Quantcast
Channel: Category Name
Viewing all 1120 articles
Browse latest View live

Announcing PowerShell 7.0

$
0
0

Today, we’re happy to announce the Generally Available (GA) release of PowerShell 7.0! Before anything else, we’d like to thank our many, many open-source contributors for making this release possible by submitting code, tests, documentation, and issue feedback. PowerShell 7 would not have been possible without your help.

What is PowerShell 7?

For those unfamiliar, PowerShell 7 is the latest major update to PowerShell, a cross-platform (Windows, Linux, and macOS) automation tool and configuration framework optimized for dealing with structured data (e.g. JSON, CSV, XML, etc.), REST APIs, and object models. PowerShell includes a command-line shell, object-oriented scripting language, and a set of tools for executing scripts/cmdlets and managing modules.

Three years ago, we announced PowerShell Core 6 as a completely new edition of PowerShell. Built on top of .NET Core, PowerShell Core introduced cross-platform support across Windows, macOS, and Linux, SSH-based PowerShell Remoting, massively improved support for REST and JSON, official Docker containers, and more. Additionally, it was the first release of PowerShell made under an open-source license (MIT), encouraging long-time PowerShell enthusiasts and complete newcomers alike to contribute directly to the source code, tests, and documentation.

After three successful releases of PowerShell Core, we couldn’t be more excited about PowerShell 7, the next chapter of PowerShell’s ongoing development. With PowerShell 7, in addition to the usual slew of new cmdlets/APIs and bug fixes, we’re introducing a number of new features, including:

  • Pipeline parallelization with ForEach-Object -Parallel
  • New operators:
    • Ternary operator: a ? b : c
    • Pipeline chain operators: || and &&
    • Null coalescing operators: ?? and ??=
  • A simplified and dynamic error view and Get-Error cmdlet for easier investigation of errors
  • A compatibility layer that enables users to import modules in an implicit Windows PowerShell session
  • Automatic new version notifications
  • The ability to invoke to invoke DSC resources directly from PowerShell 7 (experimental)

For a more complete list of features and fixes, check out the PowerShell 7.0 release notes.

The shift from PowerShell Core 6.x to 7.0 also marks our move from .NET Core 2.x to 3.1. .NET Core 3.1 brings back a host of .NET Framework APIs (especially on Windows), enabling significantly more backwards compatibility with existing Windows PowerShell modules. This includes many modules on Windows that require GUI functionality like Out-GridView and Show-Command, as well as many role management modules that ship as part of Windows. For more info, check out our module compatibility table showing off how you can the latest, up-to-date modules that work with PowerShell 7.

If you weren’t able to use PowerShell Core 6.x in the past because of module compatibility issues, this might be the first time you get to take advantage of some of the awesome features we already delivered since we started the Core project!

Awesome! How do I get PowerShell 7?

First, check out our install docs for Windows, macOS, or Linux. Depending on the version of your OS and preferred package format, there may be multiple installation methods.

If you already know what you’re doing, and you’re just looking for a binary package (whether it’s an MSI, ZIP, RPM, or something else), hop on over to our latest release tag on GitHub.

Additionally, you may want to use one of our many Docker container images. For more information on using those, check out our PowerShell-Docker repo.

What operating systems does PowerShell 7 support?

PowerShell 7 supports the following operating systems on x64, including:

  • Windows 7, 8.1, and 10
  • Windows Server 2008 R2, 2012, 2012 R2, 2016, and 2019
  • macOS 10.13+
  • Red Hat Enterprise Linux (RHEL) / CentOS 7+
  • Fedora 29+
  • Debian 9+
  • Ubuntu 16.04+
  • openSUSE 15+
  • Alpine Linux 3.8+

Additionally, we support ARM32 and ARM64 flavors of Debian and Ubuntu, as well as ARM64 Alpine Linux.

While not officially supported, the community has also provided packages for Arch and Kali Linux.

If you need support for a platform that wasn’t listed here, please file a distribution request on GitHub (though it should be noted that we’re ultimately limited by what’s supported by .NET Core 3.1).

Wait, what happened to PowerShell “Core”?

Much like .NET decided to do with .NET 5, we feel that PowerShell 7 marks the completion of our journey to maximize backwards compatibility with Windows PowerShell. To that end, we consider PowerShell 7 and beyond to be the one, true PowerShell going forward.

PowerShell 7 will still be noted with the edition “Core” in order to differentiate 6.x/7.x from Windows PowerShell, but in general, you will see it denoted as “PowerShell 7” going forward.

Which Microsoft products already support PowerShell 7?

Any module that is already supported by PowerShell Core 6.x is also supported in PowerShell 7, including:

On Windows, we’ve also added a -UseWindowsPowerShell switch to Import-Module to ease the transition to PowerShell 7 for those using still incompatible modules. This switch creates a proxy module in PowerShell 7 that uses a local Windows PowerShell process to implicitly run any cmdlets contained in that module. For more information on this functionality, check out the Import-Module documentation.

For those modules still incompatible, we’re working with a number of teams to add native PowerShell 7 support, including Microsoft Graph, Office 365, and more.

Azure Cloud Shell has already been updated to use PowerShell 7, and others like the .NET Core SDK Docker container images and Azure Functions will be updated soon.

How is PowerShell 7 officially supported by Microsoft?

As with PowerShell Core, PowerShell 7 is a supported product for a wide range of customers with existing Microsoft support agreements.

With PowerShell 7, we’re moving to a support lifecycle whereby we match the lifecycle of the underlying .NET runtime that we distribute as part of PowerShell. This means that PowerShell 7.0 is a long-term servicing (LTS) release that will be supported for approximately 3 years from December 3, 2019 (the release date of .NET Core 3.1).

You can find more info about PowerShell’s support lifecycle at https://aka.ms/pslifecycle

What’s next for PowerShell?

We’re already hard at work on PowerShell 7.1, and you should expect its first preview soon, chock full of new features and bugfixes that didn’t quite make it into 7.0. Stay tuned for a more in-depth roadmap blog outlining our current investigations and desires for 7.1.

As noted above, we’re also moving to an annual release cadence in order to align better with .NET releases and their support lifecycle (with previews continuing to release roughly every month).

How can I give feedback on PowerShell 7?

For most issues directly related to PowerShell 7, start by filing an issue on the main PowerShell repository. For issues related to specific modules (e.g. PSReadline or PowerShellGet), make sure to file in the appropriate repository.

Thanks again!

Much appreciation to everyone involved in this release, from multi-time contributors all the way to those of you keeping up with our preview releases. We couldn’t have done it without you!

Joey Aiello
PM, PowerShell

The post Announcing PowerShell 7.0 appeared first on PowerShell.


Visual Studio Code for PowerShell 7

$
0
0

We are excited to announce that we have released a major update to the PowerShell extension for Visual Studio Code. This release contains months of architectural work that first shipped in our PowerShell Preview extension in November of 2019, along with incremental bug fixes in the intervening months. If you are new to Visual Studio Code this article is helpful for getting started. If you already use Visual Studio Code with the PowerShell extension, read on to find out what is new.

What’s new

ISE Compatibility Module

We took the documentation from our “How to replicate the ISE experience in Visual Studio Code” doc and turned it into a switch to make the process of using Visual Studio code more familiar for Windows PowerShell ISE users.

This work can largely be seen in:
vscode-PowerShell #2335
Add editor command PowerShell: Enable/Disable ISE Mode for ISE emulation in VS Code. (Thanks @Corbob)

Syntax Highlighting, Multi-Line Editing and Back Search in the Integrated Console

PSReadLine, the module that provides the powerful command line-editing experience you are used to in the PowerShell console
(including syntax highlighting, multi-line editing and, back search), is now available in the Visual Studio Code integrated console across all operating systems. Full PSReadLine support has long been at the top of our list for feature requests.
It has also been among our most difficult problems to solve because at its core it also required architectural changes in how the PowerShell extension manages threading and runspaces. The additional challenge of trying to support both legacy versions of PowerShell and a range of platform distributions has caused this problem to continually be delayed. In January of 2019 we released a Preview version of the PowerShell extension which was built on .NET Standard thereby enabling us to support PSReadLine in the integrated console for Windows users on PowerShell Version 5.1 and above.

With PowerShell 7 delivering a fix in .NET Core 3.1 for the way POSIX terminal APIs are handled when starting new processes, we are finally able to move the PSReadLine support currently available in the PowerShell Preview extension into the stable PowerShell extension with support across platform distributions.

This work can largely be seen in:
PowerShellEditorServices #672
PSReadLine integration (Thanks @SeeminglyScience!)

Performance Improvements

Our number one user request for the PowerShell editing experience in Visual Studio Code is to improve the stability of the editor and debugger. Long-standing constraints in the original design of the PowerShell extension made it difficult to improve its robustness through incremental changes. Instead, over a period of six months we prioritized work to re-architect the extension with an emphasis on stability. Omnisharp’s architecture is more robust meaning that bugs that might once have been crashes will now be caught and logged. By leveraging this library we were able to greatly simplify our code and are now more compliant with language server protocol.
Ultimately, we believe that these changes will significantly reduce the number crashes of the extension and improve the performance overall. Other features of the Omnisharp port include asynchronous message handling for increase in performance, CodeLens requests no longer depending on running PowerShell (greatly improving Intellisense responsiveness), and formatting handled directly by the language server.

This work can be seen in:
PowerShellEditorServices #1056
Re-architect PowerShell Editor Services to use the Omnisharp LSP platform.

Other features

A number of other features have been available in the PowerShell Preview extension that are now available in the PowerShell extension.

For a full list of changes see our detailed changelog.

Breaking Changes

Support for PSReadLine in the PowerShell extension Integrated Console depends on changes made in PSReadLine 2.0, which does not support PowerShell versions 3 and 4. In turn, we also made the difficult decision to no longer support PowerShell 3 and 4 in future updates of the extension. In making this decision we analyzed the use of these PowerShell versions and found that approximately 1% of PowerShell session in VSCode use one of these versions. In order to accommodate these use cases we will shipped a final stable version of the extension with PowerShell version 3 and 4 support which can continue to be used (2020.01). To use this version of the extension the user will still install the PowerShell extension through the VSCode marketplace. They will then need to use the extension settings to select their desired version.

This breaking change can be seen in:
PowerShellEditorServices #741
Migrate to netstandard2.0 and PSStandard

We also made the decision to close over a number of APIs that were not designed for public exposure.
For more detailed information on this decision check out PowerShellEditorServices #1183.

What’s going to happen to the Preview Extension?

Going forward we will use preview as a vNext of our stable extension, so a preview release will take bugfixes and become the next stable release. After this release we plan to continue to address other outstanding issues in the extension, and use the PowerShell Preview extension as a means of increasing our release cadence.

Feedback and Support

Once we make these releases we will continue to make investments in the PowerShell editing experience. If you encounter any issues with the PowerShell extension in Visual Studio Code or have feature requests, the best place to get support is through our GitHub repository.

Sydney Smith, Robert Holt, Tyler Leonhardt
PowerShell Team

The post Visual Studio Code for PowerShell 7 appeared first on PowerShell.

A new kind of GridView right in your console: Introducing the early preview of ConsoleGuiTools

$
0
0

Yes. This is yet another post about GridViews. We love them. You love them. What’s not to like?

If you’re not familiar with Out-GridView, it can be used to interactively view objects as a table allowing sorting and filtering. Many PowerShell users like to use it within a pipeline for interactive selection of objects that get processed later in the pipeline.

Let’s recap where we’re at with respect to GridViews:

Today, I have the exciting opportunity to talk about a new GridView.

Introducing the Microsoft.PowerShell.ConsoleGuiTools module now in Preview

The Microsoft.PowerShell.ConsoleGuiTools is a module that will contain a set of cmdlets that enable console-based GUIs. Today, it contains one very important cmdlet: Out-ConsoleGridView.

Get-Process | Out-ConsoleGridView

Out-ConsoleGridView screen

This shows up right in the same console window you were using without launching any outside process. This module leverages the incredibly powerful and cross-platform gui.cs library by Miguel de Icaza.

Oh yeah, it also supports -PassThru!

Get-ChildItem | Out-ConsoleGridView -PassThru

PassThru works

In that last gif, you might have also noticed that mouse clicks work in the Actions menu!

Installation

If you want to get this right now:

Install-Module Microsoft.PowerShell.ConsoleGuiTools

Features

PassThru

One of the most powerful features, the -PassThru parameter lets you use the GUI to select data to send further down the pipeline.

Get-Process | Out-GridView -PassThru | Stop-Process

If you were so inclined the above script uses -PassThru to create a pretty effective emulation of a Process Manger.

Mouse clicks and keyboard support

You can click on the actions menu, dialogs and grid view using your mouse.

You can also use your keyboard:

  • Spacebar: marks one of the items in the grid view with an x if you used the PassThru parameter
  • F9: opens the Action menu
  • ESC: closes the Action menu
  • Arrow keys: move around
  • ENTER: Choose an Action or answer a dialog

NOTE: At this time you can’t mark items in the grid view with mouse click. That will be available in the next version of gui.cs which will likely be the next version of ConsoleGuiTools

Azure Cloud Shell support

Azure Cloud Shell support

Since the Console GUIs (or CUIs) in Microsoft.PowerShell.ConsoleGuiTools show up in the same console you’re prompt is in, support for environments that don’t supply a GUI but have a terminal emulators, like Azure Cloud Shell, work out of the box.

In fact, the gif in this very blog post was recorded in Azure Cloud Shell!

This is Microsoft.PowerShell.ConsoleGuiTools differentiating feature to other Out-GridViews. It’s a GUI tool, without needing a GUI.

Install it in Cloud Shell and let us know what you think!

Limitations

Currently, the Microsoft.PowerShell.ConsoleGuiTools module works only on macOS and Linux due to a known gui.cs issue on Windows.

Since Windows has multiple other options for GridView’s we felt that this was a reasonable limitation for now.

The Future

The Microsoft.PowerShell.ConsoleGuiTools module is still in preview. We’re looking for your feedback to make sure we’re on the right track for supporting this. Please don’t hesitate to open issues and feature requests over in the GraphicalTools repo which is home to both the Microsoft.PowerShell.GraphicalTools module and the Microsoft.PowerShell.ConsoleGuiTools module.

We are looking for a community member to help port Show-Command and Show-Object to ConsoleGuiTools. Check out the repository and post in the issue tracking Show-Command if you’re interested.

With the majority of the brunt work integrating PowerShell & gui.cs done, we are also open to submissions for new graphical commands or packages.

The post A new kind of GridView right in your console: Introducing the early preview of ConsoleGuiTools appeared first on PowerShell.

Microsoft Endpoint Manager expands ecosystem of VPN partners to support customer needs

$
0
0

Many organizations believe data is protected when resources exist within the boundaries of their corporate networks. But in today's digital workplace, that boundary has expanded with managed mobile devices and resources and services in the cloud. Virtual private networks (VPNs) allow remote mobile workers to securely access your corporate resources using your line of business (LOB) applications and managed public applications.

 

With Microsoft Endpoint Manager, you can create a VPN connection profile to assign VPN settings to users and devices in your organization so they can easily and securely connect to your organizational network. Here’s a few different scenarios supported by Microsoft to secure the connection between remote mobile endpoints and your corporate network.

 

Scenario 1: Provide on-premises access to multiple apps from fully managed mobile devices

In this scenario, the user devices are enrolled in Microsoft Endpoint Manager. You can include VPN connection settings in a VPN profile. Then, you assign this profile to all users that require remote access from supported mobile devices. The users see the VPN connection in the list of available networks and can connect with minimal effort, or auto-connect depending on the scenario. As an example, many Microsoft customers create and deploy custom VPN profiles with VPN solutions such as NetMotion. 

 

NetMotion is a connectivity and security solutions company for the world’s growing mobile workforce. Using NetMotion’s class-leading VPN, customers not only gain uncompromised connectivity, they benefit from a VPN that is compatible with Windows, MacOS, Android and iOS devices. NetMotion mobile VPN software maintains resilient, reliable connections and optimizes performance through the most challenging wireless-network conditions.

 

Microsoft supports several other VPN solutions that you may already own, protecting your investment and enabling a flexible architecture for mobile access. Learn more

 

In addition, Microsoft Endpoint Manager enables network access control partners to keep their network and resources safe by blocking non-compliant or non-enrolled devices from accessing data and on-prem resources.  By integrating with Conditional Access, partner NAC solutions can also make intelligent access control decisions on criteria such as IP blacklisting, identity risk, etc.

 

Scenario 2: Provide on-premises access to web apps from non-enrolled devices

In the bring-your-own-device (BYOD) scenario, end users are not necessarily required to enroll their devices in Microsoft Endpoint Manager. They may access corporate data through web apps and productivity apps such as Office 365 from the public app stores. In this scenario, Azure Active Directory Application Proxy may be best suited to control who and what gets into your network. Azure AD Application Proxy integrates with modern authentication and cloud-based technologies, like SaaS applications and identity providers. This integration enables users to access apps from anywhere. You don't need to change or update your applications to work with Application Proxy. Furthermore, App Proxy doesn't require you to open inbound connections through your firewall. With Application Proxy, Azure AD keeps track of users who need to access web apps published on-premises and in the cloud. It provides a central management point for those apps. With Conditional Access, you further ensure only compliant devices and users have access to applications.

 

Learn more about Application Proxy for roaming (or remote) users who need access to internal resources

 

Scenario 3: Provide on-premises access to line of business apps from non-enrolled devices

BYOD devices that are not enrolled for management may also use a microVPN that is embedded with a specific app. In this scenario, Microsoft partners such as Citrix  ADC (formerly NetScaler) integrate with Microsoft Endpoint Manager MAM enabled apps, like managed Microsoft Edge for iOS and Android, to enable their microVPN technology.

 

Another key integration point is our partnership with Blue Cedar. While microVPNs can help you access data remotely, it is equally important to protect the data within the application from leakage. Blue Cedar not only help with their automated solutions to create a secure VPN micro tunnel from Microsoft MAM enabled apps, but also make integrating Microsoft security and data protection controls into enterprise mobile applications as simple as clicking a button. Enterprise teams can reduce the time needed to integrate Intune protection and security controls into mobile applications by an average of five weeks – not only for the original release of the app, but for every version update over the life of the app.

 

Not all apps may be able to be covered by Scenario 3 – such as a third party app from the public App Store that does not integate a microVPN.  In these cases, you have a couple of options. You may choose to require full management of BYO devices for VPN access. Alternatively, you may choose User Enrollment (on iOS) and Work Profile (on Android) to provision a VPN for corporate apps without needing to manage an employee’s full device.

 

Getting started

Microsoft is excited to expand the security ecosystem to support diverse customer needs. Here are some other resources to help you choose and deploy the right partner to deliver secure VPN access to mobile users

Secret Management Preview 2 Release

$
0
0

We are excited to release a second preview of the Secret Management Module. Thanks to the tremendous feedback we received from the first preview release of this module, you will notice a number of breaking changes to the module. This release is still a preview release meaning that it is not feature complete, future releases will face breaking changes, and we are still iterating based on your feedback. It is important to also note that this version of the module is still Windows only as we are currently implementing Linux support which we hope to make available in the next preview release (and MacOS support after). Please note that because of the breaking changes this release requires a complete replacement of the Secret Management module and any extension modules. Additionally, any existing built in local vault secret can no longer be retrieved and must be re-saved.

How to Install Secret Management Preview 2

If you did not install our first preview release, open any PowerShell console and run:

Install-Module Microsoft.PowerShell.SecretManagement -AllowPrerelease

If you installed our first preview release you will want to first remove any secrets from the LocalDefaultVault. Based on feedback we changed the naming convention for secrets stored in CredMan, therefore previous secrets stored in the local vault will no longer be visible after the new version of the module is installed. (Although the user can still view/remove the old secrets via CredMan UI.) Next you will want to run Uninstall-Module Microsoft.PowerShell.SecretsManagement, this extra step is a result of the change we made to the name of the module. Finally you can run the above command Install-Module Microsoft.PowerShell.SecretManagement -AllowPrerelease to install the latest preview release of the module.

Changes in Secret Management Preview 2

New Module Name

We have removed the plurality in the module name to Mirosoft.PowerShell.SecretManagement in order to be consistent with the cmdlet name and to align with PowerShell naming conventions.

New Cmdlet Names

In addition to renaming the module, we have also removed plurality in the cmdlets. The available cmdlets in the module are now:

# Registering extension vaults

Register-SecretVault
Get-SecretVault
Unregister-SecretVault
Test-Vault # new cmdlet in this release

# Accessing secrets

Set-Secret # this cmdlet replaces Add-Secret
Get-Secret
Get-SecretInfo
Remove-Secret

You will notice we renamed the Add-Secret cmdlet to be Set-Secret. This change was based on user feedback that this name better conveyed the intention of the cmldet.

You will also notice that we have added a Test-Vault cmdlet, this change allows vault extension owners to check that the vault is properly configured at registration time.

Other Changes

  • Set-Secret now has a default parameter set that takes SecureString secret input type. This way Set-Secret will always prompt safely for a SecureString. String secret types can still be passed via parameter or pipeline, but default will be SecureString.

PS> Set-Secret -Name MyStringToken

cmdlet Set-Secret at command pipeline position 1
Supply values for the following parameters:
SecureStringSecret: **********

# Set string secret directly
Set-Secret -Name MyStringToken -Secret $token
Set-Secret -Name MyStringToken -Secret 'MyToken'

# Set string secret via pipeline
$token | Set-Secret -Name MyStringToken -NoClobber

  • Added SecretInformation class used to return information from Get-SecretInfo in a uniform way.
  • Changed CredMan naming prefix to ps:SecretName.
  • Added vaultName to all vault extension functions.
  • Fixed additionalParameters parameter in SecretManagementExtension abstract classes.
  • Fixed return byte[] bug in example test script extension.

In coordination with these changes we have also updated our tests and example scripts.

Next Steps

As we move towards a GA release later this year, we are using a GitHub Milestone to track issues we plan to fix. The two major work items that we are currently working toward are:

  • Linux Support (via keyring)
  • MacOS Support (via keychain)

Support and Feedback

For support on the module, feedback, or reporting a bug, please open an issue in the PowerShell/modules repo with “(Secrets Management)” specified in the issue title.

Sydney Smith, PowerShell Team

 

 

The post Secret Management Preview 2 Release appeared first on PowerShell.

Helping businesses rapidly set up to work securely from personal PCs and mobiles

$
0
0

Enabling a remote workforce is no trivial challenge in the best of times, and it can seem especially daunting when rolling out during a global crisis. Luckily, there are some easy ways to start, so your employees can continue working as close as possible to how they worked back in the office. The goal is to minimize the learning curve, so people can stay productive when dealing with so many other changes. It is very important to avoid local storage of data so that any changes made during this extraordinary time are readily available when work shifts back to the office and work-based devices.  Once you take care of the immediate needs of your users, we can recommend some ways you can prepare the organization with a more comprehensive remote work infrastructure for the future.

 

If your organization uses Microsoft 365 or EMS E3 and above licenses, you may already have the technology needed to implement these recommendations. In this article, we’ll look at some easy wins that can be achieved with simple configuration changes from IT and minimal change in behavior of your workforce. In a future article, we will discuss a few more comprehensive changes to your remote work infrastructure.

 

Quickly set-up your users to work securely from their personal PCs and mobile devices

 

The first thing to consider is the devices people use when they work from home or other locations outside the office. Some of you may have already provided company-owned devices that are set up for remote access. Many people end up using their personal laptops, or sharing their home PCs, or even other mobile devices to access work files in this situation. The priority here is to make sure that only trusted and compliant devices have access to work files. You can achieve this quickly by turning on multi-factor authentication (MFA) and Conditional Access in Microsoft Endpoint Manager, powered by Azure Active Directory. Mobile users don’t necessarily have to enroll their personal devices, and we will see next how you can use application-level controls for secure access.

 

To help with change communications for end users, you can use the planning guides, user communication kits, and end-user enrollment videos available here as a starting point.

 

The next thing to consider is what applications people use remotely. Here, the priority is not only to make sure trusted and compliant applications are used, but also ensure a user experience that is familiar and friendly. Most people are familiar with Office 365 apps such as Outlook and Teams on their work machines. These apps contain built-in security controls so that data is not at-risk when it leaves your physical workplace boundaries. Microsoft Office 365 mobile and web apps are available at no additional cost with most Microsoft 365 and Office 365 subscriptions, further helping remote workers to be productive on their home PCs and mobile devices.

 

Using Conditional Access, you can direct end users to download trusted apps such as Microsoft Outlook, Microsoft Teams, Microsoft Edge, and the Office mobile app from iOS and Android public app stores. In the background, you can assign Intune App Protection Policies to these apps and keep work data safe by controlling or stopping sharing of work data outside the trusted apps. This provides application-level controls and compliance, while maintaining the familiar user experience for end users. In this case, users don’t even have to enroll their devices to start being productive. There is little to no impact on how they may be used to working with those apps. 

 

The third aspect to consider is ensuring data is stored in trusted and compliant locations after people access it. Intune app configuration policies can help you add a further layer of protection and business continuity by enabling a policy that requires files to only be saved to OneDrive for Business, not the local device or other cloud storage. Not only does that allow users to easily share and collaborate on the files, but helps prevent data leaks on non-managed devices and ensures that files are available in one place when people get back to the office. Depending on your needs, you could manage more device and data security options, like turning on BitLocker or enforcing password length, without interfering with users’ personal data, like family photos.

 

Helping your remote workforce provision new, business-ready devices

 

Once you take care of maintaining business continuity and productivity in the immediate term with our recommendations above, you can take a step back and enable other parts of your existing infrastructure to support remote work. For instance, if you need to provision a new laptop to a user, you can take advantage of Windows Autopilot to procure the new device from your OEM or reseller and have that device shipped directly to the user’s home. Upon power on and login, they will have a secure and encrypted device that has their business applications automatically installed and ready to work.

 

If you already have a virtualized environment or want to leverage one to provide remote access, especially to line-of-business apps, Windows Virtual Desktop enables users to get the Windows 10 Enterprise desktop or app experience on virtually any device, including mobile devices. Because the virtual apps and desktop reside in the Azure cloud, they are not bound by the potential limitations of home devices. Workers access them using a standard web browser and easily scale up their processing power. Virtualization also provides another option for helping you to make sure the remote access to apps and data remains secure.

 

Watch this space for more recommendations on preparing your organization with a more comprehensive remote work infrastructure for the future.

 

Videos and end user assets to help quickly roll-out a mobile workspace

 

Ready to get started? Here are some assets that provide more information on how to enable secure mobile productivity on any device:

 

  1. Manage Windows 10 and other mobile devices in your modern workplace
  2. Secure your workplace, including applications, identities, data, and the device itself

 

Successful adoption of remote work is about helping users to understand and embrace the new technology. It is a change in culture and mindset for many people, especially if they are new to this way of working. Proactively addressing user concerns about privacy and why your company needs to manage devices is critical to a successful rollout. Getting devices ready for remote work also creates change in end user experience. Here are some tools to help you to educate your users:

 

  1. Intune Adoption Kit - Email templates, posters, instruction videos and other guidance to help you plan communications for successful rollout
  2. Mobile device management (MDM) enrollment – End user instructions to help you roll-out faster at a global scale with minimal hand-holding for enrolling devices such as iOS, Android, Windows, and macOS.
  3. Understanding mobile application management (MAM) for non-enrolled BYOD devices

 

These are unprecedented times and we are here to help and share guidance so you can keep your employees connected. We continue to update our Microsoft 365 blog with guidance and learnings, please check frequently for more ideas and information: https://www.microsoft.com/en-us/microsoft-365/blog/

 

As always, we would love to hear your experiences with remote work; joys and tears, highs and lows. Join the conversation in our Remote Work Tech Community to share, engage and learn from experts.

 

Follow @MSIntune on Twitter

 

PowerShell 7.1 Team Investments and Preview.1 Release

$
0
0

The PowerShell 7 release marks a huge milestone for PowerShell, the community, and the team!

Today we released the first preview for PowerShell 7.1! This release includes a number of changes that did not make it in time for the 7.0 release. It also includes .NET 5 preview 1!

The PowerShell team is not resting on our laurels and are committed to continuous improvement of PowerShell as we plan out our 7.1 release. This blog post details the areas of investment that the PowerShell team is funding. As we’ve done in the past, we’ll also be working with contributors interested in implementing new features as part of the 7.1 release.

Release Cycle Changes

PowerShell Core 6.0 through PowerShell 7 was on a (roughly) 6 month release cadence.

Starting with PowerShell 7.0, we shifted to align with .NET’s release and support life-cycle more closely. This means we intend to ship 7.1 within a week or two of .NET 5’s release date of winter 2020 and align with their annual release cadence going forward.

Modules and Tooling for the 7.1 Release Time Frame

Not everything here is expected to ship with PowerShell 7.1, but the work is being done along with PowerShell 7.1 development.

PowerShellGet 3.0

At the beginning of PowerShell 7 development, we announced PowerShellGet 3.0. This is a complete rewrite of PowerShellGet covering 3 big areas:

  • Improving the user experience
  • Removing dependency on PackageManagement (and Nuget provider) making the codebase simpler and easier to maintain
  • Moving from PowerShell script to C# making it easier to maintain a large and complex codebase

Based on community feedback, we wanted to take an opportunity to address many of the user experience shortcomings with a major release that will have breaking changes. We also want to leverage learnings from popular package managers like apt (on Linux) to adopt conventions already used and proven by a large set of users.

PowerShellGet 3.0 will ship on PowerShell Gallery initially, with tentative plans to deliver it into PowerShell 7.x side-by-side with PowerShellGet 2.0.

The first preview is expected later this month!

Secret Management Module

We are still working on completing Secret Management module, specifically adding Linux support, possibly macOS support, and continuing to address user feedback.

We received lots of good feedback from our preview 1 release which helped shape our preview 2 release. Thanks so much and it shows that getting previews out early really helps the project!

This module is shipped via PowerShell Gallery supporting Windows PowerShell 5.1 and PowerShell 7 and potentially included by default with PowerShell 7.1. This module enables secure storage and retrieval of secrets locally as well as using extensions to store and retrieve secrets from remote vaults (like Azure Key Vault).

We are also working with partners to have vault extensions available soon!

VSCode-PowerShell, PSEditorServices, and PSScriptAnalyzer 2.0

The PowerShell extension for Visual Studio Code and PowerShell Editor Services rely on PSScriptAnalyzer to perform real-time linting as you author or edit a PowerShell script. However, this scenario was not part of the original intent nor design of PSScriptAnalyzer and thus has become a user experience where errors and corrections lag after the user input. Major portions of PSScriptAnalyzer needs to be updated or rewritten to significantly improve throughput to make the interactive user experience more instantaneous, delightful, and productive.

PowerShell Jupyter Kernel

Jupyter notebooks are gaining popularity as a way to have executable code and text content in the same document. There have been existing Jupyter kernels available that support PowerShell, however, we wanted to invest in this space with one that would be supported by the PowerShell team and providing a complete experience.

We’ve already shipped the first preview of our PowerShell sub-kernel that is part of the DotNet Interactive Jupyter kernel.

We will coontinue to improve this experience making it a great choice for PowerShell and Jupyter users.

platyPS vNext

PlatyPS is a PowerShell module that we currently use to convert PowerShell documentation from markdown to updatable-help and is available via PowerShell Gallery. Based on feedback from content authors and partner teams, we need to invest in this tool to improve the author experience as well as improving capabilities of our documentation. This will be a rewrite to support improved Markdown parsing, rendering, and fulfilling requirements for our internal pipelines to publish updateable help.

Themes for PowerShell 7.1

Installation and Updating

A major pain point for our customers, particularly on Windows, is that installing and updating PowerShell 7 requires too many manual steps. We are exploring some options to make it easier to install as well as keep PowerShell updated. At this time, we still do not have a plan to ship PowerShell 7 in Windows due to differences in support requirements that we are still working through.

Shell Improvements

Most native commands work just fine from within PowerShell, however, there are some cases where the argument parsing is not ideal (like handling quotes properly). The intent is to enable users to cut sample command lines for any popular native tool, paste it into PowerShell, and it just works without needing PowerShell specific escaping.

In addition, for advanced users that want to mix PowerShell specific concepts with native commands, things may not work as expected. For example, PSDrives are a great way to abstract a file path across operating systems, but only PowerShell cmdlets and scripts can use them. We want to explore how to expose these things to native commands.

Interactive User Experience

To enable users to be more productive at the shell, we want to enable two new scenarios:

  • Enable predictions: We are investigating how the community can author different prediction engines helping the user complete a pipeline with minimal typing.
  • Enable dynamic help: While authoring a pipeline in the console, the user should be able to get context aware help like presenting help on parameters as they are typing or get full help content without having to abandon their current input or open a new console.
  • Enable use of color: We added some additional use of color in PowerShell 7.0 to provide visual cues when scanning console output. For 7.1, we are working with the .NET System.CommandLine team to have appropriate APIs to decorate strings so that PowerShell can render them both with color as well as plain text, as needed. This includes addressing accessibility concerns where certain colors, themes, and decorations may be hard to see.

These experiences will require changes in both PSReadLine and the PowerShell engine itself.

We are also exploring some experiments such as Out-ConsoleGridView to make the console an even more productive experience.

Minimal PowerShell

One of the great things about PowerShell is the plethora of APIs and cmdlets you can use. However, the cost of this is that lots of assemblies are included with PowerShell just in case a script uses them. This works fine for authoring scripts, but when deploying scripts, it would be better to have your target only install the parts of PowerShell needed for those scripts. Not only would it take less disk space, but more importantly, a minimal set of code means less patching and security attack surface.

As part of this effort, we also want to split the monolithic Utility, Management, and Security modules that ship with PowerShell into logical modules that can be innovated and published on their own cadence.

Finally, to improve performance, we also want to look at reducing dependencies on .NET assemblies that are not absolutely needed to reduce memory usage as well as improve startup time.

Closing

As you can see, there is a lot of work we are current exploring and prototyping. Not everything will make it into the 7.1 release and may show up in a future release. As we make progress and have more concrete definitions and scope of the work, we will publish RFCs to get community feedback like we’ve done in the past. We will also leverage GitHub Projects to track progress and enable the community to provide feedback. I’m personally excited about the future of PowerShell and looking forward to seeing feedback on our plans!

Steve Lee
Principal Software Engineer Manager
PowerShell Team

The post PowerShell 7.1 Team Investments and Preview.1 Release appeared first on PowerShell.

Helping IT send and provision business PCs at home to work securely during COVID-19

$
0
0

With so many organizations shifting to remote work, our teams are helping customers daily to understand how to provision new and existing PCs at home. The previous article in this series discussed some ideas to enable personal PCs and shared devices to help businesses implement remote work. In this article, we want to help you ship new business PCs to employees and provision them out-of-the-box without manual set up or your technical support.

 

If, like many businesses we’re helping right now, you have never done this before, there are a few pre-requisites you may need to set up. For instance, these recommendations require a secure identity control-plane such as Azure Active Directory and device management tools such as Microsoft Endpoint Manager, a unified platform that includes Microsoft Intune and Configuration Manager. These tools are already available to you if you own Microsoft 365 E3 or EMS E3 and above licenses.  

 

We realize that many of you are heads-down helping your users successfully work from home while maintaining your own health and that of your loved ones. Before we begin, we want you to know that you are not alone. Whether you have prior experience with enabling remote work or are stepping up to a new challenge, you can count on several Microsoft resources to help you succeed, including access to Microsoft FastTrack experts and 24/7 technical support at no additional cost with most Microsoft 365 and EMS licenses.

 

Send computers directly to staff and remotely provision them with Windows Autopilot

 

Many organizations are procuring devices for end users who may not have a business-ready device at home. Using Windows Autopilot, you can procure a new device from an OEM or reseller and have that device shipped directly to the user’s home, then automatically provision the right settings, apps, and resource access upon power-on and login.

 

002 Autopilot.png

 

 

The process uses the Microsoft Endpoint Manager admin center to set up Windows Autopilot and ordering the PCs with instructions to send them right to employees’ homes. Windows Autopilot saves organizations the effort of having to maintain custom images and drivers for every model of device being used, transforming your existing Windows 10 installation to a “business-ready” state, applying settings and policies, installing apps and managing the devices from the cloud. The optimal guidance for businesses getting started with this is to use the user-driven Autopilot mode with automatic Intune enrollment after Azure AD join. If you have a different architecture, please visit product documentation or contact our specialists for guidance on supported capabilities and scenarios.

 

If you have the resources for your IT department to pre-provision the devices, you can use a feature known as Windows Autopilot for white glove deployment where the time-consuming portions are performed by IT, partners, or OEMs. The end user enters their credentials and within a few moments they can begin using their device. It's worth noting that white glove service may be an option to prepare Hybrid Azure AD joined devices, which currently requires physical access to the corporate network.  As long as you deploy the needed VPN client and settings (e.g. a machine certificate and VPN profile) during the white glove process, the end user will be able to establish a VPN connection to the corporate network when they get the machine at home, and can then sign in to the device.

This Windows Autopilot deployment process poster may help visualize the process.

 

Additional use cases for modern provisioning of Windows devices

 

Before we move on, I’d like to quickly call out a couple of other scenarios in which Windows Autopilot may help you. These may not apply to all organizations, but are valuable time-savers if you need them.

If you are looking to quickly provision kiosks or digital signs, such as if you are setting up pop-up locations to help with the pandemic response, the self-deploying mode in Windows Autopilot enables a device with an Internet connection to be deployed with little to no user interaction. When setting up a kiosk, you can leverage the new Kiosk Browser, an app built on Microsoft Edge that can be used to create a tailored, MDM-managed browsing experience. If you need additional licenses for these devices, you can save costs by assigning the device-only subscription since these devices are not associated with any user identity.

 

Another scenario is if you have existing Windows 7 and 8.1 machines currently managed by Configuration Manager, then you may be able to use Windows Autopilot to deploy the latest version of Windows 10 to your existing devices, and manage them from the cloud. The initial deployment may require access to the corporate network and actions by IT staff, which may be a good option to get all devices on deck during the crisis and then manage them remotely. Once deployed, the apps end users need for work can be automatically installed and their work profile is synchronized so they can resume working right away. Check out this video for a quick overview of this process.

 

Automated zero-touch enrollment for Apple and Android devices

 

Businesses and schools are scrambling to use every available device to empower remote workers, given the impact on global supply chain. In addition to Windows Autopilot, you can use Microsoft Endpoint Manager to pre-provision, deploy, and manage large number of Apple and Android devices without physically accessing them.

 

For instance, on iOS, iPadOS and macoS you can use Automated Device Enrollment with both Apple Business Manager and Apple School Manager.  When the end user receives the device and turns it on, Setup Assistant, which includes the typical out-of-box-experience for Apple products, runs with preconfigured settings and the device enrolls into management. Similarly, Intune supports large scale Android enrollment methods in Android Enterprise such as NFC, tokens, QR code, zero-touch, and so on. Using Intune with Samsung devices and Knox Mobile Enrollment, you can enroll large numbers of company-owned Android devices using Bluetooth or NFC when using the Knox Deployment App.

 

Protecting data when staff are working outside of their normal office environment

 

In the first part of this article, we looked at application-level compliance, which does not require devices to be enrolled and can be deployed relatively quickly. Many organizations may require more granular device controls to meet their security policies using device enrollment, also known as mobile device management (MDM). Several national cybersecurity agencies (for example, NCSC in UK, CISA in US, and ASD in Australia) have recommended MDM tools to set up devices with a standard configuration, and also to remotely lock devices, erase data, or retrieve a backup. Depending on your needs, you may support both enrolled and non-enrolled devices in your organization.

 

003 MDM MAM.png

 

 

With Microsoft Endpoint Manager, you can drive user adoption by directing users to enroll devices in MDM with a friendly message when they access email or other data from non-enrolled devices. Once they complete the process, you will have the ability to make sure devices encrypt data at rest and to protect data on the device if it is lost or stolen. Check out MDM enrollment options for different device types and device ownership scenarios.

 

Next steps: technical resources and communications planning

In our experience, successful adoption isn't just about distributing new, functional technology throughout your workforce. It is important to help employees understand the need for device management and enterprise mobility, and how in these difficult times it provides the necessary security benefits for both users and the organization. Without an explanation from you, some users might feel that you're infringing on their privacy. User concern for privacy increases when you deploy MDM tools for personal PCs and mobile devices.

 

Microsoft provides several tools and templates to assist you in educating end users.

  • The Intune Adoption Kit includes email templates, an Intune Enrollment guide, and instructional videos to aid end users in easily enrolling their devices in Intune.
  • If you are new to MDM and MAM roll-out, check out the tips and learning from previous experience in the end user education resources.
  • The planning guide walks you through the process of developing a deployment plan, creating a design, onboarding Intune, and conducting a production rollout.

 

Many customers take their first steps with Microsoft FastTrack, a unique service designed with one goal in mind: helping you get the most value out of your Microsoft 365 investment. Use your FastTrack Center Benefits with eligible subscriptions to work with Microsoft specialists to assess, remediate, enable, and drive user satisfaction with your Intune roll-out. You can get help through the Microsoft 365 admin center or the FastTrack site.

 

These are unprecedented times and we are here to help and share guidance so you can keep your employees connected. We continue to update our Microsoft COVID-19 Response resources with guidance and learnings, please check frequently for more ideas and information: https://news.microsoft.com/covid-19-response

 

As always, we would love to hear your experiences with remote productivity while maintaining a healthy social distance. Join the conversation in our Remote Work Tech Community to share, engage and learn from experts.

 

Follow @MSIntune on Twitter


PowerShellGet 3.0 Preview 1

$
0
0

We are excited to announce that our first preview release of PowerShellGet 3.0 is now available on the PowerShell Gallery. This is a major update to PowerShell’s experience for discovering, installing, updating and publishing PowerShell resources like modules, DSC resources, role capabilities and scripts. This was first proposed in RFC PR #185 and superseded by RFC PR #237. Thanks for all the community feedback! For a detailed view of the update to PowerShellGet please refer to the RFC.

This early preview release of the module is not feature complete and has breaking changes intended to improve the user experience. For this reason, the preview release will work side-by-side with your existing PowerShellGet v2 module.

The purpose of this release to begin gathering the critical user feedback to improve the module through subsequent preview releases before we finalize the design for General Availability later this year.

How to Install PowerShellGet 3.0 Preview 1

Prerequisites

Please ensure that you have the latest (non-prerelease) version of PowerShellGet and PackageManagement installed.
To check the version you currently have installed run the command:
Get-InstalledModule PowerShellGet, PackageManagement

The latest version of PowerShellGet is 2.2.3, and the latest version of PackageManagement is 1.4.6.

To install the latest versions of these modules run the following at the start of a fresh PowerShell session:

Install-Module PowerShellGet -Force -AllowClobber

Installing the Preview side by side

To install this preview release side-by-side with your existing PowerShellGet version,
open any PowerShell console and run:

Install-Module PowerShellGet -Force -AllowPrerelease

If you run the command Get-Command -ModuleName PowerShellGet you will get a good picture of the
side-by-side cmdlet interfaces.

CommandType     Name                                               Version    Source
-----------   ----                                              -------     ------
Function        Find-Command                                       2.2.3      PowerShel.
Function        Find-DscResource                                   2.2.3      PowerShel.
Function        Find-Module                                        2.2.3      PowerShel.
Function        Find-RoleCapability                                2.2.3      PowerShel.
Function        Find-Script                                        2.2.3      PowerShel.
Function        Get-InstalledModule                                2.2.3      PowerShel.
Function        Get-InstalledScript                                2.2.3      PowerShel.
Function        Get-PSRepository                                   2.2.3      PowerShel.
Function        Install-Module                                     2.2.3      PowerShel.
Function        Install-Script                                     2.2.3      PowerShel.
Function        New-ScriptFileInfo                                 2.2.3      PowerShel.
Function        Publish-Module                                     2.2.3      PowerShel.
Function        Publish-Script                                     2.2.3      PowerShel.
Function        Register-PSRepository                              2.2.3      PowerShel.
Function        Save-Module                                        2.2.3      PowerShel.
Function        Save-Script                                        2.2.3      PowerShel.
Function        Set-PSRepository                                   2.2.3      PowerShel.
Function        Test-ScriptFileInfo                                2.2.3      PowerShel.
Function        Uninstall-Module                                   2.2.3      PowerShel.
Function        Uninstall-Script                                   2.2.3      PowerShel.
Function        Unregister-PSRepository                            2.2.3      PowerShel.
Function        Update-Module                                      2.2.3      PowerShel.
Function        Update-ModuleManifest                              2.2.3      PowerShel.
Function        Update-Script                                      2.2.3      PowerShel.
Function        Update-ScriptFileInfo                              2.2.3      PowerShel.
Cmdlet          Find-PSResource                                    3.0.0      PowerShel.
Cmdlet          Get-PSResource                                     3.0.0      PowerShel.
Cmdlet          Get-PSResourceRepository                           3.0.0      PowerShel.
Cmdlet          Install-PSResource                                 3.0.0      PowerShel.
Cmdlet          Register-PSResourceRepository                      3.0.0      PowerShel.
Cmdlet          Set-PSResourceRepository                           3.0.0      PowerShel.
Cmdlet          Uninstall-PSResource                               3.0.0      PowerShel.
Cmdlet          Unregister-PSResourceRepository                    3.0.0      PowerShel.

High-Level Goals of PowerShellGet 3.0

PowerShellGet 3.0 is a complete re-write of PowerShellGet with the following goals:

  • Improve maintainability of the codebase: This goal is addressed by removing the provider model that PowerShellGet was originally built on. This means that PowerShellGet 3.0 does not take a dependency on OneGet, NuGet or any other package provider. Further, this version is written in C# instead of PowerShell script which has allowed us to simplify the code base. By using the lessons learned from previous versions of the module we hope that a cleaner implementation and interface will allow us to more quickly address bugs as they arise and iterate on our vNext issues more efficiently.
  • Address top customer issues. Many of the top customer issues in previous versions of the module have been challenging to resolve because of architecture decisions made early on in the development of PowerShellGet. Below we enumerate many of these issues we hope to resolve, to view a full enumeration of these issues view this GitHub query.

Features of this Release

  • A new set of cmdlets which abstract all PSResource types (Module, Script, DSCResource, RoleCapability, Command) to a single set of cmdlets which use the noun “PSResource”. Many of these cmdlets use a -Type parameter for the user to specify the PSResource type if they would like.
Find-PSResource
Get-PSResource 
Get-PSResourceRepository 
Install-PSResource 
Register-PSResourceRepository 
Set-PSResourceRepository 
Uninstall-PSResource 
Unregister-PSResourceRepository 
Update-PSResource 
SYNTAX 
Find-PSResource [[-Name] <string[]>] [-Type {Module | Script | DscResource | RoleCapability | Command}] [-Version <string>] [-Prerelease] [-ModuleName <string>] [-Tags <string[]>] [-Repository <string[]>] [-Credential <pscredential>] [-IncludeDependencies] [-WhatIf] [-Confirm] [<CommonParameters>] EXAMPLE Find-PSResource -Name PowerShellGet -Type Module -Prerelease
  • For the cmdlets Register-PSRepository and Set-PSRepository a -Priority parameter allows setting the search order of repositories with a lower value indicating a higher priority. If not specified, the default value is 50. The PSGallery, which is registered by default, has an editable value of 50. If two PSRepositories have the same priority the “Trusted” one will be chosen, if they also have the same level of trust the first one alphabetically will be selected.
  • For Find-PSResource the -Repository parameter supports wildcard search. If no repository is specified, the cmdlet will return the latest version found from the repository with the highest priority.
Find-PSResource Az.Sql -Repository *Name Version Repository Description
—- —————– ———–
Az.Sql 2.5.0 PSGallery Microsoft Azure PowerShell – SQL service cmdlets for Azure Resource…
Az.Sql 2.5.0 PoshTestGallery Microsoft Azure PowerShell – SQL service cmdlets for Azure Resource…

Find-PSResource Az.Sql

Name Version Repository Description
—- ——– ———- ———–
Az.Sql 2.5.0 PSGallery Microsoft Azure PowerShell – SQL service cmdlets for Azure Resource…

  • For Find-PSResource and Install-PSResource the -Version parameter will accept strings (with wildcard support) based on the Nuget version range syntax
Find-PSResource Microsoft.PowerShell.GraphicalTools -Version *

Name                                Version Repository Description
----                                ------- ---------- -----------
Microsoft.PowerShell.GraphicalTools 0.2.0   PSGallery  Cross-platform GUI Tools for Pow.
Microsoft.PowerShell.GraphicalTools 0.1.0   PSGallery  Cross-platform GUI Tools for Pow.

Find-PSResource Microsoft.PowerShell.GraphicalTools -Version "(0.0,1.0)"

Name                                Version Repository Description
----                                ------- ---------- -----------
Microsoft.PowerShell.GraphicalTools 0.2.0   PSGallery  Cross-platform GUI Tools for Pow.

Find-PSResource Microsoft.PowerShell.GraphicalTools -Version "0.1.1"

Name                                Version Repository Description
----                                ------- ---------- -----------
Microsoft.PowerShell.GraphicalTools 0.1.0   PSGallery  Cross-platform GUI Tools for Pow.
  • Install-PSResource has a-DestinationPath parameter which allows the user to specify the target directory instead of the default one. Note that in this release “x86” paths, and Linux paths are not yet supported. Expect to see this support in future releases.
  • Update-PSResource has an -UpdateTo parameter with values MinorVersion (the default), MajorVersion and, PatchVersion.
  • There is support for NuGet v2 and v3 endpoints for PSRepositories.

If any of the features on this list are not behaving how you would expect them to, or would prefer them to be sure to open an issue in our GitHub repository.

Table of Implemented Parameters in this Release

Cmdlet Implemented parameters Not implemented
Install-PSResource -Name

-Version

-Prerelease

-Repository

-Credential

-Scope

-Reinstall

-InputObject

-DestinationPath [partially implemented]

-NoClobber

-IgnoreDifferentPublisher

-TrustRepository

-Force [there hasn’t been a need for force yet since the things you would force aren’t implemented]

-Quiet

-AcceptLicense

-PassThru

Update-PSResource -Name

-Version

-Prerelease

-Credential

-Repository [Update should be discovering the repository from the xml metadata instead of from user input, this will be fixed in future releases]

-InputObject

-UpdateTo

-Force

-Quiet

-AcceptLicense

-PassThru

 

Find-PSResource -Name

-Type

-Version

– Prerelease

-ModuleName

-Tags

-Repository

-Credential

-IncludeDependencies

[Nothing]
Uninstall-PSResource -Name

-Version

-PrereleaseOnly

[Nothing]
Save-PSResource -Name

-Version

-Prerelease

-Repository

-Credential

-AsNupkg

-Path

-AcceptLicense
Get-PSResource -Name

-Version

-Prerelease
Register-PSResourceRepository -Name

-URL

-PSGallery

-Credential

-Trusted

-Priority

-Repositories

-Proxy[for any proxies other than the default proxy]

-ProxyCredential[see above regarding -Proxy]

 

Unregister-PSResourceRepository -Name [Nothing]
Get-PSResourceRepository -Name

-URL

-Credential

-Trusted

-Priority

-Repositories

-Proxy [for any proxies other than the default proxy]

-ProxyCredential [see above regarding -Proxy]

 

What’s Coming Next

Features to Expect in Coming Preview Releases

This module is not feature complete, meaning many issues/bugs in this release may just be features we have not finished implementing.
Below is a list of features that we are still in the process of implementing which you can expect to see in future preview releases.

  • Publish functionality (in the meantime the publish functionality of PowerShellGet2.x works nicely side-by-side)
  • Error handling, warnings, -Verbose, and -Debug parameters (for the full list of missing parameter see the table above).
  • Local cache–this important feature significantly improves the performance of Find/Install operations. Look forward to it in future releases.
  • Dependency management. In future releases, Install-PSResource will accept a path to a psd1 or json file (using -RequiredResourceFile), or a hash table or json (using -RequiredResource) where the key is the module name and the value is either the required version specified using Nuget version range syntax or a hash table where repository is set to the URL of the repository andversion contains the Nuget version range syntax.
Install-PSResource -RequiredResource @{ "Configuration" = "[1.3.1,2.0)" "Pester" = @{ version = "[4.4.2,4.7.0]" repository = "https://www.powershellgallery.com" credential = $cred allowPrerelease = $true } }

 

In this case the modules named “Configuration”, and “Pester” will be installed.
The JSON format will be the same as if this hashtable is passed to ConvertTo-Json:

{ "Configuration": "[1.3.1,2.0)", "Pester": { "version": "[4.4.2,4.7.0]", "credential": null, "repository": "https://www.powershellgallery.com", "allowPrerelease": true } }
  • We will introduce a New-RequiredResourceFile cmdlet which will create a template file.
    If the switch -AsPSD1 is used it will create a psd1 file, otherwise it will default to JSON.
  • Save-PSResource -Type Library will download nupkgs that have a lib folder. The dependent native library in runtimes matching the current system runtime will be copied to the root of the destination specified. A -IncludeAllRuntimes can be used to explicitly retain the runtimes directory hierarchy within the nupkg to the root of the destination.
  • Native credential management/credential persistence for registered PSRepositories

Improvements we are Considering Post-GA

One important goal of PowerShellGet 3.0 is to improve the supportability of the module. As a result, once this work is complete,we hope to iterate more quickly, and tackle other top customer issues. This list represents issues we are considering tackling but have not committed to yet.

  • We will explore automatic updating of the cache in which on any operation that reaches out to a repository, a REST API will be called to see if the hash of the cache matches the current cache and if not, a new one is downloaded. This system may also take into consideration how recently the cache has been updated to avoid constant updates.
  • We will explore an Enable-PowerShellGetAlias cmdlet that will allow users to use known cmdlets like Install-Module from the PowerShellGet 3.0 implementation.
  • We will explore uninstalling orphaned dependencies automatically.

To track the full list of issues we are considering we are using the label vNext in our GitHub Repository.

How to Track the Development of this Module

GitHub is the best place to track the bugs/feature requests related to this module. We have used a combination of projects and labels on our GitHub repo to track issues for this upcoming release. We are using the label Resolved-3.0 to label issues that we plan to release at some point in before we release the module as GA (generally available). To track issues/features to particular preview and GA releases we are using GitHub projects which are titled to reflect the release.

Please note that PowerShell/PowerShellGet now represents the codebase for PowerShellGet 3.0. If you are looking for the source code, or issues related to previous versions of PowerShellGet, use PowerShell/PowerShellGetV2.

Timeline/Roadmap

Expect to see preview releases as new functionality is added/changes are made at approximately a monthly cadence until the module is feature-complete. Through this process we will also be adapting the module based on user feedback. Once we feel we have reached a sufficient quality and completeness, we will release a “Release Candidate” version of the module. Assuming this release does not require any high impact changes, we will then release that version of the module as “Generally Available”. Since these milestones are quality, rather than date, driven we can not offer an exact timeline at this point, but hope to release the module later this year.

How to Give feedback and Get Support

We cannot overstate how critical user feedback is at this stage in the development of the module. Feedback from preview releases help inform design decisions without incurring a breaking change once generally available and used in production. In order to help us to make key decisions around the behavior of the module please give us feedback by opening issues in our GitHub repository.

Sydney Smith
PowerShell Team

The post PowerShellGet 3.0 Preview 1 appeared first on PowerShell.

Manage work devices at home during Covid-19 using Configuration Manager

$
0
0

Many organizations have already allowed or are beginning to allow corporate PCs and laptops to be taken home to work remotely. By current expert estimates, the COVID-19 pandemic may result in people working from home for an extended time. Millions of these PCs are currently being managed using on-premises tools such as Configuration Manager. When these devices are no longer on-premises and are not expected to “check in” to the corporate network for weeks, how do you ensure they remain managed and up-to-date?

 

Previous articles in this series discussed some ideas to enable personal PCs and pre-provision new business PCs for remote users. Now let’s talk about how you can manage work devices being used remotely to maintain their health and security using Configuration Manager and the Microsoft cloud.

 

Who should read this article?

 

This article will help IT decision makers and Configuration Manager administrators who currently manage a mostly on-premises PC management infrastructure and now have a need for cloud management. You’ll see how to apply automation and intelligence in Microsoft cloud to your existing infrastructure. The tools discussed in this article may already be available to you if you own Microsoft 365 E3 or EMS E3 and above licenses. 

 

This is not meant to be an exhaustive guide but will help you enable users in a consistent and unified way, irrespective of their physical location.

 

Using Configuration Manager? Enable support for remote workers with co-management

 

The global health crisis has made many businesses look for ‘easy wins’ in the cloud to complement their existing device management infrastructure. Configuration Manager and Microsoft Intune are now a part of a single solution called Microsoft Endpoint Manager. With this change, organizations that are currently using on-premises Configuration Manager are able to use Intune cloud services to co-manage Windows 10 devices without additional licensing costs. Co-management may be an attractive technology for devices managed by Configuration Manager that are no longer on-premises and are not expected to “check in” to the corporate network for weeks. Use this co-management tutorial to understand the pre-requisites and implement hybrid Azure AD and Configuration Manager client configurations as you prepare to enable co-management of your Windows 10 devices.  

 

Benefits of adding cloud management to Configuration Manager right away

 

This approach has several benefits for you to manage the additional demands on IT due to Coronavirus response.  

 

Firstly, co-management adds the ability for you to use Intune cloud services to manage remote devices, while concurrently managing them from on-premises Configuration Manager servers. You may choose to stay in co-management for as long as you want and still gain intelligence from the Microsoft 365 cloud to your day-to-day work. For example:

  • deploy updates faster so that you can make your organization more secure and compliant
  • take immediate actions on all your devices from a unified web console – whether managed on-premises or natively in the cloud
  • completely automate your compatibility testing when upgrading to a new release of Windows

 

Cybersecurity is another vital consideration when devices roam outside the physical corporate boundary. With co-management, you gain the important benefit of Conditional Access for PCs. Conditional Access makes sure that only trusted users can access organizational resources on trusted devices using trusted apps. This not only helps protect remote workers but also protects the corporate network from being disrupted by an infected machine. Conditional Access combines granular control over organizational data with a user experience that maximizes worker productivity on any device, from any location. With Conditional Access, you can determine  if a device is encrypted, if malware is detected, if device settings are updated, and if mobile devices are jailbroken or rooted.   

 

To secure co-managed remote work devices, we recommend enabling Conditional Access right away. Over time, you can decide which other Configuration Manager tasks you feel comfortable moving to the cloud. One of the benefits of co-management is that you control which workloads you switch from Configuration Manager to Intune.

 

Additionally, the cloud management gateway (CMG) provides a simple way to manage Configuration Manager clients on the internet. By deploying the CMG as a cloud service in Microsoft Azure, you can manage traditional clients that roam out of your physical location without additional on-premises infrastructure. You also don't need to expose your on-premises infrastructure to the internet. Adding the power of the cloud management gateway to Microsoft Endpoint Manager will set you up with a robust long-term remote work infrastructure. Rob York recently published an article about managing remote machines using cloud management gateway (CMG) in Configuration Manager.

 

Several reputed cybersecurity agencies (for example, NCSC in UK, CISA in US, and ASD in Australia) have recommended MDM tools to set up devices with a standard configuration, and also to remotely lock devices, erase data, or retrieve a backup. With Microsoft Endpoint Manager, once you enable co-management, you have a single policy authoring console to standardize your security policies, device configurations, and app settings across all your endpoints. Using powerful tools such as the Security baselines in Microsoft Intune, you can apply a known group of settings and default values that are recommended by our security experts. If you currently use group policy, migrating to Intune for management is much easier with these baselines since they are natively built into Intune and include a modern management experience. You can quickly create and deploy a secure profile, knowing that you're helping protect your organization's resources and data.

 

Next steps  

 

If you happen to be a customer that is not using Configuration Manager to manage your Windows devices, moving straight to Microsoft Intune will greatly increase your ability to manage remote devices during this crisis.  If you are using Configuration Manager, this is the right time to take action and use the combined power of cloud insights with Microsoft Intune to keep business data safe while helping people keep working productively from home. In both cases, you should not think about ConfigMgr and Intune as separate offerings, but within the continuum of Microsoft Endpoint Manager.

 

Many customers take their first steps with Microsoft FastTrack, a unique service designed with one goal in mind: helping you get the most value out of your Microsoft 365 investment. Use your FastTrack Center Benefits with eligible subscriptions to work with Microsoft specialists to assess, remediate, enable, and drive user satisfaction with your Intune roll-out. You can get help through the Microsoft 365 admin center or the FastTrack site.

 

These are unprecedented times and we are here to help and share guidance so you can keep your employees connected. We continue to update our Microsoft COVID-19 Response resources with guidance and learnings, please check frequently for more ideas and information: https://news.microsoft.com/covid-19-response

 

As always, we would love to hear your experiences with remote productivity while maintaining a healthy social distance. Join the conversation in our Remote Work Tech Community to share, engage and learn from experts.

 

Follow @MSIntune on Twitter

Azure Active Directory Premium P1 is coming to Microsoft 365 Business!

$
0
0

Microsoft 365 Business is the comprehensive productivity and security solution for businesses with less than 300 employees. It integrates your favorite Office apps and collaboration tools including Microsoft Teams with advanced security and device management capabilities.

 

We are excited to announce the addition of the full Azure Active Directory Premium P1 license to the Microsoft 365 Business subscription. This addition brings powerful new capabilities to help small and mid-sized businesses transition to secure remote work and helps employees maintain secure access to work apps- whether they’re at home or on the go.

 

Read Azure Active Directory Premium P1 is coming to Microsoft 365 Business! to get all the details.

Azure ATP now detects SMBGhost

$
0
0

This post is authored by Mor Rubin, Security Researcher, Azure ATP.

 

The SMB vulnerability CVE-2020-0796, also known as “SMBGhost” or “CoronaBlue”, was published a few days ago. This CVE is about a potential remote code execution due to a buffer overflow vulnerability in the way SMBv3 (3.1.1) handles SMBv2 compression requests. The vulnerability affects Windows 10 and Windows Server 2019 versions 1903 and 1909.

 

A few proofs of concept that trigger this vulnerability have been published already – one them on GitHub. So far, the tools published online are expected to cause a “blue screen” if the target Windows server is vulnerable to this issue. As most of the critical servers in an organization are Windows servers, attackers will exploit this vulnerability to try to gain control of the remote servers without authenticating.

 

The vulnerability has the potential to become widely spread, similar to the way EternalBlue exploited the SMB protocol in 2017. It’s important to protect critical Windows servers by installing a patch, KB4551762, or following other suggested mitigations and workarounds.

 

In addition, to help our customers stay secure, we are releasing a new Azure ATP detection that looks for use of this vulnerability on unpatched Domain Controllers. The detection identifies crafted packets attempting to exploit SMBv3.

 

Get Started Today

Azure ATP leverages your Active Directory signals, the cloud intelligence underpinning all Microsoft’s security services, and identity-focused detections updated at cloud scale to prevent, detect, and investigate identity-based threats, compromised and malicious users, and lateral movement of on-premises attacks.

 

Depending on the right PowerShell NuGet package in your .NET project

$
0
0

Alongside the pwsh executable packages published with each PowerShell release, the PowerShell team also maintain several NuGet packages that are available on NuGet to allow targeting PowerShell as an API platform in .NET.

As a .NET application that both provides APIs and expects to load .NET libraries implementing its own (binary modules), it’s essential that PowerShell be available in the form of a NuGet package.

Currrently there are several NuGet packages that provide some representation of the PowerShell API surface area, and which to use with a particular project hasn’t always been made clear. This blog post will shed some light on a few common scenarios for PowerShell-targeting .NET projects and how to choose the right NuGet package to target for your PowerShell-oriented .NET project.

Hosting vs referencing

Some .NET projects seek to write code to be loaded into a pre-existing PowerShell runtime (such as pwsh, powershell.exe, the PowerShell Integrated Console or the ISE), while others want to run PowerShell in their own applications.

  • Referencing is for when a project, usually a module, is intended to be loaded into PowerShell. It must be compiled against the APIs that PowerShell provides in order to interact with it, but the PowerShell implementation is supplied by the PowerShell process loading it in. For referencing, a project can use reference assemblies or the actual runtime assemblies as a compilation target, but must ensure that it does not publish any of these with its build.
  • Hosting is when a project needs its own implemenation of PowerShell, usually because it is a standalone application that needs to run PowerShell. In this case, pure reference assemblies cannot be used, and instead a concrete PowerShell implementation must be depended upon. Because a concrete PowerShell implementation must be used, a specific version of PowerShell must be chosen for hosting; a single host application cannot multi-target PowerShell versions.

Publishing projects that target PowerShell as a reference

NOTE: We use the term publish in this blog post to refer to running dotnet publish, which places a .NET library into a directory with all of its dependencies, ready for deployment to a particular runtime.

In order to prevent publishing project dependencies that are just being used as compilation reference targets, it is recommended to set the PrivateAssets attribute:

<PackageReference Include="PowerShellStandard.Library" Version="5.1.0.0" PrivateAssets="all" />

If you forget to do this and use a reference assembly as your target, you may see issues related to using the reference assembly’s default implementation instead of the actual implementation. This may take the form of NullReferenceExceptions, since reference assemblies often mock the implementation API by simply returning null.

Key kinds of PowerShell-targeting .NET projects

While any .NET library or application can embed PowerShell, there are some common scenarios that use PowerShell APIs:

  • Implementing a PowerShell binary module PowerShell binary modules are .NET libraries loaded by PowerShell that must implement PowerShell APIs like the PSCmdlet or CmdletProvider types in order to expose cmdlets or providers respectively. Because they are loaded in, modules seek to compile against references to PowerShell without publishing it in their build. It’s also common for modules to want to support multiple PowerShell versions and platforms, ideally with a minimum of overhead of disk space, complexity or repeated implementation. (See about_Modules for more information about modules.)
  • Implementing a PowerShell Host A PowerShell Host provides an interaction layer for the PowerShell runtime. It is a specific form of hosting, where a PSHost is implemented as a new user interface to PowerShell. For example, the PowerShell ConsoleHost provides a terminal user interface for PowerShell executables, while the PowerShell Editor Services Host and the ISE Host both provide an editor-integrated partially graphical user interface around PowerShell. While it’s possible to load a host onto an existing PowerShell process, it’s much more common for a host implementation to act as a standalone PowerShell implementation that redistributes the PowerShell engine.
  • Calling into PowerShell from another .NET application As with any application, PowerShell can be called as a subprocess to run workloads. However, as a .NET application, it’s also possible to invoke PowerShell in-process to get back full .NET objects for use within the calling application. This is a more general form of hosting, where the application holds its own PowerShell implementation for internal use. Examples of this might be a service or daemon running PowerShell to manage machine state or a web application that runs PowerShell on request to do something like manage cloud deployments.
  • Unit testing PowerShell modules from .NET While modules and other libraries designed to expose functionality to PowerShell should be primarily tested from PowerShell (we recommend Pester), sometimes it’s necessary to unit test APIs written for a PowerShell module from .NET. This situation involves the module code trying to target a number of PowerShell versions, while testing should run it on specific, concrete implementations.

PowerShell NuGet packages at a glance

In this blog post, we’ll cover the following NuGet packages that expose PowerShell APIs:

  • PowerShellStandard.Library, a reference assembly that enables building a single assembly that can be loaded by multiple PowerShell runtimes.
  • Microsoft.PowerShell.SDK, the way to target and rehost the whole PowerShell SDK
  • The System.Management.Automation package, the core PowerShell runtime and engine implementation, that can be useful in minimal hosted implementations and for version-specific targeting scenarios.
  • The Windows PowerShell reference assemblies, the way to target and effectively rehost Windows PowerShell (PowerShell versions 5.1 and below).

NOTE: The PowerShell NuGet package is not a .NET library package at all, but instead provides the PowerShell dotnet global tool implementation. This should not be used by any projects, since it only provides an executable.

PowerShellStandard.Library

The PowerShell Standard library is a reference assembly that captures the intersection of the APIs of PowerShell versions 7, 6 and 5.1. This provides a compile-time-checked API surface to compile .NET code against, allowing .NET projects to target PowerShell versions 7, 6 and 5.1 without risking calling an API that won’t be there.

PowerShell Standard is intended for writing PowerShell modules, or other code only intended to be run after loading it into a PowerShell process. Because it is a reference assembly, PowerShell Standard contains no implementation itself, so provides no functionality for standalone applications.

Using PowerShell Standard with different .NET runtimes

PowerShell Standard targets the .NET Standard 2.0 target runtime, which is a fa???ade runtime designed to provide a common surface area shared by .NET Framework and .NET Core. This allows targeting a single runtime to produce a single assembly that will work with multiple PowerShell versions, but has the following consequences:

  • The PowerShell loading the module or library must be running a minimum of .NET 4.6.1; .NET 4.6 and .NET 4.5.2 do not support .NET Standard. Note that a newer Windows PowerShell version does not mean a newer .NET Framework version; Windows PowerShell 5.1 may run on .NET 4.5.2.
  • In order to work with a PowerShell running .NET Framework 4.7.1 or below, the .NET 4.6.1 NETStandard.Library implemenation is required to provide the netstandard.dll and other shim assemblies in older .NET Framework versions.

PowerShell 6+ provides its own shim assemblies for type forwarding from .NET Framework 4.6.1 (and above) to .NET Core. This means that as long as a module uses only APIs that exist in .NET Core, PowerShell 6+ can load and run it when it has been built for .NET Framework 4.6.1 (the net461 runtime target).

This means that binary modules using PowerShell Standard to target multiple PowerShell versions with a single published DLL have two options:

  1. Publishing an assembly built for the net461 target runtime. This involves:
    • Publishing the project for the net461 runtime
    • Also compiling against the netstandard2.0 runtime (without using its build output) to ensure that all APIs used are also present in .NET Core.
  2. Publishing an assembly build for the netstandard2.0 target runtime. This requires:
    • Publishing the project for the netstandard2.0 runtime
    • Taking the net461 dependencies of NETStandard.Library and copying them into the project assembly’s publish location so that the assembly is type-forwarded corrected in .NET Framework.

Note that to build PowerShell modules or libraries targeting older .NET Framework versions, it may be preferable to target multiple .NET runtimes. This will publish an assembly for each target runtime, and the correct assembly will need to be loaded at module load time (for example with a small psm1 as the root module).

Testing PowerShell Standard projects in .NET

When it comes to testing your module in .NET test runners like xUnit, remember that compile-time checks can only go so far, so you must test your module against the relevant PowerShell platforms.

To test APIs built against PowerShell Standard in .NET, you should add Microsoft.PowerShell.SDK as a testing dependency with .NET Core (with the version set to match the desired PowerShell version), and the appropriate Windows PowerShell reference assemblies with .NET Framework.

For more information on PowerShell Standard and using it to write a binary module that works in multiple PowerShell versions, see this blog post. Also see the PowerShell Standard GitHub repository.

Microsoft.PowerShell.SDK

Microsoft.PowerShell.SDK is a meta-package that pulls together all of the components of the PowerShell SDK into a single NuGet package. A self-contained .NET application can use Microsoft.PowerShell.SDK to run arbitrary PowerShell functionality without depending on any external PowerShell installations or libraries.

NOTE: The PowerShell SDK just refers to all the component packages that make up PowerShell, and which can be used for .NET development with PowerShell.

A given Microsoft.PowerShell.SDK version contains the concrete implementation of the same version of the PowerShell application; version 7.0 contains the implementation of PowerShell 7.0 and running commands or scripts with it will largely behave like running them in PowerShell 7.0.

Running PowerShell commands from the SDK is mostly, but not totally, the same as running them from pwsh; for example, Start-Job currently depends on the pwsh executable being available, and so will not work with Microsoft.PowerShell.SDK by default.

Targeting Microsoft.Powershell.SDK from a .NET application allows you to integrate with all of PowerShell’s implementation assemblies, such as System.Management.Automation, Microsoft.PowerShell.Management and other module assemblies.

Publishing an application targeting Microsoft.PowerShell.SDK will include all these assemblies, along with any dependencies PowerShell requires, as well as other assets that PowerShell requires in its build such as the module manifests for Microsoft.PowerShell.* modules and the ref directory required by Add-Type.

Given the completeness of Microsoft.PowerShell.SDK, it’s best suited for:

  • Implementation of PowerShell hosts.
  • xUnit testing of libraries targeting PowerShell reference assemblies.
  • Invoking PowerShell in-process from a .NET application.

Microsoft.PowerShell.SDK may also be used as a reference target when a .NET project is intended to be used as a module or otherwise loaded by PowerShell, but depends on APIs only present in a particular version of PowerShell. Note that an assembly published against a specific version of Microsoft.PowerShell.SDK will only be safe to load and use in that version of PowerShell; to target multiple PowerShell versions with specific APIs, multiple builds are required, each targeting their own version of Microsoft.PowerShell.SDK.

NOTE: The PowerShell SDK is only available for PowerShell versions 6 and up. To provide equivalent functionality with Windows PowerShell, use the Windows PowerShell reference assemblies described below.

System.Management.Automation

The System.Management.Automation package is the heart of the PowerShell SDK and exists on NuGet chiefly as an asset for Microsoft.PowerShell.SDK to pull in. However, it can also be used directly as a package for smaller hosting scenarios and version-targeting modules.

Specifically, the System.Management.Automation package may be a preferable provider of PowerShell functionality when:

  • You’re only looking to use PowerShell language functionality (in the System.Management.Automation.Language namespace) like the PowerShell parser, AST and AST visitor APIs (for example for static analysis of PowerShell).
  • You only wish to execute specific commands from the Microsoft.PowerShell.Core module and can execute them in a session state created with the CreateDefault2 factory method.

Additionally, System.Management.Automation is a useful reference assembly when:

  • You wish to target APIs that are only present within a specific PowerShell version
  • You won’t be depending on types occurring outside the System.Management.Automation assembly (for example, types exported by cmdlets in Microsoft.PowerShell.* modules).

Windows PowerShell reference assemblies

For PowerShell versions 5.1 and older (Windows PowerShell), there is no SDK to provide an implementation of PowerShell, since Windows PowerShell’s implementation is a part of Windows.

Instead, the Windows PowerShell reference assemblies provide both reference targets and a way to rehost Windows PowerShell, acting the same as the PowerShell SDK does for versions 6 and up.

Rather than being differentiated by version, Windows PowerShell reference assemblies have a different package for each version of Windows PowerShell:

Information on how to use the Windows PowerShell reference assemblies can be found here.

Real-world examples using these NuGet packages

Different PowerShell tooling projects target different PowerShell NuGet packages depending on their needs. Listed here are some notable examples.

PSReadLine

PSReadLine, the PowerShell module that provides much of PowerShell’s rich console experience, targets PowerShell Standard as a dependency rather than a specific PowerShell version, and targets the net461 .NET runtime in its csproj.

PowerShell 6+ supplies its own shim assemblies that allow a DLL targeting the net461 runtime to “just work” when loaded in (by redirecting binding to .NET Framework’s mscorlib.dll to the relevant .NET Core assembly).

This simplifies PSReadLine’s module layout and delivery significantly, since PowerShell Standard ensures the only APIs used will be present in both PowerShell 5.1 and PowerShell 6+, while also allowing the module to ship with only a single assembly.

The .NET 4.6.1 target does mean that Windows PowerShell running on .NET 4.5.2 and .NET 4.6 is not supported though.

PowerShell Editor Services

PowerShell Editor Services (PSES) is the backend for the PowerShell extension for Visual Studio Code, and is actually a form of PowerShell module that gets loaded by a PowerShell executable and then takes over that process to rehost PowerShell within itself while also providing Language Service Protocol and Debug Adapter features.

PSES provides concrete implementation targets for netcoreapp2.1 to target PowerShell 6+ (since PowerShell 7’s netcoreapp3.1 runtime is backwards compatible) and net461 to target Windows PowerShell 5.1, but contains most of its logic in a second assembly that targets netstandard2.0 and PowerShell Standard. This allows it to pull in dependencies required for .NET Core and .NET Framework platforms, while still simplifying most of the codebase behind a uniform abstraction.

Because it is build against PowerShell Standard, PSES requires a runtime implementation of PowerShell in order to be tested correctly. To do this, PSES’s xUnit tests pull in Microsoft.PowerShell.SDK and Microsoft.PowerShell.5.ReferenceAssemblies in order to provide a PowerShell implementation in the test environment.

As with PSReadLine, PSES cannot support .NET 4.6 and below, but it performs a check at runtime before calling any of the APIs that could cause a crash on the lower .NET Framework runtimes.

PSScriptAnalyzer

PSScriptAnalyzer, the linter for PowerShell, must target syntactic elements only introduced in certain versions of PowerShell. Because recognition of these syntactic elements is accomplished by implementing an AstVisitor2, it’s not possible to use PowerShellStandard and also implement AST visitor methods for newer PowerShell syntaxes.

Instead, PSScriptAnalyzer targets each PowerShell version as a build configuration, and produces a separate DLL for each of them. This increases build size and complexity, but allows:

  • Version-specific API targeting
  • Version specific functionality to be implemented with essentially no runtime cost
  • Total support for Windows PowerShell all the way down to .NET Framework 4.5.2

Summary

In this post, we’ve listed and discussed the NuGet packages available to target when implementing a .NET project that uses PowerShell, and the reasons you might have for using one over another.

If you’ve skipped to the summary, some broad recommendations are:

  • PowerShell modules should compile against PowerShell Standard if they only require APIs common to different PowerShell versions.
  • PowerShell hosts and applications that need to run PowerShell internally should target the PowerShell SDK for PowerShell 6+ or the relevant Windows PowerShell reference assemblies for Windows PowerShell.
  • PowerShell modules that need version-specific APIs should target the PowerShell SDK or Windows PowerShell reference assemblies for the required PowerShell versions, using them as reference assemblies (i.e. not publishing the PowerShell dependencies).

If you’re unsure about your scenario, feel free to get in touch by commenting, opening an issue or reaching out to us on social media.

Cheers!

Rob Holt

Software Engineer

PowerShell Team

The post Depending on the right PowerShell NuGet package in your .NET project appeared first on PowerShell.

PowerShell Gallery TLS Support

$
0
0

Summary

To provide the best-in-class encryption to our customers, the PowerShell Gallery has deprecated Transport Layer Security (TLS) versions 1.0 and 1.1 as of April 2020.

The Microsoft TLS 1.0 implementation has no known security vulnerabilities. But because of the potential for future protocol downgrade attacks and other TLS vulnerabilities, we are discontinuing support for TLS 1.0 and 1.1 in the PowerShell Gallery.

For information about how to remove TLS 1.0 and 1.1 dependencies, see the whitepaper Solving the TLS 1.0 problem.

More information

As of April 2020, TLS 1.2 is set to be the default for the PowerShell Gallery.

Please note that TLS 1.0 and 1.1 was already unsupported, but the actual deprecation when PowerShell Gallery will now stop accepting any connections using TLS 1.0 and 1.1 has occurred.

We recommend that all client-server combinations use TLS 1.2 (or a later version) to maintain connection to the PowerShell Gallery.

Work Around

In your PowerShell session run:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Note: This will not permanently update your TLS but will allow you to interact with the PowerShell Gallery during this session.

Errors I Might See

If you are running an older version of TLS and try to interact with the PowerShell Gallery you may see error messages like:

Publishing

+ ...             Publish-PSArtifactUtility @PublishPSArtifactUtility_Param ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : InvalidOperation: (:) [Write-Error], WriteErrorException
+ FullyQualifiedErrorId : FailedToCreateCompressedModule,Publish-PSArtifactUtility

Installing

+ ...            $null = PackageManagementInstall-Package @PSBoundParameters + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
+ CategoryInfo : ResourceUnavailable: (C:UsersT-Ncho...anagement.nupkg:String) [Install-Package], Exception 
+ FullyQualifiedErrorId : PackageFailedInstallOrDownload,Microsoft.PowerShell.PackageManagement.Cmdlets.InstallPackage

Concerns and Support

Please open an issue in our GitHub repository or contact our gallery support channel through cgadmin@microsoft.com if you have any concerns, challenges, or are unable to upgrade to TLS 1.2 or above.

 

Sydney Smith

PowerShell Team

 

 

The post PowerShell Gallery TLS Support appeared first on PowerShell.

Windows Server container support in Azure Kubernetes Service is now generally available

$
0
0

Containerization is an important cloud computing development to more seamlessly build, test, deploy, and manage cloud applications. Containers also introduced many of our customers to new technologies including Docker, Windows containers, orchestration, and microservices. Today, we’re excited to announce the general availability of Windows Server container support in the Azure Kubernetes Service.

Many of our customers are building new microservice inspired applications using the latest design patterns, yet often their core business functions run on applications developed before Kubernetes was even a project. The past months have presented new challenges and opportunities for many of us, some customers are experiencing unprecedented demand on their services while others are looking for ways to consolidate workloads and reduce costs in order to save jobs. We have partnered with customers to help them address both challenges using Windows Server containers in our Azure Kubernetes Service. Often customers can consolidate multiple workloads onto the same node improving density while also increasing uptime and availability. When demand increases, it’s easy to scale up the services and nodes to meet the real-time needs of the business.

In the last five years, we have made significant progress with Azure Kubernetes. Today we are up to version 1.18 and since then over 70,000 changes have been merged into the project. We also had to work through key customer workflows in AKS, enabling multiple node pools and different patching and update models, and we continue to make improvements within the community and the service to make running applications based on Linux or Windows easier and more reliable. For example, in Kubernetes version 1.17, runtime class support supplants the need to use complex and often error-prone taints and tolerations to ensure Windows Server containers land only on Windows Server hosts. In Kubernetes version 1.19, we intend to expand this feature to improve version compatibility and isolation using Hyper-V isolated containers.

We know many of you have been waiting for Windows Server containers in AKS to become generally available so you can move into productionwe're very excited to hear your success stories in the coming days and weeks, and for customers still evaluating your path to containers, this is a great time to get started. In either case, please leave us your feedback here.

To learn more about recent advancements in Kubernetes version 1.18, specifically for AKS, read this blog post. Lastly, we would like to take the moment to thank every contributor and customer, without whom, today's announcement wouldn’t be possible. We’re proud to be part of the broader and vibrant Kubernetes community.

The post Windows Server container support in Azure Kubernetes Service is now generally available appeared first on Windows Server Blog.


PowerShellGet 3.0 Preview 2

$
0
0

PowerShellGet 3.0 preview 2 is now available on the PowerShell Gallery.
The focus of this release is the Install-PSResource parameter, error messages, and warnings.
For a full list of the issues addressed by this release please refer to this GitHub project.

Note: For background information on PowerShellGet 3.0 please refer to the blog post for the first preview release.

How to install the module

To install this version of PowerShellGet open any PowerShell console and run:
Install-Module -Name PowerShellGet -AllowPrerelease -Force -AllowClobber

New Features of this release

  • Progress bar and -Quiet parameter for Install-PSResource
  • TrustRepository parameter for Install-PSResource
  • NoClobber parameter for Install-PSResource
  • AcceptLicense for Install-PSResource
  • Force parameter for Install-PSResource
  • Reinstall parameter for Install-PSResource
  • Improved error handling

What is next

GitHub is the best place to track the bugs/feature requests related to this module. We have used a combination of projects and labels on our GitHub repo to track issues for this upcoming release. We are using the label Resolved-3.0 to mark issues that we plan to release at some point before we release the module as GA (generally available). To track issues/features to particular preview and GA releases we are using GitHub projects which are titled to reflect the release.

The major feature for our next preview release (preview 3) is allowing for Install-PSResource to accept a path to a psd1 or, json file (using -RequiredResourceFile), or a hashtable or json an input (using -RequiredResource).

How to Give feedback and Get Support

We cannot overstate how critical user feedback is at this stage in the development of the module. Feedback from preview releases help inform design decisions without incurring a breaking change once generally available and used in production. In order to help us to make key decisions around the behavior of the module please give us feedback by opening issues in our GitHub repository.

Sydney Smith
PowerShell Team

The post PowerShellGet 3.0 Preview 2 appeared first on PowerShell.

PowerShell 7 Video Series

$
0
0

As a part of our PowerShell 7 release, the PowerShell Team put together a series of videos explaining and demoing aspects of the release. The intent of these videos was for User Groups to host events celebrating and discussing PowerShell 7, however, in light of the current guidance against group gatherings, we have decided to make these videos available publicly on the PowerShell Team YouTube channel.

The content is broken down into 10 videos with a total runtime of 58 minutes. We have included links to the videos below, along with links to other related resources.

Helpful Links from the Videos

We hope you enjoy these videos! Please subscribe to the PowerShell Team YouTube channel for more video content from the PowerShell Team.

 

The post PowerShell 7 Video Series appeared first on PowerShell.

PSScriptAnalyzer (PSSA) 1.19.0 has been released

$
0
0

TL;DR; (Too Long; Didn’t Read)

This new minor version brings 5 new rules, the formatter is much faster and other enhancements and fixes. You can get it from the PSGallery here. At the same time the PowerShell extension for VS Code has released a new preview version. This ships with this new version of PSSA so that you can also take advantage of all the new configuration options. Therefore, whenever we reference the next version of the extension below, we mean the recently updated preview version or the next, upcoming release of the GA version. You can still take advantage of the new PSSA release in the GA version of the extension as well now by installing the module locally via Install-Module -Name PSScriptAnalyzer -Scope CurrentUser -Force, but you won’t have access to the configuration settings of some of the new features. The full changelog is here.

New Script Analysis Rules

There are a total of five new analyzer rules and they were all added by the community!

  • AvoidLongLines (thanks Thomas Rayner!): Warns when a line is too long (default is 120 characters) but is not enabled by default.
  • AvoidOverwritingBuiltInCmdlets (thanks Thomas Rayner!): Warns you if you accidentally try to re-define a built-in cmdlet such as e.g. Get-Item by writing code like e.g. function Get-Item { }.
  • UseUsingScopeModifierInNewRunspaces (thanks Jos Koelewijn!): Warns you when trying to incorrectly reference a variable that is not defined directly in the scope of the current scriptblock. This applies e.g. to the -Command parameter of Invoke-Command or -Parallel of ForEach-Object (added in PowerShell 7, see blog here). It recommends to use the $using scope modifier to reference the variable correctly.
  • UseProcessBlockForPipelineCommand (thanks Matt McNabb!): Warns when a function declares support for pipeline input (via the [Parameter(ValueFromPipeline)] attribute) that the function needs to declare a process { } block.
  • ReviewUnusedParameter (thanks Matt McNabb!): Warns on parameters declared in a script, scriptblock, or function scope that have not been used in that scope. You can think of it as the equivalent of the UseDeclaredVarsMoreThanAssignments rule but for parameters instead of variables.

The added computational work for those rules are being compensated for by a performance improvement in the AvoidTrailingWhitespace rule, therefore the speed of running Invoke-ScriptAnalyzer for all rules is roughly the same compared to the previous version of PSScriptAnalyzer.

Formatter

Performance

Several improvements have been made to the formatting rules and the engine that should result in the formatter being multiple times faster, especially for large scripts. The improvements were:

  • Reduced initialisation overhead.
  • Improved efficiency of formatting rules, which addresses the scaling problems that were seen for large scripts.
  • Reduced number of times the script text has to be re-parsed. In its current architecture, the formatter has to re-parse the script after every rule run and every applied correction. When a rule has no violations then the parsed AST and tokens are being recycled. This leads to faster formatting when no or only some correction have to be made.

To give a specific example, running the formatter on PowerShell‘s build.psm1 module, which has over 3000 lines, we’ve measure the following times for a ‘warm’ run:

  • Version 1.18.3 takes around 1,250 ms.
  • Version 1.19.0 takes around 550 ms.
  • Version 1.19.0 takes around 170 ms on the pre-formatted file.

The reason why we measure a ‘warm’ run is because in the editor scenario, the PowerShell extension will have likely already finished a run Invoke-ScriptAnalyzer in the background on the script, which means the CommandInfo cache has already been populated. Although the default set of formatting rules in the PowerShell extension for VS Code doesn’t need the CommandInfo cache so there isn’t much of a difference between cold and warm for most users, the following 2 optional rules do use the CommandInfo:

  • UseCorrectCasing: Controlled via the powershell.codeFormatting.useCorrectCasing setting of the PowerShell extension for VS Code.
  • AvoidUsingCmdletAliases: Controlled via the powershell.codeFormatting.autoCorrectAliases setting of the PowerShell extension for VS Code.

New Formatter features

  • Parameter Casing: The UseCorrectCasing rule now correct also the casing of parameters and not just the cmdlet names.
  • The PipelineIndentationStyle setting of UseConsistentIndentation has a new option now and will also become the default setting in the next version of the PowerShell extension for VS Code. The new value is named None and will not change the user’s pipeline indentation at all which makes this feature an opt-in scenario. For the previous non-default settings IncreaseIndentationForFirstPipeline and IncreaseIndentationAfterEveryPipeline all new user reported bugs are fixed now and therefore we encourage you to please try it out again.
  • The UseConsistentWhitespace option CheckPipe has not been changed to only ADD whitespace around the pipe if it is missing but does not remove extraneous whitespace. This is because some people prefer to line up their pipelines in Pester tests. For anyone who still wants to trim redundant whitespace around pipes, the new CheckPipeForRedundantWhitespace option has been provided. For users of the PowerShell extension for VS Code this means that in the next version of the PowerShell extension for VS Code we plan to split the existing powershell.codeFormatting.whitespaceAroundPipe (enabled by default) setting into 2 new ones: powershell.codeFormatting.addWhitespaceAroundPipe (enabled by default) and powershell.codeFormatting.trimWhitespaceAroundPipe (disabled by default). The preview extension will automatically create the addWhitespaceAroundPipe setting for you with the value of whitespaceAroundPipe if you are using this setting. In the next stable extension, the left-over whitespaceAroundPipe setting will be removed completely.
  • The UseConsistentWhitespace option CheckParameter has been added and you will be able to control it via this setting of the PowerShell extension for VS Code in its next update: powershell.codeFormatting.whitespaceBetweenParameters.

Other improvements

  • The compatibility rules were updated to includes profiles for PowerShell 7; support single number version strings; and analysis for PowerShell 7 syntax (null-conditional method invocation, null-coalescing operator, ternary expression and pipeline chain operator).
  • AvoidAssignmentToAutomaticVariable rule was enhanced to include not only warn on read-only automatic variables, but also other automatic variables that can but should not be assigned to, which also includes the commonly misused $input variable.
  • The minimum supported version of PowerShell Core is 6.2.4 now but please bear in mind that support for PowerShell 6.2 itself ends on September 04 2020, see support policy here.
  • Our CI system has been migrated to use multi-stage Azure Pipelines, meaning that every commit gets tested against Windows (Server 2016 and 2019), Ubuntu (16.04 and 18.04) and macOS (10.14 and 10.15) for PowerShell 7 and also Windows PowerShell 5.1. The previous AppVeyor build still provides coverage for PowerShell 4 and before the release a manual test was executed to guarantee functionality for PowerShell 3.

What’s next?

As mentioned in multiple, previous posts here and here, the PowerShell team is looking at a partial re-write of PSScriptAnalyzer, which will require a bump of the major version. Version 1.x continues to be supported for PowerShell 3 and 4, but will not receive new features and only critical security fixes. In version 2.x, support for PowerShell version 3 and 4 are expected to be dropped.

On behalf of the Script Analyzer team,

Christoph Bergmeister, Project Maintainer from the community, BJSS

Jim Truher, Senior Software Engineer, PowerShell Team, Microsoft

Rob Holt, Software Engineer, PowerShell team, Microsoft

The post PSScriptAnalyzer (PSSA) 1.19.0 has been released appeared first on PowerShell.

PowerShellGet 3.0 Preview 3

$
0
0

PowerShellGet 3.0 preview 3 is now available on the PowerShell Gallery. The focus of this release is the -RequiredResource parameter for Install-PSResource which now allows for json, hashtable, or .json files as input. For a full list of the issues addressed by this release please refer to this GitHub project.

Note: For background information on PowerShellGet 3.0 please refer to the blog post for the first preview release and the second preview release.

How to install the module

To install this version of PowerShellGet open any PowerShell console and run: Install-Module -Name PowerShellGet -AllowPrerelease -Force

New Features of this release

New Features

  • RequiredResource parameter for Install-PSResource
  • RequiredResourceFile parameter for Install-PSResource
  • IncludeXML parameter in Save-PSResource

Bug Fix

  • Resolved paths in Install-PSResource and Save-PSResource

What is next

GitHub is the best place to track the bugs/feature requests related to this module. We have used a combination of projects and labels on our GitHub repo to track issues for this upcoming release. We are using the label Resolved-3.0 to mark issues that we plan to release at some point before we release the module as GA (generally available). To track issues/features to particular preview and GA releases we are using GitHub projects which are titled to reflect the release.

The focus feature for our next preview release (preview 4) is publishing functionality.

How to Give feedback and Get Support

We cannot overstate how critical user feedback is at this stage in the development of the module. Feedback from preview releases help inform design decisions without incurring a breaking change once generally available and used in production. In order to help us to make key decisions around the behavior of the module please give us feedback by opening issues in our GitHub repository.

Sydney Smith PowerShell Team

The post PowerShellGet 3.0 Preview 3 appeared first on PowerShell.

PowerShell Team May 2020 Update

$
0
0

Previously, I published a blog on our investments plans during the PowerShell 7.1 release timeframe. We’ve made progress across many of those investments with more work ahead of us.

PowerShell 7.1 preview 3

We are now able to ship simultaneously with each new .NET 5 preview release!

This means that you can start leveraging new capabilities in .NET 5 and assess the new performance improvements. For PowerShell it means we can find issues early during integration with .NET and get those issues resolved much more quickly. Because we will be able to simultaneously release with .NET, it also means users will get have the full support lifecycle of .NET with PowerShell.

The engineering work required to enable this means we missed one .NET 5 preview release, so unfortunately, our preview numbers don’t align. Today’s PowerShell 7.1 preview 3 release is built on top of .NET 5 preview 4! This includes preview builds of PowerShell for Windows on ARM64!

Grab the latest version from the usual places or from our GitHub repo where you can also read the detailed change log.

New experimental feature

In PowerShell 7.0, we added a temp: PSDrive. This works on all platforms and automatically maps to your user temporary path. However, native commands do not understand PowerShell drives, so if you wanted to quickly edit a temporary file using notepad or vim, you can’t just specify temp:/test.ps1 expecting that to just work.

This new experimental feature called PSNativePSPathResolution will automatically resolve file system PSPaths and pass that path to the native command. Note that if you use single quotes, then that string is passed as a literal string to the native command instead of being resolved. If the path is not a valid file system path (for example, a registry provider path like HKLM:myRegKey), then it will just be passed as a literal string to the native command.

Also, new for Windows, you can use ~ to be reference your home directory for native commands as the path will also be resolved before passing it to the native command. So you can also do something like notepad ~documentsmydoc.txt!

As a reminder, preview releases of PowerShell, by default, have experimental features enabled to solicit feedback.

If you have any issues or suggestions for this feature, please open or comment on an existing issue in our repo.

Tooling updates

Much of the work the team is focused on is not (currently) shipped with PowerShell.

PowerShellGet 3.0

We shipped the 3rd preview of this module and development continues. Currently, Find, Install, and Save is working. In the next preview we expect Publish to be working.

The goal of PowerShellGet 3.0 is to simplify the user experience so you don’t get error messages telling you to add more switches to do what you intended. Also, we removed the dependency on PackageManagement module and nuget.exe so updating PowerShellGet should be much easier. Finally, we want to address the developer scenario making it easier to specify and install bulk dependencies.

Expect a new preview every few weeks to a month as new features light up!

Please report issues or suggestions to the PowerShellGet repo.

Secret Management

We shipped the 2nd preview of this module and the Azure KeyVault team has published their extension to Secret Management module in version 1.6.0 of Az.KeyVault module.

Based on user feedback as well as our own discussions, we decided to invest in a major re-architecture of how we store secrets locally. The current preview only supports Windows because of the dependency on Windows Credential Manager. Unfortunately, Windows Credential Manager does not support two important use cases because it requires an interactive token:

  • Service accounts cannot access Windows Credential Manager
  • You can’t use Secret Management module over PowerShell remoting (or any network token)

We also found by experimenting with support of libsecret that the Linux experience would be different from Windows in that Linux will prompt for a passcode while Windows does not.

We’ll be sharing more details of our new local vault design which will provide a consistent experience across Windows, Linux, and macOS while remaining secure.

Expect this new local vault to be available in the next preview release.

Please report issues or suggestions to the PowerShell modules repo.

PSScriptAnalyzer

v1.19.0 of PSScriptAnalzyer shipped recently. This release has significant improvements to formatting as well as a number of new script analysis rules! Most of this work was done by the community. Thank you!

We are actively discussing and designing our next major version focusing on performance improvements that should make using PSSA in VSCode much snappier.

Please report issues or suggestions to the PSScriptAnalyzer repo.

Jupyter Notebook support

Since we first announced this project, we’ve made significant enhancements to our dotnet-interactive sub-kernel for PowerShell:

  • Enable connecting to Azure CloudShell
  • Host prompting works, so you can use Read-Host or Get-Credential interactively
  • Plotting cmdlets and type accelerators
  • Proper colors and formatting from console to notebook
  • $Profile support
  • Lots of examples included

A reminder that to get PowerShell language support, you just need to install dotnet-interactive!

Please report issues or suggestions to the dotnet-interactive repo.

Closing

There’s still lots of work ahead of us as we target the 7.1 release towards the end of this calendar year. We expect to continue to have a new preview release every month for PowerShell and for our modules as new capabilities get completed. We really appreciate the early feedback from the community and partners using our previews as it helps improve the product before we finalize design decisions.

Steve Lee Principal Engineering Manager PowerShell Team

The post PowerShell Team May 2020 Update appeared first on PowerShell.

Viewing all 1120 articles
Browse latest View live


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>