discovered while investigating live incidents, and a SharePoint Server on premise flaw. The third is a publicly disclosed BitLocker bypass. If you run AD FS or on premise SharePoint, patch this weekend. Microsoft also confirmed the volume is partly the output of their AI assisted vulnerability discovery pipeline, so this is likely the new normal.

👉 https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/

Huntress Catches a Threat Actor Deploying AI Generated PowerShell Against Active Directory

This one deserves your full attention. Huntress recovered a PowerShell script called Untitled1.ps1 from a real intrusion in early June, and Jevon Ang and Dray Agha published the full breakdown this week. The script is a textbook Active Directory enumeration tool, complete with a cascading five step fallback for locating the domain controller, and it is almost certainly AI generated. The tells include an unedited placeholder server name the attacker never bothered to change and an internal title that reads “100% Working AD Information Gathering Script - FULLY FIXED.”

👉 https://thehackernews.com/2026/07/attacker-uses-suspected-ai-generated.html

Write the Test First: Robert Prüst on Pester, PSConf, and Learning in Public

Andrew Pla and Robert Prüst spend an hour on Pester and why testing is the essential safety net for AI generated PowerShell. Given the Huntress story this week, the timing is uncomfortably good. 👉

Tony Redmond on Identifying Obsolete SharePoint Sites with PowerShell

Tony wrote up a Reddit question about identifying obsolete SharePoint Online sites and turned it into a full walkthrough for scanning a tenant with PowerShell. He pulls usage data from the Graph, cross references it against basic site properties from SharePoint, and lands on a report an admin can act on. The example filters for sites owned by inactive users with less than a gigabyte of data and no modifications since 2024, but the pattern is the useful part. Get-MgSite, Entra ID app registration, application permissions, hash table processing. Practical.

👉 https://office365itpros.com/2026/07/13/find-obsolete-sites/

Entra Connect Sync 2.6.84 Fixes What 2.6.79 Broke

A few weeks ago Microsoft released Entra Connect Sync 2.6.79, discovered a bug, and pulled it. Version 2.6.84 shipped Tuesday as the corrected release. If you deferred the last update cycle because of the pulled build, this is your green light. Andres has the release notes and installer link.

👉 https://blog.icewolf.ch/archive/2026/07/14/entra-connect-sync-2-6-84-released/

Fred Weinmann Wraps Seven Years of Work on the Active Directory Management Framework

Friedrich Weinmann from Microsoft Security Automation took over PowerShell Wednesday this week to walk through Active Directory Management Framework, the configuration as code project he has been building for seven and a half years. This week’s milestone ships the last major security piece the framework needed, and Fred rebuilt the website at admf.one in the same push. The pitch is straightforward. Put your entire AD topology, group policies, access rules, schema extensions, and delegations into source control, generate a diff between the plan and what is actually in your domain, then decide which changes you want to apply. This is where ADMF beats Desired State Configuration for real world AD work. DSC is all or nothing. ADMF lets you accept the seven changes you can push today and defer the three that depend on another team. Works for a single forest or for hundreds of them, runs locally or from a remote machine without a trust required, and Fred demoed the whole loop live against a real domain.

Microsoft.Graph PowerShell SDK 2.38.1 Released

A point release addressing issues in 2.38.0 shipped Monday. Andres notes both the Microsoft.Graph and Microsoft.Graph.Beta modules are updated. Given how many admins run into odd behaviors after the 2.38 line dropped in June, this is worth pulling into your baseline.

👉 https://blog.icewolf.ch/archive/2026/07/13/microsoft-graph-powershell-modules-2-38-1-released/

Harm Veenstra Renewed as Microsoft MVP for 2026-2027

Great community news to close on. Harm Veenstra, who runs PowerShellIsFun.com and produces some of the most consistently useful practical PowerShell writing anywhere, was renewed as a Microsoft MVP for another year on Wednesday (yes, I noted above already, but he has a blog post on it haha). Harm has been publishing weekly on his blog for years, and his consistency is a big part of what makes him a community anchor. Congratulations.

👉 https://powershellisfun.com/2026/07/16/microsoft-powershell-mvp-2026-2027/

Events

Midwest Tech Talk 2026 | July 19 to 21, 2026 | Lake of the Ozarks, Missouri I am speaking at this one - actually keynoting :)

👉 https://www.midwesttechtalk.com/

MMS Midway | October 25 to 28, 2026 | San Diego, California
The classic endpoint management and PowerShell conference moves to San Diego this fall.

👉 https://mmsmoa.com/

SpiceWorld 2026 | November 12 to 13, 2026 | Austin, Texas
Jeff Hicks is returning to Austin this fall to talk PowerShell at the annual Spiceworks community event.

👉 https://www.spiceworks.com/spiceworld/

Zero Trust World 2027 | February 17 to 19, 2027 | Orlando, Florida

👉 https://ztw.com/

PowerShell + DevOps Global Summit 2027 | April 5 to 8, 2027 | Orlando, Florida
The flagship US PowerShell event moves to the Sheraton Lake Buena Vista in Orlando.

👉 https://powershellsummit.org/

PSConfEU 2027 | Dates and location to be announced SynEdgy is organizing the eleventh edition of PowerShell Conference
👉 https://psconf.eu/

Merill Fernando left Microsoft to focus entirely on Maester and ensure the open source tool continues evolving alongside Microsoft 365 security. To help fund the core project, his team just launched Maester Cloud as a portal companion that lets administrators track tenant results over time. Organizations can now sponsor the effort while gaining a multi tenant dashboard for their daily monitoring tasks.

👉 https://maester.cloud

PowerShell + Proxmox: Open Source Virtualization Unleashed

Raimund Andree details how the German army uses the Dagger project to manage their mobile data centers. Following a major move away from VMware, this session demonstrates how they adapt the DSC workshop blueprint to fully automate Proxmox environments.

Hunting Down Inactive Distribution Lists

Tony Redmond updated his script for finding inactive distribution lists to use the newer Get-MessageTraceV2 cmdlet. Because the cmdlet restricts queries to ten day windows, the revised code loops through nine separate chunks to build a full ninety day history of group expansion events. The script then compares your existing groups against that compiled history to help you safely clean up stale objects.

👉 https://office365itpros.com/2026/07/09/inactive-distribution-list-2026/

Building Better SharePoint with PowerShell with Dan Adams | The PowerShell Podcast

My good friend Andrew Pla sits down with Microsoft 365 veteran Dan Adams to discuss the often misunderstood world of SharePoint and the shift toward Microsoft Graph. They dive into a custom PowerShell module Dan built for assessing and benchmarking tenant environments, proving that the bad reputation of SharePoint is usually about the builder instead of the platform itself.

Delivering a PowerShell Mail Solution

Jeff Hicks wraps up his recent scripting challenge by finalizing his custom PowerShell mail delivery tool. The latest installment covers handling file attachments using native .NET classes and managing SMTP configuration data. He reminds readers that the process of building the module teaches more than the final code itself.

👉 https://buttondown.com/behind-the-powershell-pipeline/archive/delivering-a-powershell-mail-solution/

Microsoft Graph with PowerShell 101

Jan-Hendrik Peters delivers an essential primer on navigating Microsoft Graph using PowerShell. This session breaks down the fundamentals of authentication and querying to help administrators transition away from legacy modules.

Using the PowerShell Webserver Module

Microsoft MVP Harm Veenstra highlights a community module that lets you spin up a local web server without installing IIS. The tool leverages native .NET classes to provide a quick interface for remote command execution, script execution, and file transfers. While not meant for production environments, it offers a fantastic lightweight option for home labs and quick testing.

👉 https://powershellisfun.com/2026/07/03/using-the-powershell-webserver-module/

How to use Azure Functions to run PowerShell scripts in Entra ID Governance

Christian Frohn explains how to replace an Azure Automation account with an Azure Function for Lifecycle Workflows. The guide covers adapting existing PowerShell scripts to accept HTTP requests and return proper status codes instead of standard exit commands. You will also find steps for deploying the setup through Azure DevOps pipelines and configuring Logic Apps to handle the final task result.

👉 https://www.christianfrohn.dk/2026/07/01/how-to-use-azure-functions-to-run-powershell-scripts-in-entra-id-governance/

Events

Midwest Tech Talk 2026 | July 19 to 21, 2026 | Lake of the Ozarks, Missouri I am speaking at this one in just over two weeks. Kickoff event Sunday July 19, main conference Monday and Tuesday at The Resort at Lake of the Ozarks, with an evening event Monday hosted by Provision Data Solutions. Two day K12 technology and security symposium built by folks who actually run school district tech departments, doubling as the K12TechPro Regional Meetup for the Midwest. If you are in K12 IT anywhere in the region, this is the one to make this summer.

👉 https://www.midwesttechtalk.com/

MMS Midway | October 25 to 28, 2026 | San Diego, California The classic endpoint management and PowerShell conference moves to San Diego this fall. Strong K12 IT representation if you are looking for peers in that space.

👉 https://mmsmoa.com/

SpiceWorld 2026 | November 12 to 13, 2026 | Austin, Texas Jeff Hicks is returning to Austin this fall to talk PowerShell at the annual Spiceworks community event. The pricing is genuinely reasonable for the caliber of content, and if you have a hybrid IT day job the tracks tend to hit the practical stuff you can use Monday morning.

👉 https://www.spiceworks.com/spiceworld/

Zero Trust World 2027 | February 17 to 19, 2027 | Orlando, Florida ThreatLocker’s seventh annual cybersecurity training event lands at Rosen Shingle Creek in Orlando. Three days of hands on training, real attack technique walkthroughs, hacking labs, and Cyber Hero Certification exam sessions every morning. If you defend an environment for a living, this one is built for you.

👉 https://ztw.com/

PowerShell + DevOps Global Summit 2027 | April 5 to 8, 2027 | Orlando, Florida The flagship US PowerShell event moves to the Sheraton Lake Buena Vista in Orlando. Call for papers opened Wednesday and runs through the summer, and early bird registration is open now. The OnRamp program for newcomers runs alongside the main track.

👉 https://powershellsummit.org/

PSConfEU 2027 | Dates and location to be announced SynEdgy is organizing the eleventh edition of PowerShell Conference Europe after this year’s tenth anniversary run in Wiesbaden. Watch psconf.eu for the announcement, which typically lands toward the end of summer.

👉 https://psconf.eu/

Elsewhere the community kept moving. Andres Bohren posted through the holiday week with module release notes, Tony followed up his book launch with practical pieces on Teams and Copilot, and Jeff Hicks used his June potluck to say goodbye to the Lonely Administrator blog.

I have had numerous serious udpateds to my PSGuerrilla module (Install-Module PSGuerrilla) - https://github.com/jimrtyler/PSGuerrilla - Any feedback would be greatly appreciated! We are now sitting at v2.38.0.

Congrats to all of the new Microsoft MVPs that were welcomed to the program this week!

Build Your Own PowerShell AI Terminal Copilot

Bart Pasmans demonstrates how to construct a custom AI terminal assistant using PowerShell and Azure OpenAI. His two script solution takes natural language requests and generates the exact commands needed alongside a built in risk assessment system to prevent accidental infrastructure damage. This approach provides a highly customizable alternative to commercial tools by letting administrators control execution safety directly from the shell.

👉 https://bartpasmans.tech/powershell-ai-terminal-copilot/

Microsoft 365 for IT Pros 2027 Edition Ships as a Four Book Bundle

Tony Redmond and the Office 365 for IT Pros team published the 2027 edition on Wednesday, and the rename to Microsoft 365 for IT Pros is only the headline change. The bundle now consists of four separate books. The main Microsoft 365 for IT Pros volume sits at just over 900 pages after being trimmed from the roughly 1,300 pages the 2026 edition carried. The 431 page Automating Microsoft 365 with PowerShell third edition that Tony launched last week is book two. The Microsoft Purview for IT Pros and Power Platform for IT Pros volumes are new standalone books built from four chapters lifted out of the main volume. The main book carries a new Managing AI and Agents chapter covering Microsoft 365 Copilot, Agent 365, and Work IQ. If you subscribed to the 2026 edition, the renewal code landed in your inbox on Wednesday morning.

👉 https://office365itpros.com/2026/07/01/microsoft-365-for-it-pros/

Jeff Hicks June Potluck Marks the End of The Lonely Administrator

Jeff Hicks used his June potluck for the news on the SecretManagement archive and the Summit 2027 CFP opening, plus a run through the PSReadline CopyScreen key handler that lets you select terminal output with the shift arrow keys and copy it to the clipboard on Enter. He also drops a recommendation for The Microsoft DSC Handbook on Leanpub covering DSC v3, announces his return to SpiceWorld in Austin on November 12 and 13, and closes with the news that he is deprecating his long running WordPress blog The Lonely Administrator later this year. If you have posts from there you have relied on over the years, grab them now while they are still online. The scripting challenge this month is a VHD backup tool that pushes on both PowerShell and storage fundamentals.

👉 https://buttondown.com/behind-the-powershell-pipeline/archive/

Andres Bohren Ran the Module Release Board All Week

Andres Bohren kept his usual pace through the holiday week and shipped four module release notes worth pulling. Microsoft published a new version of the MicrosoftPlaces PowerShell module on both June 30 and July 3, so you probably want the July 3 build if you have not updated recently. Microsoft.Online.SharePoint.PowerShell 16.0.27424.12000 landed on June 30 with the usual mix of authentication and provisioning refinements. Microsoft shipped a new PowerToys build this week that Andres notes on July 3 for anyone running the utility suite. And Git ticked up to 2.55.0 on July 1, which Andres covers with his usual install walkthrough using winget. If you follow one blog for Microsoft module release notes, Andres is still the one to read.

👉 https://blog.icewolf.ch/

Teaching Tara: PowerShell Script Breakdown

Andrew Pla and Tara Sinquefield sit down together and read through scripts as a team. Tara asks the beginner questions the rest of us stopped asking a long time ago, and Andrew explains variables, param blocks, sub expressions, calculated properties, and the pipeline at the pace of someone just starting to learn. If you have anyone on your team who is trying to pick up PowerShell, this is the episode to send them. Bonus AI discussion at the end on where Claude and ChatGPT actually help learners versus lead them into bad habits.

Morten Mynster Kristensen Spots New Graph Beta Permissions for Creating Defender Alerts

Fellow PowerShell MVP and LeastPrivilegedMSGraph author Morten Mynster Kristensen flagged this week that Microsoft quietly landed two new Beta permissions on Microsoft Graph, SecurityAlert.Create.All in both delegated and application forms. The endpoint at /security/alerts_v2 now accepts POST, which means you can create your own alerts in Microsoft Defender XDR from PowerShell rather than only reading them. For anyone who has built detection logic in a script and had to route the output to email, a Teams webhook, or a Sentinel ingestion pipeline, the ability to write directly into the Defender queue is a meaningful architectural shift. I plan to get support for this into my PSGuerrilla module.

👉 https://www.linkedin.com/posts/mortenmynster_powershell-msgraph-automation-activity-7345854938947694593

Tony Redmond on the Small Window for Incoming Teams Calls

Tony Redmond writes that a recent Microsoft Teams improvement is buried deep enough in settings that most users will never find it. Incoming Teams calls can now be answered in a small window rather than the full application view, and for people who take a lot of calls the difference is real. You can keep working in your primary application while the call runs in a small overlay rather than losing your context every time somebody rings. Tony’s frustration with the discoverability of the feature is fair. If you are a busy person on Teams, this is worth changing this weekend so it is on the next time you need it.

👉 https://office365itpros.com/2026/06/30/teams-small-window/

PowerShell with Buttons

Andrew Pla and Stephen Valdinger at PSConfEU 2026 The PSConfEU 2026 session recording landed this week and it is a full ninety minute hands on walkthrough of PowerShell Universal from the two of them. Stephen Valdinger from Chocolatey Software leads the technical demo, Andrew Pla plays the perfect stand in for anyone getting reintroduced to PSU after a break, and the pair walk through turning a real PowerShell module into a full web application with a REST API layer, a SQLite back end, forms, dashboards, Pester unit tests, PSPlayright UI tests, and a new plaster template that scaffolds a full PSU app module for you in one command. This is the practical content that sends you straight to Adam Driscoll’s docs Sunday afternoon.

Windows 11 26H2 Prep Time Starts Now

Microsoft published the initial 26H2 announcement in late June and the message from the community is start testing. Jason Leznek’s Windows IT Pro Blog piece covers the upgrade paths, the Autopatch pilot to production strategy, and the tracking mechanisms available to walk your fleet through a controlled rollout. For K12 shops with student devices in the field, summer is the window to get the pilot ring stood up before the school year starts. The changes are not disruptive on the surface but the Autopatch story continues to mature and the discipline of running the pilot correctly compounds over years.

👉 https://techcommunity.microsoft.com/t5/windows-it-pro-blog/get-ready-for-windows-11-version-26h2/ba-p/4529367

Encore: Lessons in Leadership from PowerShell Pioneers Jeffrey Snover and Don Jones

The encore of the April 28, 2025 conversation recorded live at the PowerShell + DevOps Global Summit dropped fresh this week. Snover walks through the origin story of PowerShell and the pivotal moment his path crossed with Don’s, Don brings his usual thoughtful reflection on the shift from individual contributor to leader, and the throughline is that vulnerability, repetition, and kindness are core to any real career.

PSConfEU 2026 Session Archive

The rest of the PSConfEU 2026 sessions from Wiesbaden continue to upload on the SynEdgy channel through the summer. I shared Andrew’s above, but I could frankly load the newsletter if I wanted to. Deep technical content across PowerShell, DSC, PSU, security, and community sessions from the tenth anniversary edition of the conference.

👉 https://www.youtube.com/@synedgy

Events

Midwest Tech Talk 2026 | July 19 to 21, 2026 | Lake of the Ozarks, Missouri I am speaking at this one in just over two weeks. Kickoff event Sunday July 19, main conference Monday and Tuesday at The Resort at Lake of the Ozarks, with an evening event Monday hosted by Provision Data Solutions. Two day K12 technology and security symposium built by folks who actually run school district tech departments, doubling as the K12TechPro Regional Meetup for the Midwest. If you are in K12 IT anywhere in the region, this is the one to make this summer.

👉 https://www.midwesttechtalk.com/

MMS Midway | October 25 to 28, 2026 | San Diego, California The classic endpoint management and PowerShell conference moves to San Diego this fall. Strong K12 IT representation if you are looking for peers in that space.

👉 https://mmsmoa.com/

SpiceWorld 2026 | November 12 to 13, 2026 | Austin, Texas Jeff Hicks is returning to Austin this fall to talk PowerShell at the annual Spiceworks community event. The pricing is genuinely reasonable for the caliber of content, and if you have a hybrid IT day job the tracks tend to hit the practical stuff you can use Monday morning.

👉 https://www.spiceworks.com/spiceworld/

Zero Trust World 2027 | February 17 to 19, 2027 | Orlando, Florida ThreatLocker’s seventh annual cybersecurity training event lands at Rosen Shingle Creek in Orlando. Three days of hands on training, real attack technique walkthroughs, hacking labs, and Cyber Hero Certification exam sessions every morning. If you defend an environment for a living, this one is built for you.

👉 https://ztw.com/

PowerShell + DevOps Global Summit 2027 | April 5 to 8, 2027 | Orlando, Florida The flagship US PowerShell event moves to the Sheraton Lake Buena Vista in Orlando. Call for papers opened Wednesday and runs through the summer, and early bird registration is open now. The OnRamp program for newcomers runs alongside the main track.

👉 https://powershellsummit.org/

PSConfEU 2027 | Dates and location to be announced SynEdgy is organizing the eleventh edition of PowerShell Conference Europe after this year’s tenth anniversary run in Wiesbaden. Watch psconf.eu for the announcement, which typically lands toward the end of summer.

👉 https://psconf.eu/

Fellow PowerShell MVP Jorge Suarez of IntuneHydrationKit fame shipped Tenant Graph, a free open source web app that renders Intune and Entra ID assignments as an interactive Three.js topology. Sign in with Microsoft Entra to search across users, devices, groups, apps, policies, and Conditional Access, with a Readable Mode that explains relationships in plain language and an admin impact panel for blast radius. The sample tenant at tenantgraph.com lands you in a Lumon themed demo with no auth required, so you can poke around before granting delegated Graph scopes against production.
👉https://github.com/jorgeasaurus/TenantGraph

Three big demos from the June PowerShell Community Call

Jason Helmick called the June PowerShell Community Call the summer edition, and what showed up was about as loaded a single hour as the call has run in a while. The PSConfEU recap took a few minutes. The servicing updates and a real warning about Azure AD Graph traffic took a few more. The Az PowerShell team showed off a login flow improvement that quietly fixes a problem every enterprise administrator has hit. And then three demos landed back to back to back, each of which would have been a headline in any other month. If you only have time to watch one segment of the recording, watch the demos. If you have time for the whole thing, the housekeeping is genuinely worth it this time.

Microsoft Ships DSC 3.3.0-preview.3 with New Windows Resources and Server Mode

Steve Lee dropped DSC 3.3.0-preview.3 on Wednesday with a handful of changes worth your attention. The build adds a Microsoft.Windows/WindowsFeatureList resource from Gijs Reijn for managing optional Windows features through DSC, plus a new Registry Adapter and Microsoft.Windows/Personalization resource that lets you target the registry for personalization configuration without writing a custom resource. Steve also renamed the previous MCP mode to Server mode, which is a cleaner name now that the protocol has settled into the broader tooling ecosystem. PSAdapter got two notable fixes from Steve, one for stream event tracing and one for modules with ScriptsToProcess that used to break. If you are testing DSC v3 in production, this is the preview to pull this weekend.

👉https://github.com/PowerShell/DSC/releases/tag/v3.3.0-preview.3

Andrew Pla and Leo D’Arcy Make the Case for Code Signing in CI/CD

My good friend Andrew Pla sat down with UK based cloud solutions architect Leo D’Arcy on The PowerShell Podcast for a candid conversation on Active Directory Certificate Services, code signing, and why so many organizations get PKI spectacularly wrong. The practical takeaway is the argument for adding a code signing step to your CI/CD pipeline as a scalable alternative to constrained language mode, which gives you cryptographic proof that scripts have not been tampered with without giving up flexibility. Leo runs the Remote Access User Group community on Discord and is a repeat PSConfEU speaker, so the conversation also ranges into the developer mindset taking over IT and why being able to talk networking with network engineers and business outcomes with leadership is the real career multiplier.

Automating Microsoft 365 with PowerShell 3rd Edition Ships

Tony Redmond and the Office 365 for IT Pros team published the third edition of Automating Microsoft 365 with PowerShell on Tuesday. The new edition runs 431 pages across eight chapters and is available now in EPUB and PDF from Gumroad, with the paperback landing on Amazon July 1. Coverage spans the base Microsoft 365 workloads, the Graph PowerShell SDK, Entra ID administration, workload automation, and the management APIs for sign in logs and audit data. The book comes bundled with the Microsoft 365 for IT Pros 2027 edition that also drops July 1, and current subscribers have already received the renewal code. If you write PowerShell for Microsoft 365 every day, this is the one to have on your desk.

👉 https://office365itpros.com/2026/06/23/automating-microsoft-365-3rd/

Microsoft Graph SDK V2.38 and Exchange Online Module Refuse to Get Along

Tony Redmond writes that the newest Microsoft Graph PowerShell SDK at V2.38 and the latest Exchange Online Management module are not playing nicely together, and the situation is getting worse rather than better. Loading both into the same session leads to assembly version conflicts that break authentication or cmdlet behavior in ways that are not always obvious until your script halts mid run. Tony goes through the workarounds, including running the two modules in separate sessions, and uses the post to highlight two cmdlets he discovered along the way that most administrators have probably never used. Worth a read before you trust a hybrid script in production.

👉 https://office365itpros.com/2026/06/22/powershell-woes-and-cmdlets/

Find Inactive Teams Channels with Graph PowerShell

Tenants accumulate inactive Teams channels the same way garages accumulate cardboard. Tony Redmond walks through a PowerShell approach for finding channels that nobody has touched in months using the Microsoft Graph PowerShell SDK. The script pulls channel metadata, checks the last activity date, and gives you a sorted list of candidates to either archive or remove. What you do with the output is your call, but having a defensible list before the next governance review is a good start. Pair this with Tony’s deleted Teams chat threads piece from last week for a fuller Teams hygiene toolkit.

👉 https://office365itpros.com/2026/06/24/find-inactive-channels/

Andres Bohren Ships M365 Service Monitor PowerShell 1.7

Andres Bohren updated his M365 Service Monitor script to version 1.7 this week with two practical fixes worth picking up. The June 17 patch fixed the modern HTML rendering for Outlook classic, which was breaking the dashboard for anyone still on the legacy client. The June 14 patch fixed path issues that tripped scheduled runs and added the date to the HTML output so you can see at a glance when the report last ran. The script polls the Service Communications API and produces a clean status dashboard you can drop into a SharePoint page or email out on a schedule. The GitHub repo has the full update notes and the latest module.

👉 https://blog.icewolf.ch/archive/2026/06/24/basic-M365-monitoring-with-powershell-1-7/

What Do You Really Get with Intune Suite in E3 and E5

Andrew Taylor wrote the Intune Suite breakdown you want to read before July 1. Starting next Wednesday, Intune Suite features fold into Microsoft 365 E3 and E5 instead of requiring a separate add on, and Andrew walks through what each component does and how much of it you will actually use. He covers Endpoint Privilege Management, Remote Help with unattended access, Advanced Analytics with Device Query and Multi Device Query, Microsoft Tunnel for mobile app access to on premise resources, and Cloud PKI. If you have been paying for the Intune Suite add on separately, you may be about to free up budget. If you have not, you may be about to get capabilities you did not know you had.

👉 https://andrewstaylor.com/2026/06/24/what-do-i-really-get-with-intune-suite/

Events

Midwest Tech Talk 2026 | July 19 to 21, 2026 | Lake of the Ozarks, Missouri I am speaking at this one. Kickoff event Sunday July 19, main conference Monday and Tuesday at The Resort at Lake of the Ozarks, with an evening event Monday hosted by Provision Data Solutions. Two day K12 technology and security symposium built by folks who actually run school district tech departments, doubling as the K12TechPro Regional Meetup for the Midwest. If you are in K12 IT anywhere in the region, this is the one to make this summer.

https://www.midwesttechtalk.com/

MMS Midway | October 25 to 28, 2026 | San Diego, California The classic endpoint management and PowerShell conference moves to San Diego this fall. Strong K12 IT representation if you are looking for peers in that space.

https://mmsmoa.com/

Zero Trust World 2027 | February 17 to 19, 2027 | Orlando, Florida ThreatLocker’s seventh annual cybersecurity training event lands in Orlando. Three days of hands on training, real attack technique walkthroughs, hacking labs, and Cyber Hero Certification exam sessions every morning. It was a blast this year - I’d recommend you check it out. It’s not very expensive.

https://ztw.com/

PowerShell + DevOps Global Summit 2027 | April 26 to 29, 2027 | Bellevue, Washington The flagship US PowerShell event. Registration tends to fill early, and the call for speakers usually opens in late summer if you are thinking about submitting.

https://powershellsummit.org/

PSConfEU 2027 | Dates and location to be announced SynEdgy is organizing the eleventh edition of PowerShell Conference Europe after this year’s tenth anniversary run in Wiesbaden. Watch psconf.eu for the announcement, which typically lands toward the end of summer.

https://psconf.eu/

Install-Module PSGuerrilla

Then, you can now launch the GUI with

Show-Guerrilla

And get a nice fancy report like this one, though hopefully not this failed :)

Videos, Videos, Videos!!!

The PowerShell Global DevOps Summit videos are now LIVE! They began dropping videos earlier this week. Here is the entire playlist.

The Same for PSConfEU! Everything is live on here on this playlist:

How Much Will July 2026 License Increases Cost Your Tenant

July 1, 2026, is the day Microsoft starts charging tenants more for nearly every license in the M365 catalog. Tony Redmond serves up a PowerShell script that retrieves the licenses assigned across your users, applies the published increase rates for each affected product, and returns the real monthly impact for your tenant. The increase rates vary by SKU and the script handles the variation cleanly. If you have not already had this conversation with your finance team, this is the read for this weekend. Pair it with last week’s piece on stale accounts and you have a complete pre July audit kit.

https://office365itpros.com/2026/06/16/monthly-license-increase-july-2026/

PowerShell 7.6.3 Released as Current LTS

Microsoft shipped PowerShell 7.6.3 on Tuesday and Andres Bohren has the install walkthrough on his blog. The build sits on the .NET 10.0.9 runtime, and the headline shift for Mac shops is that the macOS PKG package is now notarized and signed by Microsoft, closing a long standing gap for production deployments on Apple silicon. 7.6.3 is the current LTS, while the previous LTS at 7.4.17 still has support through November 10, 2026, so the upgrade can be planned rather than scrambled. Worth dropping into your test ring this weekend.

https://blog.icewolf.ch/archive/2026/06/16/powershell-7-6-3-released/

Microsoft.Graph PowerShell SDK 2.38.0 Ships

Same Tuesday, Microsoft also pushed version 2.38.0 of both the Microsoft.Graph and Microsoft.Graph.Beta modules to the PowerShell Gallery. Andres notes that Microsoft did not publish release notes for this one, but the comparing changes view on GitHub fills the gap if you want to know exactly what shifted between 2.37 and 2.38. Andres continues to install through PSResourceGet with the Microsoft Artifact Registry rather than the older PowerShellGet workflow, which mirrors where Microsoft is steering everyone for first party module installation. If you have not switched over yet, this is the release to do it on. https://blog.icewolf.ch/archive/2026/06/16/microsoft-graph-powershell-modules-2-38-0-released/

Microsoft Tightens Self Service Password Reset in September

Tony Redmond writes that Microsoft is closing a soft spot in Self Service Password Reset starting September 6, 2026. Today, SSPR can fall back on directory attributes to verify a user, which is a risk because those attributes can be modified by an attacker who has already compromised an account. The new behavior requires every user to register at least one authentication method through their Security Info page, and SSPR verifies identity only through that registered method. Microsoft kicks off a registration campaign on July 6 to push users and administrators to register before enforcement. Get your registration reporting in place now so the campaign does not surprise you.

https://office365itpros.com/2026/06/17/sspr-authentication-methods/

Removing Problematic Teams Chat Threads with Graph PowerShell

Sometimes a user posts something to Teams that has to come down, and the standard admin experience does not make that easy. Tony Redmond walks through the Microsoft Graph PowerShell SDK cmdlets to find chat threads, scan thread messages for the targeted content, and remove the offending threads. The script can run interactively for one off cleanup, or get wrapped into a tenant maintenance routine if this is something you handle regularly. If you have ever scrambled to pull a bad chat thread out of Teams in the middle of an incident, this one is worth a bookmark. https://office365itpros.com/2026/06/15/delete-teams-chat-threads/

Andres Bohren Marks 3000 Blog Posts

Andres Bohren hit a milestone this week with his 3000th blog post, written 19 years after his first post in November 2007. He calculated the average using New TimeSpan in PowerShell, naturally, and worked out that he has published a blog post roughly every other day for almost two decades. The archive spans Exchange, Outlook, ESX, SQL, Active Directory, and of course PowerShell, and the consistency is what got him recognized as a Microsoft MVP. If you want a single example of what consistent community contribution looks like over a career, his archive is the model.

https://blog.icewolf.ch/archive/2026/06/18/celebrating-3000-blog-articles/

PowerShell Universal, Community, and the Magic of Showing Up with Adriano Carollo

My good friend Andrew Pla and Berlin sysadmin Adriano Carollo on city swings then over dinner at PSConfEU 2026. Adriano covers how PowerShell Universal pulled him into web app territory through React and JavaScript, why he built an open source personal assistant in PowerShell, and what it took to pay his own way to the conference after Andrew's podcast convinced him to show up. Andrew shares his own origin story for the first time on the show.

Microsoft Artifact Registry Hits Its Stride with the 2.38 Release

The Microsoft.Graph 2.38 release this week is another data point in the steady migration that Microsoft is running to shift first party PowerShell modules from the community PowerShell Gallery to the Microsoft Artifact Registry. Andres Bohren installs every Microsoft module through MAR using PSResourceGet, and his M365PSProfile module wraps the workflow if you want a turnkey way to keep your tenant tools current. The pitch is straightforward. MAR is a Microsoft controlled feed with stronger provenance and ownership guarantees than the community gallery, which has had its share of compromised module incidents. If your environment still pulls Microsoft modules from PSGallery by default, this is the year to swap.

https://blog.icewolf.ch/archive/2026/06/16/microsoft-graph-powershell-modules-2-38-0-released/

Events

Midwest Tech Talk 2026 | July 19 to 21, 2026 | Lake of the Ozarks, Missouri I am speaking at this one. Kickoff event Sunday July 19, main conference Monday and Tuesday at The Resort at Lake of the Ozarks, with an evening event Monday hosted by Provision Data Solutions. Two day K12 technology and security symposium built by folks who actually run school district tech departments, doubling as the K12TechPro Regional Meetup for the Midwest. If you are in K12 IT anywhere in the region, this is the one to make this summer.

https://www.midwesttechtalk.com/

MMS Midway | October 25 to 28, 2026 | San Diego, California The classic endpoint management and PowerShell conference moves to San Diego this fall. Strong K12 IT representation if you are looking for peers in that space.

https://mmsmoa.com/

Zero Trust World 2027 | February 17 to 19, 2027 | Orlando, Florida ThreatLocker’s seventh annual cybersecurity training event lands in Orlando. Three days of hands on training, real attack technique walkthroughs, hacking labs, and Cyber Hero Certification exam sessions every morning. It was a blast this year - I’d recommend you check it out. It’s not very expensive.

https://ztw.com/

PowerShell + DevOps Global Summit 2027 | April 26 to 29, 2027 | Bellevue, Washington The flagship US PowerShell event. Registration tends to fill early, and the call for speakers usually opens in late summer if you are thinking about submitting.

https://powershellsummit.org/

PSConfEU 2027 | Dates and location to be announced SynEdgy is organizing the eleventh edition of PowerShell Conference Europe after this year’s tenth anniversary run in Wiesbaden. Watch psconf.eu for the announcement, which typically lands toward the end of summer.

https://psconf.eu/

Mastering PowerShell Parameters with Jeff Hicks at PowerShell + DevOps Global Summit 2026

Jeff Hicks delivered a session packed with demos on advanced parameter design at this year’s PowerShell + DevOps Global Summit in Bellevue, and Confreaks has the recording up on YouTube. He walks through advanced validation methods, leveraging types for greater efficiency, dynamic parameters, experimental features, and the techniques introduced in PowerShell 7 that make your function parameters do real work. If you write functions you ship to other people, this is the kind of session worth a weekend hour.

Microsoft to Delete Unlicensed OneDrive for Business Accounts

Tony Redmond at Office 365 for IT Pros wrote up Microsoft’s decision to start deleting unlicensed OneDrive for Business accounts that have not been paid to be archived, with the change taking effect after July 2026. Up until now those accounts could linger in Microsoft 365 Archive until retention policies and holds expired, but going forward tenants will have to decide which accounts to keep and pay for, and the rest will be removed regardless of retention or eDiscovery holds. This is a meaningful policy shift that anyone with messy offboarding hygiene needs to read before next month rolls around.

https://office365itpros.com/2026/06/12/unlicensed-onedrive-for-business-2/

Cookie Monsters and Defender Live Response with Miriam Wiesner on The PowerShell Podcast

My good friend, Andrew Pla, sat down with Miriam Wiesner at PSConfEU 2026 in Wiesbaden for a wide ranging conversation on cookie theft attacks, Defender live response, and the state of PowerShell security. Miriam, a security research PM at Microsoft working on Defender and Sentinel research, walked through her Return of the Cookie Monsters session where she demonstrated extracting Teams cookies to hijack chats, SharePoint sites, and OneDrive content from a single compromised endpoint. She also recapped the live response session she delivered with Stefan Fanulik on using Defender to investigate and remediate compromised devices without enabling RDP or PowerShell remoting. The conversation closes with a frank discussion of why PowerShell security features make life harder for sophisticated threat actors and why visibility through script block logging matters more than ever.

Adam Driscoll Recaps PSConfEU 2026 and Demos PowerShell Universal AI Tooling

Adam Driscoll posted his PSConfEU 2026 recap over at the Devolutions blog, sharing both the personal experience and the technical headline from his two sessions at the conference. The news from his sessions is PowerShell Universal 2026.2 with new AI tooling focused on MCP tools and agents, where Adam demonstrated building modules, APIs, and web apps using GitHub Copilot connected directly to a PowerShell Universal instance and generating real solutions from simple prompts. Devolutions stepped up as the key sponsor of the conference this year, and the recap is worth a read if you want to understand what has shipped in PowerShell Universal since the acquisition.

https://devolutions.net/blog/psconfeu-celebrating-ten-years-of-powershell-community/

Setting Up Least Privileged MS Graph on PowerShell Wednesday with Morten Mynster and Jake Hildreth

Andrew Pla hosted Morten Mynster and Jake Hildreth on PowerShell Wednesday this week for a walkthrough of the prerequisites to use Morten’s Least Privileged MS Graph module, the open source tool Morten built for auditing and reducing permission exposure across Microsoft Graph applications. Jake plays the friendly guinea pig live on his own tenant while Morten walks him through creating the Azure resource group, log analytics workspace, diagnostic settings for Microsoft Graph Activity Logs, the app registration, and the right API permissions. The session ran as part one of two, with next week’s installment digging into what the module actually reports once the logs roll in.

Tony Redmond Primers Sensitivity Labels with PowerShell

Tony Redmond put together a primer on the three different cmdlets available for fetching sensitivity labels with PowerShell, one in the Exchange Online module and two powered by Graph APIs. The differences come down to scope, properties returned, and whether you get the full set of available labels or just a slice. Worth bookmarking if you have ever stared at the output of one of these cmdlets and wondered why it does not match what you see in the Purview admin center.

https://office365itpros.com/2026/06/11/sensitivity-label-ps/

PowerToys v0.100.0 Released

Andres Bohren over at Icewolf marked the release of PowerToys v0.100.0, the round number milestone version of Microsoft’s open source utility suite for Windows power users. Andres includes his usual install walkthrough using winget along with notes on where to find the release artifacts on GitHub. If PowerToys has earned a spot on your daily driver, this is the version to install this weekend.

https://blog.icewolf.ch/archive/2026/06/11/powertoys-v0-100-0-released/

ExchangeOnlineManagement PowerShell Module 3.10.0 Released

Andres Bohren also covered Microsoft pushing version 3.10.0 of the ExchangeOnlineManagement PowerShell module to the gallery. The headline change is that the minimum required version of PowerShell 7 is now 7.6, while Windows PowerShell 5.1 remains unaffected. The release also fixes an issue where certificate authentication failed in Connect-IPPSSession when using the EnableSearchOnlySession switch, which is worth knowing if you script against Exchange Online in production.

https://blog.icewolf.ch/archive/2026/06/10/exchangeonlinemanagement-3-10-0-released/

PDQ Breaks Down June 2026 Patch Tuesday

The PDQ team is back with their monthly Patch Tuesday recap, and June is one of the larger releases in recent memory. Microsoft published patches for roughly 200 vulnerabilities including three actively exploited zero days, with critical remote code execution issues in core Windows infrastructure components and elevation of privilege bugs across the stack. If you handle patching for your fleet, this is your reading material before you start deploying.

https://www.pdq.com/blog/patch-tuesday-june-2026/

Tony Redmond on Finding Inactive User Accounts

Tony Redmond covers how to find inactive user accounts in Microsoft 365 tenants, with extra urgency given the Microsoft 365 license price increases coming into effect on July 1, 2026. He walks through two approaches: the Microsoft 365 Licensing Report for a quick view, and a PowerShell script that assesses inactivity based on sign in dates and refresh token baselines for more nuanced results. The point is that inactive accounts soak up licenses that suddenly cost more, and there has never been a better time to clean house.

https://office365itpros.com/2026/06/09/find-inactive-accounts/

Exchange Server SE Cumulative Update SU7 Available

Andres Bohren ran through Microsoft’s release of the SU7 update for Exchange Server Subscription Edition, including the post installation reboot requirement and his usual reminder to check for pending reboots before kicking off the installer. The KB number is 5094139 and the security update is available for direct download from Microsoft. For shops still running Exchange on premise or in a hybrid configuration, this is on the list of things to schedule for the next maintenance window.

https://blog.icewolf.ch/archive/2026/06/09/exchange-server-SE-SU7-has-been-released/

Andres Bohren Checks Azure VM Extension Versions

Andres Bohren circled back to his earlier Icewolf article on activating VM Automatic Extension Upgrade and added some practical guidance on checking the current extension version on running Azure VMs. The walkthrough uses PowerShell to inspect what version is deployed and confirms whether the automatic upgrade has run. Useful if you manage a fleet of Azure VMs and want to make sure they are not falling behind on agent and extension updates.

https://blog.icewolf.ch/archive/2026/06/08/check-azure-vm-extension-version/

Andrew Taylor’s Intune Newsletter Lands from Experts Live UK

Andrew Taylor published this week’s Intune Newsletter live from Experts Live UK in London, with content put together between trains, hotel rooms, and conference rooms. Highlights include a guide from Andrei Shchetkin on converting any Azure VM into a Windows 365 image using only Graph commands, and a script from T-Bone on modern drive and printer mapping for cloud native Windows with Intune and PowerShell. The full newsletter is worth your time if you manage endpoints.

https://andrewstaylor.com/2026/06/12/intune-newsletter-12th-june-2026/

PSConfEU Session Recordings

PSConfEU session recordings are starting to land on the SynEdgy YouTube channel following the conference wrap in Wiesbaden, and the 2026 lineup includes deep technical sessions from Steven Bucher on the state of the shell, Thorsten Butz on AI in PowerShell workflows, and Adam Driscoll on what is new in PowerShell Universal 2026.2. Sessions get uploaded over the coming weeks, so subscribing keeps you current.

Slides, scripts, and session materials from PSConfEU 2026 are collected at the conference GitHub repository, where speakers continue to drop their decks and demo code through June. This is the companion resource to the YouTube recordings.

https://github.com/psconfeu/2026

Upcoming Events

Experts Live UK wraps up today in London after two full days of sessions across Microsoft 365, Azure, AI, security, and the modern workplace. Recordings and recap content typically land in the weeks following the event from attendees and speakers, so keep an eye on the schedule page and social posts from the Intune and SCCM crowd.

https://eluk26.expertslive.co.uk/

The PowerShell + DevOps Global Summit returns to Bellevue, Washington in April 2027, the premier community event hosted by The DevOps Collective. Early bird registration usually opens late summer, so worth bookmarking now if you are planning ahead.

https://powershellsummit.org/

Looking further out, MMS Midway Edition heads to San Diego October 25 through 28, the smaller West Coast sibling of the main Midwest Management Summit.

https://mmsmoa.com/

Build returned outside Seattle for the first time since 2016, with Satya Nadella opening at Fort Mason on Tuesday morning to about 2,500 developers in the room. The framing this year was AI agents finally maturing from demo to deployment, and the announcement list reflects that shift. GitHub Copilot now has a native desktop app with agentic workflows in preview, Project Rayfin offers a managed backend on Microsoft Fabric using workflows defined in GitHub, the Surface RTX Spark Dev Box puts one petaflop of compute and 128 gigabytes of unified memory on a developer’s desk for running 120 billion parameter models locally, and Microsoft introduced seven new MAI models including MAI-Thinking-1 for reasoning and MAI-Code-1 tuned for GitHub and VS Code. Foundry Local reached general availability, Azure AI Foundry can now route across models per task, Agent 365 expanded its enterprise governance footprint, and GPT-5.5 arrived with Tier 5 and 6 quota. A lot to digest.

https://build.microsoft.com/

PowerShell Conference Europe 2026 Wraps Up in Wiesbaden

The tenth edition of PSConfEU ran June 1 through June 4 at the Dorint Pallas Hotel in Wiesbaden, drawing more than 300 attendees, around 40 speakers, and roughly 70 sessions across four packed days. SynEdgy pulled off another solid year with deep technical content from the usual heavyweights, the return of PoshaKucha at twenty slides by twenty seconds each, and the Monday bike tour winding 30 kilometers along the Rhine to Eltville. Steven Bucher delivered three sessions including State of the Shell, Thorsten Butz took the stage with another fresh AI talk, and the broader Devolutions team showcased work on PowerShell Universal that included the first public demo of their AI integration since acquiring the platform. Ten years in, the community still feels like the heart of why this event matters.

https://psconf.eu/

Argument Completers, Dynamic Parameters, and More from Ben Reader at PSConfEU 2026

Ben Reader, the pipeline daddy at Patch My PC, walked through how to build better PowerShell functions in his PSConfEU 2026 session, framed around a database access problem that he kept needing to extend across four revisions of the same script. He starts with the basics that most of us already use like validate set, validate range, and validate pattern, then moves into the more advanced ground of custom validate classes, registered argument completers, inline completers, dynamic parameters, and finally his preferred approach of building completers as their own .NET classes that the function parameter references through a clean attribute. The walkthrough is the kind of thing you can drop right into your next module, and the recording landed alongside the rest of the PSConfEU 2026 sessions this week.

Devolutions Brings AI to PowerShell Universal at PSConfEU

Adam Driscoll took the stage at PSConfEU to walk through what has shipped in PowerShell Universal since the Devolutions acquisition, and the headline was the first public demonstration of AI capabilities integrated into the platform. Marc-André Moreau followed with a separate session on implementing PSRemoting at Devolutions covering PowerShell SDK limitations, WinRM quirks, TrustedHosts behavior, and the practical realities of NTLM and Kerberos authentication in production software. The booth ran live demos throughout the conference, and if you missed Adam’s session in person it should land in the public recording archive in the coming weeks.

https://devolutions.net/blog/devolutions-at-psconf-eu-2026-unveiling-ai-in-powershell-universal-in-wiesbaden/

Foundry Local Reaches General Availability at Build

Among the busy slate of Build announcements, Foundry Local stepping into general availability stood out for anyone running model inference closer to the user. The runtime now ships as a supported product rather than a preview, and pairs naturally with the new Surface RTX Spark Dev Box for developers who want to actually run models that previously had to live in the cloud. Together with the seven new MAI models and Azure AI Foundry’s new ability to route across models, the story Microsoft is telling is one of choice across local and cloud and across providers, which is a welcome shift.

https://www.tomsguide.com/news/live/microsoft-build-2026

Tony Redmond on Container Management Labels for Security Groups

Tony Redmond walks through Microsoft’s new preview that brings container management labels to Entra ID security groups. The scope is currently narrow with just one control available, the AllowToAddGuests setting that determines whether guest accounts can be members. Tony makes the case that even this single lever is meaningful because guest access to sensitive security groups has long been a quiet risk that nobody had a clean way to prevent.

https://office365itpros.com/2026/06/03/security-groups-labels/

Tracking Distribution List Changes with PowerShell

A reader question about reporting distribution list changes prompted Tony Redmond to walk through how to do it properly given that distribution lists are Exchange Online objects rather than Entra ID groups. The same general PowerShell structure used for Microsoft 365 group change reporting applies, but the audit records and the actual code look quite different. Worth a read if you have ever opened a ticket asking who removed a manager from a critical list.

https://office365itpros.com/2026/06/02/distribution-list-changes/

MicrosoftPlaces PowerShell Module Hits 2.1.9

Andres Bohren posted at Icewolf about Microsoft pushing version 2.1.9 of the MicrosoftPlaces PowerShell module to the gallery. The release notes are thin since 2.1.8, but the headline is that the Object reference not set to an instance of an Object error that plagued 2.1.7 and 2.1.8 has been fixed. If you skipped the last two releases for that reason, this is the version to install.

https://blog.icewolf.ch/archive/2026/06/02/microsoftplaces-powershell-module-2-1-9-has-been-released/

What’s New in Microsoft Entra June 2026

The Entra team published their June roundup with a handful of items that admins will want to track. Passkey policies now get their own dedicated 20 kilobyte allocation in the authentication methods policy rather than sharing a single bucket with everything else, and the maximum number of passkey profiles per tenant goes from three to ten. There is also a reminder that the MFA enforcement for passwordless credential registration completes rollout by July 13, 2026, so if you have not finished your conditional access work for that, the clock is real.

https://techcommunity.microsoft.com/blog/microsoft-entra-blog/whats-new-in-microsoft-entra-june-2026/4517885

Handling Loop Workspaces for Departed Users

Tony Redmond covers Microsoft finally rolling out a workflow to deal with personal Loop workspaces left behind when employees leave a tenant. The process is unfortunately manual with limited automation possible, but at least the framework now exists to review and preserve workspace content rather than losing it. Two years from announcement to rollout is not fast, but it is finally here.

https://office365itpros.com/2026/06/04/user-owned-loop-workspaces/

Office 365 for IT Pros June 2026 Update and 2027 Plans

The 132nd monthly update for the Office 365 for IT Pros eBook is now available for subscribers, and Tony Redmond used the post to share what is coming for the 2027 edition. The book is being renamed, a new chapter on Copilot and agents is being added, and two topics are being split out into their own books covering Microsoft Purview and the Power Platform. If you have been wondering when the ecosystem would finally outgrow a single volume, the answer is now.

https://office365itpros.com/2026/06/01/office-365-for-it-pros-132/

Upcoming Events

Experts Live UK (formerly Workplace Ninjas UK, rebranded for 2026) June 11-12, 2026 at CodeNode, London. That’s next week, not late summer.

https://eluk26.expertslive.co.uk/

MMS Midway Edition 2026 October 25-28, 2026 in San Diego. That’s fall, not late summer.

https://mmsmoa.com/

https://patchmypc.com/events/mms-2026-midway-edition/

Microsoft shipped PowerShell 7.7.0-preview.2 this week, and Tony Schultz over at the Icewolf blog flagged the change that matters most for anyone managing PowerShell on Windows at scale. Starting with 7.7-preview, there is no more MSI installer. The MSIX package becomes the primary install method on Windows, MSI continues for 7.6 but not future releases. Tony walks through running the new preview without and with the M365PSProfile module from his download of the ZIP. If you push PowerShell with Intune, ConfigMgr, or your own deployment plumbing, your packaging for 7.7 and beyond needs a rethink before this hits stable.

https://blog.icewolf.ch/archive/2026/05/28/powershell-v7-7-0-preview2-has-been-released/

Built In PowerShell Parameters You Should Be Using with Lucas Allman

Andrew Pla hosted Lucas Allman for a PowerShell Wednesday on the common parameters baked into every advanced function and cmdlet. Lucas walks through what an advanced function actually is, how CmdletBinding or a decorated parameter unlocks the full set, and why the six output streams exist as separate channels for success, error, warning, verbose, debug, and information. He also covers the action parameters and preference variables that change how your code reacts to traffic on those streams, including capturing stream output to a variable using InformationVariable. Part one of two. Lucas comes back next week for the more interesting ones including WhatIf and Confirm.

Microsoft Entra Tenant Governance: Find Configuration Drift

Microsoft Mechanics published a deep walkthrough this week on capturing your tenant configuration as code across more than 200 resource types spanning Entra, Intune, Exchange Online, Teams, Defender, and Purview, then turning that snapshot into an ongoing drift monitor. If you have ever wished you could diff your tenant the way you diff source control, this is exactly that workflow. The angle that should land hardest for our crowd is treating configuration as a versioned artifact, which finally gives PowerShell-driven environments a story for change management that does not depend on screenshots and prayer.

https://techcommunity.microsoft.com/blog/microsoftmechanicsblog/microsoft-entra-tenant-governance--find-configuration-drift/4523358

Useful PowerShell Scripts for Windows Admin Tasks

Andrew Pla at PDQ dropped a ten-script toolkit this week aimed at the practical endpoint questions you actually field every day, like which critical errors showed up in event logs, which scheduled tasks look suspicious, are certificates valid, is BitLocker enabled, what shape are the batteries in, what is mapped where, what browser and VS Code extensions are installed, do my config baselines hold, is Defender healthy, and is Secure Boot ready for the UEFI 2023 certificate changes. The scheduled task auditor is the standout for me. It flags hidden tasks, encoded commands, execution policy bypasses, user writable paths, web downloads, and known LOLBins in one pass. Worth lifting straight into your PowerShell Scanner library.

https://www.pdq.com/blog/useful-powershell-scripts-for-windows-admin-tasks/

Jeff Hicks Ships PSIntro, a Welcome Screen and Tutorial Set for PowerShell Beginners

Jeff Hicks built PSIntro, an educational module that grew out of conversations with Jason Helmick about giving brand new users a friendlier front door into PowerShell. It puts a splash style welcome screen in front of beginners when they start a session, complete with clickable links in Windows Terminal, and it ships a set of short interactive tutorials on core concepts like Get-Command, with live output pulled from the user’s own session so the lesson matches their real environment. There are also helper commands for the things beginners stumble on early, like checking whether key modules need updating with Get-ModuleStatus, reporting on where profile scripts live, and creating one with New-PSProfile. It runs on both Windows PowerShell and PowerShell 7 across Windows, Linux, and macOS, and it is localized for English, French, and German. If you mentor anyone just getting started, or you run a user group with newcomers, this is a thoughtful thing to point them at.

https://github.com/jdhitsolutions/PSIntro

Automate Platform SSO Setup During macOS Enrollment

Cindy Crane on the Microsoft Entra Blog has a nice walkthrough this week on automating Platform SSO setup as part of macOS enrollment in Intune. The shape of the win is the usual modern endpoint story, less user friction during onboarding and fewer of those tickets that are really just a confused first sign in. If you are pulling Mac users into a Microsoft first stack, this is the cleanest path to a single sign in experience that I have seen documented end to end.

https://techcommunity.microsoft.com/category/microsoft-entra/blog/microsoft-entra-blog

Harm Veenstra on the PSBoundParameters vs IsPresent Question

Harm Veenstra dropped a fresh post this morning that started from a conversation with a colleague over which approach is right for checking whether a switch or parameter was actually used in a script or function. He breaks down what each does, PSBoundParameters being the automatic hashtable that fills in with whatever parameter names and values were passed on the command line, IsPresent being the simpler true or false check on a switch. The walkthrough uses his own Update-Modules function as the example and shows the same Install-PSResource call written both ways so you can see them next to each other. The honest answer to which is better is the IT classic of it depends, but Harm makes the practical case for IsPresent on plain switch logic and PSBoundParameters when you want the full picture of what the caller actually specified, with the caveat that defaults set inline never show up in the hashtable. He also signed off with a tease that next week’s post will be his PSConfEU recap.

https://powershellisfun.com/2026/05/29/using-psboundparameters-or-ispresent-when-checking-powershell-switch-or-parameters-usage/

Daniel Bradley Publishes 1,400 Plus Microsoft Architecture Icons at msicons.com

Daniel Bradley collated more than 1,400 Microsoft architecture icons and put them all in one easy to search spot at msicons.com. For every icon you can grab the scalable SVG, pull a PNG at whatever size you need, or embed it straight into a website or markdown file, and you can flip between light, dark, and transparent backgrounds depending on where it is headed. There is a compare view for putting icons side by side and a favoriting feature so you can bulk download a whole set at once. I am flagging this one specifically because if you build visual PowerShell apps with something like WPF, WinForms, or a web front end, having a consistent and official looking icon set on hand makes a real difference for style consistency, and this is the cleanest place I have seen to pull them.

https://msicons.com/

Solving Problems at the Root with Mark Littlefield. The PowerShell Podcast E230

Sending a Welcome Message to New Employees Part 2

Tony Redmond is back with a follow up to his welcome email project, and this one is the PowerShell heavy half. Instead of attaching ICS files, this version uses Get-MgUserCalendarView and Update-MgUserEvent in the Microsoft Graph PowerShell SDK to find existing corporate calendar events, then quietly add new employees to the participant list so the meetings land on their calendars automatically. It is a cleaner pattern than building ICS bytes by hand, and the code is small enough to drop into an existing onboarding runbook without much surgery.

https://office365itpros.com/2026/05/27/new-employee-email2/

Reporting Usage Patterns for Room Mailboxes

Also from Tony this week, a practical look at finding out whether your room mailboxes are actually being used. The article weighs two paths, the classic Exchange Online PowerShell module versus the newer Graph Places API, and is honest about the permissions and ongoing run mechanics each one demands. The right answer probably depends on what else lives in your reporting pipeline, but the side-by-side here is exactly the comparison you want before you commit to one approach for a recurring report.

https://office365itpros.com/2026/05/26/room-mailboxes-usage/

What’s New in Microsoft Intune, May 2026

Scott Sawyer’s monthly Intune roundup updated this week with the May changes worth knowing, focused on Android, macOS, and certificate management refinements across the service. It is the post I always tell our team to read first when they want to know what changed without grinding through the message center one card at a time. If you are responsible for the Intune side of an environment, this is the cheapest five minutes you will spend on staying current.

https://techcommunity.microsoft.com/blog/microsoftintuneblog/what%E2%80%99s-new-in-microsoft-intune-%E2%80%93-may/4491984

Midwest Management Summit 2026

Kevin Levart shared his recap of MMS, and if you have somehow never made it, this is one of the most respected systems and endpoint management conferences in the country. The Mall of America edition wrapped up earlier this month in Bloomington, Minnesota, with the deep ConfigMgr, Intune, Azure, and PowerShell sessions it is known for, the attendance cap that keeps it small and personal, and the community energy regulars will not stop talking about. If you missed this one, the second 2026 edition heads to the Manchester Grand Hyatt in San Diego later in the year, so there is still a chance to get your MMS fix in 2026.

https://www.linkedin.com/pulse/midwest-management-summit-2026-kevin-levart-yq36c/

I Let Claude Take FULL Control of a Fresh Windows 11 PC (Debloat + Setup)

Memory gave Claude Code one prompt to set up a fresh Windows 11 install and let it run the PowerShell commands itself to remove bloat, install his apps, and lock down privacy in a VM. Cool watch and interesting concept; honestly the future of some development and testing.

Events

Microsoft Build 2026

Microsoft’s flagship developer conference runs June 2 to 3 this year, moving to San Francisco and online after its long run in Seattle. The focus is squarely on building and scaling AI, with the product teams going deep on real code and real systems. If you cannot make the trip, the online option is free and worth blocking off given how much of the year’s Azure, Microsoft 365, and developer tooling news tends to land at Build.

https://build.microsoft.com/

PowerShell Conference Europe 2026

The big one is just around the corner, June 1 to 4 in Wiesbaden, Germany. Heads up that ticket prices already moved to 1,950 euros as of May 11 with the event entering its final logistics phase, so if you have been sitting on the fence, the cost only climbs from here.

https://psconf.eu/

Jos Lieben spent his holiday weekend solving the two biggest things holding back wider Maester adoption, the painful installation process and the lack of visibility into remediation progress as new tests get added. DriftMaester gives you a fully automatic install that runs entirely in your own tenant using a single Azure automation account and a single storage account that the installer creates for you. It uses managed identity for all access so there are no secrets to rotate or expose, it updates both the tests and the module automatically, and it emails you when your security score drifts. If you have wanted to run Maester but bounced off the setup, this is the on ramp.

https://github.com/jflieben/DriftMaester

PingCastle vs PSGuerrilla: A Check by Check Comparison From the Person Who Wrote One of Them

I finally wrote up the comparison people have been asking me for since I started shipping PSGuerrilla. PingCastle is excellent software and I still tell every K12 director I know to run it, so this is not a takedown. It is an honest look at where the two tools overlap on the Active Directory side and where PSGuerrilla goes deeper, things like the modern ADCS escalation paths from ESC9 through ESC16, offline NTDS password auditing against HaveIBeenPwned, logon script body parsing, NTLM relay preconditions, and the Tier Zero hygiene checks that catch service accounts with DCSync rights hiding in plain sight. I also get into why I built it under a license that lets consultants, MSSPs, and pen testers use it commercially without per domain pricing, because the asymmetric defenders working in resource constrained environments are exactly the people who get priced out of good tooling. If you run AD, run both. If you want the cloud identity audit across Entra, Intune, M365, and Google Workspace for free, that part stops being a comparison pretty quickly.

psign Brings Portable Code Signing to Every Platform

Marc-André Moreau over at Devolutions just dropped psign, and it solves a problem that has annoyed me for years. Code signing has always meant keeping a Windows box around just to run signtool.exe, but psign lets you sign from Linux, handles every file format and signing method, and works with Azure Key Vault for the actual key material. You can grab the prebuilt Rust executables from GitHub Releases or install it as a dotnet tool with a single command. The detail I love is that psign-tool.exe itself is code signed from Linux using an Azure Key Vault, which is about as good a proof of concept as you could ask for.

https://github.com/Devolutions/psign

AutoRest Deprecation Raises Questions for the Microsoft Graph PowerShell SDK

Tony Redmond flagged something in his latest automation update that belongs on the radar of anyone who depends on the Microsoft Graph PowerShell SDK. Back in February Microsoft quietly posted a deprecation and retirement notice for the AutoRest utility, which is the tool deeply embedded in the pipeline that generates the SDK from the OpenAPI documentation for the Graph APIs. Most of us, Tony included, missed the notice when it first went up. He walks through what AutoRest actually does in that generation process and what its retirement could mean for the future cadence and stability of the SDK we all build automation on top of. The new V2.37 release looks stable so far, but this is a thread worth keeping an eye on.

https://office365itpros.com/2026/05/20/automating-microsoft-365-ps24/

GPT-5.5 Instant Lands in Microsoft 365 Copilot

Microsoft brought OpenAI’s GPT-5.5 Instant into Microsoft 365 Copilot and Copilot Studio, replacing GPT-5.3 Instant as the quick response model across Word, Excel, Outlook, Teams, and the rest of the suite. The pitch is more accurate and concise answers with better image analysis and stronger performance on STEM tasks, plus less of the back and forth and follow up questions that made earlier models tedious. In Copilot Chat it shows up as GPT-5.5 Quick response in the model selector, and licensed users get priority access. For agent makers it is rolling out in Copilot Studio as GPT-5.5 Chat and is available in Foundry. Nothing in your ribbon changed, the model under the hood just got better.

https://techcommunity.microsoft.com/blog/microsoft365copilotblog/available-today-gpt-5-5-instant-in-microsoft-365-copilot/4517084

Detecting Orphaned Azure Resources at Scale with KQL and PowerShell

This is a genuinely useful walkthrough on hunting down the orphaned resources quietly draining your Azure bill, the unattached disks, the NSGs associated with nothing, the app service plans with no apps deployed, and the load balancers with no backend pools. The clever framing is that instead of asking what is being used, you ask what is not connected to anything, which turns this into one of the easier cleanup wins out there. The presenter credits Dolev Shor’s excellent orphaned resources workbook for the underlying KQL, then shows how to lift those queries into PowerShell, query Azure Resource Graph across the whole tenant, and tie every finding back to a resource owner tag so the right person gets the email about their own mess rather than you chasing it down. The payoff is a scheduled runbook in an Azure automation account that mails each owner an HTML report with clickable links straight to the resource and the specific issue flagged in red. When they ran it in their own environment they turned up enough forgotten disks to save tens of thousands of dollars a year.

Block Microsoft 365 Apps Using Conditional Access, and How to Script It

Prajwal Desai has a clean walkthrough of building a Conditional Access policy in Entra to block Microsoft 365 apps on unmanaged or BYOD devices, complete with the report only testing approach and the break glass account exclusions you should never skip. His guide lives entirely in the portal, so here is the PowerShell angle for those of us who would rather not click through seven blades. The Microsoft Graph PowerShell SDK exposes the whole thing through New-MgIdentityConditionalAccessPolicy, where you define the conditions, the included and excluded users, the target apps, the device platforms, and the grant control as a structured object. The smart move is to create the policy with its state set to enabledForReportingButNotEnforced first, confirm the blast radius in the sign in logs, and then flip it to enabled once you trust it. Same logic Prajwal describes in the GUI, just version controlled and repeatable.

https://www.prajwaldesai.com/block-microsoft-365-apps-using-conditional-access-policy/

IntuneAutomation Ships a Free AI PowerShell Script Generator

Ugur Koc added a script generator to IntuneAutomation that turns plain English requests into production ready PowerShell for Intune and Microsoft Graph, and it is genuinely thoughtful about the things that usually make AI generated scripts dangerous. Every script runs through six checks covering metadata, real Graph permission scopes validated against the official list, security and injection risks, runtime correctness, destructive operation safety that enforces SupportsShouldProcess on anything that wipes or deletes, and validation of every Graph endpoint against the published catalog. It needs no sign in, does not store your prompts, and scrubs obvious secrets before sending. It also happens to run on Claude, which gave me a chuckle given how I assemble this newsletter. Free with a daily limit, and a solid starting point even if you plan to harden the output yourself.

https://www.intuneautomation.com/generator/

Microsoft.Online.SharePoint.PowerShell 16.0.27215.12001 Released

Tony Schultz at the Icewolf blog notes that Microsoft shipped a new build of the SharePoint Online Management Shell. His writeup doubles as a good reminder to move to the modern PSResourceGet cmdlets like Get-InstalledPSResource and Find-PSResource instead of the older PowerShellGet commands when you check versions and update. He also raised a real question about uninstall problems that may be tied to CurrentUser scope getting redirected to OneDrive, so if you have run into that yourself, he is looking for confirmation.

https://blog.icewolf.ch/archive/2026/05/20/powershell-module-microsoft-online-sharepoint-powershell-16-0-27215-12001/

PowerShell After Dark: OnRamp, IoT, and Finding Your People

Andrew Pla took his mic to the hotel bar at the PowerShell and DevOps Global Summit for an After Dark episode of the PowerShell Podcast, and it is the kind of conversation that reminds you the community side of PowerShell matters as much as the syntax. He sits down with four attendees, starting with Josh Gratton, a 2026 OnRamp scholarship recipient who went from fifteen years in another field to the service desk to a systems engineering role on the strength of PowerShell automation, and who left Bellevue already planning to speak at a future Summit. From there it is Mark Go on his IoT and hardware work, Craig Mileham soaking up his first Summit while running MSP support in higher ed, and Matt Zaske, the Home Assistant and soldering enthusiast who ran a lightning demo and blogs over at mzonline.com. The thread Andrew keeps pulling on across all four is worth hearing if you have been lurking on the sidelines. Beginners belong here, reaching out is the move, and the distance between an online community and your people closes fast once you are in the same room.

MicrosoftPlaces PowerShell Module 2.1.7

Also from Tony Schultz this week, MicrosoftPlaces 2.1.7 is out. The headline change is a new IsAutoGenerated property exposed on Get-PlaceV3 so you can tell whether a place object was auto created by Microsoft rather than defined by an administrator. If you are managing Places for room and desk booking, this is a small but useful addition for cleaning up and auditing your place data. You will need Exchange or Places administrator rights to connect and pull the configuration.

https://blog.icewolf.ch/archive/2026/05/19/microsoftplaces-powershell-module-2-1-7-has-been-released/

Merill Fernando Launches a Weekly Microsoft AI Roundup

Merill Fernando, the person behind entra.news and the Maester project, just launched a new weekly newsletter called Merill’s Weekly Microsoft AI Roundup. It covers the most important updates across Microsoft 365 Copilot, GitHub Copilot, Azure AI Foundry, Copilot Studio, Security Copilot, Fabric, Microsoft Agent 365, and the wider community, which is a lot of ground that has been genuinely hard to track in one place. If you already lean on entra.news to keep up with identity, this is the same treatment for the AI side of the ecosystem. Worth a subscribe while it is still early.

Merill's weekly Microsoft AI roundup

Your weekly guide to the most important Microsoft AI updates across Microsoft 365 Copilot, GitHub Copilot, Azure AI Foundry, Copilot Studio, Security Copilot, Fabric, Microsoft Agent 365, and the wider community.

By Merill Fernando

Winget Inside Intune Remediation Scripts with David Sass

This PSConfEU session from David Sass is making the rounds again, and for good reason. He shows how to build smarter Intune remediation scripts powered by Winget so you can deploy and update software across your fleet without paying for extra add ons. He covers capturing logs and telemetry with Application Insights, troubleshooting execution with proper output and exit codes, and the real world lessons from running this in a hardened enterprise environment. If you have been justifying paid app management tooling to your budget holders, this one might change the conversation.

Events & Groups

PowerShell Conference Europe 2026

The big one is just around the corner, June 1 to 4 in Wiesbaden, Germany. Heads up that ticket prices already moved to 1,950 euros as of May 11 with the event entering its final logistics phase, so if you have been sitting on the fence, the cost only climbs from here.

https://psconf.eu/

PowerShell Ohio User Group Launches

Stephen Valdinger, Ryan Richter, and fellow MVP Jake Hildreth have teamed up to launch PowerShell Ohio, a new user group for the PowerShell curious, the enthusiasts, and the seasoned pros to learn, laugh, and build community around automation. The site and Meetup page are live now, and they are working out the logistics for a first meeting. Join the Meetup to get notified once they start scheduling.

https://psoh.io/

A couple of years ago I was driving to work listening to PDQ’s PowerShell Podcast, hosted by the one and only Andrew Pla, and Spencer Alessi was on talking about Active Directory security tooling. He brought up PingCastle. I had not used it. I downloaded it that afternoon, ran it against our domain, and within the hour I had a list of findings I had not seen before. A few months later I was on stage at MAEDS giving a talk called Securing Active Directory with PowerShell and Other Tools, and PingCastle was in the slide deck. I told a room of Michigan K-12 IT directors to go run it.

I still tell people to run it. PingCastle is good software. Vincent Le Toux has been maintaining it for the better part of a decade, the scoring model is calibrated against more real environments than anyone else’s, and the HTML report is the closest thing our industry has to a shared vocabulary for AD posture. If you have ever sat in a room where two engineers compare AD environments by maturity level, PingCastle is the reason that conversation is possible.

A note on scope before I go further. PSGuerrilla is not an AD-only tool. It ships 431 security checks across four theaters: Google Workspace (98 checks), Active Directory (175 checks), Entra ID, Azure, Intune, and M365 (159 checks), and continuous monitoring on top of all of it. PingCastle is fundamentally an AD tool with a separate paid Cloud Edition for Entra. So a fair comparison is really just the AD piece. That is what most of this article is about. But I want to be honest up front that the cloud side is not a place PingCastle wins. It is a place PSGuerrilla extends much further by the end.

So why did I build PSGuerrilla?

Why I built it anyway

Two reasons. The first is structural and the second is philosophical, and they reinforce each other.

The structural one is that PingCastle’s coverage stops where Vincent’s roadmap stops and there are categories of AD risk in 2026 that did not exist when the original rule set was written. ADCS escalation is the obvious example. ESC1 through ESC8 were documented in SpecterOps’ Certified Pre-Owned paper and PingCastle covers them well. ESC9 through ESC16 and EKEUwu were published after PingCastle’s ADCS module was written, and templates that pass PingCastle’s checks can still get you domain owned via ESC9 or ESC13. Same story with NTDS hash analysis, logon script body parsing, NTLM relay preconditions as a category, and Tier-0 hygiene for accounts that are functionally Tier-0 but do not appear in standard privileged group enumeration. Someone needed to write the checks.

The philosophical reason is that PingCastle Basic Edition is free for internal IT, but not for security consultants, MSSPs, pen testers, or auditors running it against client domains. For those use cases you need one of PingCastle’s commercial licenses (Auditor or Enterprise, depending on the engagement). That is a defensible business model. Vincent is well within his rights to fund the project that way and the per domain cost is reasonable. But it cuts out the people who deliver findings for a living without a budget for tooling, and it cuts out the consultancies that work with under resourced organizations. K-12 districts, county governments, rural hospitals, and small nonprofits, which are the places I spend most of my career thinking about, almost always get audited by someone who is bringing their own tools to the engagement.

I run the IT department for a public Michigan school district of about 4,900 students across 10 buildings. I know what the tooling budget looks like at that scale. The same dynamic plays out at every district my size in the state and most of the country. The principle I keep coming back to is that asymmetric defenders in resource constrained environments need asymmetric tools. That is the whole point of what I call Guerilla Zero Trust: high impact, low cost defenses that do not require a million dollar SOC stack to operate. PSGuerrilla is licensed under CC BY 4.0. Internal IT, consultants, MSSPs, pen testers, and red teams can all use it commercially. No per domain pricing, no commercial license tier, no usage gate. That license model is the actual headline.

The technical comparison below is what justifies the existence of the second tool. The license is what justifies who gets to use it.

The headline numbers for the AD side

PSGuerrilla’s Invoke-Reconnaissance cmdlet (the Active Directory module specifically) ships 203 AD security checks across 14 categories. Every one is callable as a standalone PowerShell function and documented with a stable check ID:

Category Count Prefix Privileged Account Hygiene 30 ADPRIV- Group Policy 24 ADGPO- Password Policy + NTDS 22 ADPWD- Domain / Forest 20 ADDOM- Certificate Services 19 ADCS- ACL / Delegation 16 ADACL- Logon Scripts 11 ADSCRIPT- Kerberos 11 ADKERB- Trusts 11 ADTRUST- Stale Objects 11 ADSTALE- Network (NTLM relay) 10 ADNET- Tier-Zero Hygiene 7 ADTIER- Logging Posture 7 ADLOG- Tradecraft Indicators 4 ADTRADE-

PingCastle ships roughly 150 rules in its scoring engine across anomalies, privileged accounts, stale objects, and trusts. The categories overlap significantly with mine, but the depth varies category by category. The gap is not uniformly 53 checks. In some areas PingCastle is at parity. In others it is much wider than the totals suggest.

ADCS: where the gap is widest

Active Directory Certificate Services is the single area where the difference matters most.

PingCastle covers the classic ADCS escalation paths from the original Certified Pre-Owned paper, ESC1 through ESC8. That coverage is solid and stable.

PSGuerrilla ships the full modern escalation surface:

• ADCS-002 ESC1: Enrollee Supplies Subject Alternative Name

• ADCS-003 ESC2: Any Purpose Extended Key Usage

• ADCS-004 / ADCS-005 ESC3: Enrollment Agent Template Abuse (both conditions)

• ADCS-006 / ADCS-007 ESC4: Vulnerable Template ACLs and Ownership

• ADCS-008 ESC5: Vulnerable PKI Object ACLs

• ADCS-009 ESC6: EDITF_ATTRIBUTESUBJECTALTNAME2 Flag

• ADCS-010 ESC7: Vulnerable CA ACLs

• ADCS-011 ESC8: NTLM Relay to AD CS HTTP Endpoints

• ADCS-012 ESC9: No Security Extension

• ADCS-013 ESC11: RPC Relay Without Encryption

• ADCS-014 ESC13: Issuance Policy OID Group Link

• ADCS-015 ESC15: Application Policies in Schema v1 Templates

• ADCS-016 ESC16: UPN SAN Misconfiguration

• ADCS-017 EKEUwu: Extended Key Usage Abuse

• Plus CA server inventory (ADCS-001), template enumeration (ADCS-019), and CA auditing configuration (ADCS-018)

ESC9 through ESC16 plus EKEUwu represent attack paths documented after PingCastle’s ADCS module was originally written. Templates that pass PingCastle’s checks can still be exploited via ESC9 (no security extension allows certificate requests from a user account with a manipulable altSecurityIdentities mapping) or ESC13 (issuance policy linked to a group SID). If you have an internal PKI and you have not audited it since 2022, PSGuerrilla will find paths PingCastle does not surface. I have watched this happen in production.

The NTDS password audit nobody else ships free

PSGuerrilla integrates DSInternals to read NTDS.dit offline (no domain impact, optional DC backup path) and runs four distinct checks against the resulting hashes:

• ADPWD-010 Users with Blank Passwords (Critical)

• ADPWD-011 Duplicate Password Hashes (High)

• ADPWD-012 Passwords in HaveIBeenPwned Database (High)

• ADPWD-014 Default/Common Passwords (High)

Plus tier aware cross references via ADPRIV-016 (Privileged Accounts Weak Passwords).

PingCastle does not ship offline NTDS hash analysis or HIBP integration in the Basic edition. The typical adjacent tool here is Specops Password Auditor, which is a separate product with separate licensing. PSGuerrilla ships it as part of Invoke-Reconnaissance. The HIBP corpus downloads once and updates via Update-ThreatIntel.

This is the single most operationally useful finding most environments can generate. A privileged account password that appears in HIBP is a meeting on Monday morning. I have run this against my own domain and against domains I have been allowed to test. It surfaces real issues on the first run, every time.

Logon scripts, NTLM relay, and tradecraft

Three categories I treat as first class concerns that PingCastle treats more lightly in my opinion.

Logon Script Analysis (11 checks, ADSCRIPT-001 through ADSCRIPT-011) parses every .bat, .cmd, .ps1, and .vbs in SYSVOL and Netlogon. It flags hardcoded credentials (ADSCRIPT-004), LOLBins usage (ADSCRIPT-005), plaintext passwords (ADSCRIPT-006), world-writable script permissions (ADSCRIPT-007), external resource references (ADSCRIPT-008), and UNC paths to non-DC locations (ADSCRIPT-010). In any environment older than five years, this category returns findings on the first run. I built it because I have seen what lives in SYSVOL at districts that inherited their domain from a previous administrator. PingCastle catches the GPP cpassword leftovers but does not parse script bodies at this level.

Network NTLM Relay Preconditions (10 checks, ADNET-001 through ADNET-010) covers the conditions that make Responder, mitm6, and Print Spooler relay attacks work. LDAP Signing required (ADNET-001), LDAP Channel Binding enforced (ADNET-002), SMB Server/Client Signing required (ADNET-003/004), LLMNR disabled (ADNET-005), NetBIOS-over-TCP reviewed (ADNET-006), IPv6 mitm6 mitigation posture (ADNET-007), WPAD auto-discovery disabled (ADNET-008), Print Spooler on DCs (ADNET-009), WebClient service default state (ADNET-010). PingCastle covers LDAP and SMB signing. The WPAD, LLMNR, IPv6, and WebClient surface as a dedicated category is mine.

Tradecraft Indicators (4 checks, ADTRADE-001 through ADTRADE-004) is small but distinctive. ADTRADE-001 finds GPP cpassword leftovers in SYSVOL (the 2014 vulnerability that still lives in production environments today; I have found this in district domains in the last twelve months). ADTRADE-002 checks for DCShadow indicators (rogue configuration partition servers that signal a sophisticated persistence technique). ADTRADE-003 catches stale BitLocker recovery keys. ADTRADE-004 audits RODC Password Replication Policy hygiene. PingCastle catches the cpassword issue. The other three are PSGuerrilla originals.

Tier-Zero hygiene: the tier-bleed problem

My ADTIER-001 through ADTIER-007 checks address a category PingCastle largely does not cover: service accounts that are effectively Tier-0 but do not appear in standard privileged group enumeration.

The flagship example is ADTIER-001 (Azure AD Connect MSOL_ Audit). When Azure AD Connect installs in Express mode, it creates a domain account named MSOL_<random-hex> and grants it Replicating Directory Changes plus Replicating Directory Changes All on the domain naming context. That is DCSync rights. The account is functionally a domain takeover if compromised. It lives in the default Users container, has a 10 year password expiry, and rarely appears in Domain Admins enumeration because it gets its power via direct ACL rather than group membership. Most AD tools miss it. I have personally found this account misconfigured in environments that had been audited by other tools and passed.

ADTIER-002 through ADTIER-005 extend the same logic to backup software service accounts (Veeam, CommVault), hypervisor accounts (vCenter), configuration management (SCCM), and SQL service accounts that have crept into Tier-0 groups over time. ADTIER-006 flags Tier-0 admins living outside dedicated Tier-0 OUs. ADTIER-007 flags service accounts that hold interactive logon rights via privileged group membership, which violates the Microsoft tier model.

This is one of the highest signal categories in a modern AD audit. Hybrid identity environments accumulate these accounts across change windows nobody documents. PSGuerrilla checks for them by default.

Logging posture

PingCastle does not audit logging configuration as a distinct category. My ADLOG-001 through ADLOG-007 covers the controls that determine whether an incident response would actually have data to work with:

• ADLOG-001 Advanced Audit Policy configured

• ADLOG-002 PowerShell Script Block Logging enabled

• ADLOG-003 PowerShell Module Logging enabled

• ADLOG-004 Process Creation Auditing with command line (Event 4688)

• ADLOG-005 Microsoft Defender Tamper Protection policy

• ADLOG-006 Windows Event Forwarding (WEF) Subscription Manager configured

• ADLOG-007 Sysmon deployment indicator

This category does not change the attack surface. It changes what is recoverable when something goes wrong. Worth running for that reason alone, and a category I care about deeply because I have sat in incident calls where the question of “do we have logs for that” had a bad answer.

What PingCastle still wins on

I want to be careful here. PingCastle is not behind on every front, and I am not trying to suggest otherwise. Several things it does that PSGuerrilla either does not match or covers differently:

• The Healthcheck XML primitive. PingCastle uses this as a stable cross environment data format. It is useful for trend analysis across multiple domains, especially in MSSP contexts (with an Auditor or Enterprise license).

• Scoring model maturity. PingCastle’s 0 to 100 risk score is calibrated against several years of real world data, and the Maturity Level framework is widely recognized. PSGuerrilla has its own Guerrilla Score with FORTRESS, DEFENDED POSITION, CONTESTED GROUND, EXPOSED FLANK, UNDER SIEGE, and OVERRUN tiers, but PingCastle’s calibration history is longer.

• Trust analysis depth on the AD side. PingCastle’s multi-forest trust mapping is mature and well tested. PSGuerrilla covers AD trusts in 11 checks but does not visualize the relationships the same way.

• Single binary deployment. PingCastle runs as one .exe. PSGuerrilla requires PowerShell 7 and the DSInternals module for the NTDS checks. If you need to run something on a locked down jump host with no PowerShell modernization story, PingCastle is easier to deploy.

If your organization has standardized on PingCastle and your team understands the scoring model, there is no reason to abandon it. The two tools coexist well. PSGuerrilla fills the AD categories PingCastle does not cover, extends into Entra, M365, and Workspace that PingCastle does not touch in the free tier, and offers a license model that fits engagements PingCastle’s free tier does not.

Beyond AD: where the comparison stops being a comparison

PingCastle is at its core an AD tool. PingCastle Cloud Edition is a paid add-on that crosses into Entra. That is a fair business decision. But it is worth being precise about what it means: in the free tier, PingCastle does not audit Entra ID, M365, Intune, or Google Workspace at all. PSGuerrilla does all four, by default, under the same CC BY 4.0 license, in the same module.

Invoke-Infiltration runs 159 checks across Entra ID, Azure, Intune, and M365. That covers Conditional Access, PIM, application consent grants, risky sign-ins, Exchange Online security posture, SharePoint sharing settings, Teams external access, Intune compliance policies, and the rest. Invoke-Fortification runs 98 checks against Google Workspace, covering admin console hardening, OAuth third party app review, Drive sharing posture, Gmail security defaults, audit log configuration, and 23 behavioral detection signals via Invoke-Recon. I built the Workspace side first because I run a Google district, and I needed something that audited Workspace the way PingCastle audits AD. There was nothing free that did it.

The continuous monitoring layer is where the multi-theater design starts to pay back. Invoke-Surveillance watches Entra ID for sign-in risk and directory changes. Invoke-Watchtower does baseline drift detection against AD. Invoke-Wiretap tails the M365 unified audit log for Exchange, SharePoint, Teams, Defender, and Power Platform events. Patrols schedule any of these via Register-Patrol and route alerts through nine providers: Teams, Slack, PagerDuty, Twilio, SendGrid, Mailgun, generic webhook, Syslog CEF/LEEF, and Windows Event Log.

For K-12 specifically, there is a K12 scoring profile and a compliance crosswalk that maps findings to FERPA, COPPA, CIPA, NIST 800-171, and state ed tech frameworks. That is built in. Nobody else ships this for free (and I need it bad!).

If you want to do an apples to apples comparison on cloud identity, you would need PingCastle Cloud Edition (paid) on one side and Invoke-Infiltration (free) on the other, and at that point you are not really comparing the same product anymore.

Output and remediation

Where PingCastle stops at the report, PSGuerrilla pairs every finding with a remediation. I built it this way because in my day job I do not have a remediation team. I have me, and I have a small team of people who already have full plates. If I am going to ship a tool that produces 150 findings, I owe my own future self a way to work through them without writing 150 PowerShell scripts.

Export-TechnicalReport ships each finding with check ID, current value, recommended value, severity, MITRE ATT&CK mapping, CIS Benchmark citation, NIST SP 800-53 and 800-171 references, and step by step remediation. Export-RemediationScripts writes one .ps1 per finding, each with a safety preamble and rollback comments. Export-ExecutiveSummary produces a one page document for the board. Export-BudgetJustification groups remediations by cost tier so leadership can make funding decisions.

For a 150 finding environment, that turns a six week remediation sprint into a structured backlog where each ticket carries the script attached. Nothing auto-applies. The intended workflow is read, scope, approve, execute.

How this is being built

I should be direct about something. I am not writing all 431 of these checks by hand. PSGuerrilla is being built with the assistance of AI tools doing a lot of the implementation, with my expertise and lived experience as the watchful eye over every commit. I know what a misconfigured MSOL_ account looks like in production because I have found one. I know what GPP cpassword leftovers do in a real district because I have cleaned them up. The agentic tools accelerate the work. The judgment about what to check, why it matters, and what the remediation actually has to do is mine.

I am also actively stress testing the module against sample environments to verify the checks behave correctly across configurations I do not run in production. That work is not glamorous and it does not show up in a demo, but it is the difference between a tool that runs and a tool that runs reliably.

My advice for anyone reading this who has thought about building their own tooling: take the PSGuerrilla base, drop it in your own repo, and let Copilot CLI loose on it to customize it to your environment. Add your own checks. Tune the scoring weights. Wire up the alerting providers you actually use. The CC BY 4.0 license exists precisely so this is allowed.

Building modules without agentic AI in 2026 seems nuts to me at this point. The tools are too good. The leverage they give a single practitioner who knows what they want is too high. If you are an IT director at a district my size and you are sitting on tribal knowledge about your environment that nobody else has, that knowledge plus an agentic editor is enough to produce something worth running. The barrier to making real tools has collapsed. Expertise still matters. Judgment still matters. The willingness to actually ship still matters. What has changed is how much typing sits between those things and a working module.

How to use both

The honest recommendation for AD specifically is to use both, at least initially. PingCastle’s scoring is a useful reference point and the Maturity Level framework gives leadership a familiar yardstick. PSGuerrilla extends the AD coverage into ADCS depth, NTDS password analysis, logon scripts, NTLM relay preconditions, Tier-0 hygiene, logging posture, and tradecraft indicators that PingCastle does not surface. Then it keeps going into Entra, Azure, Intune, M365, and Google Workspace that PingCastle’s free edition does not touch.

For internal IT teams: run both on the AD side. PingCastle Basic is free for you. PSGuerrilla fills the AD gaps and gives you the cloud identity audit on top.

For consultants, MSSPs, pen testers, and analysts who need to deliver findings to clients without per-engagement licensing: PSGuerrilla is CC BY 4.0 across all 431 checks. Attribute the source in the report (a footnote suffices) and ship.

Trying it

PSGuerrilla is published to the PowerShell Gallery at powershellgallery.com/packages/PSGuerrilla, so for most people the install is one line. For the AD audit specifically, you do not need to set anything else up. PSGuerrilla uses your current Kerberos session, so if you are running from a domain-joined machine with appropriate read rights, you can go from Install-Module to running checks in two commands.

# Install from the PowerShell Gallery (recommended)
Install-Module PSGuerrilla
Import-Module PSGuerrilla

# AD audit. No vault setup needed. Uses your current Kerberos session.
Invoke-ADRecon                  # alias for Invoke-Reconnaissance

# For cloud audits, set up the encrypted credential vault first
Set-Safehouse
Invoke-Infiltration             # Entra / Azure / Intune / M365 (159 checks)
Invoke-Fortification            # Google Workspace (98 checks)

# Or run everything in one go after Set-Safehouse
Invoke-Campaign

# Alternative install path if you want the latest unreleased changes
# git clone https://github.com/jimrtyler/PSGuerrilla.git
# Import-Module ./PSGuerrilla/PSGuerrilla.psd1

For the AD audit, no credential setup is needed when running from a domain-joined machine. Add Install-Module DSInternals if you want the NTDS hash analysis. For the cloud paths you will need an Entra app registration with the right Graph scopes (the README walks through it) and, for Workspace, a GCP service account with domain wide delegation. Both of those credentials live in the safehouse vault that Set-Safehouse creates.

The first run produces the executive summary, technical report, remediation playbook, and per-finding scripts. The technical report includes every check ID, observed value, recommended value, and remediation steps. The remediation scripts go into a separate folder. Nothing runs automatically.

PSGuerrilla is at guerrilla.army. The site includes an interactive configuration builder that generates the JSON config file for whichever environments you want to audit. Source is at github.com/jimrtyler/PSGuerrilla. CC BY 4.0.

PingCastle is at pingcastle.com. Commercial licensing (Auditor, Enterprise, and Cloud Edition) is per-domain.

The right answer for most teams on the AD side is both, for different reasons. The right answer for the cloud side is the tool that audits it for free. The right answer for analysts who bill for the work is the tool that does not charge per engagement.

Report what you find

PSGuerrilla will encounter edge cases in environments I have not tested against yet. That is the nature of shipping a security module that touches six different identity platforms across whatever combination of legacy and modern configurations your domain has accumulated since it was stood up. If you hit a check that produces a false positive, a missing dependency, an unhelpful error message, or a remediation script that does the wrong thing in your environment, open an issue at github.com/jimrtyler/PSGuerrilla/issues. The more specific the better. Versions, OS, domain functional level, the exact check ID, and anonymized output if you can share it. The faster I see it, the faster I can fix it for everyone running the next version.

If you build your own checks on top of the base and want them merged upstream, pull requests are welcome too. Thanks for reading if you’re still here!

PowerShell Automation for Sysadmins: Working Smarter With Three MVPs and 500 Attendees

So this is a little embarrassing. I joined Andrew Pla and Steven Judd for the PDQ webcast on PowerShell automation for sysadmins on May 13, three Microsoft MVPs talking for an hour about how PowerShell helps you stop doing sysadmin work the hard way, and I somehow managed to put together this entire newsletter without mentioning it once. Over 500 of you joined us live, which still kind of blows my mind. We covered how to figure out which tasks to automate first, why reporting and visibility scripts are the safer starting point than anything destructive, how Andrew thinks about going from reactive to proactive, why Steven hammers on the object oriented nature of PowerShell as the thing that trips people up early, and how I keep my K12 environment from imploding during student rollover when thousands of accounts need to move between organizational units at once. The full recording is on demand now, and Meredith Kreisa at PDQ wrote up an excellent companion piece that captures the whole conversation.

Watch it here: https://www.pdq.com/events/it-exchange-may2026/

Blog based on it here: https://www.pdq.com/blog/powershell-automation-for-sysadmins/

Patch Tuesday May 2026: 118 CVEs, 16 Critical, and a Dynamics 365 RCE That Demands Attention

Brock Bingham at PDQ has the full Patch Tuesday breakdown for May, and this one earned its keep. Microsoft addressed 118 CVEs with 16 rated critical, headlined by CVE-2026-42898, a Dynamics 365 remote code execution flaw scoring 9.9, and CVE-2026-41096, a 9.8 DNS Client RCE that should be patched in every environment yesterday. There is also a cluster of seven critical Office RCEs and a Hyper-V issue worth reading up on before you cut your maintenance window.

https://www.pdq.com/blog/patch-tuesday-may-2026/

Microsoft.Graph PowerShell Modules 2.37.0 Released

Tony Schultz at Icewolf has the quick rundown on the latest Microsoft.Graph PowerShell module release. Version 2.37.0 is now on the PowerShell Gallery and brings the usual mix of cmdlet additions, schema updates, and fixes that come with each release. If you are running automation that depends on Graph cmdlets, this is the kind of update you want to test in a lab before rolling into production scripts.

https://blog.icewolf.ch/archive/2026/05/13/microsoft-graph-powershell-modules-2-37-0-released/

Understanding How Graph Permissions for Groups Actually Work

Tony Redmond breaks down one of the more confusing corners of Microsoft Graph, the difference between Group.Read.All and GroupMember.Read.All and the implications for any app or PowerShell script that touches groups. The piece is a strong walk through of why the principle of least privilege matters here, what each permission actually unlocks, and how to reason about scopes when designing automation. If you have ever requested a wider permission than you really needed because the docs were unclear, this one is worth your time.

https://office365itpros.com/2026/05/13/graph-permissions-groups/

Dynamically Removing Preinstalled Microsoft Store Apps Using Native Functionality

Peter van der Woude has a great writeup on the native dynamic MSIX and APPX removal capability that arrived with Windows 11 24H2. No more debloat scripts, no more wrestling with provisioning packages that leave behind ghosts. Peter walks through how the native functionality actually works, how to target specific preinstalled apps, and what the Intune configuration looks like end to end. If you have been waiting for a clean built in answer to the bloatware problem, this is the post that explains how to use it.

https://petervanderwoude.nl/post/dynamically-removing-preinstalled-microsoft-store-apps-using-native-functionality/

Built In PowerShell Parameters You Should Be Using with Lucas Allman

Andrew Pla hosted Lucas Allman on PowerShell Wednesday this week for a beginner friendly walkthrough of the common parameters that get baked into every advanced function and cmdlet, and it is one of those topics that quietly separates people who write PowerShell from people who write good PowerShell. Lucas covers what an advanced function actually is, how a single CmdletBinding attribute or a decorated parameter unlocks the full set of common parameters for you, and why the six output streams exist as separate channels for success, error, warning, verbose, debug, and information. Good watch :)

Controlled Configuration for Microsoft Defender Antivirus Settings

Rudy Ooms has another excellent OSINT style investigation, this one digging into the ControlConfigAdapter component that Microsoft has been quietly building into Defender for managing antivirus configuration in a controlled, drift-resistant way. The post explains what the component does, where it lives, and how it interacts with the rest of the Defender configuration story. Rudy is one of the few people writing at this level of detail about Microsoft Endpoint internals, and this is required reading if you manage Defender at scale.

https://patchmypc.com/blog/controlled-configuration-for-microsoft-defender-antivirus-settings/

DSC v3.2.0 Hits GA with New Windows Resources, Version Pinning, and Experimental Bicep Integration

The 4sysops team has a solid breakdown of what landed in Microsoft Desired State Configuration v3.2.0, which reached general availability on April 29 and is rolling out into wider awareness now. The release brings built in resources for services, firewall rules, and SSH settings, extends the what-if preview mode to individual resources, introduces version pinning, and includes experimental Bicep integration over gRPC. The article walks through what changed since v3.1, the limitations to watch for, and how to install the update via winget.

https://4sysops.com/archives/dsc-v3-2-0-new-windows-resources-version-pinning-and-bicep-integration/

Upcoming Events

PSConfEU 2026 June 1-4, 2026 in Wiesbaden, Germany

https://psconf.eu/

Michael Suhl joined Mike Kanakos and Phil Bosman on the Research Triangle PowerShell User Group to tackle one of the most frustrating conversations any of us have when starting a new job, which is being told that PowerShell is too dangerous to enable. Mike walks through how to actually have the risk conversation with your GRC team, breaks down where PowerShell shows up in the MITRE ATT&CK framework, and lays out a stack ranked list of mitigations from low effort wins like audit logging and EDR all the way up to the heavy lifts like script signing, WDAC, JEA, and host based firewalls. The real gold is a slide mapping all of those controls to effort and benefit, and a teaser for a module he is calling PSART that codifies the Australian Signals Directorate guidance into deployable PowerShell.

Introducing Commercial Vantage Policy Manager for Intune

For those of you managing Lenovo devices, this post from Philip Jorgensen is a must read. He has built a new PowerShell UI tool that lets you create OMA-URI policies for Lenovo Commercial Vantage settings without having to ingest the ADMX templates the traditional way. Big quality of life improvement if you have been wrestling with this in your tenant.

https://blog.lenovocdrt.com/introducing-commercial-vantage-policy-manager-for-intune

Protecting Profiles

Jeff Hicks dropped a new Behind the PowerShell Pipeline post this week walking through how to protect your PowerShell profile scripts from tampering. He uses Get-FileHash and MyInvocation to build a function that verifies the profile has not been modified since you last approved it, which is a clever defensive technique most people overlook. If your profile is loading modules, setting aliases, or doing anything privileged, this is worth a read.

https://buttondown.com/behind-the-powershell-pipeline/archive/protecting-profiles/

Locking Down Windows Devices by Suppressing Key Combinations

Peter van der Woude has a practical post on using the built in Windows Keyboard Filter feature to suppress specific key combinations on shared, kiosk, or locked down devices. The post walks through enabling the feature with a single PowerShell command, configuring blocked combinations through some old school WMI work against the WEKF_PredefinedKey class, and deploying everything via Intune Win32 apps. Useful reference if you are managing any kind of restricted device fleet.

https://petervanderwoude.nl/post/locking-down-windows-devices-by-suppressing-key-combinations/

Shift Happens: Two Command Injections in Windows Context Menus

Remi Gascou over at SpecterOps published a fascinating piece of research uncovering two command injection vulnerabilities in the built in Windows Explorer “Open PowerShell window here” context menu, triggered by crafted folder names. One variant affects modern Windows 11 builds and the other has existed since Windows 10 1703 back in April 2017, meaning this has been sitting quietly in Windows for nearly nine years. The most interesting section is at the end where Remi shows that LLMs trained on this period of Windows documentation now confidently reproduce the vulnerable command template when asked to set up a custom context menu, with no security warnings whatsoever.

https://specterops.io/blog/2026/05/07/shift-happens-uncovering-two-built-in-command-injections-in-windows-context-menus/

Using the Microsoft Graph PowerShell SDK to Update User Profiles

Tony Redmond walks through how to use the Microsoft Graph PowerShell SDK to add awards and certifications to Microsoft 365 user profile cards, a UX update Microsoft is now rolling out to tenants. The post covers New-MgBetaUserProfileAward and New-MgBetaUserProfileCertification, how to manage the various properties, and how the resulting data surfaces in OWA, the new Outlook, and Teams. Tony also gives some good context on Microsoft’s broader people platform initiative and the surprisingly rich set of resources you can now attach to a user profile, from anniversaries to languages to publications.

https://office365itpros.com/2026/05/08/user-profile-card-awards/

Microsoft DSC v3: Build and Deploy Classic Resources with ActiveDirectoryDsc

Michal Machniak has a phenomenal deep dive on using DSC v3 to deploy a full Active Directory environment from scratch using nothing but declarative YAML files. He walks through a two stage approach where the first stage uses ActiveDirectoryDsc/ADDomain to spin up the forest and promote the first DC, then the second stage uses Microsoft.DSC/Include to compose six smaller configurations covering the OU hierarchy, admin users, delegation groups, group membership, OU permission entries, and fine grained password policies. The post is loaded with working YAML examples, parameter file patterns for keeping secrets out of source control, and the actual dsc config commands to validate and apply each stage.

https://mmachniak.net/2026/05/06/dscv3-build-and-deploy-classic-resources-activedirectory-dsc/

From ISE Anxiety to VS Code Every Day with Paula Kingsley

Andrew Pla sits down with Paula Kingsley, an eight time Microsoft MVP for Exchange Server and self described happy generalist, for a wide ranging conversation about her tech career and the long delayed jump from ISE to VS Code. Paula admits she put off the switch for as long as possible, and her advice for anyone in the same boat is refreshingly simple: just open VS Code and leave it open. The episode also covers why being a generalist is undervalued, the importance of building yourself an escape route with WhatIf and ShouldProcess, and the very real difference between Get cmdlets and Set cmdlets when your afternoon is on the line.

PowerShell Universal Forum Moves to Devolutions

Adam Driscoll announced this week that the Ironman Software forum is closing and migrating to the Devolutions forum starting Monday, May 11. All existing PowerShell Universal discussions and threads will be moved over and any new posts will need to be made directly on the Devolutions side, which means creating a free Devolutions account if you do not already have one. The migrated posts will appear anonymously at first but you can claim your content once your account is set up. Worth knowing about if you have ever posted there.

https://forums.ironmansoftware.com/t/heads-up-were-moving-to-the-devolutions-forum/13316

Announcing Native PowerShell Tooling for ReFS Snapshots

Jeffrey Woolsey announced ReFSSnapshots, a new open source PowerShell module from Microsoft that wraps the existing refsutil streamsnapshot command line utility in proper cmdlets with pipeline support and consistent error handling. ReFS has long supported stream level snapshots for point in time capture of individual files or streams rather than full volumes, but until now you had to drive it through the command line tool. If you are already using ReFS for resilient storage on Windows Server or client, this makes integrating snapshots into your existing PowerShell workflows significantly easier, and the GitHub repo includes good examples for pre change snapshots, comparison workflows, and scheduled maintenance.

https://techcommunity.microsoft.com/blog/filecab/announcing-native-powershell-tooling-for-refs-snapshots/4516377

How to Install the New Microsoft Entra ID Module

Patrick Gruenauer has a quick reference for installing the new Microsoft.Entra PowerShell module for managing Microsoft 365 from PowerShell. The whole setup is essentially Install-Module, Connect-Entra, and you are off to the races. Handy bookmark if you are still migrating scripts away from the older AzureAD or MSOnline modules and want a clean starting point.

https://sid-500.com/2026/05/06/powershell-how-to-install-the-new-microsoft-entra-id-module/

ExcelFast v0.0.1-alpha14 Released

Justin Grote pushed a new alpha release of ExcelFast, his high performance PowerShell module for importing, exporting, and manipulating Excel files. If you are still doing Excel work with ImportExcel or wrestling with COM automation, this is worth tracking as an alternative built for speed.

https://github.com/JustinGrote/ExcelFast/releases/tag/v0.0.1-alpha14

Upcoming Events

PowerShell UserGroup InnSalzach: Your Graph Apps Are Over-Privileged, Let’s Fix That with PowerShell

The PowerShell UserGroup Inn-Salzach is hosting Morten Mynster on May 14 from 8PM to 9PM CET for an online session on auditing and right sizing Microsoft Graph application permissions with PowerShell.

https://www.meetup.com/de-de/powershell-usergroup-inn-salzach/events/314638631/

PSConfEU 2026 June 1-4, 2026 in Wiesbaden, Germany

https://psconf.eu/

PowerShell 7.7.0-preview.1 Released

The first preview of PowerShell 7.7 dropped this week and it is a substantial release with a long list of community contributed improvements. On the cmdlet side, highlights include an ExcludeProperty parameter for the Format cmdlets, an Extension parameter for Join-Path, a new ToRegex method on WildcardPattern, improved tab completion for PSBoundParameters switch cases and access patterns, and a DSC v3 resource for PowerShell profiles. Several long standing annoyances around explicit switch false parameter handling get fixed across multiple cmdlets including Where-Object, Get-Uptime, New-Guid, Get-Random, and Test-Connection. Export-Csv gets a quality of life fix making Append and NoHeader mutually exclusive, and NoTypeInformation is now marked as an obsolete no-op with IncludeTypeInformation becoming the default behavior.

PSFeedbackProvider and several other experimental features also graduate to stable in this release. There is a new PSApplicationOutputEncoding variable, AppContainer support lands in the engine, and the update notification now delays by a week to ensure all packages are available before nagging you. On the breaking changes side, ValidateNotNullOrEmpty is now enforced on the -Property parameter of Format-Table, Format-List, and Format-Custom. And yes, this is the first release shipping as MSIX rather than MSI on Windows, so if you missed last week’s item from Harm on that change, now is a good time to go back and read it.

https://github.com/PowerShell/PowerShell/releases/tag/v7.7.0-preview.1

DSC v3.2.0 Released

DSC v3.2.0 hit general availability this week and it is a substantial update. New built-in Windows resources cover services, optional features, features on demand, firewall rules, and a full suite of SSH server configuration resources, all ready to use without additional installation. Version pinning lands in this release, meaning you can now lock a configuration document to a specific DSC version and pin individual resources to version ranges, which addresses a real gap for anyone running configurations across environments with different resource versions. The expression language gets lambda expressions with map and filter functions, dataUri functions, and reference usage inside copy loops. Adapter improvements include automatic conversion of PowerShell Write-* streams to DSC traces, which is a nice quality of life addition for resource authors. The experimental Bicep integration via gRPC is also included, letting Bicep orchestrate DSC resources directly without going through ARM. And an experimental PowerShell discovery extension now lets DSC find resources defined in PowerShell modules that are not traditional PSDSC resources. Big release with a lot of community contribution behind it.

https://devblogs.microsoft.com/powershell/announcing-dsc-v3-2-0/

From Event Logs to AI Workflows with Lucas Allman | The PowerShell Podcast E225

Lucas Allman joins Andrew Plaw for a conversation that starts with practical beginner wins and builds into bigger questions about AI, learning, and career growth in IT. The episode covers hands-on use cases like using Get-WinEvent to filter event logs and reusing XPath filters from Event Viewer inside PowerShell scripts, writing full functions directly in the interactive terminal and saving them with a custom helper so good code survives the session, and the experience of speaking at PowerShell Summit for the first time.

The AI discussion is one of the better ones out there right now, with Lucas making a clear case for using it as a collaborator to offload repetitive work and learn faster rather than a replacement for the judgment and critical thinking that still matter (which I totally agree with). Impostor syndrome - which we talk about below with Robert’s post - keeping up with change, and why curiosity and community remain as important as technical skill all get a moment too.

Legacy: My First Microsoft MVP Summit

Robert Bogue has a lovely short piece reflecting on attending his first MVP Summit over 20 years ago, where he sat in the back of a room and watched Jeffrey Snover present what would eventually become PowerShell, then still called Monad. He writes honestly about the impostor syndrome he felt that day and how Snover’s vision for a consistent verb noun command language stood out as the single clearest piece of thought leadership from the entire event. Worth a few minutes of your time as a reminder of where all of this came from. I actually felt the same way when I was out in Redmond.

https://thorprojects.com/2026/04/30/legacy-my-first-microsoft-mvp-summit/

PowerShell Summit After Dark | The PowerShell Podcast

Andrew Plaw recorded a couple of bar session conversations at PowerShell Summit for this special edition of the podcast. First up is Josh Dearing, known as Fortress in the PDQ Discord, talking about his journey from batch scripts to publishing modules, his first Summit experience, and why seeing speakers fail and push through was one of the most motivating things he took away from the week. The second conversation is with Jeff Wlaw, a long time PowerShell user attending his first in person Summit, reflecting on Jeffrey Snover’s session, the value of outside perspective in IT careers, and a genuinely good tangent on directness, honesty, and why being willing to be wrong is actually a sign of intelligence. Loose, honest, and exactly what you would hope a bar session podcast sounds like.

Microsoft Defender for Endpoint in Depth: 2nd Edition

Ru Campbell announced that the second edition of Microsoft Defender for Endpoint in Depth is now available for pre-order, shipping in May. Written alongside Paul Snow and Ian Hoyle, the new edition adds three fresh chapters covering tuning and situational optimizations, mobile threat protection, and safer production rollouts, with every other chapter refreshed to reflect the three years of Defender changes since the first edition. If you are serious about MDE in your environment this has been one of the most recommended practical guides in the space and the update sounds substantial.

https://www.amazon.com/dp/1837026114

PowerShell in the Browser: Safe Sandboxes and Interactive Learning

James Brundage presented at the Research Triangle PowerShell Users Group on two projects he has been building: Reptile, a browser based PowerShell REPL built on data language mode that lets you run only the commands you explicitly whitelist, and Turtle, an interactive graphics programming environment layered on top of it. The safety story is genuinely clever, data language mode has been in PowerShell since V2 and makes it impossible for a user to run commands you have not approved, which means you can hand this to a complete beginner or even a kid and not worry about them accidentally doing something destructive. The demos are fun, including drawing 100 random turtle graphics in under 20 seconds and an accidental karaoke server, but the underlying architecture is worth understanding if you have ever wanted to expose PowerShell functionality through a browser interface without the usual security headaches.

Celebrating 250 PowerShell Posts

Harm Veenstra hit a milestone this week with his 250th post on PowerShellIsFun, four years after starting the blog in April 2022. He shares some honest reflections on writer’s block, the fear of posting things others have already covered, and how the PowerShell community’s welcoming nature made all of it worthwhile. A well deserved milestone from someone who consistently puts out quality content every single week. Harm is a great guy.

https://powershellisfun.com/2026/04/24/celebrating-my-250-powershell-related-posts/

April 2026 PowerShell Potluck with Jeff Hicks

Jeff Hicks wraps up April in his newsletter with a few things worth checking out. The main discovery this month is the TextMate module, a syntax highlighting wrapper that makes viewing script files in the console genuinely pleasant, with support for dozens of languages, multiple themes, and paging for longer files. Jeff also shares a moment from PowerShell Summit that clearly meant a lot to him: he received the Don Jones PowerShell Community Leadership Award, nominated by members of the community. Well deserved. He closes with this month’s scripting challenge, which asks you to use Get-NetAdapterStatistics to build a live updating display using either Write-Progress or the pwshSpectreConsole module.

https://buttondown.com/behind-the-powershell-pipeline/archive/april-2026-powershell-potluck/

Office 365 for IT Pros May 2026 Update

Tony Redmond’s monthly roundup covers Microsoft’s upcoming Modernized Change Management system, which promises better written message center posts, an MCP server for querying updates, and a new frontier tier for tenants wanting earlier feature access. Other notable items include the ability to change a meeting organizer via Exchange Online PowerShell, recently used Teams emojis syncing across devices, and Copilot Chat gaining access to shared mailbox content for licensed tenants. The Automating Microsoft 365 with PowerShell eBook is also updated to version 23 this month for subscribers.

https://office365itpros.com/2026/05/01/office-365-for-it-pros-may-2026-update/

Upcoming Events

PSConfEU 2026 June 1-4, 2026 in Wiesbaden, Germany

https://psconf.eu/

PowerShell 7.6.1 Released with .NET SDK 10 Update

The PowerShell team has shipped 7.6.1, a maintenance release that refreshes the runtime to .NET SDK 10.0.202. I noticed the update now delays its upgrade notification by a full week so every package is live before users get nudged, and the release also folds in a PSNativeCommandArgumentPassing test fix alongside general cmdlet improvements. Binaries are published across Windows, Linux, and macOS on x64, arm64, and arm32 architectures, with LTS packages rolling out in parallel.

https://github.com/PowerShell/PowerShell/releases/tag/v7.6.1

PowerShell Scanner Now Live in PDQ Connect

PDQ announced on this week’s PDQ Live that the long awaited PowerShell scanner has officially landed in PDQ Connect, letting you run PowerShell queries against your fleet and pull real data back for reporting, automation, and the environment questions that have gone unanswered for too long. I watched the stream and the developers who built it joined to walk through what is under the hood, and the team also showcased several community built scanners solving real world problems. If you have been waiting for your scripts to have a proper home inside Connect, this is the release to check out.

Check Mail Records with the DomainHealthChecker PowerShell Module

Harm Veenstra has a helpful walkthrough of the DomainHealthChecker module from Martien van Dijk, which pulls SPF, DKIM, DMARC, BIMI, DNSSEC, and MTA-STS records for any domain you point it at. I like that the Invoke-SpfDkimDmarc cmdlet bundles the major checks into a single call and accepts a file of domains for bulk validation, making it a fast fit for migration prep or security audits. The module installs straight from the PowerShell Gallery or via PSResourceGet, and Harm walks through each cmdlet with real output so you can see exactly what to expect before running it against your tenant.

https://harmveenstra.nl/2026/04/17/check-mail-records-using-the-domainhealthchecker-powershell-module/

PowerShell Universal 2026 Part 5: Creating an Endpoint That Accepts a Body

JackedProgrammer continues the PowerShell Universal for Beginners series with a walkthrough on building a GET endpoint that accepts a JSON body instead of a query string, which is a cleaner and generally more secure pattern for filtering data against an API. I appreciated the practical touch of starting with a simple return of the input data to confirm the body is being read correctly, then layering in Get-ADUser logic, input validation using Get-Member to check for required properties, and a proper try catch block to return clean error objects when things go sideways. The demo also drives home why returning well structured JSON messages matters, since the consumers of your endpoint might be calling it from Python, JavaScript, or curl rather than PowerShell.

Entra and Microsoft 365 Could Improve License Reporting

Tony Redmond takes a hard look at the new License Usage Insights feature that landed in the Entra admin center on April 22, alongside the new dashboard card for licenses in the Microsoft 365 admin center. I share his frustration that the two admin centers cannot seem to agree on a single consistent story, with the Microsoft 365 dashboard reporting a user count that includes utility accounts like shared and room mailboxes and even claiming license totals that do not mathematically add up. Tony also points out that while the Entra insights are a welcome step, there is no way to click through to identify which account is actually using risk based conditional access, and no option to download the underlying data.

https://office365itpros.com/2026/04/24/license-insights/

PowerShell Resources Roundup from PDQ Live

Andrew Pla walked through a loaded list of PowerShell resources on this PDQ Live segment, spanning the essentials like Windows Terminal, VS Code, and PowerShell 7, alongside community favorites like Import Excel which he credits with changing lives once admins realize they can generate real spreadsheets without Excel installed. Where the episode really sharpened up was the security tooling section, covering Locksmith for auditing Active Directory Certificate Services, Maester for running baseline checks against your Entra tenant, and Morton’s Least Privilege MS Graph module for trimming enterprise app permissions down to only what the logs show they actually use.

Understanding the additionalProperties Property in Microsoft Graph PowerShell

Tony Redmond tackles one of those quirks that trips up every admin making the jump from Exchange Online or the old AzureAD module to the Microsoft Graph PowerShell SDK, which is the way cmdlets like Get-MgUserMemberOf and Get-MgGroupMember return a sparse set of strongly typed properties and stash everything else inside a catch all dictionary called additionalProperties.

https://office365itpros.com/2026/04/21/additionalproperties-property/

Upcoming Events

PSConfEU 2026 June 1-4, 2026 in Wiesbaden, Germany

https://psconf.eu/