PowerShell Sprache & Plattform PowerShell Language & Platform

# Installation via winget (Windows)
winget install --id Microsoft.PowerShell --source winget

# Prüfen der installierten Version
$PSVersionTable

# Ubuntu/Debian: Microsoft-Repository einrichten und installieren
curl -sSL https://packages.microsoft.com/keys/microsoft.asc | sudo apt-key add -
sudo sh -c 'echo "deb [arch=amd64] https://packages.microsoft.com/repos/microsoft-ubuntu-focal-prod focal main" > /etc/apt/sources.list.d/microsoft.list'
sudo apt-get update
sudo apt-get install -y powershell

# Execution Policy für CurrentUser setzen (Windows)
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

# Variablen und Typen
[string]$displayName = "Alice Müller"
[int]$age             = 32
[bool]$isAdmin        = $false
[datetime]$created    = Get-Date

# Null-Koaleszenz und Ternary (PowerShell 7+)
$city   = $null
$result = $city ?? "Berlin"          # => "Berlin"
$label  = $isAdmin ? "Admin" : "User" # => "User"

# Arrays
$colors = @("red", "green", "blue")
$colors += "yellow"
$colors | Sort-Object | Where-Object { $_ -ne "red" }

# Hashtables
$user = @{
    DisplayName = "Alice Müller"
    UPN         = "alice@contoso.com"
    Department  = "IT"
}
$user.Department  # => "IT"
$user["UPN"]      # => "alice@contoso.com"

# Here-String mit Interpolation
$msg = @"
Hallo $($user.DisplayName),
Ihr Konto wurde am $created angelegt.
"@
Write-Output $msg

# Typenoperatoren
42 -is [int]         # True
"hello" -as [int]    # $null (kein Fehler)

# if / elseif / else
$score = 87
if ($score -ge 90)       { "A" }
elseif ($score -ge 75)   { "B" }
elseif ($score -ge 60)   { "C" }
else                     { "F" }

# switch mit Regex und Wildcard
$input = "ERROR: disk full"
switch -Regex ($input) {
    "^ERROR"   { Write-Warning "Critical: $_"; break }
    "^WARN"    { Write-Warning "Warning: $_" }
    default    { Write-Verbose "Info: $_" }
}

# foreach-Schleife
$servers = @("srv01", "srv02", "srv03")
foreach ($srv in $servers) {
    Write-Host "Checking $srv..."
}

# Pipeline ForEach-Object mit Scriptblock
$servers | ForEach-Object {
    $ping = Test-Connection -ComputerName $_ -Count 1 -Quiet
    [pscustomobject]@{ Server = $_; Online = $ping }
}

# ForEach-Object -Parallel (PowerShell 7+)
$servers | ForEach-Object -Parallel {
    $ping = Test-Connection -ComputerName $_ -Count 1 -Quiet
    [pscustomobject]@{ Server = $_; Online = $ping }
} -ThrottleLimit 5

# while-Schleife mit break/continue
$retries = 0
while ($retries -lt 3) {
    $retries++
    try {
        Invoke-RestMethod -Uri "https://api.example.com/health" | Out-Null
        break
    } catch {
        Start-Sleep -Seconds 2
    }
}

function Set-UserLicense {
    [CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'Medium')]
    [OutputType([pscustomobject])]
    param(
        [Parameter(Mandatory, ValueFromPipeline, ValueFromPipelineByPropertyName)]
        [ValidatePattern('^[\w\.\-]+@[\w\-]+\.[\w\.]+$')]
        [string]$UserPrincipalName,

        [Parameter(Mandatory)]
        [ValidateSet("E3","E5","F1","F3")]
        [string]$LicenseSku,

        [Parameter()]
        [switch]$Remove
    )

    begin {
        Write-Verbose "Connecting to Microsoft Graph..."
        Connect-MgGraph -Scopes "User.ReadWrite.All","Organization.Read.All" -NoWelcome
    }

    process {
        $user = Get-MgUser -UserId $UserPrincipalName -ErrorAction Stop
        $skuId = (Get-MgSubscribedSku | Where-Object SkuPartNumber -eq $LicenseSku).SkuId

        if ($PSCmdlet.ShouldProcess($UserPrincipalName, "Set license $LicenseSku")) {
            if ($Remove) {
                Set-MgUserLicense -UserId $user.Id `
                    -AddLicenses @() `
                    -RemoveLicenses @($skuId)
            } else {
                Set-MgUserLicense -UserId $user.Id `
                    -AddLicenses @{SkuId = $skuId} `
                    -RemoveLicenses @()
            }
            [pscustomobject]@{
                User    = $UserPrincipalName
                License = $LicenseSku
                Action  = if ($Remove) { "Removed" } else { "Assigned" }
                Success = $true
            }
        }
    }

    end {
        Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
        Write-Verbose "Disconnected from Microsoft Graph."
    }
}

# Verwendung via Pipeline
"alice@contoso.com","bob@contoso.com" | Set-UserLicense -LicenseSku "E3" -Verbose

# Modul-Struktur anlegen
New-Item -Path ".\ContosoUtils" -ItemType Directory
New-Item -Path ".\ContosoUtils\ContosoUtils.psm1" -ItemType File
New-Item -Path ".\ContosoUtils\Public"  -ItemType Directory
New-Item -Path ".\ContosoUtils\Private" -ItemType Directory

# Modul-Manifest erstellen
New-ModuleManifest -Path ".\ContosoUtils\ContosoUtils.psd1" `
    -RootModule    "ContosoUtils.psm1" `
    -ModuleVersion "1.0.0" `
    -Author        "Contoso Team" `
    -Description   "Contoso Utility Functions for Microsoft 365" `
    -PowerShellVersion "7.0" `
    -RequiredModules @("Microsoft.Graph.Users") `
    -FunctionsToExport "*"

# psm1: Public-Funktionen auto-importieren
$publicFunctions = Get-ChildItem -Path "$PSScriptRoot\Public" -Filter "*.ps1"
foreach ($fn in $publicFunctions) { . $fn.FullName }

Export-ModuleMember -Function ($publicFunctions.BaseName)

# Modul installieren und importieren
Copy-Item -Path ".\ContosoUtils" -Destination "$env:PSModulePath\ContosoUtils" -Recurse
Import-Module ContosoUtils -Verbose

# Via PSGallery veröffentlichen
Publish-Module -Path ".\ContosoUtils" -NuGetApiKey $env:PSGALLERY_API_KEY -Repository PSGallery

# Basisklasse
class AzureResource {
    [string]$Name
    [string]$ResourceGroup
    [string]$Location
    hidden [datetime]$CreatedAt = (Get-Date)

    AzureResource([string]$name, [string]$rg, [string]$loc) {
        $this.Name          = $name
        $this.ResourceGroup = $rg
        $this.Location      = $loc
    }

    [string] GetId() {
        return "/subscriptions/{sub}/resourceGroups/$($this.ResourceGroup)/providers/Microsoft.Resources/$($this.Name)"
    }

    [string] ToString() {
        return "$($this.Name) [$($this.Location)]"
    }
}

# Abgeleitete Klasse
class StorageAccount : AzureResource {
    [string]$Sku
    [bool]$HierarchicalNamespace

    StorageAccount([string]$name, [string]$rg, [string]$loc, [string]$sku) : base($name, $rg, $loc) {
        $this.Sku = $sku
        $this.HierarchicalNamespace = $false
    }

    [string] GetConnectionString() {
        return "DefaultEndpointsProtocol=https;AccountName=$($this.Name);EndpointSuffix=core.windows.net"
    }
}

# Verwendung
$sa = [StorageAccount]::new("mystorageacct", "rg-prod", "westeurope", "Standard_LRS")
$sa.ToString()
$sa.GetConnectionString()

# Remoting auf Zielcomputer aktivieren (Einmalig als Admin)
Enable-PSRemoting -Force

# PSSession erstellen und wiederverwenden
$cred = Get-Credential
$sessions = New-PSSession -ComputerName srv01, srv02, srv03 -Credential $cred

# Befehl auf alle Sessions gleichzeitig ausführen
$results = Invoke-Command -Session $sessions -ScriptBlock {
    [pscustomobject]@{
        Host   = $env:COMPUTERNAME
        OS     = (Get-CimInstance Win32_OperatingSystem).Caption
        Uptime = (Get-Date) - (gcim Win32_OperatingSystem).LastBootUpTime
    }
}
$results | Format-Table -AutoSize

# Datei in Remote-Session kopieren
Copy-Item -Path ".\deploy.ps1" -Destination "C:\Deploy\deploy.ps1" `
    -ToSession $sessions[0]

# Session-Verbindung über SSH (PowerShell 7+, plattformübergreifend)
$sshSession = New-PSSession -HostName "linuxserver.contoso.com" `
    -UserName "adminuser" -SSHTransport
Invoke-Command -Session $sshSession -ScriptBlock { uname -a }

# Sessions schließen
$sessions | Remove-PSSession

# Role Capability File erstellen
New-Item -Path "C:\JEA\RoleCapabilities" -ItemType Directory -Force
New-PSRoleCapabilityFile -Path "C:\JEA\RoleCapabilities\DnsAdmin.psrc"

# DnsAdmin.psrc: nur DNS-Cmdlets erlauben
@{
    VisibleCmdlets = @(
        'Resolve-DnsName',
        @{Name = 'Set-DnsServerResourceRecord'; Parameters = @{Name = 'ZoneName'; ValidateSet = 'contoso.com'}}
    )
    VisibleFunctions = 'TabExpansion2'
    VisibleExternalCommands = @()
}

# Session Configuration File erstellen
New-PSSessionConfigurationFile -Path "C:\JEA\JEA_DNS.pssc" `
    -SessionType RestrictedRemoteServer `
    -RunAsVirtualAccount `
    -TranscriptDirectory "C:\JEA\Transcripts" `
    -RoleDefinitions @{
        'CONTOSO\HelpDesk' = @{ RoleCapabilities = 'DnsAdmin' }
    }

# Session-Konfiguration registrieren
Register-PSSessionConfiguration -Name "JEA_DNS" `
    -Path "C:\JEA\JEA_DNS.pssc" -Force

# Zugriff über JEA-Endpunkt
Enter-PSSession -ComputerName dns01 -ConfigurationName JEA_DNS `
    -Credential (Get-Credential "CONTOSO\helpdesk1")

# DSC-Modul installieren
Install-Module PSDesiredStateConfiguration -RequiredVersion 2.0.7 -Force

# Einfache DSC-Konfiguration
configuration WebServerConfig {
    param([string[]]$ComputerName = 'localhost')

    Import-DscResource -ModuleName PSDesiredStateConfiguration

    Node $ComputerName {
        WindowsFeature IIS {
            Ensure = "Present"
            Name   = "Web-Server"
        }

        WindowsFeature AspNet {
            Ensure    = "Present"
            Name      = "Web-Asp-Net45"
            DependsOn = "[WindowsFeature]IIS"
        }

        File DefaultPage {
            Ensure          = "Present"
            Type            = "File"
            DestinationPath = "C:\inetpub\wwwroot\index.html"
            Contents        = "Deployed via DSC"
            DependsOn       = "[WindowsFeature]IIS"
        }

        Service W3SVC {
            Name      = "W3SVC"
            State     = "Running"
            DependsOn = "[WindowsFeature]IIS"
        }
    }
}

# Kompilieren und anwenden
WebServerConfig -ComputerName "webserver01" -OutputPath ".\WebConfig"
Start-DscConfiguration -Path ".\WebConfig" -ComputerName "webserver01" -Verbose -Wait -Force

# Zustand prüfen
Test-DscConfiguration -ComputerName "webserver01"
Get-DscConfigurationStatus -ComputerName "webserver01"

function Invoke-SafeGraphCall {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)][string]$Uri,
        [Parameter()][int]$MaxRetries = 3
    )

    $attempt = 0
    do {
        $attempt++
        try {
            $response = Invoke-MgGraphRequest -Method GET -Uri $Uri -ErrorAction Stop
            return $response
        }
        catch [Microsoft.Graph.PowerShell.AuthenticationException] {
            Write-Error "Authentication failed – check token: $($_.Exception.Message)"
            throw  # nicht wiederholbar
        }
        catch [System.Net.Http.HttpRequestException] {
            if ($_.Exception.StatusCode -eq 429) {
                $retryAfter = [int]($_.Exception.Response.Headers['Retry-After'] ?? 10)
                Write-Warning "Throttled. Warte $retryAfter Sekunden... (Versuch $attempt/$MaxRetries)"
                Start-Sleep -Seconds $retryAfter
            } else {
                Write-Warning "HTTP-Fehler $($_.Exception.StatusCode): $($_.Exception.Message) (Versuch $attempt)"
                Start-Sleep -Seconds (2 * $attempt)
            }
        }
        catch {
            $err = $_
            Write-Warning "Unbekannter Fehler (Versuch $attempt): $($err.Exception.Message)"
            Write-Verbose "StackTrace: $($err.ScriptStackTrace)"
            Start-Sleep -Seconds 2
        }
    } while ($attempt -lt $MaxRetries)

    throw "API-Aufruf nach $MaxRetries Versuchen fehlgeschlagen: $Uri"
}

# Fehlerbehandlung mit -ErrorVariable und ErrorAction
$result = Get-MgUser -UserId "notexist@contoso.com" `
    -ErrorAction SilentlyContinue `
    -ErrorVariable graphError
if ($graphError) {
    Write-Warning "Benutzer nicht gefunden: $($graphError[0].Exception.Message)"
}

# Transcript für Audit-Logging
Start-Transcript -Path ".\runlog_$(Get-Date -Format yyyyMMdd_HHmmss).txt" -Append
# ... Skript-Aktionen ...
Stop-Transcript

# PSScriptAnalyzer installieren und ausführen
Install-Module PSScriptAnalyzer -Scope CurrentUser -Force
Invoke-ScriptAnalyzer -Path ".\MyScript.ps1" -Severity Warning,Error

# Pester 5: Beispieltest
Install-Module Pester -MinimumVersion 5.0 -Scope CurrentUser -Force
Import-Module Pester

Describe "Get-UserReport" {
    BeforeAll {
        . "$PSScriptRoot\Get-UserReport.ps1"
        Mock Get-MgUser { @([pscustomobject]@{DisplayName="Test User"; UserPrincipalName="test@contoso.com"}) }
    }

    It "gibt mindestens einen Benutzer zurück" {
        $result = Get-UserReport -Filter "department eq 'IT'"
        $result.Count | Should -BeGreaterThan 0
    }

    It "enthält UserPrincipalName-Eigenschaft" {
        $result = Get-UserReport -Filter "department eq 'IT'"
        $result[0].UserPrincipalName | Should -Not -BeNullOrEmpty
    }
}

# SecretManagement: Key Vault als Secret Store
Install-Module Microsoft.PowerShell.SecretManagement -Scope CurrentUser
Install-Module Az.KeyVault -Scope CurrentUser
Register-SecretVault -Name "ContosoVault" -ModuleName Az.KeyVault `
    -VaultParameters @{ AZKVaultName = "contosokeyvault"; SubscriptionId = $subId }
$apiKey = Get-Secret -Name "GraphApiKey" -AsPlainText

{
  "powershell.powerShellDefaultVersion": "PowerShell (x64)",
  "powershell.scriptAnalysis.enable": true,
  "powershell.scriptAnalysis.settingsPath": "./.vscode/PSScriptAnalyzerSettings.psd1",
  "powershell.pester.outputVerbosity": "Diagnostic",
  "powershell.pester.useLegacyCodeLens": false,
  "editor.formatOnSave": true,
  "[powershell]": {
    "editor.defaultFormatter": "ms-vscode.powershell",
    "editor.tabSize": 4,
    "editor.insertSpaces": true,
    "editor.rulers": [120]
  },
  "files.encoding": "utf8bom"
}

// .vscode/launch.json – Debugging-Konfigurationen
{
  "version": "0.2.0",
  "configurations": [
    {
      "name": "PowerShell: Aktuelles Skript",
      "type": "PowerShell",
      "request": "launch",
      "script": "${file}",
      "args": [],
      "cwd": "${workspaceFolder}"
    },
    {
      "name": "PowerShell: Pester Tests",
      "type": "PowerShell",
      "request": "launch",
      "script": "Invoke-Pester",
      "args": ["-Output", "Diagnostic"],
      "cwd": "${workspaceFolder}"
    },
    {
      "name": "PowerShell: Interaktive Session",
      "type": "PowerShell",
      "request": "launch",
      "script": "",
      "createTemporaryIntegratedConsole": true
    }
  ]
}

# Profil erstellen falls noch nicht vorhanden
if (-not (Test-Path $PROFILE)) {
    New-Item -ItemType File -Path $PROFILE -Force
}

# Profil öffnen
code $PROFILE  # VS Code
notepad $PROFILE  # Notepad

# Beispielinhalt für $PROFILE (Microsoft.PowerShell_profile.ps1)
# ------------------------------------------------------------------

# Aliases
Set-Alias -Name grep  -Value Select-String
Set-Alias -Name ll    -Value Get-ChildItem
Set-Alias -Name touch -Value New-Item

# Nützliche Funktionen
function Get-PublicIP { (Invoke-RestMethod https://api.ipify.org?format=json).ip }
function which ($cmd)  { (Get-Command $cmd).Source }

# Benutzerdefinierter Prompt mit Git-Branch
function prompt {
    $branch = git rev-parse --abbrev-ref HEAD 2>$null
    $location = $executionContext.SessionState.Path.CurrentLocation
    if ($branch) {
        Write-Host "[$branch] " -NoNewline -ForegroundColor Cyan
    }
    Write-Host "$location" -NoNewline -ForegroundColor Yellow
    " PS> "
}

# PSReadLine konfigurieren (PS7)
if ($PSVersionTable.PSVersion.Major -ge 7) {
    Set-PSReadLineOption -PredictionSource HistoryAndPlugin
    Set-PSReadLineOption -PredictionViewStyle ListView
    Set-PSReadLineKeyHandler -Key "Ctrl+f" -Function ForwardWord
}

# Automatischer Modul-Import
$commonModules = @("Microsoft.Graph.Authentication", "Az.Accounts")
foreach ($mod in $commonModules) {
    if (Get-Module -ListAvailable -Name $mod) {
        Import-Module $mod -Verbose:$false
    }
}

# SCHLECHT: Alle Benutzer laden, dann filtern (langsam bei großen Tenants)
$allUsers = Get-MgUser -All
$guestUsers = $allUsers | Where-Object UserType -eq "Guest"

# GUT: Server-seitiger Filter via -Filter (schnell)
$guestUsers = Get-MgUser -Filter "userType eq 'Guest'" -All `
    -Property DisplayName,UserPrincipalName,CreatedDateTime

# Measure-Command zum Messen der Laufzeit
Measure-Command {
    Get-MgUser -Filter "department eq 'Engineering'" -All `
        -Property Id,DisplayName,UserPrincipalName `
    | Select-Object DisplayName,UserPrincipalName `
    | Sort-Object DisplayName `
    | Export-Csv .\engineering_users.csv -NoTypeInformation -Encoding UTF8
}

# Parallel-Verarbeitung mit ForEach-Object -Parallel (PS7)
$userIds = (Get-MgUser -Filter "department eq 'IT'" -All -Property Id).Id
$results = $userIds | ForEach-Object -Parallel {
    Import-Module Microsoft.Graph.Users
    $groups = (Get-MgUserMemberOf -UserId $_ -Property DisplayName).DisplayName
    [pscustomobject]@{ UserId = $_; GroupCount = $groups.Count }
} -ThrottleLimit 10

# StringBuilder statt String-Concatenation für große Strings
$sb = [System.Text.StringBuilder]::new()
1..1000 | ForEach-Object { [void]$sb.AppendLine("Row $_") }
$sb.ToString()