Skip to content

Windows Admin Toolkit 3.0.0

Latest
Latest

Choose a tag to compare

View all tags
@fusiontechstrategies fusiontechstrategies released this 24 Aug 18:31
· 1 commit to main since this release
v3.0.0
285f945

Windows Admin Toolkit 3.0.0 is a major enterprise and MSP-focused release. It keeps the application as one portable PowerShell script while adding guarded automation, least-privilege policy enforcement, enterprise auditability, and controlled orchestration.

Highlights

  • Noninteractive automation for all 20 stable actions, with deterministic JSON results and process exit codes for RMM, scheduled-task, CI, and scripting integrations
  • Local, single-remote-target, and validated target-list execution with bounded concurrency and timeouts
  • Strict least-privilege policy profiles for actions, transports, targets, runtime limits, and supported inputs
  • Capability preflight that assesses requirements without running the requested action
  • Per-run JSON Lines auditing, stable target identities, policy decisions, lifecycle events, and tamper-evident summaries
  • Controlled change plans with separate Create, Approve, Execute, and Resume operations
  • Hash-bound approvals, atomic checkpoints, deterministic interruption recovery, and no automatic repetition of ambiguous or completed state changes
  • SHA-256 release manifests and an SPDX 2.3 software bill of materials

Signed downloads

Use the attached WindowsAdminToolkit.ps1 for the signed standalone application, or Windows-Admin-Toolkit-3.0.0-signed.zip for the complete signed release package. The toolkit script in both assets is Authenticode-signed by Fusion Technology Strategies, Inc. with a DigiCert-issued code-signing certificate and a verified DigiCert timestamp.

GitHub-generated source archives contain the reviewable repository source and are not the signed release assets.

Verify the standalone script before running it:

$signature = Get-AuthenticodeSignature -LiteralPath .\WindowsAdminToolkit.ps1
if ($signature.Status -ne 'Valid') {
    throw "Signature verification failed: $($signature.StatusMessage)"
}
$signature.SignerCertificate.Subject

SHA-256 identities:

  • Signed toolkit: e3a160ffef88c179e530656a0bc386e187e2992e28ca72dcbe65ff1dd54c6b0d
  • Signed release ZIP: 723a9da3bd62451d9c5ad22d64c5b66b59d30b502363c87d89daec0cd494a0fa
  • Release manifest: 547081fcfda60e0b486e4c1c693ffaf375721d725a9815fccf9c68028afaaab9
  • SPDX SBOM: ff223f6fa1f27d65add889b3753fb4290e717f3ae95dafedf88909868197af8a

Qualification

  • 649 of 649 checks passed under Windows PowerShell 5.1 and PowerShell 7.6.4 on the final repository tree
  • GitHub CI passed on Windows Server 2022 and Windows Server 2025 under both PowerShell editions
  • The preceding 647-check suite passed in clean Windows 10 Pro, Windows 11 Pro, Windows Server 2022, and Windows Server 2025 virtual machines before two release-certificate regression checks were added; the application script did not change
  • 244 of 244 adversarial stress assertions passed
  • 30 of 30 interruption and resume assertions passed across 120 targets
  • 18 of 18 live WinRM assertions passed on the supported server editions
  • FIPS, standard-user, controlled live-change, release-integrity, static-analysis, secret-scan, and Microsoft Defender gates passed
  • SignTool verified one signature with zero warnings and zero errors; signer and timestamp trust chains validated successfully

Qualification boundaries

Actual Windows Update installation and broad temporary-file deletion were not run live because they are not narrowly reversible. Positive PsExec execution was not run because no trusted local PsExec binary was present; its fail-closed validation paths passed. Successful WinRM qualification used the real remoting stack on both supported server editions while preserving the one-VM-at-a-time safety limit.

See the changelog, testing record, and release-integrity guidance for details.

Assets 7
Loading