🖥️ What's new in PSADT 4.1.7 - 2025-10-21

🛠️ Fixes

• Hotfix to resolve issue where PSAppDeployToolkit 4.1.6 did not work in PowerShell 7 (#1842)

Full Changelog: 4.1.6...4.1.7

@sintaxasn, @mjr4077au, & @DanGough - Team PSADT 😊🦖

🖥️ What's new in PSADT 4.1.6 - 2025-10-17

🛠️ Fixes

• Added the ability to format URLs with a description using in tags in dialog strings, e.g. [url=https://contoso.com/security]Click here for the IT Security Policy[/url]
• Added support for nested tags for UI text formatting.
• Changed -TerminalServerMode switch behavior so that if not running in a terminal server, no action is taken.
• Changed Fluent Dialogs to use software rendering-mode which resolves issues with remote assistance / control tools, e.g. ScreenConnect, etc.
• Fixed an issue where the UI may fail to be displayed when explorer.exe is being elevated by an EPM rule using BeyondTrust EPM, Microsoft EPM, or other EPM tool.
• Fixed an issue where Get-ADTApplication could error out if InstallSource / InstallLocation properties were malformed.
• Fixed an issue where Get-ADTLoggedOnUser would not return any output when pipelined, unless it was encapsulated in a subexpression.
• Fixed Start-ADTProcessAsUser to work with the callers' username even if it doesn't have an active session.
• Fixed issue where tags specified in dialog strings were incorrectly being displayed in Classic Dialogs (even though the tag formatting such as bold doesn't work in Classic). These are now correctly removed and the text is displayed without formatting.
• Fixed passing parameters from the command-line to a v3 compatibility template.
• Fixed Fluent Window dialog position to factor in the default offset if changed.
• Fixed a number of issues found in example documentation for Show-ADTInstallationPrompt, Get-ADTExecutableInfo and Start-ADTProcess.
• Fixed Start-ADTProcess -ArgumentList parameter incorrectly resolving custom $adtSession property to 'True'.
• Fixed Test-ADTOobeCompleted and Test-ADTEspActive not working.
• Fixed Set-ADTServiceStartMode error handling bug.
• Fixed Set-ADTActiveSetup -Description parameter could not be specified in parameter set CreateNoExecute.
• Fixed unexpected error output when reading a HKLM key in SID context.
• Fixed all known Copy-ADTFile issues.
• Fixed New-ADTZipFile not working.
• Fixed issue where Start-AdtMsiProcess could fail to uninstall an installed MSI.
• Fixed Remove-ADTEnvironmentVariable just removing that variables value, not the variable itself.
• Fixed Get-ADTShortcut no longer working for URL shortcuts.

New Contributors

• @lumirjasny made their first contribution in #1768

Full Changelog: 4.1.5...4.1.6

@sintaxasn, @mjr4077au, & @DanGough - Team PSADT 😊🦖

🖥️ What's new in PSADT 4.1.5 - 2025-09-07

🛠️ Fixes

• Added more error info to assist with troubleshooting issue - #1716
• Fixed issue that prevented the toolkit running under some Intune deployments - #1717
• Added a fallback default icon where we're unable to obtain one from a running process - #1713
• Fixed issue where Get-ADTShortcut hit an error when the icon path contained an environment variable - #1709
• Fixed OutOfMemoryException issues within Resolve-ADTErrorRecord - #1711

Full Changelog: 4.1.4...4.1.5

@sintaxasn, @mjr4077au, & @DanGough - Team PSADT 😊🦖

🖥️ What's new in PSADT 4.1.4 - 2025-09-04

🎯 Improvements

• Changed to allow IFEO-blocked processes that get invoked as SYSTEM to execute.
• Added warning within Block-ADTAppExecution if generated command line is > 255 chars
• Added -DisableInheritance switch to Set-ADTItemPermission to restore 3.x behaviour for those who want it. (#1682)
• Added IsTerminalServer to New-ADTEnvironmentTable exports (#1665)
• Updated Show-ADTInstallationWelcome documentation (thanks @That-Annoying-Guy!)
• Changed to using GetLastInputInfo() for more accurate console user idle time.
• Changed Exit-ADTInvocation to expose -NoShellExit parameter on Close-ADTSession. (https://discourse.psappdeploytoolkit.com/t/silent-install-with-restart-and-close-processes-prompt/6906)
• Made the fluent dialogs properly honour right-to-left cultures (#1693)

🛠️ Fixes

• Fixed quote handling in InstallSource and InstallLocation properties in Get-ADTApplication
• Set default parameter set for Start-ADTMspProcess. (#1677)
• Changed Start-ADTMsiProcessAsUser to ensure it uses a user-writeable log location.
• Fixed bad parameter set grouping for Start-ADTProcess family of functions.
• Fixed issue where Set-ADTItemPermissions always needed admin rights to change inheritance options (#1691)
• Fixed issue where Set-ADTActiveSetup -PurgeActiveSetupKey would only clean up keys for the active user. (#1694)
• Fixed StdOut/StdErr/Interleaved printing within Start-ADTProcess.
• Changed Start-ADTProcessAsUser to allow operating with any valid user, such as disconnected RDP users.
• Changed DeploymentSession to handle situations where people put curly braces into InstallTitle (https://discourse.psappdeploytoolkit.com/t/code-examples-for-using-appprocessestoclose-in-v4-1/6846)
• Improved version handling within Set-ADTActiveSetup (#1701)
• Fixed dynamic code trust verification issues with iNKORE dlls
• Fixed access denied issues when querying running processes
• Fixed "Exception calling TestEffectiveAccess" issue (#1679)
• Fixed ShowCloseAppsDialog issue (https://discourse.psappdeploytoolkit.com/t/v4-1-3-show-adtinstallationwelcome-closeprocesses-isnt-working/6904)
• Fixed ZeroConfig issue (#1697)
• Fixed PSADT.AccountManagement.AccountUtilities exception (https://discourse.psappdeploytoolkit.com/t/4-1-3-show-adtballoontip-the-client-process-returned-an-exception-access-denied/6890)
• Fixed issue with users being able to terminate the PSADT UI (https://discourse.psappdeploytoolkit.com/t/4-1-3-show-adtinstallationrestartprompt-task-manager/6899)
• Fixed issue with launching ServiceUI.exe via Start-ADTProcess (https://discourse.psappdeploytoolkit.com/t/4-1-3-trying-to-display-a-command-prompt-using-serviceui/6896)
• Fixed client/server UI permissions issue (https://discourse.psappdeploytoolkit.com/t/4-1-3-adt-ui-system/6905)

Full Changelog: 4.1.3...4.1.4

@sintaxasn, @mjr4077au, & @DanGough - Team PSADT 😊🦖

🖥️ What's new in PSADT 4.1.3 - 2025-08-21

🛠️ Fixes

• Fixed CloseProcesses issue introduced in in 4.1.2
• Fixed issue with variable expansion on Start-ADTProcessAsUser
• Fixed Uninstall-ADTApplication to work with 8.3 names (e.g. C:\PROGRA~2)

Full Changelog: 4.1.2...4.1.3

This release has gone through a full QA cycle to ensure there are no major issues as was the case in 4.1.1 / 4.1.2.
We apologize for the missed testing in the previous release and have taken steps to ensure this doesn't happen again.

@sintaxasn, @mjr4077au, & @DanGough - Team PSADT 😊🦖

🖥️ What's new in PSADT 4.1.2 - 2025-08-20

Please get the latest release here - https://github.com/PSAppDeployToolkit/PSAppDeployToolkit/releases/tag/4.1.3

Update - In our haste to release 4.1.2, we inadvertently introduced another issue. As such, we have pulled both 4.1.1 and 4.1.2 in order to put through a full QA test and verify that we have a fully vetted build before release.

We had a few reports of three specific issues after the 4.1.1 release. While they won’t affect everyone, we decided these fixes were important enough to warrant this quick patch release.

🛠️ Fixes

• Fixed issue with TestEffectiveAccess() call in Set-ADTClientServerProcessPermissions that would fail on some domain-joined devices
• Fixed setup in Block-ADTAppExecution so processes started by SYSTEM don't block at all
• Fixed issue with Show-ADTInstallationWelcome where the buttons would always display in English

Full Changelog: 4.1.1...4.1.2

@sintaxasn, @mjr4077au, & @DanGough - Team PSADT 😊🦖

🖥️ What's new in PSADT 4.1.1 - 2025-08-19

Please get the latest release here - https://github.com/PSAppDeployToolkit/PSAppDeployToolkit/releases/tag/4.1.3

Note - In our haste to release 4.1.2, we inadvertently introduced another issue. As such, we have pulled both 4.1.1 and 4.1.2 in order to put through a full QA test and verify that we have a fully vetted build before release.

🎯 Improvements

• Prevent end users from terminating PSADT.ClientServer.Client.exe process
• Do things to try and make the IFEO command line as short as possible
• Add better retry support to all modal dialogs to prevent client termination
• Allow -ErrorAction to handle no available user in Start-ADTProcessAsUser
• Address case where some systems seemingly don't have a Win32_BIOS.Version property
• Add FileSystemUtilities.TestFileAccess() for testing whether a user has the relevant permissions
• Add FileSystemUtilities.GetEffectiveAccess() to determine whether a SID has effective access to a path
• Rework Set-ADTClientServerProcessPermissions to test for effective access rather than just attempting to set ACLs
• Improve setup surrounding -UseShellExecute pathway, especially with UIAccess executables
• Handle situations where we might not have access to the process in ProcessUtilities.GetRunningProcesses()
• Adjust Set-ADTClientServerProcessPermissions to not require a client/server user
• Get all the *-ADTEnvironmentVariable functions running through the client/server process when the Target is User
• Run the client/server process elevated if the user has a linked admin token
• Bump InvokeBuild dependency version to latest upstream
• Ensure log lines from Show-ADTInstallationProgress reflect all inputs
• Improve comment-based help several functions within the module
• Add missing [SupportsWildcards()] decoration for Remove-ADTFolder -Path
• Ensure there's no duplicate -AppProcessesToClose entries, just like Show-ADTInstallationWelcome does
• Uplift -FilePath resolution in Start-ADTProcess to factor in DirFiles/DirSupportFiles if -WorkingDirectory is not specified
• No need to be so restrictive on Start-ADTMsiProcess -LogFileName
• Expose RequireAdmin publicly within DeploymentSession class object
• Added Bulgarian language strings (thanks @petarvnikolov)

🛠️ Fixes

• Adjust setup in ProcessUtilities.GetRunningProcesses() to handle bogus command lines
• Patch bad setup in Get-ADTClientServerUser when multiple users are present
• Fix some incorrectly named languages so they confirm with bcp47 standards
• Restore SEE_MASK_NOZONECHECKS setup in Start-ADTProcess as it's needed even for CreateProcess()
• Add missing parentheses within New-ADTTemplate -Show pathway
• Swallow TaskCanceledException throws within ServerInstance.Close()
• Properly set the Company field in all compiled file manifests
• Revise setup surrounding default setting of $WorkingDirectory in Start-ADTProcess
• Fixes for Finnish language strings (thanks @labradmin)
• Fix missing negation on DisableDefaultMsiProcessList test

🤼 New Contributors

• @labradmin made their first contribution in #1598
• @petarvnikolov made their first contribution in #1627

Full Changelog: 4.1.0...4.1.1

@sintaxasn, @mjr4077au, & @DanGough - Team PSADT 😊🦖

🖥️ What's new in PSADT 4.1.0 - 2025-08-07

Please get the latest release here - https://github.com/PSAppDeployToolkit/PSAppDeployToolkit/releases/tag/4.1.3

🎯 Major Improvements

• Up until now, it was not possible to display any user interface when deploying an application as SYSTEM using Intune (or any endpoint management tool) without using ServiceUI. Well, now it IS possible:

  • I REPEAT! You no longer need to use ServiceUI, EVER AGAIN! 🥳🎉🎊🪅🪩👯‍♂️
  • In fact, we strongly advise you stop using it as soon as possible. ServiceUI works by manipulating system security tokens in a way that could allow malicious actors to escalate privileges or bypass security controls.
  • We've taken a fresh approach which leverages the Windows security model and separates out user interactions onto a process running in the users' session - we never perform any user interaction or messaging of any kind within the SYSTEM context. This means a more secure and reliable deployment experience.
  • We have also removed the requirement for the 'Allow users to view and interact with the program installation' checkbox in Configuration Manager deployments.

• There is now full feature parity between the Fluent and Classic User Interfaces:

  • Deferral Deadline and Countdown Timer on Close Apps Dialog
  • Ability to prevent the Restart Dialog from being dismissed once a certain point in the countdown is reached
  • Ability to allow users to move dialogs
  • Ability to set the initial dialog placement to multiple locations
  • PowerShell ISE compatibility

• Furthermore, the Fluent UI has gained new features:

  • Due to the rearchitecture of how we handle user interaction with Dialogs, it is now possible to prompt the user for input using Show-ADTInstallationPrompt's -InputBox parameter
  • Support for formattable text (Bold, Italic & Accent) as well as URL hyperlinks in dialog messages
  • You can now set the % complete of the progress bar in the Progress Dialog (for example, if you are running a custom script that you want to show incremental progress changes for)
  • Ability to set different icons for Light / Dark mode

• The security rearchitecture required all of our process execution code to be rewritten. This has enabled us to provide a wealth of new capabilities to both Start-ADTProcess and Start-ADTProcessAsUser using the following new parameters:

  • -UseUnelevatedToken parameter to force a process run without elevation, for deploying user-context apps with Windows 11 Administrator Protection enabled
  • -WaitForChildProcesses parameter to wait for all child processes to end - useful for installers/uninstallers that hand off to another process and exit early
  • -KillChildProcessesWithParent parameter to close all started child processes once main process has ended - useful when installers start the application post-install, which is typically undesired when running as system
  • -Timeout parameter along with supporting -TimeoutAction and -NoTerminateOnTimeout parameters to control the outcome
  • -ExpandEnvironmentVariables parameter to allow variable expansion such as %AppData% when running a process as a user
  • -StreamEncoding parameter, useful for apps like Winget that write to the console using UTF8
  • -PassThru output now has a new 'interleaved' property that combines stdout/stderr in order

• It's now possible to set PSADT configuration settings via Group Policy using the included ADMX templates, which will override any settings in the config.psd1 file. This allows you to change, update or enforce settings across an organization.

🛠️ New and Enhanced Functions

• Added functions for managing user / machine environment variables:
  • Get-ADTEnvironmentVariable / Set-ADTEnvironmentVariable / Remove-ADTEnvironmentVariable
• Added functions for managing INI file sections / values:
  • Get-ADTIniSection / Set-ADTIniSection / Remove-ADTIniSection
  • Get-ADTIniValue / Set-ADTIniValue / Remove-ADTIniValue
• Added Start-ADTMsiProcessAsUser for installing / uninstalling user-context MSIs via the System account
• Added Test-ADTEspActive to test for an active Enrollment Status Page (ESP)
• Added -DeferRunInterval switch to Show-ADTInstallationWelcome to limit retry times from Intune
• Added -Path / -LiteralPath support to registry functions
• Added volatile key creation support to Set-ADTRegistryKey
• Added MultiString add / remove support to Set-ADTRegistryKey
• Added -MaximumElapsedTime parameter to Invoke-ADTCommandWithRetries
• Added -SuccessExitCodes and -RebootExitCodes parameters to Uninstall-ADTApplication

🛠️ Other Improvements

• Show-ADTHelpConsole has been given some love and a facelift with High-DPI awareness, resizability, PowerShell 7 compatibility, and extension module display
• Reworked Invoke-AppDeployToolkit.exe to be more compliant within WDAC environments
• Added -NoWait support to Show-ADTDialogBox
• Added process detection code to enable automatic silent deployments when processes aren't running
• Added /Debug switch to Invoke-AppDeployToolkit.exe to show terminal output for debugging purposes
• Added /Core switch to Invoke-AppDeployToolkit.exe to allow PowerShell 7 usage
• Added support for running processes from network drives

🛠️ Changes

• Added -NoOobeDetection option to Open-ADTSession to bypass OOBE detection logic when DeployMode is set to Auto. Use this to show the UI during OOBE / Autopilot ESP phases.
• Added -NoSessionDetection option to Open-ADTSession to bypass session detection logic when DeployMode is set to Auto. Use this to show the UI when no user is logged on and the SYSTEM process is interactive.
• Added -NoProcessDetection option to Open-ADTSession to bypass process detection logic when DeployMode is set to Auto. Use this to show the UI even if there are no processes to close.
• Changed -DeployMode Interactive to always show interactively. This means the toolkit will always show the dialogs, bypassing the OOBE/Session/Process detections that occur in Auto mode.
• Changed default DeferExitCode from 60012 to 1602, since ConfigMgr and Intune recognize this natively as 'User cancelled the installation'
• Changed toolkit to exit with 3010 if a suppressed reboot was encountered without having to use -AllowRebootPassThru. To mask 3010 return codes and exit with 0, you can now add -SuppressRebootPassThru
• Changed default msiexec.exe parameters in interactive mode from /qb-! to /qn
• Changed UI functions to no longer minimize windows by default, -MinimizeWindows can be added to enable this
• Changed the 'Processes to close' in the Invoke-AppDeployToolkit template to the AppProcessesToClose ADTSession parameter, where they can be re-used over Install / Uninstall / Repair
• Changed installation failure to be silent as it was in v3.x; however, you can still uncomment a line to get the full detailed stack trace as used in v4.0.x, or a new minimal example using the Fluent UI

🛠️ Fixes

• Fixed Start-ADTProcessAsUser function to work as expected
• Fixed Block-ADTAppExecution to avoid triggering AV solutions
• Fixed dialogs to show correct deployment type Install / Uninstall / Repair
• Fixed SCCM pending reboot tests within Get-ADTPendingReboot
• Fixed MSI repair to default to 'Reinstall' to avoid forced unavoidable reboots when running msiexec /f against an app that is in-use
• Fixed OOBE detection code to factor in User ESP phase
• Fixed launching processes in the users' session when using certain MDMs, e.g. VMware Workspace ONE.

Full Changelog: 4.0.6...4.1.0

🙏🏻 Thanks

• Contributors who helped with this release - @tjgruber, @CSVDK, @neo42JBR, @That-Annoying-Guy, @GoldyTec and @ClientMGMT.
• The testers on Discord and Discour...

🚀 4.1.0 final has now been released! ➡️Get it here!

Changes since RC2

• Changed default -DeployMode to Auto. This is functionally the same as the old Interactive mode, where the toolkit will automatically switch to Silent mode if the device is in OOBE/ESP phases, there is no user logged on, or (new in 4.1) there are no processes to close.
• Changed -DeployMode Interactive to always show interactively. This means the toolkit will always show the dialogs, bypassing the OOBE/Session/Process detections that occur in Auto mode.
• Added -NoOobeDetection option to Open-ADTSession to bypass OOBE detection logic when DeployMode is set to Auto. Use this to show the UI during OOBE / Autopilot ESP phases.
• Added -NoSessionDetection option to Open-ADTSession to bypass session detection logic when DeployMode is set to Auto. Use this to show the UI when no user is logged on and the SYSTEM process is interactive.
• Added -NoProcessDetection option to Open-ADTSession to bypass process detection logic when DeployMode is set to Auto. Use this to show the UI even if there are no processes to close.
• Removed superfluous text from the CloseApps dialog. Thanks @ClientMGMT for #1569

Full Changelog: 4.1.0-rc2...4.1.0-rc3

🚀 4.1.0 final has now been released! ➡️Get it here!

Changes since RC1

• Added Test-ADTEspActive to test for an active Enrollment Status Page (ESP).
• Added support for running processes from network drives.
• Fixed launching processes in the users' session when using certain MDMs, e.g. VMware Workspace ONE.
• Fixed setting the Accent Color using the ADMX templates.
• Fixed minimize button not being shown on Fluent Progress and Restart Dialogs.
• Fixed the "Restart Later" button in the Fluent Restart Dialog not being disabled during the warning period.

Full Changelog: 4.1.0-rc1...4.1.0-rc2