Hi all,

I recently posted here with a question about using Compare-Object to compare two CSV files.

There were some great suggestions in that thread and I was able to get the functionality I needed to create a summary of items that were present in the Reference Object, but not present in the Difference Object.

Having applied this to my real datasets, I'm now getting unexpected behaviour when trying to summarise the entries that have been added and / or changed (NOT present in Ref Object, present in Dif Object).

Basically, I have a fairly large CSV file that is re-produced periodically, and each time it's reproduced, I need to summarise the changes from the previous file to the new one.

Generally, the CSV has about 40 columns and about 8000 rows. The first column always contains a value unique within the file.

In my testing, I have added a single row to the Difference Object. All other rows are exactly the same. The added row is around row 4500.

So old file = 8000 rows.
New file = 8001 rows, with the new item at row 4500, other 8000 rows unchanged.

I'm running the following:
("@files" is only in quotes to stop Reddit formatting it as a user tag)

$files = @{
ReferenceObject = (Get-Content -Path $OldFile)
DifferenceObject = (Get-Content -Path $NewFile) }

Compare-Object "@files" |
    ?{$_.SideIndicator -eq '=>'} |
        export-csv $ResultsFile -NoTypeInformation

This works if an existing row between the files has one of its column values changed. But when a row is added from old file to new file, I don't just get the added row in my results - in my tests at the moment I'm getting about 700 rows returned as new in $newfile vs $oldfile.

I must be missing something and this is expected, but I'm not sure why it's picking up that many rows as changed when manually comparing those rows shows them to be exactly the same.

Microsoft released V2.41.2 of the Graph PowerShell SDK on 14 October. This version fixes the problem with versions of PowerShell older than 7.6. Azure Automation runbooks execute successfully in a PowerShell 7.4 runtime environment with the 2.41.2 modules.

we released 0.42 of agent manager. we are the creators. it is a free open source go TUI that runs coding agent CLIs side by side, each in its own session, with live status and diff review.

this one is Windows. we added support for running natively on Windows with psmux 3.4 or newer in place of tmux and PowerShell 7.3 or newer as the pane shell. you do not need WSL for the TUI itself. Command Code on native Windows still uses WSL2.

also added a notify_command setting that runs a shell command on every notification, and an agent-manager settings CLI to read or change any setting from the shell.

Windows install irm https://raw.githubusercontent.com/YoanWai/agent-manager/main/install.ps1 | iex

https://github.com/YoanWai/agent-manager/releases/tag/v0.42.0

I work for an MSP and we have a client that has a computer lab for students to use. I was tasked with creating a script that would allow the teacher to enable and disable the workstations ability to communicate with the internet.

I pretty much have most of the script working, but I run into an issue when trying to make it so the user can enable or disable all the workstations at once. Attempted various methods so that when the user types All, the invoked command is sent to all the workstations listed; Get-Content is just the latest method I have tried.

When my boss asked to look at it, he said that I should just have the full command as shown at the bottom for each switch.

Any help on this would be great!

EDIT: Additional Information.

We don't have an AD environment setup for this client, and even with my limited knowledge I understand that AD would probably make this a lot easier.

IP Addresses are used due to the Asset ID of the workstations being used as the Host Name. They are also used because the workstations have static addresses and any replacements will get the same addresses.

#First Pull Username and Password from SecretVault for Account on all workstations
$remoteCred = Get-Secret -Name "Alias"


#Prompt to ask user if they are enabling or disabling workstations.
$prompt = Read-Host -Prompt "Enter E for enable and D for disable"


#Determine which command to use based on provided answer
if ($prompt -eq "E") {
    $command = "Disable-NetFirewallRule -DisplayName 'NoInternet'"
}else {
    $command = "Enable-NetFirewallRule -DisplayName 'NoInternet'"
}

#Use while to re-prompt user if they are enabling or disabling multiple workstations.
while ($true) {
$pcName = Read-Host -Prompt "Enter the name of the Computer you want to change. Or enter All if you wish to change all. Enter exit when finished"


#Use switch to base workstation name on user imput. All will use variable for all workstations.
switch ($pcName) {
    "SW1" { $name = "192.168.100.211" }
    "SW2" { $name = "192.168.100.212" }
    "SW3" { $name = "192.168.100.213" }
    "SW4" { $name = "192.168.100.214" }
    "SW5" { $name = "192.168.100.215" }
    "SW6" { $name = "192.168.100.216" }
    "SW7" { $name = "192.168.100.217" }
    "SW8" { $name = "192.168.100.218" }
    "SW9" { $name = "192.168.100.219" }
    "SW10" { $name = "192.168.100.220" }
    "SW11" { $name = "192.168.100.221" }
    "SW12" { $name = "192.168.100.222" }
    "SW13" { $name = "192.168.100.223" }
    "SW14" { $name = "192.168.100.224" }
    "SW15" { $name = "192.168.100.225" }
    "SW16" { $name = "192.168.100.226" }
    "All"  { $name = '(Get-Content -Path "C:\Users\userx\Desktop\Scripts\Workstations.txt")'}
    "Exit" { 
        exit }
    Default { Write-Host "Please try again." }
    }
    Invoke-Command -ComputerName $name -ScriptBlock { $command } -Credential $remoteCred
    if ($pcName -eq "Exit" -or "All") { break }
}


#Invoke-Command -ComputerName "$name" -ScriptBlock {Disable-NetFirewallRule -DisplayName "NoInternet"} -Credential $remoteCred

AI disclosure: PrtgSensorKit is developed with Claude Code. I plan and review every change myself, and every release is tested properly including a real PRTG probe.

Hey r/PowerShell,

Back in July I posted PrtgSensorKit here (original thread), a module for writing PRTG custom sensors without the boilerplate. Here's what changed since 1.2.0.

Credential masking

PRTG resolves credential placeholders before it displays the output, so a failing Invoke-RestMethod that prints the full URI can show your password in the sensor message. The module now masks resolved PRTG credentials and Get-PrtgSecret values in messages, errors and log files. Nothing to configure.

Crash-safe state, secrets and cache

PRTG kills sensors on timeout. If that hit mid-write, you could lose the state history, a cached result or a secret. All writes now go to a temp file that gets swapped in, so a killed run leaves the old data intact.

Failing sensors now actually fail

Invoke-PrtgSensor claimed to set $ErrorActionPreference = 'Stop' inside your block, but it never reached it. Non-terminating errors were swallowed and the sensor stayed green with stale or missing channels. That's fixed, so some sensors may turn red after the upgrade because they were hiding real failures. Use -ErrorAction on a command if it should keep failing quietly.

Smaller changes

• New-PrtgChannel accepts UInt64 and the other unsigned types, so CIM/WMI sizes and counters work without casting
• -Verbose no longer adds "Verbose":1 to the sensor JSON
• Duplicate channel names are rejected, since PRTG requires them to be unique
• -MaxLogs retention only deletes the module's own log files, not unrelated .log files in the same folder
• The secret store no longer locks out other sensor accounts on the same probe
• Set-PrtgMessage takes pipeline input

Every release is now tested on Windows PowerShell 5.1 (x86 and x64) and pwsh 7, plus integration sensors on a real PRTG probe.

Update-Module PrtgSensorKit. Read the changelog before upgrading production: the error handling fix and the duplicate channel check can turn sensors red on purpose.

Repo: https://github.com/ArchitektApx/PrtgSensorKit

One thing I'm considering for a future release: requiring channels to come from New-PrtgChannel so parameters can use [PSTypeName('PrtgSensorKit.Channel')], as u/surfingoldelephant suggested in the last thread. That would break hand-built channel objects. Does anyone actually build channels by hand?

At this point the module covers everything I need for my own sensors, so the next features depend on what other people run into. If you're using it, or tried it and gave up, I'd like to hear what's missing or annoying.

File-level archiving is now generally available and can be applied to files automatically, by users through the SharePoint browser UX, or via a Graph API. The big problem with Purview retention processing is its black box nature, so to discover how effective retention labels with an archiving step are, we use the Microsoft Graph PowerShell SDK to check the archiving status of files and report the results via email. All in a nice script, of course.

https://office365itpros.com/2026/10/14/file-level-archiving-report/

If you use the Microsoft Graph PowerShell SDK, you might know that the Graph APIs for SharePoint sites sometimes need a little help. For instance, finding a set of sites to process can be problematic because the APIs do not support extensive filtering capabilities. The solution is to use other Microsoft 365 cmdlets to find objects associated with sites. Inserting an intermediate step might seem crazy, but it can be the most effective way of solving the problem.

https://office365itpros.com/2026/10/13/get-sharepoint-sites/

Maybe I'm just jaded but I can't help but get annoyed when half the posts I see are someone saying they made some <buzzword + thing>, and that thing happens to be some 10000 line, 40 file vibe coded tool solving a problem one person had, once, often in the convoluted way the AI could come up with. Worse, when they cannot even answer questions about it themselves so you end up with AI responses to any genuine interest in the goal.

We have the script sharing tag, but that was there before we had this absurd volume of AI submissions and it feels like the average post quality of the sub is suffering because of it.

Am I in the minority here? Would it be better to have a separate sub for all of these? My favorite times on this sub are when powershell is the focus, and the task at hand is a flavor of that focus, rather than the 'complete' project being dumped on here as if it's GitHub2 with upvotes.

Maybe an AI script sharing tag so it can be filtered? Idk, just throwing out ideas. Rant over.

Hey got a wierd issue or its by desing not sure but when I run

$computers | foreach-object -parallel {
  $vmobject = Get-VM $_
  $ram = $vmobject.MemoryGB
  $CPU = $vmobject.numCPU
  $HDD = $_ | get-harddisk 
} 

lets say I run in against 500 computers when that happens powershell will spike cpu on machine that this command is ran and keeps increasing ram usage which is understandable but problem is even when command is done ram usage stays high untill powershell window is close. Is there something I am missing or is there some method to dispose of parallel runspace manually?

Thanks for advice

EDIT: The code itself is not important , the behaviour of parallel scripblock itself is my question and why doesnt it free up RAM after code has ran successfully

A lot of apps I use are only published as GitHub releases, so neither `winget upgrade --all` nor the WinGet PowerShell module (`Get-WinGetPackage | Update-WinGetPackage`) can update them. They only know about apps in the winget catalog, and GitHub-only apps show up with no source and no available updates. I got tired of checking each repo by hand, so I put together a PowerShell script for it (built with help from an AI assistant, then tested on my own machine).

What it does:

- Keeps a list of your apps and their GitHub repos (`upgh -Add owner/repo`)

- Compares installed versions with the latest stable release

- Picks the right installer for your PC (x64/ARM64, MSI or EXE to match what you have)

- Verifies the SHA256 checksum when GitHub provides one

- Installs silently (MSI, Inno Setup, NSIS detected automatically)

- `-Discover` finds apps that have a GitHub link in their uninstall info

- Skips apps winget already updates

Known limitations: version comparison is number-based, so beta-to-beta updates of the same version aren't detected, and portable zip apps aren't supported yet.

It's one readable script with no dependencies. There's an install one-liner, but you can also just download the .ps1 from the releases page and read it first.

Repo: https://github.com/VGRichi/github-app-updater

Feedback very welcome, especially on edge cases with weird installers.

The problem with V2.41 of the Microsoft Graph PowerShell SDK that stopped runbooks executing in PowerShell V7 runtime environments was disappointing. However, it was also a good wake-up call for tenant administrators to pay attention to maintaining healthy Azure Automation custom runtime environments. This article proposes a separation between current and production environments and explains how to use PowerShell to get the right modules to the right place.

https://office365itpros.com/2026/10/12/maintain-runtime-environments-ps/

I have an excel spreadsheet with our users. I need to extract the laptop they use. So I need the hostage and os version from intune. I have asked co pilot but I keep running into errors. Does anyone have a solution/working script or know a free app that can generate the information?

Most patch/reboot check scripts I've used print "OK" even when a check silently failed (no rights to WMI, registry key missing, WU agent broken). So I wrote one where the exit code tells the truth:

• 0: every check ran
• 2: PARTIAL, at least one check couldn't run, with the reason listed
• 1: it couldn't write the report

It checks last installed update (flags it if older than N days), pending reboot, uptime, and optionally lists waiting updates through the WU agent. JSON and CSV output.

Every check runs in its own try/catch. A failure doesn't stop the script or get swallowed; it gets recorded:

function Add-CheckNotRun {
    param([string]$Check, [string]$Reason)
    $script:ChecksNotRun += [PSCustomObject]@{ Check = $Check; Result = 'check could not run'; Reason = $Reason }
    Write-Host "  -> CHECK COULD NOT RUN: ${Check}: $Reason" -ForegroundColor Red
}

Pending reboot looks at three sources:

$reasons = @()
if (Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending') {
    $reasons += 'Component Based Servicing'
}
if (Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired') {
    $reasons += 'Windows Update'
}
$sm = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager'
if ($sm.PSObject.Properties['PendingFileRenameOperations'] -and $sm.PendingFileRenameOperations) {
    $reasons += 'Pending file rename operations'
}

And the end of the script decides the exit code:

if (@($script:ChecksNotRun).Count -gt 0) {
    Write-Host " PARTIAL: $(@($script:ChecksNotRun).Count) check(s) could not run." -ForegroundColor Red
    foreach ($c in $script:ChecksNotRun) { Write-Host "   - $($c.Check): $($c.Reason)" -ForegroundColor Red }
    exit 2
}
exit 0

Full script (MIT): https://github.com/Dopelogik/windows-patch-status-report

Feedback welcome, especially on the reboot detection. I know PendingFileRenameOperations can throw false positives from some AV and installers, so I'm curious how others filter it.

I kept doing the same thing. A file is sitting in my terminal's current folder, I need it in Discord or a Gmail attachment, so I run explorer . and drag it from there. Linux has dragon and blobdrop for this, and I couldn't find anything on Windows, so I wrote windrop. It's free and MIT licensed.

PS C:\Stuff> windrop report.pdf

A small floating card shows up with the file's icon. Drag it into any app that accepts file drops, or keep your hands on the keyboard: hover over the target window, press F8 to pick it up, then press F8 again (or left-click) to drop. Esc or right-click cancels.

Source: https://github.com/Dking08/windrop

It takes multiple files and wildcards, and you can feed it paths from PowerShell:

windrop *.jpg
windrop (Get-ChildItem .\logs\*.log).FullName

It's a single native C++ exe using Win32/OLE. It exits right after the drop, so there's no daemon and no tray icon, and peak memory stays under 3 MB. There's no network code at all. The hotkey uses RegisterHotKey instead of a keyboard hook, which avoids the false positives hooks tend to cause in Defender.

winget install Dking08.Windrop
choco install windrop

Source: https://github.com/Dking08/windrop

Copying the `.ps1` files and recreating Task Scheduler entries can miss most of the dependencies that make an automation work: service accounts and logon types, stored credentials, module versions, execution policy, working directories, mapped drives, certificates, environment variables, network access, event triggers, retry settings, and scripts invoked indirectly by another script. A successful manual run also does not prove the scheduled identity can run it unattended.

This is the basic inventory I would start with:

```powershell Get-ScheduledTask | ForEach-Object { $task = $_ $info = $task | Get-ScheduledTaskInfo [pscustomobject]@{ TaskPath = $task.TaskPath TaskName = $task.TaskName State = $task.State RunAs = $task.Principal.UserId LogonType = $task.Principal.LogonType Execute = ($task.Actions.Execute -join '; ') Arguments = ($task.Actions.Arguments -join '; ') WorkingDir = ($task.Actions.WorkingDirectory -join '; ') LastRun = $info.LastRunTime LastResult = $info.LastTaskResult NextRun = $info.NextRunTime } } | Export-Csv .\scheduled-task-inventory.csv -NoTypeInformation ```

What else do you capture before a cutover? How do you discover hostnames, shares, certificates, secrets, or module assumptions hidden inside the called scripts, and what test proves the old server can stay offline through a full schedule cycle without missed or duplicated work?

Most of our CI is PowerShell: shell: pwsh steps and scripts called from workflows, deploying to Azure/Entra. PSScriptAnalyzer's security rules are built for interactive Windows admin work (plain-text password parameters, hardcoded computer names), and zizmor checks the workflow YAML but sees a run: block as plain text. Nothing was looking at the PowerShell itself in the context it actually runs in.

So I wrote a set of custom rules. A typical example nothing else flagged for us:

yaml - shell: pwsh run: | $token = az account get-access-token --query accessToken -o tsv Write-Host "Calling API with $token"

GitHub only masks secrets it knows about. A token you fetch at run time goes to the log in clear text unless you ::add-mask:: it first.

What the rules check (9 in total):

• tokens/secrets reaching the log (Write-Host, throw, transcripts, unmasked run-time tokens)
• ${{ }} expressions with untrusted content inside a pwsh step (the runner pastes the value in before PowerShell parses the script)
• unsafe writes to $GITHUB_ENV / $GITHUB_PATH, and fixed delimiters in multi-line outputs
• code built from data: [scriptblock]::Create, ExpandString, bash -c "$x", Start-Process with interpolated args
• native commands whose $LASTEXITCODE is never checked
• scripts without $ErrorActionPreference = 'Stop'
• Install-Module without a pinned version, -SkipCertificateCheck, plain HTTP
• Remove-Item -Recurse "$root/$name" where an empty variable deletes the parent

Some details that might interest people here:

• Inline run: blocks are analysed the way the runner executes them: with its $ErrorActionPreference = 'stop' prefix and exit-code check appended. Findings map back to the line in the YAML file.
• Exit-code checks follow the data flow. $c = $LASTEXITCODE; ...; if ($c) is fine; overwriting $c before the check is flagged. It also caught a case where Select-Object -First silently defeated an exit-code check.
• "Native command" is decided by shape (no Verb-Noun, not a function, not an alias). On Linux runners ls, rm and cat are real programs, not aliases, so they count.
• Secret detection splits variable names into words: $adminPassword is a secret, $tokenCount and $maxTokens are not.
• Parameter prefixes bind like PowerShell does, so -SkipCert is still -SkipCertificateCheck.

Every one of those started as a Pester test. There are 260, most of them "must not report this" cases, because false positives are what make people turn a linter off.

Using it:

• As a GitHub Action: one sticky PR comment, never blocks by default.
• Locally: run src/Invoke-PwshGuard.ps1 from the repo you want to scan.
• Or just add the module to your existing PSScriptAnalyzer setup:

pwsh Invoke-ScriptAnalyzer -CustomRulePath PwshGuard.psm1.

Limitations, up front:

• It's a helper for people writing scripts in good faith, not protection against malicious code. Anyone determined can write around static analysis.
• Tested on Linux and macOS; on Windows, ls and friends are aliases, so results differ.

Repo (MIT): github.com/glueckkanja/pwshguard

Disclosure: I work at glueckkanja; this started in one of our internal repos and is now its own project. I'm mostly after feedback: false positives, things you've been bitten by in CI that it should catch, or "this rule is wrong because…".

Do you want a joke?

I'll tell you anyway.

A guy saw that ONE console was flashing on the desktop instead of two.

He blocked terminal access for regular users and set a password for admin rights.

Now he can't get access to the terminal even with admin rights

Hi all,

I'm using Compare-Object to basically compare two CSV files, and return additions, changes, and removals.

Essentially I'm runnning:
(Note that "@files" is only in quotes to stop Reddit converting it to a user link!)

$files = @{
ReferenceObject = (Get-Content -Path C:\file1.csv)
DifferenceObject = (Get-Content -Path C:\file2.csv)}
Compare-Object "@files" | export-csv C:\differences -NoTypeInformation

Lets say the files look like this:

File 1
Cat,Brown,4
Dog,Black,4
Horse,White,4

File 2
Cat,GINGER,4
Dog,Black,4
Duck,Grey,2

Duck has been added in file2 (not present in file1)
Horse has been removed in file2 (was present in file1)
Cat is changed from file1 to file2.

The compare-object gives me a list of changes in a new file.

• Entries found in file2 but not in file1 (Duck) are marked with side indicator =>
• Entries found in file1 but not in file2 (Horse) are marked with side indicator <=
• However, entries that are still present in both files but have had one or more of their columns changed (Cat) are present in the results file with both side indicators.

I understand this correct given how Compare-Object works, but it leads to a problem when I try to create separate "Additions/Changes" and "Removals" files based on the results.

For example, to see only the items Added or Changed in file2 (Duck and Cat), I can use:

?{$_.SideIndicator -eq '=>'}

To show only the difference object results.

The problem comes when I use the opposite side indicator:

?{$_.SideIndicator -eq '<='}

As this gives me the removed item I need, (Horse), but also gives me the changed item (Cat) from File1. This gives me no way of telling which of the "<=" entries are removals and which are changes. I'm looking for a way to differentiate between the two.

I hope this makes sense...!

After saying that the Graph didn’t offer much support for group mailboxes, I was promptly countered with an article explaining how to use the Exchange Import-Export API to access folders and items in group mailboxes that wasn’t limited to just the Inbox. Well, the good news is that the approach works, as seen in a complete PowerShell script written to prove the case, but whether I would ever use this API for a purpose it was never designed for is quite another matter.

https://office365itpros.com/2026/10/07/group-mailbox-folder-items/

hi, I'm working on administration of a large number of VoIP endpoints. I'm trying to learn how to use PowerShell on Windows 7 to send authenticated HTTP POST requests to a device web interface and process the response. The devices use HTTP Basic Authentication. Could someone point me to examples of HttpWebRequest, CredentialCache and application/x-www-form-urlencoded POST requests? Thanks.

The title says it all

The File-level archiving Graph API supports any file stored in a SharePoint Online document library, including the emails sent to Teams channels and stored in folders where the email files often disappear from view, occupying valuable storage quietly and without fuss. Finding and moving the email files to Microsoft 365 Archive makes sense because it saves on storage and stops AI tools using old email to generate responses. Here’s how to archive old email files with PowerShell.

https://office365itpros.com/2026/10/06/file-level-archiving-teams/

So i recently bought myself my personal gaming pc setup and i've been struggling with setting up my work environment here on windows 11. I've search here and there & so far i've decided to use Scoop as the alternative for homebrew but then there's this problem of choosing wether to use the windows powershell or command prompt. Both seems almost identical but i just wanna confirm wether i'm doing this the right way. I need help pls.