The PowerShell Podcast

Andrew welcomes Morten Mynster back to the PowerShell Podcast to dig into the projects he’s been building around Microsoft Graph, Entra, least privilege, and authentication. Morten walks through Least Privileged Entra, a module that uses activity logs to identify users who may have more permissions than they actually need, and MS Graph Proxy, which lets developers work with mocked Microsoft Graph data locally without connecting to a live tenant. They also get into managed identities, the rougher corners of Microsoft 365 APIs, testing Graph-based projects in CI/CD pipelines, and how contributing to open source can solve real problems while creating unexpected career opportunities.

 

Key Takeaways:
· Least privilege is easier when you can see what people actually use. Morten’s Least Privileged Entra module compares assigned Entra roles with activity data to identify permissions that may be unnecessary and suggest more limited alternatives. The goal is to give admins something actionable rather than simply reporting that a configuration passed or failed.
· You don’t always need a live Microsoft 365 tenant to develop against Microsoft Graph. MS Graph Proxy intercepts Graph requests and responds with mocked data, allowing developers to test scripts and modules locally, offline, or inside CI/CD pipelines. It can also identify the minimum Graph permissions associated with the endpoints an application uses.
· Sharing your work can have benefits far beyond the project itself. Morten credits his Least Privileged MS Graph project with helping him land his current job. His approach is simple: solve a real problem, share the solution, contribute where you can, and let other people build on what you’ve learned.

 

Guest Bio:
Morten Mynster is an IT professional and open source contributor focused on Microsoft Entra, Microsoft Graph, security, and least privilege. His projects include LeastPrivilegedMSGraph, LeastPrivilegedEntra, and MSGraphProxy, and he regularly contributes to community projects and discussions around Microsoft 365 security and PowerShell.

Resource Links:

• https://github.com/Mynster9361/Least_Privileged_MSGraph
• https://github.com/Mynster9361/LeastPrivilegedEntra
• https://github.com/Mynster9361/msgraphProxy
• https://github.com/FriedrichWeinmann/EntraAuth
• The PowerShell Podcast on YouTube: https://youtu.be/cB_QE1HvAyI

Mike Soule, Field CTO at Sentinel Technologies, returns to the PowerShell Podcast for the first time in three years to talk identity security, cloud configuration testing, and the evolving role of AI in the Microsoft ecosystem. Andrew and Mike dig into Maester, the open source PowerShell-based test automation framework that applies unit testing concepts to Microsoft 365 security configuration. Mike breaks down how Maester works, how Sentinel uses it with clients, and how the community has grown it into something that spans hundreds of built-in tests covering conditional access, CIS baselines, CISA standards, and more. They also cover EntraOps, the Enterprise Access Model, AI's impact on the MSP world, and why working in managed services is still one of the fastest ways to level up in IT. The episode closes with a strong Brandon Sanderson tangent.

Key Takeaways:

• Maester brings the concept of unit testing to Microsoft 365 security configuration, letting admins continuously validate their cloud settings against known-good baselines with as few as three PowerShell commands. It's built on Pester, is fully open source, and now has over 100 community contributors.
• AI is changing the MSP landscape fast, but the fundamentals still matter. Mike and Andrew discuss how to think about Copilot licensing complexity, model routing in agent stacks, and why meeting users in their existing interface is often more important than deploying a shiny new tool.
• MSP experience accelerates learning in a way that internal IT often can't match. When you're working across multiple clients and environments, you accumulate reps quickly, and that breadth is hard to replicate elsewhere.

Guest Bio:
Mike Soule is the Field CTO at Sentinel Technologies, a large managed service provider focused on identity, cloud, and security strategy. Mike has been working hands-on with PowerShell, Entra ID, and Microsoft 365 security architecture for years and is a regular speaker at identity and security conferences.

Resource Links:
Maester (open source framework): https://maester.dev

Maester on GitHub: https://github.com/maester365/maester

Maester Cloud (hosted version by Merill Fernando): https://maester.cloud

HIPConf (Hybrid Identity Protection Conference): https://www.hipconf.com

EntraOps by Thomas Naunheim: https://github.com/Cloud-Architekt/EntraOps

Mike Soule on LinkedIn: https://www.linkedin.com/in/mikesoule

The PowerShell Podcast on YouTube: https://youtu.be/EQK693gGWoo

 

Andrew Pla sits down with TJ Turner at Microsoft’s TechMentor conference @ Microsoft HQ in Redmond, Washington, for a conversation about PowerShell, career growth, and the parts of working in IT that don’t show up in the documentation. TJ traces his path from infrastructure through K-12, finance, and retail to his current role as a Cloud Evangelist at TD SYNNEX, along with his early days using PowerShell v2 and v3, competing in the Scripting Games, and helping start the Philadelphia PowerShell User Group. They also dig into real-world automation wins, including a PowerShell workflow that helped validate thousands of systems before a holiday weekend, plus burnout, community, asking for help, and what years of broken demos and IT mistakes can teach you about staying prepared and learning to adapt.

Key Takeaways:
· What got you here won’t get you there. TJ’s career moved from hands-on infrastructure into distribution, cloud, and technical evangelism, and none of those moves were necessarily part of the original plan. Staying open to new roles, skills, and opportunities has been a big part of that growth.
· PowerShell changes how you think, not just how you work. TJ shares examples of using PowerShell to validate thousands of systems, automate VMware update workflows, and collect detailed system state information. Over time, that automation mindset became part of how he approaches problems, even as his career moved beyond day-to-day infrastructure work.
· Community and communication are technical skills too. Whether it’s recognizing burnout, asking for help, meeting someone at a conference, or admitting you don’t know an answer during a presentation, the ability to connect with other people can have just as much impact on your career as knowing the technology.

Guest Bio:
TJ Turner is a Cloud Evangelist at TD SYNNEX, one of Microsoft’s largest distributors in the CSP and partner channel. His background is in infrastructure, with experience spanning K-12, financial services, retail, and other enterprise environments. TJ got started with PowerShell during the v2 and v3 era, competed in the Scripting Games, and helped found the Philadelphia PowerShell User Group. Today, his work includes Azure, Microsoft 365, security, GitHub, DevOps, and helping partners grow their businesses.

Resource Links:
· TD SYNNEX Microsoft Partner Programs: https://www.tdsynnex.com/na/us/Microsoft/

· PDQ Connect PowerShell Scanner: https://www.pdq.com/powershell-scanner/

· PDQ PowerShell Scanner Blog Post: https://www.pdq.com/blog/the-powershell-scanner-has-arrived-in-pdq-connect/

· PDQ Community PowerShell Scanners Repository: https://github.com/pdqcom/PowerShell-Scanners

· TJ Turner on LinkedIn: https://www.linkedin.com/search/results/people/?keywords=TJ+Turner+TD+SYNNEX

The PowerShell Podcast on YouTube: https://youtu.be/ce9vxdkzDbo

 

Fred Weinmann is back, and this time he's walking us through the PowerShell Framework Collective – his personal answer to the age-old problem of building the tools that build the tools. The core idea is simple but powerful: if you invest in the scaffolding around your code, the actual code you write gets faster, cleaner, and more consistent every time. Fred breaks down four key wins from his framework stack, including PSModuleDevelopment for templating new projects, PSUtil for leveling up your console experience, PSReadLine for predictive history, and PSFramework itself for things like logging, configuration, parameter handling, and protected command execution. If you've ever spent more time wiring up logging and retry logic than solving the actual problem, this episode is going to feel very familiar – and very useful.

Key Takeaways:

• PSModuleDevelopment makes spinning up a new, fully scaffolded PowerShell module a one-liner – complete with tests, GitHub release pipelines, and PowerShell Gallery publishing – so you can focus entirely on the actual functions you need to write.
• PSFramework handles the infrastructure layer of your code (logging, configuration, tab completion, parameter validation, retry logic) so you stop reinventing the wheel and your projects stay consistent across years and teammates.
• The real payoff of a shared framework is long-term maintainability: Fred opened a module he hadn't touched in six years and had a bug fixed and released in five minutes because everything was exactly where he expected it to be.

Guest Bio:
Friedrich "Fred" Weinmann is a Cloud Solution Architect at Microsoft and one of the most recognized PowerShell community contributors working today. He is the creator of PSFramework, which underpins many other modules in the ecosystem, as well as tools like PSModuleDevelopment, PSUtil, and the Active Directory Management Framework. Fred is a frequent conference speaker, a longtime community collaborator, and someone Andrew credits with helping shape his own PowerShell journey.

Resource Links:

• PSFramework Project Home: https://psframework.org/
• PSFramework on GitHub: https://github.com/PowershellFrameworkCollective/psframework
• PSModuleDevelopment on GitHub: https://github.com/PowershellFrameworkCollective/PSModuleDevelopment
• PSUtil on GitHub: https://github.com/PowershellFrameworkCollective/PSUtil
• PowerShell Framework Collective on GitHub: https://github.com/PowershellFrameworkCollective/
• PDQ Discord – PowerShell Scripting Channel: https://discord.gg/pdq
• The PowerShell Podcast on YouTube:https://youtu.be/sZQdgBZM75Y

Andrew sits down with Evgenij Smirnov, a Berlin-based IT veteran with 30 years of experience in Active Directory and security consulting, to dig into what actually gets organizations popped. Evgenij walks through the most common escalation paths he sees in real-world AD environments, including over-permissioned accounts, exposed certificate authorities, and unencrypted domain controller backups, and explains how attackers chain these together to produce golden tickets and gain god-mode access. The conversation covers why these misconfigurations keep happening (bad defaults, lazy vendors, and a long history of "just click next"), how PowerShell fits into both hardening and attack scenarios, and what proper tier isolation actually looks like when you implement it with both authentication policies and user rights assignments. Evgenij also introduces his book, Building Modern Active Directory, and makes the case for treating security not as a chapter you can skip, but as something baked into the design from day one.

 

Key Takeaways:

• The most common Active Directory escalation paths are not sophisticated. Over-permissioned accounts with ACL chains to DC sync, exposed certificate authorities, and unencrypted backup tapes are consistently the entry points attackers exploit. If you can find these first, you are already ahead of most threat actors.
• Tier isolation done right requires both authentication policies and user rights assignment policies working together. Either technique alone leaves a blind spot that a determined attacker can walk through.
• Cybersecurity is a team sport, and bad cybersecurity is too. Microsoft ships AD with questionable defaults, vendors demand domain admin for service accounts, and administrators make shortcuts under pressure. The fix is not one heroic hardening sprint; it is a culture of least privilege built into every decision from the start.

Guest Bio:
Evgenij Smirnov is a Principal Solutions Architect at Semperis and a Microsoft MVP in both Security and PowerShell since 2020. Based in Berlin, Germany, he has spent more than 30 years in IT and security consulting, with deep expertise in Active Directory, identity security, and hybrid infrastructure. He is a longtime community leader, running the PowerShell User Group Berlin and the Windows Server User Group Berlin, and a regular speaker at conferences including PSConfEU. He is the author of Building Modern Active Directory, published by Apress in 2024.

 

Resource Links:
Building Modern Active Directory (book site): ad2049.com
Evgenij's personal blog): it-pro-berlin.de
Evgenij on LinkedIn: linkedin.com/in/evgenijsmirnov
ADMF (Active Directory Management Framework) on GitHub: github.com/ActiveDirectoryManagementFramework/ADMF
ADMF documentation and project site: admf.one
Attack Scenario To Go: https://github.com/HerrHoZi/AS2Go

The PowerShell Podcast on YouTube: https://youtu.be/EQb7H6vBOtg

 

Andrew sits down with Fred Weinmann, one of the most prolific PowerShell module authors in the community, for part one of a multi-episode series covering his projects. This episode focuses on the Active Directory Management Framework, or ADMF, a configuration-driven system Fred originally built while working as a field engineer at Microsoft for a large enterprise customer managing hundreds of Active Directory forests.

Fred walks through the problem ADMF was designed to solve: Active Directory is notoriously hard to manage consistently across environments, and most organizations just accept the chaos as the cost of doing business. The old approach at this particular customer involved zipping up scripts, RDPing into domain controllers, and running them manually. ADMF changed that by borrowing the test/apply concept from Desired State Configuration, but making it flexible enough to handle the messiness of real-world AD environments.

The conversation covers how ADMF is structured around components (like organizational units) and contexts, why generating a reference configuration from an existing environment is harder than it sounds, the protocol juggling required to handle Group Policy and schema updates, and why Fred would use raw LDAP instead of the built-in AD commands if he were starting from scratch today. Fred also touches on the credential provider plugin system, which lets teams plug in their own password management workflows for things like break-glass accounts.

Key Takeaways:

• ADMF follows a test-before-apply model borrowed from DSC, but trades DSC's all-or-nothing enforcement for a more selective, component-by-component approach that better fits the fluid reality of Active Directory management.
• Generating a configuration from an existing AD environment is tempting but potentially counterproductive. If you auto-generate your desired state from a domain that's accumulated years of cruft, you're not capturing what you want, you're just freezing what already exists.
• Performance at scale is a real consideration. The built-in Active Directory PowerShell module uses the AD Web Services protocol, which sends XML over the wire. Raw LDAP is significantly faster, and Fred says switching to it is the one architectural change he'd make if building ADMF over again.

Guest Bio:
Friedrich "Fred" Weinmann is a Cloud Solution Architect at Microsoft and one of the most recognized PowerShell community contributors working today. He is the creator of PSFramework, which underpins many other modules in the ecosystem, as well as tools like PSModuleDevelopment, PSUtil, and the Active Directory Management Framework. Fred is a frequent conference speaker, a longtime community collaborator, and someone Andrew credits with helping shape his own PowerShell journey.

Resource Links:

ADMF documentation and getting started guide: admf.one

ADMF on GitHub: github.com/ActiveDirectoryManagementFramework/ADMF

ADMF on PowerShell Gallery: powershellgallery.com/packages/ADMF

PSFramework (Fred's logging, configuration, and scripting infrastructure module): psframework.org

Fred Weinmann on GitHub: github.com/FriedrichWeinmann

Fred Weinmann on X: x.com/FredWeinmann

PDQ Community Discord: discord.gg/pdq

 

The PowerShell Podcast on YouTube: https://youtu.be/8SlIqUKP3hY

 

Jake Hildreth, Principal Security Consultant at Semperis and Microsoft MVP, is back on the podcast fresh off a trip to PowerShell Conference Europe, where he and Andrew co-presented a session on securing PowerShell. Jake also gave his own talk on Stepper, his open-source module for building resumable, step-by-step scripts — a tool that's grown considerably since his last appearance on the show. The two dig into what makes PSConf EU such a standout event, the refreshing lack of elitism in the PowerShell community, and the updates Jake's been shipping, including named steps, built-in logging, and secret suppression. The conversation winds into burnout, the importance of actually taking your vacation days, and how the same mindset that drives good automation — knowing when to stop and reset — applies to taking care of yourself.

Key Takeaways:

• Stepper has gotten some meaningful quality-of-life updates since Jake last appeared on the show, including named steps, automatic logging, and the ability to suppress secrets from logs — making it more practical for real-world production scripts.
• PSConf EU punches above its weight as a conference experience: technically deep but genuinely welcoming at every skill level, with none of the elitism that can creep into security-adjacent events.
• Your vacation time is a benefit, not a backlog item. Jake makes the case that getting good at separating your work time from your off time isn't a soft skill — it's a sustainability practice.

Guest Bio:
Jake Hildreth is a Principal Security Consultant at Semperis, a Microsoft MVP in both PowerShell and Identity/Access, and a recovering sysadmin with 25 years of IT under his belt. He's probably best known for building Locksmith, the open-source AD CS auditing and remediation tool, but he's also the creator of Stepper, Deck, BlueTuxedo, and PowerPUG! — a suite of tools designed to make identity security a little less painful for the admins who live in it. When he's not untangling Kerberos or chasing down ADCS misconfigurations, he goes by "horse" in the PowerShell Discords.

Resource Links:

• Jake Hildreth's Website: jakehildreth.com
• Jake's GitHub: github.com/jakehildreth
• Stepper (Resumable PowerShell Scripts): github.com/jakehildreth/Stepper
• Locksmith (AD CS Auditing & Remediation): github.com/jakehildreth/Locksmith
• Locksmith 2 (Next-Gen AD CS Toolkit): github.com/jakehildreth/…
• PowerShell Conference Europe: psconf.eu
• PDQ Discord: discord.gg/PDQ
• The PowerShell Podcast on YouTube: https://youtu.be/Rqkuaeps_jM

Andrew sits down with Robert Prüst, a Netherlands-based Microsoft MVP, to geek out about Pester, AI-assisted coding, and the power of showing your work in the PowerShell community. Robert breaks down how Pester works as a testing framework (unit testing, integration testing, and mocking) and explains why testing is the key to trusting AI-generated code. They also dig into a Visual Studio Code extension Robert built for Azure DevOps, the conference culture around PSConf EU, and why community involvement matters as much as technical skill. The conversation wraps with some honest takes on imposter syndrome, learning in public, and the value of just getting started.

Key Takeaways:

• Pester isn't just for unit testing your functions -- it scales all the way up to testing live infrastructure, validating Azure environments, and serving as the backbone of security tools like Maester. The more you invest in it, the more useful it gets.
• AI-generated code needs a safety net, and Pester is exactly that. Testing gives sysadmins a way to verify what the code is actually doing, which is especially critical when you didn't write it yourself.
• Imposter syndrome is almost universal in this community, and the people who feel it most are often the ones learning the most. Getting into community spaces -- online or in person -- is one of the fastest ways to grow.

Guest Bio:
Robert Prüst is a Microsoft MVP and MCT based in the Netherlands, focused on PowerShell, Azure automation, and DevOps. He has around 24 years of professional IT experience and has been working with PowerShell since roughly 2012. Robert is a regular speaker at PSConf EU, blogs at powershellpr0mpt.com, and is active on GitHub under the handle powershellpr0mpt. He runs a custom Azure Engineer bootcamp course and contributes to open source projects including the AMBA and EPAC frameworks.

Resource Links:

•  Pester documentation: https://pester.dev
•  Maester: https://maester.dev
•  PSKoans: https://github.com/vexx32/PSKoans
•  PSConfEU: https://psconf.eu
•  PDQ Discord: https://discord.gg/pdq
• Connect with Andrew: https://andrewpla.tech/links
• Robert’s blog: https://powershellpr0mpt.com
• Robert on GitHub: https://github.com/powershellpr0mpt
• Robert on LinkedIn: https://www.linkedin.com/in/rprust/
• The PowerShell Podcast on YouTube: https://youtu.be/7Z2Pk0y2Xss