Missing powershell features for DVGW and PAM management.

4 votes

Published 5 months ago

Hello.

When working with automating setup of Devolutions Gateway and Devolutions PAM, we have discovered that there is a gap in functionality in what can be done with the web GUI and what can be done with powershell.

Devolutions Gateway:

Missing "New/Update-DSGatewayFarm" commands to be able to create and manage Devolutions Gateway Farms.
New/Update-DSGateway:
- Missing ability to set permissions with New-DSGateway (Limited functionality is present with Update-DSGateway).
- Missing ability to set default permissions (Defaults to "Default (Allowed)")
- Missing functionality to control KDC-proxy settings.

Devolutions PAM:

New-DSPamProvider
- Missing ability to configure "Use Devolutions Gateway" and choose what gateway/fram to use.
- Missing ability to configure Domain Controller
- Missing ability to configure "Password Template"
New-DSPamVault
- Unable to assign permissions to an "Application"

It would be great if the functionality available in the web GUI, would also be available in the Powershell module, to enable automating things and improve consistency.

All Comments (3)

Christian Robert

Published 5 months ago

Hello Tony,

Tickets have been opened to enable these actions; we'll keep you updated.

Best regards,
Christian

Christian Robert

Published a month ago

Hello @tonyfredriksson,

Regarding your request, the following features are now available in version 2025.3.4 of our PowerShell module:

Added New-DSGatewayFarm to create new gateway farms
Added Update-DSGatewayFarm to update gateway farms
Added Gateway parameter to New-DSPamProvider and Update-DSPamProvider, enabling users to set a PAM provider’s gateway
Added DomainController parameter to New-DSPamProvider and Update-DSPamProvider, enabling users to set a PAM provider’s domain controller
Added Application parameter to New-DSPamVault to set a PAM vault’s permitted application identities

Regarding your 'Password Template' request specifically, users can now set a PAM provider's account lifecycle policy, including its password policy.

Added Get-DSAccountLifecyclePolicy to retrieve account lifecycle policies
Added AccountLifecyclePolicy parameter to New-DSPamProvider and Update-DSPamProvider to set a PAM provider’s account lifecycle policy
Added New-DSAccountLifecyclePolicyInfo to create a new account lifecycle policy object in the user-friendly PSAccountLifecyclePolicyInfo format
Added ConvertTo-DSAccountLifecyclePolicyInfo to convert a provider’s lifecycle policy to the user-friendly PSAccountLifecyclePolicyInfo format
Added Get-DSPasswordPolicy to retrieve password policies

The ability to configure gateway permissions and KDC-proxy settings will be introduced in our next major release, version 2026.1.0.

As for changing what the 'Default' permissions setting on a gateway maps to, this cannot currently be modified via PowerShell, as it is not configurable within Devolutions Server itself.

Best regards,
Christian

Christian Robert

Published 8 days ago

Hello @tonyfredriksson,

Version 2026.1 of the Devolutions.PowerShell module introduces the ability to configure gateway permissions and KDC-proxy settings.

Regarding gateway permissions:

Added New-DSGatewaySecurity to create GatewaySecurity objects, on which a gateway's permissions can be set
Gateway cmdlets (the New/Update cmdlets for Gateway, VirtualGateway, and GatewayFarm) now accept these security settings under the 'Security' parameter

Regarding KDC-proxy settings:

Added New-DSGatewayKDCProxySettings to create KDC proxy configuration objects
Added Convert-DSGatewayKDCProxySettings to extract KDC proxy settings from a gateway
New-DSGateway and Update-DSGateway now accept KDC proxy settings with the KdcProxySettings parameter

Best regards,
Christian

This feature has been implemented in version 2025.3.4