In a recent change, the new database for the on-prem Pullserver is now ESENT. Had a question for clarification.

As an old Exchange guy, I have fears that immediately pop into mind. The logs files do not appear to be using circular logging (a way of self cleaning and restricting the amount of log files) – Is this true?

If so, then I’m guess that the log files will continue to grow until the disk is full – which happens to exchange if the log files are not truncated. Is there a way today or in the future we will be able to manage the log files?

Thanks for the help understanding!

Votes from Connect: 17

Original Date Submitted: 8/13/2015 12:17:49 AM

Description:
********Contact Information********
Handle: PowerShellDon
Site Name: PowerShell
Feedback ID: 1659904
***************************************

Problem Description:
Suggestion one:

Add maintenance window awareness to the Local Configuration Manager. Edited via metaconfig, it specifies times when configuration changes are acceptable, when automated reboots are acceptable. Further automates configuration maintenance especially when you're implementing changes vs. correcting drift.

Suggestion two:

Add universal "DoNotImplementBefore" and "ImplementBy" settings to DSC resources. Just as "Present=" specifies to add/remove something, these would indicate a date/time for the setting to become valid (e.g., "we want to implement a bunch of changes, but not before x date") and a deadline by which the setting just be implemented (e.g., "this has to happen by x date"). The latter might play into the LCM configuration: For example, when set to ApplyAndAutoCorrect, even if AutoReboot=$false, an auto reboot may occur once a setting passes its "ImplementBy" date/time without previously being implemented.

These suggestions reflect some of the realities of managing a production environment.

Product Studio item created by Connect Synchronizer due to creation of feedback ID 1659904 (http://connect.microsoft.com/PowerShell/feedback/ViewFeedback.aspx?FeedbackID=1659904).

Repro Steps:

Internal BugId: 15730

NuGet feeds allow security around both listing/retrieving packages as well as pushing packages. NuGet.exe and other clients further allow you to persist credentials for listing/retrieving packages using the "nuget sources" command. (https://docs.nuget.org/consume/command-line-reference#sources-command)

This persistence is important for two reasons:

1) When you push a package to a secured NuGet feed, NuGet clients generally do a list/read operation first. That list/read operation doesn't contain any API key that you pass along in the push operation. In order for a push to succeed with an API key, you also need to have credentials set for the read operation. You can read about some folks who have been affected by that here: http://inedo.com/support/questions/2319

2) In an unattended/build server scenario, you need the ability to provide credentials for list/read and push in a non-interactive way. If the only way to provide credentials is interactive (e.g., Get-Credential) then there's no way to, say, enable a build server agent to automatically install required scripts to execute a build.

This may somewhat overlap with this other note about Register-PSRepository failing against authenticated endpoints: http://windowsserver.uservoice.com/forums/301869-powershell/suggestions/11678499-register-psrepository-fails-against-authenticated

(Originally posted in https://connect.microsoft.com/PowerShell/feedback/details/1852524)

Standard CIM cmdlets can produce invalid output. I reproduced the problem with
two commands — Get-SmbShareAccess and Enable-NetAdapterChecksumOffload.
I also believe that the problem is not limited to these particular commands.

Below is an example of me executing 'Get-SmbShareAccess C$, D$' twice. Please
note that the first output is incorrect and it shows 6 entries for C$, instead
of expected 3 entries for C$ and 3 entries for D$:

PS C:\> Get-SmbShareAccess C$, D$

Name ScopeName AccountName AccessControlType AccessRight
---- --------- ----------- ----------------- -----------
C$ * BUILTIN\Administrators Allow Full
C$ * BUILTIN\Administrators Allow Full
C$ * BUILTIN\Backup Operators Allow Full
C$ * BUILTIN\Backup Operators Allow Full
C$ * NT AUTHORITY\INTERACTIVE Allow Full
C$ * NT AUTHORITY\INTERACTIVE Allow Full

PS C:\> Get-SmbShareAccess C$, D$

Name ScopeName AccountName AccessControlType AccessRight
---- --------- ----------- ----------------- -----------
C$ * BUILTIN\Administrators Allow Full
C$ * BUILTIN\Backup Operators Allow Full
C$ * NT AUTHORITY\INTERACTIVE Allow Full
D$ * BUILTIN\Administrators Allow Full
D$ * BUILTIN\Backup Operators Allow Full
D$ * NT AUTHORITY\INTERACTIVE Allow Full

This problem occurs randomly — i.e., sometimes the output is correct, and
sometimes it is not.

Below is another example of me executing Enable-NetAdapterChecksumOffload for
two adapters, with the same problem. The first output is incorrect:

PS C:\> Enable-NetAdapterChecksumOffload A, B -IpIPv4 -PassThru

Name IpIPv4Enabled TcpIPv4Enabled TcpIPv6En
abled
---- ------------- -------------- ---------
A RxTxEnabled RxTxEnabled Disabled
A RxTxEnabled RxTxEnabled Disabled

PS C:\> Enable-NetAdapterChecksumOffload A, B -IpIPv4 -PassThru

Name IpIPv4Enabled TcpIPv4Enabled TcpIPv6En
abled
---- ------------- -------------- ---------
A RxTxEnabled RxTxEnabled Disabled
B RxTxEnabled RxTxEnabled Disabled

Additional notes:

- The problem happens in both PowerShell 4 (4.0) and 5 (5.0.10514.0)

- The problem doesn't happen with -ThrottleLimit 1

- The problem doesn't happen if the objects are taken from the pipeline, for
example, with Get-SmbShare C$, D$ | Get-SmbShareAccess

- The problem happens from time to time, so a loop like below can be useful
in reproducing it:

while (1) { Write-Host ''; Get-SmbShareAccess C$, D$ }

- From my observations, the problem occurs with CIM cmdlets that invoke a
non-static CIM method with output ¹ when these methods are executed in
parallel for multiple CIM instances.

¹ A method with [Out]-parameter in .mof file and with the corresponding
<CmdletOutputMetadata> tag in the .cdxml file.

------------------------------------------------------

Please note that the described problem is not specific to the File Share cmdlet
(Get-SmbShare), but can also be reproduced with other commands — e.g., with
Enable-NetAdapterChecksumOffload, which is unrelated to File Sharing.

A common thing about these examples is that they perform concurrent requests
to the CIM provider and then join the results. The problem doesn't happen
with -ThrottleLimit 1, and I tend to think that the root of the problem is a
race condition happening somewhere around the following method:

Microsoft.PowerShell.Cmdletization.Cim.ExtrinsicMethodInvocationJob.OnNext()

The method is a part of Microsoft.PowerShell.Commands.Management.dll assembly.

As a blind guess, it could be that, when joining the results, the resulting
CIM object from another request is being incorrectly reused and treated as
the result of the request that's currently being processed. That could explain
the duplicated entries in the output.

Votes from Connect: 12

Original Date Submitted: 4/4/2015 8:50:49 AM

Description:
********Contact Information********
Handle: Arnoud Jansveld
Site Name: PowerShell
Feedback ID: 1224213
***************************************

Frequency: PowerShell ISE
Regression: function Show-Form
{
[reflection.assembly]::LoadWithPartialName("System.Windows.Forms") >$null
$form = New-Object System.Windows.Forms.Form
$label = New-Object System.Windows.Forms.Label
$label.Text = "Please close this form"
$label.AutoSize = $true
$form.Controls.Add($label)
$form.ShowDialog()
}

$result = Show-Form

# Workaround (slow):
# $result = Start-Job ${function:Show-Form} | Receive-Job -Wait -AutoRemoveJob

"Form result: " + $result.ToString()

Write-Warning "The following step may hang PowerShell ISE, save your work!"
Read-Host -Prompt "Hit Enter or Ctrl-C to abort"

# This generates a WM_SETTINGCHANGE broadcast message
[Environment]::SetEnvironmentVariable("foo", "bar", "User")

Problem Description:
After using ShowDialog() to display a Windows Forms dialog, the ISE will hang when it receives a WM_SETTINGCHANGE broadcast message (e.g. when changing display resolution, switching from a laptop screen to an external monitor or connecting to the current session from another machine via RDP).

This was reproduced on PowerShell ISE version 4 and 5 (Feb preview). Sadly it affects many useful scripts, including Lee Holmes' (awesome) Show-Object.

Product Studio item created by Connect Synchronizer due to creation of feedback ID 1224213 (http://connect.microsoft.com/PowerShell/feedback/ViewFeedback.aspx?FeedbackID=1224213).

Repro Steps:
function Show-Form
{
[reflection.assembly]::LoadWithPartialName("System.Windows.Forms") >$null
$form = New-Object System.Windows.Forms.Form
$label = New-Object System.Windows.Forms.Label
$label.Text = "Please close this form"
$label.AutoSize = $true
$form.Controls.Add($label)
$form.ShowDialog()
}

$result = Show-Form

# Workaround (slow):
# $result = Start-Job ${function:Show-Form} | Receive-Job -Wait -AutoRemoveJob

"Form result: " + $result.ToString()

Write-Warning "The following step may hang PowerShell ISE, save your work!"
Read-Host -Prompt "Hit Enter or Ctrl-C to abort"

# This generates a WM_SETTINGCHANGE broadcast message
[Environment]::SetEnvironmentVariable("foo", "bar", "User")

Expected Results:
The script should show an empty dialog; after closing it and hitting Enter at the prompt the ISE should remain responsive (on some occasions the script has to be run more than once for the problem to occur).

This works fine in the regular PowerShell console.

Internal BugId: 14363

When upgrading to WMF 5.1, we are seeing errors in the DSC event log on servers that use a configuration with encrypted content (passwords). We are using encrypted credentials to create application pools and assign a service account as the identity. The data gets decrypted fine and the app pools get created with the correct identities. However the following error gets logged in the DSC event log every time a consistency check runs:

Job :
Message Cannot unprotect message. The input contained no encrypted content. Specify the '-IncludeContext' parameter if you wish to output the original content when no encrypted content is detected.
HResult -2146233087
StackTrack at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input)
at System.Management.Automation.PowerShell.Worker.ConstructPipelineAndDoWork(Runspace rs, Boolean performSyncInvoke)
at System.Management.Automation.PowerShell.Worker.CreateRunspaceIfNeededAndDoWork(Runspace rsToUse, Boolean isSync)
at System.Management.Automation.PowerShell.CoreInvokeHelper[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
at System.Management.Automation.PowerShell.CoreInvoke[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
at Microsoft.PowerShell.DesiredStateConfiguration.Internal.ResourceProviderAdapter.CMS_DecryptMessage(String thumbprint, String encryptedMessage, IStreamsHandler plugInStreamsHandler, String& outputResult, IntPtr& errorInstanceHandle)

We updated our certificate to use the new requirements for WMF 5.1 and everything looks fine there.

Votes from Connect: 5

Original Date Submitted: 2/20/2015 2:01:32 PM

Description:

********Contact Information********
Handle: john.s2011n
Site Name: PowerShell
Feedback ID: 1139497
***************************************

Frequency: Always Happens
Regression: Yes, this happens in all previous versions

Problem Description:
in PS 4.0 and also previous versions, there is no option to easily convert multiple selected lines to comment block. so when we have selected multiple lines & we want to make them as comment, we have to insert comment block in another location on the pane, and then cut these multiple lines and paste them inside comment block which is a bit cumbersome.
but in other products like VBA2013, this option exist & there is a button on edit toolbar which converts multiple lines into comment, in place.

hope this be added in PS 5.0
thanks

Product Studio item created by Connect Synchronizer due to creation of feedback ID 1139497 (http://connect.microsoft.com/PowerShell/feedback/ViewFeedback.aspx?FeedbackID=1139497).

Repro Steps:
Expected Results:

Internal BugId: 13253

I ran into this one, after I noticed my newly patched workstation was still turned on in the morning even though I had explicitly requested it to shutdown at a certain time. Basically the repro steps are as follows:

> Open Non-Administrative Shell
> Stop-Computer
Output:
stop-computer : Privilege not held.
At line:1 char:1
+ stop-computer
+ ~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (***:String) [Stop-Computer], ManagementException
+ FullyQualifiedErrorId : StopComputerException,Microsoft.PowerShell.Commands.StopComputerCommand

Administrative shell works as expected, this specific workstation has never participated in any fast/slow ring builds. Windows version is 15063.138

Another Windows 10 system, fast ring, that is on build 15063.14 does not exhibit this behavior. Starting PowerShell -version 2 and then running Stop-Computer still works, as does running it from administrative shell.

Full log is available below:

Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.

PS C:\Users\Jaap Brasser> stop-computer
stop-computer : Privilege not held.
At line:1 char:1
+ stop-computer
+ ~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (***:String) [Stop-Computer], ManagementException
+ FullyQualifiedErrorId : StopComputerException,Microsoft.PowerShell.Commands.StopComputerCommand

PS C:\Users\Jaap Brasser> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name Description State
============================= ==================================== ========
SeShutdownPrivilege Shut down the system Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeUndockPrivilege Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
SeTimeZonePrivilege Change the time zone Disabled
PS C:\Users\Jaap Brasser> $psversiontable

Name Value
---- -----
PSVersion 5.1.15063.138
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.15063.138
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

PS C:\Users\Jaap Brasser> powershell -version 2
Windows PowerShell
Copyright (C) 2009 Microsoft Corporation. All rights reserved.

PS C:\Users\Jaap Brasser> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name Description State
============================= ==================================== ========
SeShutdownPrivilege Shut down the system Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeUndockPrivilege Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
SeTimeZonePrivilege Change the time zone Disabled
PS C:\Users\Jaap Brasser>

On 2 Fully Updated Windows Server 2016 Machines running and provisioned from Azure I have created a Pull Server Configuration. I have created the DSC Signing Certificate using a custom template on a Enterprise Root CA which has worked for 2012R2 nodes and also tested using xDSCUtils New-xSelfSignedDscEncryptionCertificate. Using the same Certificate to Compile and Execute the MOF on the same Computer works, it is only if you compile on one and execute on another that the problems arise.
I kept getting errors when passing in credentials. I therefore wrote a tiny custom DSC Resource that Displays the Password as clear text when I run Start-DSCConfiguration -Wait -Verbose
You can find it here https://gist.github.com/aboersch/65e846a4966fe2c4708ed21d655a54a7
The Client does not correctly decrypt the Credentials. As a Password I am receiving
-----BEGIN CMS-----
<Long Multi-Line Base64 String>
-----END CMS-----
If I pass this to Unprotect-CmsMessage I receive the correct Password.
The Certificate passes $_.PrivateKey.KeyExchangeAlgorithm and $_.Verify
I have tried changing the Certificate Provider to '"Microsoft Enhanced Cryptographic Provider v1.0"', '"Legacy Cryptographic Service Provider"', and '"Microsoft RSA SChannel Cryptographic Provider"'.
I have already tried these:
http://stackoverflow.com/questions/34006865/dsc-problems-with-credentials-and-build-10586
https://wespoint.wordpress.com/2017/01/19/powershell-dsc-encryption-issue/

Votes from Connect: 3

Original Date Submitted: 6/8/2015 2:40:45 PM

Description:
********Contact Information********
Handle: aL3891
Site Name: PowerShell
Feedback ID: 1411231
***************************************

Problem Description:
At the moment all dsc resources are executed serially. given that dependencies are allready specified, it would in theory be safe to execute steps in parallel.

I'm guessing this is planned at some point but i could really use a way to enable parallel execution because I'm using dsc to spin up test environments with a bunch of services and having those being set up in parallel would speed things up considerably.

Product Studio item created by Connect Synchronizer due to creation of feedback ID 1411231 (http://connect.microsoft.com/PowerShell/feedback/ViewFeedback.aspx?FeedbackID=1411231).

Repro Steps:

Internal BugId: 14550

Steps to reproduce:

1. Install WMF5 RTM on a fresh Windows 2012 R2 system
2. Open an Administrator PS prompt and run "Install-Module Pester -Force"

Expected result: The -Force parameter causes the NuGet client to be installed without user intervention.

Actual result: The following message is displayed:

NuGet-anycpu.exe is required to continue.
PowerShellGet requires NuGet-anycpu.exe to interact with NuGet based galleries. NuGet-anycpu.exe must be available in
'C:\Program Files\PackageManagement\ProviderAssemblies' or
'C:\Users\Administrator\AppData\Local\PackageManagement\ProviderAssemblies'. For more information about NuGet provider,
see http://OneGet.org/NuGet.html. Do you want PowerShellGet to download NuGet-anycpu.exe now?
[Y] Yes [N] No [S] Suspend [?] Help (default is "Y"):

The MSDN documentation for $PSCmdlet.ShouldContinue (https://msdn.microsoft.com/en-us/library/ms568259%28v=vs.85%29.aspx) states "Cmdlets calling ShouldContinue should also implement a Force parameter that allows the cmdlet to bypass these calls. If this is not done, it will be difficult to use the cmdlet from scripts and noninteractive hosts." I'm trying to use Install-Module from an automated setup script on a fresh machine, and this prompt causes the script to hang.

Workaround: Before using Install-Module for the first time, run the following command to fetch NuGet-anycpu.exe (this is what Install-Module is doing internally):

PackageManagement\Get-PackageProvider -Name NuGet -Force