2026

Building Open Source Modules in C# - Emanuel Palm - PSConfEU 2026

This session focused on building PowerShell modules in C# with open-source tooling and GitHub automation. Emanuel Palm introduced the topic by comparing script modules and compiled .NET-based modules, and explained ...that the goal was to show how a binary module can wrap an SDK and expose it to PowerShell users.

He then described why C# can be useful for module authors. He said that the .NET ecosystem gives access to SDKs, type safety, generic methods, interfaces, classes and inheritance, and that modules can reuse existing functionality instead of rebuilding it in PowerShell. He also noted that many Microsoft modules are written in C#.

The talk then covered the required tooling and setup. Emanuel mentioned the .NET SDK, PowerShell, and a code editor such as VS Code or Visual Studio, and explained that framework targeting is an important decision because it determines whether a module can run in Windows PowerShell 5.1 or only in newer PowerShell versions. He also showed the relationship between a PowerShell cmdlet and its C# implementation.

After that, Emanuel walked through a demo module called AC Pigeon, which uses the Azure.Storage.Queues SDK to read and write messages in Azure Storage Queues. He explained the use of Sampler, Plaster, Invoke Build, Pester and GitHub workflows to scaffold the project, automate the build, run tests and publish releases.

He then demonstrated the C# code for a cmdlet that inherits from PSCmdlet, adds parameters, overrides processing methods, and creates a QueueClient using DefaultAzureCredential. He showed how the cmdlet reads a message with PeekMessage and writes the value to the PowerShell output stream.

In the final part, Emanuel described a base command class that shares queue-related parameters across multiple cmdlets, including support for parameter sets and cancellation handling through StopProcessing. He ended by showing the GitHub pipeline running build, integration tests with Azurite, and release steps, and he summarized the main lessons as dependency management, careful use of inheritance, and automation with community tools.

Chapters:
00:00:00 Building Open Source Modules in C# - Emanuel Palm - PSConfEU 2026
00:00:32 PowerShell Modules in C#
00:03:00 Module Types and Benefits
00:07:14 Tooling and Targeting
00:12:47 Sampler Build Setup
00:16:37 Project Structure Overview
00:21:24 Solution and Build Files
00:23:10 Starting the C# Module
00:28:19 Command Naming Questions
00:29:04 Queue Client Logic
00:35:50 Testing the Module
00:36:50 Base Command Inheritance
00:40:27 Pipeline Release Demo
00:42:41 Lessons and TakeawaysShow More

Building Open Source Modules in C# - Emanuel Palm - PSConfEU 2026

This session focused on building PowerShell modules in C# with ...

From Scripts to System Calls with PowerShell - Leo D'Arcy - PSConfEU 2026

PowerShell Conference EU June 1-4, 2026 Dorint Pallas Wiesbaden ...

PowerShell Conference EU
June 1-4, 2026
Dorint Pallas Wiesbaden
https://github.com/psconfeu/2026 (slides, code)

This session was about using PowerShell to call Windows APIs through pInvoke, moving from scripts to system calls. Leo Darcy introduces his ...background in Microsoft technologies, automation, remote access, and VPN-related work, and explains that the talk focuses on what a system call is and how PowerShell can reach the Windows API.

He first describes the Windows API as Win32, written in C, and explains that PowerShell reaches it through C# platform invoke. He outlines the chain from PowerShell to C# to pInvoke to the Windows API, and notes that this approach is different from the managed memory model used by PowerShell and .NET.

A first demo shows registering for group policy update notifications. Leo explains how he defines the pInvoke signature, loads it with `Add-Type`, creates an event handle, checks for errors, and waits in a loop until a policy update is detected. He uses this to show how callbacks and timeouts can be handled instead of polling on a fixed timer.

He then demonstrates enumerating VPN profiles stored on the machine. This example covers defining structures, constants, enums, memory allocation, and pointer handling. When the first allocation is too small, the API returns an error and reports the required size, after which the code reallocates memory, calls the function again, and converts the returned data into PowerShell objects.

Next, Leo shows how to start and stop a VPN connection. He defines the dial parameters, calls `RasDial`, receives a connection pointer, and then calls `RasHangUp` to disconnect. He also points out that Windows APIs can have quirks and that the documentation remarks sections are important.

The final demo enumerates attached displays. This example uses a callback-based API rather than a simple buffer. Leo explains the differences between the two monitor information structures, why the callback must return `true`, and how script scope is used so the collected monitor data can be accessed after enumeration.

He closes with practical guidance on using Microsoft documentation, SDK header files, and pInvoke.net, and warns that memory management, null values, and unmanaged boundaries can cause problems. He concludes that the Windows API is powerful but difficult to use from PowerShell, especially for deep development work.

Chapters:
00:00:00 From Scripts to System Calls with PowerShell - Leo D'Arcy - PSConfEU 2026
00:00:19 PowerShell API Basics
00:01:07 Windows API and PInvoke
00:05:17 Registering Group Policy
00:10:56 Enumerating VPN Profiles
00:20:54 Dialing the VPN
00:26:28 Display Enumeration Callback
00:36:37 Resources and Cautions
00:39:16 Memory and API Pitfalls
00:41:11 Wrap-Up and QuestionsShow More

IntuneStack - a CI/CD PowerShell workflow for managing Intune policy - Hailey Phillips - PSConfEU 26

PowerShell Conference EU June 1-4, 2026 Dorint Pallas Wiesbaden ...

PowerShell Conference EU
June 1-4, 2026
Dorint Pallas Wiesbaden
https://github.com/psconfeu/2026 (slides, code)

Hailey Phillips presents Intune Stack, a PowerShell tool designed to turn Intune administration into a CI/CD-style workflow. She introduces the problem as ...one of difficult change tracking, limited visibility into device state, and little ability to understand what changed, who changed it, or how a policy failure occurred.

She explains that common Intune workflows rely on manual portal edits, repeated clicking, and waiting for help desk reports before problems become visible. Hailey describes drift as a major issue, especially when policy changes are made without clear accountability or rollback options, and notes that the Intune Admin Center does not provide an undo mechanism.

Hailey then describes the mindset shift behind her approach: treating Intune like other infrastructure and using groups as deployment stages such as dev, test, and prod. She explains that the tool is built around components, where policies, group assignments, and status information are handled separately so that promotion decisions can be automated.

The talk then moves into the implementation of Intune Stack in PowerShell. Hailey walks through connecting to Microsoft Graph, retrieving groups and policies, mapping different policy types and endpoints, and collecting assignment and status data into logs and ordered objects. She also discusses using status codes and a success threshold to decide whether a policy should be promoted to the next group.

Hailey shows the resulting workflow, where a policy promotion job generates JSON output, checks success against a threshold, and can automatically promote a policy from one stage to the next. She explains that the current approach uses a single authentication module, federated credentials, and a simpler structure intended to be readable and adaptable.

In the Q&A, Hailey says the tool can be extended to settings catalog items that can be mapped, but some areas remain limited. She notes that versioning is handled by creating new policies rather than updating old ones, that some assignment scenarios are still future work, and that she is working on multi-tenancy support.

Chapters:
00:00:00 IntuneStack - a CI/CD PowerShell workflow for managing Intune policy
00:00:16 Intune as Code
00:01:45 Why Intune Hurts
00:04:26 Rethinking the Workflow
00:08:21 From Clicks to Groups
00:10:27 Building with Components
00:13:28 Introducing Intune Stack
00:13:57 Graph and Policy Mapping
00:18:10 Status and Promotion Logic
00:22:25 Live Demo Output
00:24:19 Promotion Workflow Details
00:27:33 Simplifying the Process
00:28:43 Audience Q&A
00:29:56 Thresholds and Success
00:30:56 Graph SDK Choices
00:33:28 Federated Authentication
00:35:01 Policy Deployment Approach
00:36:26 Versioning Limitations
00:37:55 Future EnhancementsShow More

Building security automation with PwshSpectreConsole - David Sass - PSConfEU 2026

This lecture introduces a PowerShell-based terminal user interface for ...

This lecture introduces a PowerShell-based terminal user interface for security work, built with Spectre.Console. David Sass explains that the project began as a small proof of concept and developed into ...a larger tool for working with incidents and alerts through the terminal. He says the aim was to create something faster and more usable than the Defender portal.

He then describes the reasons for building it, including the desire for better terminal UI tools on Windows and the need for more automated workflows. He says the current implementation uses supported Microsoft Graph commands in the background and can manage incidents, inspect alerts, assign items, and close or resolve incidents. He also notes planned work such as user actions, quarantine management, and more complex workflows.

The presentation includes a live demonstration of the interface. He shows navigation between incident lists, alert panels, details panes, and tabs using keyboard shortcuts. He also demonstrates selecting entities from alerts, moving to a hunting tab, running queries, and switching context between different areas of the application.

He then shows how incident resolution works, including choosing a classification, marking a case as false positive or not malicious, adding a comment, and confirming the action. He explains that these actions require the appropriate security operator role and delegated permissions. He also points out that the tool includes background prefetching, refresh indicators, and a help section with shortcut information.

A large part of the talk focuses on development and troubleshooting with Copilot and Pester. He says Copilot helped with planning, refactoring, logs, and tests, while Pester covers many functions in the project. He also discusses challenges with multithreading, input handling, logging, smaller screen layouts, and the limitations of using a terminal UI for this kind of work.

He ends by outlining future ideas such as mouse input, live investigations, offline caching, exportable queries, and additional workflow automation. He also mentions the project’s GitHub repository, the Spectre.Console resources, and that some features are still experimental or behind feature flags.

Chapters:
00:00:00 Building security automation with PwshSpectreConsole - David Sass - PSConfEU 2026
00:00:21 Sponsors and Speaker Intro
00:01:26 Why Build a Security TUI
00:05:13 Project Goals and Workflow
00:06:38 Demoing Incident Navigation
00:11:17 Resolving an Incident
00:13:40 Fast Background Updates
00:14:30 Copilot as Development Partner
00:18:40 UI Control Challenges
00:20:43 Logging and Diagnostics
00:24:34 Pester Tests and Refactoring
00:28:09 Copilot, Debugging, and TUI Limits
00:30:34 Troubleshooting with Logs
00:33:49 Sorting and Context Actions
00:36:26 Future Features and Caching
00:39:00 Resources and Closing Q&AShow More

No more passwords: The future is now! - Ben Reader - PSConfEU 2026

PowerShell Conference EU June 1-4, 2026 Dorint Pallas Wiesbaden ...

PowerShell Conference EU
June 1-4, 2026
Dorint Pallas Wiesbaden
https://github.com/psconfeu/2026 (slides, code)

In this session, Ben Reader discusses replacing passwords, client secrets and certificates with Workload Identity Federation. He explains that stored credentials can ...leak or expire, creating maintenance and security problems, and says the goal is to avoid putting secrets into source code, CI variables or build agents.

Ben then describes the federation model as a trust relationship between a workload and Azure. A workload proves its identity by requesting an OIDC token from an identity provider, exchanging it with Entra for a short-lived access token, and then using that token to access resources such as Microsoft Graph or Azure services. He emphasizes that nothing is stored long term and that the token is minted per run.

A major part of the talk is a demonstration of Azure DevOps Pipelines. Ben shows how to create a service connection that uses Workload Identity Federation, how Azure creates or uses an app registration, and how to copy the issuer and subject information into a federated credential. He then runs a pipeline that uses Azure PowerShell to request a Graph access token and list devices, without any client secret or certificate.

He next shows a similar setup in GitHub Actions. In this case, he explains that the federated credential can be scoped more precisely by branch, pull request, tag or environment. He demonstrates a failed configuration caused by a branch name mismatch, then shows a successful run that accesses Graph in the same way as the Azure DevOps example.

Ben also briefly shows the same pattern with an Azure function and a managed identity, noting that the approach can work across tenants and for system-to-system authentication. He answers questions about MFA, scoping and service-connection control, and ends by showing a PowerShell-built OIDC identity provider that exposes discovery, key and token endpoints for testing the same federation flow.

Chapters:
00:00:00 No more passwords: The future is now! - Ben Reader - PSConfEU 2026
00:00:22 Secrets Are Dead
00:02:23 Federated Trust Model
00:06:19 Linking Azure Trust
00:10:45 ADO Service Connections
00:16:15 App Registration Setup
00:19:56 Pipeline Token Demo
00:22:15 GitHub Conditions
00:27:12 Granular GitHub Scopes
00:29:36 Managed Identities
00:31:10 Building an OIDC Server
00:34:25 Cloudflare Tunnel Launch
00:35:02 Secure Local Issuer
00:37:43 Auditable Token Requests
00:40:12 Provider Compatibility
00:41:06 Branch and Tag Scoping
00:42:31 ADO Scoping LimitsShow More

Who Am I? Applied Tokenology for PowerShellers - Evgenij Smirnov - PSConfEU 2026

PowerShell Conference EU June 1-4, 2026 Dorint Pallas Wiesbaden ...

PowerShell Conference EU
June 1-4, 2026
Dorint Pallas Wiesbaden
https://github.com/psconfeu/2026 (slides, code)

This session focused on how PowerShell code can determine identity and authorization context before attempting an action. Evgenij introduced the topic as ...a way to ask “who am I,” “what can I do,” and “who called me,” especially for scripts that need to handle access decisions gracefully rather than fail with access denied errors.

The first part of the talk looked at identity and group membership. The speaker showed how Windows and .NET expose the current user through tools such as `whoami` and `WindowsIdentity.GetCurrent()`. They explained that the .NET identity object returns SIDs, claims, and other token data, while `whoami` can also show groups and privileges.

The talk then moved to claims and groups in Active Directory. Evgenij demonstrated resolving SIDs to group names, and showed that claims can include SID-based values, username-based values, and dynamic access control claims from AD. They also described how domain and resource-domain group membership appears differently depending on where access is being attempted.

A major section covered token simulation. The speaker explained that Windows authorization tokens are assembled where the resource is accessed, and that local, domain, and foreign-domain contexts can all change which groups are included. They showed how token group attributes can be queried in Active Directory, but warned that the name-based attributes are incomplete and that SIDs with later resolution are more reliable.

The speaker then discussed privileges and elevation. They showed how to query whether a process is interactive or elevated, and how to inspect the privileges present in a token using native Windows APIs. This included retrieving token privileges and resolving them to readable names.

The final part covered remoting and special logon types. The speaker demonstrated how a JEA endpoint can expose `PSSenderInfo` to identify the user who initiated a remote session. They also compared WinRM and SSH remoting, and ended with a net-only logon example, showing that under some conditions the username and password can be recovered from security logs or memory.

Chapters:
00:00:00 Who Am I? Applied Tokenology for PowerShellers - Evgenij Smirnov - PSConfEU 2026
00:00:26 Introduction and Sponsors
00:01:58 Agents Need Context
00:04:09 Tokenology Basics
00:07:47 Windows Identity and Claims
00:10:38 Resolving Group Names
00:12:02 Understanding Claims
00:14:01 Interactive and Elevated Checks
00:18:14 Token Assembly Across Domains
00:23:09 Simulating Authorization Tokens
00:29:48 Mapping Claims to Capabilities
00:33:22 Remoting Context and PSSenderInfo
00:38:50 SSH Remoting and Logon Types
00:41:59 NetOnly and Forensics
00:47:37 Extracting Credentials with MimikatzShow More

Reverse AI-ngineering - Raimund Andree, Thorsten Butz - PSConfEU 2026

PowerShell Conference EU June 1-4, 2026 Dorint Pallas Wiesbaden ...

PowerShell Conference EU
June 1-4, 2026
Dorint Pallas Wiesbaden
https://github.com/psconfeu/2026 (slides, code)

FOLLOW ALONG
🠂 This workshop is designed to enable you to carry out your own experiments.
🠂 To make things easier, we’ve cut ...out the exercise sections. Just pause the video at the relevant points.
🠂 Check out our repo with labs and examples:
~~~~~~~~~~~~~~~~~~~~~~~~
https://github.com/thorstenbutz/rai
~~~~~~~~~~~~~~~~~~~~~~~~

This workshop was presented by Raimund Andree and Thorsten Butz and introduces aigentic IDEs through a set of interactive labs. They outline three chapters: a beginner overview of AI tools, a section on AutomatedLab, and a final part about their own experience with agentic workflows. They also stress that the topic is changing quickly and that the material is intended as a starting point.

The first part explains what agentic IDEs are and how Visual Studio Code is extended by agents such as GitHub Copilot, Claude and other similar tools. They describe Claude CLI in plan mode, where the agent asks questions, creates files and can run code, and use this to show the difference between a chat interface and an agent that can interact with the local environment.

They then discuss token usage, context windows and cost. Using examples such as factorials, subnetting and summarising Leibniz’s work, they show that simple tasks are easy for models, while longer prompts and larger contexts increase cost and complexity. They recommend short prompts and using links or summaries where possible.

A later section focuses on AutomatedLab, which they describe as a tool for deploying lab environments on Hyper-V, Azure and other platforms. They explain that it abstracts underlying technologies, can create complete Windows lab environments, and can help reverse-engineer older scripts or map Azure names and SKUs back to the code.

In the final part, they describe memory banks, skills, agents and instructions as the main building blocks for controlling AI work. They emphasise spec-driven development, testing, isolation and keeping the agent’s access within a lab environment. They conclude that AI can help a great deal, but that users still need to understand the tools, review the output and manage the workflow carefully.

Final note: Background music was accidentally mixed into the recording at two very brief points. This was not intentional, and we apologise for the inconvenience.

Chapters:
00:00:00 Reverse AI-ngineering - Raimund Andree, Thorsten Butz - PSConfEU 2026
00:00:19 Prologue
00:08:10 Chapter 1: AI basics
00:14:52 Demo: Claude CLI
00:25:00 Lab 1
00:26:17 Prompt Cost Lessons
00:30:42 Chapter 2: AutomatedLab
00:37:11 Agentic AI Explained
00:38:36 Demo: Aigentic
00:42:20 Editor Setup and Keys
00:43:10 Demo: Setting up GH Copilot
00:46:26 Lab 2
00:49:28 Token Economics
00:52:48 Spec-Driven Development
00:58:13 Memory Banks Explained
01:01:44 Skills, Agents, Instructions
01:06:44 Frontmatter and Sandbox
01:10:43 Final takeaways
01:13:06 Lab 3
01:15:23 Q&AShow More

Optimizing Visual Studio Code for PowerShell, 2026 Edition - Justin Grote - PSConfEU 2026

PowerShell Conference EU June 1-4, 2026 Dorint Pallas Wiesbaden ...

PowerShell Conference EU
June 1-4, 2026
Dorint Pallas Wiesbaden
https://github.com/psconfeu/2026 (slides, code)

Justin Grote presents an updated overview of Visual Studio Code for PowerShell, focusing on recent changes that affect day-to-day use. He explains ...that the talk is part of an ongoing series on what has changed in VS Code and the PowerShell extension, and says the goal is to narrow the large amount of new information down to what is most useful.

A major topic is how the PowerShell extension works. Justin describes VS Code’s Electron-based architecture, the extension host, and the PowerShell Editor Services layer that connects VS Code to a PowerShell process through the Language Server Protocol. He also explains that the same services can be used by other editors, including NeoVim and Zed, and gives an overview of VS Code remoting through tunnels and other remote connection methods.

Justin then covers the weekly release cadence of VS Code and notes that updates now arrive more often than before. He also introduces a preview release of the PowerShell extension that adds rename support for variables and functions within a single file. He explains the limits of this feature, including scope handling and the lack of function alias generation, and shows how it is intended for quick refactoring rather than large cross-file changes.

Another section discusses the updated `PSEditor` object model and the `workspace` and `documents` members that expose open files and related actions. Justin also demonstrates the new terminal IntelliSense experience in VS Code, which differs from PSReadLine and can be disabled if desired. He then introduces Spectre, a faster alternative to PSScriptAnalyzer, and says it can be used as a separate extension or module.

Later, Justin shows that the PowerShell extension is now available in Open VSX for use in forks of VS Code, and that Zed has native PowerShell support through PowerShell Editor Services. He also highlights newer VS Code features such as native Mermaid preview support and the integrated browser. Finally, he demonstrates using VS Code CLI tunnels in Azure Cloud Shell and GitHub Actions to open a full VS Code session for interactive debugging, and ends with guidance on troubleshooting startup issues and reading logs.

Chapters:
00:00:00 Optimizing Visual Studio Code for PowerShell, 2026 Edition - Justin Grote - PSConfEU 2026
00:00:22 Sponsors and Intro
00:00:55 Extension Series Overview
00:03:24 PowerShell Extension Architecture
00:10:31 Remote Development Basics
00:12:18 Demo Roadmap and Questions
00:13:17 VS Code Weekly Releases
00:15:25 Rename Support Arrives
00:24:52 Rename Edge Cases
00:29:47 PSEditor Workspace Access
00:34:16 Terminal IntelliSense Changes
00:38:10 Faster Spectre Analysis
00:43:03 VS Code Forks and Zed
00:47:08 Zed and PowerShell Support
00:50:11 Mermaid and Integrated Browser
00:54:03 Browser Control and Spectre CLI
00:58:32 VS Code CLI and Tunnels
01:03:13 GitHub Action Debugging
01:11:12 Rename Support Internals
01:18:12 PowerShell Terminal Lockups
01:25:14 Startup Troubleshooting and LogsShow More

2026

Building Open Source Modules in C# - Emanuel Palm - PSConfEU 2026

Have a look at the PSConfEU 2026 schedule!

Like this:

Contact info

Additional links

2026

Building Open Source Modules in C# - Emanuel Palm - PSConfEU 2026

Have a look at the PSConfEU 2026 schedule!

Share this:

Like this: