Forum Widgets
Latest Discussions
PowerShell implicit remoting without connection to server
When I start a PowerShell session on my local computer, and then run: Get-Module -Name FailoverClusters I can see that implicit remoting is used (and I can see the temporary files generated for this), and an output is generated. Needless to say that I don't have the FailoverClusters module installed anywhere on the local machine (I've verified $Env:PSModulePath as well). I don't have any connection to a server when running the command. Maybe somebody can explain to me what PowerShell is doing to find the FailoverClusters module and the cmdlets contained therein?
Intermittent issues with PowerShell Command Responses Since May 10, 2025
Since May 10, 2025, we have observed unexpected behavior intermittently in the responses of the following PowerShell commands. Could you please investigate the issues outlined below? Get-CsTenantFederationConfiguration: The AllowPublicUsers property appears in the command output, but when the response is passed to ConvertTo-Json, the AllowPublicUsers value is missing. Please refer to the attached screenshot for reference. Get-CsExternalAccessPolicy: The EnablePublicCloudAccess property, which is expected to return a boolean value, is now returning null. These issues are not isolated to a specific instance — we are intermittently observing the same behavior across multiple Office 365 tenants. Looking forward to your assistance.
Set-ACL "Attempted to Perform an Unauthorized Operation"
Hi Folks, I'm currently working on automating security changes on Azure File Shares. As part of this process, I'd like to use Get-ACL and Set-ACL as the easiest ways to copy over a base set of permissions - icacls doesn't have as good functionality for this as it only allows restoring permissions to a file of the same name. However, whenever I use Set-ACL, I immediately get: Set-Acl : Attempted to perform an unauthorized operation. At line:1 char:55 + ... ath | Set-Acl -Path $concatPath + ~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : PermissionDenied: () [Set-Acl], UnauthorizedAccessException + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.SetAclCommand As a note I have removed path names. The account I'm using is a domain admin and has NTFS permission to the file. It can edit these permissions using the GUI with no issues. It also has an Elevated Contributor role in Azure AD, so it should be able to edit these ACLs. I've also tried the NTFSSecurity module, which has the same issues. Similarly, I have tried to mount the fileshare to a drive with New-PSDrive, in case that helped, but no luck there either. I'm pretty out of ideas here, and icacls will require a lot more logic work to strip back the inherited permissions to what I want them to be. If anyone has any other ideas, I'd love to hear them. Thanks in advance!Connecting to multiple Microsoft services with the same session
Hi guys. Working on a script that needs to connect to ExchangeOnlineManagement, TeamsOnlineManagement, SharePointOnlineManagement.... The script will be used across many different tenants, and I also plan to make it publicly available, so 1) I don't really want to pre-configure some complicated key setup and 2) I don't really want to have login pop-ups over and over again... For ExchangeOnline, I learned (accidentally), if I do this: $upn = Read-Host -Prompt "input yer wahawha" Connect-ExchangeOnline -userprimaryname $upn Connect-IPPSsession -userprimaryname $upn And login to MY tenant, I don't get prompted for login. I think likely because my device is Entra-joined, and it's using my Microsoft account. But even if I use a different account, it will only prompt me once - reusing it for the other. This is great, and exactly how I wanted things to flow - but now I'm trying to do Connect-SPOService (sharepoint) and Connect-MicrosoftTeams... and while both of these are part of the tenant, they don't take the -userprimaryname param - so I can specify to use the account I'm logged into my PC with.. The end-goal is to have this script run with minimal user input. I've SORT OF found a workaround for SharePoint, where I can get the SharePointSite from ExchangeOnline, then modify it a bit and use it as input for Connect-SPOService... but Teams, while it doesn't have the URL param requirement, DOES prompt me to login again. Is there a way to use the existing session for either of these, like I've done with ExchangeOnline / IPPSSession? We have MFA enabled, though not required from within our company network - but when I try to use Get-Credential, it errors me out because it wants MFA.
PowerShell Script to Follow a SharePoint Site for a User
Good morning! I've been struggling with this for a while now. I've tried multiple scripts that are supposed to do this and run into many errors. I have a new script I found, which seems to mostly work, but it gives me this one error: Write-Error: Response status code does not indicate success: Forbidden (Forbidden). It looks like a permissions issue. I'm executing this in VSC, running under my user account, but when it connects to Graph, I'm authenticating it as my admin account, which has the following roles: I do realize how easy it is for users to follow a site, but this is one of those messed-up political situations, so I need a way to do this. After the error, it just hangs here: Add users to follow site(. [Adding user 'Ken Ce.] Here is the script I'm using: # Example: .\Add-FollowUserSite.ps1 -UsersMail "user1@[domain].com","user2@[domain].com","user3@[domain].com" -SitesUrl "https://[domain].sharepoint.com" [CmdletBinding()] param( [Parameter(Mandatory=$true,HelpMessage="List of Users Mails")] [String[]]$UsersMail=@("user1@[domain].com","user2@[domain].com","user3@[domain].com"), [Parameter(Mandatory=$true,HelpMessage="List of SharePoint Url to follow")] [String[]]$SitesUrl=@("https://[domain].sharepoint.com") ) Begin{ # Validate Modules ffor Microsoft graph users exist if (Get-Module -ListAvailable -Name microsoft.graph.users) { Write-Host "Microsoft Graph Users Module Already Installed" } else { try { Install-Module -Name microsoft.graph.users -Scope CurrentUser -Repository PSGallery -Force -AllowClobber } catch [Exception] { $_.message } } # Validate Modules ffor Microsoft graph users exist if (Get-Module -ListAvailable -Name microsoft.graph.sites) { Write-Host "Microsoft Graph Sites Module Already Installed" } else { try { Install-Module -Name microsoft.graph.sites -Scope CurrentUser -Repository PSGallery -Force -AllowClobber } catch [Exception] { $_.message } } # Import Modules Microsoft.Graph.users and Microsoft.Graph.sites to be used Import-Module Microsoft.Graph.users Import-Module Microsoft.Graph.sites Write-Host "Connecting to Tenant" -f Yellow Connect-MgGraph -Scopes "Sites.ReadWrite.All", "User.Read.All" Write-Host "Connection Successful!" -f Green } Process{ $count = 0 $UsersMail | foreach { #Get user Graph properties $mail = $_ $user = Get-MgUser -ConsistencyLevel eventual -Count 1 -Search ([string]::Format('"Mail:{0}"',$mail)) $SitesUrl | foreach { #Get Site Graph properties $domain = ([System.Uri]$_).Host $AbsolutePath = ([System.Uri]$_).AbsolutePath $uriSite = [string]::Format('https://graph.microsoft.com/v1.0/sites/{0}:{1}',$domain,$AbsolutePath) $site = Invoke-MgGraphRequest -Method GET $uriSite #Create Body for Post request $body = @' { "value": [ { "id": "{$SiteID}" } ] } '@.Replace('{$SiteID}',$site.id) #Graph call that include user to follow site $uriFollow = [string]::Format('https://graph.microsoft.com/v1.0/users/{0}/followedSites/add',$user.Id) #Include follow option from user to SharePoint Site try{ $response = Invoke-MgGraphRequest -Method POST $uriFollow -Body $body -ContentType "application/json" Write-Host "User '$($user.DisplayName)' is following site '$($AbsolutePath)'" -f Green } catch { Write-Error $_.Exception } } $count += 1 #progress bar Write-Progress -Activity 'Add users to follow site(s)' -Status "Adding user '$($user.DisplayName)' to follow sites... ($($count)/$($UsersMail.Count))" -PercentComplete (($count / $UsersMail.Count) * 100) } } End { Disconnect-MgGraph Write-Host "Finished" -ForegroundColor Green } Any help would be greatly appreciated.
MGraph suddenly stops working
PS C:\Windows> Get-MGUser -All Get-MGUser : InteractiveBrowserCredential authentication failed: In Zeile:1 Zeichen:1 + Get-MGUser -All + ~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Get-MgUser_List], AuthenticationFailedException + FullyQualifiedErrorId : Microsoft.Graph.PowerShell.Cmdlets.GetMgUser_List Prior to this I did a "connect-mgraph -Scopes "User.Read.All" " and authenticated myself with MFA. Did not get an error doing so. Logged in as a global administrator. Any ideas what i going wrong? I know, the error indicates Authentication Failure, but Authentication looks correct
Can I use PowerShell SecretStore for local system accounts?
I am trying to store some "system" secrets for my services running as default system accounts like "SYSTEM" and "NETWORK SERVICE". Based on my understanding, the SecretStore vault stores secrets locally on file for the current user. So it seems I can't use the tool for my project?need to create a PTR record via PS | Need your help !
Hello dear community, I am trying to update PTR records in my DNS manager using PowerShell script and I am using the below script, it works only when a reverse zone is already existing but I have a part of the code to create a reverse zone if doesn't exist. So the problem is reverse zone is not being created and script ends. Can anyone debug it for me ? or tell me what is wrong or I am ok to have a new script if the below is not right. Appreciate your help !!! :) ------------------------- param( [string]$CsvPath = "E:\dns test file.csv", [string]$DnsServer = "10.10.10.10" ) # Import required module try { Import-Module DnsServer -ErrorAction Stop } catch { Write-Error "Failed to import DnsServer module: $_" exit 1 } # Import CSV data try { $records = Import-Csv -Path $CsvPath Write-Host "Successfully imported $($records.Count) records from $CsvPath" } catch { Write-Error "Failed to import CSV: $_" exit 1 } # Initialize counters $results = @{ Success = 0 Failure = 0 Skipped = 0 Created = 0 } # Process each record foreach ($record in $records) { Write-Host "`nProcessing $($record.IPAddress) -> $($record.Hostname)" try { # Validate IP address format $octets = $record.IPAddress -split '\.' if ($octets.Count -ne 4) { throw "Invalid IP address format - must have 4 octets" } # Build reverse zone name (e.g., 10.0.0.0/24 becomes 0.0.10.in-addr.arpa) $reverseZone = "$($octets[2]).$($octets[1]).$($octets[0]).in-addr.arpa" $ptrName = $octets[3] # Last octet becomes record name # Validate and format hostname $hostname = $record.Hostname.Trim() if (-not $hostname.EndsWith('.')) { $hostname += '.' } # Check if reverse zone exists $zoneExists = Get-DnsServerZone -Name $reverseZone -ComputerName $DnsServer -ErrorAction SilentlyContinue if (-not $zoneExists) { throw "Reverse zone $reverseZone does not exist on server $DnsServer" } # Check for existing PTR record $existingPtr = Get-DnsServerResourceRecord -ZoneName $reverseZone -ComputerName $DnsServer -Name $ptrName -RRType PTR -ErrorAction SilentlyContinue if ($existingPtr) { # Check if it already points to the correct host if ($existingPtr.RecordData.PtrDomainName -eq $hostname) { Write-Host " [SKIP] PTR record already correctly points to $hostname" $results.Skipped++ continue } # Update existing record Write-Host " [UPDATE] Changing PTR from $($existingPtr.RecordData.PtrDomainName) to $hostname" $newRecord = $existingPtr.Clone() $newRecord.RecordData.PtrDomainName = $hostname Set-DnsServerResourceRecord -ZoneName $reverseZone -ComputerName $DnsServer ` -OldInputObject $existingPtr -NewInputObject $newRecord -PassThru -ErrorAction Stop $results.Success++ } else { # Create new record - FIXED SECTION Write-Host " [CREATE] Adding new PTR record for $ptrName pointing to $hostname" # Explicitly create the record object $newPtrRecord = @{ ZoneName = $reverseZone Name = $ptrName PtrDomainName = $hostname ComputerName = $DnsServer ErrorAction = 'Stop' } # Add the record with verbose output $result = Add-DnsServerResourceRecordPtr @newPtrRecord -PassThru if ($result) { Write-Host " [SUCCESS] Created PTR record:" $result | Format-List | Out-String | Write-Host $results.Created++ } else { throw "Add-DnsServerResourceRecordPtr returned no output" } } } catch { Write-Host " [ERROR] Failed to process $($record.IPAddress): $_" -ForegroundColor Red $results.Failure++ # Additional diagnostic info Write-Host " [DEBUG] Zone: $reverseZone, Record: $ptrName, Target: $hostname" if ($Error[0].Exception.CommandInvocation.MyCommand) { Write-Host " [DEBUG] Command: $($Error[0].Exception.CommandInvocation.MyCommand)" } } } # Display summary Write-Host "`nUpdate Summary:" Write-Host " Created: $($results.Created)" Write-Host " Updated: $($results.Success)" Write-Host " Skipped: $($results.Skipped)" Write-Host " Failed: $($results.Failure)" # Return results for further processing if needed $results -------------- Output what I got: Successfully imported records from E:\dns test file.csv Processing 10.0.0.10 -> test.test.sd6.glb.corp.local [ERROR] Failed to process 10.0.0.10: Reverse zone 0.0.10.in-addr.arpa does not exist on server 10.10.10.10 [DEBUG] Zone: 0.0.10.in-addr.arpa, Record: 10, Target: test.test.sd6.glb.corp.local. Update Summary: Created: 0 Updated: 0 Skipped: 0 Failed: 1 Name Value ---- ----- Created 0 Skipped 0 Failure 1 Success 0Entra PIM Role Activation
# Ensure necessary modules are installed $modules = @("DCToolbox", "Microsoft.Entra") foreach ($module in $modules) { if (-not (Get-Module -ListAvailable -Name $module)) { Install-Module -Name $module -Repository PSGallery -Scope CurrentUser -Force -AllowClobber } } # Check if msal.ps package is installed if (-not (Get-Package -Name msal.ps -ErrorAction SilentlyContinue)) { Install-Package msal.ps -Force -Confirm:$false } # Ensure Entra Authentication module is properly imported Remove-Module Microsoft.Entra.Authentication -ErrorAction SilentlyContinue Import-Module Microsoft.Entra.Authentication -Force # Connect to Entra ID with proper authentication Connect-Entra Add-Type -AssemblyName System.Windows.Forms # Create GUI Form $form = New-Object System.Windows.Forms.Form $form.Text = "EntraPIMRole Activation" $form.Size = New-Object System.Drawing.Size(350, 350) # Create Checkboxes $checkboxes = @() $labels = @("Global Administrator", "Teams Administrator", "SharePoint Administrator", "Exchange Administrator", "Billing Administrator") for ($i = 0; $i -lt $labels.Count; $i++) { $checkbox = New-Object System.Windows.Forms.CheckBox $checkbox.Text = $labels[$i] $checkbox.AutoSize = $true $checkbox.Width = 250 $checkbox.Location = New-Object System.Drawing.Point(20, (20 + ($i * 30))) $checkboxes += $checkbox $form.Controls.Add($checkbox) } # Create TextBox $textBox = New-Object System.Windows.Forms.TextBox $textBox.Location = New-Object System.Drawing.Point(20, 180) $textBox.Size = New-Object System.Drawing.Size(300, 20) $form.Controls.Add($textBox) # Create Button $button = New-Object System.Windows.Forms.Button $button.Text = "Run" $button.Location = New-Object System.Drawing.Point(20, 220) $button.Size = New-Object System.Drawing.Size(80, 30) $button.Add_Click({ $selectedOptions = $checkboxes | Where-Object { $_.Checked } | ForEach-Object { $_.Text } $inputText = $textBox.Text # Verify if the required function exists before executing if (Get-Command -Name Enable-DCEntraIDPIMRole -ErrorAction SilentlyContinue) { Enable-DCEntraIDPIMRole -RolesToActivate $selectedOptions -UseMaximumTimeAllowed -Reason $inputText [System.Windows.Forms.MessageBox]::Show("Activated Roles: $($selectedOptions -join ', ')`nReason: $inputText") } else { [System.Windows.Forms.MessageBox]::Show("Error: Enable-DCEntraIDPIMRole function not found. Ensure the correct module is installed.") } }) $form.Controls.Add($button) # Show Form $form.ShowDialog() Im trying to create a script so i can activate PIM with logon to the azure portal. But for some reason i cant get it to work. Can you all please help me out.
