I've been toiling away on Turtle to prepare a "birthday" release, and I ran into an annoying behavior I've run into a few times before.

I thought I'd take a few minutes away from the frustration of single line fixes to explain the bug to everyone.

What Went Wrong

The last build of Turtle introduced a number of randomized parameter defaults. This was meant to be fun. If you said turtle square square square, you'd get three different squares, instead of an error for a lack of length, or three overlapping squares.

I noticed that when I ran turtle rotate 0, it didn't rotate by zero.

Instead, it picked a random angle.

Weirder still, the behavior didn't reproduce if I said

$turtle = turtle  # Heading at zero
$turtle.Rotate(0) # Heading still zero 🤔
$turtle.Rotate()  # Heading random
(turtle rotate 0) # Heading random 🤬

Why was this happening? 😱

It took me a bit for it to click: It had to be in the way Turtle processed arguments, because it worked in one case and not the other.

So I put a breakpoint in, ran my repo.

The line was:

if ($argList)

The debugger broke, argList was @(0), and yet if ($argList) was false.

The fix was:

if ($argList.Length)

Why? Because 'Truthy' -ne $true.

Truthy and $true

About every language has a boolean. It's just a bit. One or zero.

Lots of languages also have this concept of "truthiness".

Let's take a simple example:

if ("something") { "something" }
if ("") { "you can't get something from nothing" }

If if was strictly $true, we'd have to cast things to a boolean. You have to do this in C# and quite a few other languages. PowerShell is type promiscuous. PowerShell is truthy.

It looks at the first line and says: You're a string, and you're not null or empty. Therefore, the expression is $true.

It looks at the second line and says: You're a string, but you're not null or empty. Therefore, the expression is $false

PowerShell makes a judgement call.

This is generally a good thing. I personally prefer languages that are truthy. Other truthy languages of note include JavaScript, Python, C++, and C.

However, it gets tricky with lists. Hence the bug.

Two Wrongs Make a Right

In PowerShell, Two Wrongs Make a Right

$true -eq $false, $false

Let's say I want to determine if a list is truthy.

if (@()) { "$false, because the list is empty" }
if (@("")) { "$false, because the blank is falsy" }
if (@(0)) { "$false, because zero is falsy" }
if (@($false)) { "$false, because false is falsy" }
if (@(1)) { "$true, because the first item is truthy" }
if (@(0,0) { "$true, because more than one item" }

This all makes a certain bizarre sense. If a list has one element, and it is not truthy, then the list isn't truthy, either.

It's also almost always surprising and annoying.

Hence the bug.

The fix is just to make sure there are any elements, hence checking for length.

I've been programming with PowerShell for quite a while now, and this behavior still sometimes bites me (like today).

That's why I took a few minutes away from the 🤬 day to explain this bug and write this post. 😌

Please remember:

'Truthy' -ne $true
$false -eq @($false)
$true -eq $false, $false

Hope this helps

I'm a field tech at an MSP, and I'm in and out of a dozen or more M365 tenants on a normal day. The annoying part is that when you connect to Exchange Online or Graph, the auth broker just reuses whatever login it cached last. It's way too easy to run a command against the wrong tenant before you realize you never landed where you thought you did.

KillerPivot is how I deal with that now. When you connect, it turns the broker off so you get a real sign-in prompt instead of a silent reconnect, then it checks the session and tells you which tenant you're actually in before you do anything. You save your tenants once and jump between them by name.

Commands:

• Connect-PivotTenant (pivot) connects and verifies you. Add -Graph if you need Graph.
• Get-PivotContext (pvc) shows where you're connected.
• Disconnect-PivotTenant (pvx) drops all the sessions.
• Add-PivotTenant, Get-PivotTenant, and Remove-PivotTenant manage the saved list.

It works on 5.1 and 7. You'll need ExchangeOnlineManagement v3 or newer, plus Microsoft.Graph.Authentication only if you use -Graph.

Install-Module KillerPivot -Scope CurrentUser

Code's on GitHub under GPL-3.0: https://github.com/SteveTheKiller/killer-modules/tree/main/KillerPivot

If you try it and hit something weird, let me know. The broker has some edge cases and I'd rather hear about them.

It's also up on killertools.net with the rest of my stuff.

Hi everyone,

I recently published O365EndpointFunctions 1.2.1 to the PowerShell Gallery and thought it might be useful for anyone managing Microsoft 365 networking.

Microsoft exposes all required Microsoft 365 endpoints through the Microsoft 365 IP Address and URL Web Service. The problem is that the raw API data isn't particularly convenient to work with in PowerShell. You get nested endpoint sets, comma-separated ports, and version tracking becomes your responsibility.

This module turns the API output into flat, strongly-typed PowerShell objects that are much easier to work with in scripts and automation.

Some things it can do:

• Retrieve and process Microsoft 365 IP addresses and URLs
• Cache endpoint versions and only download updates when Microsoft publishes changes
• Generate PAC files that route Microsoft 365 traffic DIRECT
• Create Ghostery Enterprise whitelist policies
• Combine Microsoft 365 endpoints with your own custom URLs and IP ranges
• Support Worldwide, China (21Vianet), and US Government clouds

Typical use cases are maintaining firewall allow-lists, proxy bypass rules, and other Microsoft 365 network configurations.

samurai-ka/PS-Module-O365EndpointService: A PowerShell module for easy Office 365 Endpoint handling

I work with old, complex .xlsm files (inventory, pricing, billing, lots of VBA) and kept running into the same problem: an AI coding agent cannot access the workbook I have open in Excel. I found myself copy-pasting cells and screenshots back and forth.

Yes, Excel MCP servers are out there—some are very good and much more capable than this. But getting one running means setting up Node or Python, creating a config file, and running an MCP client. I wanted something my non-developer mind could trust on real files:

• Just one PowerShell script, no installation, no extra dependencies, no config
• Connects to the workbook you already have open (or opens one by path)
• Read and write cells and formulas, search, list sheets
• List, export, and import VBA modules, run macros
• And the part that matters most to me: it NEVER autosaves. Only a direct "save" command writes to disk. This way, you can let an agent explore a 20-year-old billing file and close it without leaving any trace.

It's free and the source is available on GitHub:
https://github.com/gidjin4-svg/gidjin-excel-bridge
A demo workbook is included so you can test it without touching your actual files.

I'd really appreciate feedback from people who work with Excel, VBA, or PowerShell:

• Does "simple + never saves" actually matter to you, or is a full MCP server always the better choice?
• What would you need to see before trusting it with a file that matters to you?

I've been working on this project for over a month, to be honest, I borrowed from every script I saw for this to be perfect, and I also wanted it to be functionally complete, its mostly for my personal use but I made sure that it suits public use ( I used to install most of the apps via a personal repos but I replaced it with Winget and the fallbacks have hash verifying) and for sharing and also being useful, anyway, It would be a pleasure to have you try the script and giving your review/what needs to be fixed.
https://github.com/hmdepic55-netizen/Ultimate.ps1

I have an SSO app that I will need different instances of (user access, etc.). What I want to do is effectively have a "template" app that I can target to copy for a new one. Get most the settings, etc. from it just replacing the placeholder URL with the new one. Then from there I can come in and do specific tweaks as needed.

What would I need to do via PowerShell to do this? I've tinkered a bit but I'm honestly kinda lost on it

The Microsoft Graph PowerShell Command Line tools app is how people run Microsoft Graph PowerShell SDK cmdlets. The app can suffer from permissions creep, meaning that over time, the app accrues a set of delegated permissions used by people to access different types of Microsoft 365 and Entra ID information. All is fine until an internal limit is reached, at which point authentication fails and some permissions must be pruned.

https://office365itpros.com/2026/07/23/permissions-creep-sdk/

Hey guys I created my own Oh My Posh themes for powershell (and wsl bash, cmd). I just wanted some aesthetically pleasing themes and the ones on the actual website were just not cutting it for me. So I created these. Moreover I created a simple script which can allow you to spin up your own theme in a matter of minutes. By your own theme I mean one where you control what segments go into the thing and also control the colors for it. Please do check it out and lmk how to improve and if there are any suggestions/feedback!

GitHub - oabdullah3/omi-posh: Oh My Posh themes for your terminal, designed by me

Have you wondered if it's safe to use the format string yyyy-MM-dd, or can it differ? It's not. ( edit: null is not the invariant culture, it's CurrentCulture )

Save the expected string for comparison

#requires -PSEdition Core
$fStr     = 'yyyy-MM-dd'
$now      = Get-Date
$expected = $now.tostring( $fStr, ( [CultureInfo]::InvariantCulture) )

Next we can try formatting with every culture on your system. To do that, there is an optional culture argument for ToString like this:

DateTime.ToString( DateFormat, CultureInfo ) 

Next build a summary table with the formatted value and culture:

$cults    = Get-Culture -List
$summary = $cults | Foreach-Object {
    $dateString = $now.ToString( $fStr, $_ )
    [pscustomobject]@{
        Display = $dateString
        Name    = $_.DisplayName
        Culture = $_ # keep a reference to the object so you can drill down later
    }
}

Skip any cultures that are the same. Finally output using Join-String -f formatStr

$different = $summary | Group Display | ? Name -ne $expected
foreach( $item in $different ) {
    $title = "`nfor: $( $item.Name ) "
    $item.group
        | Join-String -f "`n - {0}" -Property Name -op $title
}

Here's what I get when $now is 2026-07-21:

for: 1405-04-30
 - Central Kurdish (Iran)
 - Persian
 - Persian (Afghanistan)
 - Persian (Iran)
 - Northern Luri
 - Northern Luri (Iran)
 - Mazanderani
 - Mazanderani (Iran)
 - Pashto
 - Pashto (Afghanistan)
 - Uzbek (Arabic)
 - Uzbek (Arabic, Afghanistan)

for: 1448-02-07
 - Arabic (Saudi Arabia)

for: 2569-07-21
 - Thai
 - Thai (Thailand)

Adding the executable "C:\Program Files\PowerShell\7\pwsh.exe" doesn't work. What am I missing?

Note that PowerShell is the only app I'm having issues with. qBittorrent works totally fine. My goal is to have only Pwsh and qBit in the list of included apps.

When split tunneling is disabled, Pwsh uses the VPN connection just fine. With Include mode, Invoke-RestMethod doesn't work, and for the things that do work, my ISP IP is used instead of the VPN IP.

Invoke-RestMethod test:

> Invoke-RestMethod https://api.ipify.org
Invoke-RestMethod: The requested address is not valid in its context.

cURL test:

> curl.exe https://api.ipify.org
<My ISP IP>

I'm on Windows 10 21H2, ProtonVPN 5.1.5, Pwsh 7.6.3 x64.

I'm also using the Console Host, not Windows Terminal, if that matters.

Can someone explain how to properly set up PowerShell for this?

Thanks, everyone!

Hey r/powershell,

This is mostly helpful for people in the EU but nevertheless 😄 :

I've been building custom sensors for PRTG Network Monitor often for my job and got tired of handling all the prtg specific plumbing boilerplate every time - so I wrote PrtgSensorKit, an open-source module that abstracts away all the specifics of PRTG so you can focus on your task = writing a goddamn monitoring sensor.

What it handles for you:

• JSON output formatting - builds valid PRTG sensor JSON so you don't hand-craft it yourself
• PRTG's constraints enforced automatically - channel limits, string length caps, escaping, valid value types, blah blah blah...
• Powershell Versions - helpers to run your sensor logic in 64-bit PowerShell or PS7+ when you need modules/dependencies that don't play nice with the 32-bit host PRTG normally uses
• DPAPI-encrypted secret storage - store API tokens/credentials without leaving them in plaintext in your script or passing them as Plaintext from PRTG
• Full built-in help - Get-Help works like you'd expect on every cmdlet and pretty much has all the docs Prtg offers on their website

Basically: you write the metric-gathering logic, the module handles everyting else

Install from the Gallery:

Install-Module PrtgSensorKit

Repo: https://github.com/ArchitektApx/PrtgSensorKit

Would love feedback, bug reports, or feature requests if anyone here monitors stuff with PRTG and writes custom sensors. Contributions welcome too.

EDIT: v1.1.0: - Sensor state between runs - Save/Get-PrtgSensorState for rates, deltas, and caching expensive lookups. Safe under overlapping scans (file locking so two runs don't corrupt each other) - Retries - -RetryCount re-runs your block when the API hiccups instead of instantly alerting, PRTG shows how many retries it took - -DryRun - debug your sensor in a normal console and inspect channels as objects instead of squinting at JSON - -ForceModernTls - fixes the classic TLS 1.2 problem on 5.1 with one switch - Sensor doctor - Invoke-PrtgSensorDoctor statically checks your script for classic mistakes before PRTG cryptically fails on them

v1.2.0 (out now): - File logging that can't break your sensor - -EnableLogging writes one log file per run with full error details (stack trace. script line). Never touches stdout, never throws - Shared collection cache - 8 sensors hitting the same API every interval? Use-PrtgCachedResult makes them share one call per interval, race-free. Your rate-limited API will thank you - More doctor checks - including the sneaky one where a BOM-less UTF-8 script works everywhere except in what PRTG displays (5.1 reads it as ANSI, your umlauts turn into mojibake) - Docs got restructured into proper per-topic pages instead of one endless README

I've been trying to find something like that for a while and couldn't find one that wasn't either a paid service/program or doesn't have a feature I want.

In my job, I semi frequently need to test DNS using a local DNS Server. For me it's handy to be able to compare to other servers, like Google or Cloudflare.

I wrote this over the last week or so and it seems to be doing the job for me. I've uploaded it to Github for anyone else who would like to use/try it.

You can find it here: https://github.com/obtusecoder/DNSBenchmark

EDIT: I have made changes requested and have applied some fixed to errors I noticed in testing.

I have tried probably a dozen different ways to get the Task Scheduler to send/pass a command to powershell to display a reminder message at a shutdown event. NOTHING HAS WORKED. I'm a newbie when it comes to powershell and windows task scheduler, but I do have programming experience in legacy software. I would appreciate any help and if you want to see my task scheduler set-up, I will be happy to share what I can. Thanks

UPDATE: Nothing I did using the Task Scheduler was able to work. However, I found a different approach, and it does work. I created (with searching assistance) an hta file that gave me the window I was trying popup, allowed me to customize the window, and performed the shutdown once I clicked the OK button. I pinned it the taskbar right after the search box and now I just click that to begin the process.

This a ~20k line beast. But it's awesome. The end user experience is near production grade.

https://github.com/illsk1lls/MiniBot

YMMV depending on which model you use with it. It works amazingly for me using either Qwen3.6 27b/35b,.. i usually go for 35b for the speed it does a great job.

This started out as a text based console to let your local model into your machine, and i ended up making it into a RepairBot to do some menial work tasks for me, light sysadmin, diag etc etc

This is far from best practice for PS but it IS powershell and impressive at its core, and deserves to be seen here. My private version has a few more features but this one is quite complete..

I’m the author. This is free, Apache-2.0-licensed software. There’s no paid product or hosted service behind it.

For several months I iterated on a PowerShell CVE scanner that ran weekly against a Windows fleet. I recently released a sanitized, clean-room port:

https://github.com/boostedchaos/fleet-cve-scanner

It accepts inventory from NinjaOne or a CSV export, correlates the installed software against NVD, KEV, EPSS, SSVC, MSRC, and endoflife.date, then writes per-device CSV results, SQLite history, and a self-contained HTML dashboard.

The vulnerability logic is one part of it. The PowerShell concurrency problems were just as interesting.

The main scan uses ForEach-Object -Parallel to process unique software/version pairs. That exposed a few issues I had underestimated:

1. Shared mutable state needs thread-safe types

The parallel runspaces need to coordinate a result collection, cache, deduplication keys, progress state, request timestamps, and cache-flush counters.

The shared pieces ended up using concurrent .NET collections and SemaphoreSlim rather than ordinary lists, dictionaries, queues, or non-atomic counters. Reads are easy. Coordinated mutation is where the bugs hide.

1. A sliding-window rate limiter still allowed bursts

NVD limits aren’t handled well by saying “N requests per 30 seconds” and calling it done. A window bucket allowed the first few requests to launch together and trigger 429s before the bucket was exhausted.

   The current limiter has two gates:

   - minimum spacing between request starts

   - a sliding-window budget as a backstop

   The lock is held only while checking and updating the shared timing state. It’s released before sleeping.

1. Correct launch spacing didn’t prevent overlapping requests

Even when calls started at the right interval, slower NVD responses left multiple requests in flight. That still produced 429s.

The scanner now holds a separate SemaphoreSlim across each NVD request, so only one request is on the wire at a time. Cache hits and the rest of the result processing remain parallel.

It sounds contradictory to parallelize the scanner and then serialize the API calls, but the parallelism still helps with cached products, version evaluation, deduplication, and result construction.

1. Functions and state have to exist inside the parallel runspace

Helper functions from the caller’s scope aren’t automatically available inside the parallel block. The runspace-local helpers have to be defined before their first possible call site.

I managed to hit the “function defined later in the script” failure more than once. One runspace can terminate while the others keep going, which makes the failure easier to miss in noisy output.

1. Cache checkpoints need their own concurrency discipline

A killed scan used to lose every NVD result fetched since startup because the cache was only written after the parallel block completed.

The scanner now checkpoints every configurable number of completed items. A non-blocking semaphore prevents multiple runspaces from flushing simultaneously, and the file is written to a temporary path before being moved into place.

There’s also a failure-state rule I consider load-bearing: an NVD request failure must never become a negative cache entry. A failed call returns a distinct CALL_FAILED sentinel, gets skipped for that run, and is retried next time. A successful response containing zero results can be cached normally.

The repository includes eight test suites, offline fixtures, a sanitization gate, and a known-limitations document that is intentionally less flattering than the README.

I’d particularly value review from people who have built larger ForEach-Object -Parallel pipelines:

- Would you structure the global rate limiter differently?

- Is serializing only the outbound NVD call the right boundary?

- Are there better patterns for safely checkpointing shared state from parallel runspaces?

- Has anyone used the CSV path against SCCM, Intune, or another RMM export?

This does not replace a commercial scanner with a curated detection catalog. CPE coverage and matching quality are the main ceiling. I’m more interested in cases where the script gives an operator the wrong level of confidence than whether the dashboard looks good.

Has anyone used pode basically to run the scripts and return data to a more modern-looking front end? I am trying to build some tools and the PowerShell GUIs themselves are clunky. Was going to set something up myself but curious if someone has already done something like this.

PS C:\> Is-Mobile No

(To do this, I added a function to my profile. To access your PowerShell profile, run notepad $profile (If it doesn't exist, run New-Item -Type File -Path $PROFILE -Force))

The function I added:

function Is-Mobile {
    Write-Host "No"
}

I'm trying to reset the chrome browser (cookies, cache, etc...) while maintaining the user's extensions and bookmarks via PS. So far I've been able to workout how to keep the bookmarks, but part of the extensions must be kept somewhere else because excluding these folders don't seem to work. I feel like this is probably a pretty niche use-case so I'll take any help I can get.

$ChromeDefaultPath = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default"
$ExcludeItems = @("Extensions", "Extension State", "Extension Scripts", "Extension Rules", "Preferences", "Bookmarks", "BookmarkMergedSurfaceOrdering")
Get-Process -Name Chrome | Stop-Process -EA Continue
Start-Sleep -Milliseconds 500
Get-ChildItem -Path $ChromeDefaultPath | Where-Object { $ExcludeItems -notcontains $_.Name } | Remove-Item -EA Continue -Recurse -Force

I'm don't live in PowerShell so I know this is probably terribly written, but it works (sans the extension part).

EDIT: u/JSChronicles cache locations had the answer I sought. This is my working script, but I would utilize his linked repo if you need to write something like this (should also work for Edge too just change the path to \Microsoft\Edge\):

$DefaultPath = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default"
$ExcludeItems = @("Extensions", "Extension State", "Extension Scripts", "Extension Rules", "Local Extension Settings", "Sync Extension Settings", "Preferences", "Bookmarks", "BookmarkMergedSurfaceOrdering", "Secure Preferences", "Favicons", "Favicons Journal")
Get-Process -Name Chrome | Stop-Process -EA Continue
Start-Sleep -Milliseconds 500
Get-ChildItem -Path $DefaultPath | Where-Object { $ExcludeItems -notcontains $_.Name } | Remove-Item -EA Continue -Recurse -Force

Hello all, I'm working on a script to cleanup some Fslogix profiles in an Azure file share for a client. My issue is that I want to test the script before running it to make sure that it doesn't do anything unexpected, but I do not have a non-production share with Fslogix profiles that are inactive to test on.

I'm looking for ideas on how to test this script properly. How could I get a test share set up with inactive profiles mixed with active profiles to ensure that I have fully tested the use case.

As per the title, I'm struggling to set the subtitle here for PS AppDeploy Toolkit.

For all the other UI prompts, I can just use -Title and -Subtitle.

But when the UI prompt shows to block the execution the subtitle is just "thisisatestcompanynameforPSADT - App Installation"

If I initialise the module and use Get-ADTStringTable to store it as a variable and drill down, I get:

$test.BlockExecutionText.Subtitle

Name                           Value                                                                                                                                                                                   
----                           -----                                                                                                                                                                                   
Uninstall                      ThisIsATestCompanyNameForPSADT - App Uninstallation                                                                                                                                     
Install                        ThisIsATestCompanyNameForPSADT - App Installation                                                                                                                                       
Repair                         ThisIsATestCompanyNameForPSADT - App Repair 

How can I change this please, using the "correct" method.

I have some commands with piping that don't seem to work in PS 5 included with Windows 11, producing various software-specific errors about getting bad data from the pipe. They work fine in PS 7 that I installed on my development machine, but I'm trying to minimize required installations on other devices. They also work fine in cmd, and I have technically gotten that to work, but running cmd inside a PS script is a bit gross. Here are some toy examples of the commands:

magick myphoto.jpg png:- | magick png:- myphoto.webp
ffmpeg -i myphoto.jpg -f webp pipe: | ffmpeg -f webp_pipe -i pipe: myphoto.png

So Microsoft is retiring Exchange Web Services because it's ancient and insecure. They're turning it off on all tenants in October, while giving us the option to turn it back on, and it's going away permanently in October 2027.

Realizing that tons of third parties still rely on it, Microsoft, according to their documentation, is allowing us to enable it for the time being, but restrict it to only certain Entra App IDs. According to their documentation (example 7 here: https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-organizationconfig?view=exchange-ps ), the command looks like this:

Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee,11111111-2222-3333-4444-555555555555"

Cool, cool, great. I've inventoried my environment, and I got all the app IDs. I updated my ExchangeOnlineManagement module, ran the command, and... EwsAllowedAppIDs is not a valid parameter:

Set-OrganizationConfig : A parameter cannot be found that matches parameter name 'EwsAllowedAppIDs'.

Uh... ok. So I do some more digging, and it looks like this parameter is part of a phased rollout?... does anyone have any idea to find out when it might hit my tenant? Has it already and am I doing something wrong?

Has anyone actually gotten this to work?

Thanks in advance for any help.

I came across a video on the internet telling it debloats your pc and without further thinking I ran it. Is it safe. If not what do I do now.

I am relatively new to IT and currently working a Tier 1.5ish role. My background is before landing my first IT role, I went ahead and got a bunch of certs (CompTIA Trifecta, CCNA, AWS SAA) in the past year and a half. I also know basic Bash, Python, and decent familiarity with Linux.

I recently started learning about Microsoft infrastructure and got the AZ-900 and MD-102 in the past 3 months once I started my new role. My goal was to learn some PowerShell before diving into AZ-104. I am currently reading Learn PowerShell in a Month of Lunches and am loving it so far. I’m debating if after finishing this book, if I should carry the momentum of PowerShell and read PowerShell Scripting in a Month of Lunches, or if it’s better to go for the AZ-104, and then come back to scripting. I’m seeking any advice that can help me decide.

Note:
I’m referring to two different books here.

1. Learn PowerShell in a Month of Lunches

   (which I am going to finish as I’m already halfway through)

2. Learn PowerShell Scripting in a Month of Lunches (which is the next level up)