0.2.6

Release notes

UsaBanner 0.2.6. What changed since v0.2.4 (2026-10-28):

Group Policy: GPMC can report on the GPO properly

Existing code written GPOs were breaking when DeleteExpiredTaskAfter were set to PT0M. Changing to PT0S. Code DID run but hadn't confirmed how this looked in GPMC and a gpresults /h output. Changed and confirmed!

To repair a GPO an earlier version published, publish again from 0.2.6 with the same -Name. The run rewrites the task and raises the GPO's version; its -WhatIf says Write the task 'UsaBanner sync' and Raise the version by one, so that clients apply the GPO again.

Windows: PowerShell 7 where there is none

• Under Windows PowerShell 5.1, every command but Enter-UsaPSSession hands itself to pwsh. Where there was none, it stopped and said what to install. Now it offers to install it first: the newest 7.6 MSI GitHub lists, its SHA-256 checked against its release's hashes.sha256 and its Microsoft signature checked, then installed for every user by msiexec, and the command hands itself over as before.
• Note: It asks my default. Use -Confirm:$false for autodeploy scripts, -WhatIf says what it would install and installs nothing, and a PowerShell that cannot ask (-NonInteractive, no console) stops and says what to do instead. It needs an elevated PowerShell, and says so before it downloads anything.
• Hosts under the Group Policy are unchanged: its runner never reaches this, and deploy-usawinssh's policy installs their PowerShell 7

The update channel

• With -Update notify or -Update install and no -UpdateSource, the channel now looks at this project's releases on GitHub (https://github.com/Manate-ch/deploy-usabanner/releases/latest/download).

The first banner

• Older OG / test code (install.sh, rootfs/, windows/, adsys-startup.sh) has left the repository. Deploy-UsaBanner -ReplaceOldBanner still takes it off any host that has it, and Get-UsaBanner still finds it. The module's messages and help now speak of it in the past. This part was more for MY migration purposes :)

Docs

• Claude mirrored the Readme in the Gitlab this is worked on in

Claude's Checked Notes:

On the lab domain controller, on an unlinked copy of a published GPO with a scheduled task: UsaBanner's task file as 0.2.5 writes it made GPMC's HTML report fail, and as 0.2.6 writes it the report built.
On a Windows Server 2025 lab member with PowerShell 7 uninstalled: -WhatIf (it would install 7.6.9, read from GitHub), a non-interactive run (it stops, asking nothing), then a real install through Remove-UsaBanner -Confirm:$false (downloaded, both checks passed, installed, handed over; Windows Installer: installation completed, status 0); the host otherwise as before, to the hash.
The suite on the build's tree (main `0a67b275`; tests and prototype/tests): 1867, none skipped.

The assets below are the archive and its SHA256SUMS, built from main by build/New-UsaBannerRelease.ps1; sha256sum --check SHA256SUMS passes beside the archive.

UsaBanner 0.2.4

UsaBanner 0.2.4. What changed since v0.2.2 (2026-10-27): art of your own and the logo of each host's OS (!70),
and five fixes from the first production rollout (!71).

Art

• Deploy-UsaBanner -ArtPath <art.json>, and the same flag on Deploy-UsaBannerGPO: a logo you cannot, do not or
  will not contribute stays yours. Make the file from an image with New-UsaBannerArt -OutFile, look at it with
  Show-UsaBannerArt -Path, then deploy with -ArtPath. The art goes into the configuration's new art.custom,
  which both banners draw in place of art.name, and reaches every host the configuration does, through Group
  Policy too; it never enters the module (docs/DECISIONS.md, D31).
• Art of your own keeps the rules of the module's own (printable ASCII, 64 x 30 at most, a colour for every class),
  checked wherever a configuration is built or read and again when it is drawn, and one more: no two colour
  classes that differ only in case, since Windows reads the configuration at each login as PowerShell data.
• -BannerImage os-logo draws the logo of the OS each host runs: Windows, Ubuntu, or Tux on any other Linux. One
  Group Policy package draws each host its own. os, the default, stays our server pictogram in the OS's colour.

The module's own files

• The manifest lists every file of the module (FileList, D32). Deploy-UsaBannerGPO refuses a module folder
  that holds a file the list does not name, or lacks one it names, before anything is written: a publish had
  staged an admin's configuration file, left in the folder of the unpacked release, to every host.
  Deploy-UsaBanner copies the listed files alone into the copy for every user, with a warning naming any other,
  and refuses a folder short of a listed file. Keep your configuration and your own art outside the module's
  folder, and unpack each release fresh.

Group Policy

• A renamed GPO: the publisher finds its GPO by name (-Name, UsaBanner by default), so a run without -Name
  after an admin renamed it would have made a second GPO. It now stops and names the GPO that carries the task
  UsaBanner sync, with the -Name to give, and warns of any other GPO with the task beside its own.

Moving off the old banner (Ubuntu)

• The move-off stops a run of the old banner's jobs in progress, and clears the failed state of every unit of
  those jobs once they are gone: none stays in systemctl's failed list, or in the "failed units" line at a login.
  A host an earlier deploy moved off is cleared at its next deploy.

Windows

• The periodic task's program is %ProgramFiles%\PowerShell\7\pwsh.exe from any session: a deploy from a
  PowerShell remoting session over SSH registered the task again, the same pwsh by its 8.3 path. A host that holds
  the short form takes the long one once, at its next deploy.
• Remove-UsaBanner deletes its task folder, \UsagiTools\, once no other task is in it.

Checked on a Windows Server 2025 lab member and an Ubuntu 24.04 lab host, every step predicted in writing
first, in two windows: the art (a logo made from a PNG, drawn in both banners as a login draws them, and os-logo)
and the five fixes (a missing module file refused, a stray one left out of the copy, the task's program, the task
folder, a failed old unit cleared); each host back to its state before. The suite on the build, the three test
folders: 2138, none skipped; negative controls, predicted before any run, 19 of 20 exact (the one miss named a
test too few, for the same cause).

The assets below are the archive and its SHA256SUMS, built from main by build/New-UsaBannerRelease.ps1;
sha256sum --check SHA256SUMS passes beside the archive.