Saemundsson.se

From proof of concept to production: the part that is not code

Vikingur Saemundsson — Wed, 21 Oct 2026 07:02:26 GMT

My last post compared Director-Driven Development with other AI coding workflows and ended on a narrow claim: AI tools generate and review code, and my frameworks make the architecture and security requirements part of “done”. Writing it, I kept bumping into a bigger objection, my own: an app is so much more than the app. In an enterprise, a proof of concept becomes production only when the infrastructure, the identities, the monitoring, the backups, the network, the people on call and the evidence for the auditor exist around it. CodeQL finds flaws in code. The door an attacker uses is often somewhere else.

So this post takes the wider view. What does production readiness mean beyond the code? What do the breach reports say about where things actually fail? What do AI coding tools cover at those layers, and what do enterprises use instead? And what does my SaaS framework, SaaSAllTheThings, actually do when you hand it your security framework, such as the ISF Standard of Good Practice? I read its latest release file by file to answer that last one, and the answer is narrower than what I had been saying. The research notes with every source are linked at the end.

What production means, beyond the code

There is no single checklist, so I used the ones enterprises already use to name the areas: the Azure Well-Architected pillars, the Cloud Adoption Framework’s landing-zone design areas, GDPR Articles 32 and 33, and the control titles of ISO/IEC 27002. The envelope around a business-critical system comes out as eight areas.

Infrastructure and change: environments as code, reviewed change, no drift between the template and the estate.
Monitoring and operations: observability, alert routes, incident response. GDPR gives a controller 72 hours from awareness to notify, so detection and escalation have to exist before go-live.
Compliance evidence: proof that controls operated over time, not only that they were designed.
Personal data: classification, minimisation, retention, residency, deletion.
Access: identities, MFA, least privilege, just-in-time access to production, periodic reviews. In every cloud service model the customer keeps the data, the configuration and the identities.
Continuity and recovery: recovery point and time, backups, and a restore that has been tested, which GDPR Article 32 asks for in as many words.
Networking: public access off, private endpoints, local authentication off, controlled egress.
Supply chain: dependencies, third parties, pipeline identity.

One judgment runs through all of them. A repository can hold the requirement, the design and the infrastructure code. It cannot hold the proof. Each of these areas is shown by a running system, its logs and a test performed on it.

Where things actually fail

The 2026 editions of the big incident reports agree on more than I expected, with two cautions: they measure different populations, so their numbers must not be added, and several figures below come from summaries because the full reports were not readable to me.

Verizon’s 2026 Data Breach Investigations Report, covering more than 22,000 confirmed breaches, puts vulnerability exploitation first among entry points at 31 percent of breaches, ahead of stolen credentials for the first time in 19 years. A third party was involved in 48 percent of breaches. Mandiant’s M-Trends 2026, from more than 500,000 hours of incident response, also puts exploits first at 32 percent, for the sixth year running, with voice phishing second. Microsoft’s Digital Defense Report 2026 counts nearly 40,000 published vulnerabilities in the first half of the year, weaponised in well under 24 hours, while enterprise remediation of critical external vulnerabilities “can take 30 to 60 days”. IBM’s 2026 Cost of a Data Breach, from 602 breaches, puts the average cost at 4.99 million dollars and the time to identify and contain a breach at 247 days, the first rise in five years; 53 percent of the breached organisations lacked encryption for sensitive data at rest or in transit.

Read together, these say three things about people and process.

First, “exploitation” here is mostly not your application code. The named targets are edge devices, VPNs and deployed products, and the failure is a patch that took 30 to 60 days to land. That is exposure management, an operations discipline, and it fails for reasons of ownership and change control rather than coding skill. No report I read gives a share for flaws in the victim’s own application code, so I cannot put “code against everything else” in one number. What I can say is that code review alone addresses a minority of what these reports describe.

Second, identity and people are the other door: valid accounts, user execution, phishing by email and by phone, and a human element in a majority of breaches. Third-party involvement rose from 30 to 48 percent of breaches in one year. Those are process failures in onboarding, offboarding, access review and vendor management, and they happen in organisations with good code.

Third, detection is slow. 247 days to identify and contain, a median dwell of 14 days, 25 days before an outsider tells you. Monitoring and an incident process are not nice-to-haves after launch. They are the difference between an incident and a notification to the regulator.

On misconfiguration specifically, the only source that ranks it first is the Cloud Security Alliance’s survey of more than 500 experts, which is perception rather than incident data. I include it because its order matches what I see in practice: misconfiguration and weak change control, identity, insecure interfaces, and only in sixth place insecure software development.

What the tools cover at these layers

My earlier post found that the AI coding tools now ship real security features: Copilot’s cloud agent runs CodeQL, secret scanning and dependency checks by default; Devin reviews every pull request for security flaws and cannot be switched off; Cursor’s Bugbot and the newer Codex and Claude Code security scans look for vulnerabilities in source. Looked at against the envelope, they all sit in the same place: the editor and the pull request, on source code. CodeQL does not list Bicep, Terraform or ARM templates among its languages. Bugbot deliberately does not read credential-like files or Terraform state. Codex Security’s own documentation says a scan with no findings can still miss vulnerabilities, and none of them mentions infrastructure configuration, identity or runtime.

Enterprises close that gap with different tools at different stages. Azure Policy has built-in definitions such as “Cosmos DB should disable public network access” and “Key Vault should disable public network access”, and its Deny effect refuses the deployment before the resource provider ever sees it, while existing resources are only marked non-compliant. Microsoft Security DevOps scans infrastructure as code in the pipeline with Template Analyzer, Checkov and Terrascan. Defender for Cloud assesses the deployed estate continuously against standards such as ISO/IEC 27001 and NIST SP 800-53, and is honest that some controls cannot be assessed automatically. GitHub exports an SBOM from its dependency graph.

Neither set replaces the other. CodeQL cannot see a public endpoint, and Azure Policy cannot see an injection flaw. That is the first correction to my framing: a production-grade pipeline is a stack of gates at commit, at deploy and at run time, and no coding tool, mine included, covers more than one of them.

What SaaSAllTheThings does with your security framework

SaaSAllTheThings is my framework for B2B SaaS on Azure, built on the idea that the customer’s own security framework and control requirements live in the repository and shape every architecture decision. I had been describing that as a full supply-chain view that brings more security and easier compliance proof than other tools. Here is what the latest release actually does, from its files.

The path starts with a human. You name your security framework and the control frameworks that apply in the director brief, with the version, what applies and what evidence is expected from whom, and you put the requirement text or your own control list in a compliance folder. Nothing parses it. An assessment procedure reads the brief, scores nine dimensions, including configuration and secrets, identity, and delivery and operations, and picks workshops. The workshops cover vision and constraints, tenancy and identity with the security officer and the data protection officer in the room, integration and credentials, and operations: just-in-time production access, managed identities, Key Vault, a threat review of the target picture, recovery point and time, support and cost. Their outputs go into the requirements document, the decision log and draft architecture decision records.

Every architecture session then reads the compliance folder and the requirements document’s Data and Compliance section, flags a conflict between a requirement and the reference design, weighs each option against OWASP, least privilege, defence in depth, zero trust, data minimisation and “any standard named in the compliance requirements”, and states the security and compliance impact of each option. Only the human accepts the decision. The research procedure treats the customer’s security framework as the top-tier source, traces each requirement to a control, labels the trace as direct, partial, interpretive or unverified, and never lets text from the compliance folder into a public search.

Then there is the check. It fails the build on nine rules: layering, domain purity, two tenant-isolation rules, secrets patterns, file and host size, message versioning and cost-driven SKU choice. The only way past a failing rule is an accepted decision record naming the rule and the file, and a proposed decision does not count. That part holds, and I found nothing like it in the other tools.

Now the gaps, area by area against the envelope.

Area	What the release has	Form	What is missing
Infrastructure and change	Bicep conventions, dev and prod separation, prod from a tag behind approval, what-if first, Bicep compiled in the check	Reference text, one Bicep rule	No shipped pipeline; network, tags and diagnostics not checked
Monitoring	Structured logs with tenant and correlation ids, no personal data in logs, alerts in Bicep, a health endpoint	Advised	Incident response, runbooks, on-call, log retention, SIEM
Compliance evidence	Requirements, decision log, decision records, items with outcomes, assessment and workshop notes, research notes	Records	Operating evidence; check results are not kept unless the project adds CI
Personal data	Retention, residency and personal fields decided in the requirements; personal data kept out of logs and keys; deletion as a capability	Advised	No rule in the check; no classification scheme, DPIA or deletion test
Access	Token validation, managed identities, no client secrets, groups not individuals, just-in-time where the customer has it; hooks block force-push, resource deletion, reading secret values	Three rules enforced, the rest advised	Role assignments, MFA and conditional access live in the tenant, not the repository
Continuity	Continuous backup by default, one region, scaling up by decision record; the workshop asks for recovery point and time	Defaults and prompts	DR design, failover, restore test, runbook
Networking	Outbound-only or VPN for integrations; local authentication off	Absent as a requirement	Private endpoints, egress control; the default Service Bus tier cannot be private-only, so private networking is a decision-record-with-exception path, not the default
Supply chain	Domain and contract layers take no external packages; local Bicep modules only; one contract per external system	Partly enforced	Dependency scanning, SBOM, provenance, supplier assessment

Two more limits belong here. The gate is a local pre-commit hook and, in Claude Code, a stop hook; no CI ships with the framework, so a passing check leaves no record off the developer’s machine unless the project adds one. And “only the human accepts a decision” rests on a rule and a hook that asks before writing “accepted”. The status is a line of text. Branch protection and pull request review are what make it binding, and the framework does not set those up for you.

The claims, checked

“A full supply-chain view.” Does not hold. For the delivery chain, requirement to commit, it holds in part: the records link a requirement to a decision to an item to a commit. For components and vendors, there is no SBOM, no dependency scanning, no provenance and no supplier assessment. I will stop saying it.
“More security than others.” Not as stated. The narrow version holds: tenant source, tenant branching, secret patterns and layering are enforced where other tools advise. The wide version fails: Copilot ships code scanning, secret scanning and dependency checks by default, and SaaSAllTheThings ships none of those. Proving “more” would take a measured comparison on sample applications and a penetration test.
“Easier compliance proof.” Plausible for design-stage evidence, unproven beyond it. The requirements and the named framework are in the repository, every architecture session reads them, and every deviation is a decision you accepted. No release maps a rule or a test to a control identifier, no auditor has read these records, and the operating evidence, access reviews, pipeline approvals, restore tests, comes from the running system.
“Cannot exfiltrate through public endpoints.” Not on the records. There is no network requirement and no rule for it.
“Production-ready.” No. Same answer as last time: that needs a deployment and an audit.

What does hold, in sentences I am comfortable publishing: your security and architecture requirements become design records and a build gate; the customer’s framework lives in the repository and every architecture session reads it; every decision and change leaves a record a reviewer can read; and the running system, not the repository, provides the operating evidence.

Does this change the equation?

Yes, in both directions. It makes the case for structure stronger: the breach reports say the failures that cost the most are failures of ownership, change control, access review and detection, and a workflow whose whole point is written requirements, named owners, accepted decisions and a gate is aimed at exactly that. It also makes my framework’s reach smaller than I was claiming. Of the eight areas, it enforces parts of three, advises on six, and is silent on networking and the component supply chain.

So the work is clear, and it is the same work for anyone taking an AI-built proof of concept toward production. On the framework side: a network posture topic with a rule on public network access and local authentication, a shipped CI workflow that keeps the check’s output as evidence, a seeded mapping table from control identifier to requirement to rule or test, a continuity topic with a restore-test item, and a dependency view. On the proof side: a pilot deployment with Azure Policy deny assignments and Defender for Cloud, tested from outside, and then an auditor reading the records. Until that pilot exists, the honest sentence is that the framework carries the requirements and the design to the commit, and the enterprise’s own platform controls and people carry them the rest of the way.

If you run a platform or a security function and would like to be that pilot, I would like to hear from you.

Sources

Breach and incident reports, read 21 October 2026: Verizon, 2026 Data Breach Investigations Report and its news release; IBM, Cost of a Data Breach 2026; Microsoft Digital Defense Report 2026; Mandiant M-Trends 2026; Cloud Security Alliance, Top Threats to Cloud Computing 2024. Several figures (human element, credential abuse, dwell time, IBM root causes) come from secondary summaries of these reports; the full reports were too large or unreadable in my tools.

Platform and standards: Azure Well-Architected pillars; Cloud Adoption Framework landing zone design areas; Shared responsibility in the cloud; Azure Policy deny effect and the Service Bus and Cosmos DB built-in definitions; Scan infrastructure as code with Microsoft Security DevOps; Service Bus private endpoints; Cosmos DB continuous backup; GDPR Articles 32 and 33; ISF Standard of Good Practice.

Tool documentation: CodeQL supported languages; GitHub secret scanning and SBOM export; Cursor Bugbot; Devin Review; Codex Security; Claude Code Security.

SaaSAllTheThings at its latest release: the repository, read file by file: rules, procedures, workshops, reference pages, templates, the check and its hooks. Nothing was run and no deployment was made; “not found” means not found in those files.

The research notes behind this post, with every claim, source, tier and confidence, and the open gaps: production readiness of AI coding tools and from proof of concept to production in an enterprise. The earlier post this one extends: Where Director-Driven Development sits among AI coding workflows.

Where Director-Driven Development sits among AI coding workflows

Vikingur Saemundsson — Wed, 21 Oct 2026 07:00:51 GMT

I built Director-Driven Development because the second prompt kept going wrong: the fix after the demo, the feature on top of something that already worked. Since then the tools have moved fast, and I owed myself an honest look at what the alternatives do now, what my way of working shares with them, where it stands alone, and where it claims too much. This post is that look. It comes from reading the vendors’ own documentation and best-practice guides in October 2026, not from benchmarks, so it says what each one ships or prescribes, not how well it works.

The alternatives, in four groups: plain agent use (Claude Code, Cursor, Copilot’s agent mode, Codex, Gemini CLI); spec-driven workflows (Kiro, GitHub’s spec-kit, the BMAD method, and published practitioner methods such as Addy Osmani’s and Harper Reed’s); agent harnesses (Aider, Cline, Roo Code, OpenHands); and autonomous agents (Devin, Codex cloud, Jules, Copilot’s cloud agent).

What is common practice now

Most of the ideas I started from are mainstream in 2026, and that is good news, not bad.

Verification as the core loop. Anthropic’s Claude Code guide opens with “give Claude a way to verify its work”; Devin’s guide asks for tests, linters and concrete pass conditions; Aider re-runs tests after every edit and tries to fix what fails. DDD’s check is the same idea with a fixed name and exit codes.
Spec first, small tasks, fresh contexts. Osmani, Reed, Kiro, spec-kit and the Claude guide (“interview you, write SPEC.md, start a fresh session”) all say it. DDD’s one-item-one-context is the same move.
Instruction files. AGENTS.md is read by Cursor, Codex and Jules, so my choice of it is no longer a choice.
Review in a fresh context. The Claude guide recommends an adversarial reviewer subagent in nearly the words of DDD’s review rule.
Hooks for guarantees. The same guide draws the line I draw: instruction files are advisory, hooks are deterministic.

If you are doing those five things with any tool, you are most of the way to this way of working already.

Where it stands alone, as far as I could find

Reading overview pages, not every sub-page, these were not found anywhere else:

A decision log tied to dated research notes, each with its sources, confidence and a “verified as of” date, so a later session reuses the evidence instead of redoing it.
A size-keyed model map with a one-step escalation and a two-attempt stop. Cline and Roo pick a model per mode, Osmani per task; none ties it to a written size scale with a retry rule.
A named drift reset that only the director can start, beside a routine alignment pass over the records and the code. Kiro and spec-kit check a spec’s internal consistency, which is narrower.
An ownership table with placeholders for what the human owns, backed by a hook that blocks the agent from the director’s own workspace.
Architecture rules inside the build check, with an accepted decision record as the only way past them. The Claude guide tells you to write such hooks yourself; spec-kit’s gates are checkboxes in a template that the model fills in.

The honest qualifier: “not found” on the pages I read, and vendors ship monthly.

Where others do more

Isolation and scale: OS-level sandboxes, cloud runs, parallel worktrees, agent teams and batch fan-out in Claude Code; Copilot’s ephemeral cloud environment; Jules’s virtual machine. DDD runs where you run it.
Autonomous loops with an evaluator and a permissions classifier.
Spec depth: Kiro’s wave-based parallel tasks and property-based tests, spec-kit’s presets and extensions, BMAD’s multi-role sessions.
Team enforcement: Cursor’s enforced team rules, Copilot’s organisation instructions and rulesets.
Rewind: checkpoints that restore both the conversation and the code.
Tool reach: IDE integration, MCP servers, plugin marketplaces. DDD ships as Markdown, shell and skills, with no IDE surface, and its enforcement exists only in the three domains it has frameworks for: Godot games, small apps, B2B SaaS on Azure.

The claim I wanted to make, and what survives

My working line was: others help you make something that works; DDD gets you to software you can prove is stable, tested and compliant. Checked against what the vendors ship, half of that is wrong.

“Others stop at working” is false. GitHub’s Copilot cloud agent runs CodeQL, secret scanning and dependency checks by default, needs a human to approve its workflow runs, and cannot approve or merge its own pull request. Devin’s review scans every pull request for security issues and cannot be turned off. Claude Code’s hooks can fail a turn until a check passes. Every vendor also puts the final review of the output with you, in writing.

What they don’t ship is the package: architecture rules as part of “done”, exceptions only through a decision record you accept, and the customer’s own security framework living in the repository where every architecture session reads it. That is what SaaSAllTheThings does, and I did not find it elsewhere.

“Provably stable” and “compliant” don’t survive either. I have no production deployment data, no independent quality measurement and no audit. The vendors’ SOC 2 and ISO 27001 certificates cover their services, not the software built with them, and no regulation I read requires a particular gate on AI-written code; a customer’s control framework and its auditor decide what evidence counts. My own earlier post said that people own compliance, not the framework. It still does.

The evidence that a gate matters, though, is real and independent of me. Veracode found security flaws in 45 percent of its tests of AI-generated code, with newer and larger models no better. CodeRabbit counted 1.7 times the issues per AI co-authored pull request, and 1.6 times the security issues, in 470 pull requests with authorship inferred. DORA associates a 25 percent rise in AI adoption with 7 percent less delivery stability. A study of 4,022 agent pull requests found a security smell in 39 percent, and that human review missed 81 percent of the hard-coded credentials among them. Review alone does not catch this; a deterministic check does, which is the whole argument for putting the rules in the check.

So the line that holds is shorter: AI tools generate and review; Director-Driven Development makes the architecture and security requirements part of done, and leaves records a reviewer can read. Anything stronger needs a production run or an audit, and I will write that post when I have one.

Sources

Vendor documentation, read 19 and 20 October 2026: Anthropic, Best practices for Claude Code and Claude Code security; GitHub, about the Copilot cloud agent and its risks and mitigations page; GitHub spec-kit and its spec-driven.md; Kiro specs and hooks; BMAD method; Cursor rules and Bugbot; OpenAI Codex, AGENTS.md and security; Jules; Devin, instructing Devin and Devin Review; Cline, plan and act; Roo Code modes; Aider, lint and test; Gemini CLI context files; OpenHands.

Practitioner methods: Addy Osmani, my AI coding workflow; Harper Reed, my LLM codegen workflow.

Evidence on AI-generated code: Veracode, GenAI Code Security Report 2025; CodeRabbit, State of AI vs human code; GitClear, AI code quality 2025; DORA, the impact of generative AI in software development; security smells in agent pull requests, arXiv 2607.12428; Perry et al., do users write more insecure code with AI assistants, arXiv 2211.03622. Regulation and standards consulted: NIST SP 800-218A, EU AI Act, Article 15.

The two research notes behind this post, with the full comparison matrix and the gaps in what was read, are in the Director-Driven Development repository: the comparison and production readiness.

What directing AI agents costs: three projects, measured

Vikingur Saemundsson — Mon, 19 Oct 2026 13:58:00 GMT

Everyone building with AI coding agents has an opinion about what it costs. I had one too. So I measured it instead: three projects, every token, priced at the public API rates, over the 24 days since the first commit of the largest one. This post is the result, with the conclusions I think the numbers support and the ones they don’t.

The three projects all run on Director-Driven Development: I direct, agents build, one automatic check decides when a task is done, and every decision is written down. If you haven’t read about it, the original post explains the why and the docs explain the how.

Director-Driven Development itself: the documentation site, which also builds and releases the three frameworks (Godot-Director, App-Director, SaaSAllTheThings) from its own task queue. Nine days.
PKSEI, a comedy rage game in which four friends paddle a canoe catamaran across a lake, built in two and a half days and playable on itch.io. Its devlog tells the story; the repository holds the records.
Lantern, a codename: a larger indie game, 24 days in and not yet announced. Its code base is about half done in technical functionality; the assets, the playtesting and the tuning come later.

How I measured

Claude Code keeps a transcript of every session on disk, including the subagents a session starts, and every reply in it carries the token counts: fresh input, output, cache writes, cache reads, and the model that produced it. I summed them, one entry per message, and priced them at the pay-as-you-go API rates on claude.com/pricing as of 19 October 2026: Fable 5.1 at $10 in and $50 out per million tokens, Opus 5.5 at $4 and $20, Sonnet 5.5 at $2 and $10, Haiku 5.5 at $0.10 and $0.50, with cache reads at a tenth to a fortieth of the input price and cache writes at 1.25 times it. The script is in the repository: tools/usage.py.

One thing to hold on to for the rest of the post: none of this was billed per token. All three projects ran on a Claude Max subscription. The dollar figures are what the same tokens would have cost on the API: a measure of the size of the work, not of money spent. The money comes at the end.

The numbers

	Director-Driven Development	PKSEI	Lantern
Span	9 days	2.5 days	24 days
Hours at the keyboard, mine	17	3	30
Hours the agent worked on its own	24	14	96
Commits	330 (200 in the docs repo, 130 in the frameworks)	127	537
Tasks completed	142	92	514
Tokens	1.1 billion	0.3 billion	3.0 billion
API-equivalent	$364	$244	$1,067
Per completed task	$2.56	$2.65	$2.08
Per hour at the keyboard	$22	$84	$36

Cost per completed task: $2.56, $2.65 and $2.08 across the three projects, with the subscription scale in cents beside the API-equivalent dollars

What those tasks produced: a 44,000-word documentation site; 20 framework releases, including Godot-Director’s auto-playtesting (14,000 new lines); a 22,000-line game with its tests, generated art and sound, shipped to itch.io about twenty times.

“Hours at the keyboard” is every wait of thirty minutes or less that ended with a message from me: reading the agent’s report, deciding, typing. “On its own” is the rest of the time between events, the agent generating, running tools and waiting for its builders. Neither counts what happens away from the keyboard: playing the game on a phone, thinking, reviewing pull requests on GitHub. So my real hours are higher, by one to two on PKSEI alone by my own estimate, and the per-hour figures are upper bounds. The PKSEI devlog counts permission approvals as keyboard time too and gets 4.7 hours; the transcripts can’t tell an approval from a tool finishing, so this post leaves them out.

One source note: the PKSEI devlog quotes Claude Code’s own session report, $258 and 1.67 million output tokens for the build. The transcripts, which this post uses for all three projects so they compare, give $244 and 1.73 million; the two agree within six percent, the difference being two commits made after the report.

Where the money goes

Cache reads are 96 to 97 percent of the tokens and between a third and a half of the cost. Fresh input is nothing: my messages are a sentence or two. Output, which is all the code, tests, records and reports plus the models’ thinking, is half a percent of the tokens and 13 to 27 percent of the cost. The rest is cache writes: every builder that starts in a fresh context writes the records it reads into the cache, 80,000 tokens for a small item, a million for a large one.

Where the money goes: cache reads, cache writes, output and fresh input as shares of each project’s cost

The surprise was who spends it. The orchestrating session, the one I talk to, accounts for 60 to 72 percent of the cost in all three projects. The builders, reviewers and researchers it starts are the rest. The orchestrator designs, keeps the records, reads every report, writes every commit and pull request.

What a change costs

A task is small by design, so a cost per task is partly a statement about how I cut the work. Merged changes are the unit other people publish, so here are seven of mine from the three projects, large to small, measured from the moment the first builder started to the moment the change was committed or its pull request opened. The design conversation before the builder isn’t in these numbers; the builders, the reviewers and the orchestrator’s bookkeeping are. The sources at the end name each one.

Sample	What it is	Size	API-equivalent
1	A game hazard, the beast that guards the lake’s edges: its rule class, scene and tests	1,038 lines, 23 files, 1 commit	$7.90
2	A game’s hazard framework: seeded bands, an effects palette, the first hazard, with tests	755 lines, 21 files, 1 commit	$7.60
3	A game rule class with its tests: paddling against the current	229 lines, 9 files, 1 commit	$1.14
4	The same installer change in two framework repositories, built in parallel	220 lines, 8 files, 2 commits	$0.65 together
5	A framework adapter hook with its tests and docs	169 lines, 12 files, 1 commit	$1.82
6	An installer change with tests	137 lines, 4 files, 1 commit	$0.50
7	A small game fix: a swimmer shows his beer only while he has one	17 lines, 2 files, 1 commit	$0.29

A third of a cent to two cents per line added, around a cent for anything over a hundred lines, and the orchestrator’s share grows as the change shrinks. One change is left out of the table and the charts because it is an order of magnitude larger than a typical task: a 6,687-line framework feature built in five commits, two of them with an independent Opus review, which cost $50 of API-equivalent and twenty minutes of my attention spread over four hours, at the same rate per line as the rest.

The published comparison is Jellyfish’s, from 12,000 developers in the first quarter of 2026, at list prices: cost per merged pull request from $0.28 in their cheapest tier to $89 in their most expensive, with a median of about 7 million tokens per pull request and 69 million in the top decile. They don’t say how big their pull requests are. Mine run from $0.29 to $7.90 with the size stated, and the one large feature, at $50, used twice the tokens of their top decile. One practitioner ran the same real feature 29 times through a dozen agents and harnesses and got $3 to $33 per merged feature. One developer published his own two months on Claude Code with a spec-driven workflow, which is close to mine: $36 per commit, $314 per day, with commits six to thirteen times the size of mine in output tokens. Per token of output we’re of the same order; per commit I’m far cheaper because my commits are far smaller.

Approximate spend per change, by size, on a log scale: seven changes from the three projects, 17 to 1,038 lines, costing $0.29 to $7.90, against Jellyfish’s $0.28 to $89 per merged pull request, one feature’s $3 to $33, one engineer’s $43 per pull request and one developer’s $36 per commit

The same data on a linear scale, which is how the difference looks when the axis is money rather than ratios:

What the way of working does to the bill

Three things in the workflow show up in the numbers, and one thing I expected doesn’t.

It is cache-friendly. Without caching, the same tokens would cost eleven to twelve times more: $4,532, $2,847 and $11,773. Caching is Anthropic’s feature and any Claude Code session gets it, so I won’t claim the saving as mine. What the workflow contributes is stable context: the rules, the records and the task list live in files that every session and every builder reads the same way, so almost everything a model sees, it has seen before.

Small tasks, one commit each, keep the per-task cost flat. $2.08, $2.56 and $2.65 for three projects of very different size and shape. That consistency is the most useful number in this post, and it is partly a property of how the work is cut: a task is sized to fit one builder in one fresh context, and the size picks the model.

The director’s hours are the limit, not the tokens. At $20 to $85 of API-equivalent per hour at the keyboard, with the agent working one and a half to five hours on its own for each of mine, a full day of directing is a $200 to $700 day, and I can’t direct more than a day a day. The one week I ran three sessions in parallel is the week the bill was highest.

Model sizing saves less than I thought. Sending small items to Haiku and medium ones to Sonnet saved about 9 percent against running everything on Opus. The builders aren’t where the tokens are; the orchestrator is, and its model is the biggest single cost choice. In PKSEI I ran the orchestrator on Fable 5.1 on purpose, because I had weekly allowance to spare and wanted to try it: $136 of the project’s $244. The same session on Opus would have been about $55. I also found a mistake there: 48 of the 89 builder runs had inherited Fable from the session instead of getting the model their size called for, $94, nearly forty percent of the project’s cost, for no reason. The fix is a rule now queued in all three frameworks: a builder always gets its model passed explicitly. And a confession about the orchestrator: since moving to Max I have run design sessions on Opus and Fable because the allowance was there, not because the work needed it. Everything on Sonnet 5.5, orchestrator included, would have cost $198, $80 and $581 instead of $364, $244 and $1,067: a third to a half. I haven’t measured what that does to quality, so it’s a floor, not a recommendation.

What the subscription turns it into

Here is the money. Anthropic publishes the plan prices and the session multiples (Max 5x and Max 20x are five and twenty times Pro per five-hour window), not the weekly caps. Third-party measurements from real accounts fill the gap; the week of 12 October 2026, Wokey measured Pro’s weekly cap at about $170 of API-equivalent across 474 accounts and Max 20x at about $1,640 across 17. My own heaviest week, $1,155 across six projects with allowance left, agrees with the 20x figure.

	Pro, $20	Max 5x, $100	Max 20x, $200
Weekly cap, API-equivalent	about $170	unmeasured; roughly half of 20x	about $1,640
Per month if you use the week	about $740	$2,000 to $4,000	about $7,100
What you pay per API dollar	about 3 cents	3 to 5 cents	about 3 cents

One director’s month in API-equivalent dollars per week, against the measured Pro and Max 20x weekly caps

If the weekly limit is used, every plan delivers its tokens at roughly a thirtieth of the API price. The $2 to $3 per completed task becomes six to eight cents. The $50 feature pull request becomes a dollar and a half. The $20 to $85 per hour at the keyboard becomes under a dollar to two and a half.

Which plan fits: at $20 to $85 an hour at the keyboard, a Pro week covers two to eight hours of directing, a Max 5x week roughly six to forty, a Max 20x week twenty to seventy-five. The five-hour window binds first on Pro: about $14 of API value, which this way of working spends in well under an hour. So Pro suits a few hours a week in short sittings, Max 5x a part-time director, and Max 20x a full-time one, parallel sessions, and Fable, which on Max may use half the weekly cap at no extra charge but moves the meter about twice as fast as Opus. Past any cap, extra usage is billed at API rates.

How it sits next to what others measure

The structural numbers agree with outside data: Cursor reports that about 90 percent of its tokens are cache reads across two years of aggregate use, Jellyfish reports 96 percent across its customers, and an academic study of agent runs on SWE-bench finds cache reads the largest token category in every phase; my 96 to 97 percent fits. The cost-per-change comparison is the one above, and it is the one the claim rests on.

The productivity numbers don’t line up, because there’s nothing to line them up with. The large studies measure time on task, tasks or pull requests per developer, and cycle time, and they disagree: controlled trials range from 19 percent slower (METR’s 2025 trial of experienced developers in their own repositories) to 56 percent faster (a one-task trial with hired programmers); the telemetry studies that also count review load and defects find those rising faster than output. None joins billed cost to merged changes on real projects, no one reports work per million tokens, and no study separates a structured workflow from freeform use on cost or output, which is the measurement this post would need to claim more than it does. So I won’t put my 142 tasks in nine days next to anyone’s uplift figure. The honest comparison is the one above: same token shape, and pull requests inside the only published cost range, with their sizes stated and most of theirs not.

The conclusions

Director-Driven Development is an efficient way to turn attention into shipped work. Not because of a trick with models, but because the whole loop is built to be cached, cut small and recorded: a completed task costs $2 to $3 of API-equivalent whether it’s a docs page, a game rule with its tests, or a framework release; a 6,700-line feature with its tests costs $50 and twenty minutes of attention; and the records show where every dollar went. The bill scales with my hours, which is the constraint I’d choose.

Claude Code on a subscription is remarkable value for this way of working. Used to its weekly cap, a plan delivers tokens at about three cents on the API dollar; a few hours a week fit in Pro, a part-time director in Max 5x, and a full-time one, parallel sessions or Fable call for 20x.

And what I’m not claiming, because I didn’t measure it: that this is cheaper than building the same things another way, by hand or with an agent and no workflow. There is no baseline in these numbers, and no one has published one. Nor do they say anything about quality: PKSEI still has 116 placeholder values, and the frameworks’ /ui-design feature is still in my own acceptance test. The numbers say what three real projects cost, to the token, and that the cost was flat, predictable and small next to the subscription that paid for it.

Measure your own

The transcripts are in ~/.claude/projects/. The script that produced every number here, tools/usage.py in the Director-Driven Development repository, prints the same table for any project on your machine: the total at dated prices, the shares by token kind and by session, your hours at the keyboard, and what it would have cost uncached or on one model. Date your prices, state whether you mean API-equivalent or money, and keep the orchestrator’s model in view: it’s where the tokens are.

Sources

The seven changes: samples 1, 2, 3 and 7 are PKSEI commits 54daa59, a63c993, b637d7a and e66b0aa; 4 is App-Director #22 with SaaSAllTheThings #15; 5 and 6 are Godot-Director #27 and #29. The large feature left out of the charts is Godot-Director #25.

The published figures: Jellyfish, “Is tokenmaxxing cost effective?” (April 2026) and its State of AI in Software Engineering report for the cache-read share; Insight, “Token Price Is the Wrong Number” (July 2026); Zest’s Claude Code pricing page; arXiv 2607.13080 (one developer, two 28-day periods, spec-driven); Cursor’s usage data via The Pragmatic Engineer; arXiv 2604.22750 on token use in agent runs; METR’s 2025 trial and the 2023 Copilot trial for the range of productivity findings; Wokey’s measured usage limits for the weekly caps; claude.com/pricing for the API prices and plans; the PKSEI devlog for the game’s own report. All read on 19 October 2026.

Anchoring AI-built SaaS in your security framework

Vikingur Saemundsson — Tue, 13 Oct 2026 06:44:33 GMT

When an AI agent writes most of your code, your security framework can’t sit in a document the agent never sees. It has to live where the agent works: in the repo, in the decisions it brings to you, and in the checks it can’t get past.

I’ve spent the last five years building cloud platforms for banks, insurance and government. The principle that runs through all of it is simple: trust, but verify. We anchor the platform in a control framework, enforce the controls that matter most, and audit the rest. Nobody has to remember every control. The platform does.

AI coding agents need the same thing, and more urgently. An agent works fast, never gets tired and never reads the wiki. Every change it makes looks reasonable on its own, and that is exactly how a platform slowly drifts away from its security framework.

This post shows how SaaSAllTheThings, my open-source framework for building B2B SaaS on Azure with Director-Driven Development, anchors a product in your security framework, in two layers:

Enforce what’s critical. A small set of rules is checked by machine, on every change, and an agent cannot get past them.
Audit the rest. Everything that needs judgement is put in front of you, the director, with the requirements quoted, before the decision is made.

If you’re new to the framework, the step-by-step guide covers the basics.

Figure 1: Anchored in your control framework. The framework in compliance/ feeds two layers: what the check and the hooks enforce, and what the director decides with the requirements in front of them.

1. Give requirements a home

An agent can only respect a requirement it can find. In SaaSAllTheThings, compliance requirements live in plain files in the app’s own repo, next to the code:

product/prd.md › Data and Compliance: data residency, retention, which data is personal, audit needs, and export and deletion when a customer leaves.
compliance/: the control framework you’re held to, such as the ISF Standard of Good Practice or ISO 27001, and the security requirements in your customer contracts. This is the anchor every architecture decision is checked against.
product/requirements/: user stories and feature specs, when you have them.

The framework asks for these early. Onboarding includes data and compliance in its product interview, and the tenancy and identity workshop ends with a data map: each kind of data, who owns it, whether it’s personal and how long it’s kept.

Anything you haven’t decided stays visibly undecided. The reference is explicit: until the PRD decides retention, residency and which fields are personal, they’re open questions, not guesses. An agent never picks a retention period because it seemed reasonable.

2. Enforce what’s critical

A handful of security controls are too important to depend on anyone remembering them, human or agent. SaaSAllTheThings builds them into the architecture and enforces them by machine, in two places. These are built into the check and the hooks: the small set of controls every SaaS on this architecture needs, whatever framework you answer to.

The check runs before every commit that touches code, and in Claude Code also before the agent ends its turn. Among its architecture rules, these carry the security weight:

Rule	What it stops
secrets	Secrets in code, configuration or apps
tenant-source	Reading the tenant from the request instead of the validated token
tenant-branching	Tenant-specific code: customers differ by data in a registry, never by code
layers	Clients reaching past the contracts, and layers depending on what they shouldn’t
cost-sku	Infrastructure outside the agreed cost tiers

The hooks stop commands before they run. An agent can’t read a Key Vault secret into its session, create a client secret (it has to use a federated credential), delete Azure resources, run a complete-mode deployment, force-push, or skip the check with --no-verify. Two more actions don’t block but ask you first: editing the framework’s own files, and marking an ADR as accepted.

None of this depends on the agent following instructions. A prompt can be ignored; a failing build can’t.

3. Audit the rest

Most compliance questions can’t be reduced to a pattern a script can match. Should this data be stored in another region? Is this integration allowed to see personal data? Those need judgement, and in Director-Driven Development judgement belongs to the director. The framework’s job is to make sure you never decide blind.

When an architecture question comes up, /architect prepares the call before it offers anything:

It reads your requirements. The reference topic in question, every related ADR, compliance/, product/requirements/ and the PRD’s Data and Compliance section.
It classifies the question: an open choice, a deviation from the reference, a gap in the framework, or a requirements conflict, where the compliant architecture would break a stated requirement, or a requirement forces a deviation.
It shows you the context first. The rule in question, the classification, related ADRs, and any conflict stated explicitly, before a single option is on the table.
It offers 2-4 options, each with its effort, monthly Azure cost, risk, security and compliance impact, and how hard it is to undo.
It checks every option against a standing baseline: OWASP Top 10, least privilege, defence in depth, zero trust, data minimisation, and the control framework in compliance/, whether that’s the ISF Standard of Good Practice, ISO 27001, SOC 2 or GDPR.
It recommends one, preferring the option that complies, the one that can be undone, and the stronger security posture when the effort is similar. Then it waits for you.

The same discipline continues into the build. Large items, and any medium item that touches tenant isolation, identity, a contract or a stored schema, get an independent, read-only reviewer in a fresh context before they are committed.

4. Build personal data in from the start

GDPR-style requirements are hard to retrofit, so the reference architecture bakes the basics in from the first commit:

No personal data in logs, traces or metrics. Log ids, not names, email addresses or document contents. No secrets or tokens either.
No personal data in partition keys, where it would be copied into indexes and hard to erase.
Events carry personal data only where a consumer needs it. Messages travel further than you think.
Deletion is a platform capability. Deleting a tenant’s or a person’s data is built as part of the platform, not a script someone runs by hand.
Export and deletion are a milestone. The roadmap’s second-tenant stage isn’t done until a second customer sees none of the first one’s data, and export and deletion work.
Isolation is tested before a customer arrives. /tenant won’t call a new customer ready unless every store has a tenant-isolation test. A missing one is a high-severity bug.

And when a customer needs more than pooled tenancy allows, such as dedicated infrastructure for a regulated tenant, the architecture is ready for it: a tenant can move to its own deployment. Whether that’s worth the cost is a product decision, made by you, with the price on the table.

5. Make every deviation leave a trail

In a regulated environment, the question is rarely “did you follow the rule?” It’s “when you didn’t, who decided, why, and what did it cost?” SaaSAllTheThings answers that from the repo itself:

An auditor asks	Where the answer lives
Why does this deviate from the standard architecture?	An ADR in `adr/`: context, the options with “comply” always first, and the decision
Who approved it?	The ADR’s status. Only the director accepts one, and in Claude Code a hook asks before it’s marked accepted
Is the exception still limited to what was approved?	The ADR’s “Exception:” lines. The check excuses a violation only while an accepted ADR names it
Is the deviation temporary?	Its removal item in `TASKS.md`. `/align` reports any temporary deviation without one
Why was this product rule chosen?	One line per decision in `product/decisions.md`
When did it change, and who approved the change?	The git history: one item, one commit, each approved by the director

/align keeps the trail honest between audits. It reports stale ADR exceptions, proposed ADRs that have waited more than a week, and decisions the PRD no longer reflects.

The point isn’t paperwork. Every record is something the agent needs anyway to work in a fresh context, so the audit trail costs nothing extra to keep.

6. Treat drift in tenancy as a security finding

Agents don’t break your design in one go. They drift: a principle that can be read two ways eventually gets read two ways. For product rules, that’s a design problem. For tenancy and identity, it’s a security problem, and the framework treats it as one.

When you start a design drift reset with /drift-reset, the analysis of the system as built always includes tenancy and identity as an area of its own: where the tenant comes from at every entry point, whether every store, query, blob path, cache key and message carries it, how tokens are validated, and anything that reads across tenants. Drift found there is marked as a security finding and reported to you at once.

It doesn’t become a design question, because the reference has already settled it. It goes straight into the queue as a high-severity bug, ahead of everything else in the rebuild. Accepted ADRs are checked the same way: each one must still be honoured, and a reset can never drop one without a new ADR.

Three things a reset is never allowed to do: propose a change to the tenancy, identity or cost rules, relax a rule in the check, or add an exception. The postmortem goes the other way. It repeats the tenancy and identity analysis on everything the rebuild touched, and turns drift a script could have caught into proposed new check rules for you to approve. Repeated judgement becomes a check.

Figure 3: Two kinds of drift. Product drift becomes a design call for the director; tenancy and identity drift becomes a high-severity bug.

What stays human

A framework doesn’t make a product compliant. People do. What SaaSAllTheThings does is make sure the human decisions are the ones that count, and that they can be found again:

You decide the data rules: residency, retention, what’s personal, what an auditor needs to see.
You accept every deviation, with its cost and risk in front of you.
You approve every commit, and production deployments are yours to run.
You onboard customers. Consent, role assignments and the registry entry are steps the framework writes out for you, not steps it takes.

Everything else is either enforced by the build or put in front of you before it matters. Enforce what’s critical, audit the rest.

It’s the same principle we’ve used on regulated cloud platforms for years. The difference is that an agent only knows what’s in front of it, so your requirements have to live in the repo, and your critical controls in the build.

SaaSAllTheThings is free and MIT licensed: github.com/Freakling/SaaSAllTheThings. If you’re building SaaS for a regulated industry and want to compare notes, I’m happy to talk.

Trust the agent. Verify with the build.

In the docs

SaaSAllTheThings: install, the check and every command
What the check enforces: section 2
Reviews: section 3
Deviation is an ADR and Records in files: section 5
/align and /drift-reset: sections 5 and 6
Ownership: what stays human

Build a B2B SaaS on Azure with Director-Driven Development

Vikingur Saemundsson — Fri, 09 Oct 2026 14:35:11 GMT

SaaSAllTheThings turns an idea, a proof of concept or an existing app into a multi-tenant B2B SaaS on Azure, with an AI coding agent doing the building and you directing it. It is free, MIT licensed and runs locally in your app’s own git repository.

In my Director-Driven Development post I described a way of working where you stop writing the implementation and become the director. SaaSAllTheThings is that way of working applied to the hardest kind of product I know: software that many business customers share, sign in to with their own identity provider, and trust with their data.

The framework splits the work three ways:

Figure 1: Three cards: you own the product, the framework owns the architecture, the AI agent builds.

The middle column is the unusual part. The architecture isn’t up for debate in every session, because the check enforces it, so your attention goes to the product.

This guide walks through it step by step, from an empty repo to a running, released stage. The commands are Claude Code slash commands; every one of them also works as a plain sentence (“do the next task”), and the core works with any assistant that reads AGENTS.md.

Step 1: Pick your starting point and install

There are two ways in, and they meet at the same place.

From scratch. A short product interview, then the platform is built in small, proven steps, starting with tenancy and sign-in rather than bolting them on later.
From a proof of concept or an existing app. Assess it first. The saas-assessment skill reads the app without changing it and writes a report: how ready it is (scored, with evidence), a roadmap by stage with rough effort, the decisions to make, and the workshops to hold. Ask it “what does it take to make this app a SaaS?”

Your app needs git with no uncommitted changes, bash (Git for Windows includes it) and your backend’s toolchain, the .NET SDK 8+ for the default stack. Then, in Claude Code:

/plugin marketplace add Freakling/SaaSAllTheThings
/plugin install saasallthethings@saasallthethings

Open a new session in your app’s folder and run /saasallthethings:saas-all-the-things. Onboarding works out whether this is a new app, an existing one or an upgrade, and then:

installs the files into your repo;
settles the backend stack with you, keeping yours if it’s compatible;
interviews you about the product, or reads the existing app, including its single-tenant habits and secrets;
writes the first stages of the roadmap into TASKS.md;
ends with one commit for you to approve.

Restart Claude Code so the new commands load. Using another assistant? Onboarding installs the tool-neutral core only, and your assistant follows AGENTS.md.

Figure 2: Two starting points, from scratch or an existing app, leading into six steps: install, design, plan, build, prove and release, with align and drift reset running alongside.

Step 2: Describe the product, one decision at a time

The product is yours, so the agent never decides a business rule on its own. Start a design session on any capability:

/design orders

Every product question comes back to you as 2-4 options with a recommendation, and you can always write your own answer. The agent proposes. The director decides. Your choices land in three plain files:

product/prd.md: the product’s current requirements, plus its open questions;
product/decisions.md: why, one line per decision;
TASKS.md: the items the decision creates.

Anything not decided yet goes on the open-questions list as Q<n>, and values you haven’t set are marked PLACEHOLDER in the code. /design questions ranks the open questions by what they unblock, so you know which decision to make next.

You don’t need a terminal for this part. The saas-design-session skill runs the same sessions in the Claude apps, on desktop, web or mobile, and it also prepares and scribes workshops with customers: agenda, pre-reads, timekeeping and decisions. Drop the notes into assessment/workshops/ and “process the workshop notes” turns them into records.

When a design session’s commit lands, clear the conversation. Every decision is in the files, so the next session loses nothing.

Figure 3: A design call with three options, one recommended, plus write your own, recorded in prd.md, decisions.md and TASKS.md.

Step 3: Let the framework own the architecture

You don’t design the architecture from scratch each time. SaaSAllTheThings ships a reference architecture in .satt/reference/, one topic per file, and the agent reads only the topics an item touches:

Layers: contracts, domain, application, infrastructure, integration, host, platform and client, each allowed to depend only on the layers the reference lists. The domain is pure; the Azure Functions hosts stay thin.
Event-driven: commands on queues, events on topics (Service Bus), state and its events saved together through an outbox, idempotent consumers, versioned contracts.
Clients: a Windows app and a mobile app, separate and thin, depending on the contracts only.
Cost: Flex Consumption Functions, serverless Cosmos DB, one Service Bus namespace, log caps and a budget per environment.

When a build can’t comply, it stops and asks. You change the architecture for one app through an architecture session:

/architect

It writes an architecture decision record in adr/. Option one is always “comply with the reference”, so a deviation has to earn its place, with its cost in effort and monthly Azure spend. An ADR stays proposed until you accept it; in Claude Code a hook asks you before any ADR is marked accepted. If the deviation would fail the check, the ADR names it in a line like this:

- Exception: <rule> <path pattern>

The check excuses a violation only while an accepted ADR names it. Deviation becomes a decision, not an accident.

Step 4: Get tenancy, identity and integrations right first

The parts that make SaaS hard are the parts most often bolted on last. SaaSAllTheThings builds them first and checks them by machine.

Tenancy is pooled. The tenant comes from the validated token, never from the request. Every record and message carries it. Tenants differ by data in a registry, never by code, and a tenant can move to its own deployment later.
Identity is OIDC with Entra ID, multi-tenant, so customers sign in with their own directory (External ID for those without one). Clients use auth code with PKCE. Managed identities and federated credentials everywhere: no secrets in code, config or apps.
Integrations get a contract you decide: direction, system of record and conflict handling, then one anti-corruption layer and function app per external system. /integrate navision starts with Navision (Dynamics NAV / Business Central).
Data rules are product decisions. Residency, retention, which fields are personal, audit needs, and export and deletion when a customer leaves all live in the PRD’s Data and Compliance section, and stay open questions until you decide them. Personal data

This is what the check does when someone, human or agent, reads the tenant from a request header. Real output from the framework’s example app:

check: architecture violations (only an accepted ADR in adr/ excuses one; see .satt/procedures/architect.md):
  [tenant-source] src/OrderDesk.Functions/Orders/PlaceOrderFunction.cs:30: the tenant comes from the validated token, never from the request
check: architecture: FAIL: 1 violations

A second rule, tenant-branching, fails tenant-specific ifs in the code. In Claude Code, a hook also blocks reading Key Vault secrets and creating client secrets.

When your first customer is ready, /tenant runs a readiness check (isolation tests on every store, no tenant-specific code, a decided plan, identity, integrations) and writes out the steps only you can take: the registry entry, the consent link for the customer’s admin, role assignments and a smoke test. Onboarding a tenant changes no code.

Figure 5: The tenant flows from sign-in through the validated token to handlers, stores and messages, while the check blocks tenant from the request and tenant-specific code.

Step 5: Plan one stage at a time

Every SaaSAllTheThings project goes through the same stages, so any session knows where the project stands. Existing apps start with stage 0, new ones at stage 1, and stages 4-6 can run side by side once the first slice works.

Figure 6: The nine stages from Extract to Capabilities, with tenancy and identity as stage 2 and stages 4 to 6 in parallel.

/roadmap writes items for the current stage and the next one only. Later stages wait, so they can be planned with what the earlier ones teach. Each item is small, sized and explicit about its scope:

### T12 · Place an order through the API · todo · M · agent
- Depends on: T10
- Touches: src/OrderDesk.Application/Orders/PlaceOrderHandler.cs (new), …
- Done when: an order without lines is rejected (test) · OrderPlacedV1 is saved with the order (test) · POST /api/v1/orders answers 201 in dev (demo)
- PRD: Capabilities › Orders

Touches names every file the item may change. Done when lists one to three observable outcomes, each tagged with how it’s proven. Large items are split before they start: contract first, then domain and application, then the host, then the client. Things only you can do, like app registrations or customer conversations, become human items in the same queue.

Step 6: Direct the build loop

Now the agent builds. One command picks the next ready item, high-severity bugs first:

/next-task

Or say “work through the queue”, and it keeps going until an item needs you. Each item runs the same loop:

Hand off. The main session claims the item and hands it to a builder subagent that starts with an empty context. The builder reads only what the item needs: the files in Touches, the relevant architecture rows, the PRD sections it names and the reference topics it touches.
Build on the right model. Each size maps to its own model: Haiku for XS and S, Sonnet for M, Opus for L and XL. A failed build retries once on the next size up.
Prove. The builder runs bash tools/check.sh: the architecture rules, then the stack’s build and tests, then the Bicep files, then any app-specific checks. “It compiled” is not an answer.
Review what’s risky. L and XL items, and M items that touch a contract, tenant isolation, identity or a stored schema, get an independent reviewer subagent in its own fresh context before the commit. Findings in scope are rebuilt; anything outside the item becomes a new item.
Commit. You approve it. One item, one commit.

Figure 7: The build loop: next ready item, fresh builder, the check, a reviewer for risky items, and a commit you approve.

The main session never reads the code being changed. After each item it keeps only the builder’s report of about 20 lines, so a session that works through ten items stays about as lean as one that did one. When a session ends, nothing is lost: TASKS.md, the commits, the PRD and the ADRs hold everything.

The check also runs in a git pre-commit hook, and in Claude Code before the agent ends its turn. A force push, reset --hard, --no-verify and deleting Azure resources are blocked outright.

Step 7: Prove it with people, then release

A passing check proves the code does what the item said. It doesn’t prove the product works for a customer. Two more loops close that gap:

Acceptance (/acceptance): a checklist of what’s been built that needs a human eye in a running app. You tick Works or Broken, and broken rules come back as bugs.
Feedback (/feedback): turns a customer or pilot session into bugs, score trends and product proposals. Proposals come to you as design calls, like everything else in the product.

Releasing is a guided procedure, not a script you run blind:

/release dev

It runs the check, a what-if of the infrastructure changes, the deploy and a smoke test, and asks for your approval at each step. Deploys and cloud changes always ask you first, and production is yours to run.

Step 8: Align often, reset when you have to

Agents don’t break your design. They drift. A principle that can be read two ways eventually gets read two ways.

Align often. /align is a routine consistency pass across the PRD, decisions, ADRs, integration contracts, TASKS.md and the code. Every capability rule is built, planned or reported as a gap, every recent decision is reflected in the PRD, every project in the solution has a row in the architecture table, the architecture check passes and no proposed ADR has waited more than a week. Mechanical drift gets fixed; anything that touches the product or the architecture comes back to you. When the same conflict keeps returning, align recommends a reset.

Reset when you have to. /drift-reset is for when everything is accounted for, but a principle has been built two different ways. Only you can start it:

Describe the system as built, area by area, with tenancy and identity always as an area of its own.
Map how each pillar, PRD rule, contract rule and ADR was actually interpreted, and classify it as consistent, divergent or contradictory.
Rewrite the design where it splits, one design call at a time.
Plan the rebuild as ordinary items. No code is written in the reset itself.
Run /drift-reset postmortem after the rebuild. Drift a script could have caught becomes a proposed check rule.

In SaaSAllTheThings a reset only covers the product you own. It never relaxes a check rule or touches the tenancy, identity and cost rules. Tenancy drift found in step 1 isn’t a design question at all: it’s a security finding, and it goes straight into the queue as a high-severity bug.

Figure 8: Align checks that everything is accounted for; the five-step drift reset checks that everything means one thing.

Try it

The fastest way to see what a project looks like is the worked example in the repository, [examples/order-desk](https://github.com/Freakling/SaaSAllTheThings/tree/main/examples/order-desk): a small order app with its PRD, decisions, ADRs, tasks and check settings in place. To watch the check work, clone the repository and run bash selftest.sh. It installs the framework into copies of the example and runs the architecture check, the hooks and the installer, with no Azure account needed.

Then pick your door:

A new product: install the plugin, run /saasallthethings:saas-all-the-things, and answer the product interview.
An existing app: run the saas-assessment skill first and read the report before you install anything.
Not ready for code yet: use saas-design-session in the Claude app to work through the product and architecture decisions, or to prepare a workshop with your team.

SaaSAllTheThings is free and MIT licensed: github.com/Freakling/SaaSAllTheThings. If you try it on a real product, I’d like to hear how it goes, and I’m happy to walk your team through it.

You own the product. The framework owns the architecture. The agent builds. Trust the agent, and verify with the build.

In the docs

SaaSAllTheThings: install, the check and every command
/design: step 2
/next-task: step 6
Acceptance check: step 7
/align and /drift-reset: step 8

Director-Driven Development: A New Way of Working with AI Coding Agents

Vikingur Saemundsson — Wed, 07 Oct 2026 14:59:06 GMT

Our role as developers in the AI coding assistant world has changed. We no longer write most of the code. We direct it.

A single prompt can build an app. The trouble starts with the second prompt: the fix, the new feature, the change to something that already works. I call it the second prompt problem. That is where results start to vary from session to session. Context fills up and the agent loses track. The design drifts as it quietly decides things nobody agreed to. “Done” means “it compiled”. Every new session reinterprets the project from scratch.

That isn’t a flaw in the model. AI is a non-deterministic tool, and that is also where its creativity comes from. The cause is a codebase and a workflow built for humans. Director-Driven Development is the way of working I built to fix that: creativity, inside a frame. Small context, small tasks, and automated proof that every task works.

The principle

A director doesn’t need to act. A director needs to recognize a good take.

You don’t write the implementation. You decide what gets built, judge the result and own the design. Left alone, an agent makes every prompt work as fast as you ask, and every change looks reasonable on its own. That is exactly how a codebase rots. Someone has to hold the whole picture. That’s the director.

Four roles:

Director (you): design, priorities, acceptance. Final say.
Orchestrator (main session): picks tasks, records decisions, hands off builds. Never reads the code being changed.
Builder: builds one task in a fresh context and reports back.
Reviewer: independent, read-only review of every change against its task and the tests.

Code shaped for agents

Agent quality drops as context grows. So the codebase is shaped to keep every task’s context small.

Small, separate units. Even a small app becomes a set of internal services and functions. One function per file, and every file works like a small service: input in, output out.
Read only what the task needs. Each task names the files it may touch. The builder greps for the exact rows it needs and reads nothing else.
Surgical edits. One task, one atomic change, one commit. Large tasks are split before they start.
Rules live in testable code. Agents are strong at UI because UI is easy to verify, and weak at complex rules. So rules live in plain classes that tests build directly, and the check fails when the UI holds logic.
State lives in files, not chat. A design document, a decision log, a task queue and an architecture table hold everything. Each fact has one home. Clearing the session loses nothing.

Two tasks, sized and names the exact files it may touch.

On request, claude runs /next-task and starts grabbing tasks according to specification.

The loop

Every change runs the same four steps.

1. Decide

The agent proposes. The director decides. Design calls come to you as 2-4 options with a recommendation, and you can always write your own answer. Only your choice is recorded, in a decision log in the repo, so the next session starts from what was agreed rather than a fresh guess. Anything undecided goes on an open-questions list, and values you haven’t set stay marked as placeholders. The agent never guesses intent.

Design calls come back as options. Only the director’s choice is recorded. Custom answers can be given if none of the recommendations match director expectations.

2. Build

The orchestrator hands one sized task to a builder with a fresh, empty context. The builder returns a short structured report. The orchestrator never reads the changed code, so ten tasks cost about as much context as one.

Each task size maps to its own model: Haiku for XS and S, Sonnet for M, Opus for L and XL, with Fable as an alternative for the largest tasks. A failed build retries once on the next size up. Cost follows complexity, not habit.

The orchestrator sees the report, not the code.
nb: L tasks were mapped to Sonnet to save tokens.

3. Prove

One check defines done: the project builds, the tests pass and the architecture rules hold. “It compiled” is not an answer. Large changes, and medium ones that touch contracts, stored data or other risky boundaries, also get an independent, read-only reviewer in a fresh context before they are committed.

check.sh failing on a rule in a screen file, then passing after the fix.

4. Commit

A passing check gates every commit. Run a single task and you approve it. Work through the queue and commits land automatically, listed in the final report.

One task, one commit.

What makes it different

None of the building blocks are new. Small batches, a single source of truth, a definition of done, decision records and an orchestrator delegating to sub-agents are all established practice. In regulated industries we have long run platforms the same way: trust, but verify. Enforce what’s critical, audit the rest. Director-Driven Development combines these for AI agents and adds four things:

Rules are enforced, not suggested. Most AI workflows guide the agent with prompts and templates, and prompts can be ignored. Here the check fails the build: a rule inside the UI, a tenant ID read from a request, logic in the wrong layer.
Deviation is a decision. Where the framework owns the architecture, the only way past a rule is an architecture decision record the director accepts. The check excuses only the exceptions an accepted record names. Builders and reviewers have limited autonomy: anything they find outside their task is flagged for the director, not fixed on the spot.
Context discipline is a rule, not a tip. The orchestrator never reads the code being changed. Its context holds decisions and reports, so a long session stays as sharp as a short one.
Ownership is enforced by tools. The director’s own workspace is protected by a hook: the agent can read it, but never write to it. Areas the director owns, like art and audio, get placeholders until they are ready to be replaced with production-ready assets.

The agent reads the director’s workspace but can’t write to it.

When the design drifts

Agents don’t break your design. They drift. Complex rule systems drift in interpretation: a principle that can be read two ways gets read two ways. I handle that at two levels.

Align often. /align is a routine consistency pass. It checks that everything is accounted for: every design rule has a task, every decision is reflected in the design document, every part of the architecture points at something real. Mechanical drift gets fixed; anything that touches the design comes back to the director. When the same conflict comes back, or one conflict spans several design principles, align recommends a reset.

Reset when you have to. Sometimes everything is accounted for, but the same principle has been built two different ways. Don’t patch. Reset. /drift-reset walks the director through it, and only the director can start it:

Analyse the system as built, area by area, with read-only reviewers in fresh contexts.
Map how each design principle was actually interpreted, and where.
Rewrite the design document, one design call at a time. Only the director’s choices are recorded.
Plan the rebuild as ordinary sized tasks. The rebuild itself runs through /next-task.
Run /drift-reset postmortem against the old failure modes. Drift a script could have caught becomes a proposed check rule, for the director to approve.

It means throwing work away. That is the price of keeping the design yours, and the routine align pass is what keeps the price rare.

Three frameworks, one model

All are MIT licensed and run locally. Designed to work with any AI coding assistant that reads AGENTS.md. Built and tested on Claude Code.

Godot-Director: games in Godot 4. The check fails if a screen script holds game rules.
App-Director: small web, mobile and desktop apps, with TypeScript, Flutter and Python stacks.
SaaSAllTheThings: B2B SaaS on Azure. You own the product, the framework owns the architecture, the agent builds. Tenancy, identity and cost rules are machine-checked. Deviation requires an ADR you accept.

The same loop runs all three, and all three ship /align and /drift-reset. Only the rules the check enforces change. Directing scales by turning repeated judgment into checks.

Who it’s for

Anyone who can judge the design of code, even without writing it. You need design judgment, the discipline to keep documents authoritative, and the willingness to throw work away when it no longer matches intent.

AI didn’t remove the need for engineering judgment. It concentrated it.

In the docs
This post is the why. The how, step by step, is in the Director-Driven Development docs.

Sovereign Cloud Part 3: Disconnected operations change the sovereignty conversation for Azure Local

Vikingur Saemundsson — Wed, 22 Apr 2026 16:21:00 GMT

February 2026 marked a major shift for Azure Local. Disconnected Operations.

With disconnected operations now generally available, Azure Local no longer requires continuous connectivity to the Azure public control plane to operate, govern, or run workloads. This is a major shift and enabler of sovereign operation. In practice, it creates a new responsibility: organizations can and must now design for, test, and rehearse operating without external connectivity.

This article focuses on why disconnected operations matter for sovereignty, what Azure Local actually is, and why customers should treat disconnection as a scenario to actively test rather than a theoretical edge case.

Setting the stage: Sovereignty and Azure Local

In part 2 of this series, an important nuance emerged in the discussion around sovereignty, one that is worth making explicit before going deeper. Shout out to Rickard Carlsson for the discourse 😘.

Even when an organization understands where workloads run, who can administer them, and which regulations apply, a fundamental dependency remains: the platform provider itself.

In public cloud platforms, sovereignty is always bounded by what the provider chooses to expose, document, and allow customers to verify. Customers do not have full insight into internal operational mechanisms, such as internal access paths, key handling implementations, or emergency procedures, unless they fully own or can independently audit the entire platform.

This does not make public cloud insecure or unusable. It simply means sovereignty in the cloud is always, to some extent, a matter of conscious risk acceptance.

As the well-known saying goes: “There is no cloud – it’s just someone else’s computer.” The value of Azure, and other hyperscale platforms, lies in convenience, speed, and access to advanced capabilities that would be unrealistic to build and operate independently. The trade-off is reduced direct control.

What is often overlooked, however, is that this trade-off does not disappear in private datacenters or so-called private clouds.

Even fully private environments are deeply dependent on vendors across the entire value chain: operating systems, hypervisors, licensing models, subscription services, development tooling, identity platforms, and documentation systems. Critical functionality can be gated, altered, or withdrawn through licensing and contractual changes, not only through technical failures. Even going fully into open-source has trade offs in integration complexity, and ultimately raises the TCO for your platform in terms of manpower requirements.

Sovereignty, therefore, is rarely, if ever, absolute.

It is about understanding and deliberately choosing which dependencies are acceptable, and under which conditions they remain acceptable.

Azure Local operates in this space intentionally. It does not claim to eliminate vendor dependency. What it changes is where the operational control boundary sits, and what continues to function when external systems, control planes, or connectivity are no longer available.

This is why disconnected operations matter.

They do not remove all risk. They reduce dependency in the scenarios where dependency matters most.

What Azure Local is and how it differs from traditional on-premises datacenters

Azure Local allows customers to run Azure services in their own datacenters, on hardware they control, while retaining a cloud-native operational and governance model.

This is not traditional virtualization with a cloud management veneer.

Compared to classic on-premises environments, Azure Local provides:

Azure-native infrastructure, managed and operated using the same resource model, policies, and identity concepts as Azure.
A consistent governance and security model across local, hybrid, and cloud environments.
The ability to deploy IaaS, PaaS, and selected SaaS-like services locally, not just virtual machines.

The key difference is not physical location. It is operational alignment.

Traditional datacenters require separate tooling, separate governance models, and often separate teams. Azure Local allows organizations to extend their Azure governance and operating model into their own facilities, reducing divergence while maintaining physical and legal control.

Until recently, however, there was a critical limitation.

What changed in February 2026: Disconnected operations

As of early 2026, Azure Local supports full disconnected operations.

This means:

No runtime dependency on the Azure public control plane.
No outbound connectivity required for infrastructure or governance.
No customer data leaving the environment.
Management, policy enforcement, and operations continue locally.

This matters because sovereignty has always struggled with a simple question:

What happens if connectivity is lost, restricted, or intentionally removed?

Disconnected operations answer that question directly.

Infrastructure, governance, and now AI workloads can continue to operate entirely within the customer’s sovereign boundary. Control does not degrade when connectivity disappears.

This is a significant change from earlier hybrid models where loss of connectivity often meant loss of control.

AI in disconnected environments: Completing the sovereign stack

Another important development is the expansion of Foundry Local.

Foundry Local now supports large, enterprise-grade AI models in disconnected environments. Not only small edge models, but multimodal models capable of meaningful inference workloads.

Crucially:

Models, prompts, and inference results remain local.
No prompts or metadata are sent externally.
AI can run close to sensitive, regulated, or operational data.

For many organizations, this removes a major blocker.

Customers that previously could not use AI due to sovereignty, data protection, or control plane dependency concerns can now do so without introducing external reliance.

At this point, the sovereign private cloud stack becomes complete:

Infrastructure runs locally.
Governance is enforced locally.
Productivity and AI workloads operate locally.
No runtime dependency on public cloud services.

What disconnected means in practice

Disconnected operations are not only about air-gapped military environments. They are relevant whenever reliance on external control planes is unacceptable.

Typical scenarios include:

Intentionally isolated or restricted environments.
Security policies that forbid dependency on public control planes.
AI workloads handling sensitive or classified data.
Mission-critical systems that must continue through prolonged network outages.
Environments with extreme latency requirements or near real-time control systems.

From a sovereignty perspective, this changes the dependency question.

The organization can now clearly answer what it depends on to keep running. That answer no longer includes continuous access to the public cloud.

Why fire drills matter

Disconnected capability is only sovereign if it is proven.

Too many organizations assume disconnection “would probably work” without ever testing it. Sovereignty fails in the gap between theory and reality.

Fire drills should be mandatory.

Organizations using Azure Local in a sovereign context should intentionally test:

Loss of all outbound connectivity.
Extended operation in fully disconnected mode.
Recovery, updates, and governance enforcement without cloud access.
Operational readiness of staff when cloud backstops are unavailable.

If disconnected operations only exist on a slide, sovereignty is assumed, not enforced.

Relevance for Swedish and European customers

In Sweden and across the EU, sovereignty requirements are becoming stricter, not looser.

Regulatory frameworks such as EDPB guidance, DORA, NIS2, and sector-specific requirements increasingly require:

Clear control boundaries.
Evidence of operational independence.
Reduced reliance on foreign jurisdictions for critical systems.

Azure Local with disconnected operations does not eliminate all trust considerations. Microsoft is still a vendor. Software supply chains still matter.

What it does provide is the ability for the customer to retain operational control even when trust is questioned, connectivity is lost, or conditions change.

That distinction is increasingly important.

For decision makers and the owners of corporate IT capabilities and platforms

Disconnected Azure Local is particularly relevant when you say or hear statements like:

“Data must not leave Sweden.”
“The environment must not be connected.”
“We cannot rely on public AI services.”
“AI must not send prompts or metadata externally.”
“We need modern capabilities without cloud dependency.”

These are not edge cases. They are becoming mainstream requirements in public sector, critical infrastructure, and regulated industries.

Closing thoughts

Sovereignty is not about eliminating all dependency. That has never been realistic.

It is about understanding dependencies, choosing them deliberately, and ensuring that control holds when conditions are no longer ideal.

Disconnected operations in Azure Local do not claim to make environments magically independent of vendors, software supply chains, or commercial relationships. What they do is shift a critical dependency boundary. Operational control no longer collapses when connectivity to a public control plane disappears.

That shift matters for organizations where availability, trust, jurisdiction, or accountability cannot be conditional.

The real value of disconnected Azure Local is therefore not the feature itself, but what it forces organizations to confront: what they actually depend on to keep running, and whether those dependencies are acceptable under stress.

Sovereignty is never proven in architecture diagrams or procurement slides. It is proven when assumptions fail.

If sovereignty matters to you, treat disconnection as a first class scenario. Test it deliberately. Operate through it. Learn from it.

Anything less is trust by assumption, not control by design.

Originally published on LinkedIn on April 22, 2026.

Sovereign Cloud Part 2: The technical controls that make sovereignty real in a public cloud

Vikingur Saemundsson — Fri, 20 Mar 2026 16:20:00 GMT

Part 1: What sovereignty actually means in the public cloud

This article is a continuation on my previous article where I talk about Sovreignty, what it is and why it matters. In part 2 I want to focus on the actual controls that can grant Sovreignty in Public Cloud

“Sovereign cloud” can not be defined by a list of security features enabled, but it is instead defined by whether control is enforceable under adverse conditions such as (but not limited to) misconfiguration, insider threat, and privileged access scenarios. For any Cloud or PaaS/SaaS service this includes validating if the control is enforceable against the Service Providers themselves (Scary, I know).

The Sovereign Cloud Technical Control Matrix

Think of a Sovereign Cloud Technical Control Matrix as a structured way to answer:

Which controls exist, and what scope they cover
How they are enforced (deny, allow with conditions, audit)
How exceptions work, who can grant them, for how long, and with what auditable evidence
How controls interact so you are not betting sovereignty on a single layer

Sovereignty is measured by what, and when the platform can actually technically prevent or cryptographically invalidate (hard controls). Not by user processes, intent, guidance, or documentation (soft controls).

How sovereign controls work together (layered enforcement)

Sovereign posture in a public cloud comes from controls reinforcing each other across layers:

Identity and access controls

These controls answer: who can change or access what, and under which conditions.

A sovereign posture generally requires:

No standing high privilege access for day-to-day work
Time-bound, approval-based elevation for privileged roles
Clear separation between different types of privilege:
- Control plane operations (platform configuration)
- Data plane access (reading or operating on data)
- Security operations (security tooling and alerts)
Separation of duties across privileged workflows, so no individual can act as judge, jury, and executioner for high-impact actions or privileged access.

I know it might seem tedious to enforce these things, as an operator/administrator this can be felt like an administrative overhead, but these things should be non-negotiable. In physical security we treat every warehouse and store-room with high value objects using access-card locks, we monitor, we place patrolling guards around the perimiter and inside the areas. We delegate access to employees on a strict need-only basis.

If we don’t treat our IT systems with the same respect in terms of access, then it’s not a question about if an incident occurs it’s a question of when, and how often and how much does it cost.

These controls is how you avoid a single account obtaining a “master key” without supervision or restraint.

Policy controls

These controls answer: what can exist in your environment.

If sovereignty depends on reviews and guidance, it is still trust-based.

A sovereign baseline relies on policy that can:

Deny non-compliant deployments by default
Continuously evaluate services for drift or non-compliance
Require exemptions to be time-bound and auditable

Network controls

These controls answer: where data is allowed to flow.

A sovereign posture typically needs:

Centrally governed ingress patterns for anything exposed publicly
Centrally governed egress controls so data cannot leave through unapproved paths
Controls that limit lateral movement between workloads and services

The goal is simple: even authorized identities should not be able to bypass the approved architecture.

Cryptographic controls

These controls answer: what happens if access controls are bypassed.

Cryptography is the final enforcement layer because it can make data unusable even if someone gains access.

For sovereignty, the important part is not “encryption exists”. The important part is who controls the keys, and whether the customer can:

Rotate keys
Disable keys
Destroy keys in a way that renders data cryptographically inaccessible

Logging and monitoring controls

These controls answer: can you prove what happened.

Sovereignty needs evidence:

Privileged actions must be attributable
Changes must be traceable to an identity, a ticket/approval, and a time window
Alerts must exist for sovereign boundary violations, not just availability issues

Without evidence, you do not have accountability. You have claims.

What “good” looks like: the sovereignty litmus test

A platform is not sovereign-ready for workload onboarding if any of these are true.

Access control

Privileged access cannot be fully revoked or time-bounded without changing application code or workload configuration.
Administrative access relies on standing permissions rather than just-in-time elevation with enforced approval and logging.

Cryptographic control

The customer does not retain exclusive control over encryption keys protecting data at rest.
Data confidentiality depends solely on access controls rather than cryptographic enforcement.

Data residency

Data location is governed by convention or documentation rather than enforceable technical controls.
The platform cannot prevent replication, backup, or processing outside approved regions.

Network and service exposure

Public endpoint exposure can be enabled without an explicit centrally enforced control mechanism.
Platform teams cannot centrally restrict egress paths and service-to-service communication.

Policy enforcement

Compliance depends on reviews or manual approvals rather than deny-by-default policy enforcement.
Deviations from the sovereign baseline are not time-bound, tracked, and auditable.

If any of these conditions exist, the platform may be well secured, but it does not provide sovereign assurance.

The operational reality behind “toxic combinations”

Even with a strong sovereign architecture and the right technical controls in place, there is often a limiting factor that determines whether sovereignty actually holds in practice.

That factor is people and organization.

Technical controls can enforce boundaries, but they do not operate themselves. A sovereign posture depends on having highly qualified engineers covering distinct areas of responsibility, without overlap of duties that would undermine those controls.

This is where the concept often referred to as a “toxic combination” becomes critical.

Why toxic combinations matter

A toxic combination exists when the same individuals can both:

grant themselves access to workloads or storage, and
access, modify, or disable the encryption keys protecting that data.

When this happens, sovereignty no longer rests on enforceable control. It collapses into trust in individuals.

No matter how strong the technical platform is, if one person or one team can act unilaterally across control, access, and protection, the system is no longer sovereign in any meaningful sense.

What a sovereign operating model requires

In a sovereign design, responsibilities must be deliberately separated and staffed by different roles with no practical ability to override each other:

Platform operators can build, run, and maintain the platform, but cannot decrypt or access data.
Key administrators can control cryptographic keys, but cannot grant themselves access to workloads or data.
Security operators can monitor, investigate, and enforce response, but do not operate workloads or manage keys.

This separation is not theoretical. It is an operational safeguard designed to ensure that no single role becomes all-powerful.

If an exception is required where an individual must temporarily assume a toxic combination of privileges, that elevation must be governed by a formal process requiring explicit approval, full traceability, and continuous monitoring. All actions performed under such elevation must be independently audited to ensure accountability.

Why people matter as much as controls

For this model to work, organizations must invest in:

sufficiently skilled engineers in each domain,
clear role definitions and responsibility boundaries,
staffing models that avoid role concentration out of convenience or cost.

Sovereignty fails quietly when organizations collapse roles “temporarily” or “for efficiency”. Those shortcuts are rarely reversed, and they erode control faster than any technical misconfiguration.

From technical sovereignty to operational sovereignty

True sovereignty is not achieved when controls exist. It is achieved when they are:

operated by different people,
continuously monitored,
independently auditable.

In regulated environments, this is why external oversight matters. Regulatory institutions, auditors, and supervisory authorities play a critical role in verifying that sovereignty is not just declared in architecture diagrams, but upheld in day-to-day operations.

Sovereignty is therefore not only a technical posture. It is an operational discipline, sustained by people, process, and scrutiny over time.

Concrete control areas for Azure public cloud

The controls for Azure Platforms can be summarised as follows. Keep in mind that these controls might not be complete, as there is no peer-review on this article, and this is written using a point in time (early 2026) and the security landscape is ever evolving and expanding.

Identity and access (Entra ID)

Centralized tenant governance for identity, conditional access, and privileged workflows
No standing privileged access for administrators
Break-glass accounts defined, tested, and monitored
Privileged Identity Management for time-bound elevation (approval + logging)
Custom RBAC roles for consumers with explicit denial of sensitive platform actions
Separation of duties between control plane, data plane, and security operations

Management group and subscription topology

A management group hierarchy that supports consistent enforcement
Clear ownership boundaries between platform and consumer scopes
A rule that platform consumers cannot assign roles or policies which override governance policies.

Policy baseline (deny-by-default)

Allowed locations, enforced
Allowed services, enforced
Network architecture requirements, enforced
Encryption requirements where supported (prefer customer-managed keys for sensitive data)
Exemptions that are time-bound, tracked, and auditable
Policy changes via version-controlled code and peer review

Network boundary controls

Approved ingress patterns (and no “click-to-public” endpoints without governance)
Central egress restrictions and service-to-service controls
Mandatory monitoring for boundary violations

Cryptography and key control

Customer-controlled keys for sensitive data, with the ability to disable or destroy keys
Operational separation between key administrators and platform administrators
Evidence that key access is approved, time-bound, and logged

Evidence and auditability

Logs bound to identity, time, and approval context
Monitoring that detects both configuration drift and boundary violations
Reporting that supports audits without relying on verbal assurance

Why this matters right now in Europe

Sovereignty requirements in Sweden and the EU are increasingly shaped by an uncomfortable reality: many organizations must assume distrust.

Even if you use the big public cloud providers (Microsoft, Amazon, Google) with EU data residency, the provider is still a company under foreign sovereignty. That pushes buyers toward controls that are enforceable and provable, not promises.

The controls outlined in this article apply equally to local private cloud providers and privately operated datacenters. Sovereignty is defined by control, not proximity. If effective control cannot be exercised, sovereignty does not exist.

In a later part, I will explore private cloud sovereignty and Azure Local with Disconnected Operations, and why the ability to operate without reliance on public cloud control planes is becoming a real requirement for certain organizations and workloads.

Originally published on LinkedIn on March 20, 2026.

What sovereignty actually means in the public cloud

Vikingur Saemundsson — Wed, 18 Mar 2026 16:19:00 GMT

When people talk about sovereignty in the cloud, the conversation almost always starts with geography.

When discussing this we often hear “Does our data stay in Sweden?” or “Is it stored inside the EU?”. These are reasonable questions. They are just not the full story.

Sovereignty is not primarily about where data sits. It is about control and accountability.

For organizations consuming cloud services, sovereignty is the ability to clearly answer three basic questions.

The three questions that define sovereignty

Who is in control of the data and the systems? Who ultimately decides how systems are configured, operated, changed, or shut down.
Who can access or operate them, and under which laws? Who has technical access, operational authority, or legal reach if something goes wrong.
What does the business depend on to keep running? Which external services, networks, or decisions must exist for operations to continue.

If these questions cannot be answered clearly, sovereignty is assumed rather than understood.

Why location alone is not enough

It is entirely possible for data to be physically stored in Sweden or elsewhere in the EU and still not be sovereign in practice.

Data location alone does not automatically answer:

Who can technically access the systems
Who operates and maintains the platform
Which laws apply to operators and vendors
What happens if connectivity, services, or support is disrupted

Sovereignty is about control under real conditions, not just during normal operations.

The trust question in Europe

In Sweden and across the EU, sovereignty discussions are increasingly shaped by a broader trust issue.

Microsoft, Amazon, and Google are all US-based companies. Regardless of where data is stored, these providers themselves operate under a foreign legal and political sovereignty.

This creates understandable concern for public sector organizations and regulated industries:

What legal obligations apply to the provider if a foreign authority makes a request?
What happens if geopolitical conditions change?
What level of dependency is acceptable for critical systems?

For many decision-makers, the concern is not technical. It is institutional and legal.

An example

Consider a Swedish public authority using a public cloud service.

The data may be stored in an EU datacenter. Access may be restricted. Encryption may be strong.

But if:

The control plane is operated from outside the EU
Platform operations depend on continuous connectivity to global services
Support, updates, or security decisions are made under foreign jurisdiction

Then sovereignty becomes conditional.

The question is no longer “Where is the data?” It becomes “Who is in control if something happens?”

What sovereignty means in public cloud terms

In a public cloud, sovereignty does not mean that no external provider is involved. It means understanding and actively managing the relationship with that provider.

In practical terms, public cloud sovereignty is about:

Transparency around roles and responsibilities
Clear boundaries for access and operations
Legal clarity around jurisdiction and accountability
Awareness of operational dependencies

You are not asking: “Is this cloud foreign or local?”

You are asking: “Who can do what, under which conditions, and what do we depend on?”

The questions non-technical leaders should ask

Sovereignty is not an IT problem. It is a governance problem.

Non-technical leaders should be asking:

If there is a crisis, who has the authority and technical capabilities to act on our systems?
If connectivity is lost, what continues to work and what stops?
If regulations change, do we have options or are we locked in?
If trust is questioned, can we prove who controls what?

These are business questions. They just happen to involve cloud services.

Sovereignty is a spectrum, not a switch

A common misconception is that sovereignty is binary. Either you have it or you do not. In reality, sovereignty exists on a spectrum.

Different workloads require different levels of control:

Some can operate with shared responsibility and external dependencies
Others require tighter operational, legal, or physical control
Some must continue running even if disconnected or intentionally isolated

Understanding sovereignty means understanding which level of control is appropriate where.

Setting the stage

This article is the first part of a series.

The purpose here is to establish a shared understanding:

Sovereignty is about control, accountability, and dependency
It applies to public cloud usage, not just private environments
It is a business concern first, and a technical concern second

In the next part, the focus will go into details on the technical controls that make sovereignty real in a public clouds

Originally published on LinkedIn on March 18, 2026.

DevOps & Rocket manufacturing

Vikingur Saemundsson — Fri, 01 Oct 2021 16:21:00 GMT

I was catching up on one of my favourite youtube channels (Everyday Astronaut) during my morning coffee. The video is a SpaceX tour with Elon Musk and basically from nowhere Elon Musk starts to describe DevOps processes and how they apply to SpaceX design process and production line.

He describes 5 steps to building rockets, but this can be implemented to just about any process in any industry. I have paraphrased the steps and taken the liberty to expand on some steps in order to apply to the industry I’m working in.

Make your requirements less dumb. – “Your requirements are definitely dumb. It does not matter who gave the requirements. It’s particularly dangerous if a smart person defined the requirements”.
Delete the part or process step – For IT the parts are often an infrastructure component or a part of an application (function, microservices etc.). Run tight margins on what makes it into the product. Any part or process that is not critical should be added to a backlog and re-added when needed. Build a MVP (minimum viable product), only add what you need and focus on what matters without over-engineering. Another take-away from this is that requirements and constraints must be owned by a person and never a department. You can’t ask a department why a requirement or constraint is in place since people move around or leave the organization. Design decisions, processes and products should have ownership of an individual. If we trace back to a department we might loose the detailed how and why of a part or process. Review all parts of the process, and remove what does not fit the requirements.
Simplify or Optimize – “It’s very common of a smart engineer is to optimize something that should not exist”. Focus on your requirements before working on optimizing.
Accelerate cycle time – “You’re moving too slowly, go faster.” But don’t go faster unless you have cycled through the first three steps. Focus on the constraining process in your delivery chain, if it is a manual process or an automated build/release process you can always go faster
Automate, but only when step 1-4 are cycled through. We often go in the opposite direction. We often automate or fix the automation before we fix the process. I can attest that as a self-proclaimed automation aficionado I stumble down this rabbit hole a bit too often. Automate the part or process you have identified as the most impactful part/constraint of your delivery chain. When you’re done revert back to step 1 and work your way through the process again.

These five steps are so intuitive when read as listed above, but often extremely difficult to apply when in the middle of a project.

Now, how is this related to DevOps? What Elon is listing is a process that can be directly linked to several core concepts in DevOps, and most importantly the “three ways”.

Work always flows in one direction – Downstream. Focus on what matters and don’t optimize downstream. The concept “shift-left” is often cited here. – The process of never optimizing at the end

Create, shorten and amplify feedback loops. Here we often talk about failing fast – The process of segmenting a product into small manageable chunks that can be developed, tested, deployed and re-iterated upon without having to rebuild the whole project before testing

Continued experimentation, in order to learn from mistakes, and achive mastery. In Elon Musks 5 steps, this is highly related to his 2nd step, where we always review and re-iterate on our needs and create a mindset focused on our requirements and how to approach them. When we have a good requirement we go forward with the process of developing, optimizing and automating. I also belive that their success is part of how many rockets they launch, get telemetry and improve. Even when the rockets experience “rapid unscheduled disassembly” SpaceX considers this a success because it gaves them opportunies for destructive testing (DT).

Enough of my ramblings, check out the full video! The link to get directly to the 5 steps lecture.

https://youtu.be/t705r8ICkRw?t=814

Originally published on LinkedIn on October 1, 2021.

Sending css formatted tables in Outlook

Vikingur Saemundsson — Fri, 06 Apr 2018 10:46:01 GMT

If you’ve ever used Powershell to send HTML tables in Outlook containing CSS you’ve probably been disappointed of the outcome.
There is some archived documentation for Outlook 2007 that is still viable for Outlook 365 (https://msdn.microsoft.com/en-us/library/aa338201(v=office.12).aspx).

Basically the function accepts a csv and css file, hardcodes the css into the table and outputs a formatted HTML table that is compatible with Outlook.

I wrote this during my time @Xenit and the post should be found here
Read more on: https://tech.xenit.se/sending-css-formatted-tables-outlook/

Just enough Administration & RDS

Vikingur Saemundsson — Mon, 11 Dec 2017 09:50:23 GMT

Reblogged from my company blog: https://tech.xenit.se/just-enough-administration-rds/
—

The Problem?

Microsoft RDS has limitations when delegating access, in fact there is no built-in access delegation whatsoever!

The solution? Powershell!

A Just enough Administration (JEA) endpoint, also known as a Constrained Powershell Endpoint.
The endpoint is restricted to only access List collection, list users and subsequently force logoff users. The endpoint configuration to only accept users from a certain AD group.

To configure endpoint, run the following code on all connection brokers. The script is somewhat generalized for easy adaptability. The main parts are in the parameters where we configure who can run, using which account and also what cmdlet are available in the constrained session.

<#
.Synopsis
    Short description
.DESCRIPTION

.NOTES
    Name: Create-JEA-RDS-Endpoint.ps1
    Author: Vikingur Saemundsson
    Date Created: 2017-11-20
    Version History:
        2017-11-20 - Vikingur Saemundsson
            Initial Creation

    Xenit AB
#>

[cmdletbinding()]
Param(
    [String]$Name = 'Xenit.JEA.RDS.Servicedesk',
    [String]$Path = 'C:\Xenit\RDS\LogoffEndpoint',
    [Array]$VisibleCmdlets = $("Get-RDSessionCollection","Get-RDSessionHost","Get-RDUserSession","Invoke-RDUserLogoff","Where-object"),
    [String]$AdGroup = 'Servicedesk Ad group',
    [Parameter(Mandatory=$true)]
    [String]$ServiceAccount,
    [Array]$Modules = 'RemoteDesktop',
    [String]$Author = 'Vikingur Saemundsson',
    [String]$Company = 'Xenit AB'
)
Try{
    $ADGroupSID = (Get-ADGroup $AdGroup).SID

    If(-not(Test-Path -Path $Path -PathType Container)){
        New-Item -Path $Path -ItemType Directory -Force
    }

    $LockdownScript = @'
    Get-Command | Where Visibility -eq 'Public' | ForEach-Object {
        if ( $_.Name -notin $CmdsToExclude ) {
            $_.Visibility = 'Private'
        }
    }
'@
    '$CmdsToExclude = @("Get-Command", "Out-Default", "Exit-PSSession", "Measure-Object", "Select-Object" , "Get-FormatData"{0})' -f (($VisibleCmdlets | ForEach-Object{",`"$_`""}) -join '') | Out-File "$Path\LockdownScript.ps1"
    $LockdownScript | Out-File "$Path\LockdownScript.ps1" -Append

    $Modules += 'Microsoft.PowerShell.Core'
    $Modules += 'Microsoft.PowerShell.Management'
    $Modules += 'Microsoft.PowerShell.Security'
    $Modules += 'Microsoft.PowerShell.Utility'
    $Modules += 'Microsoft.PowerShell.Diagnostics'
    $Modules += 'Microsoft.PowerShell.Host'

    $ConfigFileParams = @{
        Path ="$Path\$Name.pssc"
        ModulesToImport = $Modules
        ScriptsToProcess = "$Path\LockdownScript.ps1"
        CompanyName = $Company
        Author = $Author
        Copyright = "(c) $((Get-Date).Year) $Company. All rights reserved."
        SessionType = 'Default'
        LanguageMode = "ConstrainedLanguage"
        ExecutionPolicy = 'Bypass'
    }

    $SessionConfigParams = @{
        RunAsCredential = $ServiceAccount
        Name = $Name
        Path = $ConfigFileParams.Path
        UseSharedProcess = $true
        SecurityDescriptorSddl = "O:BAG:DUD:AI(A;;GX;;;$ADGroupSID)"
        Confirm = $false
    }

    If(Get-PSSessionConfiguration -Name $SessionConfigParams.Name -ErrorAction SilentlyContinue){
        Unregister-PSSessionConfiguration -Name $SessionConfigParams.Name -Confirm:$false
    }

    New-PSSessionConfigurationFile @ConfigFileParams

    Register-PSSessionConfiguration @SessionConfigParams
}
Catch{
    Write-Error $_
}

The frontend application code is not posted in the blog.

Recursively search Azure Ad group members

Vikingur Saemundsson — Mon, 11 Dec 2017 09:50:20 GMT

Reblogged from my company blog: https://tech.xenit.se/recursively-search-azure-ad-group-members/
—
When working with on-premise Active Directory an administrator often has to recursively search AD groups, this is easy using the ActiveDirectory module with cmdlet “Get-AdGroupMember -Recusive”.
For the AzureAD equivalent this is no longer an option, the cmdlet Get-AzureADGroupMember has three parameters.

PARAMETERS
-All
If true, return all group members. If false, return the number of objects specified by the Top parameter
-ObjectId
Specifies the ID of a group in Azure AD.
-Top
Specifies the maximum number of records to return.

As we can see there is no -recursive, in order to search recursively I’ve written the function below.

Function Get-RecursiveAzureAdGroupMemberUsers{
[cmdletbinding()]
param(
   [parameter(Mandatory=$True,ValueFromPipeline=$true)]
   $AzureGroup
)
    Begin{
        If(-not(Get-AzureADCurrentSessionInfo)){Connect-AzureAD}
    }
    Process {
        Write-Verbose -Message "Enumerating $($AzureGroup.DisplayName)"
        $Members = Get-AzureADGroupMember -ObjectId $AzureGroup.ObjectId -All $true

        $UserMembers = $Members | Where-Object{$_.ObjectType -eq 'User'}
        If($Members | Where-Object{$_.ObjectType -eq 'Group'}){
            $UserMembers += $Members | Where-Object{$_.ObjectType -eq 'Group'} | ForEach-Object{ Get-RecursiveAzureAdGroupMemberUsers -AzureGroup $_}
        }
    }
    end {
        Return $UserMembers
    }
}

The function accepts groups by parameter or by pipeline and returns only the object type ‘User’

To run a recursive AzureAD Group member search simply pipe a normal ADgroup search as below

Get-AzureADGroup -SearchString 'AzureADGroupName' | Get-RecursiveAzureAdGroupMemberUsers

Azure Automation – Running scripts locally on VM through runbooks

Vikingur Saemundsson — Mon, 11 Dec 2017 09:46:48 GMT

Reblogged from my company blog: https://tech.xenit.se/azure-automation-running-scripts-locally-vm-runbooks/
—
I was tasked to create a powershell script to run on a schedule on a Azure VM. Normally this would be running as a scheduled task on the VM but seeing as we’re working with AzureVM and schedule tasks are legacy I wanted to explore the possibilities of running the schedule and script in Azure to keep the VM clean and the configuration scalable.

After some research the best option would be running the powershell script as a CustomScriptExtension on the VM, and the schedule would be handled by a Process Automation Runbook (using Automation Accounts).

What I ended up with is the script below. It’s fairly easy to configure and contains almost all the required configuration in the parameters.

How does it work? Simple!

Prerequisites

Create a Storage Account
- Create a Private Blob container
Create a Automation Account
- Make sure a RunAsAccount is created

Runbook configuration

Navigate to the Automation Account you intend to use
Create a Powershell runbook and press Edit
Copy the below script into the runbook and save
- Fill out the parameters with relevant information (subscription, resourcegroup etc)
- Make sure to set the name of the StorageContainer to the one where you want to host the scripts
- Extension name should be unique for the job, as well as the ScriptName
- The scriptblock parameter takes the script you intend to run on the VMs
On the first run, go into the Test Pane from edit view and edit the UploadScript parameter to $True
- This will make the runbook actually save the script to the Container, allowing the VM download and run the script
Done!

Now simply register schedules to the runbook. If you want to run the script on several VM you have two options. Either specify multiple VM when creating schedules or create a schedule per machine you want to run the script against.

[cmdletbinding()]
Param(
    $SubscriptionID = '<SubscriptionID>',
    $ResourceGroup = 'RG-NorthEU',
    $VMNames = @('vmname1','vmname2'),
    $StorageAccount = '<StorageAccount>',
    $StorageAccountKey = '<Storagekey>',
    $StorageContainer = 'sc-scripts', # Create this manually before first execution!
    $ExtensionName = 'Xenit.<job>',
    $ScriptName = 'scriptname.ps1',

    $UploadScript = $false,
    $ScriptBlock = {
        <Script to run locally on VMs>
    }
)

################
################
#
# DO NOT CHANGE BELOW
#
################
################

function Invoke-AzureRmVmScript {
<#

    # Vikingur Saemundsson @ Xenit AB
    # Credit to source https://github.com/RamblingCookieMonster/PowerShell/blob/master/Invoke-AzureRmVmScript.ps1
    # Made som small modifications to allow control over if the scriptfile is uploaded or not to avoid extra data to containers and shorten the executiontime
    #

    .FUNCTIONALITY
        Azure
#>
    [cmdletbinding()]
    param(
        # todo: add various parameter niceties
        [Parameter(Mandatory = $True,
                    Position = 0,
                    ValueFromPipelineByPropertyName = $True)]
        [string[]]$ResourceGroupName,

        [Parameter(Mandatory = $True,
                    Position = 1,
                    ValueFromPipelineByPropertyName = $True)]
        [string[]]$VMName,

        [Parameter(Mandatory = $True,
                    Position = 2)]
        [scriptblock]$ScriptBlock, #todo: add file support.

        [Parameter(Mandatory = $True,
                    Position = 3)]
        [string]$StorageAccountName,

        [string]$StorageAccountKey, #Maybe don't use string...

        $StorageContext,

        [string]$StorageContainer = 'sc-scripts',

        [string]$Filename, # Auto defined if not specified...

        [string]$ExtensionName, # Auto defined if not specified

        [bool]$UploadScript = $true,

        [switch]$ForceExtension,
        [switch]$ForceBlob,
        [switch]$Force
    )
    begin
    {
        if($Force)
        {
            $ForceExtension = $True
            $ForceBlob = $True
        }
    }
    process
    {
        Foreach($ResourceGroup in $ResourceGroupName)
        {
            Foreach($VM in $VMName)
            {
                if(-not $Filename)
                {
                    $GUID = [GUID]::NewGuid().Guid -replace "-", "_"
                    $FileName = "$GUID.ps1"
                }
                if(-not $ExtensionName)
                {
                    $ExtensionName = $Filename -replace '.ps1', ''
                }

                $CommonParams = @{
                    ResourceGroupName = $ResourceGroup
                    VMName = $VM
                }

                Write-Verbose "Working with ResourceGroup $ResourceGroup, VM $VM"
                # Why would Get-AzureRMVmCustomScriptExtension support listing extensions regardless of name? /grumble
                Try
                {
                    $AzureRmVM = Get-AzureRmVM @CommonParams -ErrorAction Stop
                    $AzureRmVMExtended = Get-AzureRmVM @CommonParams -Status -ErrorAction Stop
                }
                Catch
                {
                    Write-Error $_
                    Write-Error "Failed to retrieve existing extension data for $VM"
                    continue
                }

                # Handle existing extensions
                Write-Verbose "Checking for existing extensions on VM '$VM' in resource group '$ResourceGroup'"
                $Extensions = $null
                $Extensions = @( $AzureRmVMExtended.Extensions | Where {$_.Type -like 'Microsoft.Compute.CustomScriptExtension'} )
                if($Extensions.count -gt 0)
                {
                    Write-Verbose "Found extensions on $VM`:`n$($Extensions | Format-List | Out-String)"
                    if(-not $ForceExtension)
                    {
                        Write-Warning "Found CustomScriptExtension '$($Extensions.Name)' on VM '$VM' in Resource Group '$ResourceGroup'.`n Use -ForceExtension or -Force to remove this"
                        continue
                    }
                    Try
                    {
                        # Theoretically can only be one, so... no looping, just remove.
                        $Output = Remove-AzureRmVMCustomScriptExtension @CommonParams -Name $Extensions.Name -Force -ErrorAction Stop
                        if($Output.StatusCode -notlike 'OK')
                        {
                            Throw "Remove-AzureRmVMCustomScriptExtension output seems off:`n$($Output | Format-List | Out-String)"
                        }
                    }
                    Catch
                    {
                        Write-Error $_
                        Write-Error "Failed to remove existing extension $($Extensions.Name) for VM '$VM' in ResourceGroup '$ResourceGroup'"
                        continue
                    }
                }

                if(-not $StorageContainer)
                {
                    $StorageContainer = 'scripts'
                }
                if(-not $Filename)
                {
                    $Filename = 'CustomScriptExtension.ps1'
                }
                if(-not $StorageContext)
                {
                    if(-not $StorageAccountKey)
                    {
                        Try
                        {
                            $StorageAccountKey = (Get-AzureRmStorageAccountKey -ResourceGroupName $ResourceGroup -Name $storageAccountName -ErrorAction Stop)[0].value
                        }
                        Catch
                        {
                            Write-Error $_
                            Write-Error "Failed to obtain Storage Account Key for storage account '$StorageAccountName' in Resource Group '$ResourceGroup' for VM '$VM'"
                            continue
                        }
                    }
                    Try
                    {
                        $StorageContext = New-AzureStorageContext -StorageAccountName $StorageAccountName -StorageAccountKey $StorageAccountKey
                    }
                    Catch
                    {
                        Write-Error $_
                        Write-Error "Failed to generate storage context for storage account '$StorageAccountName' in Resource Group '$ResourceGroup' for VM '$VM'"
                        continue
                    }
                }
                If($UploadScript){
                    Write-Verbose "Uploading script to storage account $StorageAccountName"
                    Try
                    {
                        $Script = $ScriptBlock.ToString()
                        $LocalFile = [System.IO.Path]::GetTempFileName()
                        Start-Sleep -Milliseconds 500 #This might not be needed
                        Set-Content $LocalFile -Value $Script -ErrorAction Stop

                        $params = @{
                            Container = $StorageContainer
                            Context = $StorageContext
                        }

                        $Existing = $Null
                        $Existing = @( Get-AzureStorageBlob @params -ErrorAction Stop )

                        if($Existing.Name -contains $Filename -and -not $ForceBlob)
                        {
                            Write-Warning "Found blob '$FileName' in container '$StorageContainer'.`n Use -ForceBlob or -Force to overwrite this"
                            continue
                        }
                        $Output = Set-AzureStorageBlobContent @params -File $Localfile -Blob $Filename -ErrorAction Stop -Force
                        if($Output.Name -notlike $Filename)
                        {
                            Throw "Set-AzureStorageBlobContent output seems off:`n$($Output | Format-List | Out-String)"
                        }
                    }
                    Catch
                    {
                        Write-Error $_
                        Write-Error "Failed to generate or upload local script for VM '$VM' in Resource Group '$ResourceGroup'"
                        continue
                    }
                }

                # We have a script in place, set up an extension!
                Write-Verbose "Adding CustomScriptExtension to VM '$VM' in resource group '$ResourceGroup'"
                Try
                {
                    $Output = Set-AzureRmVMCustomScriptExtension -ResourceGroupName $ResourceGroup `
                                                                    -VMName $VM `
                                                                    -Location $AzureRmVM.Location `
                                                                    -FileName $Filename `
                                                                    -Run $Filename `
                                                                    -ContainerName $StorageContainer `
                                                                    -StorageAccountName $StorageAccountName `
                                                                    -StorageAccountKey $StorageAccountKey `
                                                                    -Name $ExtensionName `
                                                                    -TypeHandlerVersion 1.1 `
                                                                    -ErrorAction Stop

                    if($Output.StatusCode -notlike 'OK')
                    {
                        Throw "Set-AzureRmVMCustomScriptExtension output seems off:`n$($Output | Format-List | Out-String)"
                    }
                }
                Catch
                {
                    Write-Error $_
                    Write-Error "Failed to set CustomScriptExtension for VM '$VM' in resource group $ResourceGroup"
                    continue
                }

                # collect the output!
                Try
                {
                    $AzureRmVmOutput = $null
                    $AzureRmVmOutput = Get-AzureRmVM @CommonParams -Status -ErrorAction Stop
                    $SubStatuses = ($AzureRmVmOutput.Extensions | Where {$_.name -like $ExtensionName} ).substatuses
                }
                Catch
                {
                    Write-Error $_
                    Write-Error "Failed to retrieve script output data for $VM"
                    continue
                }

                $Output = [ordered]@{
                    ResourceGroupName = $ResourceGroup
                    VMName = $VM
                    Substatuses = $SubStatuses
                }

                foreach($Substatus in $SubStatuses)
                {
                    $ThisCode = $Substatus.Code -replace 'ComponentStatus/', '' -replace '/', '_'
                    $Output.add($ThisCode, $Substatus.Message)
                }

                [pscustomobject]$Output
            }
        }
    }
}
Try{
    #region Connection to Azure
    write-verbose "Connecting to Azure"
    $connectionName = "AzureRunAsConnection"

    try
    {
        # Get the connection "AzureRunAsConnection "
        $servicePrincipalConnection = Get-AutomationConnection -Name $connectionName

        "Logging in to Azure..."
        Add-AzureRmAccount `
            -ServicePrincipal `
            -TenantId $servicePrincipalConnection.TenantId `
            -ApplicationId $servicePrincipalConnection.ApplicationId `
            -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint
    }
    catch {
        if (!$servicePrincipalConnection)
        {
            $ErrorMessage = "Connection $connectionName not found."
            throw $ErrorMessage
        } else{
            Write-Error -Message $_.Exception.Message
            throw $_.Exception
        }
    }

    Select-AzureRmSubscription -SubscriptionId $SubscriptionID
    $RG = Get-AzureRmResourceGroup -Name $ResourceGroup
    Foreach($VMName in $VMNames){
        $AzureVM = Get-AzureRmVM -Name $VMName -ResourceGroupName $RG.ResourceGroupName

        $Params = @{
            ResourceGroupName = $ResourceGroup
            VMName = $AzureVM.Name
            StorageAccountName = $StorageAccount
            StorageAccountKey = $StorageAccountKey
            StorageContainer = $StorageContainer
            FileName = $ScriptName
            ExtensionName = $ExtensionName
            UploadScript = $UploadScript
        }

        Invoke-AzureRmVmScript @Params -ScriptBlock $ScriptBlock -Force -Verbose
    }
}
Catch{
    Write-Error -Message $_.Exception.Message
    Exit Throw $_
}

Powershell & Graphs

Vikingur Saemundsson — Mon, 30 Oct 2017 15:04:58 GMT

TL;DR I wanted to draw graphs in powershell without any external dependancies. So I did, results below.

How to graph:
Create one or more array of points
Join arrays into another array of lines
Execute Draw-Graph function with some data

#Build graph
[Array]$Line1 = 1..12 | ForEach-Object{Get-Random (10..20)}
$p=Get-Random (14..25)
$p%5
[Array]$Line2 = 1..12 | ForEach-Object{
    If($p%5 -eq 0){
        $p-=(get-random (1..3))
    }
    Else{
        $p+=(get-random (1..5))
    }
    $p
}
[Array]$Lines = $Line1,$Line2
$Legend = "Line1 Header","Line2 Header"
$Colors = "Blue","Green"

$file = ([guid]::NewGuid()).Guid
$file = "$env:TEMP\$file.png"
Draw-Graph -Lines $Lines -Legend $Legend -Colors $Colors -Header "Header" -SaveDestination $file
.$file

Graph functions/Initialization

Add-Type -AssemblyName System.Windows.Forms,System.Drawing

Function Get-Color{
    $rbg = @()

    For($i = 0;$i -le 3;$i++){
        Switch($i){
            #Black
            0{ $rbg += 255}#Get-Random -Minimum 128 -Maximum 255 }
            #RGB
            Default{$rbg += Get-Random -Minimum 0 -Maximum 255}
        }
    }
    Return $rbg
}

Function Draw-Graph{
Param(
    $Width = 1024,
    $Height = 512,
    [Array]$Lines,
    [Array]$Legend,
    [Array]$Colors,
    $Header = "Graph",
    $SaveDestination,
    [Switch]$Preview
)
    Begin{}
    Process{
    If($Preview){
        [Windows.Forms.Form]$Window = New-Object System.Windows.Forms.Form

        $Window.Width = $Width
        $Window.Height = $Height

        $Window.Show()
        $Window.Refresh()

        [Drawing.Graphics]$Graph = $Window.CreateGraphics()
    }
    Else{
        $bmp = New-Object Drawing.Bitmap $Width,$Height
        $Graph = [Drawing.Graphics]::FromImage($bmp)

    }
    $Graph.InterpolationMode = [Drawing.Drawing2D.InterpolationMode]::HighQualityBicubic
    $Graph.SmoothingMode = [Drawing.Drawing2D.SmoothingMode]::AntiAlias
    $Graph.TextRenderingHint = [Drawing.Text.TextRenderingHint]::AntiAlias
    $Graph.CompositingQuality = [Drawing.Drawing2D.CompositingQuality]::HighQuality

    $Background = [System.Drawing.Color]::Snow
    $Graph.Clear($Background)

    $TextBrush = New-Object Drawing.SolidBrush([System.Drawing.Color]::FromArgb(255, 0, 212,252))
    $Font = New-object System.Drawing.Font("arial",12)  
    $gridPen = [Drawing.Pens]::LightGray

    #Draw Graph area
    $DrawArea = New-Object 'object[,]' 2,2

    # X (Width)
    [int]$DrawArea[0,0] = $Width/10
    [int]$DrawArea[0,1] = ($Width-$Width/6)
    # Y (Height)
    [int]$DrawArea[1,0] = $Height/10
    [int]$DrawArea[1,1] = ($Height-$Height/3)

    # Get X bounds
    $xFac = ($Lines | ForEach-Object{$_.Length} | Sort -Descending)[0]-1
    $xInc = ($DrawArea[0,1]-$DrawArea[0,0]+$DrawArea[0,0])/$xFac

    #Get Y bounds
    $yMax = ($lines | ForEach-Object{$_} | sort -Descending)[0]
    $yFac = ($DrawArea[1,1]-$DrawArea[1,0])/$yMax

    #Draw box
    $Graph.DrawRectangle($gridPen, ($DrawArea[0,0]),($DrawArea[1,0]),($DrawArea[0,1]),($DrawArea[1,1]))

    #Draw Header
    $Textpoint = New-Object System.Drawing.PointF ((($DrawArea[0,1]-$DrawArea[0,0])/2+$DrawArea[0,0]),($DrawArea[1,0]/2))
    $Graph.DrawString($Header,$Font,$TextBrush,$TextPoint)

    #Draw horizontal lines
    $scaleFac = 0.1
    $i = 1
    #Get scale
    While($i -ge 1){
        $scaleFac = $scaleFac*10
        $i = $yMax/$scaleFac
    }
    $scaleFac = $scaleFac/10

    0..($yMax/$scaleFac) | ForEach-Object{
        $y = $DrawArea[1,1]-(($_*$scaleFac)*$yFac)+$DrawArea[1,0]
        $x1 = $DrawArea[0,0]
        $x2 = $DrawArea[0,1]+$DrawArea[0,0]

        $Graph.DrawLine($gridPen,$x1,$y,$x2,$y)
        $thisPoint = New-Object System.Drawing.PointF (($x1-10),($y-15))
        $thisSF = New-object System.Drawing.StringFormat
        $thisSF.Alignment = "Far"
        $Graph.DrawString("$($_*$scaleFac)",$Font,$TextBrush,$thisPoint,$thisSF)
    }

    If($lines[0].Count -le 1){
        $tmp = $Lines
        Remove-Variable Lines
        $Lines = @(0)
        $Lines[0] = $tmp
        Remove-Variable tmp
        $Lines
    }

    #DRAW LINE
    $l = 0
    Foreach($Line in $Lines){
        If($Colors.Count -gt $l){
            $Pen = New-Object Drawing.Pen($Colors[$l])
        }
        Else{
            $rgb = Get-Color
            $Pen = New-object Drawing.Pen([System.Drawing.Color]::FromArgb($rgb[0],$rgb[1],$rgb[2],$rgb[3]))
        }
        $Pen.Width = 2

        #Initiate/Reset Points
        $Points = @()
        $Step = 0

        Foreach($point in $line){

            $x = ($xInc*$step)+$DrawArea[0,0]
            $y = $DrawArea[1,1]-($point*$yFac)+$DrawArea[1,0]

            $Points += New-Object System.Drawing.PointF($x,$y)
            $Step++
        }
        $Graph.DrawLines($pen,$Points)

        If($Legend.Count -gt $l){
            $thisLegend = $Legend[$l]
            If($Colors.Count -gt $l){
                $thisBrush = New-Object Drawing.SolidBrush($Colors[$l])
            }
            Else{
                $rgb = Get-Color
                $thisBrush = New-Object Drawing.SolidBrush([System.Drawing.Color]::FromArgb($rgb[0],$rgb[1],$rgb[2],$rgb[3]))
            }

            $y = $DrawArea[1,1]+$DrawArea[1,0]+20
            $x = $DrawArea[0,0]+100*$l

            $thisPoint = New-Object System.Drawing.PointF ($x,$y)
            $thisFont = New-Object System.Drawing.Font("arial",12,[System.Drawing.FontStyle]::Bold)
            $Graph.DrawString($thisLegend,$thisFont,$thisBrush,$thisPoint)
        }
        $l++
    }

    }
    End{

        If($Preview){
            Start-Sleep 10
        }
        Else{
            $bmp.save($SaveDestination)
        }

        Try{$Graph.Dispose()}Catch{}
        Try{$bmp.Dispose()}Catch{}
        Try{$Window.Close()}Catch{}
        Try{$Window.Dispose()}Catch{}
    }
}

Generate-Key

Vikingur Saemundsson — Mon, 25 Jan 2016 15:42:37 GMT

To compliment my earlier post I have created a short function to generate keys.

Function Generate-key{
Param(
    [validateset(128,192,256)]
    $bits,
    [switch]$COUT,
    $seed
)
    $bytes = $bits/8
    $array = @()
    If($seed){
        1..$bytes | ForEach-Object{
            $array += Get-Random -Minimum 0 -Maximum 255 -SetSeed $seed
        }
    }
    Else{
        1..$bytes | ForEach-Object{
            $array += Get-Random -Minimum 0 -Maximum 255
        }
    }
    If($COUT){
        [string]$retval = ($array -join ',')
        Return $retval
    }
    Else{
        Return [Byte[]]$Key = $array
    }
}

Encrypting strings with custom keys in powershell

Vikingur Saemundsson — Wed, 01 Apr 2015 14:50:01 GMT

Since the ConvertTo-SecureString is not really secure, and neither is the EncodedCommand (base64string) I made two short functions to encrypt and decrypt strings in order to send them across the void unharmed.

Function Encrypt-String{
Param(

    [Parameter(
        Mandatory=$True,
        Position=0,
        ValueFromPipeLine=$true
    )]
    [Alias("String")]
    [String]$PlainTextString,

    [Parameter(
        Mandatory=$True,
        Position=1
    )]
    [Alias("Key")]
    [byte[]]$EncryptionKey
)
    Try{
        $secureString = Convertto-SecureString $PlainTextString -AsPlainText -Force
        $EncryptedString = ConvertFrom-SecureString -SecureString $secureString -Key $EncryptionKey

        return $EncryptedString
    }
    Catch{Throw $_}

}

this function accepts a string, a key and outputs the encryptedstring.

To encrypt call the function with a plaintext string and a key. the key must be a byte array with 16,24 or 32 bytes (128,192 or 256 bits)

Calling the function looks like this.

$string = @'
I am about to become encrypted!
'@

[Byte[]]$Key = 117,9,103,192,133,20,53,149,81,95,108,34,81,224,226,220,56,68,133,120,139,241,176,239,171,54,231,205,83,57,51,255

$EncryptedString = Encrypt-String -PlainTextString $string -Key $Key

The output becomes

PS> $encryptedString
76492d1116743f0423413b16050a5345MgB8AG8AVABnAGcAagArAFYAUgBoAGkAYwBOAFIAZgBTAGEAQQB1AGsAMQBmAHcAPQA9
AHwAZQBiADIAOAA4ADQAYwA5ADEAMABlAGMAOABmADUAOAAyAGIANQAzADIAOABjADIAOAAxADUAZgAxADYAMgAyAGQAMgA2AGUA
ZQA2ADYANAA2AGUAYQA0AGMAMgBmADMAYgAwADIAMgAxAGQAOQAxADcANwBhADgANwAxADcAZgBjADEANwAxADcANwA1ADgANwBh
ADMAMgA3AGEAMABmADcAYQAzADcAYQBiADgANAAwADkAOQA4ADgANgA1AGYAMwA5ADMANAA3ADkAZgAwAGIAZAA1AGQAZgA2AGEA
MABmADIANwBmADkANQBhAGYAOAAxAGYANgA0ADAAOAAxAA==

Now to the decrypt. This function needs the exact encryptedstring and the exact key that the string was encoded with.

Function Decrypt-String{
Param(
    [Parameter(
        Mandatory=$True,
        Position=0,
        ValueFromPipeLine=$true
    )]
    [Alias("String")]
    [String]$EncryptedString,

    [Parameter(
        Mandatory=$True,
        Position=1
    )]
    [Alias("Key")]
    [byte[]]$EncryptionKey
)
    Try{
        $SecureString = ConvertTo-SecureString $EncryptedString -Key $EncryptionKey
        $bstr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($SecureString)
        [string]$String = [Runtime.InteropServices.Marshal]::PtrToStringAuto($bstr)
        [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr)

        Return $String
    }
    Catch{Throw $_}

}

To call this function simply input the encryptedString and key and you get the pre-encrypted string as the return value.

PS> Decrypt-String -EncryptedString $EncryptedString -EncryptionKey $Key
I am about to become encrypted!

Both functions accept value by pipeline so a Get-content can be used like this.

Get-Content C:\temp\encrypted.txt | Decrypt-String -EncryptionKey $Key

An overkill version of this is to double encode/encrypt. First convert the string to a base64 (encodedCommand style) then encode it with the key. This really adds no further security except to obfuscate the encrypted package and in case someone gets the key to decrypt they have to convert the encodedcommand to a string from base 64

Function Encrypt-String{
Param(

    [Parameter(
        Mandatory=$True,
        Position=0,
        ValueFromPipeLine=$true
    )]
    [Alias("String")]
    [String]$PlainTextString,

    [Parameter(
        Mandatory=$True,
        Position=1
    )]
    [Alias("Key")]
    [byte[]]$EncryptionKey
)
    Try{
        $bytes = [System.Text.Encoding]::Unicode.GetBytes($PlainTextString)
        $encodedCommand = [Convert]::ToBase64String($bytes)
        $secureString = Convertto-SecureString $encodedCommand -AsPlainText -Force
        $EncryptedString = ConvertFrom-SecureString -SecureString $secureString -Key $EncryptionKey

        return $EncryptedString
    }
    Catch{Throw $_}

}

Function Decrypt-String{
Param(
    [Parameter(
        Mandatory=$True,
        Position=0,
        ValueFromPipeLine=$true
    )]
    [Alias("String")]
    [String]$EncryptedString,

    [Parameter(
        Mandatory=$True,
        Position=1
    )]
    [Alias("Key")]
    [byte[]]$EncryptionKey
)
    Try{
        $SecureString = ConvertTo-SecureString $EncryptedString -Key $EncryptionKey
        $bstr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($SecureString)
        [string]$String = [Runtime.InteropServices.Marshal]::PtrToStringAuto($bstr)
        [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr)

        $data = @()
        [convert]::FromBase64String($encodedCommand) | ForEach-Object{
            If($_ -ne 0){
                $data += [char]$_
            }
        }

        Return ($data -join '')
    }
    Catch{Throw $_}

}

Retreive passwords through GPO/GPP with powershell.

Vikingur Saemundsson — Tue, 03 Feb 2015 12:12:59 GMT

There is a known vulnerability in windows where all passwords stored in Group policy preferences are encrypted with a public AES key (link to msdn).

In this post we will go through how to get all the usernames and passwords from group policies in the minimum amount of time with maximum amount of data so we can infiltrate the domain.

What we will need is a fast USB stick loaded with a set of scripts. (attached at the bottom of the post)

First we want to retreive all XML files that may contain passwords. We do this by a query to the SYSVOL. This is the bulk of the time and it is recommended to perform this first if you’re using this on someone else’s computer (perhaps forgot to lock or in a public area).
For this run “Get-GPPXML.ps1”

If there is still time, we can go ahead and encrypt by running “Decrypt-passwords.ps1”, this will save it as a csv file to be opened in excel with the following headers for easy reading.
Domain Usernames Passwords NewNames(might be reset) File ChangedTimestamp

Get-GPPPasswords.zip (file no longer available)

Counting in roman

Vikingur Saemundsson — Thu, 20 Nov 2014 14:23:54 GMT

1 to 100 looks like this

I, II, III, IV, V, VI, VII, VIII, VIV, X, XI, XII, XIII, XIV, XV, XVI, XVII, XVIII, XVIV, XX, XXI, XXII, XXIII, XXIV, XXV, XXVI, XXVII, XXVIII, XXVIV, XXX, XXXI, XXXII, XXXIII, XXXIV, XXXV, XXXVI, XXXVII, XXXVIII, XXXVIV, XC, XCI, XCII, XCIII, XCIV, XCV, XCVI, XCVII, XCVIII, XCVIV, L, LI, LII, LIII, LIV, LV, LVI, LVII, LVIII, LVIV, LX, LXI, LXII, LXIII, LXIV, LXV, LXVI, LXVII, LXVIII, LXVIV, LXX, LXXI, LXXII, LXXIII, LXXIV, LXXV, LXXVI, LXXVII, LXXVIII, LXXVIV, XC, XCI, XCII, XCIII, XCIV, XCV, XCVI, XCVII, XCVIII, XCVIV, LXC, LXCI, LXCII, LXCIII, LXCIV, LXCV, LXCVI, LXCVII, LXCVIII, LXCVIV, C

Function To-Roman{
Param([Parameter(Mandatory=$true)][int]$int)
    [int]$M = 1000
    [int]$D = 500
    [int]$C = 100
    [int]$L = 50
    [int]$X = 10
    [int]$V = 5
    [int]$I = 1
    If($int -eq 0){Throw "Zero does not exist in roman culture.";Return 404}
    $done = $false
    While($done -eq $false){

        #$Roman = $roman+(addup $int $m "M")
        If($int -ge $m){
            $n = Loopy $int $m
            $int = $n[0]
            1..$n[1] | %{$Roman = $Roman+"M"}

        }

        If($int -ge $D){
            $n = Loopy $int $D
            $int = $n[0]
            1..$n[1] | %{$Roman = $Roman+"D"}
        }

        If($int -ge $C){
            $n = Loopy $int $C
            $int = $n[0]
            1..$n[1] | %{$Roman = $Roman+"C"}

        }

        If($int -ge $L){
            $n = Loopy $int $L
            $int = $n[0]
            1..$n[1] | %{$Roman = $Roman+"L"}
        }

        If($int -ge $X){
            $n = Loopy $int $X
            $int = $n[0]
            1..$n[1] | %{$Roman = $Roman+"X"}

        }

        If($int -ge $V){
            $n = Loopy $int $V
            $int = $n[0]
            1..$n[1] | %{$Roman = $Roman+"V"}
        }

        If($int -ge $I){
            $n = Loopy $int $I
            $int = $n[0]
            1..$n[1] | %{$Roman = $Roman+"I"}

        }
        If($roman.Contains("CCCC")){$roman=$Roman.Replace("CCCC","CD")}
        If($roman.Contains("XXXX")){$roman=$Roman.Replace("XXXX","XC")}
        If($roman.Contains("LLLL")){$roman=$Roman.Replace("LLLL","XL")}
        If($roman.Contains("LXXX")){$roman=$Roman.Replace("LXXX","XC")}
        If($roman.Contains("VIV")){$roman=$Roman.Replace("VIV","IX")}
        If($roman.Contains("IIII")){$roman=$Roman.Replace("IIII","IV")}

        If($int -eq 0){$done = $true}
    }
    Return $Roman
}

Function Loopy{
Param(
    [int]$int,
    [int]$number
)
    $notDone = $true
    $loops = 0
    While($notDone){
        If($int-$number -ge 0){$int=$int-$number;$loops++}
        ElseIf($int-$number -lt $number){$notDone = $false}
    }
    return $int,$loops
}

1..1000 | %{"$(To-Roman $_) $_"}

Threaded GUI module

Vikingur Saemundsson — Wed, 12 Nov 2014 15:30:40 GMT

Function Invoke-GUI {
<#
    .SYNOPSIS
        Invoke-GUI creates a customizable threaded GUI for powershell
    .DESCRIPTION
        Creates a GUI from XAML file through Windows Presentation Foundation.
        All XAML data that require changeable data requires a "Name" node which sets the variable name
        Any XML nodes with name will get a variable assigned under $Code.<variable> and all subsequent data is accessible from there.
        The main GUI will be assigned $Code.GUI
    .PARAMETER File
        Sets a file with the XAML data used to build the interface.
    .PARAMETER XAML
        Input object in form on an already created XML variable.
    .PARAMETER OnTick
        Code to be executed on each tick
    .PARAMETER InitializationScript
        Code to be performed one time before the GUI shows.
    .PARAMETER TimerInterval
        Timer interval
    .PARAMETER LogFile
        LogFile location
    .Example
        Invoke-GUI -File C:\Application\GUI.xaml
        This loads the GUI without any tick action or custom initialization script.
    .Example
        Invoke-GUI -XAML $XAML -LogFile C:\Application\dump.log
        Loads the GUI from an already compiled XAML object and outputs logs to dump.log
    .Example
        Invoke-GUI -XAML $XAML -OnTick {$Code.MessageBox.Content = "Random number: $(Get-Random)"} -TimerInterval "0:1:0.00" -LogFile C:\Application\dump.log
        As example two but updates a MessageBox variable with a random number once per minute.
    .Example
        Invoke-GUI -XAML $XAML -TimerInterval "0:1:0.00" -LogFile C:\Application\dump.log -OnTick {
            $Code.MessageBox.Content = "Random number: $(Get-Random)"
        } -InitializationScript {
            $Code.Company.Content = "Contoso"
            $Code.Agreement.Value = 0
        }
        As example three but adds some company and agreement information at startup.
#>
[cmdletbinding()]
Param (
    [Parameter(Mandatory=$True,ParameterSetName="File")]
    [String]$File,
    [Parameter(Mandatory=$True,ParameterSetName="XAML")]
    [XML]$XAML,
    [Parameter(Mandatory=$False)]
    [ScriptBlock]$OnTick = {},
    [Parameter(Mandatory=$False)]
    [ScriptBlock]$InitializationScript = {},
    [Parameter(Mandatory=$False)]
    [TimeSpan]$TimerInterval = "0:0:1.00",
    [Parameter(Mandatory=$False)]
    [String]$LogFile
)

    If($LogFile){
        $time = get-date -Format "yyyy-MM-dd HH:mm:ss"
        "$Time | Starting GUI script" | Out-File $LogFile -Append
    }

    $Script:Code = [hashtable]::Synchronized(@{})
    $Code.TimerInterval = $TimerInterval
    $Code.OnTick = $OnTick
    $Code.InitializationScript = $InitializationScript
    $Code.ParameterSet = $PSCmdlet.ParameterSetName
    If($PSCmdlet.ParameterSetName -eq "File"){
        $Code.XAMLFile = $File
    }
    Else{
        $Code.XAML = $XAML
    }

    If($LogFile){
        $Code.LogFile = $LogFile
    }

    $Script:Runspacehash = [hashtable]::Synchronized(@{})
    $Runspacehash.host = $Host
    $Runspacehash.runspace = [RunspaceFactory]::CreateRunspace()
    $Runspacehash.runspace.ApartmentState = “STA”
    $Runspacehash.runspace.ThreadOptions = “ReuseThread”
    $Runspacehash.runspace.Open()
    $Runspacehash.psCmd = {Add-Type -AssemblyName PresentationCore,PresentationFramework,WindowsBase}.GetPowerShell()
    $Runspacehash.runspace.SessionStateProxy.SetVariable("code",$Code)
    $Runspacehash.runspace.SessionStateProxy.SetVariable("Runspacehash",$Runspacehash)
    $Runspacehash.psCmd.Runspace = $Runspacehash.runspace

    $Runspacehash.Handle = $Runspacehash.psCmd.AddScript({

        $Script:Update = {
            # Do stuff on tick here
            .$Code.OnTick
        }

        If($Code.ParameterSet -eq "File"){[XML]$XAML = Get-Content $Code.XAMLFile}
        Else{[XML]$XAML = $Code.XAML}

        # builds gui as $Code.GUI with data from $XAML
        # creates variable for each xml property with the "name" assigned.
        Try {

            [reflection.assembly]::loadwithpartialname("System.Windows.Forms") | Out-Null

            $objXMLReader = (New-Object System.Xml.XmlNodeReader $XAML)
            $Code.GUI = [Windows.Markup.XamlReader]::Load($objXMLReader)

            $Code.GUI.WindowStartupLocation = "CenterScreen"

            If($Code.LogFile){
                $time = get-date -Format "yyyy-MM-dd HH:mm:ss"
                "$Time | Creating variables for XAML elements.." | Out-File $Code.LogFile -Append
            }
            $XAML.SelectNodes("//*[@Name]") | ForEach-Object {
                If($Code.LogFile){
                    $time = get-date -Format "yyyy-MM-dd HH:mm:ss"
                    "$Time | Variable created: `$Code.$($_.Name)" | Out-File $Code.LogFile -Append
                }
                $Code."$($_.Name)" = $Code.GUI.FindName($_.Name)
            }
        }
        Catch {
            If($Code.LogFile){
                $time = get-date -Format "yyyy-MM-dd HH:mm:ss"
                "$Time | $_" | Out-File $Code.LogFile -Append
            }
            Exit
        }

        #Timer Event
        $Code.GUI.Add_SourceInitialized({
            $Script:timer = new-object System.Windows.Threading.DispatcherTimer
            If($Code.LogFile){
                $time = get-date -Format "yyyy-MM-dd HH:mm:ss"
                "$Time | Timer interval is: $($Code.TimerInterval)" | Out-File $Code.LogFile -Append
            }
            $timer.Interval = [TimeSpan]$Code.TimerInterval

            $timer.Add_Tick({
                $Update.Invoke()
                [Windows.Input.InputEventHandler]{$Code.GUI.UpdateLayout()}
            })

            #Start timer
            If($Code.LogFile){
                $time = get-date -Format "yyyy-MM-dd HH:mm:ss"
                "$Time | Starting timer" | Out-File $Code.LogFile -Append
            }
            $timer.Start()
            If (-NOT $timer.IsEnabled) {

                If($Code.LogFile){
                    $time = get-date -Format "yyyy-MM-dd HH:mm:ss"
                    "$Time | Stopping GUI" | Out-File $Code.LogFile -Append
                }

                $Code.GUI.Close()
            }
        })

        $Code.GUI.Add_Closed({
            If($Code.LogFile){
                $time = get-date -Format "yyyy-MM-dd HH:mm:ss"
                "$Time | GUI disposed" | Out-File $Code.LogFile -Append
            }
            $timer.Stop()
            $Runspacehash.PowerShell.Dispose()

            [gc]::Collect()
            [gc]::WaitForPendingFinalizers()
        })

        Try{$Code.InitializationScript.Invoke()}
        Catch{
            If($Code.LogFile){
                $time = get-date -Format "yyyy-MM-dd HH:mm:ss"
                "$Time | $_" | Out-File $Code.LogFile -Append
            }
        }

        # Does not work to place this in the InitializationScript yet. Need to work around this somehow
        $Code.GUI.Add_MouseLeftButtonDown({
            $This.DragMove()
        })

        $Code.GUI.ShowDialog() | Out-Null

    }).BeginInvoke()

    #Give gui time to initialize
    Start-sleep 1
}

Function Update-GUI{
<#
    .SYNOPSIS
        Update-GUI Sends a scriptblock for execution in the GUI thread.
    .DESCRIPTION
        Takes a Scriptblock for execution in the GUI thread.
        It is a simple command (9 rows) but as it is used often converted to a function.
        Code is:
        $Code.GUI.Dispatcher.Invoke([action]{
            Try{.$ScriptBlock}
            Catch{
                If($Code.LogFile){
                    $time = get-date -Format "yyyy-MM-dd HH:mm:ss"
                    "$Time | Could not execute command: $ScriptBlock" | Out-File $Code.LogFile -Append
                }
            }
        })
    .PARAMETER ScriptBlock
        Scriptblock to run inside thread.
    .Example
        Update-GUI -ScriptBlock {$Code.Message.content = "Hello world"}
        Updates the message node content with "hello world"
#>
Param(
    [Parameter(Mandatory=$True)]
    [ScriptBlock]$ScriptBlock
)
    $Code.GUI.Dispatcher.Invoke([action]{
        Try{.$ScriptBlock}
        Catch{
            If($Code.LogFile){
                $time = get-date -Format "yyyy-MM-dd HH:mm:ss"
                "$Time | Could not execute command: $ScriptBlock" | Out-File $Code.LogFile -Append
            }
        }
    })
}

Microsoft hotfix indexer and browser

Vikingur Saemundsson — Wed, 16 Apr 2014 14:32:09 GMT

A while back I made a quick hotfix indexer script and database browser.

These were not too great but had sufficient functionality for the time. Now that I have expanded on functionality I want to write this as a single post.

Any Microsoft enterprise technician could see the value in having a list like this.
The question is why Microsoft don’t provide this list themselves.
Anyhow, let’s begin!

This package (file no longer available) contains three files. One indexer.ps1. One HotfixBrowser.ps1 and a config file where you specify SQL connectionstring and table to be used before running the scripts.

The heart of the script is the indexer. It goes through a range specified and lists them in a database. The table must have the following columns:

Other columns can be added if needed and will be listed in the hotfix browser.
What I do is add a scheduled task that runs this script with a set of ranges every weekend to get a up-to date view.

When the indexer has completed you can start HotfixBrowser.ps1

From here you can search with standard SQL syntax. All fields to a LIKE search so for example All windows 8 hotfixes released during 2014 has this search criteria.

Clicking search allows you to quickly see the short text of all articles involving Windows 8 with a hotfix download available allowing you to work efficiently and determine if any of the hotfixes are applicable to your client environment.

There are also the option to go ‘advanced’ which allows you to edit the Select query as you see fit.

In the File menu you can export the current datatable as a CSV file.
In the tools mode you can save and load searches as well as choose visible columns and enable edit mode.
Edit mode makes the cells writable and allows you to send a UPDATE query to the server (given the appropriate rights) to edit some fields such as note and other custom fields.

Project: 3D Printer from scratch. Part 5 – Trial and error. And finally success!

Vikingur Saemundsson — Mon, 07 Apr 2014 11:51:26 GMT

With all the mechanical parts assembled all that is left is firmware calibration – or so we thought.

With all basic calibration done we noticed on prints that the X and Y axises were shifting. as shown below. Looking around and asking on communities this seems often to be due to when the stepper motors skips steps or the timing belt slipping.
We tried everything suggested, from cooling stepper drivers, motors, tightening belts and turning down acceleration in the firmware but nothing worked.

It was first when we loosened the belts and ran the motors we noticed that the pulleys were slipping off the shafts. This was because the pulleys screws were biting into the brass pipe which we used to bridge the gap between our motors and the pulleys did not provide enough friction. When we loosened the belts even less friction was applied between the brass and drive shaft and the slippage became apparent.

After buying some metal epoxy to fixate everything together we are able to finally produce perfectly straight prints!

The print above are some holders for a spool where I designed the feet myself.
It’s quite an amazing feeling to draw something in a 3D program one day and to hold it the next.

Project: 3D Printer from scratch. Part 4 – Assembly

Vikingur Saemundsson — Mon, 07 Apr 2014 11:16:08 GMT

With all the parts delivered it was time to assemble.

I’m not going to go through the whole build process. But it consisted of loads of screwing around (pun intended) and It’s not the prettiest build but i honestly don’t care about looks. It’s function I’m after.

To make a long story short here are some pictures of the build process:

One issue we had was that the motors shaft diameter was 4mm and the pulleys had 5mm. We solved this by buying a brass pipe with 4mm inner and 5mm outer diameter.
We then cut the pipe and screwed them on. This kept the pulleys from rotating in an elipse and gave us a nice smooth circular and even rotation.

Not being the most experianced DIY guys we spent about half a billion hours on assembly. But in the end it worked and we managed to produce our first ever print!

Success!!!

Hotfix browser

Vikingur Saemundsson — Mon, 31 Mar 2014 15:02:56 GMT

#Requires -version 2
[CmdletBinding()]
Param($min,$max)
Begin{
    $MyPath = Split-Path $MyInvocation.MyCommand.path -Parent

    Function SaveFileDialog{
    Param(
        [Parameter(Mandatory=$True)]
        $Filetype
    )
        [Void][Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
        $SaveFileDialog = New-Object System.Windows.Forms.SaveFileDialog
        $SaveFileDialog.Filter = "$Filetype files (*.$Filetype)|*.$Filetype|All files (*.*)|*.*"
        $status = $SaveFileDialog.ShowDialog()

        If($status -eq "Cancel"){$Return = $status}
        Else{$Return = $SaveFileDialog.FileName}

        $SaveFileDialog.Dispose()
        Return $Return
    }

    Function Call-Form{
        [reflection.assembly]::loadwithpartialname("System.Windows.Forms") | Out-Null
        [reflection.assembly]::loadwithpartialname("System.Drawing") | Out-Null
        $EditMode = $False
        $savepath = "$MyPath\SavedSearches.xml"

        ### MAINFORM
        $form1 = New-Object System.Windows.Forms.Form
        $label7 = New-Object System.Windows.Forms.Label
        $label6 = New-Object System.Windows.Forms.Label
        $NotesSearch = New-Object System.Windows.Forms.TextBox
        $LinkSearch = New-Object System.Windows.Forms.TextBox
        $label5 = New-Object System.Windows.Forms.Label
        $label4 = New-Object System.Windows.Forms.Label
        $Progressbar = New-Object System.Windows.Forms.ProgressBar
        $DownloadSearch = New-Object System.Windows.Forms.ComboBox
        $label3 = New-Object System.Windows.Forms.Label
        $label2 = New-Object System.Windows.Forms.Label
        $label1 = New-Object System.Windows.Forms.Label
        $ReviewSearch = New-Object System.Windows.Forms.TextBox
        $AppliestoSearch = New-Object System.Windows.Forms.TextBox
        $ShortTextSearch = New-Object System.Windows.Forms.TextBox
        $KBIDsearch = New-Object System.Windows.Forms.TextBox
        $searchButton = New-Object System.Windows.Forms.Button
        $dataGrid = New-Object System.Windows.Forms.DataGridView
        $InitialFormWindowState = New-Object System.Windows.Forms.FormWindowState

        #SAVE FORM
        $saveForm = New-Object System.Windows.Forms.Form
        $saveBox = New-Object System.Windows.Forms.TextBox
        $SaveButton = New-Object System.Windows.Forms.Button
        $listView = New-Object System.Windows.Forms.ListView

        #LOAD FORM
        $loadForm = New-Object System.Windows.Forms.Form
        $loadBox = New-Object System.Windows.Forms.TextBox
        $loadButton = New-Object System.Windows.Forms.Button

        $searchButton_Click ={
            $Progressbar.Show()
            If($DownloadSearch.Text -eq "True"){
                $DL = "1"
            }
            Else{
                $DL = "0"
            }

            #Get values from fields
            $SearchValues = @{}
            $SearchValues.Add("KBID",$KBIDsearch.Text)
            $SearchValues.Add("ShortText",$ShortTextSearch.Text)
            $SearchValues.Add("Download",$DL)
            $SearchValues.Add("AppliesTo",$AppliestoSearch.Text)
            $SearchValues.Add("LastReviewed",$ReviewSearch.Text)
            $SearchValues.Add("Link",$LinkSearch.Text)
            $SearchValues.Add("Notes",$NotesSearch.Text)

            #Compile search query
            $Query = "Select KBID,ShortText,Download,AppliesTo,LastReviewed,Link,Notes FROM hotfix_primary WHERE Exist = 1"
            $SearchValues.Keys | ForEach-Object{
                If($SearchValues.$_ -ne ''){
                    $value = $SearchValues.$_
                    $Query = "$Query AND $_ LIKE `'$Value`'"
                }

            }
            Try{
                $Data = Get-SQLQuery $Query
                $dataGrid.Rows.Clear()
                $Data | ForEach-Object{
                    [datetime]$date = $_.LastReviewed
                    $lastReviewed = '{0:yyyy-MM-dd}' -f $Date
                    $dataGrid.Rows.Add($_.KBID,$_.ShortText,$_.Download,$_.AppliesTo,$lastReviewed,$_.Link,$_.Notes)
                }
            }
            Catch{}#Write-Error $_}
            $Progressbar.Hide()
        }

        $OnLoadForm_StateCorrection=
        {#Correct the initial state of the form to prevent the .Net maximized form issue
        	$form1.WindowState = $InitialFormWindowState
        }

        # Menu button clicks

        $toolEdit_Click = {
            If($EditMode -eq $False){
                $toolEdit.Checked = $True
                $EditMode = $True
                $MainMenu.Items.Add($editMenu) | out-null
                $datagrid.columns | ForEach-Object{$_.ReadOnly = $False}
            }
            Else{
                $toolEdit.Checked = $False
                $EditMode = $False
                $MainMenu.Items.Remove($editMenu) | out-null
                $datagrid.columns | ForEach-Object{$_.ReadOnly = $True}
            }
        }

        $fileExport_Click = {
            $File = SaveFileDialog -Filetype "csv"
            If($File -ne "Cancel"){
                $Progressbar.Show()
                "KBID,ShortText,Download,AppliesTo,LastReviewed,Link,Notes" | Out-File $File
                $dataGrid.Rows | ForEach-Object{
                    $Cells = $_.cells
                    $KBID = ($cells | Where-object{$_.OwningColumn.Name -eq "KBID"}).Value
                    $ShortText = ($cells | Where-object{$_.OwningColumn.Name -eq "ShortText"}).Value
                    $Download = ($cells | Where-object{$_.OwningColumn.Name -eq "Download"}).Value
                    $AppliesTo = ($cells | Where-object{$_.OwningColumn.Name -eq "AppliesTo"}).Value
                    $LastReviewed = ($cells | Where-object{$_.OwningColumn.Name -eq "LastReviewed"}).Value
                    $Link = ($cells | Where-object{$_.OwningColumn.Name -eq "Link"}).Value
                    $Notes = ($cells | Where-object{$_.OwningColumn.Name -eq "Notes"}).Value
                    If($KBID -ne $null){
                        "$KBID,$ShortText,$Download,$AppliesTo,$LastReviewed,$Link,$Notes" | Out-File $File -Append
                    }
                }
                $Progressbar.Hide()
            }
        }

        $toolClear_Click = {
            $dataGrid.Rows.Clear()

            $KBIDsearch.Text = ''
            $ShortTextSearch.Text = ''
            $DownloadSearch.Text = "True"
            $AppliestoSearch.Text = ''
            $ReviewSearch.Text = ''
            $LinkSearch.Text = ''
            $NotesSearch.Text = ''
        }

        $toolSave_Click = {
            .$saveloadOnLoad
            $saveForm.Controls.Add($listView)
            $saveForm.ShowDialog()| Out-Null
        }
        $toolLoad_Click = {
            .$saveloadOnLoad
            $loadForm.Controls.Add($listView)
            $loadForm.ShowDialog()| Out-Null
        }

        $fileQuit_Click = {
            $form1.Close()
        }

        $SaveButton_OnClick = {
            $new = $saves.CreateElement('Save')
            $Name = $SaveBox.Text
            $new.SetAttribute('Name',"$($SaveBox.Text)")
            $new.SetAttribute('Query',"$Query")
            Try{($saves.SavedSearches.Save | Where-Object{$_.Name -eq $Name}).RemoveAll()}Catch{}
            $saves.SavedSearches.AppendChild($new)
            $saves.Save($savepath)
            #clean up bad elements
            [xml]$Clean = Get-Content $savepath | Where-Object{($_ -NotMatch '<Save />') -or ($_ -NotMatch 'Save Name=""')}
            $Clean.Save($savepath)
            $saveForm.Controls.Remove($listView)
            $saveForm.Close()
        }
        $LoadButton_OnClick = {
            $Query = ($saves.SavedSearches.Save | Where-object {$_.Name -Match "$($loadBox.Text)"}).Query
            $loadForm.Controls.Remove($listView)
            $loadForm.Close()
            $Progressbar.Show()
            $KBIDsearch.Text = ''
            $ShortTextSearch.Text = ''
            $DownloadSearch.Text = "True"
            $AppliestoSearch.Text = ''
            $ReviewSearch.Text = ''
            $LinkSearch.Text = ''
            $NotesSearch.Text = ''
            Try{
                $Data = Get-SQLQuery $Query
                $dataGrid.Rows.Clear()
                $Data | ForEach-Object{
                    [datetime]$date = $_.LastReviewed
                    $lastReviewed = '{0:yyyy-MM-dd}' -f $Date
                    $dataGrid.Rows.Add($_.KBID,$_.ShortText,$_.Download,$_.AppliesTo,$lastReviewed,$_.Link,$_.Notes)
                }
            }
            Catch{Write-Error $_}
            $Progressbar.Hide()
        }

        $listView_OnSelected = {
            $SaveBox.Text = $listView.SelectedItems[0].Text
            $loadBox.Text = $listView.SelectedItems[0].Text
        }

        $saveloadOnLoad = {
            $loadBox.Text = ''
            $SaveBox.Text = ''
            $listView.Items.Clear()
            [xml]$Clean = Get-Content $savepath | Where-Object{($_ -NotMatch '<Save />') -or ($_ -NotMatch 'Save Name=""')}
            $Clean.Save($savepath)
            $saves = [xml](Get-Content $savepath)
            $saves.SavedSearches.Save | ForEach-Object{
                $listView.Items.Add("$($_.Name)")|Out-Null
            }
        }

        $editClear_Click = {
            $new = "<?xml version=`"1.0`" encoding=`"utf-8`"?>`r`n<SavedSearches Description=`"All saved searches are nodes under this one`">`r`n</SavedSearches>"
            $new | out-file $savepath
        }

        $editUpdate_Click = {

            $dataGrid.Rows | ForEach-Object{
                $Cells = $_.cells
                $KBID = ($cells | Where-object{$_.OwningColumn.Name -eq "KBID"}).Value
                If($KBID -ne $null){
                    $ShortText = ($cells | Where-object{$_.OwningColumn.Name -eq "ShortText"}).Value
                    $Download = ($cells | Where-object{$_.OwningColumn.Name -eq "Download"}).Value
                    $AppliesTo = ($cells | Where-object{$_.OwningColumn.Name -eq "AppliesTo"}).Value
                    [Datetime]$LastReviewed = ($cells | Where-object{$_.OwningColumn.Name -eq "LastReviewed"}).Value
                    $Link = ($cells | Where-object{$_.OwningColumn.Name -eq "Link"}).Value
                    $Notes = ($cells | Where-object{$_.OwningColumn.Name -eq "Notes"}).Value

                    $Columns = "KBID","ShortText","Download","AppliesTo","LastReviewed","Link","Notes"
                    $Values = "`'$KBID`'","`'$ShortText`'","`'$Download`'","`'$AppliesTo`'","`'$LastReviewed`'","`'$Link`'","`'$Notes`'"
                    $UpdateCMD = "UPDATE hotfix_primary SET $($c = $Columns.count;(1..($c-1) | ForEach-Object{"$($Columns[$_]) = $($Values[$_])"}) -Join ',') WHERE KBID = `'$KBID`';"
                    Process-SQLCmd $UpdateCMD
                }
            }

        }

        #----------------------------------------------
        #region Generated Form Code
        $form1.ClientSize = "853,485"
        $form1.DataBindings.DefaultDataSourceUpdateMode = 0
        $form1.Text = "KB article browser"
        ### Main Menu Settings
        $MainMenu = new-object System.Windows.Forms.MenuStrip
        $MainMenu.Location = "0,0"
        $MainMenu.Name = "MainMenu"
        $MainMenu.Size = "1000,620"
        $MainMenu.TabIndex = 0
        $MainMenu.Text = "Main Menu"

        ## File Menu settings
        $fileMenu = new-object System.Windows.Forms.ToolStripMenuItem('&fileMenu')
        $fileMenu.Size = "35,20"
        $fileMenu.Text = "File"

        # Quit button
        $fileQuit = new-object System.Windows.Forms.ToolStripMenuItem('&Quit')
        $fileQuit.add_Click($fileQuit_Click)
        # Save button
        $fileExport = new-object System.Windows.Forms.ToolStripMenuItem('&Export list to CSV')
        $fileExport.Add_Click($fileExport_Click)

        # Add to file menu
        $fileMenu.DropDownItems.Add($fileExport) | out-null
        $fileMenu.DropDownItems.Add($fileQuit) | out-null

        ## Tool Menu settings
        $toolMenu = new-object System.Windows.Forms.ToolStripMenuItem('&toolMenu')
        $toolMenu.Size = "35,20"
        $toolMenu.Text = "Tools"

        $toolSave = new-object System.Windows.Forms.ToolStripMenuItem('&Save search')
        $toolSave.add_Click($toolSave_Click)

        # Copy button
        $toolLoad = new-object System.Windows.Forms.ToolStripMenuItem('&Load search')
        $toolLoad.add_Click($toolLoad_Click)

        # Copy button
        $toolEdit = new-object System.Windows.Forms.ToolStripMenuItem('&Edit mode')
        $toolEdit.add_Click($toolEdit_Click)

        # Clear button
        $toolClear = new-object System.Windows.Forms.ToolStripMenuItem('&Clear/Reset')
        $toolClear.add_Click($toolClear_Click)

        # Add to tool menu
        $toolMenu.DropDownItems.Add($toolSave) | out-null
        $toolMenu.DropDownItems.Add($toolLoad) | out-null
        $toolMenu.DropDownItems.Add($toolEdit) | out-null
        $toolMenu.DropDownItems.Add($toolClear) | out-null

        ## Edit Menu settings
        $editMenu = new-object System.Windows.Forms.ToolStripMenuItem('&editMenu')
        $editMenu.Size = "35,20"
        $editMenu.Text = "Edit"

        # Clear saved searches button
        $editClear = new-object System.Windows.Forms.ToolStripMenuItem('&Remove all saved searches')
        $editClear.add_Click($editClear_Click)

        # Update button
        $editUpdate = new-object System.Windows.Forms.ToolStripMenuItem('&Update database')
        $editUpdate.add_Click($editUpdate_Click)

        # Add to tool menu
        $editMenu.DropDownItems.Add($editUpdate) | out-null
        $editMenu.DropDownItems.Add($editClear) | out-null

        # Add main menu buttons
        $MainMenu.Items.Add($fileMenu) | out-null
        $MainMenu.Items.Add($toolMenu) | out-null

        $form1.Controls.Add($MainMenu) | out-null

        #######Searchboxes##########

        $NotesSearch.DataBindings.DefaultDataSourceUpdateMode = 0
        $NotesSearch.Location = "653,64"
        $NotesSearch.Name = "NotesSearch"
        $NotesSearch.Size = "93,20"
        $NotesSearch.TabIndex = 15

        $form1.Controls.Add($NotesSearch)

        $LinkSearch.DataBindings.DefaultDataSourceUpdateMode = 0
        $LinkSearch.Location = "553,64"
        $LinkSearch.Name = "LinkSearch"
        $LinkSearch.Size = "94,20"
        $LinkSearch.TabIndex = 14

        $form1.Controls.Add($LinkSearch)

        $DownloadSearch.DataBindings.DefaultDataSourceUpdateMode = 0
        $DownloadSearch.FormattingEnabled = $False
        $DownloadSearch.Items.Add("True")|Out-Null
        $DownloadSearch.Items.Add("False")|Out-Null
        $DownloadSearch.Location = "253,64"
        $DownloadSearch.Name = "DownloadSearch"
        $DownloadSearch.Size = "94,21"
        $DownloadSearch.TabIndex = 10
        $DownloadSearch.SelectedItem = "True"
        $DownloadSearch.DropDownStyle = 2

        $form1.Controls.Add($DownloadSearch)

        $ReviewSearch.DataBindings.DefaultDataSourceUpdateMode = 0
        $ReviewSearch.Location = "453,65"
        $ReviewSearch.Name = "ReviewSearch"
        $ReviewSearch.Size = "94,20"
        $ReviewSearch.TabIndex = 6

        $form1.Controls.Add($ReviewSearch)

        $AppliestoSearch.DataBindings.DefaultDataSourceUpdateMode = 0
        $AppliestoSearch.Location = "353,65"
        $AppliestoSearch.Name = "AppliestoSearch"
        $AppliestoSearch.Size = "94,20"
        $AppliestoSearch.TabIndex = 5

        $form1.Controls.Add($AppliestoSearch)

        $ShortTextSearch.DataBindings.DefaultDataSourceUpdateMode = 0
        $ShortTextSearch.Location = "153,65"
        $ShortTextSearch.MaxLength = 128
        $ShortTextSearch.Name = "ShortTextSearch"
        $ShortTextSearch.Size = "94,20"
        $ShortTextSearch.TabIndex = 3

        $form1.Controls.Add($ShortTextSearch)

        $KBIDsearch.DataBindings.DefaultDataSourceUpdateMode = 0
        $KBIDsearch.Location = "53,65"
        $KBIDsearch.MaxLength = 7
        $KBIDsearch.Name = "KBIDsearch"
        $KBIDsearch.Size = "94,20"
        $KBIDsearch.TabIndex = 2

        $form1.Controls.Add($KBIDsearch)

        $searchButton.Anchor = 9

        $searchButton.DataBindings.DefaultDataSourceUpdateMode = 0
        $searchButton.Location = "752,64"
        $searchButton.Name = "searchButton"
        $searchButton.Size = "88,21"
        $searchButton.TabIndex = 1
        $searchButton.Text = "Search"
        $searchButton.UseVisualStyleBackColor = $True
        $searchButton.add_Click($searchButton_Click)

        $form1.Controls.Add($searchButton)

        #####Labels and the rest#####

        $label7.DataBindings.DefaultDataSourceUpdateMode = 0

        $label7.Location = "653,43"
        $label7.Name = "label7"
        $label7.Size = "100,15"
        $label7.TabIndex = 17
        $label7.Text = "Notes"

        $form1.Controls.Add($label7)

        $label6.DataBindings.DefaultDataSourceUpdateMode = 0

        $label6.Location = "554,43"
        $label6.Name = "label6"
        $label6.Size = "100,14"
        $label6.TabIndex = 16
        $label6.Text = "Link"

        $form1.Controls.Add($label6)

        $label5.DataBindings.DefaultDataSourceUpdateMode = 0

        $label5.Location = "454,43"
        $label5.Name = "label5"
        $label5.Size = "93,18"
        $label5.TabIndex = 13
        $label5.Text = "Last Review Date"

        $form1.Controls.Add($label5)

        $label4.DataBindings.DefaultDataSourceUpdateMode = 0

        $label4.Location = "353,43"
        $label4.Name = "label4"
        $label4.Size = "94,15"
        $label4.TabIndex = 12
        $label4.Text = "AppliesTo"

        $form1.Controls.Add($label4)

        $Progressbar.DataBindings.DefaultDataSourceUpdateMode = 0
        $Progressbar.Location = "13,437"
        $Progressbar.Name = "Progressbar"
        $Progressbar.Size = "828,36"
        $Progressbar.Style = 2
        $Progressbar.TabIndex = 11
        $Progressbar.Anchor = 14

        $form1.Controls.Add($Progressbar)
        $Progressbar.Hide()

        $label3.DataBindings.DefaultDataSourceUpdateMode = 0

        $label3.Location = "253,43"
        $label3.Name = "label3"
        $label3.Size = "94,18"
        $label3.TabIndex = 9
        $label3.Text = "Hotfix available"

        $form1.Controls.Add($label3)

        $label2.DataBindings.DefaultDataSourceUpdateMode = 0

        $label2.Location = "153,44"
        $label2.Name = "label2"
        $label2.Size = "94,18"
        $label2.TabIndex = 8
        $label2.Text = "Short Text"

        $form1.Controls.Add($label2)

        $label1.DataBindings.DefaultDataSourceUpdateMode = 0
        $label1.Location = "53,44"
        $label1.Name = "label1"
        $label1.RightToLeft = 0
        $label1.Size = "94,18"
        $label1.TabIndex = 7
        $label1.Text = "KB ID"
        $label1.add_Click($handler_label1_Click)

        $form1.Controls.Add($label1)

        ####DATA GRID COLUMNS######

        $dataGrid.Anchor = 15
        $KBIDColumn = New-Object System.Windows.Forms.DataGridViewTextBoxColumn
        $KBIDColumn.HeaderText = "KB ID"
        $KBIDColumn.Name = "KBID"
        $KBIDColumn.ReadOnly = $True
        $KBIDColumn.Width = 100

        $dataGrid.Columns.Add($KBIDColumn)|Out-Null

        $ShortTextColumn = New-Object System.Windows.Forms.DataGridViewTextBoxColumn
        $ShortTextColumn.HeaderText = "Short Text"
        $ShortTextColumn.Name = "ShortText"
        $ShortTextColumn.ReadOnly = $True
        $ShortTextColumn.Width = 100

        $dataGrid.Columns.Add($ShortTextColumn)|Out-Null

        $DownloadColumn = New-Object System.Windows.Forms.DataGridViewTextBoxColumn
        $DownloadColumn.HeaderText = "Hotfix available"
        $DownloadColumn.Name = "Download"
        $DownloadColumn.ReadOnly = $True
        $DownloadColumn.Width = 100

        $dataGrid.Columns.Add($DownloadColumn)|Out-Null

        $AppliesToColumn = New-Object System.Windows.Forms.DataGridViewTextBoxColumn
        $AppliesToColumn.HeaderText = "Applies to"
        $AppliesToColumn.Name = "AppliesTo"
        $AppliesToColumn.ReadOnly = $True
        $AppliesToColumn.Width = 100

        $dataGrid.Columns.Add($AppliesToColumn)|Out-Null

        $DateColumn = New-Object System.Windows.Forms.DataGridViewTextBoxColumn
        $DateColumn.HeaderText = "Last Review date"
        $DateColumn.Name = "LastReviewed"
        $DateColumn.ReadOnly = $True
        $DateColumn.Width = 100

        $dataGrid.Columns.Add($DateColumn)|Out-Null

        $LinkColumn = New-Object System.Windows.Forms.DataGridViewTextBoxColumn
        $LinkColumn.HeaderText = "Link"
        $LinkColumn.Name = "Link"
        $LinkColumn.ReadOnly = $True
        $LinkColumn.Width = 100

        $dataGrid.Columns.Add($LinkColumn)|Out-Null

        $NotesColumn = New-Object System.Windows.Forms.DataGridViewTextBoxColumn
        $NotesColumn.HeaderText = "Notes"
        $NotesColumn.Name = "Notes"
        $NotesColumn.ReadOnly = $False
        $NotesColumn.Width = 100

        $dataGrid.Columns.Add($NotesColumn)|Out-Null

        $dataGrid.DataBindings.DefaultDataSourceUpdateMode = 0
        $dataGrid.Location = "12,91"
        $dataGrid.Name = "dataGrid"
        $dataGrid.Size = "828,382"
        $dataGrid.TabIndex = 0
        $dataGrid.add_CellContentClick($handler_dataGrid_CellContentClick)

        $form1.Controls.Add($dataGrid)

        #endregion Generated Form Code

        #Save the initial state of the form
        $InitialFormWindowState = $form1.WindowState
        #Init the OnLoad event to correct the initial state of the form
        $form1.add_Load($OnLoadForm_StateCorrection)

        ### SAVE SEARCH FORM SETTINGS
        $saveForm.ClientSize = "246,196"
        $saveForm.DataBindings.DefaultDataSourceUpdateMode = 0
        $saveForm.Name = "saveForm"
        $saveForm.Text = "Save current search"
        $form1.add_Load($saveloadOnLoad)

        $saveBox.Anchor = 14
        $saveBox.DataBindings.DefaultDataSourceUpdateMode = 0
        $saveBox.Location = "1,133"
        $saveBox.Name = "saveBox"
        $saveBox.Size = "245,20"
        $saveBox.TabIndex = 2

        $saveForm.Controls.Add($saveBox)

        $SaveButton.Anchor = 14

        $SaveButton.DataBindings.DefaultDataSourceUpdateMode = 0

        $SaveButton.Location = "1,159"
        $SaveButton.Name = "SaveButton"
        $SaveButton.Size = "245,38"
        $SaveButton.TabIndex = 1
        $SaveButton.Text = "Save"
        $SaveButton.UseVisualStyleBackColor = $True
        $SaveButton.add_Click($SaveButton_OnClick)

        $saveForm.Controls.Add($SaveButton)

        $listView.Anchor = 15
        $listView.DataBindings.DefaultDataSourceUpdateMode = 0
        $listView.Location = "1,1"
        $listView.Name = "listView"
        $listView.Size = "245,121"
        $listView.TabIndex = 0
        $listView.add_MouseClick($listView_OnSelected)
        #$listView.add_KeyPress($listView_OnDelete)
        $listView.View = 3

        ### LOAD SEARCH FORM SETTINGS
        $loadForm.ClientSize = "246,196"
        $loadForm.DataBindings.DefaultDataSourceUpdateMode = 0
        $loadForm.Name = "loadForm"
        $loadForm.Text = "Load current search"
        $form1.add_Load($saveloadOnLoad)

        $loadBox.Anchor = 14
        $loadBox.DataBindings.DefaultDataSourceUpdateMode = 0
        $loadBox.Location = "1,133"
        $loadBox.Name = "loadBox"
        $loadBox.Size = "245,20"
        $loadBox.TabIndex = 2

        $loadForm.Controls.Add($loadBox)

        $loadButton.Anchor = 14

        $loadButton.DataBindings.DefaultDataSourceUpdateMode = 0

        $loadButton.Location = "1,159"
        $loadButton.Name = "loadButton"
        $loadButton.Size = "245,38"
        $loadButton.TabIndex = 1
        $loadButton.Text = "load"
        $loadButton.UseVisualStyleBackColor = $True
        $loadButton.add_Click($loadButton_OnClick)

        $loadForm.Controls.Add($listView)
        $loadForm.Controls.Add($loadButton)

        #Show the Form
        If(!(Test-Path $savePath)){.$editClear_Click}
        $form1.ShowDialog()| Out-Null
    }

    Function Process-SQLCmd {
    Param(
        [Parameter(Mandatory=$true)]
        [String]$Command,
        [Parameter(Mandatory=$false)]
        [String]$ConnectionString = 'Server=LocalHost\SQL;Database=ClientMaintenance;Trusted_Connection=True;'
    )
        $connection = New-Object System.Data.SqlClient.SqlConnection
        $connection.ConnectionString = $ConnectionString
        $connection.Open()
        $cmd = New-Object System.Data.SQLClient.SQLCommand
        $cmd.Connection = $connection
        $cmd.CommandText = $Command
        Try{$cmd.ExecuteNonQuery()}
        Catch{
            If(!($_.Exception -match 'Violation of PRIMARY KEY constraint')){
                $_.Exception | Out-file "$Mypath\error.log" -append
                $command | Out-file "$Mypath\error.log" -append
            }
        }
        $connection.Close()
    }

    Function Get-SQLQuery{
    Param(
        [Parameter(Mandatory=$true)]
        [String]$SQLQuery,
        [Parameter(Mandatory=$false)]
        [String]$ConnectionString = 'Server=LocalHost\SQL;Database=ClientMaintenance;Trusted_Connection=True;'
    )
        $connection = New-Object System.Data.SqlClient.SqlConnection
        $connection.ConnectionString = "$ConnectionString"
        $connection.Open()
        $Command = New-Object System.Data.SQLClient.SQLCommand
        $Command.CommandTimeout = 300
        $Command.Connection = $Connection
        $Command.CommandText = $SQLQuery
        Try{
            $Reader = $Command.ExecuteReader()
            $Counter = $Reader.FieldCount

            $DataTable = New-Object system.Data.DataTable
            for($i = 0; $i -lt $counter; $i++){
                $Column = New-Object system.Data.DataColumn $Reader.GetName($i),([string])
                $DataTable.Columns.Add($Column)
            }

            while ($Reader.Read()) {
                $strData = @()
                for ($i = 0; $i -lt $Counter; $i++) {
                    $strData += [String]$Reader.GetValue($i)
                }
                $DataTable.Rows.Add($strData) | out-null
            }
            $Reader.Close()
            $Data = $Datatable
        }
        Catch{
            Write-Error $_
            $Data  = $_.Exception
        }
        Finally{
            $Connection.Close()
        }
        Return $Data
    }
}
Process{

    Call-Form
}
End{}

Index all microsoft hotfixes

Vikingur Saemundsson — Thu, 27 Mar 2014 16:12:07 GMT

Microsoft has a crappy hotfix index mechanism. I want to change this, and I’ve done this by indexing all support.microsoft articles myself.

To do this you need a SQL server with the following table configuration

Then you run the indexer script. It goes through all hotfixes inefficiently but gets the job done.
All support.microsoft.com/kb pages are indexed. From 1 to 4000000

Result in MSSQL looks something like this:

Due to web formatting the script can’t be displayed here. Instead I’ve linked it below as a .txt file
Script

Of course, there is a hotfix browser that is used to search and view these but it’s not done yet.

Project: 3D Printer from scratch. Part 3 – Electronics, issues and blowing fuses

Vikingur Saemundsson — Tue, 04 Mar 2014 15:19:04 GMT

The last parts were delivered from ebay on the 3rd of march. This took a bit longer than usual as I managed to order during the chinese new year.

With all the parts at hand i decided to start building, while the paint on the frame dries I started working on the electronics.

I converted a old Corsair cx430 to work with the printer. At 12v and 430W the supply can output about 35 amps which is more than enough.
Here is a picture of the Mega 2560+RAMPS 1.4 with 5 stepper drivers mounted, 5 motors connected and the hotend connected.

The firmware I’m using is Marlin. Marlin is a deviation on Sprinter and has LCD support amongst other improvements.

Image of the motors, both Z axises are running.
From left to right:
X axis, Y axis, 2x Z axis, Extruder motor.

When connecting the LCD I noticed something was off, the display shows garbage and nothing can be read from it.

The almighty google suggest multiple possible errors.
First thing to troubleshoot is to see if there is any noticable soldering junk creating crosstalk, I checked both the LCD PCB and Mega2560+RAMPS PCB but I could not find any. I then proceeded to checking the Marlin code to see if I had made any configuration errors.
Unfortunately I had no luck there either.
As a LCD is not required I decided to move on. When the printer is up and running I will probably deal with the LCD errors.

Then I went ahead and configured the endstops. This proved an issue. I’m using 4 pin Mech Endstop v1.2. I had a hard time figuring out which pin did what and after more google I found out more people had made the mistake to wire them wrong and burn the arduino board.
My approach was to connect a LED to the endstop and a tiny bit of voltage from the PSU.
Unfortunately my calculations were off and I managed to burn the fuse on the PSU! 🙁
Here is an image of the PSU, next to the big brown cable is the burned fuse.

Soldering off the power cords and fuse and from the PSU was easy, however with the PSU built to be compact it was not easy to solder a new 3A fuse.
Here we can see the PSU out of the case with the old fuse on the side.

With the endstop issues solved and PSU works great the main job left is to assemble the printer.
More updates to come!

Ps. More images

Project: 3D printer from scratch. Part 2 – Printed parts delivery

Vikingur Saemundsson — Tue, 04 Feb 2014 17:19:21 GMT

Update!

I got a box yesterday with some mysterious contents.

Opening it revealed the table of contents, delivery took exactly one week.

I’m very pleased, this is the exact ebay item i bought

Since images can tell the story better than I can this post will be mostly pictures.

All included parts scattered on the floor, cat was not included in the box.
For those wondering, these parts were ofcourse themselves printed. Gears are made using PLA filament and the rest are printed with ABS filament.

Closeup of the gear teeth

Usb flash drive for scale

Project: 3D printer from scratch. Part 1 – The Shoppingcart.

Vikingur Saemundsson — Wed, 29 Jan 2014 09:22:56 GMT

I’ve always wanted a 3D printer, but the pricetag has been so high that I’ve gotten discouraged in the past.

However with the increasing community support of open sourced 3D printers the accessibility and price has dropped significantly if you’re willing to do some manual work.
As this is not an easy task to build a 3D printer, and that it will most likely mostly stand idle I thought it would be good to have a partner in crime. Knowing my brother also wants a 3D printer I approached him and we decided to build one together.

After a period of research I decided to build the RepRap Prusa i3.

The RepRap project (Link) is an open source 3D printer project founded by Dr. Adrian Bowyer. The build area is about 20x20x20 cm or 8x8x8 inches. This enables about 8000cm3 or 8 litre build.

The filament is about 40 USD/1kg which allows for a ton of prints.

The finished product should look something like this, but with an LCD display and SD card slot to enable standalone printing.

Prusa i3

Before we can begin building we need the parts. With budget in mind I’ve decided to shop the bulk of hardware from Ebay.

Here is the shopping list:

1x Prusa i3 Printed parts (boxed variant)
1x Greg’s JHead Extruder (cold end)
1x M8 hobbed bolt (to pull the filament)
1x J-Head Pre assembled Hotend – 0.3mm nozzle – 1.75mm filament (includes thermistor and resistor)
1x HotEnd Aluminum mount plate for J-Head
1x HeatBed mk2
1x Aluminum Bed mount plate
1x 10k ohm thermistor
1x red 3mm LED
1x Borosilicate glass
5x Nema 17 stepper motor (1.8° stepping angle)
10x LM8UU linear ball bearing
2x 5x5mm coupling (D20L25)
2x GT2 5mm pulley
2m GT2 timing belt
1x LCD 2004 controller
1x Arduino Mega 2560
1x RAMPS 1.4 shield
5x A4988 stepper driver + heatsinks
3x Mechanical endstop switches
1x 624 ball bearing
4x 608 ball bearing

I also bought various cables, connectors and metal clamps, 40mm fans, but these do not need to be defined.

Cost: 420 USD included shipping. This comes out at around 2700 sek.

Next we need to buy material for the frame which I will aquire from the local hardware store.

We need:

Wood/chipboard to build the frame.
Centerless smooth metal rods
Threaded metal rods
A ton of nuts
Power supply (Any old ATX PSU should suffice)
Black paint for the frame

For build instructions there is a great unity 3d model build instruction to be found.

http://www.carlos-sanchez.com/Prusa3/

To be continued…

Solve sudoku – WIP!

Vikingur Saemundsson — Fri, 13 Dec 2013 18:04:59 GMT

[CmdletBinding()]
Param()
Process{
    # Initial process. Clear all grids with hints.

    $Hash1 = 1 # Set Datahash 1 and 2 to different values.
    $Hash2 = 0
    While($Hash1 -notmatch $Hash2){
        $Hash1 = (1..9 | ForEach-Object{($Data | Where-Object{$_."ID"}).$_}).count
        Process-Sudoku
        $Hash2 = (1..9 | ForEach-Object{($Data | Where-Object{$_."ID"}).$_}).count
    }
}
Begin{
    #
    $MyPath = Split-Path $MyInvocation.MyCommand.path -Parent

    $Data = Import-Csv -Path "$MyPath\sudoku.txt" -Delimiter " "

    For($i = 1;$i -le 9;$i++){
        $currentRow = ($Data | Where-Object{$_."ID" -eq $i})
        For($n = 1;$n -le 9;$n++){
            $cell = [int32]($currentRow.$n)
            If($cell -eq 0){
                $currentRow.$n = (1..9)
            }
            Else{
                $currentRow.$n = [array]$cell
            }
        }
    }
    Function Process-Sudoku{

        # Process Horizontal
        For($i = 1;$i -le 9;$i++){
            If($Hash1 -le 162){} ## DEEBUUUGG
            $currentRow = $data[($i-1)]
            $exists = 1..9 | Foreach-Object{If(($currentRow.$_).count -eq 1){$currentRow.$_}}
            $NotSolved = 1..9 | Where-Object{($currentRow.$_).count -gt 1}
            $NotSolved | ForEach-Object{
                [Array]$NewArray = $currentRow.$_ | ForEach-Object{if($exists -match $_){}Else{$_}}
                $currentRow.$_ = $NewArray
            }
        }

        # Process Verical
        For($i = 1;$i -le 9;$i++){
            $CurrentLine = @{}
            For($n = 1;$n -le 9;$n++){
                $currentRow = $Data[($n-1)]
                $CurrentLine += @{$n = $currentRow.$i}
            }
            $Exists = 1..9 | Foreach-Object{If(($CurrentLine.$_).count -eq 1){$currentLine.$_}}
            $NotSolved = 1..9 | Where-Object{($CurrentLine.$_).count -gt 1}
            $NotSolved | ForEach-Object{
                For($n = 1;$n -le 9;$n++){
                    $currentRow = $Data[($_-1)]
                    [Array]$NewArray = $currentRow.$i | ForEach-Object{if($exists -match $_){}Else{$_}}
                    $currentRow.$i = $NewArray
                }
            }
        }
        # Process grid
        For($i = 1;$i -le 9;$i++){

            If($i -le 3){$Mod = 0}
            ElseIf($i -gt 6){$Mod = 6}
            Else{$Mod = 3}

            $CurrentGrid = @{}
            $c = 1
            For($n = 1;$n -le 3;$n++){
                $currentRow = $Data[($n+$mod-1)]
                For($x = 1;$x -le 3;$x++){

                    $CurrentGrid += @{$c = $currentRow.$x}
                    $c++
                }
            }
            $exists = 1..9 | Foreach-Object{If(($CurrentGrid.$_).count -eq 1){$CurrentGrid.$_}}
            $NotSolved = 1..9 | Where-Object{($CurrentGrid.$_).count -gt 1}
            $NotSolved | ForEach-Object{
                If($_ -le 3){$row = 1}
                ElseIf($_ -ge 7){$row = 3}
                Else{$row = 2}
                $currentRow = $Data[($row+$mod-1)]
                [Array]$NewArray = $currentRow.$_ | ForEach-Object{if($exists -match $_){}Else{$_}}
                $currentRow.$_ = $NewArray
            }
        }
    } # End process function
}
End{
    $Data | Format-Table -AutoSize
}

Input

ID 1 2 3 4 5 6 7 8 9
1 9 0 0 0 0 0 1 2 0
2 0 0 2 3 0 0 0 0 0
3 4 0 0 0 0 5 9 6 0
4 0 8 0 2 0 0 6 0 0
5 0 0 0 0 5 0 0 0 0
6 0 0 1 0 0 9 0 3 0
7 0 7 6 9 0 0 0 0 1
8 0 0 0 0 0 1 7 0 0
9 0 9 8 0 0 0 0 0 4

Find primes, the proper way

Vikingur Saemundsson — Tue, 10 Dec 2013 09:41:41 GMT

I noticed that the earlier way to find primes is really fast for small numbers, but it is really really slow for number >5000

To shorten this, and provide a proper track of what primes are found as well as looping endlessly I’ve created this thing below.

Place it as prime.ps1 in a folder with read/write access.

The code below writes lines in a file called primes.log and keeps a progress of the last processed number (stored in progress.log).
This allows the script to resume the last location where it was terminated.
It also uses a better algorithm to determine if the given number is a prime or not, resulting in a steady 30 seconds to calculate 0-5000

Now the algorithm is not perfect (could check common divisible numbers first and some pattern matching) but it produces a steady stream of numbers in a fairly quick fashion.

[CmdletBinding()]
Param()
Process{

    If(!([int]$currentNumber = Get-Content $progressfile -ErrorAction Ignore)){[int]$currentNumber = $lastPrime+1}
    Write-Verbose "Starting at $currentNumber"

    "$(Get-Date -UFormat "%Y-%m-%d %r")| Starting at $currentNumber" | Out-File $logfile -Append

    While($Loop){

        Write-Verbose "Processing $currentNumber"
        $prime = Test-Prime $currentNumber

        If($prime){
            $currentNumber | Out-File $file -Append
            "$(Get-Date -UFormat "%Y-%m-%d %r")| Found prime, $currentNumber" | Out-File $logfile -Append
            Write-host "Success, prime found! $currentNumber" -ForegroundColor Green
        }

        $currentNumber++
        $currentNumber | Out-File $progressfile
    }
}
Begin{

    $MyPath = Split-Path $MyInvocation.MyCommand.path -Parent

    $Loop = $true
    $logfile = "$MyPath\log.log"
    $file = "$MyPath\primes.log"
    $progressfile = "$MyPath\progress.log"
    Try{
        $primes = Get-Content $file -ErrorAction Ignore
        [int]$lastPrime = $primes[-1]
        Write-Verbose "File found, last prime is $lastprime"
    }
    Catch{
        Write-Verbose "File not found. Creating file and starting from 3"
        $lastPrime = 3
        New-Item -Path $file -ItemType file -Force
        "2","3" | ForEach-Object{$_ | Out-File $file -Append}
    }

    Function Test-Prime{
        Param($number)
        If($number -match "0$|2$|4$|5$|6$|8$"){
            return $false
        }
        [int]$DivNumber = $number/2
        #$numbers = 2..$DivNumber
        $i = 2
        While($i -le $DivNumber){
            If($number%$i -eq 0){
                return $false
            }
            $i++
        }
        return $true
    }
}

Quick and dirty way to find primes

Vikingur Saemundsson — Fri, 06 Dec 2013 14:44:43 GMT

2..5000 | ForEach-Object{
    $current = $_
    $f = @()
    1..$Current | ForEach-Object{
        $result = $current/$_
        If($result.GetType().Name -eq "Int32"){
            $f += $result
        }
    }
    if($f.count -le 2){
        $current
    }
}

Fibonacci sequence

Vikingur Saemundsson — Fri, 06 Dec 2013 12:50:08 GMT

$1 = 0
$2 = 1
1..100 | ForEach-Object{
    if($_%2 -eq 1){
        $1 = $1+$2
        $1
    }
    Else{
        $2 = $1+$2
        $2
    }
}

Alcohol calculator

Vikingur Saemundsson — Thu, 14 Nov 2013 16:29:00 GMT

Calculate the amount of pure alchohol in litre you consume per year. All forms needs to be filled in.

[void][reflection.assembly]::LoadWithPartialName("System.Windows.Forms")
$Form = New-Object 'System.Windows.Forms.Form'

$Calculate = {

[double]$Result = 0
[double]$beer = $BeerTextBox.Text
[double]$wwine = $WhiteWineTextBox.Text
[double]$rwine = $RedWineTextBox.Text
[double]$spirit = $SpiritTextBox.Text
$result = ($beer*0.5*0.05)+($wwine*0.7*0.08)+($rwine*0.7*0.13)+($spirit*0.7*0.4)
$ResultBox.Text = $Result
}

$Form.Size = "300,300"

$BeerLabel = New-Object 'System.Windows.Forms.Label'
$BeerLabel.Text = "Beer"
$BeerLabel.Location = "10,10"
$BeerLabel.Size = "70,15"
$Form.Controls.add($BeerLabel)

$BeerTextBox = New-Object 'System.Windows.Forms.TextBox'
$BeerTextBox.Location = "80,10"
$BeerTextBox.Text = "~ Antal 50cl 5%"
$Form.Controls.add($BeerTextBox)

$WhiteWineLabel = New-Object 'System.Windows.Forms.Label'
$WhiteWineLabel.Text = "White Wine"
$WhiteWineLabel.Location = "10,25"
$WhiteWineLabel.Size = "70,15"
$Form.Controls.add($WhiteWineLabel)

$WhiteWineTextBox = New-Object 'System.Windows.Forms.TextBox'
$WhiteWineTextBox.Location = "80,25"
$WhiteWineTextBox.Text = "~ Antal 70cl 8%"
$Form.Controls.add($WhiteWineTextBox)

$RedWineLabel = New-Object 'System.Windows.Forms.Label'
$RedWineLabel.Text = "Red Wine"
$RedWineLabel.Location = "10,40"
$RedWineLabel.Size = "70,15"
$Form.Controls.add($RedWineLabel)

$RedWineTextBox = New-Object 'System.Windows.Forms.TextBox'
$RedWineTextBox.Location = "80,40"
$RedWineTextBox.Text = "~ Antal 70cl 13%"
$Form.Controls.add($RedWineTextBox)

$SpiritLabel = New-Object 'System.Windows.Forms.Label'
$SpiritLabel.Text = "Spirit"
$SpiritLabel.Location = "10,55"
$SpiritLabel.Size = "70,15"
$Form.Controls.add($SpiritLabel)

$SpiritTextBox = New-Object 'System.Windows.Forms.TextBox'
$SpiritTextBox.Location = "80,55"
$SpiritTextBox.Text = "~ Antal 70cl 40%"
$Form.Controls.add($SpiritTextBox)

$CalcButton = New-Object 'System.Windows.Forms.Button'
$CalcButton.Location = "10,90"
$CalcButton.Size = "100,40"
$CalcButton.Text = "Calculate"
$CalcButton.add_Click($calculate)
$Form.Controls.add($CalcButton)

$ResultBox = New-Object 'System.Windows.Forms.Label'
$ResultBox.Location = "10,155"
$ResultBox.Size = "100,25"
$ResultBox.Text = "inget ännu"
$Form.Controls.add($ResultBox)

$AverageLabel = New-Object 'System.Windows.Forms.Label'
$AverageLabel.Location = "10,130"
$AverageLabel.Size = "150,25"
$AverageLabel.Text = "Medel i sverige är 10,3"
$Form.Controls.add($AverageLabel)

$Form.showdialog()

Get startpage

Vikingur Saemundsson — Thu, 14 Nov 2013 16:12:45 GMT

Invent startpage set in IE for XP and Windows7 clients. Needs a list of computers and collects the startpage in a CSV file.

[cmdletbinding()]
Param(
    $Computers,
    $output,
    $Progress,
    [Switch]$Loop
)

$ErrorActionPreference = "SilentlyContinue"

If(Test-Path -Path $Computers -PathType Leaf){
    [Array]$Script:computers = Get-Content $Computers
}

$ComputerCount = $Computers.Count
$Script:Database = @{}
Function Get-Startpage{
    Param(
        $output,
        $Progress
    )
    if(Test-Path -Path $Progress -PathType Leaf){
        [Array]$ProgressContent = Get-Content $Progress
    }
    Else{
        Try{"DATE,Computer,Status" | Out-File $Progress
            [Array]$ProgressContent = Get-Content $Progress
        }
        Catch{Write-Error $_;Break}
    }
    If(!(Test-Path -Path $output -PathType Leaf)){
        Try{'SID,Computername,USER,Start Page' | Out-File $output}
        Catch{Write-Error $_;Break}
    }
    Foreach($Client in $Script:Computers){

        Try{
            [Array]$status = $ProgressContent | Where-Object{ $_ -match "$Client"}
            $Status = $status[-1].Split(",")[-1]
        }
        Catch{$status -eq $null}

        Write-Host $Client

        $Ping = new-object Net.NetworkInformation.Ping

        If(($Ping.Send($Client).Status -eq "Success") -and (($status -eq "Failed") -or ($status -eq $null))){

            $OperatingSystem  = (([adsisearcher]"cn=$client").FindOne()).Properties.operatingsystem

            Switch($OperatingSystem){
                "Windows 7 Enterprise"{
                    Try{$Userprofile = Get-WmiObject -ComputerName $client win32_userprofile}
                    Catch{
                        Write-Host $Client
                        Write-Error $_
        				$Userprofile = $null
        			}
                    If($Userprofile){
                        $Userprofile | Where-Object {($_.localpath -match 'c*users') -and ($_.Loaded)} | Select SID | ForEach-Object{
                            $SID = $_.SID
                            $objSID = New-Object System.Security.Principal.SecurityIdentifier($SID)
                            $objUser = $objSID.Translate([System.Security.Principal.NTAccount])
                            $Username = $objUser.Value.Split("\")[1]
                            $table = @{"USER" = $Username;"SID" = $SID; "Start Page" = "n/a"; "Computername" = "$Client"}
                            $currentUser = New-Object psobject -property $table
                            $Script:Database.$client += @{"$username" = $currentUser}
                        }
                    }
                }

                "Windows XP Professional"{
                    Try{$Userprofile = (Get-WmiObject -computername $Client -Query "Select UserName from Win32_ComputerSystem").UserName}
                    Catch{
                        Write-Host $Client
                        Write-Error $_
        			    $Userprofile = $null
        			}
                    If($Userprofile){
                        $Domain = $Userprofile.Split("\")[0]
                        $Username = $Userprofile.Split("\")[1]
                        $objUser = New-Object System.Security.Principal.NTAccount($Domain, $Username)
                        $SID = ($objUser.Translate([System.Security.Principal.SecurityIdentifier])).Value

                        $table = @{"USER" = $Username;"SID" = $SID; "Start Page" = "n/a"; "Computername" = "$Client"}
                        $currentUser = New-Object psobject -property $table
                        $Script:Database.$client += @{"$username" = $currentUser}
                    }

                }

                "Default"{Break}

            }
            $Userdata = ($Script:Database.$Client | ForEach-Object {$_.Values})
            Foreach($User in $Userdata){
                Try{
                    $SID = $User.SID
                    $objSID = New-Object System.Security.Principal.SecurityIdentifier($SID)
                    $objUser = $objSID.Translate( [System.Security.Principal.NTAccount])  
                    $Username = $objUser.Value.Split("\")[1]
                    $reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('USERS', $Client)
                    $regkey = $reg.OpenSubkey("$SID\\Software\\Microsoft\\Internet Explorer\\Main")
                    $StartPage = $regkey.GetValue("Start Page")

                    If($StartPage.GetType().Name -ne "String"){Throw "Value not String"}

                    $Script:Database.$Client.$Username.'Start Page' = $StartPage

                }Catch{
                    Write-Host $Client
                    Write-Error $_
                    $Script:Database.$Client.$Username.'Start Page' = "Unknown"
                }
            }
			Try{
				$Script:Database | ForEach-Object{$_.$Client.Values} | ForEach-Object{
					$SID = $_.SID
					$Computername = $_.Computername
					$User = $_.USER
					$StartPage = $_.'Start Page'
					"$SID,$Computername,$User,$StartPage"
				} | Out-File $output -Append
			}
			Catch{Write-Host $Client;Write-Error $_;Break}

			Try{
				$TimeStamp = Get-Date -Format "yyyyMMdd:HH.mm.ss"
				"$TimeStamp,$Client,Successful" | Out-File $Progress -Append
				$Script:Database.Status += @{"$Client" = $True}
			}
			Catch{Write-Host $Client;Write-Error $_;Break}
        }
        ElseIf(($Status -eq "Successful") -or ($Status -eq "Skipped")){
            #Do nothing. Already Successful.
            $Script:Database.Status += @{"$Client" = $True}
        }
        Else{
            Try{
                $Script:Database.Status += @{"$Client" = $false}
                $TimeStamp = Get-Date -Format "yyyyMMdd:HH.mm.ss"
                "$TimeStamp,$Client,Failed" | Out-File $Progress -Append
            }
            Catch{Write-Host $Client;Write-Error $_}
        }

        $Script:Percentage = 100/$ComputerCount
        $Script:Completed = ($Script:Database.Status.Values | Where-Object{$_ -Match $true}).Count
        If(!$Script:Completed){$Script:Completed = 0}
        $Script:currentpercentage = $Script:Percentage*$Script:Completed

        write-progress -Activity "Collecting Startpage information." -ID 1 -Status "Processing $Client. Completed count: $Script:Completed/$Script:ComputerCount" -PercentComplete $Script:currentpercentage
    }
}

[Void](Get-Startpage -output $Output -Progress $Progress)
If($Loop){
    While(($Database.status.Values  | Where-Object{$_ -Match $false}) -eq $false){
        [Void](Get-Startpage -output $Output -Progress $Progress)
    }
}

Access CSC

Vikingur Saemundsson — Thu, 14 Nov 2013 15:58:14 GMT

this is used to quickly gain access to a users client side cache without ruining sync.
Used for backup issues and other stuff.

$comp = 'computer1' # Replace with computer
$FQDN = 'your.domain.com' # Replace with FQDN
$UserID = 'user1' # Replace with the useraccount to gain access

Function ConvertTo‐Base64($string) {
  $bytes  = [System.Text.Encoding]::Unicode.GetBytes($string);
  $encoded = [System.Convert]::ToBase64String($bytes);
  Return $encoded;
}

$cmd = @'
if (schtasks.exe /Query | select-string "RUNCMD1") {
    schtasks.exe /delete /tn "RUNCMD1" /F
}

mkdir c:\temp\ -ea 0

"running"|out-file c:\temp\csctemp
schtasks.exe /ru "SYSTEM" /Create /TN "RUNCMD1" /TR "cmd /C icacls c:\windows\csc\ /c /grant {FQDN}\{UserID}`:`(OI`)`(CI`)F /T > c:\temp\cmd1.log && del c:\temp\csctemp" /sc "once" /ST "23:00"
schtasks.exe /run /tn "RUNCMD1"
'@.Replace('{FQDN}',$FQDN).Replace('{UserID}',$UserID)

$EncodedCmd = ConvertTo‐Base64($cmd)
$EncodedArgs = 'c:\windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy ByPass -EncodedCommand "' + $EncodedCmd + '"'
$result = Invoke-WmiMethod -ComputerName $comp -class win32_process -name create -ea 0 -ArgumentList $EncodedArgs

Add users as local admin on select computers

Vikingur Saemundsson — Thu, 14 Nov 2013 15:40:35 GMT

This is used to add users as local admin on a select group of clients.
Needs a input file specified or default to input.txt in same folder.
It converts Administrator SID to friendlyname to account for things such as foreign characters.

It uses WMI to invoke a client side script to be run under admin credentials in order to bypass PSremoting policies.

Content in input should be formatted as below.

Computername,Username
computer1,User1
computer2,User1
computer2,User2

This is used to add users as local admin on a select group of clients.
Needs a input file specified or default to input.txt in same folder.
It converts Administrator SID to friendlyname to account for things such as foreign characters.

It uses WMI to invoke a client side script to be run under admin credentials in order to bypass PSremoting policies.

Content in input should be formatted as below.

Computername,Username
computer1,User1
computer2,User1
computer2,User2

Script below:

[Cmdletbinding()]
Param(
    [String]$InputFile=".\input.txt"
)
$MyPath = Split-Path $MyInvocation.MyCommand.path -Parent
$Logpath = "$MyPath\Status.log"
$Ping = new-object Net.NetworkInformation.Ping
If(!(Test-path -Path $InputFile -PathType Leaf)){Throw{"Could not find $InputFile"}}
$Data = Import-Csv $InputFile -Delimiter ','

$Logpath = "$MyPath\Status.log"
If(!(Test-Path -Path $Logpath -PathType Leaf)){
    New-Item -Path $Logpath -ItemType file
    "Computername,Username,Status" | Out-File $Logpath
}
$LogData = Import-Csv $Logpath -Delimiter ','

Function ConvertTo-Base64($String){
    $Bytes = [System.Text.Encoding]::Unicode.GetBytes($String)
    $Encoded = [System.Convert]::ToBase64String($Bytes)
    Return $Encoded
}
$cmdtemplate = @'
$SID = "S-1-5-32-544" # built-in administrator group sid
# Find Administrator group based on SID and gets the friendlyname of account
$admins = New-object System.Security.Principal.SecurityIdentifier($SID)
[string]$adminNTaccount = $admins.Translate([System.Security.Principal.NTAccount]).Value.Split('\')[1]

# Gets a list of members and collects friendlyname of each member
$computer = [ADSI]('WinNT://.,computer')
$Group = $computer.psbase.children.find($adminNTaccount)
$Group.Add("WinNT://{replacewithuser},user") # Must change/replace user string here with real user account
'@

$data | Foreach-object{
    $Computer = $_.Computername
    $User = $_.Username
    $Cmd = $cmdtemplate -replace '{replacewithuser}',$User
    $EncodedCmd = ConvertTo-Base64($Cmd)
    $EncodedArgs = 'c:\windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy ByPass -EncodedCommand "' + $EncodedCmd + '"'
    Remove-Variable added -Force -ErrorAction Ignore
    $added = $LogData | Where-Object {($_.Computername -match $computer) -and ($_.Username -match $user) -and ($_.Status -match "Success")}
    $Status = ($Ping.Send($Computer)).Status
    If($added){
        Write-host "Already added $User to $Computer" -ForegroundColor Blue
    }
    ElseIf($Status -eq "Success"){
        $Result = Invoke-WmiMethod -ComputerName $Computer -class win32_process -name create -ErrorAction Ignore -ArgumentList $EncodedArgs
        Write-Verbose $Result
        If($Result.ReturnValue -eq 0){
            Write-host "Added $User to $Computer" -ForegroundColor Green
            $Returnvalue = "Success"
        }
        Else{
            Write-Host "Failed to add $User to $Computer" -ForegroundColor Red
            $Returnvalue = "Error $($result.ReturnValue)"
        }

    }
    Else{
        Write-Host "Could not contact $Computer" -ForegroundColor Red
        $Returnvalue = "Host Unreachable"
    }

    "$computer,$User,$Returnvalue" | Out-File -Append $Logpath

}
Write-host "Done!" -BackgroundColor Green -ForegroundColor Black
Write-host "Bash the keyboard to quit application!" -BackgroundColor Green -ForegroundColor Black
[void]$Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")

Custom progress bar

Vikingur Saemundsson — Tue, 25 Jun 2013 16:29:12 GMT

Not that anyone wants or needs it, but here is a custom progress bar!

It has two modes. Loop and step. And is called like below.

PS> 0..99 | ForEach-Object{"Processing, current step $_";Start-Sleep -Milliseconds 200;.\epicship.ps1 -step $_};"Installation complete!"

 .\epicship.ps1 -loop

The Loop has more functions, such as a sun shining and getting obscured by the ship (notice the reflections dissapearing as the sunrays are blocked by the ship).

Param(
    [int]$step,
    [Switch]$Loop,
    [string]$FlagMsg,
    [int]$speed = 500,
    $condition = $False
)

$ErrorActionPreference = "SilentlyContinue"

if($step -gt 100){Write-Error "Step cannot exceed 100";Break}
[int]$step = $step/100*77
if($step -le 0){$step++}
#[console]::CursorVisible = $False

Function Animatrix{
    Param(
        [switch]$Loop,
        [int]$step
    )

    if($Loop){$action = "Loop"}
    Elseif($step){$action = "Step"}

    $ship = "                                                                                                                    "
    if(!($FlagMsg)) { $FlagMsg = "LOADING.-" } else {

    $FlagMsg = "$FlagMsg-."

    if($flagmsg.length -gt 22) {
      write-error "Flag text is too long .. max 20 characters!!"
      Break
    }

    }

    # Add padding to left
    while($FlagMsg.length -lt 22) {
      $FlagMsg = " $FlagMsg"
    }

    # Add padding to right
    while($FlagMsg.length -lt 116) {
      $FlagMsg += ' '
    }  
    $ship += $FlagMsg
$ship += @'

                 |
         Ya...___|__..ab.     .   .
          Y88b##\88b##\88b   (     )
           Y88b##:88b##:88b   `.oo'
           :888##|888##|888  ( (`-'
  .-.      d88P##;88P##;88P   `.`.
 //._)    d8P-"""|"""'-Y8P      `.`.
(o(`    .-.  .-. |.-.  .-.  .-.  )oo)
 \o`---(-O-)(-O-)(-O)(-O-)(-O-)-'//
~~`.~~~~`-'~~`-'~~`-'~~`-'~~`-'~~.'~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   `----------------------------'
'@

    $arrship = $ship.Split("`n")
    $saveY = [console]::CursorTop
    $saveX = [console]::CursorLeft
    Switch($action){
        "Loop"{

            0..109 | ForEach-Object{
                $i = 0
                $arrship | ForEach-Object{
                    If($i -eq $arrship.count-2){
                        $arrship[$i] = "~" + $arrship[$i].Substring(0,$arrship[$i].Length-1)
                    }
                    else{$arrship[$i] = " " + $arrship[$i].Substring(0,$arrship[$i].Length-1)}
                    $i++
                }
                $n = 0
                $chance = 0
                $sunpos = 60,75
                $sunMultiplier = 0.28
                $arrship | ForEach-Object{
                    $nChar = 0
                    If($n -eq $arrship.Count-5){
                    [char[]]$arrship[$n] | ForEach-Object{
                        If(($nChar -ge $sunpos[0]+5) -and ($nChar -le $sunpos[1]-5)){
                            If($_ -eq " "){Write-Host $_ -BackgroundColor Yellow -NoNewline;$chance += $sunMultiplier}
                            Else{Write-Host $_ -ForegroundColor Yellow -NoNewline}
                        }
                        Elseif($nChar -lt 116){Write-Host $_ -ForegroundColor DarkGray -NoNewline}
                        Else{Write-Host $_ -ForegroundColor DarkGray}
                        $nChar++
                        }
                    }
                    ElseIf($n -eq $arrship.Count-4){
                    [char[]]$arrship[$n] | ForEach-Object{
                        If(($nChar -ge $sunpos[0]+2) -and ($nChar -le $sunpos[1]-2)){
                            If($_ -eq " "){Write-Host $_ -BackgroundColor Yellow -NoNewline;$chance += $sunMultiplier}
                            Else{Write-Host $_ -ForegroundColor Yellow -NoNewline}
                        }
                        Elseif($nChar -lt 116){Write-Host $_ -ForegroundColor DarkGray -NoNewline}
                        Else{Write-Host $_ -ForegroundColor DarkGray}
                        $nChar++
                        }
                    }
                    ElseIf($n -eq $arrship.Count-3){
                    [char[]]$arrship[$n] | ForEach-Object{
                        If(($nChar -ge $sunpos[0]) -and ($nChar -le $sunpos[1]) -and ($_ -eq " ")){Write-Host $_ -BackgroundColor Yellow -NoNewline;$chance += $sunMultiplier}
                        Elseif($nChar -lt 116){Write-Host $_ -ForegroundColor DarkGray -NoNewline}
                        Else{Write-Host $_ -ForegroundColor DarkGray}
                        $nChar++
                        }
                    }
                    ElseIf($n -eq $arrship.count-2){Write-Host $arrship[$n] -ForegroundColor Blue}
                    Elseif($n -eq $arrship.count-1){Write-Host $arrship[$n] -ForegroundColor Cyan}
                    Else{Write-host $arrship[$n] -ForegroundColor DarkGray}
                    $n++
                }

                wavegen -modulus 3 -SunXY $sunpos -chance $chance
                wavegen -modulus 10 -SunXY $sunpos -chance $chance
                wavegen -modulus 30 -SunXY $sunpos -chance $chance
                wavegen -modulus 200 -SunXY $sunpos -chance $chance
                $refchance = $chance*10
                "chance of reflection is: $refchance%"

                Start-Sleep -Milliseconds $speed

                [console]::setcursorposition($saveX,$saveY)
            }
        }
        "Step"{
            Clear-Host
            $i = 0
            $arrship | ForEach-Object{
                If($i -eq $arrship.count-2){$arrship[$i] = "~"*$step + $arrship[$i].Substring(0,$arrship[$i].Length-1*$step)}
                else{$arrship[$i] = " "*$step + $arrship[$i].Substring(0,$arrship[$i].Length-1*$step)}
                    $i++
            }
            $n = 0
            $arrship | ForEach-Object{
                If($n -eq $arrship.count-2){Write-Host $arrship[$n] -ForegroundColor Blue}
                elseif($n -eq $arrship.count-1){Write-Host $arrship[$n] -ForegroundColor Cyan}
                Else{Write-host $arrship[$n] -ForegroundColor Yellow}
                $n++
            }
            $chance = 7
            $sun = 30,45

            wavegen -modulus 3 -SunXY $sun -chance $chance
            wavegen -modulus 10 -SunXY $sun -chance $chance
            wavegen -modulus 30 -SunXY $sun -chance $chance
            wavegen -modulus 200 -SunXY $sun -chance $chance
        }
    }
}

function wavegen{
    Param(
        [int]$modulus,
        [array]$SunXY,
        [int]$chance
    )
    $test = 0
    0..115 | ForEach-Object{
        $test++
        $rand = get-random -Maximum 1000  
        $rand%$modulus
    } | ForEach-Object{

            $i = Get-random -maximum 5  
            If(($test -ge $SunXY[0]) -and ($test -le $SunXY[1]) -and ((Get-Random -Maximum 10) -lt $chance)){
                $color = "Yellow"
            }Else{
                If($i%2 -eq 0){$color = "DarkBlue"}
                else{$color = "blue"}  
            }
            if($_ -eq 1){

                write-host -foregroundcolor $color "~" -NoNewline
            }
            elseif($_ -eq 2){
                Write-Host -ForegroundColor $color "-" -NoNewline
            }
            elseif($_ -eq 3){
                Write-Host -ForegroundColor $color "_" -NoNewline
            }
            else{Write-host " " -NoNewline}  
    }
    Write-host " "
}

If($Loop){
    Animatrix
    While($condition -eq $False){
        Animatrix -Loop
    }
}
Elseif($step){
    Animatrix -step $step
    [console]::setcursorposition($saveX,$saveY)
}
Else{
    Write-Warning "You're doing it wrong!"
}

FileDialogs

Vikingur Saemundsson — Fri, 12 Apr 2013 15:18:27 GMT

Function SaveFileDialog{
    Param(
        [Parameter(Mandatory=$True)]
        $Filetype
    )
    [Void][Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
    $SaveFileDialog = New-Object System.Windows.Forms.SaveFileDialog
    $SaveFileDialog.Filter = "$Filetype files (*.$Filetype)|*.$Filetype|All files (*.*)|*.*"
    $status = $SaveFileDialog.ShowDialog()

    If($status -eq "Cancel"){$Return = $status}
    Else{$Return = $SaveFileDialog.FileName}

    $SaveFileDialog.Dispose()
    Return $Return
}

Function SelectFileDialog{
    Param(
        [Parameter(Mandatory=$True)]
        $Filetype
    )
    [Void][Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
    $OpenFileDialog = New-Object System.Windows.Forms.OpenFileDialog

    $OpenFileDialog.Filter = "$Filetype files (*.$Filetype)|*.$Filetype|All files (*.*)|*.*"

    $status = $OpenFileDialog.ShowDialog()

    If($status -eq "Cancel"){$Return = $status}
    Else{$Return = $OpenFileDialog.FileName}

    $OpenFileDialog.Dispose()
    Return $Return
}

Function SelectFolderDialog{
    [Void][Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")

    $SelectFileDialog = New-Object System.Windows.Forms.FolderBrowserDialog
    $status = $SelectFileDialog.ShowDialog()

    If($status -eq "Cancel"){$Return = $status}
    Else{$Return = $SelectFileDialog.FileName}

    $SelectFileDialog.Dispose()
    Return $Return
}

The one-liner maker!

Vikingur Saemundsson — Thu, 20 Dec 2012 16:48:26 GMT

I give you all, probably the most unused function on the planet. The “Make one-liner”!

It’s probably not even close to “Complete” but it is easy to add exceptions on where to format.

Function Main{
    $ScriptString = Get-Content [enter powershell script path here]
    Make-Oneliner $ScriptString
}

Function Make-Oneliner{
    Param([Array]$array)
    [string]$OneLiner = @()
    Foreach($Line1 in $array){

    $Line1 = $Line1.Split("#")[0]
    $Line1 = $Line1.Trim()
    Foreach($Line in $Line1){
        #Parse and add ;
            If(
                ($line.EndsWith("`{")) -or
                ($line.EndsWith("`;")) -or
                ($line.EndsWith("`(")) -or
                ($line.EndsWith("`|")) -or
                ($line.EndsWith("`]"))
            ){
                    $OneLiner += $Line
            }
            Elseif($line.EndsWith("`'")){
                if(($Line.Split("`'").Count % 1) -eq 0){
                    $Line = $Line + "`;"
                    $OneLiner += $Line
                    }
            }
            Elseif($line.EndsWith("`"")){
                if(($Line.Split("`"").Count % 1) -eq 0){
                    $Line = $Line + "`;"
                    $OneLiner += $Line
                    }
            }
            Elseif($Line.StartsWith("#")){
                # do nothing
            }
            Else{
                $Line = $Line + "`;"
                $OneLiner += $Line
            }
        }
    }
    # Cleanup inappropriate ";".
    $OneLiner = $OneLiner.Replace(';)',')').Replace(',;',',').Replace(';;',';').Replace(';;',';')

    # Cleanup inappropriate ";" on words using insensitive replace methods.
    $OneLiner = $OneLiner -ireplace '};else','}else'
    $OneLiner = $OneLiner -ireplace '};catch','}catch'
    $OneLiner = $OneLiner -ireplace '};finally','}finally'

    Return $OneLiner
}
Main

SQL queries in powershell

Vikingur Saemundsson — Tue, 06 Nov 2012 12:17:11 GMT

I was trying to query the SCCM database and sort the results with Powershell to get a full report on all the connections to a collection. To do this i needed to inject a SELECT query and retrieve an object from the database which proved to be a bit difficult. Below is how i resolved it.

To connect to a SQL you need a client, in powershell and .NET we have the System.Data.SQLClient namespace

$connection = New-Object System.Data.SqlClient.SqlConnection

Then i needed a connection string to open the database.

$connection.ConnectionString = "$ConnectionString"
$connection.Open()

Now we need to inject the command we want. Fairly simple, we create a SQLCommand and connect it to the already established connection.

$Command = New-Object System.Data.SQLClient.SQLCommand
$Command.Connection = $Connection

Then we insert our command

$Command.CommandText = $SQLQuery

What we do after is execute the command and create a counter of the columns in the result.

$Reader = $Command.ExecuteReader()
$Counter = $Reader.FieldCount

Now we create the DataTable and use the counter to populate the columns. We name them after each column in the query.

$DataTable = New-Object system.Data.DataTable
for($i = 0; $i -lt $counter; $i++){
    $Column = New-Object system.Data.DataColumn $Reader.GetName($i),([string])
    $DataTable.Columns.Add($Column)
}

While the Reader is active it processes a loop for the length of counter and ejects the results into new rows in the DataTable.
To get the correct formatting, we place everything into a string and format accordingly. Name and value.
We then use the Invoke-Expression cmdlet to execute the formatted string and add values to the rows

while ($Reader.Read()) {
    $Data = @()
    for ($i = 0; $i -lt $Counter; $i++) {
        $Data += [String]$Reader.GetValue($i)
    }
    $DataTable.Rows.Add($Data)
}

Last but not least, we close the reader and the connection to the database and output the finished table

$Reader.Close()
$Connection.Close()

Return $DataTable

And we’re done!

The finished function will now look like this:

Function Get-SQLQuery{
    Param(
        [Parameter(Mandatory=$true)]
        [String]$SQLQuery,
        [Parameter(Mandatory=$true)]
        [String]$ConnectionString
    )
    $connection = New-Object System.Data.SqlClient.SqlConnection
    $connection.ConnectionString = "$ConnectionString"
    $connection.Open()
    $Command = New-Object System.Data.SQLClient.SQLCommand
    $Command.Connection = $Connection
    $Command.CommandText = $SQLQuery
    $Reader = $Command.ExecuteReader()
    $Counter = $Reader.FieldCount

    $DataTable = New-Object system.Data.DataTable
    for($i = 0; $i -lt $counter; $i++){
        $Column = New-Object system.Data.DataColumn $Reader.GetName($i),([string])
        $DataTable.Columns.Add($Column)
    }

    while ($Reader.Read()) {
        $Data = @()
        for ($i = 0; $i -lt $Counter; $i++) {
            $Data += [String]$Reader.GetValue($i)
        }
        $DataTable.Rows.Add($Data)
    }
    $Reader.Close()
    $Connection.Close()

    Return $DataTable
}

First set your connectionstring and Select query then invoke the command like this:

Get-SQLQuery -ConnectionString $connectionstring -SQLQuery $SelectQuery

Examples of connectionstrings can be found at Connectionstrings.com
The usual string is the trusted which uses your credentials

If you are using the function a lot, concider adding it to your Powershell profile. For more information check out my previous post on WGET and profiles

Beta testing and error handling

Vikingur Saemundsson — Tue, 21 Aug 2012 11:10:33 GMT

Here is a simple snippet that you can run to output all exceptions in a script.

$ErrorActionPreference = "SilentlyContinue"

IWillProduceAnError

#----------------------------------------------------------------
# Debug function, dumps all errors in $Error variable to file
#----------------------------------------------------------------

Function Dump-Errors(){
    Param(
        [Parameter(Position=0, Mandatory = $True)]
        [String]$Logfile
    )
    $Error | Add-Content $Logfile
    $Error.Clear()
}

Dump-Errors -logfile "c:\temp\script.log"

If you look at the code, the cmdlet “IWillProduceAnError” is most likely not recognized and will produce an exception.
However, you have the $ErrorActionPreference set to SilentlyContinue so nothing will show for the user.

This is where the dump-errors function will help you catch errors you would otherwise never see.

Place the function in your code and make sure the last line to run is the function.
It will output all exceptions in the $Error variable to a file. You can then later collect the file from the users you know are beta testing and use the Try/Catch statements to correct your code. Combine this with the Powershell auto updater in silent mode and the user will never know you updated the code.

Office 2007 and .ost files.

Vikingur Saemundsson — Tue, 12 Jun 2012 14:29:28 GMT

There is a slight issue with .ost files and roaming profiles in Outlook 2007.
The issue appears when the user gets a corrupt profile, gets another generated but still has some registry keys mapped to the old corrupt profile. If the corrupt profile gets removed, or if another local mail account is created on the new profile it will result in an error when the user switches between computers.

Here is the logonscript that solves the issue by changing the keys each time the user logs on.

On Error Resume Next

If Not TestOstFilePath = True Then
  Const HKEY_CURRENT_USER = &H80000001
  Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")
  Set objFSO = CreateObject("Scripting.FileSystemObject")
  Set oShell = CreateObject("WScript.Shell")

  LocalAppData = oShell.ExpandEnvironmentStrings("%LocalAppData%")
  stringDefaultOstPath = LocalAppdata & "\Microsoft\Outlook\"

  ' searches for the most recent created .ost file.
  Set objFSO = CreateObject("scripting.filesystemobject")
  set oFolder = objFSO.getfolder(stringDefaultOstPath)
  For Each aFile In oFolder.Files
    Extension = objFSO.GetExtensionName(stringDefaultOstPath & aFile)
    If Extension = "ost" Then
      If sNewest = "" Then
        Set fNewest = aFile
        sNewest = aFile.Name
      Else
        If fNewest.DateCreated < aFile.DateCreated Then
          Set fNewest = aFile
        End If
      End If
    End If
  Next

  ' if no .ost file is found, revert to default.
  If fNewest = "" Then
    fNewest = stringDefaultOstPath & "outlook.ost"
  End If

  ' Convert path into binary format with nulls
  stringDefaultOstFilePath = fNewest

  iLength = Len(stringDefaultOstFilePath)
  Dim binaryDefaultOstFilePath()
  Redim binaryDefaultOstFilePath(iLength * 2 + 1)
  For i = 0 To iLength - 1
    binaryDefaultOstFilePath(i * 2)   = Asc(Mid(stringDefaultOstFilePath, i + 1, 1))
    binaryDefaultOstFilePath(i * 2 + 1) = 0
  Next
  binaryDefaultOstFilePath(iLength * 2)   = 0
  binaryDefaultOstFilePath(iLength * 2 + 1) = 0'

  ' Look in outlook profile and set the ost to correct location
  iReturn = oReg.EnumKey(HKEY_CURRENT_USER, "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\", allOutlookProfiles)
  If IsArray(allOutlookProfiles) Then
    For Each stringOutlookProfile In allOutlookProfiles
      iReturn = oReg.SetBinaryValue(HKEY_CURRENT_USER, "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\" & stringOutlookProfile & "\13dbb0c8aa05101a9bb000aa002fc45a", "001f6610", binaryDefaultOstFilePath)
      If iReturn <> 0 Then
        oShell.Logevent 1, "Error! Could not set value 001f6610 to " & binaryDefaultOstFilePath & ". Error: " & iReturn
      End If
      iReturn = oReg.SetStringValue(HKEY_CURRENT_USER, "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\" & stringOutlookProfile & "\13dbb0c8aa05101a9bb000aa002fc45a", "001e660e", stringDefaultOstPath)
      If iReturn <> 0 Then
        oShell.Logevent 1, "Error! Could not set value 001e660e to " & stringDefaultOstPath & ". Error: " & iReturn
      End If
    Next
  End If

  ' Writes an event with the current .ost file to registry.
  RegistrySetting = oShell.RegRead("HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook\13dbb0c8aa05101a9bb000aa002fc45a\001f6610")
  If Not RegistrySetting = "" Then
    oShell.Logevent 4, "The .ost path has been set to: " & stringDefaultOstFilePath
  Else
    oShell.Logevent 2, "The .ost path can not be found"
  End If
End If

Function TestOstFilePath
  On Error Resume Next
  Const HKEY_CURRENT_USER = &H80000001
  Set objFSO = CreateObject("Scripting.FileSystemObject")
  Set oShell = CreateObject("WScript.Shell")

  strKeyPath = "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook\13dbb0c8aa05101a9bb000aa002fc45a\"
  strValueName = "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook\13dbb0c8aa05101a9bb000aa002fc45a\001f6610"

  RegExists = True
  RegistrySetting = oShell.RegRead(strValueName)
  If Err.Number <> 0 Then
    oShell.Logevent 2, "Could not read from registry. " & Err.Description
    RegExists = False
    Err.Clear
  End If

  StringRegValue=""  
  for i=0 to ubound(RegistrySetting)
    if RegistrySetting(i)<>0 then StringRegValue=StringRegValue & chr(RegistrySetting(i))
  Next

  If RegExists = True Then
    If objFSO.FileExists(StringRegValue) Then
      TestOstFilePath = True
    Else
      TestOstFilePath = False
    End If
  Else
    TestOstFilePath = True
  End If
End Function

I did not come up with everything myself. Some of the code was taken from the site below. But i felt that this did not solve my issue completely since i do not use “ForceOSTPath” value.

Some functionality was taken from:
http://www.greycube.com/help/vb/update_ost_path_in_outlook_profiles.txt

Windows forms, tips and trix – Buttons

Vikingur Saemundsson — Fri, 18 May 2012 11:07:36 GMT

Ever written a GUI to your application? Ever think there are alot of unnecessary lines?
Here is a smart way to add basic buttons without too many lines.

function CreateButton{
  param(
    $name,
    $text,
    $size,
    $location,
    $onclick,
    $Form
  )
  $name = New-Object System.Windows.Forms.Button
  $name.Text = "$text"
  $name.Location = "$location"
  $name.Size = "$size"
  $name.add_Click($onclick)
  $Form.Controls.Add($name)
}

This requires a specific type of code to be run on click. We declare a variable as code within curlybrackets as shown below. In this case we use System.Windows.Forms.SaveFileDialog and save a richtextbox named $consolewindow.

$SaveButton_Click = {
  $SaveFileDialog = New-Object System.Windows.Forms.SaveFileDialog
  $SaveFileDialog.Filter = "txt files (*.txt)|*.txt|All files (*.*)|*.*"
  $SaveFileDialog.ShowDialog()
  $ConsoleWindow.Text | Out-File $SaveFileDialog.FileName
  $SaveFileDialog.Dispose()
}

To add a button with this information we need to create a main form and the console window with the code below.

[Void][Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")

# Main form settings
$Form = New-Object System.Windows.Forms.Form
$Form.ClientSize = "1000,620"
$Form.DesktopLocation = "100,100"
$Form.MaximizeBox = $False
$Form.ShowIcon = $False
$Form.FormBorderStyle = "FixedSingle"
$Form.Name = "Example"
$Form.Text = "Example"

# Console window settings
$ConsoleWindow = New-Object System.Windows.Forms.RichTextBox
$ConsoleWindow.Size = "1000,250"
$ConsoleWindow.Location = "0,320"
#$ConsoleWindow.ReadOnly = $True #commented out for manual input.
$ConsoleWindow.BackColor = "Black"
$ConsoleWindow.ForeColor = "White"
$Form.Controls.Add($Consolewindow)

I’ve added a few extra rows just to make it look good for the example.
Now let’s create a button

CreateButton -name "SaveButton" -text "Save to file" -size "100,30" -location "50,50" -form $form -onclick $SaveButton_Click

Then we load the forms window

$Form.ShowDialog()

Normally you might not have a use for this function but when creating dynamic buttons you could have a use for it. To create a range of buttons from an array, use something like this.

$x = 0
$y = 0
for($i=0; $i -lt 20;$i++){
  CreateButton -name $Buttons[$i] -text $Buttons[$i] -size "100,30" -location "$x,$y" -form $form -onclick $Button_Click[$i]
  $x += 100
  if($x -gt "900"){$y += 30;$x = 0}
}

This example takes the first 20 from an array and puts them on the main form in a orderly fashion as to not overcrowd the main window. The example has no practical use, but you could extract nestled objects and create dynamic buttons with a bit of work.

The full script would look like this:
Note that i’m using the same function for all buttons.

function CreateButton{
  param(
    $name,
    $text,
    $size,
    $location,
    $onclick,
    $Form
  )
  $name = New-Object System.Windows.Forms.Button
  $name.Text = "$text"
  $name.Location = "$location"
  $name.Size = "$size"
  $name.add_Click($onclick)
  $Form.Controls.Add($name)
}
$SaveButton_Click = {
  $SaveFileDialog = New-Object System.Windows.Forms.SaveFileDialog
  $SaveFileDialog.Filter = "txt files (*.txt)|*.txt|All files (*.*)|*.*"
  $SaveFileDialog.ShowDialog()
  $ConsoleWindow.Text | Out-File $SaveFileDialog.FileName
  $SaveFileDialog.Dispose()
}
[Void][Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")

# Main form settings
$Form = New-Object System.Windows.Forms.Form
$Form.ClientSize = "1000,620"
$Form.DesktopLocation = "100,100"
$Form.MaximizeBox = $False
$Form.ShowIcon = $False
$Form.FormBorderStyle = "FixedSingle"
$Form.Name = "Example"
$Form.Text = "Example"

# Console window settings
$ConsoleWindow = New-Object System.Windows.Forms.RichTextBox
$ConsoleWindow.Size = "1000,250"
$ConsoleWindow.Location = "0,320"
#$ConsoleWindow.ReadOnly = $True #commented out for manual input.
$ConsoleWindow.BackColor = "Black"
$ConsoleWindow.ForeColor = "White"
$Form.Controls.Add($Consolewindow)

$Buttons = @("1".."26")
$x = 0
$y = 0
for($i=0; $i -lt 20;$i++){
  if($buttons[$i] -eq $null){break}
  CreateButton -name $Buttons[$i] -text $Buttons[$i] -size "100,30" -location "$x,$y" -form $form -onclick $SaveButton_Click
  $x += 100
  if($x -gt "900"){$y += 30;$x = 0}
}

$Form.ShowDialog()

wget for windows

Vikingur Saemundsson — Thu, 03 May 2012 12:26:17 GMT

ever wanted to use wget in Powershell? This short function allows you to wget to local directory.

function wget($urlpath){
  $directory = (get-location).path

  $filename = $urlpath.Split("/")[-1]
  $file = $directory+"\"+$filename

  $webclient = New-Object System.Net.WebClient
  $webclient.DownloadFile($urlpath,$file)
}

Simply enter the function into your current powershell session and try it out.
wget http://upload.wikimedia.org/wikipedia/en/f/f4/The\_Scream.jpg

If you want to permanently have access to this command add the function to the following file: “%windir%\system32\WindowsPowerShell\v1.0\profile.ps1”

For more information on Powershell profiles, read this article:
[http://msdn.microsoft.com/en-us/library/windows/desktop/bb613488(v=vs.85).aspx](http://msdn.microsoft.com/en-us/library/windows/desktop/bb613488(v=vs.85%29.aspx)

Powershell auto updater

Vikingur Saemundsson — Thu, 03 May 2012 11:39:01 GMT

I wrote this short script to keep local scripts up to date with server versions.

Makes it easier to handle scripts that are added with initial version through task sequence or other onetime distributions. The requirement is for the scripts to have the variable $CurrentVersion = <int/double>

Example script, located on the central/repository:

$CurrentVersion = 1.1
[Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
$form = New-Object 'System.Windows.Forms.Form'
$form.showdialog()

If the local/current script contains $CurrentVersion = 1.0 or less it will get updated once the launcher has been run.
Launcher code below:

# Following variables control the paths used in script

# Retrieve the directory of script.
$Script:G_runDir = Split-Path -Parent $MyInvocation.MyCommand.Path

# Name of the script to update.
$Script:G_Script  = "ScriptPath.ps1"

# Where repository version is located.
$Script:G_RepositoryPath = "\\$env:userdnsdomain\Path\To\Script"

# Build paths for scripts. Do not change!
$Script:G_LocalScript = "$G_runDir\$G_Script"
$Script:G_CentralScript = "$G_RepositoryPath\$G_Script"
===========================================================================

Function MainFunction(){

    if(Test-Path $G_CentralScript){

        $LocalInfo = Get-Info -ScriptPath $G_LocalScript
        $CentralInfo = Get-Info -ScriptPath $G_CentralScript

        $LocalVersion = $LocalInfo.Version
        $LocalChecksum = $LocalInfo.Checksum

        $CentralVersion = $CentralInfo.Version
        $CentralChecksum = $CentralInfo.Checksum

        Write-Host "Local Version: $LocalVersion. Central Version: $CentralVersion"

        If($LocalChecksum -ne $CentralChecksum){
            If($LocalVersion -ge $CentralVersion){
                Write-Host "Local script corrupt"
            }
            try{
                Write-Host "Updating script"
                Copy-Item "$G_CentralScript" -Destination "$G_runDir" -Force
                Write-host "Script pdated"
            }
            catch{
                Write-Error $_
            }
        }Elseif($LocalChecksum -eq $CentralChecksum){
            Write-Host "Script up to date"
        }
    }
    Else{
        Write-host "Local Version: $LocalVersion. Could not find $G_CentralScript."
    }

    Launch-Application
} # End Function

#----------------------------------------------------------------
# Gets version of scripts.
#----------------------------------------------------------------
Function Get-Info{
    Param(
        [Parameter(Mandatory=$true)]$ScriptPath
    )

    $Return = @{"Checksum" = "Null";"Version" = 0}
    $MD5 = New-Object 'System.Security.Cryptography.MD5CryptoServiceProvider'

    If(Test-Path $ScriptPath){

        Try{
            $Checksum = [System.BitConverter]::ToString($MD5.ComputeHash([System.IO.File]::ReadAllBytes($ScriptPath)))
            $Return.Checksum = $Checksum
        }
        Catch{
            Write-Error $_
        }

        $Script = (get-content $ScriptPath) | Where-Object{$_ -like "*APP_VER*"}
        if(!$Script){
            Return Write-Host "$ScriptPath does not contain any valid version information!"
        }
        else{
            Try{
                # Uses invoke-expression to set version variable.
                $ScriptBlock = $Script | Where-Object{$_.StartsWith("Set-Variable")}
                If($ScriptBlock.GetType().Name -eq "String"){
                    Invoke-Expression $ScriptBlock
                    If(($APP_VER.GetType() -eq [Double]) -or ($APP_VER.GetType() -eq [Int])){
                        $Return.Version = $APP_VER
                    }
                }
            }Catch{
                Write-Error $_
            }
        }
    }
    Return $Return
}

#----------------------------------------------------------------
# Prompts for input and launches script.
#----------------------------------------------------------------

Function Launch-Application{
    Try{
        .{Powershell.exe -File "$Script:G_LocalScript"}
    }
    Catch{
        Write-Error $_
    }
} # End function

#=== Call Main function =========================================================
#================================================================================

MainFunction

Just copy-paste this and change the paths and you should be good. If you’re running a console application you might want to change the “-Windowstyle” in Start-Script function to “normal”
Currently it waits until any key has been pressed but if you want it to launch instantly just comment out the line

[void]$host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")