BurntToast v1.0, PSPlaywright v0.1.0, and Encrypting Secrets with Protect-CmsMessage
+ Hunting Network Activity with PowerShell
Hey everyone, here’s to another great week of PowerShell content! This is actually jam packed with a lot of big names in the community. Every week when I curate this newsletter, it always amazes me how much the community is churning out in great new tutorials, conversations, modules, meetups and more. Like I said last week, the PowerShell community is something really special.
Videos
PoshBytes: Encrypting Secrets with Protect-CmsMessage
Matthew Dowst demonstrates how to properly encrypt and decrypt secrets using Protect-CmsMessage without summoning eldritch IT beings. Stop sharing secrets in plain text and use PowerShell’s built-in CMS message protection like a pro.
BurntToast v1.0 and 10 Years of PowerShell Notifications with Josh King
The PowerShell Podcast features Andrew Pla’s longtime friend and PowerShell legend Josh King discussing BurntToast v1.0 and reflecting on a decade of PowerShell notifications. A must-listen for anyone interested in the evolution of PowerShell community tools.
PowerShell Parameter Binding Explained and Debugged with Microsoft’s Sean Wheeler
This week’s PowerShell Wednesday from PDQ (hosted by Andrew Pla) has a great video about how PowerShell determines which parameters to use for input values, explaining the process of parameter binding by type, name, and position, and showing how to troubleshoot it using the Trace-Command and a custom echoargs utility for native commands
Intro to PowerShell: Hunting Network Activity.
The Cyber Mentor has an interesting video on how to hunt for malicious activity by analyzing network artifacts on a Windows system using PowerShell, focusing on commandlets like Get-NetTCPConnection to correlate network activity with the underlying processes and uncover indicators of compromise (IOCs)
Community News
Building Event-Driven Automations in Microsoft 365 Using Graph Subscriptions
Brad Wyatt delivers an excellent walkthrough on how to leverage Microsoft Graph Subscriptions to create event-driven automation in Microsoft 365 without the need for constant polling. The post demonstrates creating real-time notifications for changes to Microsoft 365 resources like users, groups, and mailboxes, complete with practical examples of setting up Azure Functions to handle subscription notifications and validation requests. This approach significantly reduces API calls while maintaining responsive automation workflows.
Understanding the trap Statement in PowerShell
Patrick Gruenauer provides a comprehensive guide on using the trap statement for error handling in PowerShell scripts. The article explains how trap differs from traditional try-catch blocks and demonstrates practical examples of capturing terminating errors, logging issues, and cleaning up resources. Patrick covers the various actions available within trap blocks, including continue, break, return, and throw, making this essential reading for anyone looking to write more robust and reliable PowerShell automation.
https://sid-500.com/2025/11/04/understanding-the-trap-statement-in-powershell/
Zero-Touch Microsoft Connected Cache with Intune
Jose Schenardie presents an impressive solution for deploying Microsoft Connected Cache (MCC) nodes entirely through Autopilot and Intune, eliminating manual configuration steps. The article covers DOINC (Delivery Optimization In-Network Cache) which acts as a centralized cache node for Delivery Optimization on network segments, finally reaching General Availability after five years of development. Complete with detailed PowerShell scripts and deployment guidance, this solution is perfect for organizations looking to optimize Windows update delivery in cloud-native environments.
https://msendpointmgr.com/2025/11/06/zero-touch-microsoft-connected-cache-with-intune/
Toast Notification Script v3 is Here
Martin Bengtsson announces a complete rewrite of his popular Toast Notification Script, now built exclusively for Microsoft Intune Remediations. Version 3 brings enhanced logging, smart detection logic, personalized user greetings, and multiple notification scenarios perfect for weekly reminders, pending reboot notifications, Company Portal integration, and custom organizational messages. The script includes ready-to-use configuration examples and can be deployed immediately from the GitHub repository for immediate testing with hosted URLs.
https://www.imab.dk/big-announcement-toast-notification-script-v3-is-here/
Version 1.5 of the Microsoft 365 User Password and Authentication Report
Tony Redmond updates his popular authentication report to include the last used date for authentication methods, providing even more valuable insights into how users are accessing Microsoft 365. The enhanced PowerShell script now captures comprehensive data about authentication patterns, including Windows Hello for Business adoption rates, password usage, and multi-factor authentication methods. This update makes it easier for administrators to understand authentication trends and identify security gaps in their tenant.
https://office365itpros.com/2025/11/06/authentication-methods-graph-2/
Reporting the Use of Emojis in Teams Reactions
Tony Redmond presents an interesting approach to learning PowerShell and audit log analysis by creating a script that analyzes emoji usage in Teams reactions. The script extracts ReactedToMessage audit events from the unified audit log, translates user principal names to display names, and even displays the actual emoji graphics instead of just names. The article includes a complete hash table of approximately 80 Teams emojis and demonstrates how to export the data to Excel for further analysis, making audit data exploration more engaging and educational.
https://office365itpros.com/2025/11/07/teams-reactions-emojis/
PSPlaywright v0.1.0 Released
Adam Driscoll announces PSPlaywright, a new PowerShell module for browser automation using Microsoft Playwright. This module enables PowerShell users to automate web browsers for testing, web scraping, and end-to-end testing scenarios with support for Chromium, Firefox, and WebKit browsers. PSPlaywright brings the power of modern browser automation to PowerShell developers, opening up new possibilities for automated testing and web interaction directly from PowerShell scripts.
https://www.powershellgallery.com/packages/PSPlaywright/0.1.0
PowerShell Tab Title in Windows Terminal
Damir Arh demonstrates how to customize PowerShell tab titles in Windows Terminal to make it easier to identify multiple open tabs. The article provides practical examples of dynamically setting tab titles based on the current directory, active profile, or custom indicators, significantly improving workflow organization when working with numerous terminal sessions. This simple but effective technique helps prevent confusion when juggling multiple PowerShell sessions throughout the day.
https://www.damirscorner.com/blog/posts/20251031-PowerShellTabTitleInWindowsTerminal.html
Easy PowerShell Scripts for Windows Server 2025 Management
Andreas Hartig has a great article on powerful and useful PowerShell scripts to automate routine tasks and streamline Windows Server 2025 management, including examples for listing Domain Controllers, automating GPO reports, monitoring event logs and disk space, and managing updates and services https://hartiga.de/windows-server/powershell-scripts-windows-server-2025/.
https://hartiga.de/windows-server/powershell-scripts-windows-server-2025/
AzNetworkLatency v0.0.4 Module
Leo Visser from AutoSysOps releases an updated PowerShell module designed to determine network latency between two Azure regions. This practical tool helps Azure architects and administrators make informed decisions about resource placement and network topology by providing real-time latency measurements. The module is particularly useful for multi-region deployments where network performance between regions is critical for application responsiveness and user experience.
https://www.powershellgallery.com/Packages/AzNetworkLatency/0.0.4
Get My Things - Jeff Hicks
Jeff Hicks, in hisBehind the PowerShell Pipeline, has a good article about how to filter out PowerShell defaults to find user-defined items like variables and aliases, demonstrating how to create a new PowerShell instance with no profile or logo to capture the default state and then compare it to the current session’s state to identify customizations https://buttondown.com/behind-the-powershell-pipeline/archive/get-my-things/
Event Roundup
PSConfEU 2026 Call for Speakers The call for speakers is now open for PSConfEU 2026, taking place in Wiesbaden, Germany on June 1-4, 2026. Submission deadline is December 14, 2025.
https://sessionize.com/psconfeu26
Cliff Diving with PowerShell (And Other Bad Ideas) Pacific PowerShell User Group hosts Stephen Valdinger discussing what happens when you hand scripts to people without proper safety measures.
https://www.meetup.com/pacific-powershell-user-group/events/311873587/
PowerShell + DevOps Global Summit 2026 Save the date: April 13-17, 2026 in Bellevue, WA. The premier PowerShell community event returns next spring.
https://www.powershellsummit.org/