Christian Robert

Breaking Changes

• The Password of the items in the Credentials.PasswordList property of an entry is now always empty, because reading it there cannot be logged; scripts that read it get an empty string

New Features

• Added Get-DSVaultTemplateSummary to list the vault templates of a Devolutions Server

• Added Get-RDMCurrentPrincipal to identify the current user or application identity

• Added Get-RDMEntryRunningState to fetch info about currently running sessions

• Added Get-RDMMyAccountSetting and Set-RDMMyAccountSetting to read and change the current user's My account settings, including external credential providers such as Delinea Secret Server, CyberArk, KeePass and Bitwarden

Improvements

• Added -PasswordListItemID to Get-RDMEntryPassword and Get-RDMEntryUsername to read a specific item of a Password List entry or of an entry that references one, with a PasswordListItemNotFound error when the item is not one of the items the entry selects

• Get-RDMEntryPassword and Get-RDMEntryUsername now raise a PasswordListItemRequired error that names -PasswordListItemID and lists the items when a Password List has several items, no item is given and the session cannot prompt, instead of the generic "An unexpected error occurred" error

• Get-RDMEntryPasswordListItem now writes a password viewed log entry for each item whose password it returns, and asks for the comment and ticket number when the entry requires them, or accepts them through the new -Comment and -TicketID parameters

• Get-RDMEntryPasswordListItem now writes a warning when the item passwords are returned empty because the user does not have the "copy password" right

• Improved the performance on a Devolutions Cloud workspace with an application identity by removing unneeded calls to retrieve the current user

• New-DSVault now accepts -VaultTemplateId to create a vault from a vault template

Fixes

• Fixed Get-DSActivityLog, Get-DSAdministrationLog, Get-DSLoginAttempt, Get-DSPamPasswordRotationLog, Get-DSPasswordsReport, Get-DSVault, Get-DSEntry, Get-DSUser, Get-DSUserGroup, Get-DSDeletedUser, Get-DSDeletedUserGroup and Get-DSPamAccount failing with a JSON error when the session was opened with New-DSSession -UseOAuth or -WindowsAuthentication

• Fixed Get-DSPamPasswordRotationLog ignoring the -DateFilter, -After and -Before parameters

• Fixed Get-RDMEntryCredentials wrongly returning certain credential modes as CredentialEntry

• Fixed Get-RDMEntryOTPKey returning empty when the OTP comes from a credential in another vault

• Fixed the module giving "Could not obtain data source settings" error when connecting to DVLS with OAuth when no application identity data was provided

• Get-RDMEntryUsername now logs "Username was read in PowerShell" with the same log type as the RDM desktop client, instead of "Copied username to clipboard"

Hello @Daniel Albrecht,

That matches the failure we've investigated and fixed. The fix will be in the next release. Until then, as mentioned, using an application identity should avoid it. Another way to avoid it would be to set that workspace's Authentication browser mode to Embedded, in its Advanced settings.

Best regards,

Christian

Hello @Daniel Albrecht,

We think this might be related to a problem we recently fixed for DVLS logins in PowerShell. If it is, the fix would go out with our next release. But to confirm, can you tell us:

• The version of the module you're using

• In your workspace's settings, in the Advanced tab, is "Auto-go offline" checked? Also, what's your authentication browser mode set to?

• In File > Settings > Advanced > Authentication, is 'Use embedded browser for login' checked?

Until the fix ships, if the issue is what we think it is, it should be avoidable by connecting with an application identity, which avoids the normal sign-in flow.

(Agreed that we should change the verb for these cmdlets.)

Best regards,

Christian

Hello @Gerhard Ryznar,

Version 2026.3.2 of the Devolutions.PowerShell module implements these features:

• Added Test-RDMPassword to check a password against a password policy

• Added -Policy parameter to New-RDMStandalonePassword to generate a password from a password policy object

• Added -PasswordPolicy and -PasswordComplexity parameters to New-DSCredentialEntry and New-DSSSHShellEntry to assign a password policy to the new entry and set how a non-compliant password is handled

Some of the cmdlets have 'RDM' names, but they work with DS workflows just as well.

Best regards,

Christian

Hello @Erica Poirier,

Version 2026.3.2 of the Devolutions.PowerShell module includes the ability to create Contractor type users with New-DSUser. (Added “Contractor” to the available -AuthenticationType values, and an -ExpirationDate parameter since that's necessary for contractors.)

Best regards,

Christian

Hello @Matthew Morrow,

Can you confirm you're describing an issue in the Devolutions.PowerShell module (as opposed to, for instance, PowerShell Universal), and if so, which specific cmdlets it appears in? Both Add-RDMRoleAssignment and Add-DSRoleAssignment are supposed to keep a user's existing roles, so if you're getting a different behavior, we'll need to look into that.

Best regards,

Christian

Hello @Marcel G,

Version 2026.3.1 of the Devolutions.PowerShell module introduces a fix for the issue discussed in this thread. Let us know if you need anything else.

Best regards,

Christian

New Features

• Added Get-RDMImportableUserGroup to discover the user groups an identity provider makes available for import

• Added Import-RDMUserGroup to import user groups discovered from an identity provider

Improvements

• Added -ExpirationDate to New-RDMUser to set a user's expiration date

• Added the OfflineMode and AllowDragAndDrop properties to users returned by Get-RDMUser

• Description on a user is now derived from FirstName and LastName, so it reflects changes to those properties immediately rather than only after the user is saved and retrieved again

• Improved error messages on Set-RDMVault, New-RDMVault, Set-RDMCloudVaultAccess, Remove-RDMCloudVaultAccess, and Import-RDMVault to include Devolutions Server's specific reason when a vault save fails and one is available, instead of always showing a generic message

• Read-RDMEntry is now an alias of Import-RDMEntry

Fixes

• Assigning to Description on a user returned by Get-RDMUser now raises a read-only property error, instead of succeeding with no effect

• Fixed a hang and stack-overflow crash when Devolutions Server rejected the session right after an application key login

• Fixed Azure workspaces with Active Directory Interactive logins throwing 'Required framework .NET 4.7' errors on connection

• Fixed Get-RDMEntryOTP failing to fetch the OTP code of PAM entries

• Fixed Get-RDMEntryOTPKey failing to fetch the OTP key of PAM entries

• Fixed Get-RDMUserGroupVaultAccess preventing queries of vaults the provided user group does not have access to

• Fixed Get-RDMUserVaultAccess preventing queries of vaults the provided user does not have access to

• Fixed New-RDMUser disabling -Password for Contractor-type users

• Fixed New-RDMVault -VaultTemplate throwing NotImplementedException and leaving an empty vault on SQL Server workspaces

• Fixed Set-RDMEntry and Move-RDMEntry checking PAM entry rules against a vault's previous security level after that level was changed with Set-RDMVault in the same session

• Fixed Set-RDMEntryOTP failing to set OTP settings for PAM entries

• Set-RDMUserProperty now warns that the value was not set when -Property "Description" is used on a user, instead of reporting success and discarding the value on save

Hello @Marcel G,

Thanks for pointing out that it only happens with Active Directory Interactive, that observation is what let us pin it down. A fix is done and verified, and will ship in an upcoming release; we'll tell you when it's out. In the meantime, as you say, changing your login method to SQL Server authentication should avoid those errors, if that's possible for you.

Best regards,

Christian

Hello @Marcel G,

The '.NET 4.7' error is a generic fallback message; I don't believe there's actually a problem with your .NET version.

Your observation that Get-RDMDataSource works while the others don't was the most useful clue in the report, it points at a specific part of our cmdlet start-up path. Based on that, could you try this:

Disable-RDMTelemetry

Get-RDMVersion

If the error goes away, we've found where it's coming from and you have a working stopgap in the meantime. The setting persists across sessions, so you can leave it off: usage telemetry is optional and turning it off won't affect any functionality. Once we ship a proper fix you can turn it back on with Enable-RDMTelemetry. Either way, could you let us know the result?

Best regards,

Christian

Hello @Matthew Morrow,

Your thread has been moved to the PowerShell Universal forum.

Best regards,

Christian

Hello @andreas05,

A ticket has been opened to enable fetching the UI's currently selected entries from PowerShell. We'll keep you updated as progress is made on the task.

Best regards,

Christian

Fixes

• Export-RDMActivityLogsReport and Export-RDMEntrySecurityAnalyzerReport now write correct CSV/XML column headers when the RDM UI language contains accented or non-ASCII characters

• Fixed Get-DSEntriesPermissions attempting to get permission info for virtual folders

• Fixed Get-DSEntry causing null reference exceptions when called with an ID matching no entry

• Fixed Get-DSFolders returning virtual folders

• Fixed Get-DSPamVault returning JSON deserialization error

• Fixed Get-DSVault returning nothing with paging parameters

Hello @lucaoutma,

A ticket has been opened to enable fetching info about whether an entry is opened by other users. We'll keep you updated as progress is made on the task.

Best regards,

Christian

Hello @RDMTinkerer2,

If you want similar audit columns as those currently available for an entry, but for individual password list items, we don't currently save that information on a per-item basis, so we can't currently display it from PowerShell, it would be more of a Windows feature request beforehand.

Remember the last line - Set-RDMEntry, otherwise the changes won't get persisted into your database.

By the way, these cmdlets also have a -Set parameter which persists the change directly, which might be simpler for your needs.

Best regards,

Christian

Hello @RDMTinkerer2,

Version 2026.2.2 of the Devolutions.PowerShell module introduces the following cmdlets:

• Add-RDMEntryPasswordListItem

• Get-RDMEntryPasswordListItem

• Remove-RDMEntryPasswordListItem

• Set-RDMEntryPasswordListItem

• New-RDMPasswordListItemCustomField (generates custom fields which can then be set on password list items)

These should help with editing password lists in PowerShell. Let us know if you need anything else.

Best regards,

Christian

Hello @swidmann,

Version 2026.2.2 of the Devolutions.PowerShell module introduces the Get-DSDeletedUserGroup, Remove-DSDeletedUserGroup and Restore-DSDeletedUserGroup cmdlets, allowing users to manage deleted user groups on Devolutions Server.

Let us know if you need anything else.

Best regards,

Christian

Breaking Changes

• Get-DCGateway renamed to Get-DCDevoGateway

• Get-DCGatewaySettings renamed to Get-DCDevoGatewaySettings

• New-DCGateway renamed to New-DCDevoGateway

• New-DCGatewaySettings renamed to New-DCDevoGatewaySettings

• Remove-DCGateway renamed to Remove-DCDevoGateway

• Set-DCGateway renamed to Set-DCDevoGateway

• Set-DCGatewaySettings renamed to Set-DCDevoGatewaySettings

New Features

• Added Add-RDMEntryPasswordListItem to add password list items to a Password List entry

• Added Get-DSDeletedUserGroup to fetch deleted user groups from Devolutions Server

• Added Get-RDMEntryParameter, Add-RDMEntryParameter, Set-RDMEntryParameter, and Remove-RDMEntryParameter cmdlets to read and manage command-line parameter values

• Added Get-RDMEntryPasswordListItem to fetch password list items from a Password List entry

• Added New-RDMPasswordListItemCustomField to create custom fields which can be added to Password List entry items

• Added Remove-DSDeletedUserGroup to permanently remove deleted user groups from Devolutions Server

• Added Remove-RDMEntryPasswordListItem to remove password list items from a Password List entry

• Added Restore-DSDeletedUserGroup to restore deleted user groups on Devolutions Server

• Added Set-RDMEntryPasswordListItem to modify password list items on a Password List entry

Improvements

• Added -ID parameter to Get-RDMUser and Get-RDMUserGroup

• Exposed Parameter1DataType through Parameter5DataType and ExtraParametersData on the Cmd object returned by Get-RDMEntry, so scripts working with $entry.Cmd directly can now read and change a parameter's type, not just its default value

• Renamed Export-RDMPasswordAnalyzerReport to Export-RDMEntrySecurityAnalyzerReport (old name still works but emits a deprecation warning)

Fixes

• Fixed -Attachment parameter on Update-RDMEntryDocument quietly wiping data when attachment filename is unavailable

• Fixed Export-RDMEntrySecurityAnalyzerReport automatically correcting a missing file extension with a warning when -Path is provided without one

• Fixed Export-RDMPasswordAnalyzerReport HTML export crashing with an unhelpful message

Hello @reinleen,

Version 2026.2.1 of the Devolutions.PowerShell module introduces an improvement to the 'Unexpected exception' issue raised in this thread. The affected cmdlets should now instead raise a more descriptive error, mentioning that the provided vault ID may not be valid.

Feel free to reach out if you have further questions or comments.

Best regards,

Christian

Hello @patrick2,

As of version 2026.1.5 of the Devolutions.PowerShell module, users can now convert legacy website entries to modern website entries using the new ConvertFrom-RDMWebsiteLegacyEntry cmdlet.

Feel free to reach out if you need anything else.

Best regards,

Christian

Hello @ronbouwmeester,

As of version 2026.1.5 of the Devolutions.PowerShell module, you can now manage a vault’s custom variables using the following cmdlets: Get-RDMVaultCustomVariable, Set-RDMVaultCustomVariable, New-RDMVaultCustomVariable, and Remove-RDMVaultCustomVariable.

Feel free to reach out if you need anything else.

Best regards,

Christian

Hello @RokB,

If what you want is a script that an admin could run to execute an export-import of all other users' private vault contents at once, this won't be possible, since admins can't access other users' private vaults. However, if a script that an individual user could run (which would avoid the mistakes you mentioned) would be fine with you, you can try the following:

$tempFile = "C:\mypath\vault-migration.rdm"

# Auto-generate a cryptographically random password
$randomBytes = [System.Security.Cryptography.RandomNumberGenerator]::GetBytes(32)
$password = [Convert]::ToBase64String($randomBytes) | ConvertTo-SecureString -AsPlainText -Force

# Source data source
Get-RDMDataSource -Name "Source DVLS" | Set-RDMCurrentDataSource

$entries = Get-RDMEntry -VaultMode User

if (-not $entries) {
    Write-Host "No private vault entries found."
    return
}

Export-RDMSession -XML -IncludeCredentials -Path $tempFile -Sessions $entries -Password $password

# Target data source
Get-RDMDataSource -Name "Target DVLS" | Set-RDMCurrentDataSource

Import-RDMEntry -Path $tempFile -Password $password -VaultMode User -Set

Remove-Item $tempFile -Force

The users would have to run this themselves, but it would avoid the failure modes you mentioned. It includes credentials by default, generates a strong password (a long, random string like IBMvhKTI0lo+peDi6Pnppvrm9bBBqChDm72M0dEFrPY=), and deletes the file automatically after.

Best regards,

Christian

Hello @rbouwmeester,

Apologies for the confusion in my previous message. The cmdlets Import-RDMCustomVariable and Export-RDMCustomVariable are already available (as of version 2025.3.0 of the Devolutions.PowerShell module). We do plan to introduce additional cmdlets to allow initializing, modifying, and removing these variables in the near future. In the meantime, the existing cmdlets should allow you to migrate your variables as-is.

Best regards,

Christian

Hello,

Your thread has been moved to the Windows support forum.

Best regards,

Christian

Hello @tonyfredriksson,

Version 2026.1.3 of the Devolutions.PowerShell module introduces a fix for this issue; Get-RDMOAuthToken should no longer throw this error when fetching the token. Feel free to contact us if you encounter any other problems.

Best regards,

Christian