Skip to content

Releases: PSAppDeployToolkit/PSAppDeployToolkit

PSAppDeployToolkit 4.1.8

14 Jan 20:30

Choose a tag to compare

πŸ–₯️ What's new in PSADT 4.1.8 - 2026-01-14

This release strengthens Windows Installer (.msi) and Patch (.msp) deployment reliability, improves process and handle safety, enhances dialog behavior, and hardens serialization and exception reporting. It also modernizes dependencies and standardizes UTF-8 handling.

Highlights

  • Better MSI/MSP behavior, including logging, version-handling, and multi-product patch support
  • Safer process + handle management with improved cleanup and error handling
  • More resilient dialogs and user-interaction flows
  • Hidden-file handling fixes and Zero-Config MSI reliability improvements
  • Dependency updates, CI/signing performance gains, and UTF-8 BOM standardization

Added

  • Added automatic MSP logging within Start-ADTMsiProcess
  • Added support for MSI patches that target multiple product codes
  • Added -PassThru result for Start-ADTMsiProcess when an MSI isn't installed on the system
  • Added Start-ADTMsiProcess logging parameters to Start-ADTMspProcess
  • Added automatic dialog repositioning when screen resolution changes
  • Added parallelized code signing / dep caching to our CI. Build was 23+ mins, now +/- 7 mins (thanks @pl4nty!)
  • Added IsAdmin property to RunAsActiveUser object

Changed

  • Changed Test-ADTNetworkConnection to include Wi-Fi connections by default
  • Changed Start-ADTMsiProcess and Start-ADTMspProcess parameters to be fully harmonized
  • Changed PowerShell InformationStream to use Write-Host again for transcription support
  • Changed Show-ADTInstallationPrompt command in template to remove -Icon parameter (not supported in Fluent UI)
  • Changed ESP detection to not require CloudAssignedTenantId (to support Windows 365 devicies)
  • Changed Start-ADTMsiProcess documentation to clarify FilePath parameter usage for MSI/MSP files (thanks lumirjasny)
  • Changed Start-ADTMsiProcess documentation to include -ArgumentList array support examples. Fixes #1864
  • Changed permissions checks to occur earlier in ProcessManager.CreateProcessUsingToken()
  • Changed FileHandleManager.GetOpenHandles() to use ordinal string comparison for object names
  • Changed FileHandleManager.GetOpenHandles() to only test for disk file handles
  • Changed child processes to no longer inherit duplicated handles
  • Changed ProcessUtilities.GetProcessImageName() to improve exception reporting
  • Changed ProcessUtilities.GetProcessArgv() to improve error capturing
  • Changed CsWin32 by updating to latest and accommodating related API changes
  • Changed NuGet dependencies by updating to the latest versions
  • Changed FileSystemUtilities.GetNtPathLookupTable() by optimizing to only loop through available drives

Fixed

  • Fixed Start-ADTMsiProcess checking if $msiDefaultParams exist before adding to $msiArgs (thanks @egfx-notifications). Fixes #1955
  • Fixed Start-ADTMsiProcess exception caused by InstalledApplication object handling
  • Fixed Zero-Config MSI code to use the FileName column. Fixes #1950
  • Fixed outer-quoted command line arguments incorrectly parsing as key/value pairs
  • Fixed ProcessManager.LaunchAsync() disposal issues
  • Fixed ProcessManager.LaunchAsync() exit code handling
  • Fixed module file encoding to use UTF-8 with BOM
  • Fixed deserialization checks to handle missing data
  • Fixed CloseAppsDialogFluentStrings() parameter name
  • Fixed handling of malformed input in DataSerialization.SerializeToString()
  • Fixed SafeThreadHandle implementation where the handle was not releasing
  • Fixed DialogManager.ShowBalloonTip() disposal
  • Fixed Start-ADTMsiProcess to handle MSI files without ProductVersion
  • Fixed MsiUtilities.GetMessageFromMsiExitCode() null terminator handling
  • Fixed Block-ADTAppExecution to work on ProcessDefinition objects. Fixes #1930
  • Fixed Invoke-ADTAllUsersRegistryAction help to use -LiteralPath instead of -Key. Fixes #1919
  • Fixed WIN32_ERROR.ERROR_MR_MID_NOT_FOUND error handling
  • Fixed arithmetic overflow in error handling utilities
  • Fixed typos in LGPL boilerplate text
  • Fixed SafeHandle disposal for processes we don't own
  • Fixed desktop icon cache refresh. Fixes #1846
  • Fixed DeploymentSession.AppVendor field for Zero-Config MSI deployments. Fixes #1883
  • Fixed AssemblyPermissions.Remediate() exception details. Fixes #1899
  • Fixed process.HasExited checks within ProcessUtilities.GetRunningProcesses()
  • Fixed Turkish locale issues with case conversion (invariant ToUpper/ToLower)
  • Fixed Close-ADTSession break behavior in breakable statements
  • Fixed Show-ADTInstallationWelcome infinite dialog loop when processes can't be closed by user
  • Fixed /Debug mode to only work in user interactive processes. Fixes #1860
  • Fixed Start-ADTProcessAsUser missing Default_CreateWindow_Wait parameter set
  • Fixed hidden files/folders not being copied when referenced directly. Fixes #1875
  • Fixed Get-ADTUserNotificationState return type
  • Fixed Show-ADTInstallationWelcome -AllowMove parameter help message
  • Fixed Slovak installation message (thanks @lumirjasny)
  • Fixed Copy-ADTContentToCache error on re-run when source and destination are the same
  • Fixed ProcessManager.OutLaunchArguments() setup
  • Fixed hStdInput handle to use INVALID_HANDLE_VALUE when not in use
  • Fixed non-CsWin32 P/Invoke declarations hardening
  • Fixed FileHandleManager.GetOpenHandles() to skip invalid file handles
  • Fixed AttachThreadInput() P/Invoke to use custom declaration with SetLastError = true

Full Changelog: 4.1.7...4.1.8

@sintaxasn, @mjr4077au, & @DanGough - Team PSADT πŸ˜ŠπŸ¦–

PSAppDeployToolkit 4.1.7

21 Oct 12:26

Choose a tag to compare

πŸ–₯️ What's new in PSADT 4.1.7 - 2025-10-21

πŸ› οΈ Fixes

  • Hotfix to resolve issue where PSAppDeployToolkit 4.1.6 did not work in PowerShell 7 (#1842)

Full Changelog: 4.1.6...4.1.7

@sintaxasn, @mjr4077au, & @DanGough - Team PSADT πŸ˜ŠπŸ¦–

PSAppDeployToolkit 4.1.6

17 Oct 10:42

Choose a tag to compare

πŸ–₯️ What's new in PSADT 4.1.6 - 2025-10-17

πŸ› οΈ Fixes

  • Added the ability to format URLs with a description using in tags in dialog strings, e.g. [url=https://contoso.com/security]Click here for the IT Security Policy[/url]
  • Added support for nested tags for UI text formatting.
  • Changed -TerminalServerMode switch behavior so that if not running in a terminal server, no action is taken.
  • Changed Fluent Dialogs to use software rendering-mode which resolves issues with remote assistance / control tools, e.g. ScreenConnect, etc.
  • Fixed an issue where the UI may fail to be displayed when explorer.exe is being elevated by an EPM rule using BeyondTrust EPM, Microsoft EPM, or other EPM tool.
  • Fixed an issue where Get-ADTApplication could error out if InstallSource / InstallLocation properties were malformed.
  • Fixed an issue where Get-ADTLoggedOnUser would not return any output when pipelined, unless it was encapsulated in a subexpression.
  • Fixed Start-ADTProcessAsUser to work with the callers' username even if it doesn't have an active session.
  • Fixed issue where tags specified in dialog strings were incorrectly being displayed in Classic Dialogs (even though the tag formatting such as bold doesn't work in Classic). These are now correctly removed and the text is displayed without formatting.
  • Fixed passing parameters from the command-line to a v3 compatibility template.
  • Fixed Fluent Window dialog position to factor in the default offset if changed.
  • Fixed a number of issues found in example documentation for Show-ADTInstallationPrompt, Get-ADTExecutableInfo and Start-ADTProcess.
  • Fixed Start-ADTProcess -ArgumentList parameter incorrectly resolving custom $adtSession property to 'True'.
  • Fixed Test-ADTOobeCompleted and Test-ADTEspActive not working.
  • Fixed Set-ADTServiceStartMode error handling bug.
  • Fixed Set-ADTActiveSetup -Description parameter could not be specified in parameter set CreateNoExecute.
  • Fixed unexpected error output when reading a HKLM key in SID context.
  • Fixed all known Copy-ADTFile issues.
  • Fixed New-ADTZipFile not working.
  • Fixed issue where Start-AdtMsiProcess could fail to uninstall an installed MSI.
  • Fixed Remove-ADTEnvironmentVariable just removing that variables value, not the variable itself.
  • Fixed Get-ADTShortcut no longer working for URL shortcuts.

New Contributors

Full Changelog: 4.1.5...4.1.6

@sintaxasn, @mjr4077au, & @DanGough - Team PSADT πŸ˜ŠπŸ¦–

PSAppDeployToolkit 4.1.5

07 Sep 04:32

Choose a tag to compare

πŸ–₯️ What's new in PSADT 4.1.5 - 2025-09-07

πŸ› οΈ Fixes

  • Added more error info to assist with troubleshooting issue - #1716
  • Fixed issue that prevented the toolkit running under some Intune deployments - #1717
  • Added a fallback default icon where we're unable to obtain one from a running process - #1713
  • Fixed issue where Get-ADTShortcut hit an error when the icon path contained an environment variable - #1709
  • Fixed OutOfMemoryException issues within Resolve-ADTErrorRecord - #1711

Full Changelog: 4.1.4...4.1.5

@sintaxasn, @mjr4077au, & @DanGough - Team PSADT πŸ˜ŠπŸ¦–

PSAppDeployToolkit 4.1.4

04 Sep 17:27

Choose a tag to compare

πŸ–₯️ What's new in PSADT 4.1.4 - 2025-09-04

🎯 Improvements

  • Changed to allow IFEO-blocked processes that get invoked as SYSTEM to execute.
  • Added warning within Block-ADTAppExecution if generated command line is > 255 chars
  • Added -DisableInheritance switch to Set-ADTItemPermission to restore 3.x behaviour for those who want it. (#1682)
  • Added IsTerminalServer to New-ADTEnvironmentTable exports (#1665)
  • Updated Show-ADTInstallationWelcome documentation (thanks @That-Annoying-Guy!)
  • Changed to using GetLastInputInfo() for more accurate console user idle time.
  • Changed Exit-ADTInvocation to expose -NoShellExit parameter on Close-ADTSession. (https://discourse.psappdeploytoolkit.com/t/silent-install-with-restart-and-close-processes-prompt/6906)
  • Made the fluent dialogs properly honour right-to-left cultures (#1693)

πŸ› οΈ Fixes

Full Changelog: 4.1.3...4.1.4

@sintaxasn, @mjr4077au, & @DanGough - Team PSADT πŸ˜ŠπŸ¦–

PSAppDeployToolkit 4.1.3

21 Aug 21:28

Choose a tag to compare

πŸ–₯️ What's new in PSADT 4.1.3 - 2025-08-21

πŸ› οΈ Fixes

  • Fixed CloseProcesses issue introduced in in 4.1.2
  • Fixed issue with variable expansion on Start-ADTProcessAsUser
  • Fixed Uninstall-ADTApplication to work with 8.3 names (e.g. C:\PROGRA~2)

Full Changelog: 4.1.2...4.1.3

This release has gone through a full QA cycle to ensure there are no major issues as was the case in 4.1.1 / 4.1.2.
We apologize for the missed testing in the previous release and have taken steps to ensure this doesn't happen again.

@sintaxasn, @mjr4077au, & @DanGough - Team PSADT πŸ˜ŠπŸ¦–

PSAppDeployToolkit 4.1.2

20 Aug 15:20

Choose a tag to compare

πŸ–₯️ What's new in PSADT 4.1.2 - 2025-08-20

Please get the latest release here - https://github.com/PSAppDeployToolkit/PSAppDeployToolkit/releases/tag/4.1.3

Update - In our haste to release 4.1.2, we inadvertently introduced another issue. As such, we have pulled both 4.1.1 and 4.1.2 in order to put through a full QA test and verify that we have a fully vetted build before release.

We had a few reports of three specific issues after the 4.1.1 release. While they won’t affect everyone, we decided these fixes were important enough to warrant this quick patch release.

πŸ› οΈ Fixes

  • Fixed issue with TestEffectiveAccess() call in Set-ADTClientServerProcessPermissions that would fail on some domain-joined devices
  • Fixed setup in Block-ADTAppExecution so processes started by SYSTEM don't block at all
  • Fixed issue with Show-ADTInstallationWelcome where the buttons would always display in English

Full Changelog: 4.1.1...4.1.2

@sintaxasn, @mjr4077au, & @DanGough - Team PSADT πŸ˜ŠπŸ¦–

PSAppDeployToolkit 4.1.1

20 Aug 05:31

Choose a tag to compare

πŸ–₯️ What's new in PSADT 4.1.1 - 2025-08-19

Please get the latest release here - https://github.com/PSAppDeployToolkit/PSAppDeployToolkit/releases/tag/4.1.3

Note - In our haste to release 4.1.2, we inadvertently introduced another issue. As such, we have pulled both 4.1.1 and 4.1.2 in order to put through a full QA test and verify that we have a fully vetted build before release.

🎯 Improvements

  • Prevent end users from terminating PSADT.ClientServer.Client.exe process
  • Do things to try and make the IFEO command line as short as possible
  • Add better retry support to all modal dialogs to prevent client termination
  • Allow -ErrorAction to handle no available user in Start-ADTProcessAsUser
  • Address case where some systems seemingly don't have a Win32_BIOS.Version property
  • Add FileSystemUtilities.TestFileAccess() for testing whether a user has the relevant permissions
  • Add FileSystemUtilities.GetEffectiveAccess() to determine whether a SID has effective access to a path
  • Rework Set-ADTClientServerProcessPermissions to test for effective access rather than just attempting to set ACLs
  • Improve setup surrounding -UseShellExecute pathway, especially with UIAccess executables
  • Handle situations where we might not have access to the process in ProcessUtilities.GetRunningProcesses()
  • Adjust Set-ADTClientServerProcessPermissions to not require a client/server user
  • Get all the *-ADTEnvironmentVariable functions running through the client/server process when the Target is User
  • Run the client/server process elevated if the user has a linked admin token
  • Bump InvokeBuild dependency version to latest upstream
  • Ensure log lines from Show-ADTInstallationProgress reflect all inputs
  • Improve comment-based help several functions within the module
  • Add missing [SupportsWildcards()] decoration for Remove-ADTFolder -Path
  • Ensure there's no duplicate -AppProcessesToClose entries, just like Show-ADTInstallationWelcome does
  • Uplift -FilePath resolution in Start-ADTProcess to factor in DirFiles/DirSupportFiles if -WorkingDirectory is not specified
  • No need to be so restrictive on Start-ADTMsiProcess -LogFileName
  • Expose RequireAdmin publicly within DeploymentSession class object
  • Added Bulgarian language strings (thanks @petarvnikolov)

πŸ› οΈ Fixes

  • Adjust setup in ProcessUtilities.GetRunningProcesses() to handle bogus command lines
  • Patch bad setup in Get-ADTClientServerUser when multiple users are present
  • Fix some incorrectly named languages so they confirm with bcp47 standards
  • Restore SEE_MASK_NOZONECHECKS setup in Start-ADTProcess as it's needed even for CreateProcess()
  • Add missing parentheses within New-ADTTemplate -Show pathway
  • Swallow TaskCanceledException throws within ServerInstance.Close()
  • Properly set the Company field in all compiled file manifests
  • Revise setup surrounding default setting of $WorkingDirectory in Start-ADTProcess
  • Fixes for Finnish language strings (thanks @labradmin)
  • Fix missing negation on DisableDefaultMsiProcessList test

🀼 New Contributors

Full Changelog: 4.1.0...4.1.1

@sintaxasn, @mjr4077au, & @DanGough - Team PSADT πŸ˜ŠπŸ¦–

PSAppDeployToolkit 4.1.0

07 Aug 08:02
51f064f

Choose a tag to compare

πŸ–₯️ What's new in PSADT 4.1.0 - 2025-08-07

Please get the latest release here - https://github.com/PSAppDeployToolkit/PSAppDeployToolkit/releases/tag/4.1.3

🎯 Major Improvements

  • Up until now, it was not possible to display any user interface when deploying an application as SYSTEM using Intune (or any endpoint management tool) without using ServiceUI. Well, now it IS possible:

    • I REPEAT! You no longer need to use ServiceUI, EVER AGAIN! πŸ₯³πŸŽ‰πŸŽŠπŸͺ…πŸͺ©πŸ‘―‍♂️
    • In fact, we strongly advise you stop using it as soon as possible. ServiceUI works by manipulating system security tokens in a way that could allow malicious actors to escalate privileges or bypass security controls.
    • We've taken a fresh approach which leverages the Windows security model and separates out user interactions onto a process running in the users' session - we never perform any user interaction or messaging of any kind within the SYSTEM context. This means a more secure and reliable deployment experience.
    • We have also removed the requirement for the 'Allow users to view and interact with the program installation' checkbox in Configuration Manager deployments.
  • There is now full feature parity between the Fluent and Classic User Interfaces:

    • Deferral Deadline and Countdown Timer on Close Apps Dialog
    • Ability to prevent the Restart Dialog from being dismissed once a certain point in the countdown is reached
    • Ability to allow users to move dialogs
    • Ability to set the initial dialog placement to multiple locations
    • PowerShell ISE compatibility
  • Furthermore, the Fluent UI has gained new features:

    • Due to the rearchitecture of how we handle user interaction with Dialogs, it is now possible to prompt the user for input using Show-ADTInstallationPrompt's -InputBox parameter
    • Support for formattable text (Bold, Italic & Accent) as well as URL hyperlinks in dialog messages
    • You can now set the % complete of the progress bar in the Progress Dialog (for example, if you are running a custom script that you want to show incremental progress changes for)
    • Ability to set different icons for Light / Dark mode
  • The security rearchitecture required all of our process execution code to be rewritten. This has enabled us to provide a wealth of new capabilities to both Start-ADTProcess and Start-ADTProcessAsUser using the following new parameters:

    • -UseUnelevatedToken parameter to force a process run without elevation, for deploying user-context apps with Windows 11 Administrator Protection enabled
    • -WaitForChildProcesses parameter to wait for all child processes to end - useful for installers/uninstallers that hand off to another process and exit early
    • -KillChildProcessesWithParent parameter to close all started child processes once main process has ended - useful when installers start the application post-install, which is typically undesired when running as system
    • -Timeout parameter along with supporting -TimeoutAction and -NoTerminateOnTimeout parameters to control the outcome
    • -ExpandEnvironmentVariables parameter to allow variable expansion such as %AppData% when running a process as a user
    • -StreamEncoding parameter, useful for apps like Winget that write to the console using UTF8
    • -PassThru output now has a new 'interleaved' property that combines stdout/stderr in order
  • It's now possible to set PSADT configuration settings via Group Policy using the included ADMX templates, which will override any settings in the config.psd1 file. This allows you to change, update or enforce settings across an organization.

πŸ› οΈ New and Enhanced Functions

πŸ› οΈ Other Improvements

  • Show-ADTHelpConsole has been given some love and a facelift with High-DPI awareness, resizability, PowerShell 7 compatibility, and extension module display
  • Reworked Invoke-AppDeployToolkit.exe to be more compliant within WDAC environments
  • Added -NoWait support to Show-ADTDialogBox
  • Added process detection code to enable automatic silent deployments when processes aren't running
  • Added /Debug switch to Invoke-AppDeployToolkit.exe to show terminal output for debugging purposes
  • Added /Core switch to Invoke-AppDeployToolkit.exe to allow PowerShell 7 usage
  • Added support for running processes from network drives

πŸ› οΈ Changes

  • Added -NoOobeDetection option to Open-ADTSession to bypass OOBE detection logic when DeployMode is set to Auto. Use this to show the UI during OOBE / Autopilot ESP phases.
  • Added -NoSessionDetection option to Open-ADTSession to bypass session detection logic when DeployMode is set to Auto. Use this to show the UI when no user is logged on and the SYSTEM process is interactive.
  • Added -NoProcessDetection option to Open-ADTSession to bypass process detection logic when DeployMode is set to Auto. Use this to show the UI even if there are no processes to close.
  • Changed -DeployMode Interactive to always show interactively. This means the toolkit will always show the dialogs, bypassing the OOBE/Session/Process detections that occur in Auto mode.
  • Changed default DeferExitCode from 60012 to 1602, since ConfigMgr and Intune recognize this natively as 'User cancelled the installation'
  • Changed toolkit to exit with 3010 if a suppressed reboot was encountered without having to use -AllowRebootPassThru. To mask 3010 return codes and exit with 0, you can now add -SuppressRebootPassThru
  • Changed default msiexec.exe parameters in interactive mode from /qb-! to /qn
  • Changed UI functions to no longer minimize windows by default, -MinimizeWindows can be added to enable this
  • Changed the 'Processes to close' in the Invoke-AppDeployToolkit template to the AppProcessesToClose ADTSession parameter, where they can be re-used over Install / Uninstall / Repair
  • Changed installation failure to be silent as it was in v3.x; however, you can still uncomment a line to get the full detailed stack trace as used in v4.0.x, or a new minimal example using the Fluent UI

πŸ› οΈ Fixes

  • Fixed Start-ADTProcessAsUser function to work as expected
  • Fixed Block-ADTAppExecution to avoid triggering AV solutions
  • Fixed dialogs to show correct deployment type Install / Uninstall / Repair
  • Fixed SCCM pending reboot tests within Get-ADTPendingReboot
  • Fixed MSI repair to default to 'Reinstall' to avoid forced unavoidable reboots when running msiexec /f against an app that is in-use
  • Fixed OOBE detection code to factor in User ESP phase
  • Fixed launching processes in the users' session when using certain MDMs, e.g. VMware Workspace ONE.

Full Changelog: 4.0.6...4.1.0

πŸ™πŸ» Thanks

Read more

PSAppDeployToolkit 4.1.0-rc3

02 Aug 05:55

Choose a tag to compare

Pre-release

πŸš€ 4.1.0 final has now been released! ➑️Get it here!

Changes since RC2

  • Changed default -DeployMode to Auto. This is functionally the same as the old Interactive mode, where the toolkit will automatically switch to Silent mode if the device is in OOBE/ESP phases, there is no user logged on, or (new in 4.1) there are no processes to close.
  • Changed -DeployMode Interactive to always show interactively. This means the toolkit will always show the dialogs, bypassing the OOBE/Session/Process detections that occur in Auto mode.
  • Added -NoOobeDetection option to Open-ADTSession to bypass OOBE detection logic when DeployMode is set to Auto. Use this to show the UI during OOBE / Autopilot ESP phases.
  • Added -NoSessionDetection option to Open-ADTSession to bypass session detection logic when DeployMode is set to Auto. Use this to show the UI when no user is logged on and the SYSTEM process is interactive.
  • Added -NoProcessDetection option to Open-ADTSession to bypass process detection logic when DeployMode is set to Auto. Use this to show the UI even if there are no processes to close.
  • Removed superfluous text from the CloseApps dialog. Thanks @ClientMGMT for #1569

Full Changelog: 4.1.0-rc2...4.1.0-rc3