Modern IT Automation with PowerShell

Foreword

Contributors

1. Alain Tanguy
2. Allen Chin
3. Amy Zanatta
4. Bill Kindle
5. C.J. Zuk
6. Chad Miars
7. Christian Coventry
8. Felipe Binotto
9. Greg Onstot
10. James Petty
11. Joe Houghes
12. John Hermes
13. Jordan Borean
14. Kevin Laux
15. Kieran Jacobsen
16. Kirill Nikolaev
17. Martha Clancy
18. Matt Corr
19. Michael B. Smith
20. Michael Lotter
21. Michael Zanatta
22. Nicholas Bissell
23. Rob Derickson
24. Steven Judd
25. Wes Stahler

Acknowledgements

Disclaimer

Introduction

1. About OnRamp
2. Prerequisites
3. A Note on Code Listings
4. Feedback
5. ICollaboration

1.Introduction to Git

1. 1.1Understanding Terminology
2. 1.2Creating a Local Repository
3. 1.3Cloning an Existing Repository
4. 1.4Understanding the Flow of Working in Git
5. 1.5Your First Commit
6. 1.6Creating a Branch
7. 1.7Merging Branches
8. 1.7.1Merge Commits
9. 1.7.2Merge Conflicts
10. 1.8Stashing Changes
11. 1.9Rolling Back When Things Go Wrong
12. 1.9.1Hard Reset in Action
13. 1.10Connecting to a Remote Repository
14. 1.11Starting Over When Things Really Go Wrong
15. 1.11.1Starting From Scratch
16. 1.12Conclusion
17. 1.13Modern IT Automation With PowerShell Extras
18. 1.14Further Reading

2.Code Reviews

1. 2.1Purpose of Code Reviews
2. 2.2How to Start with Code Reviews
3. 2.2.1Define Code Conventions for Your Team or Project
4. 2.2.2Define the Code Review Process for Your Team or Project
5. 2.3Things to Consider When Performing a Code Review
6. 2.4Code Review Best Practices
7. 2.4.1Keep Your Changes Small
8. 2.4.2Provide Constructive Feedback
9. 2.4.3Balance Nit-Picks with Major Comments
10. 2.4.4Create Pull Request Templates
11. 2.4.5When to Approve
12. 2.4.6Talk to Each Other
13. 2.4.7Use Automation
14. 2.5Tools to Help with Code Reviews
15. 2.5.1PSScriptAnalyzer
16. 2.5.2PowerShell Extension for Visual Studio Code
17. 2.6Further Reading
18. IIPowerShell Testing

3.The AAA Approach

1. 3.1Arrange, Act, and Assert
2. 3.1.1Arrange
3. 3.1.2Act
4. 3.1.3Assert
5. 3.1.4Benefits of the AAA Approach
6. 3.2Pester 5.0
7. 3.2.1Pester Installation
8. 3.3The Star Wars API Example
9. 3.3.1So How Does It Work?
10. 3.3.2Example Code
11. 3.3.3Example Code Output
12. 3.4Pester Tests
13. 3.4.1Simple Tests
14. 3.4.2Pester Verbosity
15. 3.4.3Simple Test Output
16. 3.4.4Mocked Tests
17. 3.4.5Mocked Test Output
18. 3.4.6Complex Tests
19. 3.4.7Complex Test Output
20. 3.5Conclusion
21. 3.6Further Reading

4.Mocking

1. 4.1Mocking and Mock Testing
2. 4.1.1Stubs, Fakes, and Mocks
3. 4.2Mocking in Pester with Mock
4. 4.3Mock Testing and Verifiable Mocks
5. 4.3.1Should -Invoke
6. 4.3.2Should -InvokeVerifiable
7. 4.3.3Running the Mock Assertion Tests
8. Assert-MockCalled and Assert-VerifiableMock
9. 4.4Mock Scoping
10. PesterBoundParameters
11. 4.5Mocking in the Module Scope with -ModuleName
12. 4.5.1Mock Testing in the Module Scope
13. 4.5.2Running the Module Scope Tests
14. 4.6Dynamic Mock Behavior with -ParameterFilter
15. 4.6.1Filtered Mock Assertions
16. 4.6.2Running the Filtered Mock Tests
17. 4.6.3Restricting Mock Calls Further with -ExclusiveFilter
18. 4.7Calling Real Dependencies While They’re Mocked
19. 4.8Removing Parameter Typecasting and Validation
20. 4.9Mocking Native Applications
21. 4.10Mocking .NET Objects with New-MockObject
22. 4.11Next Steps
23. 4.12Further Reading

5.Unit Testing

1. 5.1Why Unit Testing?
2. 5.2What Is Unit Testing?
3. 5.3Testing Frameworks
4. 5.3.1Black Box vs. White Box Testing
5. 5.3.2The AAA Approach
6. 5.4Pester
7. 5.4.1Getting Started
8. 5.4.2Defining Pester Test Files
9. 5.4.3Pester Demo Code
10. 5.4.4Pester Test Structure
11. 5.4.5Mocking
12. 5.4.6Running Pester Tests
13. 5.4.7Pester Configuration
14. 5.4.8Pester Automation
15. 5.5Conclusion
16. 5.6Further Reading

6.Parameterized Testing

1. 6.1Pester Versions and Parameterized Tests
2. 6.2Your First Test
3. 6.2.1-ForEach
4. 6.2.2Templates ‘<>’
5. 6.2.3BeforeDiscovery
6. 6.2.4Param
7. 6.2.5Pester Container
8. 6.2.6PesterConfiguration
9. 6.3Pester v4
10. 6.4Outputs
11. 6.5One Last Example
12. 6.6Conclusions
13. 6.7Further Reading
14. IIIPowerShell in Depth

7.Refactoring PowerShell

1. 7.1Expanding on the Pipeline
2. 7.2Expanded Splatting
3. 7.3Interpolation
4. 7.3.1Variable Substitution
5. 7.3.2Using the Format (-f) Operator
6. 7.4Refactoring Functions
7. 7.4.1Simplify Functions to Perform a Singular Task
8. 7.4.2Use Typecasting on Parameters
9. 7.4.3Use Advanced Function Parameters
10. 7.4.4Use Approved Verbs
11. 7.4.5Use a Singular Output Object Type
12. 7.5Writing Better Code
13. 7.5.1Simplify Nested Statements
14. 7.5.2Grouping Similar Code
15. 7.5.3Refactoring Comments and Documentation
16. 7.5.4Using Code Regions
17. 7.5.5Refactoring Logic Flow to be Implicitly $True or $False
18. 7.6Data Management
19. 7.6.1JSON
20. 7.6.2YAML
21. 7.6.3XML
22. 7.6.4CSV
23. 7.6.5CLIXML
24. 7.6.6Best Practices for Data Management
25. 7.7Further Reading

8.Advanced Conditions

1. 8.1Case Sensitive Operators
2. 8.2Using the Switch Statement
3. 8.2.1Using -Regex
4. 8.2.2Using -Wildcard
5. 8.2.3Using -Exact
6. 8.2.4Using -CaseSensitive
7. 8.2.5Using PowerShell Expressions for Matching
8. 8.2.6Default
9. 8.2.7Parsing Lists and Arrays
10. 8.3Type Comparison and Conversion Operators: -is, -isnot and -as
11. 8.3.1Using -is and -isnot
12. 8.4Using -as to Typecast Safely
13. 8.5Bitwise Operators (-band, -bor, -bxor, -bnot, -shl and -shr)
14. 8.5.1What is an Enum?
15. Enum Reference
16. 8.5.2Base-2 vs. Base-10 (Binary vs. Decimal)
17. 8.5.3The AND Logic Gate
18. 8.5.4The OR Logic Gate
19. 8.5.5The NOT Logic Gate
20. 8.5.6The XOR Logic Gate
21. 8.5.7-band Bitwise AND
22. 8.5.8-bor Bitwise OR
23. 8.5.9-bxor Bitwise XOR
24. 8.5.10-bnot Bitwise NOT
25. 8.5.11-shl Shift Bits Left
26. 8.5.12-shr Shift Bits Right
27. 8.5.13Practical Applications
28. 8.6-like and -notlike
29. 8.7-match and -notmatch
30. 8.8-in, -contains, -notin and -notcontains
31. 8.9-replace
32. 8.10Ternary Operator (condition) ? <true> : <false>
33. 8.11Null-Coalescing Operator ??
34. 8.12Null-Coalescing Assignment Operator ??=
35. 8.13Null-Conditional Operator ?. and ?[]
36. 8.13.1Examples of ?.
37. 8.13.2Examples of ?[]
38. 8.14:parent Loop Labels
39. 8.15PowerShell Operator Precedence
40. 8.15.1Example - Operator Precedence (,, [])
41. 8.15.2Example - Parentheses ()
42. 8.15.3Example - Negation Operator -not
43. 8.15.4Example - Equal Precedence
44. 8.15.5Example - A Complex Expression
45. 8.16Further Reading

9.Logging

1. 9.1Why Log?
2. 9.2What Makes for Good Logging
3. 9.3What Should Never Be Logged
4. 9.4Logging Basics
5. 9.5Enable System-Level Logging
6. 9.5.1Windows
7. 9.5.2Event Log Locations
8. 9.6Linux, macOS, WSL
9. 9.7Logging for Troubleshooting
10. 9.7.1Writing Console Output
11. 9.8Persistent Logging Options
12. 9.8.1PowerShell Transcription
13. 9.8.2Logging to Files
14. 9.8.3Using Tee-Object
15. 9.9History
16. 9.9.1Built-in History
17. 9.9.2PSReadline History
18. 9.9.3Writing to Windows Event Logs
19. 9.9.4Cloud Shell
20. 9.9.5Using Third Party modules for logging
21. 9.10Summary
22. 9.11Further Reading

10.Infrastructure as Code (IaC)

1. 10.1Overview
2. 10.2IaC Key Concepts
3. 10.3IaC Benefits
4. 10.4IaC Principles
5. 10.4.1Source Control as the Single Source of Truth
6. 10.4.2Modular
7. 10.4.3Versioning
8. 10.4.4Repeatable
9. 10.4.5Disposable
10. 10.4.6Self-Documented
11. 10.4.7Testing and Monitoring
12. 10.5IaC in Action
13. 10.5.1Azure-SQL-Server.psm1
14. 10.5.2Azure-Storage-Account.psm1
15. 10.5.3Azure-Load-Balancer.psm1
16. 10.5.4Azure-Virtual-Machine.psm1
17. 10.6Configuration as Code (CaC)
18. 10.6.1PowerShell Desired State Configuration (DSC)
19. 10.6.2CaC in Action
20. 10.7IaC and CaC: Better Together
21. 10.8Conclusion
22. 10.9Further Reading
23. IVUsing Regexes

11.Regex 101

1. Did you know?
2. 11.1First Principles and Limitations
3. 11.1.1Wildcard Patterns vs. Regexes
4. 11.1.2Differences Between PowerShell Regexes and Others
5. 11.2Getting Started
6. 11.3Character Classes
7. 11.4Custom Character Classes
8. Character Classes Reference
9. 11.5Quantifiers
10. Quantifiers Reference
11. 11.6Character Escape Sequences
12. Character Escape Sequences Reference
13. 11.7Anchors (Zero-Width Assertions)
14. Anchors Reference
15. 11.8Captures
16. 11.9Visualizing Captures
17. Grouping Constructs Reference

12.Accessing Regexes

1. 12.1Using PowerShell Syntax
2. 12.1.1-match Operator with Strings
3. 12.1.2-match Operator with String Arrays
4. 12.1.3-cmatch and -imatch Operators and Inverses
5. 12.1.4-replace Operator with Strings
6. 12.1.5-replace Operator with String Arrays
7. 12.1.6-creplace and -ireplace Operators
8. Comparison Operators Reference
9. 12.1.7-split Operator with Strings
10. 12.1.8-split Operator with String Arrays
11. 12.1.9Splitting Strings with -split and a Script Block
12. 12.1.10-csplit and -isplit Operators
13. Split Reference
14. 12.1.11Select-String Cmdlet
15. Select-String Reference
16. 12.1.12Where-Object Cmdlet with the -Match Parameter
17. Where-Object Reference
18. 12.1.13switch -Regex Statement
19. Switch Reference
20. 12.1.14ValidatePattern() Parameter Attribute
21. ValidatePattern Reference
22. 12.1.15Pester Should -Match and -MatchExactly Assertions
23. Pester Assertions Reference
24. 12.2Using the .NET Methods
25. 12.2.1Constructors
26. 12.2.2IsMatch()
27. 12.2.3Match()
28. Match Class in .NET
29. 12.2.4Match.NextMatch() Instance Method
30. 12.2.5Matches()
31. 12.2.6Replace()
32. 12.2.7Split()
33. 12.2.8Escape() and Unescape()
34. 12.2.9GetGroupNumbers() and GetGroupNames()
35. 12.2.10GroupNameFromNumber() and GroupNumberFromName()
36. .NET Regex Reference
37. 12.3Regex Options
38. 12.3.1RegexOptions.None (0)
39. 12.3.2RegexOptions.IgnoreCase (1)
40. 12.3.3RegexOptions.Multiline (2)
41. 12.3.4RegexOptions.ExplicitCapture (4)
42. 12.3.5RegexOptions.Compiled (8)
43. 12.3.6RegexOptions.Singleline (16)
44. 12.3.7RegexOptions.IgnorePatternWhitespace (32)
45. 12.3.8RegexOptions.RightToLeft (64)
46. 12.3.9RegexOptions.ECMAScript (256)
47. 12.3.10RegexOptions.CultureInvariant (512)
48. 12.3.11Combining Regex Options
49. 12.3.12Inline Options
50. Regex Options Reference

13.Regex Deep Dive

1. 13.1Debugging Your Regex Patterns
2. 13.1.1Regex Through the Eyes of an NFA Engine
3. 13.1.2Backtracking and Branching
4. 13.1.3Catastrophic Backtracking
5. 13.1.4Atomic Groups
6. 13.2Functionality to Consider
7. 13.2.1No Subroutines
8. 13.2.2No Recursion
9. 13.2.3Possessive Quantifiers vs. Atomic Groups
10. 13.2.4Variable-Length Lookbehinds
11. 13.3Deconstructing a Pattern
12. 13.4Advanced Syntax
13. 13.4.1Unicode Categories and Blocks
14. Unicode Categories and Blocks Reference
15. .NET Character Encoding Reference
16. 13.4.2Character Class Subtraction
17. Character Class Subtraction Reference
18. 13.4.3Using Inline Options
19. 13.4.4Using Option Spans
20. Inline Options Reference
21. 13.4.5Comments in Regex
22. 13.5Advanced Replacement Patterns
23. 13.5.1Named and Numeric Captures
24. 13.5.2Entire Match
25. 13.5.3Match Span Prefixes and Postfixes
26. 13.5.4Entire Input
27. 13.5.5Last Capture
28. 13.6Advanced Subexpressions and Backreferences
29. 13.6.1Backreferences in Depth
30. Backreference Constructs Reference
31. 13.6.2Lookarounds in Depth
32. Example 23: Thoughts
33. Lookarounds Reference
34. 13.6.3Conditional Logic
35. Example 25: Thoughts
36. Conditionals Reference
37. 13.6.4Balancing Groups
38. Balancing Groups Reference

14.Regex Best Practices

1. 14.1Constrained and Unconstrained Input
2. 14.2Backtracking and Exponential Operations
3. 14.3Preventing ReDoS with Regex Time-Outs
4. 14.4Capturing Just Enough
5. 14.5Static vs. Instance Methods and Caching
6. 14.6No More CompileToAssembly()
7. 14.7Getting the Scope Right
8. 14.8Iterative Development
9. 14.9Edge Cases and Near Matches
10. Best Practices Reference
11. 14.10Thread Safety
12. Regex Thread Safety Reference
13. 14.11Next Steps
14. 14.12Further Reading
15. 14.12.1Official Reference Materials
16. 14.12.2Other Materials
17. VPowerShell Security

15.Script Signing

1. 15.1What Is Script Signing and How It Protects You
2. 15.1.1How Digital Signing Works
3. 15.1.2How Code Signing Works in Modern Windows Systems
4. 15.2The Anatomy of a Signed Script
5. 15.3How to Sign a Script
6. 15.3.1Acquiring a Code Signing Certificate
7. 15.3.2How to Install Code Signing Certificates Properly
8. 15.3.3Signing Process
9. 15.3.4How to Prevent Your Signatures from Expiring
10. 15.3.5What Else Can You Sign
11. 15.4How to Verify a Signature
12. 15.4.1Get-AuthenticodeSignature
13. 15.4.2Sigcheck
14. 15.4.3Signtool
15. 15.4.4Execution Errors
16. 15.5Scaling Out
17. 15.5.1Use Your Own PKI
18. 15.5.2Deploy Code Signing Certificates in a Corporate Environment
19. 15.6Summary
20. 15.7Further Reading

16.Script Execution Policies

1. 16.1Types of Execution Policies
2. 16.1.1AllSigned
3. 16.1.2RemoteSigned
4. 16.1.3Restricted
5. 16.1.4Unrestricted
6. 16.1.5Bypass
7. 16.1.6Default
8. 16.1.7Undefined
9. 16.2Execution Policy Scope
10. 16.2.1Scope Precedence
11. 16.3Security Considerations
12. 16.4Setting the Execution Policy
13. 16.4.1Set-ExecutionPolicy
14. 16.4.2Group Policy
15. 16.4.3AppLocker
16. 16.4.4Windows Defender Application Control
17. 16.5Further Reading

17.Constrained Language Mode

1. 17.1In Depth
2. 17.1.1Language Modes
3. 17.1.2Constrained Language Mode Features
4. 17.2Limitations of Constrained Language Mode
5. 17.2.1PowerShell Protect
6. 17.3Deep Diving into Windows Lockdown Policy
7. 17.3.1GetLockdownPolicy()
8. 17.3.2GetWldpPolicy()
9. 17.3.3GetAppLockerPolicy()
10. 17.3.4GetDebugLockdownPolicy()
11. 17.4Implementing Policies Using AppLocker Script Rules
12. 17.4.1Introduction
13. 17.4.2Getting Started
14. 17.5Implementing Policies Using WDAC
15. 17.5.1What Is WDAC?
16. 17.6Deploying WDAC Using Microsoft Intune
17. 17.6.1Prerequisites
18. 17.6.2Creating a Device Policy
19. 17.7Best Practices
20. 17.8Further Reading

18.Just Enough Administration

1. 18.1Introduction
2. 18.1.1Requirements
3. 18.2Background of JEA
4. 18.2.1PowerShell Remoting 101
5. 18.2.2An Overview of PowerShell Session Configuration
6. 18.2.3PowerShell Remoting Authentication and Transport Encryption
7. 18.3PowerShell Role Capabilities
8. 18.3.1Implementing Windows PowerShell Role Capabilities in the Console
9. 18.3.2Implementing PowerShell (Core) Role Capabilities in the Console
10. 18.3.3Implementing PowerShell Role Capabilities Within DSC
11. 18.4Getting Started With PowerShell Session Configuration
12. 18.4.1Step 1: Enabling PowerShell Remoting
13. 18.4.2Step 2: Creating/Registering the PowerShell Session Configuration
14. 18.4.3Connecting to a PowerShell Session Configuration
15. 18.4.4Role Definition Design Considerations
16. 18.4.5Managing PowerShell Session Configurations
17. 18.5An Overview of the Security Descriptor Definition Language (SDDL)
18. 18.5.1Terms
19. 18.5.2SDDL Overview
20. 18.5.3SDDL Syntax
21. 18.5.4Reading SDDLs
22. 18.5.5Creating SDDLs from a Security Descriptor
23. 18.6Auditing PowerShell Remoting Sessions
24. 18.6.1Review Effective Rights
25. 18.6.2PowerShell Event Logs
26. 18.6.3Session Transcription Logs
27. 18.6.4Removing Existing PowerShell Sessions
28. 18.7Further Reading

Afterword

Index

1. A, SYMBOLS
2. B, C
3. D, E
4. F, G
5. H, I
6. J, K, L, M
7. N
8. O
9. P
10. R
11. S
12. T
13. U, V, W
14. Y