Support

I am attempting to upgrade PSU from v5.5.0 to v26.2.3.0, both initial install and upgrade are being done via MSI. The v26 MSI upgrade process itself completes successfully without error. However, post upgrade when first trying to start the PSU service the below error throws and the service will not start. I don't recall ever doing anything unique/special with this PSU installation, but as of now I am unable to get past it. Are there intermediate version(s) I need to step through instead of a straight jump to 26.2.3.0? [FTL] Fatal error starting PowerShell Universal as a Windows service. Microsoft.Data.Sqlite.SqliteException (0x80004005): SQLite Error 1: 'duplicate column name: DebugPreference'. at Microsoft.Data.Sqlite.SqliteException.ThrowExceptionForRC(Int32 rc, sqlite3 db) at Microsoft.Data.Sqlite.SqliteCommand.PrepareAndEnumerateStatements()+MoveNext() at Microsoft.Data.Sqlite.SqliteCommand.GetStatements()+MoveNext() at Microsoft.Data.Sqlite.SqliteDataReader.NextResult() at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader(CommandBehavior behavior) at Microsoft.Data.Sqlite.SqliteCommand.ExecuteReader() at Microsoft.Data.Sqlite.SqliteCommand.ExecuteNonQuery() at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteNonQuery(RelationalCommandParameterObject parameterObject) at Microsoft.EntityFrameworkCore.Migrations.MigrationCommand.ExecuteNonQuery(IRelationalConnection connection, IReadOnlyDictionary2 parameterValues) at Microsoft.EntityFrameworkCore.Migrations.Internal.MigrationCommandExecutor.Execute(IReadOnlyList1 migrationCommands, IRelationalConnection connection, MigrationExecutionState executionState, Boolean beginTransaction, Boolean commitTransaction, Nullable1 isolationLevel) at Microsoft.EntityFrameworkCore.Migrations.Internal.MigrationCommandExecutor.<>c.<ExecuteNonQuery>b__3_1(DbContext _, ValueTuple6 s) at Microsoft.EntityFrameworkCore.Storage.NonRetryingExecutionStrategy.ExecuteTState,TResult at Microsoft.EntityFrameworkCore.Migrations.Internal.MigrationCommandExecutor.ExecuteNonQuery(IReadOnlyList1 migrationCommands, IRelationalConnection connection, MigrationExecutionState executionState, Boolean commitTransaction, Nullable1 isolationLevel) at Microsoft.EntityFrameworkCore.Migrations.Internal.Migrator.MigrateImplementation(DbContext context, String targetMigration, MigrationExecutionState state, Boolean useTransaction) at Microsoft.EntityFrameworkCore.Migrations.Internal.Migrator.<>c.<Migrate>b__20_1(DbContext c, ValueTuple4 s) at Microsoft.EntityFrameworkCore.Storage.NonRetryingExecutionStrategy.Execute[TState,TResult](TState state, Func3 operation, Func3 verifySucceeded) at Microsoft.EntityFrameworkCore.Migrations.Internal.Migrator.Migrate(String targetMigration) at Microsoft.EntityFrameworkCore.RelationalDatabaseFacadeExtensions.Migrate(DatabaseFacade databaseFacade) at PowerShellUniversal.SQLite.DatabaseFeature.InitializeDatabase(IConfiguration configuration, ILogger logger) in D:\a\powershell-universal\powershell-universal\src\PowerShellUniversal.SQLite\Plugin.cs:line 72 at Universal.Server.Services.SystemPluginService.InitializeDatabase(IConfiguration configuration) in D:\a\powershell-universal\powershell-universal\src\Universal.Server\Services\SystemPluginService.cs:line 58 at Universal.Server.Startup.InitializeDatabase(ISystemPluginService systemPluginService) in D:\a\powershell-universal\powershell-universal\src\Universal.Server\Startup.cs:line 340 at Universal.Server.Startup.ConfigureServices(IServiceCollection services) in D:\a\powershell-universal\powershell-universal\src\Universal.Server\Startup.cs:line 82 at System.Reflection.MethodBaseInvoker.InterpretedInvoke_Method(Object obj, IntPtr* args) at System.Reflection.MethodBaseInvoker.InvokeDirectByRefWithFewArgs(Object obj, Span1 copyOfArgs, BindingFlags invokeAttr) at System.Reflection.MethodBaseInvoker.InvokeWithOneArg(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) at Microsoft.AspNetCore.Hosting.ConfigureServicesBuilder.InvokeCore(Object instance, IServiceCollection services) at Microsoft.AspNetCore.Hosting.GenericWebHostBuilder.UseStartup(Type startupType, HostBuilderContext context, IServiceCollection services, Object instance) at Microsoft.AspNetCore.Hosting.GenericWebHostBuilder.<>c__DisplayClass7_0.<UseStartup>b__0(HostBuilderContext context, IServiceCollection services) at Microsoft.Extensions.Hosting.HostBuilder.InitializeServiceProvider() at Microsoft.Extensions.Hosting.HostBuilder.Build() at Universal.Server.PowerShellUniversalWindowsService.StartHostAsync(CancellationToken cancellationToken) in D:\a\powershell-universal\powershell-universal\src\Universal.Server\PowerShellUniversalWindowsService.cs:line 61

Hi, I used to work with VSCode and the PowerShell Universal Extension version 5.6.2. My PSU Server meanwhile is on 2026.2.2 The old extension still somewhat works. I can edit APP code and pages. I can add a page. I can restart the APP. Same for Scripts and Apis. Now I have tried the new extension 2026.2.2 It is all different, but ok. The problem is that I can't edit scripts or API (Endpoints). I can't add app pages. And it happened that a saved some faulty code by accident, that lead to my page being still on disk, but no longer shown. I could neither delete, nor update. All in all the new version is not usable for me so I am back to 5.6.2 which does what I need for now. Anybody else with similar or other experience on that?

Hello, since a few weeks I sporadically encounter the following Error, when I open an App (also includes Portal and Admin page) or call an Endpoint: [image] (I added the inner exception as attachment) After some time (with refreshing and cookie delete) it works again. I already tried the following: Service / Server Restart (solved the issue for a few hours) Changed the Security Environment from "Integrated" to "Powershell 7" Fiddled a bit with my Saml Configuration (enabled, disabled "Load metadata" and recreated the whole Authentication Method Updated from 2026.2.2.0 to 2026.2.3.0 My Saml2 Method looks like this: [image] Do you have a suggestion how I can get this fixed? Thank you.

I have many scheduled jobs that run smoothly without any issues but I am noticing that two of them randomly get dropped from the scheduler. The fix is that I just have to reload the configuration file from the File tab (so no changes to the files). Then rinse and repeat like a week later. I don't catch these until users tell me that they are not getting some of the expected reports. Has anyone encountered this and found a fix? Thanks

Are variable and secrets supposed to be available to tests as we have built tests that require these but are all failing?

We are running PSU version 2026.1.1 Ran into an issue where on macOS, enabling Dark Mode in any browser caused it to not finish rendering the page? Has anyone else experienced this? [image]

Hi, We are currently using PSU for our "internal" IT Automation, which runs great. By now we are thinking to extend this also for our Employees, to handle specific tasks like guided updating the Members of a Distribution Group in Active Directory. I have some concerns regarding security, if we let our employees access the PSU, which runs on our Automation Windows Server. What is the recommended setup here? Thanks for any answer!

I'm running Powershell Universal version 5.6.9. is it possible to upgrade directly to 2026.2.3.0?

Product: PowerShell Universal Version: 5.4.1 IIS Install/SQL Express AppPool ID: LocalSystem Greetings, first post here! I am struggling through the initial learning curve of PSU and trying to use a gMSA to run a script. I’m experienced in the ways of gMSA, so it’s been properly created and the local machine has rights to retrieve the password. The account has both “Log on as a batch job” and “Log on as a service” rights. I’ve registered the gMSA as a PSCredential variable (DOMAIN\user$), and checked the box for “Password not required”. No test can be performed on the credential, as for standard accounts. I assume this is a limitation of gMSAs. I can select the credential in the script properties. All good. But when running the script, I get: Error executing job: Failed to login user (1326). System.ComponentModel.Win32Exception (1326): The user name or password is incorrect. In the Windows Security Log, I see confirmation that IIS is initiating the logon, but finding “Unknown user name or bad password”: Subject: Security ID: SYSTEM Account Name: MYCOMPUTER$ Account Domain: MYDOMAIN Logon ID: 0x3E7 Logon Type: 4 Account For Which Logon Failed: Security ID: NULL SID Account Name: svc_gMSA$ Account Domain: MYDOMAIN Failure Information: Failure Reason: Unknown user name or bad password. Status: 0xC000006D Sub Status: 0xC000006A Process Information: Caller Process ID: 0x1048 Caller Process Name: C:\Windows\System32\inetsrv\w3wp.exe The IIS app pool is running under LocalSystem. From the docs I am understanding that if I were to run it under a custom service account, then I could not use alternate credentials. How does one get this working? Thank you! Just to cover a few additional bases: forwardWindowsAuthToken is set to “true” Using a standard AD account as alternate credentials works fine Tried granting additional User Rights in Local Security Policy: Impersonate a client after authentication, Replace a process level token, Obtain an impersonation token for another user in the same session

Hi, I've had this solution working on a previous version but after migrating to the latest I'm getting an error and I've not been to resolve it and I'm running out of ideas. So any help will be appreciated. I have an API endpoint that I use to refresh a dashboard component. The dashboard is running in the Integrated environment as is the endpoint. New-PSUEndpoint -Url "/refresh" -Description "Refresh" -Method @('GET') -Endpoint { try { Sync-PSUComponent -Integrated -Id "Import" -Broadcast "[Dashboard Refreshed]" } catch { "[Dashboard Refresh Failed]" $_ } } -Environment "Integrated" When I call the API Endpoint I get an error with this exception TargetSite : @{Name=IPublicClient.SyncComponent; DeclaringType=; ReflectedType=; MemberType=8; MetadataToken=100664704; Module=; IsSecurityCritical=True; IsSecuritySafeCritical=False; IsSecurityTransparent=False; MethodHandle=; Attributes=481; CallingConvention=33; ReturnType=; ReturnTypeCustomAttributes=; ReturnParameter=; IsCollectible=True; IsGenericMethod=False; IsGenericMethodDefinition=False; ContainsGenericParameters=False; MethodImplementationFlags=0; IsAbstract=False; IsConstructor=False; IsFinal=True; IsHideBySig=True; IsSpecialName=False; IsStatic=False; IsVirtual=True; IsAssembly=False; IsFamily=False; IsFamilyAndAssembly=False; IsFamilyOrAssembly=False; IsPrivate=True; IsPublic=False; IsConstructedGenericMethod=False; CustomAttributes=System.Object[]} Message : Specified method is not supported. Data : InnerException : HelpLink : Source : ProtoBuf.Grpc.Internal.Proxies HResult : -2146233067 StackTrace : at ProtoBuf.Grpc.Internal.Proxies.ClientBase.IPublicClient_Proxy_51.IPublicClient.SyncComponent(StringRequest, Boolean) at Universal.SyncComponentCommand.ProcessRecord() in D:\a\powershell-universal\powershell-universal\src\Cmdlets\Apps\SyncComponentCommand.cs:line 17 at System.Management.Automation.CommandProcessor.ProcessRecord()

Hi, not sure if this a bug or i do something wrong. Im using the Autocomplete Component to select one or more users from a list. For the Name i build something out of Username and the Title / Position and the Value is the ObjectGuid for the script to use afterwards. If i now select one entry it works without a problem, but as soon as i add another different entry, the one before transforms into the Value instead of showing the Name. The code for the Autocomplete Component ist the following: The $ADUsers is a cached list of our AD Users. New-UDAutocomplete -Id "txtMailboxAccess" -Label "User" -Multiple -FullWidth -Icon (New-UDIcon -Icon "user" -Solid) -OnLoadOptions { $ADUsers | Where-Object {$_.userprincipalname -like "*$Body*" -or $_.samaccountname -like "*$Body*"} | ForEach-Object { New-UDAutoCompleteOption -Name "$($_.displayName) ($($_.title) | $($_.department))" -Value $_.ObjectGuid } | ConvertTo-Json } [image] Does anybody know how to solve this? Thank you!

Is there a way to get the FailoverClusters module running in the Windows docker container? It looks like the windows feature has been removed from the docker image, and I haven't been able to find a way to get it installed. I tried copying the module files to the running container doesn't work, as PowerShell throws errors when importing the module. I'm trying to migrate from the PowerShell module install of PowerShell Universal to the docker container, and this is the last thing that's holding me up. I have a custom module I created for my company that relies on the FailoverClusters module, and I would prefer not to have to re-write the module.

Changes made in the admin ui are written to the working directory but never committed. The next sync then fails, because git pull (pull.rebase=true) refuses to run on a dirty tree. Sync stays broken until the tree is cleared manually, then breaks again on the next UI change. PSU 2026.2.2 Windows Server 2022 Standard Evaluation, 10.0.20348 Service: PowerShellUniversal, running as LocalSystem Git for Windows 2.55.0.windows.3 Remote: git@github.com:user/repo.git (SSH) External Git Client: on (forced by SSH key selection) TwoWay + Automatic Dev/Test License over devolutions account System gitconfig ( C:/Program Files/Git/etc/gitconfig ): user.name=PowerShell Universal user.email=psu@lab.local safe.directory=C:/ProgramData/UniversalAutomation/Repository pull.rebase=true core.autocrlf=true Repro: 1. Configure git sync with an SSH remote + SSH key. Clone succeeds, sync OK. 2. Confirm clean working tree. 3. Edit a portal page description in the admin console. 4. git status -> .universal/portalPages.psd1 modified. git log -> no new commit. 5. Next sync: [ERR] Git Error: error: cannot pull with rebase: You have unstaged changes. [ERR] Failed to sync ("Failed"): Git command failed with exit code 128. at GitService.RunGitCommandAsync(String args) in GitService.cs:line 1553 at GitService.PullAsync() in GitService.cs:line 1018 at GitSyncService.TrySync(...) in GitSyncService.cs:line 201 With debug logging on, the only git commands logged are "git remote set-url" and "git pull origin master". There is no git commit or git add, it looks like PSU never attempts a commit. Expected per docs: changes made in the admin ui invoke a git commit.

Product: PowerShell Universal Version: 4.5.5 I'm having an issue with a standard user execution a script from a Dashboard. I have 2 environments currently, both running 4.5.5 (yeah, I know it's older, looking to rebuild our 'prod' environment with 2026 but i need to have a 'dev' version for users to use while I rebuild it), but users are not able to run scripts from a dashboard. The error that I get in the admin portal is Error executing job: The credential '************' can not be used for the roles '****,****'. Our old environment, which has been upgraded several times and was created using PUD version 2.X, is working perfectly fine. I've checked all the settings in the admin portal and everything looks mirrored. Has anyone encountered this issue or can direct me to look in some place? Thanks in advance!

Hi, The developer licensing model changed over the last few versions and it now breaks our setup. Previously, purchasing a license also let us create offline developer licenses. Now the Developer Edition requires signing in with a Devolutions account, which needs internet access, and an offline dev license no longer seems to be available. Our situation: Our development server has no internet access. It's isolated because it holds sensitive data. Company policy doesn't allow developing locally on workstations, so we can't develop off that server. We connect from the workstation to the dev server via VS Code Remote Tunnels, start the Universal instance there, and forward the port with dev tunnels. Signing in with a Devolutions account in this setup isn't possible. We already hold normal licenses for our production and test systems. It's only the local/isolated development case that used to work and now doesn't. The PSU instance on the dev server is started only during development, stopped afterwards, and used by a single developer. As far as we can tell, the Developer Edition can't work here, and there's no offline dev license anymore, so this path is closed for us. What we'd like to know: What do you recommend for teams working in an isolated/offline setup like this? Is there a supported way to keep developing without internet access on the dev machine? We've been working this way for a while and are now blocked, so a clear recommendation on the intended path would be much appreciated. Thanks, Wolf

Hi, PSU version: 2026.2.2 (Windows, licensed, ZIP Installation) What we're trying to do: Enable the "Auto-reload" toggle (Settings -> Files -> Configuration Changes) programmatically from a code-first script (.universal/settings.ps1), so a freshly provisioned local dev instance or automatically newly deployed instances doesn't need a manual click every time. Steps to reproduce: 1. Fresh instance, new/empty database (GitSyncBehavior is not OneWay, so the toggle is available, not greyed out). 2. In .universal/settings.ps1 (a script PSU re-evaluates on every server start), call: Set-PSUSetting -DisableAutoReload:$false -Integrated (also tested without -Integrated) 3. Restart the server (reusing the same database, no DB reset) several times. Expected: Settings -> Files -> Configuration Changes -> "Auto-reload" toggle shows enabled. Actual: Toggle stays off across every restart, no matter how many times the script runs with -DisableAutoReload:$false. Isolating the cause: - Manually flipping the same toggle ON once via the admin console persists correctly across subsequent restarts (as long as the DB isn't recreated) - so DB persistence of the setting itself works fine. - This suggests Set-PSUSetting -Integrated either doesn't write DisableAutoReload to the database at all, or writes it but the running process doesn't pick it up, while the admin console's toggle goes through a different code path that applies it live. - Also tried the DisableCodeFirst alias - same result. Questions: 1. Is this a known bug, or is DisableAutoReload intentionally not settable via -Integrated or code directly? 2. Is there any supported code-first / startup-time way (appsettings.json key, cmdlet, CLI flag) to enable Auto-reload on a fresh instance without a manual admin console click? 3. If not, could this be added as a feature - i.e. Set-PSUSetting actually applying DisableAutoReload live, matching the admin console's behavior? Happy to provide logs or run further tests if useful. [image] Thanks, René

Hi, we still get this warning whenever a page with New-UDTabs -RenderOnActive is opened: "[Warning] [App-Development] RenderOnActive is deprecated and will be removed in 4.0" The deprecation was tracked in https://github.com/ironmansoftware/powershell-universal/issues/1937 with the note that -Dynamic on New-UDTab should be enough. The same question was already asked on the but never got an answer ( RenderOnActive is deprecated and will be removed in 4.0? - PowerShell Universal - Ironman Software Forums ). We're on 2026.1.7 now, -RenderOnActive is still a valid parameter, and the warning is still emitted. Could someone clarify what the current status of this is and what the recommended migration path looks like? Thank you

Hi everyone, I'm looking for architectural best practices regarding credential handling in a hybrid scenario. Our Setup & Problem: Users authenticate to our web app (PowerShell Universal) using Azure AD / Entra ID . However, the app needs to perform remote actions on local On-Premises PCs (via WinRM/CIM). Because the Azure identity cannot be used directly for local Windows authentication, we need a separate set of Active Directory credentials. What we want to achieve: Prompt the user inside the app for their local Windows/AD credentials. Cache these credentials securely only for the duration of their browser session (they must expire when the browser is closed). Reuse the cached credentials during the session to query remote PCs by passing them to background jobs via Invoke-PSUScript. My Questions: What is the most secure way to temporarily store a PSCredential object in the server's session memory (e.g., $Session scope) without risking plaintext exposure? How do you reliably ensure the credentials are wiped as soon as the user closes the browser? Are there better alternative architectural patterns for this specific "Azure App to On-Premises Management" transition? Serviceuser aint an Option. Thanks in advance for your advice!

I don't know when that started. (EDIT: it started after the 2026.2.1 update) We are on 2026.2.2 now with DEV and PROD server. Doing an edit / save in the GUI does not show any error. Clicking "Synchronize Now" seems to work fine. But nothing will happen in GIT. When I click "fetch remote branches" I get this error: [image] We did not change auth type.

After upgrading PowerShell Universal from 2026.1.7.0 to 2026.2.1.0 , the functions used by our endpoints and apps are no longer being recognized. For some context, the environments used by our endpoints and apps are configured to run a script at runspace startup that dot-sources all of our functions. This setup has worked correctly in all previous versions, but it stopped working immediately after the upgrade. Has anyone else experienced the same issue or found a workaround?

Hi, After upgrading from 2026.2.1 on 3 different containers to 2026.2.2, the license is now considered invalid. [image] Re-adding the license fails, even that the license is valid. Downgrading to 2026.2.1 "fixes" the issue. Update: Its also an issue on Windows deployments.

The folder view for scrips does not show folders. I can create sub-folders in the ui and they get correcly created on disk, but will not show up in the folder explorer. [image] I m on Version 2026.2.0 Not quite sure if I do something wrong, or there is an issue somewhere...

I created an unauthenticated API Endpoint "/getData" which uses variables and the $Secret scope to connect to other APIs and return aggregated data. Issue1: the endpoint could not read all secrets and threw a security exception despite none of them had any role restrictions. Recreating the secrets worked, so some update must have corrupted the permission requirements of the secrets. Not sure if this is worth looking into. Issue2: the endpoint needs to run an internal script via Invoke-PSUScript -Integrated -Script 'AuthorizeToAPI.ps1' -Wait that handles the authentication to that external API. That script is able to be run unauthenticated, but needs update variables/secrets. This is what I used: $AccessTokenVar = Get-PSUVariable -Name "AccessToken" $AccessTokenLifetimeVar = Get-PSUVariable -Name "AccessTokenLifetime" $TokenResponse = Invoke-RestMethod "<externalAPIauthentication>" -Method 'POST' -Headers $Headers -Body $Body Set-PSUVariable -Variable $AccessTokenVar -Value $TokenResponse.Token Set-PSUVariable -Variable $AccessTokenLifetimeVar -Value $TokenResponse.LifeTime which worked fine until the last update and suddenly returns an error: Permission denied. The role specified does not have access to this resource. Since Issue1 clearly pointed to some update corrupting role requirements to variables, I m at a loss on what is intended behavior and what is not. Are integrated scripts not able to use Get/Set-PSUVariable or did more permissions get corrupted? Help would be much appreciated :)

Good moring PSU-Community, i have a question regarding agents and their handling after the target system got deleted. Since i wasn`t able to find information regarding this in the documentation or the forum, i decided to open up this thread. Right know the agent ist marked as offline under platform/computer in the PSU-web-UI and i would like to delete it or mark it as deleted. As far as i can tell there is no button in the web-UI or PowerShell-Cmdlet in the "Universal"-module to do that. When i use the command "Get-PSUComputers" and filter it to the coresponding agent, there is a property called "deleted", which right know is set to "false". With "Set-PSUComputer" i also can`t change the mentioned property and as far i an tell ther is no other command for deleting or softdeleting the agent-computer. Can you tell me the intended way to clean up old agents? Thanks in advance and greets from Germany, Markus

Hello, We are running GIT for our production PSU which is 2026.1.1. It is currently configured for PUSH Only. We were curious if anyone has setup a test server and changed the Production to PULL while the "test" server was pushing Production changes? We have never done this before so any guidance from the community would be helpful for us.