v1.2.1 — UI and bug fixes (BUG-001..011) - #28
Merged
Conversation
The prior fix (#16) pinned Pester to the exact reference version 5.7.1 in CI and Test-TierModelPrerequisites. That was too strict: it blocked any other valid 5.x release, and it blocked deployment when a supported 5.x was installed side-by-side with a newer major. Loosen the gate to accept any Pester 5.x (major-version match) while still rejecting 6.x, whose breaking changes (new mock engine / Should-* assertions) broke 44 test cases. - ci.yml: install Pester with -MinimumVersion 5.0.0 -MaximumVersion 5.99.99 (both lint and test jobs). - Test-TierModelPrerequisites: accept the highest installed 5.x. Pester installs side-by-side, so a supported 5.x alongside an unsupported newer major (e.g. 6.x) no longer blocks deployment; it emits a non-blocking note that PowerShell auto-loads the highest version and the 5.x line must be imported explicitly (Import-Module Pester -MaximumVersion 5.99.99). Fails only when no 5.x release is present. Cast Version to [version] so string and [version] inputs are both handled under Set-StrictMode. - Invoke-AllTests.ps1: select and explicitly import the highest 5.x so local/ lab runs use the supported version even when 6.x is installed alongside it. - config/dependencies.json keeps 5.7.1 as the tested reference version. - Docs (faq, quick-deployment-guide) clarify any 5.x is supported, not 6.x. Validated locally with Pester 5.7.1: full suite 1403 passed, 0 failed; added unit tests for any-5.x acceptance, 6.x-only rejection, and the 5.9.0 + 6.0.0 side-by-side scenario. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The unmocked 'Should check Pester module availability' test asserted the prereq snapshot equals the highest installed Pester (highest overall). That encoded the old selection logic and failed in the lab when Pester 6.0.0 was installed side-by-side with 5.9.0: the snapshot correctly reports the highest supported 5.x (5.9.0), but the test expected 6.0.0. Update the expected value to the highest installed 5.x, falling back to the highest overall only when no 5.x is present, matching the loosened gate. Validated in the lab with 5.7.1 + 5.9.0 + 6.0.0 installed: full suite 1403 passed, 0 failed; runner selects and imports 5.9.0. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
… planning) BUG-002 — Deploy-TierModel.ps1 -UserOnly did not list the missing OUs/Groups when run against an unprepared domain, unlike -GroupOnly/-GposOnly. The path calls Invoke-UserDeployment with -Silent (to avoid duplicate plan output), which suppresses that function's own dependency-error listing. Surface the deduplicated 'Dependency Errors:' + ' ❌ <message>' block in the outer -UserOnly display block before the generic 'Resolve all dependency errors' line, matching the other scope parameters. BUG-005 — During -FullDeployment ... -IncludeWinLaps planning (no -ConfirmApply) against an unprepared domain, missing LAPS GPOs were reported as red 'Required GPO ... does not exist' errors, even though the earlier GPO phase creates them at apply time. Make the LAPS GPO existence check non-blocking in the FD planner (Get-TierModelWinLapsAclFd): a missing GPO now adds a Warning instead of a hard RequiredGpoNotFound planError/early-return, so the decryptor step plans a yellow 'ConfigureLapsDecryptor' action and Deploy-TierModel renders the warnings in yellow. The standalone -IncludeWinLaps path (Get-TierModelWinLapsAcl) is unchanged and keeps the strict pre-existence check. Tests: updated the FD 'Gate 4a' unit test to assert warning-not-error (standalone 'Gate 4a' still asserts the error); strengthened the UserOnly display test to assert the specific dependency message is listed. Full suite 1401 passed under Pester 5.9.0. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Squad memory + logs from the Hyper-V AD lab validation of the BUG-002 and BUG-005 display fixes: Wolverine/Beast history, merged decisions, and the session + orchestration logs (Wolverine tester, Cyclops reviewer — both PASS). No production code or the fix commit (32b748f) is affected. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 620d06cb-97e5-425f-ac2c-66214b66c536
Additional Squad memory from the extended lab campaign (9 scenarios incl. real -ConfirmApply applies + audit): Wolverine/Cyclops history and merged decisions. Both fixes RESOLVED, no regressions. Also surfaced candidate BUG-008 (prereq relative dependencies.json path) recorded in the local tracker. No production code or the fix commit (32b748f) is affected. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 620d06cb-97e5-425f-ac2c-66214b66c536
# Conflicts: # CHANGELOG.md
The first BUG-002 attempt kept -UserOnly's -Silent call and bolted the dependency-error list onto the outer display block. That left the output misaligned with -GroupOnly: the 'User Plan Summary' section was missing and the errors appeared under '=== Deployment Plan ===' instead of before it. Correct the approach to mirror -GroupOnly: - Drop -Silent from the -UserOnly dispatch so Invoke-UserDeployment prints 'Analyzing User requirements...', 'User Plan Summary', and the 'Dependency Errors:' list (its non-Silent display path, previously dead code since both callers passed -Silent). - Suppress per-user 'User exists' noise inside Invoke-UserDeployment via Get-TierModelUser -Silent (Get-TierModelGroup has no per-entity spam, so this keeps parity with the Group path). - Revert the outer-block error listing so '=== Deployment Plan ===' shows only the 'Resolve all dependency errors' line, matching -GroupOnly. FullDeployment's Invoke-UserDeployment -Silent call is unaffected. Tests: UserOnly Display Variants now assert 'User Plan Summary', the specific message, and the resolve line; stale 'Silent=\True internally' comments updated. Full suite 1403 passed under Pester 5.9.0; render confirmed to match -GroupOnly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 620d06cb-97e5-425f-ac2c-66214b66c536
The first BUG-005 revision emitted a yellow warning for each missing LAPS
GPO ('⚠ LAPS GPO ... not found - assuming it will be created ...'). The ⚠
glyph was wrong (not the standard yellow ■ action bullet) and the intent is
to preview the configuration, not warn about a not-yet-created GPO.
Final behavior:
- Get-TierModelWinLapsAclFd: a missing LAPS GPO during FD planning is now
silently non-blocking (debug-logged only) — no warning, no planError. The
decryptor step still plans a ConfigureLapsDecryptor action per configured GPO.
- Deploy-TierModel Write-IncludeAclPlanActions: render ConfigureLapsDecryptor
as ' ■ Configure : <gpoName>' (yellow), matching the format of the other
planned actions, instead of '■ Configure LAPS decryptor: <dec> on <gpo>'.
- Removed the separate ⚠ warning display block in the FD phase-10 section.
Only the 6 decryptor-configured LAPS GPOs are listed; the DC LAPS GPO retains
the DSRM default (Domain Admins) by design and is not configured in this phase
(confirmed with the maintainer).
Tests: FD Gate 4a unit test now asserts non-blocking (no RequiredGpoNotFound
error, no 'not found' warning). Full suite 1403 passed under Pester 5.9.0.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 620d06cb-97e5-425f-ac2c-66214b66c536
…ncipals render The '■ Configure : <gpoName>' lines still did not appear in the WinLaps FD preview against an unprepared domain, and the 'Create ACL:' principals were blank. Root cause: the FD planner resolved groups with Get-ADGroup -Filter, which returns NO match (and does NOT throw) when a group is absent. The best-effort estimated-name fallback lived only in the catch block, so missing groups stayed unresolved — leaving \ unset, which blanked the Create ACL principals and made the decryptor loop 'continue' (skipping every ConfigureLapsDecryptor action). Move the best-effort fallback to run whenever the group is unresolved (empty result OR exception), not only on exception. Now the FD preview against an unprepared domain shows the 21 Create ACL lines with estimated principals and the 6 '■ Configure : <gpoName>' lines (real names resolve at apply time once the earlier phase creates the groups). Verified on the lab DC: Phase 10 shows 27 actions (21 Create ACL + 6 Configure), no ⚠, no red errors. Full suite 1403 passed under Pester 5.9.0. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 620d06cb-97e5-425f-ac2c-66214b66c536
… LDAP)
New-TierModelOuAcl bound to the target OU with a serverless path
([ADSI]"LDAP://$targetOUPath"), which connects to a random DC. In multi-DC
environments successive ACL delegations could land on different DCs, causing
replication-dependent inconsistency. Bind via "LDAP://$DomainController/$targetOUPath"
(the -PreferredDc passed through the pipeline), matching the MSA/gMSA/dMSA
ACL cmdlets.
Also fix the same serverless-bind pattern in New-TierModelGpo (the GPO
Deny-Apply ACL / GPC bind) to "LDAP://$DomainController/CN={...}" so every
ACL - OU and GPO - targets the same DC.
Lab-validated end-to-end (TierLab-DC01): -FullDeployment preview (664 actions,
0 errors) -> -ConfirmApply (Applied 643, Skipped 4, Errors 0; Phase 4 OU ACLs
all applied, no Access-denied/canonical failures) -> Audit -FullDeployment =
COMPLIANT (366 checked, 0 drift, 0 errors). Full Pester suite 1403 passed
under 5.9.0.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 620d06cb-97e5-425f-ac2c-66214b66c536
…aps UnexpectedAcl, Include deps path BUG-008: pass an absolute $PSScriptRoot-based DependenciesPath in both -Include* $prereqSplat hashtables so prerequisites resolve regardless of the current working directory (previously fell back to cwd-relative config/dependencies.json and failed when the script was launched by absolute path from another directory). BUG-004: Test-TierModelWinLapsAcl now emits UnexpectedAcl findings for extra LAPS extended-right holders not in the configured Read/Reset set (skipping well-known/admin principals), mirroring the MSA/gMSA/dMSA audits. Lab-validated on TierLab-DC01. BUG-003: dMSA/gMSA/WinLaps prerequisites now fail fast before any deployment phase -- a dMSA DFL critical pre-flight gate right after module load, and the -Include* switches routed through the up-front Test-TierModelPrerequisites call (both FullDeployment and standalone). The dMSA DFL message is friendly and the redundant schema-version error is suppressed; DFL-only is confirmed correct for the single-domain Tier Model (no FFL check). Message alignment: a shared Write-TierModelFailFast helper renders every gate identically (no "Prerequisites not met:" header, no "ERROR:" prefix, blank-line-separated "Remediation steps:", closing "Deploy/Audit script completed."). WinLaps schema errors de-duplicated, every previously-bare dMSA prerequisite error gained a remediation step, the PowerShell-version gate gained a run-in-PS7 remediation, and Audit-TierModel.ps1 gained a matching PowerShell-version gate + aligned prerequisite block. Full suite: 1411 passed, 0 failed (Pester 5.9.0). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 620d06cb-97e5-425f-ac2c-66214b66c536
… logging Squad history and decisions from the fail-fast/message-alignment work, the dMSA DFL doc lookup (OQ-4: DFL-only, cited), and the BUG-004 lab validation that surfaced BUG-009 (GenericAll LAPS false-positive). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 620d06cb-97e5-425f-ac2c-66214b66c536
…ation Task Summary: - Merged wolverine-bug010-lab-validation.md from inbox into decisions.md - Archived 5 decisions older than 30 days to decisions-archive.md - Appended BUG-010 lab validation note to Beast's history (Learnings section) - Created orchestration log (2026-07-29-05-15-29Z-wolverine.md) - Created session log (2026-07-29-bug010-lab-validation.md) Decisions Archive: - Beast Decision: Precompute Optional MSA/gMSA/dMSA ACL (2026-06-03) - Beast: Phase 16 Pester Test Patterns (2025-07-18) - Beast: Standalone Lab Validation (2026-05-30) - Copilot Directive: 002-gmsa-support Testing Scope (2026-05-30) - Storm Decision: Phase 16 MSA/gMSA/dMSA Documentation (2025-07-18) BUG-010 Validation Result: PASS - 4x -OuOnly iterations: all 10 OUs gPOptions=1, 0 audit failures - 1x -FullDeployment: Phase 2 cleared, 31 OUs audit 100% compliant - Readback verification active (Attempts=1 on all OUs) - Recommendation: Close BUG-010 as RESOLVED Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…heritance; hard-stop before Groups
New-TierModelOu now reads back the setting after applying it (Get-GPInheritance for GPO
block inheritance; the ACL's AreAccessRulesProtected for security inheritance) on the same
DC, and retries up to 4 times with backoff until verified. A silent no-op (the AD call
returns without error but the change does not persist) is no longer reported as success;
after retries it records a human-readable error ("Block GPO Inheritance flag was not set
for OU 'X'...") with the raw exception kept only in the log.
Deploy-TierModel.ps1: in -FullDeployment, an unverified OU inheritance setting hard-stops
the run before the Groups phase so a tier boundary is never silently left open (narrowed
to inheritance-verification error codes so existing general-error resilience is unchanged).
Logic remains create-only: existing/live OUs are never modified (remediate drift via change
control and confirm with the audit script).
Lab-validated on TierLab-DC01 (4x -OuOnly + 1x -FullDeployment): every configured
block-inheritance OU verified gPOptions=1 with zero false-success and zero audit drift.
Full Pester suite: 1414 passed, 0 failed (Pester 5.9.0).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 620d06cb-97e5-425f-ac2c-66214b66c536
…e/settings.json personal The 225-word Code Spell Checker dictionary now lives in a portable, committed cspell.json at the repo root (auto-detected by the Code Spell Checker extension and usable from the cspell CLI in CI/PR checks), so misspellings stay flagged consistently for every contributor. .vscode/settings.json is personal (gitignored) and holds only per-user editor prefs (the dark-orange workbench theme + chat prompt recommendations). This also restores the shared dictionary that was inadvertently removed from the repo in d9d135a when a session-records commit swept in the already-staged .vscode/settings.json untracking. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 620d06cb-97e5-425f-ac2c-66214b66c536
…ip range guard
BUG-009: Test-TierModelWinLapsAcl no longer flags tier admin groups that hold
GenericAll (full control) on an OU as UnexpectedAcl LAPS drift. Their LAPS read
is effective (GenericAll-derived), not an explicit ms-LAPS delegation, and is
covered by the OU ACL audit. The audit now collects the OU GenericAll (Allow)
holders from the DACL it already reads for SELF detection and excludes them from
the unexpected-holder check; a genuinely unexpected explicit LAPS reader is still
flagged. StrictMode-safe via PSObject.Properties guards. Lab-validated on
TierLab-DC01 (the two recurring Tier0Admins/Tier1Admins warnings are gone; an
injected explicit LAPS holder is still detected).
BUG-011: Deploy-TierModel reported a phantom "Skipped: 4" on a clean
-FullDeployment with zero real skips. The User and OuAcl result builders used
@(1..$executionResult.Skipped | ForEach-Object {...}); PowerShell 1..0 is the
descending range {1,0} (2 elements), so each of those two phases emitted 2
phantom skips. All four 1..$n ranges (User/OuAcl Applied+Skipped) are now guarded
with if ($n -gt 0) so a zero count yields an empty array.
Tests: +2 WinLaps audit unit tests (GenericAll holder not flagged; explicit
non-GenericAll rogue still flagged) and +1 integration test (clean FullDeployment
reports Skipped: 0, reproduced Skipped: 4 pre-fix). Full suite 1417 passed /
0 failed (Pester 5.9.0).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 620d06cb-97e5-425f-ac2c-66214b66c536
…k Temp mock artifact
Two test-only fixes so the suite is deterministically green under every invocation
(unit-only isolation, canonical Invoke-AllTests, CI directory-path, and raw file-array).
No production code changes.
Unit.Prerequisites.Tests.ps1 — the "WinLaps Gate 3 DFL" and "all three gates pass"
tests asserted LapsModulePresent=true but only mocked Import-Module LAPS (no-op),
relying on the LAPS module being ambiently loaded (which only happened in the full
suite via another file). They failed when unit tests ran in isolation. Fixed by
mocking Get-Module/Get-Command for LAPS in the context BeforeEach so the tests are
self-contained.
Unit.GpoOperations.Tests.ps1 — two Import-TierModelGpo tests used non-GUID backup
folder names ("backup"/"b1"/"b2"). Real Import-GPO coerces -BackupId to [System.Guid]
and Pester mocks preserve that parameter binding, so those calls threw once the real
GroupPolicy module was loaded (cumulatively via integration tests), sending the import
to the "path not found" branch (Executed=0). They passed in isolation but failed in
the full suite. Fixed by using valid-GUID backup names (GPO backups are GUID-named in
reality), which bind cleanly regardless of module load state.
Also untrack Temp/TestGPO_Mock.inf (a Pester-generated GPO mock artifact accidentally
committed) and add Temp/ to .gitignore so test runs no longer dirty the tree.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 620d06cb-97e5-425f-ac2c-66214b66c536
Update README.md, docs/test-coverage.md, and docs/faq.md to reflect the current measured state after the BUG-001..011 fixes: - Automated tests: 1,401 -> 1,425 (Unit 1,122->1,137, Integration 279->288); 0 failed. - Overall docs-scope line coverage: 90.92% -> 88.68% (13,788/15,548), still above the 80% CI gate on the modules/TierModel scope (~91%). The two root orchestration scripts are measured separately: Deploy-TierModel 81.4%, Audit-TierModel 73.1% (new fail-fast and alignment code paths that need live-AD or PowerShell <7 to exercise). - Per-file coverage rows for the 8 changed files updated; tier-summary and sub-tables reconciled to sum to 63 files (fixes a pre-existing miscount that omitted the 12 MSA/gMSA/dMSA files). - Current release bumped to v1.2.1 (patch: UI and reliability bug fixes) in README and FAQ. - The unverified "Manual Integration Tests / 331" README row is preserved as-is (no such automated file exists in the repo); automated vs manual totals kept distinct. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 620d06cb-97e5-425f-ac2c-66214b66c536
There was a problem hiding this comment.
Pull request overview
This PR delivers the v1.2.1 patch release for ActiveDirectoryTierModel, focusing on UI/output consistency and reliability fixes across deployment/audit orchestration, prerequisite gating, OU/GPO/WinLaps ACL operations, and supporting tests/docs.
Changes:
- Improve reliability and consistency: preferred-DC LDAP binds for OU/GPO ACL writes, verified/retried OU inheritance changes, and fail-fast prerequisite gates/messages.
- Fix WinLaps planning/audit behavior: FD planning treats missing LAPS GPOs as non-blocking, WinLaps audit emits
UnexpectedAcldrift while excluding OUGenericAllholders. - Update test infrastructure and release metadata: loosen Pester gate to any 5.x (with 6.x side-by-side handling), bump version to 1.2.1, and refresh docs/coverage numbers.
Reviewed changes
Copilot reviewed 39 out of 40 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| tests/Unit.WinLapsAclOperations.Tests.ps1 | Adds/adjusts unit coverage for BUG-005 planning behaviors and WinLaps drift scenarios. |
| tests/Unit.Prerequisites.Tests.ps1 | Expands prerequisite unit tests (Pester 5.x selection, dMSA DFL/schema/KDS messaging). |
| tests/Unit.OuOperations.Tests.ps1 | Adds tests for BUG-010 OU inheritance verification/retry and surfaced errors. |
| tests/Unit.ModuleManifest.Tests.ps1 | Updates expected module version to 1.2.1. |
| tests/Unit.GpoOperations.Tests.ps1 | Normalizes mock import paths to GUID-like values. |
| tests/Invoke-AllTests.ps1 | Selects/imports highest installed supported Pester 5.x to avoid auto-loading newer majors. |
| tests/Integration.Module.Tests.ps1 | Updates expected loaded module version to 1.2.1. |
| tests/Integration.Deploy.Tests.ps1 | Adds integration coverage for BUG-002/003/008/010/011 behaviors and invariants. |
| tests/Integration.Audit.Tests.ps1 | Updates audit prereq messaging expectations and adds fallback-message coverage. |
| README.md | Refreshes test counts/coverage and bumps displayed version to 1.2.1. |
| modules/TierModel/TierModel.psd1 | Bumps ModuleVersion to 1.2.1 and updates release notes. |
| modules/TierModel/public/Test-TierModelWinLapsAcl.ps1 | Implements UnexpectedAcl detection and GenericAll-holder exclusion (BUG-004/009). |
| modules/TierModel/public/Test-TierModelPrerequisites.ps1 | Loosens Pester gate to any supported major line and aligns prerequisite messaging/remediation. |
| modules/TierModel/public/New-TierModelOuAcl.ps1 | Uses preferred DC in LDAP bind for OU ACL writes (BUG-001). |
| modules/TierModel/public/New-TierModelOu.ps1 | Verifies/retries GPO/security inheritance changes and surfaces unverified states as errors (BUG-010). |
| modules/TierModel/public/New-TierModelGpo.ps1 | Uses preferred DC in LDAP bind for GPC ACL writes (BUG-001). |
| modules/TierModel/public/Get-TierModelWinLapsAclFd.ps1 | Makes missing LAPS GPO non-blocking in FD planning; improves group resolution fallback (BUG-005). |
| docs/test-coverage.md | Updates coverage report and adds v1.2.1 notes/metrics. |
| docs/quick-deployment-guide.md | Updates Pester guidance to “any 5.x; 6.x not supported”. |
| docs/faq.md | Updates version/release references to v1.2.1. |
| Deploy-TierModel.ps1 | Adds consistent fail-fast helper, adds dMSA DFL preflight, threads Include* prereqs up-front, fixes skipped-count range bug, adds OU inheritance hard-stop gate (BUG-002/003/008/010/011). |
| Audit-TierModel.ps1 | Adds PS7 gate and consistent fail-fast formatting for prerequisite failures. |
| CHANGELOG.md | Adds v1.2.1 release notes and detailed BUG-001..011 entries. |
| .github/workflows/ci.yml | Installs any Pester 5.x (min/max) instead of pinning an exact version (BUG-007). |
| cspell.json | Introduces repository-level cspell configuration (migrated from VS Code settings). |
| .vscode/settings.json | Removes committed personal VS Code workspace settings (now ignored). |
| .gitignore | Stops tracking .vscode/settings.json and ignores Temp/ scratch output. |
| .squad/orchestration-log/2026-07-29-05-15-29Z-wolverine.md | Adds lab validation log artifact. |
| .squad/orchestration-log/2026-07-28T12-10-15Z-wolverine.md | Adds lab validation log artifact. |
| .squad/orchestration-log/2026-07-28T12-10-15Z-cyclops.md | Adds review/architect log artifact. |
| .squad/log/2026-07-29-bug010-lab-validation.md | Adds session log for BUG-010 validation. |
| .squad/log/2026-07-28T12-10-15Z-ui-bugs-002-005-lab-validation.md | Adds session log for BUG-002/005 validation. |
| .squad/decisions.md | Adds decision records and validation notes for BUG fixes and research outcomes. |
| .squad/decisions-archive.md | Archives older decisions and moves entries from active window. |
| .squad/agents/wolverine/history.md | Updates agent learnings/history with recent validation details. |
| .squad/agents/storm/history.md | Adds note about dMSA functional-level decision outcome. |
| .squad/agents/cyclops/history.md | Adds campaign review learnings and corroborations. |
| .squad/agents/beast/history.md | Updates condensed history/learned patterns and recent validation notes. |
| .squad/agents/beast/history-archive.md | Refreshes archived notes format/content. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
213
to
+216
| if (-not $prereqResult -or -not $prereqResult.PSObject.Properties['Valid'] -or -not $prereqResult.Valid) { | ||
| Write-Host "Prerequisites not met:" -ForegroundColor Red | ||
| if ($prereqResult.Errors) { | ||
| $prereqResult.Errors | ForEach-Object { Write-Host " ERROR: $_" -ForegroundColor Red } | ||
| } | ||
| if ($prereqResult.Remediation) { | ||
| Write-Host "Remediation steps:" -ForegroundColor Yellow | ||
| $prereqResult.Remediation | ForEach-Object { Write-Host " - $_" -ForegroundColor Yellow } | ||
| } | ||
| $ffMessages = @() | ||
| if ($prereqResult -and $prereqResult.Errors) { $ffMessages = @($prereqResult.Errors) } | ||
| if ($ffMessages.Count -eq 0) { $ffMessages = @('Prerequisites were not met.') } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v1.2.1 — UI and reliability bug fixes
Patch release resolving 10 tracked bugs found during lab and CI testing. No breaking changes; no new features. All changes are backward-compatible.
Bugs fixed
LDAP://path (random DC); in multi-DC domains delegations could land on different DCs and drift. Now bind via-PreferredDc, matching the MSA/gMSA/dMSA cmdlets.-UserOnlyoutput parity:-UserOnlyhid the dependency-error list (missing OUs/Groups). It now shows the same plan summary and specific dependency errors as-GroupOnly.-IncludeDmsa/-IncludeGmsa/-IncludeWinLapsused to run the whole deployment and only fail deep (Phase 9) with a cryptic schema error. A clean pre-flight gate (dMSA DFL, KDS root key, LAPS schema) now blocks before any phase in both full and standalone modes.UnexpectedAcl. It now flags extra (non-configured) LAPS delegations as drift, like the MSA/gMSA/dMSA audits.-Include*prereq checks failed with "Dependencies file not found" when the script was launched by absolute path. Now resolvesconfig/dependencies.jsonfrom$PSScriptRoot.GenericAllwere flagged as unexpected LAPS readers. The audit now excludes full-control holders (covered separately by the OU ACL audit) while still catching genuine explicit LAPS drift.Set-GPInheritanceoccasionally silently no-op'd yet reported success, leaving a tier boundary unblocked. It is now verified + retried, with a hard-stop before the Groups phase if it cannot be confirmed.Skipped: 4(zero real skips) due to a PowerShell1..0descending-range bug. Guarded — clean deploys now reportSkipped: 0.Also: aligned all fail-fast prerequisite messages across Deploy and Audit (shared helper, de-duplicated remediation).
Testing
Invoke-AllTests.ps1, and the CI directory-path invocation.modules/TierModel/*scope remains ~91%, above the 80% gate.Note: merging this PR does not publish a release — the
v1.2.1release package is created when thev1.2.1tag is pushed after merge.