Support

Hi everyone, I'm looking for architectural best practices regarding credential handling in a hybrid scenario. Our Setup & Problem: Users authenticate to our web app (PowerShell Universal) using Azure AD / Entra ID . However, the app needs to perform remote actions on local On-Premises PCs (via WinRM/CIM). Because the Azure identity cannot be used directly for local Windows authentication, we need a separate set of Active Directory credentials. What we want to achieve: Prompt the user inside the app for their local Windows/AD credentials. Cache these credentials securely only for the duration of their browser session (they must expire when the browser is closed). Reuse the cached credentials during the session to query remote PCs by passing them to background jobs via Invoke-PSUScript. My Questions: What is the most secure way to temporarily store a PSCredential object in the server's session memory (e.g., $Session scope) without risking plaintext exposure? How do you reliably ensure the credentials are wiped as soon as the user closes the browser? Are there better alternative architectural patterns for this specific "Azure App to On-Premises Management" transition? Serviceuser aint an Option. Thanks in advance for your advice!

After upgrading PowerShell Universal from 2026.1.7.0 to 2026.2.1.0 , the functions used by our endpoints and apps are no longer being recognized. For some context, the environments used by our endpoints and apps are configured to run a script at runspace startup that dot-sources all of our functions. This setup has worked correctly in all previous versions, but it stopped working immediately after the upgrade. Has anyone else experienced the same issue or found a workaround?

Hi, The developer licensing model changed over the last few versions and it now breaks our setup. Previously, purchasing a license also let us create offline developer licenses. Now the Developer Edition requires signing in with a Devolutions account, which needs internet access, and an offline dev license no longer seems to be available. Our situation: Our development server has no internet access. It's isolated because it holds sensitive data. Company policy doesn't allow developing locally on workstations, so we can't develop off that server. We connect from the workstation to the dev server via VS Code Remote Tunnels, start the Universal instance there, and forward the port with dev tunnels. Signing in with a Devolutions account in this setup isn't possible. We already hold normal licenses for our production and test systems. It's only the local/isolated development case that used to work and now doesn't. The PSU instance on the dev server is started only during development, stopped afterwards, and used by a single developer. As far as we can tell, the Developer Edition can't work here, and there's no offline dev license anymore, so this path is closed for us. What we'd like to know: What do you recommend for teams working in an isolated/offline setup like this? Is there a supported way to keep developing without internet access on the dev machine? We've been working this way for a while and are now blocked, so a clear recommendation on the intended path would be much appreciated. Thanks, Wolf

Hi, After upgrading from 2026.2.1 on 3 different containers to 2026.2.2, the license is now considered invalid. [image] Re-adding the license fails, even that the license is valid. Downgrading to 2026.2.1 "fixes" the issue. Update: Its also an issue on Windows deployments.

Hi, we still get this warning whenever a page with New-UDTabs -RenderOnActive is opened: "[Warning] [App-Development] RenderOnActive is deprecated and will be removed in 4.0" The deprecation was tracked in https://github.com/ironmansoftware/powershell-universal/issues/1937 with the note that -Dynamic on New-UDTab should be enough. The same question was already asked on the but never got an answer ( RenderOnActive is deprecated and will be removed in 4.0? - PowerShell Universal - Ironman Software Forums ). We're on 2026.1.7 now, -RenderOnActive is still a valid parameter, and the warning is still emitted. Could someone clarify what the current status of this is and what the recommended migration path looks like? Thank you

The folder view for scrips does not show folders. I can create sub-folders in the ui and they get correcly created on disk, but will not show up in the folder explorer. [image] I m on Version 2026.2.0 Not quite sure if I do something wrong, or there is an issue somewhere...

I created an unauthenticated API Endpoint "/getData" which uses variables and the $Secret scope to connect to other APIs and return aggregated data. Issue1: the endpoint could not read all secrets and threw a security exception despite none of them had any role restrictions. Recreating the secrets worked, so some update must have corrupted the permission requirements of the secrets. Not sure if this is worth looking into. Issue2: the endpoint needs to run an internal script via Invoke-PSUScript -Integrated -Script 'AuthorizeToAPI.ps1' -Wait that handles the authentication to that external API. That script is able to be run unauthenticated, but needs update variables/secrets. This is what I used: $AccessTokenVar = Get-PSUVariable -Name "AccessToken" $AccessTokenLifetimeVar = Get-PSUVariable -Name "AccessTokenLifetime" $TokenResponse = Invoke-RestMethod "<externalAPIauthentication>" -Method 'POST' -Headers $Headers -Body $Body Set-PSUVariable -Variable $AccessTokenVar -Value $TokenResponse.Token Set-PSUVariable -Variable $AccessTokenLifetimeVar -Value $TokenResponse.LifeTime which worked fine until the last update and suddenly returns an error: Permission denied. The role specified does not have access to this resource. Since Issue1 clearly pointed to some update corrupting role requirements to variables, I m at a loss on what is intended behavior and what is not. Are integrated scripts not able to use Get/Set-PSUVariable or did more permissions get corrupted? Help would be much appreciated :)

Good moring PSU-Community, i have a question regarding agents and their handling after the target system got deleted. Since i wasn`t able to find information regarding this in the documentation or the forum, i decided to open up this thread. Right know the agent ist marked as offline under platform/computer in the PSU-web-UI and i would like to delete it or mark it as deleted. As far as i can tell there is no button in the web-UI or PowerShell-Cmdlet in the "Universal"-module to do that. When i use the command "Get-PSUComputers" and filter it to the coresponding agent, there is a property called "deleted", which right know is set to "false". With "Set-PSUComputer" i also can`t change the mentioned property and as far i an tell ther is no other command for deleting or softdeleting the agent-computer. Can you tell me the intended way to clean up old agents? Thanks in advance and greets from Germany, Markus

Hello, We are running GIT for our production PSU which is 2026.1.1. It is currently configured for PUSH Only. We were curious if anyone has setup a test server and changed the Production to PULL while the "test" server was pushing Production changes? We have never done this before so any guidance from the community would be helpful for us.

The current PowerShell host is: 'Universal Automation Host' (version 1.0). The module 'C:\Program Files\PowerShell\Modules\Kemp.LoadBalancer.Powershell\Kemp.LoadBalancer.Powershell.psd1' requires a minimum PowerShell host version of '2.0' to run. Running 2026.2.0. Running this script specifically in Windows PowerShell 5.1 environment. Script is literally just loading the module and then Get-Module. Not sure how to get around this.

Hey, I`am wondering about the licensing in Powershell Universal. I know you have access to the full feature set for free in the Developer Version, but that version is prohibited for production use. So could I use PowershellUniversal for small production usecases without a license? I know multiple features are missing when unlicensed, but if i dont need those for the specific usecase, could I deploy it in production? Thanks in advance, Fabian

Just upgraded to 2026.2.0, playing about with Workflows and when I schedule a workflow it doesn't fire. Log gives this error: Scheduling job 'test' with schedule sdfsdfsdf on time zone (UTC+00:00) Dublin, Edinburgh, Lisbon, London 2026-06-05 09:46:37.774 +01:00 [WRN][Hangfire.AutomaticRetryAttribute] Failed to process the job '25': an exception occured. Job was automatically deleted because the retry attempt count exceeded 0. System.NullReferenceException: Object reference not set to an instance of an object. at PowerShellUniversal.Automation.ExecutionService.Execute(ExecutionOptions executionOptions) in D:\a\powershell-universal\powershell-universal\src\PowerShellUniversal.Automation\ExecutionService.cs:line 145 at InvokeStub_TaskAwaiter.GetResult(Object, Object, IntPtr*) at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) Also, attempted to work around it by creating a script with Invoke-PSUWorkflow as per PSU documentation and schedule that up, but I get "The term 'Invoke-PSUWorkflow' is not recognized as a name of a cmdlet, function, script file, or executable program." Seems as though that cmdlet is not included despite the documentation thinking otherwise..? Get-Command -Module Universal | Where-Object Name -like '*Workflow*' CommandType Name Version Source ----------- ---- ------- ------ Cmdlet Get-PSUWorkflow 2026.2.0 Universal Cmdlet New-PSUWorkflow 2026.2.0 Universal Cmdlet New-PSUWorkflowActivity 2026.2.0 Universal Cmdlet New-PSUWorkflowParameter 2026.2.0 Universal Cmdlet Remove-PSUWorkflow 2026.2.0 Universal Cmdlet Set-PSUWorkflow 2026.2.0 Universal

Hey all, not sure if this is a bug or not. Version 2026.2.0, browser Edge I've set up my roles.ps1 file to have different claimvalues based on groupsid of different groups in active directory. So basically a PSU_Admins, PSU_Operators, PSU_Readers, and PSU_Users (basically authenticated users). All this works properly if looking at "My Identity" page and verifying roles. My problem is that any time a user (or I'm using a different account) doesn't have an exact permissions binding, browsing is incredibly slow in apps or the admin page. I feel like it's checking the claim on each page instead of once on logon. Since my account is explicitly declared as Administrators, browsing is quite fast for me. Any account that I set up with explicit permissions is also fast, local accounts are also unaffected. Is there anything else I can do to test or find logs?

Hi, not sure if this a bug or i do something wrong. Im using the Autocomplete Component to select one or more users from a list. For the Name i build something out of Username and the Title / Position and the Value is the ObjectGuid for the script to use afterwards. If i now select one entry it works without a problem, but as soon as i add another different entry, the one before transforms into the Value instead of showing the Name. The code for the Autocomplete Component ist the following: The $ADUsers is a cached list of our AD Users. New-UDAutocomplete -Id "txtMailboxAccess" -Label "User" -Multiple -FullWidth -Icon (New-UDIcon -Icon "user" -Solid) -OnLoadOptions { $ADUsers | Where-Object {$_.userprincipalname -like "*$Body*" -or $_.samaccountname -like "*$Body*"} | ForEach-Object { New-UDAutoCompleteOption -Name "$($_.displayName) ($($_.title) | $($_.department))" -Value $_.ObjectGuid } | ConvertTo-Json } [image] Does anybody know how to solve this? Thank you!

Hello, I'm trying to work with the Management API on Powershell Universal 4.4.1. I'm trying to filter jobs run using the GET /api/v1/job endpoint. However, parameters does not seem to have any effect ( Take / Total / OrderDirection / Scheduled etc... ) on the filtering of the query. Goal would be to filter for instance x last jobs triggered via Scheduled. What is the proper way to use the parameters ?

While I understand that Microsoft no longer supports Send-MailMessage (but doesn't have a replacement, yet)....I can do the following from PowerShell (on the server hosting PSU), but not within PSU itelself when I try to use Send-MailMessage and embedding an image in an e-mail. $Attachment = New-Object System.Net.Mail.Attachment -FilePath [image] however, within PSU - when I hit that point in the Web App - I get a "could not find System.Net.Mail.Attachment". [image] My understanding is that this isn't a module that I need to import, however I can't seem to get the app to load it.

Having read some good review i thought I'd try this in Azure I followed the video on YouTube and also found instructions on ironmansoftware but I'm on the point of giving up Using the docker image ironmansoftware/universal 2026.2.0-azure The web app just times out on start-up. Set the WEBSITES_CONTAINER_START_TIME_LIMIT to 1800 Error logs don't really say much useful. Can't find anything about problems running it in Azure webapp Don't know what else to do. other than look for an alternative product

We have roles setup for different user bases that are just setup to look if they are members of groups in Entra since we use SSO. For one of our groups/roles (BadRole), when they go to a page that they are allowed to go to, they get the following error: One or more errors occurred Status(StatusCode="Internal", Detail="Error starting gRPC call. HttpRequestException: Requesting HTTP version 2.0 with version policy RequestVersionExact while unable to establish HTTP/2 connection.", DebugException="System.Net.Http.HttpRequestException: Requesting HTTP version 2.0 with version policy RequestVersionExact while unable to establish HTTP/2 connection.") [image] When I go to the page as my administrator role, it works fine: [image] It's a simple form that doesn't checking of roles or do any permission specific lookups: New-UDGrid -Item -ExtraSmallSize 3 -Content { $Session:RNOutput = 'None' New-UDForm -SubmitText "View Info" -ButtonVariant contained -Content { New-UDTextbox -Id "RNLocID" -Placeholder "LocID" -Label "LocID" New-UDSelect -Label "Select a Page" -Id "TableSelect" -Option { New-UDSelectOption -Name "SiteMain" -Value "SiteMain" New-UDSelectOption -Name "Location" -Value "Location" New-UDSelectOption -Name "Equipment" -Value "Equipment" New-UDSelectOption -Name "Circuits" -Value "Circuits" New-UDSelectOption -Name "Phone Lines" -Value "Phones" New-UDSelectOption -Name "Work Orders" -Value "WorkOrders" New-UDSelectOption -Name "Employees" -Value "Employees" New-UDSelectOption -Name "AV" -Value "AV" } -DefaultValue "SiteMain" } -OnValidate { $FormContent = $EventData if ($FormContent.RNLocID -eq $null -or $FormContent.RNLocID -eq '') { New-UDFormValidationResult -ValidationError "The LocID is required" } Else { New-UDFormValidationResult -Valid } } -OnSubmit { Invoke-UDRedirect -Url "/OurSite/$($EventData.RNLocID)/$($EventData.TableSelect)" } } The UDPage has this at the top: New-UDPage -Url "/OurSite" -Name "OurSite" -Role @('Administrator', 'BadRole') -Content { ... There is nothing the PSU logs at the time of loading the page, we do not use a proxy internally and we do have our site behind a load balancer. We did however, test going directly to the PSU servers (we have 2) and not thru the load balancer and the issue still remained. We are currently on version 2026.1.6 and tested it on 2026.2 in our QA environment with the same issue. Any ideas?

Hello due to certain security restriction i had some issues starting powershell universal as a service (service cannot access easily internet). while i'm working on a POC, i tried to execute as zip/portable version, where i have a better control to the proxy access. unfortunatelly, each time i start Start-Process .\Universal\Universal.Server.exe , when i connect to the web page First-run , it start black, nothing appear http://localhost:5000/first-run in the console the last lines are 404 with Blazor [18:27:50 INF] Microsoft.AspNetCore.Hosting.Diagnostics Request finished HTTP/1.1 GET http://localhost:5000/first-run - 200 null text/html; charset=utf-8 1455.5383ms [18:27:51 INF] Microsoft.AspNetCore.Hosting.Diagnostics Request finished HTTP/1.1 GET http://localhost:5000/_framework/blazor.server.js?v=2026.2.0 - 404 0 null 365.1191ms [18:27:51 INF] Microsoft.AspNetCore.Hosting.Diagnostics Request reached the end of the middleware pipeline without being handled by application code. Request path: GET http://localhost:5000/_framework/blazor.server.js, Response status code: 404 any suggestion?

We have a deployment that we configured OIDC on and this is working as expected. Now I have a use case for Windows Authentication for API endpoints. I am able to use Windows Auth properly when OIDC is disabled or Windows Auth is defined first. But Defining Windows Auth first breaks OIDC for the portal. Is there a supported way for these two configurations to coexist? We have PSU installed as a service and when OIDC is defined first I get a 401 unauthorized when trying to use the -UseDefaultCredentials parameter of Invoke-RestMethod against an API endpoint. I found reference to a header X-Windows-Auth but trying this did not change the result.

Hi, I'm attempting to use ssh keys instead of username/password credential with Azure devops. After generating the credential on PSU and entering it into the keys section in the cloud, I keep encountering this when trying to sync: [image] Hoping for a little insight on where to go for troubleshooting this further!

Product: PowerShell Universal Version: 5.5.5 Hey PSU folks, I have an environment where Okta workflows will call PSU APIs, which will create a JSON “staging” file in a folder relevant to the API/script. From there I have job scripts on schedules that run so often, check for staging files, and when found the scripts import them and take actions. Grand total I have 14 scheduled jobs running per hour. When there’s no staging files, the scripts simply exit and there’s very little written to the PSU Jobs. When there are staging files, they import them, take actions, and most things are written to the PSU Jobs stream and logged in the PSU Jobs. At first, I had no issue with the Automation / Jobs page loading all the jobs. Here lately the Jobs page will not load and just sits there spinning like it’s trying to load the jobs data, but it won’t. Usually on a reboot the jobs will load for a day or two, but after that they will not. When I click on Automation / Jobs and it’s trying to load the Jobs, I notice the resource usage on the server starts climbing until there are no more resources. I doubled the resources on the server, but that didn’t help. Also, when I click on Automation / Jobs and it’s stuck spinning I can’t click out of it. I’ll click something else and the URL in the browser will update, but it will not browse to the newly clicked location. I then have to click refresh on the browser for it to leave the Jobs page and go to the newly clicked page. Note that in my Sandbox environment we have an exact copy of this setup, except the schedules are disabled and we manually trigger the job scripts there. That environment loads the Jobs page every time without issue, but there are far fewer jobs in that environment. Any ideas? At 14 scheduled jobs per hour, am I simply writing too many jobs for it to load them? Is there some sort of limit, roll over, or other settings I can configure to keep only 14 days’ worth of jobs, so they load? Thanks, Rob

Product: PowerShell Universal Version: 2026.1.6 After upgrading from 5.2.1 to 2026.1.6, I'm having an issue with New-UDSelect. The default value, nor a selected value, show in the text box anymore. When clicking the dropdown, the options are there but when clicking one it does not show the value in the text box. However, on the backend the selection is good. Clicking submit on the form passes validation and the ticket that is opened has the correct value listed. It's a front end issue, where the user cannot see any value in the box; whether it's the default value or a selected value. Seems to be related to https://forum.devolutions.net/topics/54901/bug-new-udselectgroup I found that if I remove my theme, the issue goes away. My theme is Material Ui based, so I commented out all the Mui overrides from the theme file then added them back in one at a time. I found the one that is having trouble is MuiListItemText. When you click the dropdown box to see the selections, I have the background set to a dark shade of gray and when hovering it changes to a lighter shade of gray. For contrast, I have the text color set to white "#ffffff" in MuiListItemText. When you click the dropdown box you can read the text as it's white. Normally, the text in the New-UDSelect text box remains as default, black. It's been working this way for 5 years, but now that I've upgraded to 2026.1.6 it seems the text in New-UDSelect box and the text of the selections are treated as the same color as what's in MuiListItemText. If I set MuiListItemText to a different color, I can see the default and selected values in the box, but it makes the text in the dropdown selections funky. So, it seems the text of the New-UDSelect value box and the text of the dropdown items used to be different, but now they're being seen as the same??? This is how it has been looking for the past 5 years. White text in the dropdown selections using MuiListItemText, and default/black text in the text box. [image] How it looks after upgrading to 2026.1.6. Notice you can't see anything in the text box. [image] How it looks if I change MuiListItemText to a different color, like black. [image] How it looks if I remove theming. [image] Code for the New-UDSelect $theme = Import-PowerShellDataFile '<Full path to theme file>.psd1' New-UDDashboard -Title 'Page Testing' -Content { New-UDSelect -Id 'select_region' -Label 'Region:' -Option { New-UDSelectOption -Name 'Central US' -Value 'centralus' New-UDSelectOption -Name 'West Europe' -Value 'westeurope' } -DefaultValue 'centralus' } -Theme $theme Code in my theme.psd1 file, from the overrides section. overrides = @{ MuiListItemText = @{ primary = @{ color = '#ffffff' fontSize = 14 fontWeight = 500 } }# MuiListItemText }# Overrides Unfortunately, I learned what I needed to know about Mui 5 years ago; just enough to get this theme created. I haven't worked with it since, so I can't take the troubleshooting any further. Seems this may be an issue with PSU, where the MuiListItemText is now being applied to both locations? For now I can change MuiListItemText color to black, as a work around. Would this be fixed in a future PSU update, or do I need to somehow put something else in my theme file, in my Mui overrides, to have the text be different colors between the dropdown selections and the text box text? Thanks, Rob

On a fresh Windows MSI install of v2026.2.0.0 of Powershell Universal, when attempting to login with my Devolutions account it redirects to this URL: http://localhost:60370/rdm-auth-loopback And fails with "localhost can't currently handle this request. HTTP ERROR 500". I can complete the setup by creating the local admin user and running unlicensed, but I'd like to have access to the full feature set.

Product: PowerShell Universal Version: 2026.1.5 Hello everyone, I currently have a (serious) problem with a dispatcher script that throws errors when executing around 150 scripts, for some of them: Status(StatusCode="Unknown", Detail="Exception was thrown by handler.", DebugException="Grpc.Core.Internal.CoreErrorDetailException: {"created":"@1778133607.433000000","description":"Error received from peer ipv6:[::1]:50383","file":"..\..\..\src\core\lib\surface\call.cc","file_line":953,"grpc_message":"Exception was thrown by handler.","grpc_status":2}") Failed to check concurrency limits.: SQLite Error 5: 'database is locked'. , Status(StatusCode="Unknown", Detail="Exception was thrown by handler. SqliteException: SQLite Error 5: 'database is locked'.") and SQLite Error 5: 'database is locked' . It is only a handful of scripts, but this could cause major issues in the production environment. For executing the 150 scripts I use several predefined caches, which save me from constantly querying Active Directory. I have already limited the maximum number of parallel executions to 5. The whole setup runs on IIS and PowerShell 7. I hope someone can help me as soon as possible. Should i enable the IIS advanced setting property “Disable Overlapped Recycle” from “false” to “true”?