The catalog · release 2026.161
All 223 ready-to-run PowerShell scripts
Every script below ships with PowerScripts for Microsoft 365, Active Directory, your network and business systems. Each one opens as a form: you grant it to the people who should run it, and every run is recorded. Use a script as it is, or make your own copy and change it; catalog updates never overwrite your edits.
223 scripts
Microsoft 365 · 150
Exchange Online 46
Add-CalendarPermissionreversibleGive one or more users access to one or more mailbox calendars, optionally as a calendar delegate.
MailboxUPNsrequired One or more mailboxes whose calendar is being shared.UserUPNsrequired One or more users receiving calendar access.AccessRightsOwner, PublishingEditor, Editor, PublishingAuthor, Author, NonEditingAuthor, Reviewer, Contributor, LimitedDetails, or AvailabilityOnly. Default: Reviewer.AsDelegateAlso flag the user as a calendar delegate so they receive meeting requests. Requires an Author-or-higher access right.
Add-DistributionGroupMemberreversibleAdds one or more recipients to one or more Exchange distribution or mail-enabled security groups — the groups Graph cannot write. Idempotent — skips existing memberships, and skips Microsoft 365, dynamic, and directory-synced groups with the reason.
GroupIdsrequired One or more distribution or mail-enabled security groups — display name, alias, SMTP address, or GUID. Right-click a group in M365 search to add it to the list.UserUPNsrequired One or more recipients to add. Any mail-enabled recipient works — users, shared mailboxes, mail contacts, or nested groups. Right-click users in M365 search to stack them.BypassManagerCheckWhen true, adds to groups the running account does not manage. Requires the Security Group Creation and Membership role; leave false unless an add fails the manager check.
Add-MailboxAliasreversibleAdd one or more secondary SMTP aliases to one or more cloud mailboxes, leaving the primary address unchanged.
MailboxUPNsrequired One or more mailboxes to add the aliases to.Aliasesrequired One or more alias addresses to add, e.g. sales@contoso.com.SkipDomainCheckAdd the aliases without validating their domains against the tenant's accepted domains.
Add-ResourceDelegatereversibleAdd one or more people as booking delegates on one or more room or equipment mailboxes.
ResourceUPNsrequired One or more room or equipment mailboxes.DelegateUPNsrequired One or more users to add as booking delegates.ForwardRequestsToDelegatesForward booking requests to the delegates for approval. Default: true.AllowNonResourceMailboxAllow targets that are not room or equipment mailboxes.
Audit-NonOwnerMailboxAccessFind non-owner access events on a mailbox over the last N days, via the Unified Audit Log.
MailboxUPNrequired Mailbox to audit. Example: ceo@contoso.comDaysBackHow many days of history to scan. Default 30. Max 90 (UAL retention).ResultSizeCap on rows returned from the UAL search. Default 5000.
Audit-ResourceMailboxComplianceSearches the Unified Audit Log for non-owner access on resource (room/equipment) mailboxes. (Search-MailboxAuditLog was retired April 2024.)
ResourceFilterrequired 'All' or a specific identity.DaysBackLookback window in days. Default 90.ExportReportEmit a final 'report generated' marker.
Convert-MailboxTypeConverts a mailbox to Room, Equipment, or Shared type.
MailboxIdentityrequired Target mailbox identity.ConversionTyperequired ToRoom, ToEquipment, or ToShared.
Export-EmailTrafficReportExports an email traffic, spam, malware, or phish report. Traffic uses the Microsoft Graph getEmailActivityUserDetail report; spam/malware/phish use Get-MailDetailATPReport / Get-MailDetailMalwareReport.
StartDaterequired Inclusive start date.EndDaterequired Inclusive end date.ReportTypeTraffic, Spam, Malware, or Phish. Default Traffic.
Get-DelegateAccessAuditAudits non-owner delegate access events across one or all mailboxes via the Unified Audit Log. (Search-MailboxAuditLog was retired April 2024.)
MailboxFilterrequired Mailbox UPN to audit, or 'All' for all mailboxes.DaysBackAudit lookback window in days. Default: 30.
Get-ExternalMessageTrackingTraces inbound and outbound messages to/from external domains over a specified date window.
StartDaterequired Start date for the message trace window.DaysBackNumber of days forward from StartDate. Default: 7.OutputFormatCSV or JSON. Default: CSV.
Get-ForwardingAuditReportFinds mail forwarded out of the organisation and inbox rules that look like a compromised mailbox (external forwarding, blank names, moving mail to RSS or Archive, mark-as-read, delete). Rates each finding HIGH/MEDIUM/LOW and reports whether automatic external forwarding is blocked. Read-only.
MailboxFilterMailbox to audit, or All for every user and shared mailbox. Default: All.IncludeInternalAlso list rules that forward only inside the organisation.
Get-MailboxAccessReportReports who currently has access to one or more mailboxes — FullAccess, SendAs, SendOnBehalf, calendar permissions, and forwarding — optionally expanding group trustees to their members.
MailboxUPNsrequired One or more mailboxes to audit.IncludeCalendarInclude calendar folder permissions. Default: true.ExpandGroupsResolve group trustees to their members so group-held access is visible.OutputFormatTable, CSV, or JSON. Default: Table.CsvPathFile path for CSV output. Default: MailboxAccessReport.csv.
Get-MailboxDeletionAuditAudits soft-delete, hard-delete, and purge operations on a mailbox via the Unified Audit Log. (Search-MailboxAuditLog was retired April 2024.)
MailboxUPNrequired UPN of the mailbox to audit.DaysBackLookback window in days. Default: 90.
Get-MailboxSizeReportGenerates a Summary, Detailed, or Quota report of mailbox sizes and usage and exports to CSV/JSON/Grid.
MailboxFilterrequired Mailbox filter (UPN, alias, or 'All').ReportTypeReport type: Summary, Detailed, or Quota. Default Summary.OutputFormatExport format: CSV, JSON, or Grid. Default CSV.IncludeArchiveInclude archive mailbox stats.DryRunPreview action without executing.
Get-MessageTraceReportTraces a message by sender address or message ID and exports the full delivery path detail.
MessageIdentifierrequired Sender UPN (contains @) or Message-ID string.StartDateStart date for trace window when filtering by sender.OutputFormatCSV or Grid. Default: CSV.
Get-PermissionChangeTrackingQueries the unified audit log for mailbox permission add/remove/update events over a rolling window.
DaysBackLookback window in days. Default: 7.OutputFormatCSV or Grid. Default: CSV.
Get-ResourceMailboxReportReports utilization, booking policy, or full inventory across resource mailboxes.
ReportTypeUtilization, Bookings, or AllResources. Default Utilization.OutputFormatCSV or Grid. Default CSV.
Get-SafeLinksTrackingQueries the unified audit log for Safe Links clicks and Safe Attachments events over a rolling window.
DaysBackLookback window in days. Default: 30.OutputFormatCSV or JSON. Default: CSV.
Get-TransportRuleHitReportTraces messages matching a transport rule name filter and exports sender/recipient/status data.
StartDaterequired Start date for the message trace query.RuleNameFilterPartial rule name to match against message subjects.OutputFormatCSV or Grid. Default: CSV.
Get-VipMailboxActivityAudits all access events for VIP mailboxes (UPN or CSV) via the Unified Audit Log. (Search-MailboxAuditLog was retired April 2024.)
VipFilterrequired Single UPN or path to a CSV file with a UPN column.DaysBackAudit lookback window in days. Default: 30.
Grant-MailboxFullAccessreversibleGrant one or more users FullAccess on one or more mailboxes — open, read, and manage as if it were their own.
MailboxUPNsrequired One or more mailboxes to grant access on (often shared mailboxes).DelegateUPNsrequired One or more users who'll get access.AutoMappingWhen true (default), Outlook auto-attaches the mailbox in the delegate's profile. Set false to keep it hidden until they open it manually.
Grant-MailboxSendAsreversibleLet one or more users send messages that appear to come directly from one or more mailboxes (no "on behalf of" prefix).
MailboxUPNsrequired One or more mailboxes the users will be allowed to send AS.DelegateUPNsrequired One or more users getting the SendAs right.
Manage-EmailForwardingInspect or change a mailbox's auto-forwarding settings (mailbox-level + inbox rules).
UserPrincipalNamerequired Mailbox you're inspecting or changing. Example: alex@contoso.comActionAudit reports current forwards. DisableForwarding clears the mailbox setting. SetForwardTo points forwarding at a new address.ForwardToAddressDestination SMTP address. Used only with SetForwardTo. Example: backup@contoso.comDisableInboxRulesWhen true, also disables any inbox rules that forward externally. Default true (safer).ForceSkip confirmation prompts.
Manage-InboxRulesLists a mailbox's inbox rules, or disables the ones that forward outside the organisation or hide mail from the owner - kept for evidence, not deleted. Can re-enable or delete named rules.
UserPrincipalNamerequired Mailbox whose rules to check.ActionAudit lists every rule. DisableSuspicious turns off rules that forward outside or hide mail, keeping them as evidence. EnableRules / RemoveRules act on -RuleNames.RuleNamesEnableRules / RemoveRules: the rule names to act on.DryRunPreview without changing anything.
Manage-MailboxPermissionsAudit or change who has FullAccess on one or more mailboxes, with optional SendAs grant.
MailboxUPNsrequired One or more mailboxes whose permissions you're managing.ActionAudit lists current non-inherited permissions. Grant/Remove changes them.DelegateUPNsUsers receiving (or losing) the permission. Required for any Grant/Remove action.RemoveAllWipe every non-inherited permission on the mailbox. Use with care — destructive.
Manage-ResourceMailboxLifecycleEnables, hides, archives, or deletes one or all resource mailboxes.
ResourceFilterrequired Alias, identity, or 'All'.ActionEnable, Disable, Archive, or Delete. Default Disable.DryRunPreview without executing.
Manage-RoomDelegatesGrant or revoke FullAccess (calendar management) or booking-approver rights on a room or equipment mailbox.
ResourceIdentityrequired Resource mailbox to modify. Example: boardroom-a@contoso.comDelegateUPNPerson you're granting (or revoking from). Required for any Grant/Revoke action. Example: facilities@contoso.comActionFullAccess opens the calendar in Outlook. Booking lets the delegate approve booking requests for the resource.
New-BulkMailboxesAndGroupsCreates shared mailboxes (with Full Access / Send As), distribution groups and mail-enabled security groups from a CSV. Existing recipients are brought up to date instead of duplicated.
CsvPathrequired CSV of recipients. Headers: Type (Shared|Distribution|Security), Address, DisplayName, Members (';'), SendAs (';'), ManagedBy (';').DryRunPreview the recipients and permissions that would change without changing anything.
New-BulkResourceMailboxesCreates room and equipment mailboxes from a CSV with capacity, location and auto-accept booking. Skips addresses that already exist.
CsvPathrequired CSV of resources. Headers: DisplayName, Alias, Address, Type (Room|Equipment), Capacity, Location, AutoAccept.DryRunPreview the resources that would be created without changing anything.
Remove-CalendarPermissionreversibleRemove one or more users' access to one or more mailbox calendars. Reverse of Add-CalendarPermission.
MailboxUPNsrequired One or more mailboxes whose calendar is shared.UserUPNsrequired One or more users losing calendar access. Default and Anonymous cannot be removed.
Remove-DistributionGroupMemberreversibleRemoves one or more recipients from one or more Exchange distribution or mail-enabled security groups. Idempotent — skips recipients that are not members, and skips Microsoft 365, dynamic, and directory-synced groups with the reason.
GroupIdsrequired One or more distribution or mail-enabled security groups — display name, alias, SMTP address, or GUID. Right-click a group in M365 search to add it to the list.UserUPNsrequired One or more recipients to remove. Right-click users in M365 search to stack them.BypassManagerCheckWhen true, removes from groups the running account does not manage. Requires the Security Group Creation and Membership role; leave false unless a removal fails the manager check.
Remove-MailboxAliasreversibleRemove one or more secondary SMTP aliases from one or more cloud mailboxes. Reverse of Add-MailboxAlias.
MailboxUPNsrequired One or more mailboxes to remove the aliases from.Aliasesrequired One or more alias addresses to remove, e.g. sales@contoso.com. The primary SMTP address is never removed.
Remove-ResourceDelegatereversibleRemove one or more people as booking delegates from one or more room or equipment mailboxes. Reverse of Add-ResourceDelegate.
ResourceUPNsrequired One or more room or equipment mailboxes.DelegateUPNsrequired One or more delegates to remove.ClearForwardingTurn off ForwardRequestsToDelegates on resources left with no delegates.AllowNonResourceMailboxAllow targets that are not room or equipment mailboxes.
Rename-ResourceMailboxRenames a room or equipment resource mailbox — display name, object name, alias, primary SMTP address, and UPN — validating every value before writing anything.
Identityrequired The resource mailbox to rename.NewDisplayNameNew display name shown in the room finder and on invitations.NewNameNew directory object name.NewAliasNew Exchange alias / mail nickname.NewPrimarySmtpAddressNew primary SMTP address. Must be in an accepted domain and unused.NewUserPrincipalNameNew user principal name for the underlying account.UpdateUserPrincipalNameKeep the UPN aligned with the new primary SMTP address. Default: true.RemoveOldAddressDelete the old address instead of keeping it as an alias. Mail sent to it will bounce.AllowNonResourceMailboxAllow targets that are not room or equipment mailboxes.DryRunPreview the rename without changing anything.
Revoke-MailboxFullAccessreversibleRemove one or more users' FullAccess permission from one or more mailboxes.
MailboxUPNsrequired One or more mailboxes to remove access from.DelegateUPNsrequired One or more users whose access is being revoked.
Revoke-MailboxSendAsreversibleRemove one or more users' SendAs permission from one or more mailboxes.
MailboxUPNsrequired One or more mailboxes the users can currently send AS.DelegateUPNsrequired One or more users whose SendAs right is being revoked.
Set-BulkOutOfOfficeConfigures internal/external auto-reply (OOF) messages on one, many, or all mailboxes, with optional scheduling.
TargetMailboxesrequired Comma-separated UPNs or 'All'.InternalMessagerequired Internal auto-reply body.ExternalMessageExternal auto-reply body.StartTimeSchedule start (when AutoReplyState=Scheduled).EndTimeSchedule end (when AutoReplyState=Scheduled).AutoReplyStateEnabled, Disabled, or Scheduled. Default Enabled.
Set-BulkResourceMailboxSettingsBulk-applies hide-from-address-list and retention policy across resource mailboxes.
ResourceFilterrequired 'All' or a specific alias.HideFromAddressListHide from address lists. Default false.RetentionPolicyRetention policy name to apply.
Set-MailboxSendOnBehalfAdd or remove Send-on-Behalf grants for one or more users on one or more mailboxes. Outgoing messages show "Delegate on behalf of Mailbox". Other existing grants are preserved.
MailboxUPNsrequired One or more mailboxes the users will send on behalf of.DelegateUPNsrequired One or more users being added or removed.ActionGrant adds users to the on-behalf list; Revoke removes them. Other delegates are untouched.
Set-ResourceMailboxAttributesSets capacity, location, phone, and equipment type on one or more resource mailboxes (same values applied to all).
ResourceIdentitiesrequired One or more resource mailbox aliases or UPNs.CapacityResource capacity (seats).LocationOffice/location string.PhonePhone number.EquipmentTypeStored in CustomAttribute1.
Set-RoomBookingPolicyConfigures calendar processing and booking policy on a resource mailbox.
ResourceIdentityrequired Resource mailbox alias or UPN.BookingPolicyAutoAccept, AutoDecline, or ManualApproval. Default AutoAccept.MaximumDurationMinutesMax booking length. Default 480.BookingWindowDaysHow far in advance bookings are accepted. Default 180.DeclineConflictsDisallow overlapping bookings.
Sync-RoomBookingsSyncs bookings into a room from a CSV or exports current calendar folder properties.
ResourceIdentityrequired Resource mailbox alias or UPN.ActionSyncWithCSV or ExportBookings. Default SyncWithCSV.CsvPathCSV with bookings (when Action=SyncWithCSV).
Entra ID 33
Add-M365LicensereversibleAssigns one or more Microsoft 365 licenses to one or more users by SKU part number or GUID. Checks available seats and usage location first; skips licenses already assigned.
UserUPNsrequired One or more users to license.SkuPartNumbersrequired One or more SKU part numbers or SKU GUIDs, e.g. ENTERPRISEPACK, SPE_E3.UsageLocationTwo-letter ISO country code to set on users that have no usage location, e.g. US. Required before Entra will license a user.DisabledPlansService plan names to leave switched off within the assigned SKUs, e.g. YAMMER_ENTERPRISE.DryRunPreview the assignments without changing anything.
Add-UserToGroupreversibleAdds one or more users to one or more Entra ID / Microsoft 365 groups. Idempotent — skips existing memberships, and skips dynamic, directory-synced, and Exchange-owned groups with the reason.
GroupIdsrequired One or more target group GUIDs or display names. Right-click a group in M365 search to add it to the list.UserUPNsrequired One or more users to add. Right-click users in M365 search to stack them.
Audit-GroupGuestAccessLists guest/external members of one or all groups; optionally removes them.
GroupFilterrequired 'All' or a group GUID.RemoveGuestsRemove guests after listing.
Block-M365UserSignInreversibleBlocks Microsoft 365 sign-in for one or more users and revokes every session, for a lost or stolen device or a compromised account. Reversible with Unblock-M365UserSignIn.
UserUPNsrequired One or more users to lock out.KeepSessionsBlock new sign-ins but leave existing sessions alone.DryRunPreview without changing anything.
Convert-GroupTypeConverts one or more groups between Microsoft 365 unified, security, and mail-enabled types.
GroupIdsrequired One or more target group GUIDs.ConversionTyperequired ToM365Group, ToSecurityGroup, or ToMailEnabled.
Get-AppRegistrationCertificateExpirationLists Entra ID app registration certificates with days until expiry and an EXPIRED/CRITICAL/WARN/OK status, soonest first. Optionally covers SAML signing certificates on service principals.
ApplicationFilterApp object ids, application ids, display names, or 'All'. Default: All.DaysAheadOnly report certificates expiring within this many days, plus already-expired ones. Default: 60.IncludeAllReport every certificate regardless of expiry date.WarnDaysDays remaining at or below which a certificate is WARN. Default: 30.CriticalDaysDays remaining at or below which a certificate is CRITICAL. Default: 7.IncludeServicePrincipalsAlso check certificates on service principals, where SAML token-signing certificates live.IncludeOwnersInclude each application's owners — one extra Graph call per application.OutputFormatTable, Object, CSV, or JSON. Default: Table.CsvPathFile path for CSV output. Default: AppCertificateExpiration.csv.
Get-AppRegistrationSecretExpirationLists Entra ID app registration client secrets with days until expiry and an EXPIRED/CRITICAL/WARN/OK status, soonest first.
ApplicationFilterApp object ids, application ids, display names, or 'All'. Default: All.DaysAheadOnly report secrets expiring within this many days, plus already-expired ones. Default: 60.IncludeAllReport every secret regardless of expiry date.WarnDaysDays remaining at or below which a secret is WARN. Default: 30.CriticalDaysDays remaining at or below which a secret is CRITICAL. Default: 7.IncludeServicePrincipalsAlso check secrets held on service principals.IncludeOwnersInclude each application's owners — one extra Graph call per application.OutputFormatTable, Object, CSV, or JSON. Default: Table.CsvPathFile path for CSV output. Default: AppSecretExpiration.csv.
Get-EntraSignInReportExports Entra sign-in logs over a lookback window to CSV or JSON.
DaysBackLookback window in days. Default 7.OutputFormatCSV or JSON. Default CSV.
Get-GroupAuditReportGenerates a Membership, Activity, or AllGroups report and exports to CSV/JSON.
ReportTypeMembership, Activity, or AllGroups. Default Membership.OutputFormatCSV or JSON. Default CSV.
Get-GroupMembershipLists the members (and optionally owners) of one or more Entra ID / Microsoft 365 groups, flagging guests, disabled accounts, and nested groups.
GroupIdsrequired One or more group GUIDs or display names.RecursiveExpand nested groups and report every effective member.IncludeOwnersAlso list the group's owners.OutputFormatTable, CSV, or JSON. Default: Table.CsvPathFile path for CSV output. Default: GroupMembership.csv.
Manage-AppRegistrationCreates a new single-tenant app registration or deletes one by ID.
Actionrequired Create, Update, or Delete.AppNameDisplay name for new apps.AppIdApplication object ID for delete/update.
Manage-ConditionalAccessPolicyCreates a Conditional Access policy (MFA-required) or disables an existing one.
Actionrequired Create, Update, Enable, or Disable.PolicyNameDisplay name for new policies.PolicyIdPolicy GUID for update/disable.
Manage-DirectorySyncChecks directory sync status, forces a sync, or enables the cloud-only security policy.
ActionCheckSyncStatus, ForceSync, or CloudOnlyPolicy. Default CheckSyncStatus.
Manage-EntraDevicesDeletes or updates compliance state on one or all Entra-joined/hybrid devices.
DeviceFilterrequired Device ID or 'All'.ActionDelete or UpdateCompliance. Default Delete.
Manage-GroupLifecycleArchives, renews, or deletes one or more groups.
GroupFiltersrequired One or more group GUIDs, or the literal value 'All'.ActionArchive, Renew, or Delete. Default Archive.DryRunPreview without executing.
Manage-GroupOwnershipAssigns one or more owners across one or more groups; optionally deletes orphaned (ownerless) groups.
GroupFiltersrequired One or more group GUIDs, or the literal value 'All'.NewOwnerUPNsUsers to add as owners on every matched group.RemoveOrphanedDelete groups that have zero owners.
Manage-GroupPermissionsGrant or revoke SendAs across one or more groups, or add and remove one or more owners.
GroupIdsrequired One or more groups to modify. Right-click groups in M365 search to stack them.DelegateUPNsUsers receiving (or losing) the permission. Required for all actions.Actionrequired GrantSendAs / RevokeSendAs control SendAs on the group address. GrantOwner / RevokeOwner add and remove the user as a group admin (via Graph). The last remaining owner is never removed.
Manage-GuestUserLifecycleProvisions guest invitations, expires pending guests, or removes a guest user.
Actionrequired Provision, Expire, or Remove.GuestEmailEmail/UPN of the guest.ExpirationDaysPending-state expiration window. Default 90.
Manage-UserMfaReports each user's registered auth methods, or resets them all, across one or more users.
ActionReport or Reset. Default Report.UserPrincipalNamesOne or more target user UPNs.
Manage-UserOnboardingMicrosoft 365 joiner and leaver. Onboard creates the account with a copy-once password, manager, and a colleague's groups and Teams. Offboard blocks sign-in, revokes sessions, hands groups the leaver owned alone to their manager, and removes them from every group and Team.
Actionrequired Onboard (joiner) or Offboard (leaver).UserPrincipalNamerequired The joiner's or leaver's UPN.DisplayNameOnboard: display name. Default: GivenName Surname.GivenNameOnboard: first name.SurnameOnboard: last name.JobTitleOnboard: job title.DepartmentOnboard: department.ManagerUPNOnboard: the manager to set. Offboard: who takes over groups the leaver owned alone (default: their manager).CopyGroupsFromOnboard: copy Microsoft 365 groups, Teams and security groups from this colleague.AddToGroupsOnboard: more groups or Teams to add, by display name or id.UsageLocationOnboard: two-letter usage location. Default: US.DryRunPreview without changing anything.
New-BulkM365GroupsCreates Microsoft 365 groups from a CSV with owners and members, and optionally turns each into a Team. Existing groups are brought up to date instead of duplicated.
CsvPathrequired CSV of groups. Headers: DisplayName, MailNickname, Description, Visibility, Owners (';'), Members (';'), TeamEnabled.VisibilityVisibility for rows that leave it blank.TeamRetrySecondsHow long to keep retrying Team creation while a new group replicates.DryRunPreview the groups, owners and members that would change without changing anything.
Remove-M365LicensereversibleRemoves one or more Microsoft 365 licenses from one or more users by SKU part number or GUID. Reverse of Add-M365License; reports group-inherited licenses instead of failing on them.
UserUPNsrequired One or more users to unlicense.SkuPartNumbersrequired One or more SKU part numbers or SKU GUIDs, e.g. ENTERPRISEPACK, SPE_E3.DryRunPreview the removals without changing anything.
Remove-UserFromGroupreversibleRemoves one or more users from one or more Entra ID / Microsoft 365 groups. Idempotent — skips users that aren't members, and skips dynamic, directory-synced, and Exchange-owned groups with the reason.
GroupIdsrequired One or more target group GUIDs or display names. Right-click a group in M365 search to add it to the list.UserUPNsrequired One or more users to remove. Right-click users in M365 search to stack them.
Send-NotificationTestChecks that PowerScripts can deliver results: the Output Email From mailbox and the app's Mail.Send permission for script email, and a Teams Workflow webhook URL for completion notifications. Read-only unless -SendTestEmail or -SendTestTeamsMessage is set, which send one labelled test message.
RecipientUPNrequired Who receives the test email. Also checked to exist in the tenant.WebhookUrlA Teams Workflow webhook URL from a script's notification settings, to check it is valid and reachable.SendTestEmailSend one labelled test email from the Output Email From mailbox to RecipientUPN.SendTestTeamsMessagePost one labelled test card to WebhookUrl.
Set-BulkUsersAndLicensesCreates or updates Entra ID users from a CSV (name, title, department, usage location) and assigns a license only where a free seat exists. Safe to re-run.
CsvPathrequired CSV of users. Headers: UserPrincipalName, DisplayName, GivenName, Surname, JobTitle, Department, CompanyName, OfficeLocation, MailNickname, UsageLocation, License (SKU part number or GUID).UsageLocationTwo-letter usage location for rows that leave it blank. Required by Microsoft before a license can be assigned.StartDisabledCreate new users with sign-in blocked.DryRunPreview the users and licenses that would change without changing anything.
Set-DynamicGroupRuleUpdates or reads a dynamic-membership rule on an Entra ID group.
GroupIdrequired Target group GUID.MembershipRulerequired Membership rule expression (e.g. user.department eq 'Sales').ActionUpdateRule or ValidateRule. Default UpdateRule.
Set-GroupPolicyApplies a sensitivity label, restricts guest access, or enforces naming on a group.
GroupIdrequired Target group GUID.PolicyActionrequired ApplySensitivityLabel, RestrictGuestAccess, or EnforceNaming.SensitivityLabelIdLabel GUID when PolicyAction=ApplySensitivityLabel.
Set-PimRoleAssignmentGrants or removes an Eligible (default 30 days) or Active PIM role assignment for one or more users.
UserPrincipalNamesrequired One or more user UPNs.RoleNamerequired Directory role display name.AssignmentTypeEligible or Active. Default Eligible.ActionGrant the assignment or Remove an existing one. Default Grant.
Sync-GroupMembershipReconciles a group's membership against a CSV, either adding only or fully replacing.
GroupIdrequired Target group GUID.MembershipCsvrequired CSV with a UPN column for desired members.ModeReplace (prune extras) or AddOnly. Default AddOnly.
Test-AppCredentialHealthChecks the PowerScripts app registration's client secrets and certificates: expiry dates and days left, and whether each certificate is installed on this server with a private key the service account can use. Schedule it to get a warning before an expiry breaks every script at once. Read-only.
WarnDaysReport secrets and certificates that expire within this many days.
Test-GraphConnectionVerifies the Microsoft Graph connection: tenant identity, app registration, granted scopes, and a live org read.
VerboseReserved for future use.
Test-M365ConnectivityTroubleshoots the tenant connection as the app sees it: modules and versions, Graph, the app's Entra roles and their scope, Exchange Online and which cmdlets its role exposes, Security & Compliance, Teams and SharePoint. Ends with plain-English findings. Read-only.
CheckCmdletsExtra cmdlets to test for - for example the ones a failing script needs, such as New-DistributionGroup. For each one that is missing, the findings name the Exchange roles that include it.
Unblock-M365UserSignInreversibleAllows one or more blocked users to sign in to Microsoft 365 again. Reverse of Block-M365UserSignIn; revoked sessions are not restored.
UserUPNsrequired One or more users to allow back in.DryRunPreview without changing anything.
Compliance 20
Disable-LitigationHoldreversibleRemoves a litigation hold from a mailbox. Reversible from the run log, restoring the previous hold duration.
MailboxUPNrequired Mailbox to remove the hold from.ReasonReason recorded for audit purposes.RestoreDurationDaysUsed when reversing: duration to restore if re-enabling. 0 = indefinite.
Enable-LitigationHoldreversiblePlaces a mailbox on litigation hold, optionally for a fixed duration. Reversible from the run log.
MailboxUPNrequired Mailbox to place on hold.DurationDaysHold duration in days. 0 or omitted = indefinite.ReasonReason recorded on the mailbox for audit purposes.
Export-UnifiedAuditLogSearches the unified audit log over a date range and exports to CSV or JSON.
StartDaterequired Inclusive start date.EndDaterequired Inclusive end date.OperationsOperation filter or 'All'. Default All.OutputFormatCSV or JSON. Default CSV.
Get-ComplianceGovernanceReportProduces a tenant-wide compliance governance summary: total legal holds, active eDiscovery cases, and retention policies.
OutputFormatCSV or JSON. Default: CSV.
Get-CrossServiceHoldOverviewProduces a combined count of litigation holds across mailboxes and SharePoint sites, exportable as CSV.
OutputFormatCSV or Grid. Default: CSV.
Get-DlpHeldContentReportReports DLP rule-match incidents (optionally filtered to blocked/held actions) via Export-ActivityExplorerData. (Get-DlpIncidentReport was retired Feb 2023.)
DaysBackNumber of days back to query DLP events. Default: 30.OnlyBlockedOrHeldRestrict to events where the policy action was Block / Hold.OutputFormatCSV or JSON. Default: CSV.
Get-EDiscoveryCaseReportReports status and custodian counts for all eDiscovery cases, optionally filtered by case name.
CaseNameFilterOptional case name filter; omit to report all cases.OutputFormatCSV or JSON. Default: CSV.
Get-EDiscoveryExportReportSummarizes content search results for a given eDiscovery case, showing name, status, item count, and size.
CaseNameeDiscovery case name to scope the search.OutputFormatCSV or Grid. Default: CSV.
Get-HoldExpirationLists all mailboxes under litigation hold with their duration and owner to track upcoming hold expirations.
DaysToExpireThreshold window in days for flagging expiring holds. Default: 30.
Get-HoldStatisticsReports litigation hold duration and owner for mailboxes and lock state for SharePoint sites.
ScopeMailbox, Site, or All. Default: All.
Get-LegalHoldAuditLogSearches the unified audit log for HoldCreated and HoldRemoved operations from a specified start date.
StartDaterequired Start date for the audit log search (YYYY-MM-DD).DaysBackNumber of days back to search. Default: 30.
Get-LegalHoldReportReports all mailboxes and SharePoint sites currently under litigation hold, exportable as CSV or plain text.
HoldTypeMailbox, Site, or All. Default: All.OutputFormatCSV or Grid. Default: CSV.
Get-PurviewReportExports DLP incidents (Activity Explorer), sensitivity-label activity (Unified Audit Log), or retention policy compliance.
ReportTypeDLPIncidents, LabelActivity, or RetentionEffectiveness. Default: DLPIncidents.DaysBackLookback window in days. Default: 30.OutputFormatCSV or JSON. Default: CSV.
Get-RetentionHoldReportReports retention and deletion hold policies with their applied locations, exportable as CSV or JSON.
HoldTypeRetention, Deletion, or All. Default: All.OutputFormatCSV or JSON. Default: CSV.
Manage-DlpPolicyCreates a DLP policy in AuditAndNotify mode, or toggles one or more existing policies between Enforce and Audit modes.
Actionrequired Create, Update, Enable, or Disable.PolicyNameDisplay name for new policy.PolicyIdsOne or more policy identities to update/enable/disable.
Manage-EDiscoveryCaseCreates eDiscovery cases and content searches, runs them, and exports results.
Actionrequired CreateCase, CreateSearch, or Export.CaseNameeDiscovery case name.SearchNameCompliance search name.QueryKQL content match query. Default subject:'confidential'.
Manage-RetentionPolicyCreates a tenant-wide retention policy, scopes it to one or more locations, or deletes it.
Actionrequired Create, Assign, or Delete.PolicyNamePolicy display name.TargetIdentitiesMailboxes/sites to add when Action=Assign.
New-EDiscoveryCaseHoldreversibleCreates (or reuses) a Purview eDiscovery case and puts mailboxes, sites and Microsoft 365 groups or Teams on hold in it, optionally only for content matching a query. Re-running adds locations; reversible.
CaseNamerequired eDiscovery case name. Created if it does not exist.CaseDescriptionDescription for a new case (ignored when the case exists).HoldNameHold policy name inside the case. Default: '<CaseName> hold'.MailboxesMailboxes to hold (UPN or SMTP address).SitesSharePoint or OneDrive site URLs to hold.GroupsMicrosoft 365 groups or Teams to hold, by mail address. Holds the group mailbox and its site.QueryKQL query limiting the hold to matching content, e.g. subject:"Project Erie". Empty = hold everything.DryRunShow the case, hold and locations that would be set without changing anything.
Remove-EDiscoveryCaseHoldreversibleTakes mailboxes, sites or Microsoft 365 groups / Teams off an eDiscovery case hold, and removes the hold policy once it is empty. Reverse of New-EDiscoveryCaseHold.
CaseNamerequired eDiscovery case name.HoldNameHold policy name. Default: '<CaseName> hold'.MailboxesMailboxes to release (UPN or SMTP address).SitesSharePoint or OneDrive site URLs to release.GroupsMicrosoft 365 groups or Teams to release, by mail address.DryRunShow what would be released without changing anything.
Set-SensitivityLabelApplies a sensitivity label to a mailbox or SharePoint site, or reports a label's settings.
TargetIdentityrequired Mailbox identity or site URL.LabelIdLabel GUID.TargetTypeMailbox, Site, OneDrive, or Team. Default Mailbox.ActionApply or Report. Default Apply.
Teams 18
Add-TeamMemberreversibleAdds users to one or more teams as members or owners, promoting existing members in place rather than duplicating them. Idempotent, and reports guest additions the tenant policy blocks.
TeamIdsrequired One or more teams (group id or display name).UserUPNsrequired One or more users (UPN or object id).RoleMember or Owner. Default: Member.DryRunPreview the memberships that would be added without changing anything.
Audit-TeamsGuestAccessLists external/guest members across one team or all teams.
TeamFilterrequired Team ID or 'All'.ExportReportEmit a final 'report generated' marker.
Copy-TeamClones a team's description, visibility, and channels into a new target team.
SourceTeamIdrequired Source team GUID.TargetTeamNamerequired Display name for the new team.IncludeMembershipAlso copy team members (when set).
Get-TeamsInactiveTeamsReports teams with no activity in the chosen window using the Microsoft 365 usage reports, with message and meeting counts, creation date, and optionally the owners to contact. Read-only; feeds Manage-TeamArchival.
DaysInactiveDays without activity before a team is reported. Default: 90.PeriodUsage report window: D7, D30, D90 or D180. Default: D90.IncludeOwnersAlso list each inactive team's owners - one Graph call per team reported.OutputFormatTable, CSV, or JSON. Default: Table.CsvPathFile path for CSV output. Default: InactiveTeams.csv.
Get-TeamsMessageActivityRetrieves recent channel or private chat messages for a Teams team or chat thread via Graph.
TeamIdTeam GUID (required when TargetType=Channel).ChatIdChannel ID or Chat ID depending on TargetType.DaysBackNumber of days back to retrieve messages. Default: 30.TargetTypeChannel or Chat. Default: Channel.
Get-TeamsOwnershipReportReports every team's ownership with a risk flag - ownerless, owners all disabled, single owner, or guest owner - plus member and guest counts. Read-only; feeds Add-TeamMember -Role Owner.
RiskyOnlyOnly report teams carrying a risk flag.IncludeNonTeamGroupsAlso report Microsoft 365 groups that are not teams.OutputFormatTable, CSV, or JSON. Default: Table.CsvPathFile path for CSV output. Default: TeamsOwnership.csv.
Get-TeamsUsageReportGenerates a TeamActivity, ChannelUsage, or Membership report and exports to CSV/JSON.
ReportTypeTeamActivity, ChannelUsage, or Membership. Default TeamActivity.OutputFormatCSV or JSON. Default CSV.
Manage-TeamArchivalArchives, unarchives, or deletes one or more teams (by id, displayName, or 'All').
TeamFiltersrequired One or more team IDs / displayNames, or the literal 'All'.ActionArchive, Unarchive, or Delete. Default Archive.DryRunPreview without executing.
Manage-TeamMembershipAdd or remove a member or owner on a Microsoft Team.
TeamIdrequired Team to modify. Right-click a team in M365 search to drop in the GUID.UserPrincipalNamerequired User to add or remove. Example: jane@contoso.comActionMember = regular participant. Owner = team admin (can manage settings, members, and channels).
Manage-TeamsMeetingsSchedules a Teams online meeting for one or more organizers, or fetches an attendance report.
OrganizerUPNsrequired One or more organizer UPNs.Subjectrequired Meeting subject.StartTimeMeeting start (when Action=Schedule).DurationMinutesLength in minutes. Default 60.ActionSchedule or GetAttendance. Default Schedule.
Manage-TeamsMessagingPolicyAudits, applies a named messaging policy, or enables moderation across one or more teams.
TeamIdsrequired One or more target team GUIDs.ActionAudit, ApplyPolicy, or EnableModeration. Default Audit.PolicyNameMessaging policy name when Action=ApplyPolicy. Default 'Default'.
New-BulkTeamsCreates Teams from a CSV: the Microsoft 365 group, owners and members, the Team, and extra standard channels. Re-running adds what is missing and never removes.
CsvPathrequired CSV of teams. Headers: DisplayName, MailNickname, Description, Visibility, Owners (';'), Members (';'), Channels (';').VisibilityVisibility for rows that leave it blank.TeamRetrySecondsHow long to keep retrying Team creation while a new group replicates.DryRunPreview the teams, owners, members and channels that would change without changing anything.
New-TeamsChannelCreates standard, private or shared channels in a team, singly or from a CSV. Enforces the rules the API only reports as opaque errors: private channels need an owner, and channel owners must already be team members.
TeamIdrequired Team to create the channels in (group id or display name).ChannelNamesOne or more channel names. Required unless -CsvPath is used.MembershipTypeStandard, Private or Shared. Default: Standard.DescriptionChannel description.OwnerUPNChannel owner (UPN). Required for private and shared channels.MemberUPNsAdditional members for private and shared channels (UPNs).CsvPathCSV of channels to create. Headers: Name, Description, MembershipType, Owner, Members (';'-separated).DryRunPreview the channels that would be created without changing anything.
Remove-TeamMemberreversibleRemoves users from teams, or demotes owners to members with -DemoteToMember. Reverse of Add-TeamMember; refuses to remove a team's last owner unless forced, and warns when a team is left ownerless.
TeamIdsrequired One or more teams (group id or display name).UserUPNsrequired One or more users (UPN or object id).DemoteToMemberDrop the owner role but keep the user as a member.ForceAllow removing or demoting a team's last owner.DryRunPreview the removals without changing anything.
Send-TeamsChannelMessagePosts a Markdown/HTML message to one or more Teams channels in a team via Microsoft Graph.
TeamIdrequired Team ID (or 'General').ChannelIdsrequired One or more channel IDs in the team.MessageBodyrequired Message body (Markdown/HTML).ImportanceNormal, High, or Urgent. Default Normal.
Send-TeamsMessageBroadcasts a Teams message to one or more channels or chats with configurable importance.
TargetIdsrequired One or more Team IDs (channel mode) or Chat IDs (chat mode).ChannelIdChannel ID when TargetType=Channel (applied to every team).MessageBodyrequired Message body (Markdown/HTML).ImportanceNormal, High, or Urgent. Default Normal.TargetTypeChannel or Chat. Default Channel.
Send-TeamsUrgentMessageSends an Urgent/High/Normal message to either a Teams chat or channel via Microsoft Graph.
TargetIdrequired Chat ID, or 'TeamId/ChannelId' for a channel message.MessageBodyrequired Message body.TargetTypeChat or Channel. Default Chat.ImportanceNormal, High, or Urgent. Default Urgent.
Set-TeamSettingsUpdates a team's external-access settings or applies a sensitivity label.
TeamIdrequired Target team GUID.ActionUpdateSettings or ApplySensitivityLabel. Default UpdateSettings.SensitivityLabelIdLabel GUID when Action=ApplySensitivityLabel.AllowExternalAccessAllow external senders. Default true.
Defender 10
Get-DefenderSecurityReportExports a cross-product Defender report: threat assessment summary, incident list, or Secure Score trend.
ReportTypeThreatSummary, IncidentReport, or SecureScoreTrend. Default: ThreatSummary.OutputFormatCSV or JSON. Default: CSV.
Get-SecureScoreReportMicrosoft Secure Score in plain words: current score, 30- and 90-day change, comparison with similar organisations, progress by area, and the recommendations worth the most points with effort and user impact. Optional HTML report with a trend chart and how-to steps. Read-only.
TopHow many recommendations to list. Default: 10.ReportPathHTML report with the score, trend chart, areas and how-to steps.
Get-SecurityAlertNotificationRetrieves Defender alerts by severity and simulates webhook notification dispatch for each.
SeverityFilterrequired Alert severity to filter on (e.g. high, medium, low).WebhookUrlWebhook endpoint to post alert notifications.
Invoke-AdvancedHuntingQueryExecutes a KQL Advanced Hunting query via the Graph Security API and exports the results.
KqlQueryrequired KQL query string to execute against Advanced Hunting.OutputFormatCSV or JSON. Default: CSV.
Invoke-DeviceRemediationIsolates or scans risky/non-compliant devices in bulk via Defender for Endpoint Graph actions.
DeviceFilterrequired Risky, NonCompliant, or All.ActionIsolate, Scan, Retire, or Wipe. Default: Scan.DryRunPreview changes without executing.
Manage-CloudAppSecurityPolicyCreates app or file governance policies in Microsoft Defender for Cloud Apps via the Graph Security API.
PolicyTyperequired CreateAppPolicy or CreateFilePolicy.PolicyNameDisplay name for the new policy.
Manage-DefenderO365PolicyCreates Safe Links or Safe Attachment policies for Defender for Office 365.
PolicyTyperequired CreateSafeLinks, CreateSafeAttachment, or UpdateAntiPhish.PolicyNameDisplay name for the new policy.
Manage-SecurityIncidentAssigns, closes, or triggers device isolation across one or more Defender security incidents.
IncidentIdsrequired One or more Defender incident IDs to act on.ActionAssign, Close, or IsolateDevice. Default: Close.AssigneeUPNsUPNs to assign when Action=Assign.
Manage-ThreatDetectionRuleCreates a custom Defender detection rule, or enables/disables one or more existing rules via the Graph Security API.
Actionrequired Create, Update, Enable, or Disable.RuleNameDisplay name for the new rule (required for Create).RuleIdsOne or more alert rule IDs (required for Enable/Disable).KqlQueryKQL detection query (required for Create).
Manage-ThreatIntelligenceAdds or removes IP, URL, or file-hash indicators of compromise in Microsoft Defender Threat Intelligence.
Actionrequired AddIoC, RemoveIoC, or UpdateIoC.IndicatorValueThe IP address, URL, or hash value of the indicator.IndicatorTypeIP, URL, or FileHash.
Copilot 7
Export-CopilotAdoptionDashboardScheduled Copilot adoption dashboard — per-user detail + period summary.
FrequencyWeekly (D7) or Monthly (D30). Default: Weekly.OutputFormatCSV or JSON. Default: CSV.
Get-CopilotAdoptionReportPer-user Microsoft 365 Copilot adoption (last activity per app, across the period).
PeriodD7, D30, D90, or D180. Default: D30.OutputFormatCSV or JSON. Default: CSV.
Get-CopilotInteractionAuditQueries the Entra audit log for Copilot category events to audit user interactions over a rolling window.
DaysBackLookback window in days. Default: 30.OutputFormatCSV or JSON. Default: CSV.
Get-CopilotUsageMetricsMicrosoft 365 Copilot usage metrics — per-user detail plus enabled/active counts for the period.
PeriodD7, D30, D90, or D180. Default: D30.OutputFormatCSV or JSON. Default: CSV.
Get-CopilotUserActivityPer-user Copilot activity (last activity per app) for one or more UPNs, or all users.
UserFiltersrequired One or more UPNs to query, or the literal value 'All'.PeriodD7, D30, D90, or D180. Default: D30.
Optimize-CopilotLicensesIdentifies and (with -CopilotSkuId) removes Copilot licenses from inactive users via the Graph beta usage report.
InactiveDaysInactivity threshold in days. Default: 60.CopilotSkuIdTenant Copilot SKU GUID. Required when -DryRun is not set. Find via Get-MgSubscribedSku.PeriodLookback period: D30, D90, or D180. Default: D90.DryRunPreview removals without executing.
Set-BulkCopilotLicenseAssigns or removes the Microsoft 365 Copilot license for users listed in a CSV file.
CsvPathrequired Path to CSV file with a UPN column.ActionAssign or Remove. Default: Assign.DryRunPreview changes without executing.
On-premises · 58
Network & infrastructure 30
Get-CertificateExpirationConnects to one or more HTTPS endpoints with phase-by-phase diagnostics (DNS / TCP / TLS / cert) and per-IP candidate walk that prefers IPv4 to avoid dual-stack IPv6-first stalls; reads the X.509 certificate and reports expiration against warning and critical thresholds. Per-URL ports (https://host:8443) are honoured, results are sorted soonest-expiry first with unreachable endpoints on top, and a rollup of everything expiring or unreachable is written to the warning stream. Status values include OK, WARN, CRITICAL, EXPIRED, DNS-FAIL, TCP-TIMEOUT, TCP-REFUSED, TCP-RESET, TLS-FAIL, ERROR.
Urlrequired One or more hostnames or URLs to query. A port in the URL (https://host:8443) overrides -Port for that endpoint.PortTCP port for endpoints that do not specify one. Default 443.WarnDaysDays-until-expiry threshold that triggers WARN. Default 30.CriticalDaysDays-until-expiry threshold that triggers CRITICAL. Default 7.TimeoutMsTCP connect timeout per candidate IP in milliseconds. Default 10000.DnsTimeoutMsDNS resolution timeout in milliseconds. Default 3000.RetryCountRetry count on transient TCP-TIMEOUT or TCP-RESET (per candidate IP). Default 0.RetryDelayMsDelay between retries in milliseconds. Default 500.AddressFamilyAuto (IPv4 first, fall back to IPv6), IPv4, or IPv6. Default Auto.OutputFormatSummary (readable lines, the default), or Object, CSV, JSON, Grid for other tools.IgnoreValidationSkip server certificate validation (inspect-only mode).DryRunPreview action without executing.
Get-IISApplicationPoolStatusReports IIS application pool and site state via the WebAdministration module when available, falling back to appcmd.exe XML output (locally or remotely via Invoke-Command); enriches each pool with worker process PIDs, .NET runtime version, identity, idle timeout, and recent WAS recycle event counts (event IDs 5074/5075/5076/5077/5079/5080/5117).
ComputerNameTarget computer. Default localhost.PoolNameFilterWildcard filter for app pool names. Default '*'.SiteNameFilterWildcard filter for site names. Default '*'.RecycleWindowHoursRecycle event lookback in hours. Default 24.StrictRunningOnlyTreat any non-Running pool as FAIL.OutputFormatObject, JSON, or CSV. Default Object.DryRunPreview action without executing.
Get-ServiceBannerConnects to TCP services on configured ports and grabs protocol-aware banners (HTTP HEAD, HTTPS via SslStream, SSH version exchange, SMTP EHLO, FTP/POP3/IMAP first frame, Telnet read), then extracts product and version strings via regex patterns.
Targetrequired FQDN or IP host(s).Portrequired TCP port(s) to probe.ConnectTimeoutMsTCP connect timeout in ms. Default 3000.DnsTimeoutMsDNS resolution timeout in ms. Default 3000.AddressFamilyAuto (IPv4 first, fall back to IPv6), IPv4, or IPv6. Default Auto.ReadTimeoutMsBanner read timeout in ms. Default 3000.ProtocolAuto, Http, Https, Ssh, Smtp, Ftp, Pop3, Imap, Telnet, Generic. Default Auto (port-based).MaxBytesMaximum bytes to read. Default 4096.OutputFormatObject, JSON, or CSV. Default Object.DryRunPreview action without executing.
Invoke-NetworkDiscoveryDiscovers live hosts on a CIDR subnet or IP range using parallel ICMP echo, TCP probes against common service ports, and ARP cache walking; enriches results with MAC addresses and vendor (OUI) lookup, optional reverse DNS, and TTL hints for OS fingerprinting.
Targetrequired CIDR (10.0.0.0/24) or range (10.0.0.1-10.0.0.50).MethodProbe methods: Icmp, Tcp, Arp. Default all.TcpPortsTCP ports to probe. Default 22,80,135,443,445,3389.TimeoutMsProbe timeout in ms. Default 800.ConcurrentPeak concurrent workers. Default 64.ResolveNamesReverse-DNS each live host.OutputFormatObject, JSON, or CSV. Default Object.DryRunPreview action without executing.
Invoke-SubnetPortScanTCP-connect port scan across CIDR subnets, IP ranges, or comma-separated targets, driven by a .NET RunspacePool for concurrency, with per-connection timeout, optional protocol-aware service banner grabbing, and CSV/JSON export.
Targetrequired CIDR (10.0.0.0/24), range (10.0.0.1-10.0.0.50), or hostname/IP list.Portrequired Port list/range (e.g., '22,80,443' or '1-1024').ConcurrentPeak concurrent workers. Default 100.TimeoutMsPer-connection timeout in ms. Default 1000.GrabBannerRead service banner from open ports.BannerTimeoutMsBanner read timeout in ms. Default 1500.OnlyOpenSuppress closed ports in output.OutputFormatObject, JSON, or CSV. Default Object.DryRunPreview action without executing.
Measure-ApiLoadProfileDrives concurrent or ramp-based load against REST or GraphQL endpoints using a .NET RunspacePool, reporting throughput (req/sec), error rate, min/avg/max latency, and configurable percentile breakpoints (P50/P75/P95/P99).
Urlrequired Target URL.EngineREST or GraphQL. Default REST.MethodHTTP method. Default GET.BodyRequest body or file path (REST).GraphQlQueryGraphQL query/mutation document (GraphQL engine).GraphQlVariablesGraphQL variable values.HeadersAdditional request headers.AuthSchemeNone, Bearer, or Basic. Default None.BearerTokenToken for Bearer auth.BasicUsernameUsername for Basic auth.BasicPasswordPassword for Basic auth.ConcurrentPeak concurrent workers. Default 10.TotalRequestsTotal requests to issue. 0 = run for DurationSec. Default 100.DurationSecTest duration when TotalRequests=0. Default 30.RampUpSecSeconds to ramp to full concurrency. 0 = immediate. Default 0.PercentilesLatency percentiles to compute. Default 50,75,95,99.ErrorThresholdPercentError-rate percent above which run is FAIL. Default 5.TimeoutSecPer-request timeout in seconds. Default 15.OutputFormatObject, JSON, or CSV. Default Object.DryRunPreview action without executing.
Measure-NetworkThroughputDrives sustained TCP or UDP traffic to a remote endpoint over a fixed duration and reports Mbps, total data transferred, error count, and optional concurrent ICMP latency correlation.
Targetrequired Remote host to test against.Portrequired Remote TCP/UDP port.ProtocolTCP or UDP. Default TCP.DurationSecTest duration in seconds. Default 10.BufferBytesSend buffer / datagram size in bytes. Default 65536.DirectionUpload (client sends) or Download (client reads). Default Upload.LatencyCorrelationRun concurrent ICMP pings to correlate throughput with latency.OutputFormatObject, CSV, or JSON. Default Object.DryRunPreview action without executing.
Monitor-CloudServiceHealthQueries public health endpoints for AWS (per-service RSS feeds), Azure (Atom status feed), and GCP (incidents JSON API), reports availability and active incidents, and trends degradation within a configurable time window.
ProviderAWS, Azure, GCP, or All. Default All.AwsRegionsAWS region filter (e.g. us-east-1). Omit for all curated services.AzureRegionsAzure region name filter. Omit for global feed.OnlyDegradedSuppress OK rows; show only degraded or errored services.TrendHoursAge window (hours) for incident trending. Default 72.TimeoutSecPer-provider HTTP timeout in seconds. Default 20.OutputFormatObject, JSON, Grid, or CSV. Default Object.DryRunPreview action without executing.
Monitor-NtpSynchronizationSends raw NTP (UDP/123) requests to one or more time servers, calculates clock offset, round-trip delay, and jitter from multiple samples, and warns on stratum, offset, or inter-server spread violations.
ServerNTP server(s) to query. Default: time.windows.com, pool.ntp.org, time.google.com, time.cloudflare.com.SamplesPerServerNumber of NTP packets per server for jitter calculation. Default 4.SampleIntervalMsDelay between samples in ms. Default 500.OffsetWarnMsAbsolute offset (ms) that triggers WARN. Default 128.JitterWarnMsJitter (ms) that triggers WARN. Default 50.MaxStratumMaximum acceptable stratum level. Default 3.TimeoutMsUDP receive timeout per packet in ms. Default 3000.OutputFormatObject, CSV, JSON, or Grid. Default Object.DryRunPreview action without executing.
Monitor-WindowsServerHealthCollects Windows server health via CIM/WMI sessions (WSMan or DCOM) — CPU LoadPercentage, OS memory, fixed-disk free space, non-disabled services in non-Running state, recent error events from System and Application logs — and applies WARN/FAIL thresholds with configurable required-service validation.
ComputerNameTarget computers. Default localhost.CredentialCredential for remote CIM session.UseDcomUse DCOM instead of WSMan.CpuWarnPctCPU percent — WARN threshold. Default 75.CpuFailPctCPU percent — FAIL threshold. Default 90.MemWarnPctMemory percent used — WARN threshold. Default 80.MemFailPctMemory percent used — FAIL threshold. Default 92.DiskWarnFreePctFree-disk percent — WARN below. Default 15.DiskFailFreePctFree-disk percent — FAIL below. Default 5.RequiredServicesService names that must be Running.EventWindowHoursRecent error event window in hours. Default 24.EventTopNMaximum recent error events per log. Default 10.OutputFormatObject, JSON, or CSV. Default Object.DryRunPreview action without executing.
New-MonitoringReportAggregates JSON or CSV output produced by any monitoring script in this catalog into a self-contained HTML report — status rollup cards, per-group sortable tables (click headers), inline SVG sparklines for trended numeric metrics (LatencyMs, CpuPercent, etc.), color-coded status pills, and an optional raw-JSON dump. No external CSS or JS dependencies.
InputPathrequired Input JSON/CSV files from any monitoring script.OutputPathrequired Output HTML report path.TitleReport title. Default 'PS365 Monitoring Report'.GroupByProperty used for per-group tables. Default 'Status'.TrendPropertyNumeric properties candidates for sparkline. First with >=2 values wins per group.TopNTop-N rows per group. Default 200.EmbedRawJsonAppend raw JSON dump of all rows in a collapsible section.DryRunPreview action without executing.
Send-TestNotificationMulti-channel alert delivery validator. Sends a structured test notification across any combination of Syslog (UDP RFC5424 framing with computed PRI), SNMP trap (snmptrap.exe shell-out, v2c, custom enterprise OIDs), Microsoft Teams MessageCard, Slack incoming webhook, PagerDuty Events v2, and SMTP — captures per-channel delivery success and round-trip latency.
ChannelChannels: Syslog, SnmpTrap, Teams, Slack, PagerDuty, Smtp. Default = auto-detect from supplied params.SubjectNotification subject. Default 'PS365 Test Notification'.BodyNotification body.SeverityDEBUG/INFO/WARN/ERROR/CRIT. Default INFO.SyslogServerSyslog server hostname/IP.SyslogPortSyslog UDP port. Default 514.SyslogFacilitySyslog facility 0-23. Default 1 (user).SnmpTargetSNMP target host[:port] (default port 162).SnmpCommunitySNMP community. Default 'public'.SnmpTrapOidSNMP trap OID.TeamsWebhookUrlMicrosoft Teams incoming webhook URL.SlackWebhookUrlSlack incoming webhook URL.PagerDutyRoutingKeyPagerDuty Events v2 routing key.SmtpServerSMTP server.SmtpPortSMTP port. Default 587.SmtpFromSMTP from address.SmtpToSMTP recipient(s).SmtpCredentialSMTP credential.SmtpUseSslEnable STARTTLS.TimeoutSecPer-channel timeout. Default 10.OutputFormatObject, JSON, or CSV. Default Object.DryRunPreview action without executing.
Test-CertificateChainPerforms full TLS certificate chain validation using X509Chain — walks intermediates, checks NotAfter on each cert, runs online OCSP/CRL revocation checks with configurable scope (leaf only / entire chain / exclude root), and flags chain breaks, untrusted anchors, and expiring intermediates.
Targetrequired Hostname, URL, or IP to inspect.PortTLS port. Default 443.ServerNameSNI hostname (defaults to Target).RevocationModeNoCheck, Online, or Offline. Default Online.RevocationFlagEndCertificateOnly, EntireChain, or ExcludeRoot. Default ExcludeRoot.WarnDaysDays-until-expiry threshold for WARN status. Default 30.TimeoutMsTCP connect timeout in ms. Default 10000.DnsTimeoutMsDNS resolution timeout in ms. Default 3000.AddressFamilyAuto (IPv4 first, fall back to IPv6), IPv4, or IPv6. Default Auto.OutputFormatObject, JSON, or CSV. Default Object.DryRunPreview action without executing.
Test-CertificateTransparencyQueries the public crt.sh JSON API for certificate-transparency log entries matching a domain or wildcard pattern, filters to a configurable lookback window, dedupes by serial, aggregates by issuer, diffs against a regex allow-list of trusted CAs to flag unexpected issuers, and warns on issuance-rate spikes.
Domainrequired Domain or wildcard pattern (e.g., 'example.com' or '%.example.com').LimitMaximum cert records to return. Default 200.WindowDaysLookback window in days. Default 30.AllowedIssuerRegex patterns matching trusted issuer CNs; anything else triggers FAIL.IncludeSubdomainsAdd wildcard prefix to query.SpikeThresholdIssuance count above which to WARN. Default 50.TimeoutSecRequest timeout in seconds. Default 30.OutputFormatObject, JSON, or CSV. Default Object.DryRunPreview action without executing.
Test-DatabaseConnectivityTests connection and query latency to SQL Server (native ADO.NET), PostgreSQL (Npgsql or TCP fallback), MySQL (MySql.Data or TCP fallback), and Redis (raw RESP protocol). Reports connect time, query latency, and engine version.
Enginerequired SqlServer, PostgreSQL, MySQL, or Redis.Serverrequired Database server hostname or IP.PortPort. Defaults: SqlServer=1433, PostgreSQL=5432, MySQL=3306, Redis=6379.DatabaseDatabase name (not applicable to Redis).UsernameAuthentication username. Omit for Windows auth on SqlServer.PasswordAuthentication password.QueryCustom diagnostic query. Defaults to engine-specific version query or PING.LatencyWarnMsQuery latency (ms) that flags WARN. Default 250.TimeoutSecConnect and query timeout in seconds. Default 10.DnsTimeoutMsDNS resolution timeout in ms (TCP-fallback paths). Default 3000.AddressFamilyAuto (IPv4 first, fall back to IPv6), IPv4, or IPv6. Default Auto.OutputFormatObject, JSON, or CSV. Default Object.DryRunPreview action without executing.
Test-DnsResolutionResolves hostnames against one or more DNS servers, captures latency and answers, and flags drift between resolvers.
Namerequired One or more hostnames to resolve.ServerDNS servers to query. Omit to use the system resolver.RecordTypeA, AAAA, CNAME, MX, TXT, NS, SOA, SRV, PTR, or ANY. Default A.LatencyWarnMsLatency threshold (ms) that triggers WARN. Default 200.OutputFormatObject, CSV, JSON, or Grid. Default Object.DryRunPreview action without executing.
Test-DnssecValidationValidates the DNSSEC chain-of-trust for a domain by walking parent labels, fetching DNSKEY, DS, and RRSIG records via a DNSSEC-aware resolver (e.g. 1.1.1.1), checking the resolver's Authenticated Data flag on the leaf answer, and flagging unsigned zones, broken delegations, missing signatures, and AD-flag failures.
Domainrequired Domain to validate (e.g., cloudflare.com).RecordTypeLeaf record type to fetch. Default A.DnsServerValidating DNS server. Default 1.1.1.1.OutputFormatObject, JSON, or CSV. Default Object.DryRunPreview action without executing.
Test-EgressPortMatrixValidates outbound firewall posture by running concurrent TCP-connect tests across a curated target set (or supplied list) against a configurable port matrix (22, 53, 80, 123, 443, 465, 587, 993, 995, 3389, 8080, 8443 by default), produces a target × port permitted/blocked grid, and FAILs the run when configured required ports are blocked anywhere.
TargetTargets to probe. Default curated public hosts.PortPorts to probe each target. Default common service ports.TimeoutMsPer-connection timeout in ms. Default 1500.DnsTimeoutMsDNS resolution timeout in ms. Default 3000.AddressFamilyAuto (IPv4 first, fall back to IPv6), IPv4, or IPv6. Default Auto.ConcurrentPeak concurrent workers. Default 32.RequiredPortsPorts that MUST be open everywhere (else FAIL). Default 443.OutputFormatObject, JSON, CSV, or Matrix. Default Object.DryRunPreview action without executing.
Test-EmailSecurityRecordsAudits a domain's email-spoofing posture by resolving SPF, DMARC, and DKIM (selector probe) DNS records, recursively expanding SPF includes with a depth cap, counting DNS lookups against the RFC 7208 limit of 10, scoring DMARC enforcement strength (p=reject vs quarantine vs none), and estimating DKIM RSA key size from the public-key blob.
Domainrequired Domain to audit (e.g., example.com).DkimSelectorDKIM selectors to probe. Defaults to common selector list.DnsServerSpecific DNS server to query (defaults to OS resolver).SpfMaxDepthMaximum SPF include depth. Default 10.OutputFormatSummary (readable lines, the default), or Object, JSON, CSV for other tools.DryRunPreview action without executing.
Test-GraphQlEndpointPOSTs GraphQL queries or mutations with variable substitution, optionally runs full schema introspection, detects errors in the GraphQL errors array, matches error messages against regex patterns, and asserts on dot-notation data properties.
Urlrequired GraphQL endpoint URL.QueryGraphQL query or mutation document string.VariablesVariable values serialised into the request variables field.OperationNameNamed operation to execute in multi-operation documents.IntrospectSchemaRun __schema introspection and return type system summary.HeadersAdditional request headers.AuthSchemeNone, Bearer, or Basic. Default None.BearerTokenToken for Bearer auth.BasicUsernameUsername for Basic auth.BasicPasswordPassword for Basic auth.ErrorPatternsRegex patterns to match against GraphQL error messages.AssertDataDot-notation assertions against the data object.LatencyWarnMsResponse time (ms) that triggers WARN. Default 1000.TimeoutSecRequest timeout in seconds. Default 30.SkipCertCheckSkip TLS certificate validation.OutputFormatObject, JSON, or Grid. Default Object.DryRunPreview action without executing.
Test-HttpEndpointProbes HTTP/HTTPS endpoints for status code, response time, final URI, and an optional response-body regex match.
Urlrequired One or more URLs to probe.MethodGET, HEAD, or POST. Default GET.ExpectedStatusExpected HTTP status code. Default 200.ExpectedContentRegexRegex the response body must match for OK status.LatencyWarnMsResponse time (ms) above which result is WARN. Default 1500.TimeoutSecRequest timeout in seconds. Default 15.SkipCertCheckSkip TLS validation (use only for testing).OutputFormatObject, CSV, JSON, or Grid. Default Object.DryRunPreview action without executing.
Test-HttpSecurityHeadersInspects HTTP response headers for security controls (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP), evaluates value quality for HSTS max-age and CSP permissiveness, penalizes information-disclosure headers (Server, X-Powered-By), and assigns a weighted A-F grade.
Urlrequired Target URL (HTTPS recommended).MethodHTTP method: GET or HEAD. Default GET.UserAgentUser-Agent header value.HeadersAdditional request headers.FollowRedirectsFollow up to 5 redirects (off by default).RequireHttpsForce FAIL if final URL is not HTTPS.TimeoutSecRequest timeout in seconds. Default 15.OutputFormatSummary (readable lines, the default), or Object, JSON, CSV for other tools.DryRunPreview action without executing.
Test-PortConnectivityTests TCP or UDP port reachability against a destination host with optional polling, latency capture, and CSV/JSON export.
Targetrequired Destination host (FQDN or IP).Portrequired One or more port numbers to probe.ProtocolTCP or UDP. Default TCP.TimeoutMsConnection timeout in milliseconds. Default 3000.DnsTimeoutMsDNS resolution timeout in ms (TCP only). Default 3000.AddressFamilyAuto (IPv4 first, fall back to IPv6), IPv4, or IPv6 (TCP only). Default Auto.PollCountNumber of polling attempts. 0 = single check.PollIntervalSecSeconds between polls. Default 5.OutputFormatObject, CSV, or JSON. Default Object.DryRunPreview action without executing.
Test-ProxyTraversalDetects HTTP proxy presence (system proxy via WebRequest.GetSystemWebProxy plus *_PROXY environment variables), measures direct vs proxied request latency to a control URL, captures proxy-injected response headers (Via, X-Forwarded-For), and detects TLS MITM substitution by comparing the served leaf certificate's SHA1 thumbprint against an expected fingerprint.
Urlrequired Control URL to probe (HTTPS recommended).ExpectedThumbprintExpected leaf cert SHA1 thumbprint for MITM detection.ProxyUrlExplicit proxy URL (overrides system proxy).ProxyCredentialProxy credential.IterationsIterations for latency averaging. Default 3.TimeoutSecRequest timeout in seconds. Default 15.LatencyOverheadWarnPctProxied-vs-direct overhead percent that triggers WARN. Default 100.DnsTimeoutMsDNS resolution timeout in ms (TLS thumbprint probe). Default 3000.AddressFamilyAuto (IPv4 first, fall back to IPv6), IPv4, or IPv6. Default Auto.OutputFormatObject, JSON, or CSV. Default Object.DryRunPreview action without executing.
Test-RestEndpointExecutes configurable HTTP methods (GET/POST/PUT/DELETE/PATCH) with Bearer, Basic, or OAuth2 client-credentials auth, JSON/XML body injection, dot-notation property assertions, lightweight JSON schema validation, and indicative per-phase latency breakdown (DNS/TCP/TLS/TTFB/Total).
Urlrequired Target REST URL.MethodGET, POST, PUT, DELETE, or PATCH. Default GET.HeadersAdditional request headers.ContentTypeRequest Content-Type. Default application/json.BodyRequest body string or path to a body file.AuthSchemeNone, Bearer, Basic, or OAuth2. Default None.BearerTokenToken for Bearer auth.BasicUsernameUsername for Basic auth.BasicPasswordPassword for Basic auth.OAuth2TokenUrlOAuth2 token endpoint for client_credentials flow.OAuth2ClientIdOAuth2 client ID.OAuth2ClientSecretOAuth2 client secret.OAuth2ScopeOAuth2 scope string.ExpectedStatusAcceptable HTTP status codes. Default 200.AssertPropertyDot-notation property assertions against the response JSON.SchemaFilePath to a lightweight JSON schema file (required + properties).LatencyWarnMsTotal response time (ms) that triggers WARN. Default 1000.TimeoutSecRequest timeout in seconds. Default 30.SkipCertCheckSkip TLS certificate validation.OutputFormatObject, JSON, or CSV. Default Object.DryRunPreview action without executing.
Test-SmtpConnectivityConnects to an SMTP server, reads the banner, issues EHLO, parses capabilities, optionally negotiates STARTTLS, and probes for open-relay acceptance.
Serverrequired SMTP server hostname or IP.PortSMTP port. Default 25.EhloNameHostname presented in EHLO. Default: local computer name.TestStartTlsAttempt STARTTLS upgrade after EHLO.TestRelaySend MAIL FROM / RCPT TO to probe for open-relay (own servers only).RelayFromSender address for relay probe. Default probe@example.com.RelayToRecipient address for relay probe. Default check@example.net.TimeoutMsConnection and read timeout in ms. Default 10000.DnsTimeoutMsDNS resolution timeout in ms. Default 3000.AddressFamilyAuto (IPv4 first, fall back to IPv6), IPv4, or IPv6. Default Auto.OutputFormatObject, JSON, or Grid. Default Object.DryRunPreview action without executing.
Test-TlsConfigurationProbes a TLS endpoint for supported protocol versions (SSLv3 through TLS 1.3) and negotiated cipher suites using SslStream, flags weak protocols and ciphers (RC4, 3DES, NULL, EXPORT, sub-128-bit), and assigns an A-F security grade.
Targetrequired Target hostname or IP.PortTLS port. Default 443.ProtocolsProtocols to probe: Ssl3, Tls, Tls11, Tls12, Tls13. Default all.TimeoutMsTCP connect timeout in ms. Default 10000.DnsTimeoutMsDNS resolution timeout in ms. Default 3000.AddressFamilyAuto (IPv4 first, fall back to IPv6), IPv4, or IPv6. Default Auto.ServerNameSNI hostname. Defaults to Target.OutputFormatSummary (readable lines, the default), or Object, JSON, CSV for other tools.DryRunPreview action without executing.
Test-TraceroutePathMulti-protocol (ICMP/TCP) traceroute with per-hop min/avg/max latency, blackhole detection, optional PTR resolution, and route-change comparison against a saved baseline.
Targetrequired Destination host (FQDN or IP).ProtocolICMP or TCP. Default ICMP.TcpPortTCP destination port for TCP-mode probes. Default 80.MaxHopsMaximum TTL / hop limit. Default 30.ProbesPerHopProbes per hop for latency statistics. Default 3.TimeoutMsPer-probe timeout in milliseconds. Default 3000.DnsTimeoutMsDNS resolution timeout in ms (target is resolved once up front). Default 3000.AddressFamilyAuto (IPv4 first, fall back to IPv6), IPv4, or IPv6. Default Auto.ResolveNamesPerform PTR (reverse DNS) lookups on each hop IP.BaselinePathJSON baseline file to compare hop IPs against for route-change detection.SaveBaselineWrite current route to the baseline file.OutputFormatObject, CSV, JSON, or Grid. Default Object.DryRunPreview action without executing.
Test-WebSocketConnectionOpens a WebSocket (ws/wss) session using .NET ClientWebSocket, measures handshake latency, negotiates subprotocols, exchanges configurable message count with RTT sampling, validates response frames against a regex, and retries with configurable reconnect logic.
Urirequired WebSocket endpoint URI (ws:// or wss://).SubProtocolSubprotocol(s) to negotiate during handshake.MessageText message to send each exchange. Default 'ping'.MessageCountNumber of send/receive cycles. Default 1.ExpectedResponseRegexRegex each response frame must match.KeepAliveIntervalSecTCP keep-alive interval in seconds. Default 0 (disabled).ReconnectAttemptsRetry count on failure. Default 0.ReconnectDelaySecSeconds between reconnect attempts. Default 2.HeadersAdditional HTTP headers for the upgrade request.AuthSchemeNone, Bearer, or Basic. Default None.BearerTokenToken for Bearer auth.BasicUsernameUsername for Basic auth.BasicPasswordPassword for Basic auth.HandshakeTimeoutMsWebSocket handshake timeout in ms. Default 10000.MessageTimeoutMsPer-message send/receive timeout in ms. Default 5000.SkipCertCheckSkip TLS certificate validation for wss://.OutputFormatObject, JSON, or CSV. Default Object.DryRunPreview action without executing.
Watch-PingLatencySends a configurable burst of ICMP echo requests per target and reports min/avg/max round-trip, jitter, and packet loss against thresholds.
Targetrequired One or more hostnames or IPs to ping.CountPings per target. Default 20.IntervalMsDelay between pings in ms. Default 500.LatencyWarnMsAverage-latency threshold that flags WARN. Default 100.LossWarnPercentPacket-loss percent that flags WARN. Default 5.TimeoutMsPer-ping timeout in ms. Default 1500.OutputFormatObject, CSV, JSON, or Grid. Default Object.DryRunPreview action without executing.
Active Directory 28
Add-ADPrivilegedGroupMemberreversibleAdds one or more users to privileged AD groups only (Domain Admins, Enterprise Admins, Administrators, Operators, adminCount=1). Marked privileged: never auto-granted to a role.
GroupNamesrequired One or more target groups (sAMAccountName, DN, or GUID).UserNamesrequired One or more users to add (sAMAccountName, UPN, DN, or GUID).ServerDomain controller to target. Default: any writable DC.DryRunPreview the memberships that would be added without changing anything.
Add-ADUserProxyAddressreversibleAdds email aliases to on-premises AD users' proxyAddresses, optionally promoting one to primary. Skips addresses already assigned anywhere in the directory, since proxy addresses must be unique.
UserNamesrequired One or more users (sAMAccountName, UPN, DN, or GUID).Addressesrequired Addresses to add. Bare addresses are treated as smtp:.MakePrimaryPromote the address to primary, demoting the current primary to an alias. One address only.SetMailAttributeAlso write the new primary address to the mail attribute. -MakePrimary only.ServerDomain controller to target. Default: any writable DC.DryRunPreview the resulting address list without changing anything.
Add-ADUserToGroupreversibleAdds one or more users to one or more on-premises Active Directory groups. Idempotent — skips memberships that already exist. Privileged groups (Domain Admins and similar) are refused; they use Add-ADPrivilegedGroupMember.
GroupNamesrequired One or more target groups (sAMAccountName, DN, or GUID).UserNamesrequired One or more users to add (sAMAccountName, UPN, DN, or GUID).ServerDomain controller to target. Default: any writable DC.DryRunPreview the memberships that would be added without changing anything.
Copy-ADGroupMembershipCopies one AD user's group memberships onto other users, in additive or mirror mode. Skips privileged and AdminSDHolder-protected groups unless explicitly included, and never touches the primary group.
SourceUserrequired User to copy memberships from (sAMAccountName, UPN, DN, or GUID).TargetUsersrequired One or more users to copy memberships to.ModeAdd (default) keeps the target's own groups; Mirror removes any the source does not have.ExcludeGroupsGroups to leave out of the copy (sAMAccountName, DN, or GUID).IncludePrivilegedGroupsInclude privileged groups, which are skipped by default.ForceRequired for Mirror, which removes memberships the target already has.ServerDomain controller to target. Default: any writable DC.DryRunPreview the memberships that would be added or removed without changing anything.
Disable-ADUserAccountreversibleDisables on-premises AD user accounts, stamps the reason and date into the description, and optionally moves them to a holding OU or hides them from the GAL. Refuses built-in and critical system accounts unless forced.
UserNamesrequired One or more users (sAMAccountName, UPN, DN, or GUID).ReasonWhy the account is being disabled. Recorded in the description attribute.MoveToOUOU to move the disabled account into, e.g. 'OU=Disabled Users,DC=contoso,DC=com'.HideFromGALHide the user from Exchange address lists (needs an Exchange-extended schema).ForceAllow built-in and critical system accounts to be disabled.ServerDomain controller to target. Default: any writable DC.DryRunPreview the accounts that would be disabled without changing anything.
Enable-ADUserAccountreversibleEnables on-premises AD user accounts and strips the '[Disabled <date>]' stamp from the description. Reverse of Disable-ADUserAccount; can also unlock, clear an account expiry, and move the object back.
UserNamesrequired One or more users (sAMAccountName, UPN, DN, or GUID).UnlockAlso unlock the account if it is locked out.ClearExpirationClear the account expiry date, which otherwise still blocks sign-in.MoveToOUOU to move the account back into, e.g. 'OU=Staff,DC=contoso,DC=com'.UnhideFromGALUnhide the user from the Exchange address lists.KeepDescriptionLeave the description as it is instead of stripping the disabled stamp.ServerDomain controller to target. Default: any writable DC.DryRunPreview the accounts that would be enabled without changing anything.
Get-ADGroupMembershipLists the members of one or more on-premises Active Directory groups, flagging disabled accounts, last logon, nested groups, and primary-group members.
GroupNamesrequired One or more groups (sAMAccountName, DN, or GUID).RecursiveExpand nested groups and report every effective member.ServerDomain controller to query. Default: any DC.OutputFormatTable, CSV, or JSON. Default: Table.CsvPathFile path for CSV output. Default: ADGroupMembership.csv.
Get-ADPrivilegedAccountReportExpands every privileged AD group through nesting and reports each member with its weaknesses - password never expires, kerberoastable SPN, unconstrained delegation, stale or disabled - plus accounts carrying adminCount drift after privilege was removed. Read-only.
AdditionalGroupsExtra groups to treat as privileged, on top of the built-in list.StaleDaysDays without a logon before a privileged account is flagged stale. Default: 90.SkipAdminCountDriftLeave out the adminCount drift section.OutputFormatTable, CSV, or JSON. Default: Table.CsvPathFile path for CSV output. Default: PrivilegedAccounts.csv.ServerDomain controller to target. Default: any DC.
Get-ADStaleAccountsReports AD users and computers with no recent logon, using both lastLogonTimestamp and password age so decommissioned machines and never-used accounts are caught. Read-only; feeds the disable and cleanup scripts.
DaysInactiveDays since the last logon before an account counts as stale. Default: 90.ScopeUsers, Computers, or Both. Default: Both.SearchBaseLimit the search to one OU. Default: the whole domain.IncludeDisabledAlso report accounts that are already disabled.ExcludeNeverLoggedOnLeave out accounts that have never signed in.OutputFormatTable, CSV, or JSON. Default: Table.CsvPathFile path for CSV output. Default: StaleAccounts.csv.ServerDomain controller to target. Default: any DC.
Install-RSATFeaturesInstalls Remote Server Administration Tools (RSAT) on the runner host so AD/DNS/GroupPolicy PowerShell modules become available to other catalog scripts. Detects Windows client vs Server and uses Add-WindowsCapability or Install-WindowsFeature accordingly. Idempotent; requires elevation.
ProfileAD (default), DNS, GroupPolicy, DHCP, ServerManager, All, or Custom.NamesWhen Profile=Custom, explicit capability/feature names (e.g. 'Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0' on client, 'RSAT-AD-PowerShell' on server).DryRunPreview without installing.
Move-ADUserToOUreversibleMoves on-premises AD users into another OU, printing each source OU first and restoring accidental-deletion protection afterwards. Reversible: the first user's original OU is captured before the move.
UserNamesrequired One or more users (sAMAccountName, UPN, DN, or GUID).TargetOUrequired Target OU, e.g. 'OU=Leavers,DC=contoso,DC=com'.ForceClear protection from accidental deletion to make the move, then restore it afterwards.ServerDomain controller to target. Default: any writable DC.DryRunPreview the moves without changing anything.
New-ADComputerAccountPrestages AD computer accounts in the right OU, singly or by CSV, and can delegate the domain join to a named user or group by granting only the four rights a join needs on that object.
ComputerNamesOne or more computer names to prestage. Required unless -CsvPath is used.OUPathOU to create the accounts in. Default: the domain's Computers container.DescriptionDescription recorded on each computer object.LocationLocation recorded on each computer object.ManagedByOwner written to managedBy (user or group).JoinPrincipalUser or group allowed to join the machine to the domain, granted on this object only.CsvPathCSV of computers to prestage. Headers: Name, OUPath, Description, Location, ManagedBy, JoinPrincipal.ServerDomain controller to target. Default: any writable DC.DryRunPreview the accounts that would be prestaged without changing anything.
New-ADGroupsreversibleCreates on-premises AD groups singly or in bulk from a CSV, setting scope, category, description, managedBy owner and initial members in one pass. Skips groups that already exist.
GroupNamesOne or more group names to create. Required unless -CsvPath is used.OUPathOU to create the groups in. Default: the domain's Users container.ScopeGlobal, DomainLocal or Universal. Default: Global.CategorySecurity or Distribution. Default: Security.DescriptionDescription recorded on each group.ManagedByOwner written to managedBy (user or group).InitialMembersMembers to add to every group created (users or groups).CsvPathCSV of groups to create. Headers: Name, OUPath, Scope, Category, Description, ManagedBy, Members (';'-separated).ServerDomain controller to target. Default: any writable DC.DryRunPreview the groups that would be created without changing anything.
New-ADOrganizationalUnitsCreates on-premises AD organizational units from top-down paths like 'Lakefront/Flats Operations', adding any missing parents. Skips OUs that already exist.
OUPathsOne or more OU paths, top-down and '/'-separated. Required unless -CsvPath is used.ParentPathDistinguished name the paths are relative to. Default: the domain root.DescriptionDescription recorded on each OU created.CsvPathCSV of OUs to create. Headers: Path, Description.UnprotectedCreate the OUs without protection from accidental deletion.ServerDomain controller to target. Default: any writable DC.DryRunPreview the OUs that would be created without changing anything.
New-ADUserAccountreversibleCreates on-premises AD user accounts singly, from a template user, or in bulk from a CSV. Generates a compliant password per account, copies the template's groups and attributes, and skips accounts that already exist.
SamAccountNamesAMAccountName for the new account. Required unless -CsvPath is used.GivenNameFirst name.SurnameLast name.DisplayNameDisplay name. Default: 'GivenName Surname'.UserPrincipalNameUPN. Default: SamAccountName@<domain DNS root>.EmailAddressEmail address (mail attribute).TitleJob title.DepartmentDepartment.CompanyCompany.ManagerManager (sAMAccountName, UPN, DN, or GUID).OUPathOU to create the account in. Default: the template user's OU, else the domain's Users container.PasswordInitial password. Leave empty to generate one per account: the log shows [REDACTED] and you get one Copy button.CopyFromUserExisting user to copy OU, department, company, title, manager and group memberships from.AddToGroupsGroups to add the new account to, on top of any inherited from the template.CsvPathCSV of accounts to create. Headers match the parameter names; AddToGroups is ';'-separated.NoPasswordChangeAtLogonDo not require a password change at next logon.StartDisabledCreate the account disabled - useful for starters who begin later.ServerDomain controller to target. Default: any writable DC.DryRunPreview the accounts that would be created without changing anything.
Remove-ADGroupsDeletes on-premises AD groups after printing a full record of each one, refusing built-in and critical groups outright and non-empty, AdminSDHolder-protected or primary-group-referenced groups unless forced.
GroupNamesrequired One or more groups (sAMAccountName, DN, or GUID).ForceDelete groups that still have members, and clear protection from accidental deletion.ServerDomain controller to target. Default: any writable DC.DryRunReport what would be deleted, with full membership, without changing anything.
Remove-ADPrivilegedGroupMemberreversibleRemoves one or more users from privileged AD groups only (Domain Admins, Enterprise Admins, Administrators, Operators, adminCount=1). Marked privileged: never auto-granted to a role.
GroupNamesrequired One or more target groups (sAMAccountName, DN, or GUID).UserNamesrequired One or more users to remove (sAMAccountName, UPN, DN, or GUID).ServerDomain controller to target. Default: any writable DC.DryRunPreview the memberships that would be removed without changing anything.
Remove-ADUserFromGroupreversibleRemoves one or more users from one or more on-premises Active Directory groups. Reverse of Add-ADUserToGroup; never removes a user's primary group. Privileged groups (Domain Admins and similar) are refused; they use Remove-ADPrivilegedGroupMember.
GroupNamesrequired One or more target groups (sAMAccountName, DN, or GUID).UserNamesrequired One or more users to remove (sAMAccountName, UPN, DN, or GUID).ServerDomain controller to target. Default: any writable DC.DryRunPreview the memberships that would be removed without changing anything.
Remove-ADUserProxyAddressreversibleRemoves email aliases from on-premises AD users' proxyAddresses. Reverse of Add-ADUserProxyAddress; refuses to drop the primary SMTP address unless forced.
UserNamesrequired One or more users (sAMAccountName, UPN, DN, or GUID).Addressesrequired Addresses to remove. Bare addresses are treated as smtp:.ForceAllow removal of the primary SMTP address, leaving no reply address.ServerDomain controller to target. Default: any writable DC.DryRunPreview the resulting address list without changing anything.
Reset-ADComputerAccountDiagnoses broken computer trust relationships from the directory's own evidence (enabled state, machine password age, last logon) and repairs them - re-enabling the account, running Test-ComputerSecureChannel -Repair over WinRM, or resetting the account password for a rejoin.
ComputerNamesrequired One or more computers (name, DN, or GUID).EnableRe-enable the computer account if it is disabled.RepairRemotelyRun Test-ComputerSecureChannel -Repair on the machine over WinRM. Needs the machine online.ResetPasswordReset the account password in the directory. Breaks the trust until the machine rejoins.ServerDomain controller to target. Default: any writable DC.DryRunReport the diagnosis and the actions that would be taken, without changing anything.
Reset-ADUserPasswordResets on-premises AD passwords against the PDC emulator, generating a compliant password per account when none is supplied. Optionally unlocks, clears an account expiry, and forces a change at next sign-in. Refuses krbtgt.
UserNamesrequired One or more users (sAMAccountName, UPN, DN, or GUID).PasswordNew password. Leave empty to generate one per account: the log shows [REDACTED] and you get one Copy button.GeneratedLengthLength of generated passwords. Default: 16.NoChangeAtNextLogonDo not force a password change at next sign-in - use for service accounts.UnlockAlso unlock the account if it is locked out.ClearExpirationAlso clear an account expiry date that would still refuse sign-in.ServerDomain controller to target. Default: the PDC emulator, which owns password changes.DryRunPreview the accounts that would be reset without changing anything.
Set-ADUserAttributesUpdates directory attributes (title, department, manager, office, phones, employee id and more) on AD users from parameters or a CSV. Writes only what differs and prints every change as old -> new, so it is safe to schedule against an HR feed.
UserNamesOne or more users (sAMAccountName, UPN, DN, or GUID). Required unless -CsvPath is used.CsvPathCSV of users and attributes. Headers match the parameter names; SamAccountName or UserPrincipalName identifies the row.TitleJob title.DepartmentDepartment.CompanyCompany.OfficeOffice (physicalDeliveryOfficeName).ManagerManager (sAMAccountName, UPN, DN, or GUID).OfficePhoneOffice phone (telephoneNumber).MobilePhoneMobile phone.EmailAddressEmail address (mail attribute).DescriptionDescription.EmployeeIDEmployee id.StreetAddressStreet address.CityCity.StateState or province.PostalCodePostal code.ClearAttributesAttributes to empty, by LDAP name, e.g. 'manager','telephoneNumber'.ExtraAttributesExtra attributes as 'lDAPDisplayName=value' pairs separated by ';'.ServerDomain controller to target. Default: any writable DC.DryRunPreview every change as old -> new without writing anything.
Set-ADUserManagerSets or clears the manager attribute on AD users from parameters or a CSV, walking the proposed chain first and refusing any change that would create a reporting loop. Skips users who already have the requested manager.
UserNamesOne or more users (sAMAccountName, UPN, DN, or GUID). Required unless -CsvPath is used.ManagerManager to set (sAMAccountName, UPN, DN, or GUID).ClearManagerEmpty the manager attribute instead of setting it.CsvPathCSV with SamAccountName (or UserPrincipalName) and Manager columns.ServerDomain controller to target. Default: any writable DC.DryRunPreview the manager changes without writing anything.
Sync-ADGroupFromCsvMakes an AD group's membership match a supplied CSV or list, reporting the add/remove/keep difference first. Removals are opt-in and guarded against bad input by a maximum-removal percentage and an empty-list refusal.
GroupNamerequired Group to synchronise (sAMAccountName, DN, or GUID).CsvPathCSV holding the desired membership. Columns: Member, SamAccountName, UserPrincipalName or User.MembersDesired members given directly instead of by CSV.RemoveExtraRemove members that are not in the desired list. Off by default - extras are reported only.MaxRemovalPercentRefuse the run if removals would exceed this share of the current membership. Default: 50.AllowEmptyAllow an empty desired list, which empties the group.ServerDomain controller to target. Default: any writable DC.DryRunReport the difference without changing anything.
Test-ADReplicationHealthValidates Active Directory replication by querying Get-ADReplicationPartnerMetadata and Get-ADReplicationFailure if the ActiveDirectory module is available, otherwise parsing 'repadmin /showrepl /csv' output; reports per-partner last-success time, replication latency, consecutive failure counts, and applies WARN/FAIL thresholds against latency.
ServerTarget DC FQDN. Default current host.AllDomainControllersIterate every DC in the domain (requires AD module).LatencyWarnMinutesLatency WARN threshold in minutes. Default 30.LatencyFailMinutesLatency FAIL threshold in minutes. Default 180.OutputFormatObject, JSON, or CSV. Default Object.DryRunPreview action without executing.
Test-ADTargetConnectivityTroubleshoots an Active Directory target as the app sees it: RSAT module, the target's server and service account, DNS, ports 88/389/636/3268/9389, an LDAP bind that separates a bad password from a blocked AD Web Services port, and an AD-module read. Ends with plain-English findings. Read-only.
ServerDomain controller or domain to test. Default: the AD target's server.
Test-LdapPerformanceMeasures LDAP/LDAPS bind and search latency against directory servers using System.DirectoryServices.Protocols, supports Anonymous/Negotiate/Kerberos/Ntlm/Basic/External auth, configurable filter/attributes/scope, paged search, multi-iteration timing with min/avg/max and configurable percentiles (P50/P95/P99), and applies WARN/FAIL gating against search latency.
Serverrequired Directory server hostname(s).PortPort. Default 389 (or 636 with -UseSsl).UseSslUse LDAPS (TLS).AuthTypeAnonymous, Basic, Negotiate, Kerberos, Ntlm, External. Default Negotiate.CredentialBind credential.SearchBaseSearch base DN (auto-discovered from RootDSE if omitted).FilterLDAP filter. Default '(objectClass=user)'.AttributesAttributes to retrieve. Default cn, sAMAccountName.ScopeBase, OneLevel, or Subtree. Default Subtree.IterationsBind+search iterations per server. Default 5.PageSizePage size for paged search. 0 = no paging. Default 0.PercentilesPercentiles to compute. Default 50,95,99.SearchWarnMsAverage-search WARN threshold (ms). Default 500.SearchFailMsAverage-search FAIL threshold (ms). Default 2000.TimeoutSecConnection timeout in seconds. Default 15.SkipCertCheckSkip TLS cert validation (LDAPS).OutputFormatObject, JSON, or CSV. Default Object.DryRunPreview action without executing.
Unlock-ADUserAccountUnlocks locked-out AD accounts by name or across the whole domain, reading authoritative lockout state from the PDC emulator. Can report per-DC bad-password activity to find where a recurring lockout comes from.
UserNamesOne or more users (sAMAccountName, UPN, DN, or GUID). Omit when using -AllLockedOut or -ListOnly.AllLockedOutUnlock every locked-out account in the domain.ListOnlyReport locked-out accounts without unlocking anything.CheckAllDomainControllersQuery every DC for bad-password activity to find where the lockout is coming from.ServerDomain controller to target. Default: the PDC emulator, which holds the authoritative lockout state.DryRunPreview the accounts that would be unlocked without changing anything.
Business systems · 15
ERP & BI 15
Demo-Reconcile-WithSampleDataRunnable end-to-end demo of cross-ERP GL reconciliation using inline sample data. No targets, no credentials, no network — call this to see exactly what the reconciliation output looks like during a live cutover. Useful for sales demos, onboarding, and smoke tests.
ReconcileScriptPath to Reconcile-GLBalance-Legacy-vs-S4.ps1. Default: sibling file in this catalog.
Demo-VendorDrift-WithSampleDataRunnable end-to-end demo of cross-ERP vendor master drift detection. Synthesizes vendors across PeopleSoft, Epicor Kinetic, and S/4HANA with realistic drift (different payment terms, different postal codes, missing-from-one-ERP). No live connections needed.
DriftScriptPath to Detect-Drift-VendorMaster.ps1. Default: sibling file in this catalog.
Detect-Drift-VendorMasterDetects vendor master drift across PeopleSoft, Epicor Kinetic, and SAP S/4HANA. Clusters vendors by normalized name+tax+postal hash, then flags clusters where payment terms, tax IDs, postal codes, or names disagree across ERPs.
PeopleSoftVendorsrequired Vendor rows from PeopleSoft.KineticVendorsVendor rows from Epicor Kinetic.S4SuppliersSupplier rows from S/4HANA (output of ERP-SAP-S4HANA/Get-VendorMaster).MinErpAppearancesMinimum number of ERPs a cluster must appear in to be reported. Default 2.
Detect-SoD-Conflicts-S4Detects SAP S/4HANA users that hold conflicting PFCG role pairs (segregation-of-duties). Pulls active user-role assignments via OData and joins against a supplied CSV of conflict pairs. Outputs one row per user x triggered pair as SOX evidence (ITGC-AC-01).
ODataBaseUrlrequired S/4HANA OData base URL.BearerTokenrequired OAuth bearer token (service user).ConflictsCsvrequired Path to SoD conflict pair CSV. Headers: RoleA,RoleB,ControlId,ControlDescription.SapClientSAP client number. Default 100.PageSizePage size for paginated reads. Default 5000.
Get-GLBalancePulls a PeopleSoft GL trial balance for a given business unit, fiscal year, and accounting period via direct Oracle ODBC. Returns one row per (account, department, product) with debit, credit, and net amounts.
OdbcConnectionStringrequired Oracle ODBC connection string bound to the PeopleSoft target.BusinessUnitrequired PeopleSoft Business Unit code.FiscalYearrequired Fiscal year, four-digit.AccountingPeriodrequired Accounting period (1-12, plus 0 for BBF, 998/999 for adjustments).LedgerLedger name. Default ACTUALS.RowLimitMax rows returned (0 = no limit).
Get-GLBalancePulls a SAP S/4HANA GL trial balance for a company code, fiscal year, and period via OData on I_GLAccountLineItem. Aggregates to one row per (GLAccount, Currency).
ODataBaseUrlrequired S/4HANA OData base URL.BearerTokenrequired OAuth bearer token.CompanyCoderequired SAP company code (BUKRS).FiscalYearrequired Fiscal year, four-digit.FiscalPeriodrequired Fiscal period, 1-12 (or 13-16 for special periods).LedgerLedger code. Default 0L (leading ledger).SapClientSAP client number. Default 100.PageSizePage size. Default 5000.
Get-VendorMasterPulls the SAP S/4HANA supplier master (I_Supplier CDS view via OData) for a client, with optional country and changed-since filters. Paginates 5,000 rows per page.
ODataBaseUrlrequired S/4HANA OData base URL.BearerTokenrequired OAuth bearer token.SapClientSAP client number. Default 100.CountryISO country filter. Empty = all.ChangedSinceOnly pull suppliers changed on or after yyyy-MM-dd. Empty = no filter.PageSizeRows per page. Default 5000.
Get-WorkOrders-OpenPulls open (released, not closed) production work orders from Epicor Kinetic for one plant or all plants. Returns one row per job with part, quantities, and due dates. Building block for KPI rollup and cutover reconciliation.
RestBaseUrlrequired Kinetic REST base URL.CompanyIdrequired Kinetic company ID.BearerTokenrequired OAuth bearer token.PlantPlant filter. Empty = all plants for the company.PageSizePage size for paginated reads. Default 1000.
Reconcile-GLBalance-Legacy-vs-S4Reconciles a legacy-ERP GL trial balance (from PeopleSoft or Kinetic) against an S/4HANA trial balance for the same period. Joins on a supplied account map and flags variances per absolute and percent tolerances. Used for S/4HANA cutover sign-off and parallel-run reconciliation.
LegacyRowsrequired Legacy trial-balance rows (output of PeopleSoft Get-GLBalance or Kinetic BAQ runner).S4Rowsrequired S/4HANA trial-balance rows (output of ERP-SAP-S4HANA/Get-GLBalance).AccountMaprequired Hashtable (legacy->s4) or path to CSV with headers Legacy,S4.TolerancePerAccountAbsolute tolerance per account in currency units. Default 1.00.TolerancePercentPercent tolerance per account (0.001 = 0.1%). Default 0.001.MaxFailRowsFailure threshold. Default 0 — any FAIL row fails the reconciliation.
Refresh-PowerBI-DatasetTriggers a Power BI dataset refresh and polls the refresh history until Completed, Failed, or Disabled. Returns final status, duration, and error if any. Used to chain BI refreshes into ERP-extract orchestrations.
WorkspaceIdrequired Power BI workspace (group) ID.DatasetIdrequired Power BI dataset ID.BearerTokenrequired Bearer token for the Power BI REST API.NotifyOptionNotify owners on failure. Default true.TimeoutSecMax wait time in seconds. Default 1800.PollIntervalSecPoll interval in seconds. Default 15.
Run-BAQGeneric runner for any Epicor Kinetic Business Activity Query (BAQ). Executes a named BAQ via the BAQSvc REST endpoint and returns rows as PowerShell objects.
RestBaseUrlrequired Kinetic REST base URL.CompanyIdrequired Kinetic company ID.BaqIdrequired BAQ ID (case-sensitive).BearerTokenOAuth bearer token.ApiKeyLegacy API key.BaqParametersBAQ parameter name=value pairs.PageSizeMax rows returned. Default 5000.
Run-PSQueryRuns a named PeopleSoft Query through Query Access Service (QAS) and returns the row set as PowerShell objects. Generic runner reusable across any defined PS Query.
QasEndpointrequired QAS SOAP endpoint URL.QueryNamerequired Defined PS Query name (case-sensitive).Credentialrequired Credential bound to the PeopleSoft target.BindVariablesBind variable name=value pairs for the query.MaxRowsMax rows returned. Default 5000.
Test-ConnectionHealth probe for an Epicor Kinetic REST endpoint. Confirms reachability, auth, and a sub-second round-trip on the Companies service for the bound company.
RestBaseUrlrequired Kinetic REST base URL.CompanyIdrequired Kinetic company ID.BearerTokenOAuth bearer token (preferred).ApiKeyLegacy API key.TimeoutSecRequest timeout in seconds. Default 15.
Test-ConnectionHealth probe for an SAP S/4HANA OData Gateway. Confirms reachability, auth, and that the service user has read access to a baseline CDS view.
ODataBaseUrlrequired S/4HANA OData base URL.BearerTokenOAuth bearer token (preferred).CredentialHTTP basic credential.SapClientSAP client number (mandt). Default 100.ProbeServiceOData service path used for the probe.TimeoutSecRequest timeout in seconds. Default 20.
Test-ConnectionHealth probe for a PeopleSoft Integration Broker REST endpoint. Confirms reachability, auth, and a sub-second round-trip on a known service operation.
IbBaseUrlrequired PeopleSoft Integration Broker REST base URL.ProbeOperationService operation path used as the probe. Default PT_PING.v1/ping.Credentialrequired Credential bound to the PeopleSoft target.TimeoutSecRequest timeout in seconds. Default 15.
No script matches. Need one we don't have? Tell us, or bring your own: any PowerShell script becomes a form.