Announcement

Breaking Changes Raised minimal powershell version to 7.6 to use the module New Features Added a new Update-RDMOption cmdlet to reload module options when a concurrent RDM instance has modified them Improvements Added -DefaultElevationGroupID to New-DSPamAccount to save default JIT elevation group identifiers (AD SIDs or Entra ID object IDs) on a PAM account at creation time Added -DefaultElevationGroupID to Update-DSPamAccount to replace or clear the saved default Added -Detailed switch to Get-DSPamAccount to retrieve full account data for all accounts in a single bulk call, equivalent to fetching each account individually with -AccountID Added -ElevationGroupID to Invoke-DSPamCheckout: omit to auto-apply the account's saved default, supply identifiers to override, or pass @() to skip JIT elevation entirely even when a default is configured Added -PageSize parameter to Get-DSPamAccount to control how many accounts are fetched per request when retrieving bulk results (default: 500) Deprecated the -HubPersonal parameter in New-RDMDataSource Export-RDMEntry now accepts entries as pipeline input Improved Get-RDMWorkspaceCustomVariable and Set-RDMWorkspaceCustomVariable cmdlets to correctly enumerate and consume pipeline objects Invoke-DSPamCheckout now accepts a -MfaCode parameter (string or SecureString via PSPassword) to satisfy MFA-on-checkout policies; the cmdlet automatically resolves the user's configured TOTP authenticator, and the code can be retrieved from a stored OTP entry using Get-DSEntryOTP New-DSPamCheckoutPolicy and Update-DSPamCheckoutPolicy now support a -CheckoutMFAMode parameter to configure MFA enforcement on PAM checkout (Default, None, Mandatory, or MandatoryOnElevationOnly) Removed version management configuration prompt when upgrading a data source Renamed "connection" and "session" to "entry" across cmdlets, parameters, and documentation Renamed "data source" to "workspace" across cmdlets, parameters, and documentation Renamed "password template" to "password policy" across cmdlets, parameters, and documentation Renamed "repository" to "vault" across cmdlets, parameters, and documentation Renamed "role" to "user group" across cmdlets, parameters, and documentation Renamed "virtual gateway" to "ruleset" across cmdlets, parameters, and documentation Renamed -HubBusiness to -Cloud on New-RDMDatasource and *-RDMHubVaultAccess cmdlets to *-RDMCloudVaultAccess (old names kept as aliases) Update-RDMEntries no longer reloads options Fixes Fixed a null-reference exception in New-DSPamCheckoutPolicy and Update-DSPamCheckoutPolicy when the server returned an error response Fixed Export-RDMActivityLogsReport - -After/-Before parameters now honor time-of-day instead of being truncated to whole-day boundaries Fixed recently created users not being fetched by Add-RDMRoleToUser for its -UserName parameter Fixed Set-RDMEntry failing with "The entry is checked out" when saving a new entry with manual checkout mode Fixed Update-DSPamCheckoutPolicy throwing an argument exception when -Name was omitted while supplying other parameters

Improvements Added -AsBase64 parameter to New-DPSEncryptConfiguration to return the configuration as a Base64 string Added -OutputPath parameter to New-DPSEncryptConfiguration to enable creating a new encryption configuration at any specified file path Fixes Fixed password list item custom fields and passwords not being resolved by Get-RDMEntry

New Features Added ConvertFrom-RDMWebsiteLegacyEntry to convert legacy website entries to the modern website entry type Added Get-DSActivityLog cmdlet to retrieve activity log entries from Devolutions Server with date range and user filtering Added Get-DSAdministrationLog cmdlet to retrieve administration log entries from Devolutions Server Added Get-DSPamLog cmdlet to retrieve PAM log entries from Devolutions Server, with support for filtering by message type Added Get-DSPamPasswordRotationLog cmdlet to retrieve PAM password rotation log entries from Devolutions Server Added Get-RDMVaultCustomVariable to retrieve a vault's custom variables Added New-RDMVaultCustomVariable to add a custom variable to a vault Added Remove-RDMVaultCustomVariable to remove custom variables from a vault Added Set-RDMVaultCustomVariable to modify a vault's custom variables Improvements Added Scope and Before parameters to Remove-RDMDeletedEntry to enable mass-removing deleted entries before a given time Updated cmdlet help for Update-DSEntryBase and New-DSEntryBase to recommend -Depth 10 when piping entries through ConvertTo-Json, preventing a type conversion error on deep properties such as lifecycle policy actions Fixes Fixed Devolutions.PowerShell.Extension already loaded preventing the import of Devolutions.PowerShell Fixed Invoke-RDMEntryCheckOut preventing checkouts for entries set to multiple/infinite checkouts Fixed Set-RDMEntryProperty with WhatIf still modifying property of entry

New Features Added Get-DSApplicationIdentity to retrieve the list of application identities Added Get-RDMApplicationIdentity to retrieve the list of application identities for the current data source Added Get-RDMHubVaultAccess to retrieve permission assignments for a Devolutions Hub vault Added New-RDMHubVaultAccess to create a PSVaultPermissionInfo permission assignment object linked to a user, user group, or application identity Added PSVaultPermissionInfo output object exposing individual permission flags (EditEntries, ManageAttachments, etc.) Added Publish-DSGatewayRevocationList to publish revocation lists for one or all gateways Added Remove-RDMHubVaultAccess to remove permission assignments from a Devolutions Hub vault Added Set-RDMHubVaultAccess cmdlet to replace the full set of permission assignments on a Devolutions Hub vault Improvements Added -Account and -PrivilegeSetName parameters to Update-DSPamProvider to assign a PAM account to the specified JIT privilege sets on the provider Added -IsJitAccount parameter to New-DSPamAccount to mark a new account as a JIT account Improved Update-RDMUI reliability after RDM process restart Fixes Fixed Add-RDMEntryAttachment -PassThru returning no results when used with a DVLS or Hub data source Fixed favorites not being added when using Add-RDMFavoriteEntry

Improvements Added `-AlwaysAskForOldPassword` parameter to `New-RDMRepository` and `Set-RDMRepository` to require the current master password to be verified before it can be changed or cleared. Added `-MasterPassword` parameter to `New-RDMRepository` and `Set-RDMRepository` to protect the vault with a password. Added `-OldMasterPassword` parameter to `Set-RDMRepository` to supply the current master password when changing or clearing it on a vault with **Always ask for old password** enabled. Added `-Owners` parameter to `New-RDMRepository` and `Set-RDMRepository` to assign vault owners. Added `-SortPriority` parameter to `New-RDMRepository` to set the vault's sort priority. Added `-VaultSecurityLevel` parameter to `New-RDMRepository` and `Set-RDMRepository` to set the security level of the vault (DVLS only). Added `-Visibility` parameter to `New-RDMRepository` to control who can request access to the vault. Improved `PSRepositoryInfo` format to allow direct modification of more vault properties: `AlwaysAskForOldPassword`, `ContentType`, `Owners`, `SortPriority`, `VaultSecurityLevel`, and `Visibility`. Fixes Fixed an issue where `Get-RDMOAuthToken` threw a type initializer exception for `System.Text.Json.JsonSerializer`. Fixed DPS cmdlets failing on Linux with the error: `Microsoft.Data.SqlClient is not supported on this platform`. Fixed `Export-RDMOptionFile -Datasources` silently clearing datasource credentials from the current option file.

Fixes Fixed an issue preventing connections to advanced data sources

Fixes Fixed an issue where the -DeobfuscateSensitives parameter of Export-HubEntriesForExport had no effect when exporting entries to CSV, causing passwords to remain encrypted

Breaking Changes Database upgrade required Removed support for Dropbox and Google Drive data sources. New-RDMDataSource no longer allows creating these types New Features Added Convert-DSGatewayKDCProxySettings to extract KDC proxy settings from a gateway Added Enable-RDMTelemetry and Disable-RDMTelemetry cmdlets to control anonymous usage statistics collection in the PowerShell module Added Get-DPSDatabaseVersion to retrieve the Devolutions Server database version Added Get-DSLoginAttempt to retrieve login attempts Added Get-RDMEntryPrivateKeyCertificateData cmdlet to retrieve embedded SSH certificate data as SecureString or plain text Added Get-RDMEntryTags to retrieve an entry's tags Added New-DSGatewayKDCProxySettings to create KDC proxy configuration objects Added New-DSGatewaySecurity to create GatewaySecurity objects Added Set-RDMEntryPrivateKeyCertificateData cmdlet to set embedded SSH certificate data and automatically configure the certificate type to Data Added Set-RDMEntryTags to modify an entry's tags Added Start-DSTrial cmdlet to activate a Devolutions Server trial license Improvements Added -AsHandbook parameter to Get-RDMEntryDocumentation to return legacy PSHandbook format for backward compatibility Added -Filter parameter to Get-RDMEntryDocumentation to search both title and content for backward compatibility Added -NoEnumerate switch parameter to Invoke-RDMLoadFromInventorySession to optionally return results as a collection instead of individual objects Added -PassphraseMaximumLength parameter to set a maximum length limit (0-100 characters) for generated passphrases in New-RDMRandomPassword Added support for appending special characters to passphrase words in New-RDMRandomPassword to better meet password complexity requirements Added support for using a raw database connection string in DPS cmdlets Added warning when a user without a license connects to a SQL Server data source Aliased redundant Session cmdlets to their equivalent Entry cmdlets (e.g., Get-RDMSession is now an alias of Get-RDMEntry) Improved error messages when creating entry types that are not supported in certain vaults Improved RDMEntryDocumentation cmdlets to provide clear error messages for unsupported data sources Renamed -PassphraseLength parameter to -WordCount for clarity (the old parameter name still works as an alias) in New-RDMRandomPassword Reworked telemetry collection in the PowerShell module to track anonymous usage statistics (cmdlet names, module version, data source type, and platform information) Updated gateway cmdlets (New/Update for Gateway, VirtualGateway, and GatewayFarm) to accept the Security parameter Updated New-DSGateway and Update-DSGateway to accept KDC proxy settings with the KdcProxySettings parameter Fixes Fixed a null reference exception when using Set-RDMEntryDocumentation on a SQLite data source Fixed an issue where multiple cmdlets incorrectly allowed the root entry to be provided Fixed an issue where the Get-RDMEntry cmdlet would incorrectly return entries when the required license was not available Fixed Get-DSEntry forcing users to provide a VaultID when -SearchAllVaults is specified Fixed Get-RDMEntryPassword verifying unnecessary permissions Fixed Invoke-RDMLoadFromInventorySession to process all sessions in an array instead of stopping after the first error Fixed multiple cmdlets returning a "not found" error when provided with the root entry Fixed New-RDMEntry with the Set parameter to not return a newly created entry if the save operation fails Fixed PowerShell cmdlet validation to check entry subtypes against vault content type restrictions when creating new entries

New Features Added cmdlets (Get-RDMSystemSettingsTags, Set-RDMSystemSettingsTags) for managing system tags at the data source level Added ConvertTo-DSAccountLifecyclePolicyInfo to convert a provider's lifecycle policy to the user-friendly PSAccountLifecyclePolicyInfo format Added Get-DSAccountLifecyclePolicy to retrieve account lifecycle policies Added Get-DSPasswordPolicy to retrieve password policies Added New-DSAccountLifecyclePolicyInfo to create a new account lifecycle policy object in the user-friendly PSAccountLifecyclePolicyInfo format Added New-DSGatewayFarm to create new gateway farms Added Set-DSEntryProperty cmdlet to modify an entry object's properties (including nested properties) Added Update-DSGatewayFarm to update gateway farms Improvements Added AccountLifecyclePolicy parameter to New-DSPamProvider and Update-DSPamProvider to set a PAM provider's account lifecycle policy Added Application parameter to New-DSPamVault to set a PAM vault's permitted application identities Added Description and WaitTime parameters to New-RDMPlaylistShared Added DomainController parameter to New-DSPamProvider and Update-DSPamProvider, enabling users to set a PAM provider's domain controller Added Gateway parameter to New-DSPamProvider and Update-DSPamProvider, enabling users to set a PAM provider's gateway Added Name, Description, and WaitTime parameters to Set-RDMPlaylistLocal and Set-RDMPlaylistShared Fixes Added validation to ensure WaitTime parameter cannot be set below 200 milliseconds to align with Devolutions Remote Desktop Manager application limits Inverted position of Connections and Description parameters in NewRDMPlaylistLocal

New Features Added Get-DSDeletedUser and Get-RDMDeletedUser cmdlets to retrieve paginated list of deleted users (Devolutions Server only) Added Get-RDMForbiddenPassword to retrieve forbidden passwords Added Remove-DSDeletedUser and Remove-RDMDeletedUser cmdlets to permanently remove deleted users (Devolutions Server only) Added Remove-RDMPlaylistLocal to remove local playlists Added Remove-RDMPlaylistShared to remove shared playlists Added Restore-DSDeletedUser and Restore-RDMDeletedUser cmdlets to restore deleted users (Devolutions Server only) Added Set-RDMForbiddenPassword to update the forbidden password list Fixes Fixed "Not Implemented" exception when moving entries to an existing folder - users are now prompted to merge the folders or create copies Fixed checkout validation logic that was incorrectly blocking all move operations with a "checkout active" error, even when no entries were checked out by other users Fixed Open-RDMSession causing an unexpected guid format in Remote Desktop Manager

New Features Added New-RDMStandalonePassword for password generation usable in all workflows (RDM, DS, Hub) Fixes Fixed Get-RDMTemplate incorrectly filtering certain edge cases Fixed stack overflow error occurring in specific scenarios when writing to the host

Improvements Added Backup-DPSConfigurationFile and Backup-DPSInstallationFiles to backup DVLS files before updates Added Get-DPSProduct to download the latest DVLS version for Linux or Windows Added Restore-DPSConfigurationFiles, Restore-DPSCustomFolders, and Restore-DPSAnomalyDetectionFolder to restore DVLS files after updates Added the IsDefault property to PowerShell data source objects, allowing users to easily identify which data source is configured as the default when using cmdlets like Get-RDMDataSource Export-RDMSession now adds the extension of the chosen format automatically Fixes Fixed bug where Update-DSPamFolder would create a virtual folder on name update Fixed issue where cmdlets used in a Linux context could not find the appsettings.json file due to case sensitivity

Database upgrade required Deprecated Devolutions Onlive Drive is no longer supported and cannot be created in New-RDMDataSource Data source types FTP, SFTP, S3 and Hub Personal Legacy have been removed from the application New Features Added ApiKey parameter in New-DSSession to connect with a user's api key Added Export-RDMCustomVariable to export custom variables Added Get-DSEntryDocumentation to retrieve an entry's documentation Added Get-RDMPasswordPolicy to fetch password policy by name Added Get-RDMUserOfRole to retrieve the users of a group Added Import-RDMCustomVariable to import custom variables Added New-DSEntryDocumentation to create a documentation page Added PasswordPolicy parameter to Set-RDMEntryPassword to generate password from policy Added Remove-DSEntryDocumentation to delete a documentation page Added support for attachments in Send-RDMMessageByShareableLink and Send-RDMMessageByEmail cmdlets Added support for custom dictionaries in New-RDMRandomPassword passphrase mode generation Added support for Netbox, Custom PowerShell, and JAMF synchronizers Added Update-DSEntryDocumentation to update a documentation page Improvements Added automatic checkout to Set-RDMEntry cmdlets Added source code, json, configuration, dockerfile, and Terraform document support Added the parameter TicketNumber to Invoke-DSPamCheckout to populate the checkout request with the specified value Added warnings to deprecated parameters in Import-DSPamScanResult Improve the parameter AllowedApplicationsList in Set-DSVaultApplication to accept either the application ID or the name Make VaultID parameter mandatory in Get-DSEntries when using the FolderID parameter instead of using a default value Set-RDMDataSource now triggers a forced refresh of data sources in the active Remote Desktop Manager instance Fixes Added handling for more group name edge cases in Set-DSEntityPermissions Fix Get-DSEntries returning a null reference when trying to access to a forbidden vault Fixed Get-RDMRole -Name parameter validation failing for newly created roles Fixed New-DSPamFolder creating folders with obsolete type

New Features Add Get-RDMAddOnId to obtain the connection subtype for an add-on entry Improvements Enable modification of the HashiCorpVaultToken property by adding a setter Fixes Fixed missing sqlite3secure.dll dependency on a clean Windows installation Fixed missing System.IO.Pipelines dll in an Enter-PSSession context Fixed missing types when creating entries

Improvements Clarification on modifiable properties within the PowerShellSetting property in PSScriptConfiguration object Fixes Fixed changing the TargetResources property always returning an error in the PSScriptConfiguration object Fixed Get-DSEntry ignoring VaultID when the All parameter is used Fixed Get-DSEntry not returning subentries when the All parameter is used Fixed missing default status when creating entries with RDM cmdlets Fixed wrong property value on an AnyIdentity provider in PSScriptConfiguration object

Improvements Improve error message when sqlite3secure.dll is missing a dependency on a clean Windows install Improve error message when unable to fetch public server information with New-DSSession Fixes Fixed an issue where using Get-RDMEntry -VaultMode Global in PowerShell caused a crash on unsupported data sources such as SQLite Fixed hub application not being allowed to import vault in existing vaults with Import-RDMRepository cmdlet Fixed hub application requiring the "Manage Vault" right when using Import-RDMRepository cmdlet

New Features Create a new PSPamPropScriptConfiguration object, which can be utilized to define the parameters for a PAM script configuration, with New-DSScriptConfiguration Retrieve a PAM AnyIdentity template by its name using Get-DSPamProviderTemplate Retrieve a specific PAM script configuration by its ID using Get-DSScriptConfiguration Retrieve a specific PAM script configuration template by ID using Get-DSScriptTemplate Return a summary of all PAM script configuration templates using Get-DSScriptTemplateSummary Return a summary of all PAM script configurations using Get-DSScriptConfigurationSummary Save a specified PAM script configuration using Set-DSScriptConfiguration Improvements Enable Hub application identities to utilize the Import-RDMVault cmdlet with the appropriate permissions Fixes Fixed all license assignments that are missing when the user is not an administrator when using Get-RDMLicense Fixed DS cmdlets failing with the WebApiRedirect status Fixed New-RDMEntry cmdlet ignoring the VaultMode parameter

Improvements Add a new cmdlet New-RDMConnectionPermission to instantiate the ConnectionPermission object Improve error message for denied scripting access Fixes Fix Active Directory filters not applied when using Open-RDMSyncSession Fix New-RDMDataSource incorrectly loading the default data source when invoked as the first cmdlet

New Features Add Get-RDMEntryFromSmartFolder cmdlet to retrieve entries from smart folder search results Add Get-RDMUserRoles cmdlet to retrieve all groups associated with a specified user Improvements Add VaultRoleOverride and CustomVaultAccess parameters to Update-DSGateway cmdlet to manage vault access in a gateway Improve Get-RDMEntryOTPKey cmdlet to support all resolution modes instead of only the configured one Fixes Fix receiving prompt for shared vault password when accessing the user vault Fix the non-functional Remove-DSUser cmdlet Resolved issue with Get-DSPasswordsReport causing a deserialization error when an application identity is not utilized

Breaking changes Get-DSPamScanResult now returns a unified object across all result types, with certain properties either missing or renamed (upn => UserPrincipalName, FullName => Name) (HostID, DomainName, ADDomainID, AlreadyCreated, CanBeAdded are all removed) Get-RDMEntryOTPKey requires an administrator or vault owner to use as it is required in RDM New Features Add Export-RDMX509Certificate cmdlet to export the certificate of an X509 certificate entry Add Import-RDMX509Certificate cmdlet to import the certificate into an X509 certificate entry Enable new permission to prevent modifications to session recording properties Enable new permission to prevent modifications to VPN/Tunnel/Gateway properties Improvements Add basic IIS support when creating a configuration with DPS cmdlets Improve Get-RDMEntryOTPKey cmdlet to work with all entries with OTP directly configured instead of only OTP credentials Support optional checkout mode for linked PAM account credentials Fixes Resolve variables in the entry name in the confirmation message when unsealing the entry with Unprotect-RDMSealedEntry

New Features Add 'Export-DPSEncryptionKeys' cmdlet to export an encryption key file from a Devolutions Server instance Add 'Import-DPSEncryptionKeys' cmdlet to import an encryption key file into a Devolutions Server instance

Fixes Resolved connection issue with an application on a DVLS data source Resolved issue related to data retrieval deserialization for users, roles, and entries with non-application users

Improvements Enhance Set-RDMCurrentRepository to apply the ID parameter before the initial load Fixes Fixed folder created as a shortcut in XML data source Fixed sql error occurring when calling Update-DPSDatabase

New Features Add 'Get-DSOktaUser' and 'Import-DSOktaUser' cmdlets to enable the import of Okta users Integrate 'Add-DSPlaylistEntry' to add connections to an existing playlist Integrate 'New-DSPlaylistEntry' to establish a new playlist Integrate 'Remove-DSPlaylistEntry' to remove connections from an existing playlist Improvements Enable setting the client secret of an Azure Key Vault entry directly from the PSConnection Enable the property 'Key' in Set-RDMEntryOTP to accept either a string or a secure string 'Get-RDMEntryOTP' and 'Set-RDMEntryOTP' now support OTP in password list by utilizing the new parameter 'PasswordListItemID' or receiving prompt Include 'Name' property to the PSPasswordListItem object Parameter 'Connections' added to 'New-RDMPlaylistShared' and 'Set-RDMPlaylistShared' cmdlets to facilitate adding connections in a playlist Transform 'Get-RDMSessionOTP', 'Set-RDMSessionOTP', 'Get-RDMPrivateSessionOTP', and 'Set-RDMPrivateSessionOTP' as aliases to the corresponding 'RDMEntryOTP' cmdlet

New Features Add cmdlet "Unlock-RDMApplication" to access the application when it is password-protected Improvements Update the minimum PowerShell version requirement to 7.5.0 Include a notification in Get-DSServerLicense indicating that from DVLS version 2025.1.0.0 onwards, a server license is no longer necessary Include a notification in Register-DSServerLicense indicating that from DVLS version 2025.1.0.0 onwards, a server license is no longer necessary The parameter "PamAccount" of Update-DSPamAccount now accepts the PAM account ID Fixes Fixed "Open-RDMSyncSession" failing when using the option "Use LDAP over SSL" Fixed bypass of password-protected vault Fixed missing file name in error message from Import-RDMSession Fixed Set-RDMSession and Set-RDMEntry returning the error 'Connection has an invalid group specified' when saving multiple entries in Devolutions Server data source Fixed SQL permission issue when non-admin user assigned to a group with admin rights Resolved the issue with password resolution in Devolutions Server and Hub data sources for Get-RDMSessionPassword and Get-RDMEntryPassword