Show Notes
Andrew sits down with Fred Weinmann, one of the most prolific PowerShell module authors in the community, for part one of a multi-episode series covering his projects. This episode focuses on the Active Directory Management Framework, or ADMF, a configuration-driven system Fred originally built while working as a field engineer at Microsoft for a large enterprise customer managing hundreds of Active Directory forests.Fred walks through the problem ADMF was designed to solve: Active Directory is notoriously hard to manage consistently across environments, and most organizations just accept the chaos as the cost of doing business. The old approach at this particular customer involved zipping up scripts, RDPing into domain controllers, and running them manually. ADMF changed that by borrowing the test/apply concept from Desired State Configuration, but making it flexible enough to handle the messiness of real-world AD environments.The conversation covers how ADMF is structured around components (like organizational units) and contexts, why generating a reference configuration from an existing environment is harder than it sounds, the protocol juggling required to handle Group Policy and schema updates, and why Fred would use raw LDAP instead of the built-in AD commands if he were starting from scratch today. Fred also touches on the credential provider plugin system, which lets teams plug in their own password management workflows for things like break-glass accounts.Key Takeaways:
ADMF follows a test-before-apply model borrowed from DSC, but trades DSC's all-or-nothing enforcement for a more selective, component-by-component approach that better fits the fluid reality of Active Directory management. Generating a configuration from an existing AD environment is tempting but potentially counterproductive. If you auto-generate your desired state from a domain that's accumulated years of cruft, you're not capturing what you want, you're just freezing what already exists. Performance at scale is a real consideration. The built-in Active Directory PowerShell module uses the AD Web Services protocol, which sends XML over the wire. Raw LDAP is significantly faster, and Fred says switching to it is the one architectural change he'd make if building ADMF over again.
Guest Bio:Friedrich "Fred" Weinmann is a Cloud Solution Architect at Microsoft and one of the most recognized PowerShell community contributors working today. He is the creator of PSFramework, which underpins many other modules in the ecosystem, as well as tools like PSModuleDevelopment, PSUtil, and the Active Directory Management Framework. Fred is a frequent conference speaker, a longtime community collaborator, and someone Andrew credits with helping shape his own PowerShell journey.Resource Links:ADMF documentation and getting started guide: admf.oneADMF on GitHub: github.com/ActiveDirectoryManagementFramework/ADMFADMF on PowerShell Gallery: powershellgallery.com/packages/ADMFPSFramework (Fred's logging, configuration, and scripting infrastructure module): psframework.orgFred Weinmann on GitHub: github.com/FriedrichWeinmannFred Weinmann on X: x.com/FredWeinmannPDQ Community Discord: discord.gg/pdq
The PowerShell Podcast on YouTube: https://youtu.be/8SlIqUKP3hY
More from The PowerShell Podcast
Fresh off a PowerShell Wednesday session on Windows PowerShell versus PowerShell 7, Andrew Pla sits down with Ryan Yates, a longtime pillar of the UK PowerShell community and member of three PowerShell Working Groups (Cmdlets, Engine, and Interactive UX). Ryan pulls back the curtain on what working group members actually do, from triaging issues and reviewing PRs to deciding how bugs and enhancements should be implemented before the community picks up the work.The conversation rewinds to Ryan's early days as an IT apprentice at Barclays, where supporting SharePoint without a Visual Studio license led him straight to PowerShell and a lifelong love of breaking things to learn how they work. Ryan also shares his take on PowerShellGet and PackageManagement headaches, why PSResourceGet and DSC v3 point to a better future, how AI's cost barrier affects everyday PowerShell users, and his dream of turning old devices into a local AI compute farm.Things wrap up with a rapid-fire lightning round covering underrated cmdlets, favorite automatic variables, the most rewritten code block in PowerShell history, and a heartfelt call for more community eyes on the PowerShell repository.Key Takeaways:
Andrew sits down with longtime PowerShell legend James Brundage to recap what he calls his "summer of fun," a stretch of side projects that prove PowerShell can go way further than most of us ever thought to push it. James kicks things off with Wave, a module for creating and manipulating real .wav files in the object pipeline. Once you see audio as a sine wave and some math, you can generate notes, play music, and even draw animated SVG waves straight from PowerShell.From there, the tour keeps rolling. MarkX turns Markdown into queryable XML so you can pull out code blocks or turn Markdown tables into typed data tables. James also shares how a vibe coded Wolfenstein 3D style clone in PowerShell (that got pulled from the internet after some tough feedback) sent him down the audio rabbit hole, and how he's collaborating with Bruce Payette on getting Braid to play nicely with PowerShell. Then it gets visual. James walks through his Matrix module, which brings the transformation matrices already baked into .NET over to PowerShell and CSS, and shows off a hallway of fake 3D depth built entirely with PowerShell generated SVG. He explains the simple trick behind PowerShell static sites (a .html.ps1 script that spits out HTML, plus a ToString or HTML property on your objects) and shares Fun, a tiny web server where any function named with a leading slash becomes a web page. The episode wraps with a promise of a Part 2, because there is clearly way more to cover.Key Takeaways:
Adam Driscoll, creator of PowerShell Universal, returns to the show for a deep dive into how AI has reshaped his day to day work. Since selling PSU to Devolutions last October, Adam has gone from writing thousands of lines of code himself to running a fleet of coding agents through GitHub Copilot, working across the PSU codebase, documentation, and Jira tickets. He and Andrew talk candidly about the personal side of that shift, the strange mix of mourning your old flow state while also getting more done than ever. From there the conversation turns practical, covering how Adam builds guardrails around agents using PowerShell modules and MCP servers, why planning in smaller steps beats one shotting a huge feature, and why Pester testing has quietly become non negotiable. They wrap with a PowerShell Universal 2026.3 update, including a redesigned admin console, new AI chat and MCP guardrail features, and Devolutions Agent support for running PSU jobs, plus a fun detour into Adam's side projects: a fully managed SQLite engine called Ahtola and an accidental 20,000 line Unity game.Key Takeaways:
Justin Grote (posh.guru) rejoins the PowerShell Podcast a year after his last appearance to talk about how fast the agentic AI world has moved since then. He walks through his experiments with the agent host protocol, running coding agents in isolated dev boxes and spot VMs so a stray command can only trash a container instead of his laptop. He and Andrew dig into what a "harness" actually is, how tools like these steer raw model output into something useful, and why that shift pushed Justin into a real existential dip this past summer, wondering what the point of hand building modules is when an agent can spin one up on demand. He works through how he came out the other side (doing it for the love of the game and the community), then gets into the practical stuff: a from-scratch C# rewrite of ModuleFast that cut Az module install time from seven seconds to three, the ExcelFast beta for slinging PowerShell objects in and out of Excel, and how he's tuning prompts using VS Code's new debug view and token caching. They also cover the rise of agent plugins (bundled skills plus MCP), his favorite lightweight plugin Ponytail, and Justin's read on where PowerShell fits once AI can talk to APIs directly. The conversation closes on advice for people getting into PowerShell right now and where to find Justin online.Key Takeaways:
Andrew welcomes back pen tester and AD security enthusiast Spencer Alessi (Tech Spence) fresh off DEF CON for a wide ranging chat on where PowerShell still fits into offensive security, how AI is changing his workflow, and what makes an environment genuinely painful to attack. Spencer talks through why PowerShell remains a favorite for both attackers and defenders, how he uses LLMs to speed up one off scripting tasks (and where they still fall short), and how he leans on AI tools to obfuscate offensive tooling during engagements. The conversation shifts into real world stories from the field, including a memorable case of exposed domain user hashes sitting on an overly permissive share, before wrapping up with the three controls Spencer sees make the biggest difference for defenders: application control, content filtering, and network segmentation.KEY TAKEAWAYS: