Griff Barker

1. Run the script.
2. Re-run hybrid conf wizard if applicable, with only the OAuth checkbox filled.
3. Recycle the OWAApp and ECP IIS app pools in IIS on your Exchange servers.
4. Restart the Exchange service host service.

Works a charm. Forever thankful to the Exchange team for their tools! (2/2)

If you've ever had your Exchange server's auth cert get messed up or expire and can no longer access ECP, Microsoft has this nifty PowerShell script that can reset it for you. Run the script to replace the cert, using the flag to ignore hybrid environment if you have a hybrid environment... (1/2)

[🧠]$integer

Man, who DOESN’T have “future of work” or “thought leader” in their LinkedIn bio now?

I’m adding “future of chilling” and “double meat at Chipotle” to mine. I mean, work is fine, but chilling is the future

[🧵]$string

I would love to get up to refill my water, but I have a very cozy, sleepy dog on my lap that told me no.

MCP Server | PowerShell Universal Enable a model context protocol server.

#PowerShell Universal 5.7 nightly has an **experimental plugin** for a Model Context Protocol (MCP) server to allow you to hook agents like @github.com CoPilot directly into your PowerShell scripts. docs.powershelluniversal.com/platform/plu...

It's been a great watch! Highly recommend.

That's my exact question. What on earth is the use case where this is set to allow by default?

Yep! If you use the Active Directory Administrative Center app instead of Active Directory Users and Computers app, I believe it logs what the PowerShell commands are to accomplish what you did in the GUI. Parts of the inbuilt Server Manager also do this. Very handy tool!

@wollymight.bsky.social

Really good point & should mostly work. Here's some very rough AI-gen #PowerShell that seems to mostly work to kill #Adobe related processes in a Windows virtual machine I have:

gist.github.com/griffeth-bar...

Of course you could do it without the GUI and just have a function you run that does it.

Updated 😁

You're right, I totally forgot to provide an inbuilt alias, which would be a good-guy thing to do. I'll adjust it next time I'm at my computer! Thanks for pointing that out!

Want to generate a shortened URL from #PowerShell? You can use my `New-ShortenedUri` function:

🔗 gist.github.com/griffeth-bar...

Would be rather unfortunately to flip that switch and run your log storage out of space quickly due to noisy PowerShell logging. Have seen this before in orgs where there are lots of automations/scheduled tasks using PS that write to the event log.

Some great points!

Luckily, CIS benchmarks now recommend *enabling* PowerShell logging. Though I do suggest people considering enabling this to look at the size of your environment, monitor the rate of logging for average hosts, and consider the size of your SIEM/log aggregation storage.

Feels dumb to have not found that sooner. Definitely looked at it for far too long.

Feels dumb to have not found that sooner. Definitely looked at it for far too long.

It appears 1 of the several vCenters the script connects to has an authentication configuration issue that is resulting in it making the script prompt for credentials and the noninteractive session of the scheduled task can't handle that, so it would hang.

I did not -- probably should have though that's a good suggestion. Turns out the .NET version was a red herring. I ended up using PsExec to run an interactive PS session as the gMSA and run the script with some additional debugging output and found the issue.

It appears 1 of the several vCenters the script connects to has an authentication configuration issue that is resulting in it making the script prompt for credentials and the noninteractive session of the scheduled task can't handle that, so it would hang.

A good thought, but I did rule that out. Turns out the .NET version was a red herring. I ended up using PsExec to run an interactive PS session as the gMSA and run the script with some additional debugging output and found the issue.

Have just discovered the Powershell "Evergreen" module. Holy shit, this is amazing. Almost totally obsoletes PMPC and Winget for our purposes, and it's free.

Because the versions match and the import in the script works fine when not run by the gMSA, I assume there's some limitations or issues with the gMSA portion? Looking for any input. Many thanks in advance!

I've also made sure the module is up-to-date.

When run as gMSA the error I find when debugging is that it couldn't be imported because the .NET version (4.7.2) is not in the permitted versions. Upon inspecting the module manifest, 4.7.2 is indeed allowed.

Alright knowledgeable #Microsoft #ActiveDirectory folks. I'm apparently dumb and coming up empty-handed. If a #PowerShell script is scheduled via Windows Task Scheduler as a gMSA, why does it fail to import a module (VMware.PowerCLI), but the script's module import works when not run with a gMSA?

That's rather unfortunate, and doesn't sound like vacation.

I love this