In Azure Automation DSC the whole MOF file gets encrypted without the need to manually issue certificates for every node and then to collect the public keys.

From Azure documentation:
"Keeping credentials secure in node configurations (MOF configuration documents) requires encrypting the credentials in the node configuration MOF file. Azure Automation takes this one step further and encrypts the entire MOF file."

This extremely useful feature sould also be implemented in the on-premises DSC pull server. Especially because the needed functionality must alread be in the WMF 5 as nothing more than WMF 5 is needed to use the Azure Automation DSC service.

This would be huge improvment for the DSC pull server.

Thx!

At some point in the 5.0 time period, Update-Help installed About topic files in the en-US directory for the PSWorkflow module with .txt (not .help.txt) file name extensions.

e.g. about_Foreach-Parallel.txt

Later, this was fixed and Update-Help installed the same help files in the same directory with the (correct) ".help.txt" file name extension.

e.g. about_Foreach-Parallel.help.txt

Now, the PSWorkflow\en-US directory has 9 pairs of files that are identical except for the file name extension.

about_ActivityCommonParameters.help.txt
about_ActivityCommonParameters.txt
about_Checkpoint-Workflow.help.txt
about_Checkpoint-Workflow.txt
about_Foreach-Parallel.help.txt
about_Foreach-Parallel.txt
about_InlineScript.help.txt
about_InlineScript.txt
about_Parallel.help.txt
about_Parallel.txt
about_Sequence.help.txt
about_Sequence.txt
about_Suspend-Workflow.help.txt
about_Suspend-Workflow.txt
about_WorkflowCommonParameters.help.txt
about_WorkflowCommonParameters.txt
about_Workflows.help.txt
about_Workflows.txt

Get-Help should ignore the .txt files (must have changed in 4.0), but it does not. Instead, it finds both .txt and .help.txt. So, when you run Get-Help, instead of displaying help for the topic, it lists the duplicate base names.

PS C:\ps-test> Get-Help about_Foreach-Parallel

Name Category Module Synopsis
---- -------- ------ --------
about_ForEach-Parallel HelpFile Describes the ForEach
about_Foreach-Parallel HelpFile Describes the ForEach

I'm not sure why Get-Help is recognizing About.txt files.

But, we had a similar problem in a module when we shipped a file with corrected capitalization in the base name.

about_FileName.help.txt
about_filename.help.txt

We might want to tweak Get-Help so that when it detects an exact duplicate base name, it displays the content in the newest file.

Also, in modules, Get-Help should display the help only for the version of the module that it's processing. That would allow module authors to update help topic names without causing unintended duplicates.

For some reason DSC errors out with a credential object contains a null password. Unfortunately that is the mechanism use to set group managed service accounts.
Here is a link to a relevant bug in xWebAdministration: https://github.com/PowerShell/xWebAdministration/issues/80#issuecomment-171364644

And here is an example of the output your recieve when you attempt to use a managed service account:

"VERBOSE: [COMPUTERNAME]: LCM: [ End Test ] [[xWebAppPool]testpool] in 0.0070 seconds.
The password supplied to the Desired State Configuration resource MSFT_xWebAppPool is not valid. The password cannot be null or empty.
+ CategoryInfo : InvalidResult: (:) [], CimException
+ FullyQualifiedErrorId : InvalidPassword
+ PSComputerName : localhost

Votes from Connect: 391

Original Date Submitted: 5/21/2015 12:20:32 AM

Description:
********Contact Information********
Handle: June Blender
Site Name: PowerShell
Feedback ID: 1351032
***************************************

Problem Description:
PowerShell users often read .NET reference pages in MSDN. It's all but required, because Get-Help doesn't describe object members. However, in the Examples section of .NET reference pages, there are no PowerShell examples; not even a PowerShell tab.

MSDN says they cannot demonstrate a demand for PowerShell examples. I'd like to use this feature request to demonstrate the demand.

Product Studio item created by Connect Synchronizer due to creation of feedback ID 1351032 (http://connect.microsoft.com/PowerShell/feedback/ViewFeedback.aspx?FeedbackID=1351032).

Repro Steps:

Internal BugId: 14500

The New-LocalUser cmdlet available in Windows 10 Anniversary Update cannot perform a function described in the documentation.

Local user accounts may be connected with existing Microsoft accounts. New-LocalUser should support this by accepting a -Name parameter of the form "MicrosoftAccount\<user>@outlook.com". This is described in the detailed help.

However this fails because the parameter fails validation as it is over 20 characters in length (already true with "MicrosoftAccount\" and "@outlook.com" let alone the "actual" user name). The 20 character limit is valid for a regular local account name, but shouldn't be valid for an MS account name.

There appears no other way I can find to create a local user account with an existing MS account; so this is rather major.

Note that also the error message from the "problematic" call is also of spurious grammar (where it inserts the length of the name parameter provided):

PS C:\WINDOWS\system32> New-LocalUser -name 'MicrosoftAccount\me@outlook.com'
New-LocalUser : Cannot validate argument on parameter 'Name'. The character length of the 31 argument is too long. Shor
ten the character length of the argument so it is fewer than or equal to "20" characters, and then try the command agai
n.
At line:1 char:21
+ New-LocalUser -name 'MicrosoftAccount\me@outlook.com'
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidData: (:) [New-LocalUser], ParameterBindingValidationException
+ FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.NewLocalUserCommand

Renamed from "Provide additional resource control methods in DSC" for clarity
Votes from Connect: 13

Original Date Submitted: 5/28/2015 12:15:20 AM

Description:
********Contact Information********
Handle: Ben Gelens
Site Name: PowerShell
Feedback ID: 1373894
***************************************

Problem Description:
Scenario:
A MOF file is compiled for a node serving a website. The service resource is used to declare the W3SVC service to be started and the file resource is used to copy in the web content.
Next an update is deployed to the website by compiling a new MOF file and for the new content to become active, the W3SVC service needs to be restarted.

Right now we need to do this in stages as we need to compile an intermediate MOF file to stop the W3SVC service.
When dealing with continues deployment / integration utilizing DSC Push or Pull, it would be greatly beneficial if DSC could leverage additional functionality so a resource could actually trigger a restart of a service by calling the service resource governing the status of that service and allowing this action to take place.

Of course this should not be implemented only for the service resource but would apply to others as well.

Chef has implemented this concept in all its resources where they can specify a Notify on one resource and an Action on another. For example: when a file mutation has taken place, it could notify the service resource to handle the restart action.

Suggestion:
Enrich DSC with additional native functionality to allow us to signal resources to take actions as the desired state of another resource is re-implemented / restored.

Code Example using registry:
configuration MyWebSite {

WindowsFeature SNMP-Service {
Name = 'SNMP-Service'
Ensure = 'Present'
}

service SNMP {
Name = 'SNMP'
StartupType = 'Automatic'
State = 'Running'
Action = 'Restart','Start','Stop'
DependsOn = '[WindowsFeature]SNMP-Service'
}

Registry Community {
Key = 'HKLM:\System\CurrentControlSet\Services\SNMP\Parameters\ValidCommunities'
ValueName = 'MyCommunity'
ValueData = '10'
ValueType = 'Dword'
Ensure = 'Present'
Force = $true
Notify = '[Service]SNMP:Action:Restart'
}
}
In this example we make sure SNMP service is installed, the service has the desired state of started and a registry key is set to configure the SNMP service with a valid community setting.
The registry setting will only be activated once the SNMP service is restarted so we setup a notify on the registry resource and allow it to trigger the Action of restart on the resource governing the SNMP service.

Product Studio item created by Connect Synchronizer due to creation of feedback ID 1373894 (http://connect.microsoft.com/PowerShell/feedback/ViewFeedback.aspx?FeedbackID=1373894).

Repro Steps:

Internal BugId: 14519

Example:

$Get-Process | select -First 5 | ft -au

Handles NPM(K) PM(K) WS(K) VM(M) CPU(s) Id ProcessName
------- ------ ----- ----- ----- ------ -- -----------
716 47 32832 43396 587 1764 AdminManagerClient
257 34 3432 9352 84 1128 AgentService
495 78 15700 28528 154 3744 AppVClient
244 35 60952 41796 692 0.56 5416 AppVStreamingUX
591 18 17280 22992 108 1,751.98 4672 audiodg

$Get-Process | select -First 5 | ft -markdown

|Handles|NPM(K)|PM(K)|WS(K)|VM(M)| CPU(s)| Id|ProcessName |
|-------|------|-----|-----|-----|--------|----|------------------|
| 716| 47|32832|43396| 587| |1764|AdminManagerClient|
| 257| 34| 3432| 9352| 84| |1128|AgentService |
| 495| 78|15700|28528| 154| |3744|AppVClient |
| 244| 35|60952|41796| 692| 0.56|5416|AppVStreamingUX |
| 591| 18|17280|22992| 108|1,751.98|4672|audiodg |

This could be pasted to a morkdown file and would be nicely rendered as a table.

The Other way to read tables from markdown woulb de nice to. It would require a syntax for naming tables and referencing them in markdown. It would allow very readable configuration files.

(Sorry here is no monospace font available)

I can successfully create a disabled local user account on a non-domain joined server which has a password policy enforced.

If I try to create the disabled account with out a password, or one in violation of the policy, the configuration fails. This is expected.

If I create a disabled local user account with a password that meets the requirements, the configuration applies. When I run Test-DSCConfiguration the test fails with:
PowerShell DSC resource MSFT_UserResource failed to execute Test-TargetResource functionality with error message:
There could be a possible connection error while trying to use the System.DirectoryServices API's.Exception calling
"ValidateCredentials" with "2" argument(s): "This user can't sign in because this account is currently disabled.
"
+ CategoryInfo : InvalidOperation: (root/Microsoft/...gurationManager:String) [], CimException
+ FullyQualifiedErrorId : ProviderOperationExecutionFailure
+ PSComputerName : localhost

Wouldn't this lead to the configuration constantly running every cycle?

I am trying to update Pester on Windows 2016 to 4.x because the preshipped Pester 3.4.0 emits a note about the depreciation of the -quiet switch when I use the quiet switch. This get's scooped into stdout when executing via AWS SSM remote commands. Version 3.x complains it does not understand "-Show None".

I want to update to 4.x - in which I ran into all the problems documented here: https://github.com/OneGet/oneget/issues/215

But ended up with "Install-module pester -force -SkipPublisherCheck.

So far so bad, but when I go to remove the 3.4.0 version (with admin rights) from: 'c:\program files\windowspowershell\modules\pester\3.4.0' I get errors because only TrustedInstaller has permissions.

If this scenario wasn't horrible enough, putting preinstalled modules under Windows Resource Protection really throws it over the top.

Could someone please make sure that preinstalled modules can be *replaced* cleanly? Or don't preinstall them?