Invoke-FvAdOuAceRemediation

Author(s)

• Olamide Olaleye

Tags

ActiveDirectory Security ACL GPO Audit Remediation

Functions

Backup-FvAdOuAcl Get-FvAdOuAce Get-FvAdOuAceReport Invoke-FvAdOuAceRemediation Reset-FvAdOuAce Restore-FvAdOuAcl

Dependencies

This module has no dependencies.

Release Notes

## [0.2.0] - 2026-09-10

### Added

- Initial module: `Get-FvAdOuAce`, `Get-FvAdOuAceReport`, `Backup-FvAdOuAcl`, `Reset-FvAdOuAce`,
 `Restore-FvAdOuAcl`, and `Invoke-FvAdOuAceRemediation`, assessing, reporting on, remediating
 and rolling back over-permissive explicit `Everyone`/`GenericAll` (and similarly
 over-permissive) `Allow` ACEs on Active Directory Organizational Units.
- Pester v6 unit test suite (`tests/Unit/Public/`) with every `ActiveDirectory` cmdlet mocked.
- `about_Invoke-FvAdOuAceRemediation` help topic documenting the design choices, the two
 `Reset-FvAdOuAce -RestoreMode` semantics, and every stated assumption.

### Removed

- The template's example logging helpers (`Write-ToLog`, `Invoke-LogRotation`) and example
 public functions (`Get-Greeting`, `Export-Greeting`) - unused by this module.

### Fixed

- Removed `ActiveDirectory` from the module manifest's `RequiredModules` key. Sampler's
 `package_module_nupkg` build task unconditionally walks every entry in that list trying to
 resolve and bundle it, which fails the CI pack step with "You cannot call a method on a
 null-valued expression" the moment the module isn't present on the build agent - true for
 every hosted GitHub Actions runner, since `ActiveDirectory` is a Windows RSAT feature never
 published to PSGallery. The dependency is now documented via
 `PrivateData.PSData.ExternalModuleDependencies` instead; PowerShell's own module
 auto-loading still resolves the cmdlets at runtime for users who have RSAT installed.
- Restricted the `test` job to Windows only in `ci.yml`, `release.yml` and
 `azure-pipelines.yml`. The unit tests mock `ActiveDirectory` cmdlets via Pester's
 `-ModuleName` mocking, which requires the real cmdlet to exist to shadow it; on a
 Linux/macOS runner (no RSAT) that fails outright with `CommandNotFoundException` before the
 mock ever takes effect - confirmed by a real CI run failing 44 of 104 tests on
 ubuntu-latest/macos-latest. Updated `CLAUDE.md`/`AGENTS.md`/`README.md`, which previously
 and incorrectly claimed the test suite ran on any platform.
- Added an `Install-WindowsFeature -Name RSAT-AD-PowerShell` step ahead of the test run in
 `ci.yml`, `release.yml` and `azure-pipelines.yml`. Restricting to `windows-latest` (above)
 was not on its own sufficient: the hosted `windows-latest` image doesn't ship the
 `ActiveDirectory` module either, so `Get-ADObject`/`Get-ADDomain` etc. didn't exist as real
 commands there and Pester's mock resolution still failed with `CommandNotFoundException` -
 confirmed by a second real CI run failing the same way on windows-latest.