In a recent change, the new database for the on-prem Pullserver is now ESENT. Had a question for clarification.

As an old Exchange guy, I have fears that immediately pop into mind. The logs files do not appear to be using circular logging (a way of self cleaning and restricting the amount of log files) – Is this true?

If so, then I’m guess that the log files will continue to grow until the disk is full – which happens to exchange if the log files are not truncated. Is there a way today or in the future we will be able to manage the log files?

Thanks for the help understanding!

OS: Windows Server 2016 1607 (14393.1593)
PSVersionTable:
Name Value
---- -----
PSVersion 5.1.14393.1532
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.14393.1532
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

PSDscResource module: v2.8.0.0

Take a look at this configuration:
Configuration DependentConfig
{
Import-DscResource -ModuleName PSDscResources -Name Registry

Node MyNode01
{

File SetupScript
{
DestinationPath = 'C:\Scripts\hello.txt'
Contents = 'somecommand'
Type = 'File'
Ensure = 'Present'
DependsOn = '[Registry]regCheck'
}

Registry regCheck
{
Key = 'HKEY_LOCAL_MACHINE\SYSTEM\SomeKey'
ValueName = 'SomeValue'
ValueData = 0
ValueType = 'DWord'
Ensure = 'Present'
}
}
}

DependentConfig -OutputPath C:\DependentConfig

This requires PSDscResources module version 2.8.0.0 from the gallery and the file resource from the PSDesiredStateConfiguration in-box module. However, compiling this configuration will fail with a message that File resource cannot be loaded. If we remove -Name File from the first import command, you will see an error that Registry resource cannot be found. We have to use -Name with PSDscResources since PSDesiredStateConfiguration already exports the same resource.

So, the only work around at this time is to remove the PSDesiredStateConfiguration import completely from the configuration so that we can at least compile this. Here is something that works.

Configuration DependentConfig
{
Import-DscResource -ModuleName PSDesiredStateConfiguration
Import-DscResource -ModuleName PSDscResources -Name Registry

Node MyNode01
{

File SetupScript
{
DestinationPath = 'C:\Scripts\hello.txt'
Contents = 'somecommand'
Type = 'File'
Ensure = 'Present'
DependsOn = '[Registry]regCheck'
}

Registry regCheck
{
Key = 'HKEY_LOCAL_MACHINE\SYSTEM\SomeKey'
ValueName = 'SomeValue'
ValueData = 0
ValueType = 'DWord'
Ensure = 'Present'
}
}
}

DependentConfig -OutputPath C:\DependentConfig

Votes from Connect: 17

Original Date Submitted: 8/13/2015 12:17:49 AM

Description:
********Contact Information********
Handle: PowerShellDon
Site Name: PowerShell
Feedback ID: 1659904
***************************************

Problem Description:
Suggestion one:

Add maintenance window awareness to the Local Configuration Manager. Edited via metaconfig, it specifies times when configuration changes are acceptable, when automated reboots are acceptable. Further automates configuration maintenance especially when you're implementing changes vs. correcting drift.

Suggestion two:

Add universal "DoNotImplementBefore" and "ImplementBy" settings to DSC resources. Just as "Present=" specifies to add/remove something, these would indicate a date/time for the setting to become valid (e.g., "we want to implement a bunch of changes, but not before x date") and a deadline by which the setting just be implemented (e.g., "this has to happen by x date"). The latter might play into the LCM configuration: For example, when set to ApplyAndAutoCorrect, even if AutoReboot=$false, an auto reboot may occur once a setting passes its "ImplementBy" date/time without previously being implemented.

These suggestions reflect some of the realities of managing a production environment.

Product Studio item created by Connect Synchronizer due to creation of feedback ID 1659904 (http://connect.microsoft.com/PowerShell/feedback/ViewFeedback.aspx?FeedbackID=1659904).

Repro Steps:

Internal BugId: 15730

Votes from Connect: 42

Original Date Submitted: 4/10/2015 11:19:28 PM

Description:
********Contact Information********
Handle: Trevor Sullivan [MVP]
Site Name: PowerShell
Feedback ID: 1238786
***************************************

Problem Description:
The Out-GridView command displays all of the properties of each object that is fed into it. Consequently, in order to make the tool more usable, the Select-Object command can be used to inclusively filter the key properties of each object, to display to the end user. Unfortunately, this process results in a modified object, that cannot be used for all intended purposes.

Instead of using Select-Object, a -DisplayProperty parameter should be added to Out-GridView, so that unmodified objects can be piped into it, while only the specified properties are displayed. The pipeline output from Out-GridView should emit the unmodified objects.

Product Studio item created by Connect Synchronizer due to creation of feedback ID 1238786 (http://connect.microsoft.com/PowerShell/feedback/ViewFeedback.aspx?FeedbackID=1238786).

Repro Steps:

Internal BugId: 14376

Currently, if you have a configuration that installs a Windows feature then has another step that configures settings using a module that gets installed with that particular feature, the LCM fails its check because that module is not currently present on the node.

For example, we have a configuration that installs the Web-Server role. There are later steps which use the xWebAdministration resource to configure things like Application Pools and Application Pool defaults. The problem is, when the LCM pulls the configuration and runs it's checks, it fails because the xWebAdministration resource uses cmdlets that are present in the WebAdministration module which gets installed with the Web-Server role. Since that role is not installed, the LCM fails saying the WebAdministration module is not present.

Because of this, we need to split our configurations up into 2 and manually apply both. It would be nice if the LCM could use some kind of logic to accommodate for modules that will become available after certain roles are installed or configuration steps are completed.

Votes from Connect: 3

Original Date Submitted: 6/8/2015 2:40:45 PM

Description:
********Contact Information********
Handle: aL3891
Site Name: PowerShell
Feedback ID: 1411231
***************************************

Problem Description:
At the moment all dsc resources are executed serially. given that dependencies are allready specified, it would in theory be safe to execute steps in parallel.

I'm guessing this is planned at some point but i could really use a way to enable parallel execution because I'm using dsc to spin up test environments with a bunch of services and having those being set up in parallel would speed things up considerably.

Product Studio item created by Connect Synchronizer due to creation of feedback ID 1411231 (http://connect.microsoft.com/PowerShell/feedback/ViewFeedback.aspx?FeedbackID=1411231).

Repro Steps:

Internal BugId: 14550

NuGet feeds allow security around both listing/retrieving packages as well as pushing packages. NuGet.exe and other clients further allow you to persist credentials for listing/retrieving packages using the "nuget sources" command. (https://docs.nuget.org/consume/command-line-reference#sources-command)

This persistence is important for two reasons:

1) When you push a package to a secured NuGet feed, NuGet clients generally do a list/read operation first. That list/read operation doesn't contain any API key that you pass along in the push operation. In order for a push to succeed with an API key, you also need to have credentials set for the read operation. You can read about some folks who have been affected by that here: http://inedo.com/support/questions/2319

2) In an unattended/build server scenario, you need the ability to provide credentials for list/read and push in a non-interactive way. If the only way to provide credentials is interactive (e.g., Get-Credential) then there's no way to, say, enable a build server agent to automatically install required scripts to execute a build.

This may somewhat overlap with this other note about Register-PSRepository failing against authenticated endpoints: http://windowsserver.uservoice.com/forums/301869-powershell/suggestions/11678499-register-psrepository-fails-against-authenticated

Votes from Connect: 5

Original Date Submitted: 2/20/2015 2:01:32 PM

Description:

********Contact Information********
Handle: john.s2011n
Site Name: PowerShell
Feedback ID: 1139497
***************************************

Frequency: Always Happens
Regression: Yes, this happens in all previous versions

Problem Description:
in PS 4.0 and also previous versions, there is no option to easily convert multiple selected lines to comment block. so when we have selected multiple lines & we want to make them as comment, we have to insert comment block in another location on the pane, and then cut these multiple lines and paste them inside comment block which is a bit cumbersome.
but in other products like VBA2013, this option exist & there is a button on edit toolbar which converts multiple lines into comment, in place.

hope this be added in PS 5.0
thanks

Product Studio item created by Connect Synchronizer due to creation of feedback ID 1139497 (http://connect.microsoft.com/PowerShell/feedback/ViewFeedback.aspx?FeedbackID=1139497).

Repro Steps:
Expected Results:

Internal BugId: 13253

On 2 Fully Updated Windows Server 2016 Machines running and provisioned from Azure I have created a Pull Server Configuration. I have created the DSC Signing Certificate using a custom template on a Enterprise Root CA which has worked for 2012R2 nodes and also tested using xDSCUtils New-xSelfSignedDscEncryptionCertificate. Using the same Certificate to Compile and Execute the MOF on the same Computer works, it is only if you compile on one and execute on another that the problems arise.
I kept getting errors when passing in credentials. I therefore wrote a tiny custom DSC Resource that Displays the Password as clear text when I run Start-DSCConfiguration -Wait -Verbose
You can find it here https://gist.github.com/aboersch/65e846a4966fe2c4708ed21d655a54a7
The Client does not correctly decrypt the Credentials. As a Password I am receiving
-----BEGIN CMS-----
<Long Multi-Line Base64 String>
-----END CMS-----
If I pass this to Unprotect-CmsMessage I receive the correct Password.
The Certificate passes $_.PrivateKey.KeyExchangeAlgorithm and $_.Verify
I have tried changing the Certificate Provider to '"Microsoft Enhanced Cryptographic Provider v1.0"', '"Legacy Cryptographic Service Provider"', and '"Microsoft RSA SChannel Cryptographic Provider"'.
I have already tried these:
http://stackoverflow.com/questions/34006865/dsc-problems-with-credentials-and-build-10586
https://wespoint.wordpress.com/2017/01/19/powershell-dsc-encryption-issue/

Votes from Connect: 12

Original Date Submitted: 4/4/2015 8:50:49 AM

Description:
********Contact Information********
Handle: Arnoud Jansveld
Site Name: PowerShell
Feedback ID: 1224213
***************************************

Frequency: PowerShell ISE
Regression: function Show-Form
{
[reflection.assembly]::LoadWithPartialName("System.Windows.Forms") >$null
$form = New-Object System.Windows.Forms.Form
$label = New-Object System.Windows.Forms.Label
$label.Text = "Please close this form"
$label.AutoSize = $true
$form.Controls.Add($label)
$form.ShowDialog()
}

$result = Show-Form

# Workaround (slow):
# $result = Start-Job ${function:Show-Form} | Receive-Job -Wait -AutoRemoveJob

"Form result: " + $result.ToString()

Write-Warning "The following step may hang PowerShell ISE, save your work!"
Read-Host -Prompt "Hit Enter or Ctrl-C to abort"

# This generates a WM_SETTINGCHANGE broadcast message
[Environment]::SetEnvironmentVariable("foo", "bar", "User")

Problem Description:
After using ShowDialog() to display a Windows Forms dialog, the ISE will hang when it receives a WM_SETTINGCHANGE broadcast message (e.g. when changing display resolution, switching from a laptop screen to an external monitor or connecting to the current session from another machine via RDP).

This was reproduced on PowerShell ISE version 4 and 5 (Feb preview). Sadly it affects many useful scripts, including Lee Holmes' (awesome) Show-Object.

Product Studio item created by Connect Synchronizer due to creation of feedback ID 1224213 (http://connect.microsoft.com/PowerShell/feedback/ViewFeedback.aspx?FeedbackID=1224213).

Repro Steps:
function Show-Form
{
[reflection.assembly]::LoadWithPartialName("System.Windows.Forms") >$null
$form = New-Object System.Windows.Forms.Form
$label = New-Object System.Windows.Forms.Label
$label.Text = "Please close this form"
$label.AutoSize = $true
$form.Controls.Add($label)
$form.ShowDialog()
}

$result = Show-Form

# Workaround (slow):
# $result = Start-Job ${function:Show-Form} | Receive-Job -Wait -AutoRemoveJob

"Form result: " + $result.ToString()

Write-Warning "The following step may hang PowerShell ISE, save your work!"
Read-Host -Prompt "Hit Enter or Ctrl-C to abort"

# This generates a WM_SETTINGCHANGE broadcast message
[Environment]::SetEnvironmentVariable("foo", "bar", "User")

Expected Results:
The script should show an empty dialog; after closing it and hitting Enter at the prompt the ISE should remain responsive (on some occasions the script has to be run more than once for the problem to occur).

This works fine in the regular PowerShell console.

Internal BugId: 14363

(Originally posted in https://connect.microsoft.com/PowerShell/feedback/details/1852524)

Standard CIM cmdlets can produce invalid output. I reproduced the problem with
two commands — Get-SmbShareAccess and Enable-NetAdapterChecksumOffload.
I also believe that the problem is not limited to these particular commands.

Below is an example of me executing 'Get-SmbShareAccess C$, D$' twice. Please
note that the first output is incorrect and it shows 6 entries for C$, instead
of expected 3 entries for C$ and 3 entries for D$:

PS C:\> Get-SmbShareAccess C$, D$

Name ScopeName AccountName AccessControlType AccessRight
---- --------- ----------- ----------------- -----------
C$ * BUILTIN\Administrators Allow Full
C$ * BUILTIN\Administrators Allow Full
C$ * BUILTIN\Backup Operators Allow Full
C$ * BUILTIN\Backup Operators Allow Full
C$ * NT AUTHORITY\INTERACTIVE Allow Full
C$ * NT AUTHORITY\INTERACTIVE Allow Full

PS C:\> Get-SmbShareAccess C$, D$

Name ScopeName AccountName AccessControlType AccessRight
---- --------- ----------- ----------------- -----------
C$ * BUILTIN\Administrators Allow Full
C$ * BUILTIN\Backup Operators Allow Full
C$ * NT AUTHORITY\INTERACTIVE Allow Full
D$ * BUILTIN\Administrators Allow Full
D$ * BUILTIN\Backup Operators Allow Full
D$ * NT AUTHORITY\INTERACTIVE Allow Full

This problem occurs randomly — i.e., sometimes the output is correct, and
sometimes it is not.

Below is another example of me executing Enable-NetAdapterChecksumOffload for
two adapters, with the same problem. The first output is incorrect:

PS C:\> Enable-NetAdapterChecksumOffload A, B -IpIPv4 -PassThru

Name IpIPv4Enabled TcpIPv4Enabled TcpIPv6En
abled
---- ------------- -------------- ---------
A RxTxEnabled RxTxEnabled Disabled
A RxTxEnabled RxTxEnabled Disabled

PS C:\> Enable-NetAdapterChecksumOffload A, B -IpIPv4 -PassThru

Name IpIPv4Enabled TcpIPv4Enabled TcpIPv6En
abled
---- ------------- -------------- ---------
A RxTxEnabled RxTxEnabled Disabled
B RxTxEnabled RxTxEnabled Disabled

Additional notes:

- The problem happens in both PowerShell 4 (4.0) and 5 (5.0.10514.0)

- The problem doesn't happen with -ThrottleLimit 1

- The problem doesn't happen if the objects are taken from the pipeline, for
example, with Get-SmbShare C$, D$ | Get-SmbShareAccess

- The problem happens from time to time, so a loop like below can be useful
in reproducing it:

while (1) { Write-Host ''; Get-SmbShareAccess C$, D$ }

- From my observations, the problem occurs with CIM cmdlets that invoke a
non-static CIM method with output ¹ when these methods are executed in
parallel for multiple CIM instances.

¹ A method with [Out]-parameter in .mof file and with the corresponding
<CmdletOutputMetadata> tag in the .cdxml file.

------------------------------------------------------

Please note that the described problem is not specific to the File Share cmdlet
(Get-SmbShare), but can also be reproduced with other commands — e.g., with
Enable-NetAdapterChecksumOffload, which is unrelated to File Sharing.

A common thing about these examples is that they perform concurrent requests
to the CIM provider and then join the results. The problem doesn't happen
with -ThrottleLimit 1, and I tend to think that the root of the problem is a
race condition happening somewhere around the following method:

Microsoft.PowerShell.Cmdletization.Cim.ExtrinsicMethodInvocationJob.OnNext()

The method is a part of Microsoft.PowerShell.Commands.Management.dll assembly.

As a blind guess, it could be that, when joining the results, the resulting
CIM object from another request is being incorrectly reused and treated as
the result of the request that's currently being processed. That could explain
the duplicated entries in the output.

When upgrading to WMF 5.1, we are seeing errors in the DSC event log on servers that use a configuration with encrypted content (passwords). We are using encrypted credentials to create application pools and assign a service account as the identity. The data gets decrypted fine and the app pools get created with the correct identities. However the following error gets logged in the DSC event log every time a consistency check runs:

Job :
Message Cannot unprotect message. The input contained no encrypted content. Specify the '-IncludeContext' parameter if you wish to output the original content when no encrypted content is detected.
HResult -2146233087
StackTrack at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input)
at System.Management.Automation.PowerShell.Worker.ConstructPipelineAndDoWork(Runspace rs, Boolean performSyncInvoke)
at System.Management.Automation.PowerShell.Worker.CreateRunspaceIfNeededAndDoWork(Runspace rsToUse, Boolean isSync)
at System.Management.Automation.PowerShell.CoreInvokeHelper[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
at System.Management.Automation.PowerShell.CoreInvoke[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
at Microsoft.PowerShell.DesiredStateConfiguration.Internal.ResourceProviderAdapter.CMS_DecryptMessage(String thumbprint, String encryptedMessage, IStreamsHandler plugInStreamsHandler, String& outputResult, IntPtr& errorInstanceHandle)

We updated our certificate to use the new requirements for WMF 5.1 and everything looks fine there.

I ran into this one, after I noticed my newly patched workstation was still turned on in the morning even though I had explicitly requested it to shutdown at a certain time. Basically the repro steps are as follows:

> Open Non-Administrative Shell
> Stop-Computer
Output:
stop-computer : Privilege not held.
At line:1 char:1
+ stop-computer
+ ~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (***:String) [Stop-Computer], ManagementException
+ FullyQualifiedErrorId : StopComputerException,Microsoft.PowerShell.Commands.StopComputerCommand

Administrative shell works as expected, this specific workstation has never participated in any fast/slow ring builds. Windows version is 15063.138

Another Windows 10 system, fast ring, that is on build 15063.14 does not exhibit this behavior. Starting PowerShell -version 2 and then running Stop-Computer still works, as does running it from administrative shell.

Full log is available below:

Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.

PS C:\Users\Jaap Brasser> stop-computer
stop-computer : Privilege not held.
At line:1 char:1
+ stop-computer
+ ~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (***:String) [Stop-Computer], ManagementException
+ FullyQualifiedErrorId : StopComputerException,Microsoft.PowerShell.Commands.StopComputerCommand

PS C:\Users\Jaap Brasser> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name Description State
============================= ==================================== ========
SeShutdownPrivilege Shut down the system Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeUndockPrivilege Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
SeTimeZonePrivilege Change the time zone Disabled
PS C:\Users\Jaap Brasser> $psversiontable

Name Value
---- -----
PSVersion 5.1.15063.138
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.15063.138
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

PS C:\Users\Jaap Brasser> powershell -version 2
Windows PowerShell
Copyright (C) 2009 Microsoft Corporation. All rights reserved.

PS C:\Users\Jaap Brasser> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name Description State
============================= ==================================== ========
SeShutdownPrivilege Shut down the system Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeUndockPrivilege Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
SeTimeZonePrivilege Change the time zone Disabled
PS C:\Users\Jaap Brasser>