OS: Windows Server 2016 1607 (14393.1593)
PSVersionTable:
Name Value
---- -----
PSVersion 5.1.14393.1532
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.14393.1532
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

PSDscResource module: v2.8.0.0

Take a look at this configuration:
Configuration DependentConfig
{
Import-DscResource -ModuleName PSDscResources -Name Registry

Node MyNode01
{

File SetupScript
{
DestinationPath = 'C:\Scripts\hello.txt'
Contents = 'somecommand'
Type = 'File'
Ensure = 'Present'
DependsOn = '[Registry]regCheck'
}

Registry regCheck
{
Key = 'HKEY_LOCAL_MACHINE\SYSTEM\SomeKey'
ValueName = 'SomeValue'
ValueData = 0
ValueType = 'DWord'
Ensure = 'Present'
}
}
}

DependentConfig -OutputPath C:\DependentConfig

This requires PSDscResources module version 2.8.0.0 from the gallery and the file resource from the PSDesiredStateConfiguration in-box module. However, compiling this configuration will fail with a message that File resource cannot be loaded. If we remove -Name File from the first import command, you will see an error that Registry resource cannot be found. We have to use -Name with PSDscResources since PSDesiredStateConfiguration already exports the same resource.

So, the only work around at this time is to remove the PSDesiredStateConfiguration import completely from the configuration so that we can at least compile this. Here is something that works.

Configuration DependentConfig
{
Import-DscResource -ModuleName PSDesiredStateConfiguration
Import-DscResource -ModuleName PSDscResources -Name Registry

Node MyNode01
{

File SetupScript
{
DestinationPath = 'C:\Scripts\hello.txt'
Contents = 'somecommand'
Type = 'File'
Ensure = 'Present'
DependsOn = '[Registry]regCheck'
}

Registry regCheck
{
Key = 'HKEY_LOCAL_MACHINE\SYSTEM\SomeKey'
ValueName = 'SomeValue'
ValueData = 0
ValueType = 'DWord'
Ensure = 'Present'
}
}
}

DependentConfig -OutputPath C:\DependentConfig

Take a look at the following configuration:
$configurationData =
@{
AllNodes =
@(
@{
NodeName = 'S16-01'
PsDscAllowPlainTextPassword = $true
PSDscAllowDomainUser = $true
}
)
}

Configuration DSCRunDemo
{
param (
[pscredential] $Credential
)
Import-DscResource -ModuleName PSDesiredStateConfiguration

Node $AllNodes.NodeName
{
Script DSCRunDemo1
{
SetScript =
{
Write-Verbose -Message $(whoami)
}
TestScript =
{
return $false
}
GetScript =
{
return @{}
}
PsDscRunAsCredential = $Credential
}

Script DSCRunDemo2
{
SetScript =
{
Write-Verbose -Message $(whoami)
}
TestScript =
{
return $false
}
GetScript =
{
return @{}
}
}
}
}

DSCRunDemo -ConfigurationData $configurationData -Credential (Get-Credential)

One instance of the script resource has PSDscRunAsCredential while the other does not. This compiles fine and then MOF looks good.

/*
@TargetNode='S16-01'
@GeneratedBy=Administrator
@GenerationDate=08/22/2017 13:36:38
@GenerationHost=S16-JB
*/

instance of MSFT_Credential as $MSFT_Credential1ref
{
Password = "Dell1234";
UserName = "psdsc\\administrator";

};

instance of MSFT_ScriptResource as $MSFT_ScriptResource1ref
{
ResourceID = "[Script]DSCRunDemo1";
PsDscRunAsCredential = $MSFT_Credential1ref;
GetScript = "\n return @{}\n ";
TestScript = " \n return $false\n ";
SourceInfo = "::22::9::Script";
SetScript = " \n Write-Verbose -Message $(whoami)\n ";
ModuleName = "PSDesiredStateConfiguration";

ModuleVersion = "0.0";

ConfigurationName = "DSCRunDemo";

};
instance of MSFT_ScriptResource as $MSFT_ScriptResource2ref
{
ResourceID = "[Script]DSCRunDemo2";
GetScript = "\n return @{}\n ";
TestScript = " \n return $false\n ";
SourceInfo = "::39::9::Script";
SetScript = " \n Write-Verbose -Message $(whoami)\n ";
ModuleName = "PSDesiredStateConfiguration";

ModuleVersion = "0.0";

ConfigurationName = "DSCRunDemo";

};
instance of OMI_ConfigurationDocument

{
Version="2.0.0";

MinimumCompatibleVersion = "2.0.0";

CompatibleVersionAdditionalProperties= {"Omi_BaseResource:ConfigurationName"};

Author="Administrator";

GenerationDate="08/22/2017 13:36:38";

GenerationHost="S16-JB";

Name="DSCRunDemo";

};

However, when we enact this configuration, it fails with the following message:

PS C:\> Start-DscConfiguration -Path .\DSCRunDemo -Verbose -Wait -Force
VERBOSE: Perform operation 'Invoke CimMethod' with following parameters, ''methodName' = SendConfigurationApply,'className' = MSFT_DSCLocalConfigurationManager,'namespaceName' = root/Microsoft/Windows/DesiredStateConfiguration'.
VERBOSE: An LCM method call arrived from computer S16-JB with user sid S-1-5-21-689661094-3032901192-2251061677-500.
VERBOSE: [S16-01]: LCM: [ Start Set ]
VERBOSE: [S16-01]: LCM: [ End Set ]
The resources ('[Script]DSCRunDemo1' and '[Script]DSCRunDemo2') have conflicting values of the following properties: 'PsDscRunAsCredential'. Ensure that their values match.
+ CategoryInfo : ResourceExists: (root/Microsoft/...gurationManager:String) [], CimException
+ FullyQualifiedErrorId : MI RESULT 11
+ PSComputerName : S16-01

VERBOSE: Operation 'Invoke CimMethod' complete.
VERBOSE: Time taken for configuration job to complete is 3.761 seconds

If this is by design, it is a wrong design. Think of adding registry configuration for multiple users on the same system using the same configuration document.

When upgrading to WMF 5.1, we are seeing errors in the DSC event log on servers that use a configuration with encrypted content (passwords). We are using encrypted credentials to create application pools and assign a service account as the identity. The data gets decrypted fine and the app pools get created with the correct identities. However the following error gets logged in the DSC event log every time a consistency check runs:

Job :
Message Cannot unprotect message. The input contained no encrypted content. Specify the '-IncludeContext' parameter if you wish to output the original content when no encrypted content is detected.
HResult -2146233087
StackTrack at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input)
at System.Management.Automation.PowerShell.Worker.ConstructPipelineAndDoWork(Runspace rs, Boolean performSyncInvoke)
at System.Management.Automation.PowerShell.Worker.CreateRunspaceIfNeededAndDoWork(Runspace rsToUse, Boolean isSync)
at System.Management.Automation.PowerShell.CoreInvokeHelper[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
at System.Management.Automation.PowerShell.CoreInvoke[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
at Microsoft.PowerShell.DesiredStateConfiguration.Internal.ResourceProviderAdapter.CMS_DecryptMessage(String thumbprint, String encryptedMessage, IStreamsHandler plugInStreamsHandler, String& outputResult, IntPtr& errorInstanceHandle)

We updated our certificate to use the new requirements for WMF 5.1 and everything looks fine there.

I ran into this one, after I noticed my newly patched workstation was still turned on in the morning even though I had explicitly requested it to shutdown at a certain time. Basically the repro steps are as follows:

> Open Non-Administrative Shell
> Stop-Computer
Output:
stop-computer : Privilege not held.
At line:1 char:1
+ stop-computer
+ ~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (***:String) [Stop-Computer], ManagementException
+ FullyQualifiedErrorId : StopComputerException,Microsoft.PowerShell.Commands.StopComputerCommand

Administrative shell works as expected, this specific workstation has never participated in any fast/slow ring builds. Windows version is 15063.138

Another Windows 10 system, fast ring, that is on build 15063.14 does not exhibit this behavior. Starting PowerShell -version 2 and then running Stop-Computer still works, as does running it from administrative shell.

Full log is available below:

Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.

PS C:\Users\Jaap Brasser> stop-computer
stop-computer : Privilege not held.
At line:1 char:1
+ stop-computer
+ ~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (***:String) [Stop-Computer], ManagementException
+ FullyQualifiedErrorId : StopComputerException,Microsoft.PowerShell.Commands.StopComputerCommand

PS C:\Users\Jaap Brasser> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name Description State
============================= ==================================== ========
SeShutdownPrivilege Shut down the system Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeUndockPrivilege Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
SeTimeZonePrivilege Change the time zone Disabled
PS C:\Users\Jaap Brasser> $psversiontable

Name Value
---- -----
PSVersion 5.1.15063.138
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.15063.138
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

PS C:\Users\Jaap Brasser> powershell -version 2
Windows PowerShell
Copyright (C) 2009 Microsoft Corporation. All rights reserved.

PS C:\Users\Jaap Brasser> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name Description State
============================= ==================================== ========
SeShutdownPrivilege Shut down the system Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeUndockPrivilege Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
SeTimeZonePrivilege Change the time zone Disabled
PS C:\Users\Jaap Brasser>

On 2 Fully Updated Windows Server 2016 Machines running and provisioned from Azure I have created a Pull Server Configuration. I have created the DSC Signing Certificate using a custom template on a Enterprise Root CA which has worked for 2012R2 nodes and also tested using xDSCUtils New-xSelfSignedDscEncryptionCertificate. Using the same Certificate to Compile and Execute the MOF on the same Computer works, it is only if you compile on one and execute on another that the problems arise.
I kept getting errors when passing in credentials. I therefore wrote a tiny custom DSC Resource that Displays the Password as clear text when I run Start-DSCConfiguration -Wait -Verbose
You can find it here https://gist.github.com/aboersch/65e846a4966fe2c4708ed21d655a54a7
The Client does not correctly decrypt the Credentials. As a Password I am receiving
-----BEGIN CMS-----
<Long Multi-Line Base64 String>
-----END CMS-----
If I pass this to Unprotect-CmsMessage I receive the correct Password.
The Certificate passes $_.PrivateKey.KeyExchangeAlgorithm and $_.Verify
I have tried changing the Certificate Provider to '"Microsoft Enhanced Cryptographic Provider v1.0"', '"Legacy Cryptographic Service Provider"', and '"Microsoft RSA SChannel Cryptographic Provider"'.
I have already tried these:
http://stackoverflow.com/questions/34006865/dsc-problems-with-credentials-and-build-10586
https://wespoint.wordpress.com/2017/01/19/powershell-dsc-encryption-issue/

Hi all,
I am using DSC partials to create role-based architectures with Azure virtual machines.
When switching to Windows 2016 (everything works great on Windows 2012 R2), I get errors when DSC is compiling the MOF.
The idea is that I have multiple partials that contain the same Windows Feature installation, because it's needed for a certain roles. When I apply more roles on the same machine, the partials need to merge. So I have one partial that contains this:
WindowsFeature DotNetFrameworkRole1
{
Name = 'AS-NET-Framework'
}
and another partial that contains this:
WindowsFeature DotNetFrameworkRole2
{
Name = 'AS-NET-Framework'
}
When applying the partials on same machine (again, works fine in Windows 2012), I get these errors on Windows 2016:

Job {B1BD89DA-1965-11E7-A942-000D3A27FE28} :
MIResult: 11
Error Message: The resources ('[WindowsFeature]DotNetFrameworkRole1' and '[WindowsFeature]DotNetFrameworkRole2') have conflicting values of the following properties: 'ModuleVersion'. Ensure that their values match. Merging of partial configurations failed. LCM failed to start desired state configuration manually.
Message ID: MI RESULT 11
Error Category: 20
Error Code: 11
Error Type: MI

Job {3CFCAF9F-1967-11E7-A942-000D3A27FE28} :
MIResult: 11
Error Message: The resources ('[WindowsFeature]DotNetFrameworkRole1' and '[WindowsFeature]DotNetFrameworkRole2') have conflicting values of the following properties: 'ModuleVersion'. Ensure that their values match. Merging of partial configurations failed.
Message ID: MI RESULT 11
Error Category: 20
Error Code: 11
Error Type: MI

Any ideas for this one?
Thank you,
Sorin

PS C:\Windows\system32> Get-PSRepository

Name InstallationPolicy SourceLocation
---- ------------------ --------------
PSGallery Untrusted https://www.powershellgallery.com/api/v2/
TestRepo Trusted \\NugetServer\BMNNuGet\packages

PS C:\Windows\system32> Find-Module * -Repository TestRepo

Version Name Repository Description
------- ---- ---------- -----------
1.0.1 cConfigNode TestRepo Provides a way to manipulate nodes of the xml configu...
1.3.0 cNtfsAccessControl TestRepo The cNtfsAccessControl module contains DSC resources ...
3.2.0 xNetworking TestRepo Module with DSC Resources for Networking area
1.0.0 xReleaseManagement TestRepo Host a custom DSC Resource to transform files based o...
1.17.0 xWebAdministration TestRepo Module with DSC Resources for Web Administration

PS C:\Windows\system32> Find-Module xNetworking -Repository TestRepo
PackageManagement\Find-Package : No match was found for the specified search criteria and module name 'xNetworking'. Try
Get-PSRepository to see all available registered module repositories.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:1360 char:3
+ PackageManagement\Find-Package @PSBoundParameters | Microsoft ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (Microsoft.Power...ets.FindPackage:FindPackage) [Find-Package], Exception
+ FullyQualifiedErrorId : NoMatchFoundForCriteria,Microsoft.PowerShell.PackageManagement.Cmdlets.FindPackage

PS C:\Windows\system32> Install-Module xNetworking -Repository TestRepo
PackageManagement\Install-Package : No match was found for the specified search criteria and module name 'xNetworking'. Try
Get-PSRepository to see all available registered module repositories.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:1772 char:21
+ ... $null = PackageManagement\Install-Package @PSBoundParameters
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (Microsoft.Power....InstallPackage:InstallPackage) [Install-Package], Excepti
on
+ FullyQualifiedErrorId : NoMatchFoundForCriteria,Microsoft.PowerShell.PackageManagement.Cmdlets.InstallPackage

PS C:\Windows\system32> $Credential

PS C:\Windows\system32> Find-Module xNetworking -Repository TestRepo -Credential (Get-Credential)
cmdlet Get-Credential at command pipeline position 1
Supply values for the following parameters:
PackageManagement\Find-Package : No match was found for the specified search criteria and module name 'xNetworking'. Try
Get-PSRepository to see all available registered module repositories.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:1360 char:3
+ PackageManagement\Find-Package @PSBoundParameters | Microsoft ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (Microsoft.Power...ets.FindPackage:FindPackage) [Find-Package], Exception
+ FullyQualifiedErrorId : NoMatchFoundForCriteria,Microsoft.PowerShell.PackageManagement.Cmdlets.FindPackage

PS C:\Windows\system32> Find-Module * -Repository TestRepo | Install-Module
PackageManagement\Install-Package : No match was found for the specified search criteria and module name 'xNetworking'. Try
Get-PSRepository to see all available registered module repositories.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:1875 char:34
+ ... $null = PackageManagement\Install-Package @PSBoundParameters
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (Microsoft.Power....InstallPackage:InstallPackage) [Install-Package], Excepti
on
+ FullyQualifiedErrorId : NoMatchFoundForCriteria,Microsoft.PowerShell.PackageManagement.Cmdlets.InstallPackage

PackageManagement\Install-Package : No match was found for the specified search criteria and module name
'xReleaseManagement'. Try Get-PSRepository to see all available registered module repositories.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:1875 char:34
+ ... $null = PackageManagement\Install-Package @PSBoundParameters
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (Microsoft.Power....InstallPackage:InstallPackage) [Install-Package], Excepti
on
+ FullyQualifiedErrorId : NoMatchFoundForCriteria,Microsoft.PowerShell.PackageManagement.Cmdlets.InstallPackage

Let me explain. I have a script that is collecting data, and I send it to StdOut by simply piping it into Select (but problem also happens if I add a ForEach loop and simply make [PSCustomObject] objects). Then my script loops to the next server. That output is not displaying on the screen. All is not lost though, when the script loops to the second server and displays both the first and second will now display. When the third server finishes it displays OK, as does the 4th.

So it looks like it's just the first one. Normally I would be OK with this, except that if the name of the second server is inputted wrong, my script will abort and the data from the first server disappears forever.

Has anyone else noted this behavior? I don't remember this happening before 5.1 and I have had multiple people able to reproduce this issue.

Problem description
--------------------------
INPUTS and OUTPUTS section of get-help -Full content shows some unwanted tab and new line characters for almost all cmdlets.

For e.g.,

get-help content with INPUTS and OUTPUTS section highlighted where extra new line and tab comes for every cmdlet help content.

INPUTS
PSObject OR array of PSObject OR String OR array of String


You can pipe one IP address or a list of IP addresses as Strings, or one PSObject or list of PSObjects having
the iLO details such as IP Address, Hostname, Username and Password to access the iLO.


OUTPUTS



PSObject[] is returned. Use Get-Member to get details of fields in returned objects.

Custom cmdlet help gets custom help for a provider cmdlet in a provider drive. In 5.0, the provider help, including custom cmdlet help, was missing. It's restored in 5.1, but it's not working.

Ugh, I can't post a screenshot.

Here's the repro:

1) Get-Help Get-ChildItem -Path Cert: -Parameter DnsName
[Should succeed; fails]

2) cd Cert:
PS Cert:\> Get-Help Get-ChildItem -Parameter DnsName
[Should succeed; fails]

3. #Verify that parameter exists
PS Cert:\> (gcm Get-ChildItem).ParameterSets.Parameters | where Name -eq DnsName
[succeeds]

4. #Verify that content is in help file.
PS Cert:\> [xml]$SecHelp = cat $pshome\en-US\Microsoft.PowerShell.Commands.Security.dll-help.xml

PS Cert:\>($SecHelp.helpItems.providerHelp.CmdletHelpPaths.CmdletHelpPath.command | where {$_.details.Name.Trim() -eq 'Get-ChildItem}).Parameters.Parameter | where Name -eq DnsName | foreach Description
[Succeeds]

Dynamic parameters of a cmdlet that are added by a provider are documented in the <providerHelp>\<cmdletHelpPaths> element of the help XML file.

The FileSystem provider adds the following parameters to Add-Content:

PS C:\> (Get-Command Add-Content).ParameterSets.Parameters | Where IsDynamic | foreach Name | Sort -Unique
Encoding
NoNewline
Stream

However, the Encoding and Stream parameters are documented in the primary help file, Microsoft.PowerShell.Commands.Management.dll-help.xml, so they appear in Get-Help even in provider drives where the parameter is not valid.

PS Function:\> (Get-Help Add-Content -Path function:).Parameters.Parameter | where Name -notin $common | foreach Name | Sort -Unique
Credential
Encoding # <----
Exclude
Filter
Force
Include
LiteralPath
PassThru
Path
Stream # <---
UseTransaction
Value
PS Function:\> (Get-Command Add-Content).ParameterSets.Parameters | where Name -notin $common | foreach Name | Sort -Unique
Credential
Exclude
Filter
Force
Include
LiteralPath
PassThru
Path
UseTransaction
Value

To complicate matters, the <providerHelp>\<cmdletHelpPaths> section of the help file that stores the content for this feature, documents the following parameters:

PS C:\ps-test> $sma.helpItems.providerHelp.CmdletHelpPaths.CmdletHelpPath.command | Where {$_.details.name.trim() -eq 'Add-Content'} | foreach {$
_.Parameters.Parameter.Name}
Encoding
Force #<-- Not dynamic
Stream
Confirm #<-- SupportsShouldProcess; not dynamic
WhatIf #<-- SupportsShouldProcess; not dynamic
UseTransaction #<-- SupportsTransactions; not dynamic

And, it is missing the NoNewLine dynamic parameter.

PS C:\> (Get-Command Add-Content).ParameterSets.Parameters.Name -eq 'NoNewLine'
NoNewline
NoNewline

PS C:\> Get-Help Add-Content -Parameter NoNewLine
Get-Help : No parameter matches criteria NoNewLine.
At line:1 char:1
+ Get-Help Add-Content -Parameter NoNewLine
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (System.Manageme...CommandHelpInfo:ProviderCommandHelpInfo) [Get-Help], PSArgu
mentException
+ FullyQualifiedErrorId : NoParmsFound,Microsoft.PowerShell.Commands.GetHelpCommand

The FileSystem provider adds the following dynamic parameters to Get-ChildItem:

PS C:\> (Get-Command Get-ChildItem).ParameterSets.Parameters | where IsDynamic | foreach Name | Sort -Unique
Attributes
Directory
File
Hidden
ReadOnly
System
But, these are all failing in Get-Help in the file system drives.

PS C:\> $dynam | foreach { if (!(Get-Help Get-ChildItem -Parameter $_ -ErrorAction SilentlyContinue)) { $_ } }
Attributes
Directory
File
Hidden
ReadOnly
System

Unlike the related bugs I've filed, I can't find the error in the help file. These parameters are (correctly) not documented in the cmdlet help, and they are correctly documented in the provider help.

PS C:\> [xml]$sma = cat $pshome\en-us\System.Management.Automation.dll-help.xml
PS C:\> $sma.helpItems.providerhelp | where { $_.Name.trim() -eq 'FileSystem' } |
>> foreach { $_.CmdletHelpPaths.CmdletHelpPath.command } |
>> where { $_.details.name.Trim() -eq 'Get-ChildItem' } |
>> foreach { $_.parameters.parameter.name }
>>
Attributes
Directory
File
Hidden
ReadOnly
System

This might be an actual code error in Get-Help, but it's more likely to be an error in the help XML file that I just haven't detected.
Force
UseTransaction

Concurrent operations on an open shell always increase (eg, for each command run) even when the Terminate signal message is sent and (apparently) properly processed after each command. This eventually causes the MaxConcurrentOperationsPerUser quota to be hit, requiring a new shell to be created.

A simple reproduction using pywinrm is available at: https://github.com/diyan/pywinrm/issues/124. I'm guessing there's just something wrong with the way the Terminate signal is being sent by pywinrm, but the server appears to be happy with it.

To run the repro, ensure python and pip are available, create a file with the repro code (and adjust the wsman endpoint, username, password, and change the "transport" arg to ntlm if basic isn't configured) then do:
pip install pywinrm==0.2.0
python (path_to_repro).py

Lower the MaxConcurrentOperationsPerUser to something less than 100 to hit the repro more quickly.