The Password of the items in the Credentials.PasswordList property of an entry is now always empty, because reading it there cannot be logged; scripts that read it get an empty string
New features
4
Added Get-DSVaultTemplateSummary to list the vault templates of a Devolutions Server
Added Get-RDMCurrentPrincipal to identify the current user or application identity
Added Get-RDMEntryRunningState to fetch info about currently running sessions
Added Get-RDMMyAccountSetting and Set-RDMMyAccountSetting to read and change the current user's My account settings, including external credential providers such as Delinea Secret Server, CyberArk, KeePass and Bitwarden
Improvements
6
Added -PasswordListItemID to Get-RDMEntryPassword and Get-RDMEntryUsername to read a specific item of a Password List entry or of an entry that references one, with a PasswordListItemNotFound error when the item is not one of the items the entry selects
Get-RDMEntryPassword and Get-RDMEntryUsername now raise a PasswordListItemRequired error that names -PasswordListItemID and lists the items when a Password List has several items, no item is given and the session cannot prompt, instead of the generic "An unexpected error occurred" error
Get-RDMEntryPasswordListItem now writes a password viewed log entry for each item whose password it returns, and asks for the comment and ticket number when the entry requires them, or accepts them through the new -Comment and -TicketID parameters
Get-RDMEntryPasswordListItem now writes a warning when the item passwords are returned empty because the user does not have the "copy password" right
Improved the performance on a Devolutions Cloud workspace with an application identity by removing unneeded calls to retrieve the current user
New-DSVault now accepts -VaultTemplateId to create a vault from a vault template
Fixes
6
Fixed Get-DSActivityLog, Get-DSAdministrationLog, Get-DSLoginAttempt, Get-DSPamPasswordRotationLog, Get-DSPasswordsReport, Get-DSVault, Get-DSEntry, Get-DSUser, Get-DSUserGroup, Get-DSDeletedUser, Get-DSDeletedUserGroup and Get-DSPamAccount failing with a JSON error when the session was opened with New-DSSession -UseOAuth or -WindowsAuthentication
Fixed Get-DSPamPasswordRotationLog ignoring the -DateFilter, -After and -Before parameters
Fixed Get-RDMEntryCredentials wrongly returning certain credential modes as CredentialEntry
Fixed Get-RDMEntryOTPKey returning empty when the OTP comes from a credential in another vault
Fixed the module giving "Could not obtain data source settings" error when connecting to DVLS with OAuth when no application identity data was provided
Get-RDMEntryUsername now logs "Username was read in PowerShell" with the same log type as the RDM desktop client, instead of "Copied username to clipboard"
Added Get-RDMSshAlgorithmSupport and Set-RDMSshAlgorithmSupport cmdlets to read and write the SSH Algorithm Support settings (cipher, host key, key exchange and MAC) in the configuration
Added Start-RDMDebugLog and Stop-RDMDebugLog to write the debug log of the current session to the given file, for every debug level or only the ones given with -Level
Added Test-RDMPassword to check a password against a password policy
Improvements
5
Added -ExpirationDate parameter to New-DSUser to set a user's expiration date
Added -PasswordPolicy and -PasswordComplexity parameters to New-DSCredentialEntry and New-DSSSHShellEntry to assign a password policy to the new entry and set how a non-compliant password is handled
Added -Policy parameter to New-RDMStandalonePassword to generate a password from a password policy object
Added "Contractor" to the available -AuthenticationType values in New-DSUser
Start-RDMProfiler now writes each line to its -Path file immediately, so the file keeps every line logged before the process crashes or is stopped
Fixes
1
Fixed Get-RDMPasswordPolicy failing to return the password policies of a Devolutions Cloud workspace
Added Get-RDMImportableUserGroup to discover the user groups an identity provider makes available for import
Added Import-RDMUserGroup to import user groups discovered from an identity provider
Improvements
5
Added -ExpirationDate to New-RDMUser to set a user's expiration date
Added the OfflineMode and AllowDragAndDrop properties to users returned by Get-RDMUser
Description on a user is now derived from FirstName and LastName, so it reflects changes to those properties immediately rather than only after the user is saved and retrieved again
Improved error messages on Set-RDMVault, New-RDMVault, Set-RDMCloudVaultAccess, Remove-RDMCloudVaultAccess, and Import-RDMVault to include Devolutions Server's specific reason when a vault save fails and one is available, instead of always showing a generic message
Read-RDMEntry is now an alias of Import-RDMEntry
Fixes
12
Assigning to Description on a user returned by Get-RDMUser now raises a read-only property error, instead of succeeding with no effect
Fixed a hang and stack-overflow crash when Devolutions Server rejected the session right after an application key login
Fixed Azure workspaces with Active Directory Interactive logins throwing 'Required framework .NET 4.7' errors on connection
Fixed Get-RDMEntryOTP failing to fetch the OTP code of PAM entries
Fixed Get-RDMEntryOTPKey failing to fetch the OTP key of PAM entries
Fixed Get-RDMUserGroupVaultAccess preventing queries of vaults the provided user group does not have access to
Fixed Get-RDMUserVaultAccess preventing queries of vaults the provided user does not have access to
Fixed New-RDMUser disabling -Password for Contractor-type users
Fixed New-RDMVault -VaultTemplate throwing NotImplementedException and leaving an empty vault on SQL Server workspaces
Fixed Set-RDMEntry and Move-RDMEntry checking PAM entry rules against a vault's previous security level after that level was changed with Set-RDMVault in the same session
Fixed Set-RDMEntryOTP failing to set OTP settings for PAM entries
Set-RDMUserProperty now warns that the value was not set when -Property "Description" is used on a user, instead of reporting success and discarding the value on save
Get-DSPamFolder is deprecated and no longer available for Devolutions Server workspaces past version 2026.3.0; users should instead use Get-DSFolder or Get-DSFolders
Legacy Website entries can no longer be edited before being converted to modern Website entries
Removed deprecated parameters ResetPasswordOnCheckIn, UnmanagedAction, and Unmanaged in Import-DSPamScanResult
New features
24
Added Add-RDMForbiddenPasswordList to add a forbidden password list
Added ConvertTo-RDMEntryXml to serialize a live entry (from Get-RDMEntry) or a historical version (from Get-RDMEntryHistory) to XML
Added Enable-DSPamProviderSelfRotation to convert a PAM provider's own username/password into a server-managed, self-rotating PAM account
Added Get-DSAdministrativeRole, Add-DSRoleAssignment, Get-DSRoleAssignment, Remove-DSRoleAssignment, and Get-DSPrincipalRoleAssignment to look up, grant, and revoke Devolutions Server administrative role assignments at vault, gateway, PAM provider, organizational unit, or global scope (requires a workspace running 2026.3.0 or later)
Added Get-RDMAdministrativeRole, Add-RDMRoleAssignment, Get-RDMRoleAssignment, Remove-RDMRoleAssignment, and Get-RDMPrincipalRoleAssignment for managing role assignments through an active RDM/RDMS data source connection
Added Get-RDMEntryCheckOut to fetch an entry's current check-outs
Added Get-RDMEntryHistory to list an entry's version history, newest first; accepts a PSConnection via pipeline or -InputObject, and requires a workspace that supports version history
Added Get-RDMForbiddenPasswordList to fetch forbidden password lists
Added Get-RDMImportableDomain to discover the domains an identity provider makes available for import
Added Get-RDMImportableUser to discover the users an identity provider makes available for import
Added Get-RDMTicket to retrieve tickets from a ticketing service selected via -ServiceName or -ServiceId (defaulting to the highest-priority one), emitting each ticket's Code, Summary, Priority, Status, Description, Assignee, and Url
Added Get-RDMTicketingService to list the log-enabled ticketing services configured on the current data source (Name, Id, ServiceType, Priority), never returning stored credentials
Added Get-RDMUserTags to allow fetching user tags
Added Get-RDMUserTemplate to retrieve the user template (default settings for new users) from a workspace's system settings
Added Get-RDMVaultTemplate, New-RDMVaultTemplate, Set-RDMVaultTemplate, and Remove-RDMVaultTemplate to manage vault templates on Devolutions Server and Devolutions Hub
Added Import-RDMUser to import users discovered from an identity provider
Added Invoke-RDMUserCleanup to clean up users that no longer match their identity provider
Added Remove-RDMEntryHistory to delete specific version(s) of an entry's history, or all versions of one or more entries; requires administrator or vault-owner rights and a workspace that supports deleting version history (Hub Business is not supported)
Added Remove-RDMForbiddenPasswordList to remove a forbidden password list
Added Restore-RDMEntryHistory to revert a live entry to a version obtained from Get-RDMEntryHistory, preserving the entry's password history and restoring any embedded document from that version; supports -PassThru to return the reverted entry
Added Set-RDMForbiddenPasswordList to modify a forbidden password list
Added Set-RDMUserTags to allow updating user tags
Added Sync-RDMUser to synchronize users from providers
Added Sync-RDMUserGroup to synchronize user groups from providers
Improvements
30
Added -AllowCheckoutExtensions parameter to New-DSPamCheckoutPolicy and Update-DSPamCheckoutPolicy to enable allowing or disabling checkout extensions on a policy
Added -CheckOut parameter to Invoke-RDMEntryCheckIn to force the check-in of specific user check-outs
Added -JitAccountMode parameter to New-DSPamAccount and Update-DSPamAccount, adding a new EnableDisable JIT mode that references an existing DomainUser or AzureADUser account instead of creating one, enabling it and adding it to configured groups on checkout, and disabling it and removing it on check-in
Added -MaxCheckoutTime parameter to New-DSPamCheckoutPolicy and Update-DSPamCheckoutPolicy to enable setting a policy's maximum checkout time
Added -MaxExtensionTime parameter to New-DSPamCheckoutPolicy and Update-DSPamCheckoutPolicy to enable setting a policy's maximum extension time
Added -RequireApprovalForExtensions parameter to New-DSPamCheckoutPolicy and Update-DSPamCheckoutPolicy to enable setting a policy's extension approval behavior
Added -Resolved parameter to Get-DSPamCheckoutPolicy to return the effective global-default value for any policy setting left at its default
Added -Tag parameter to Get-RDMUser to allow filtering returned users by their tags
Added -UserType, -HasUserVaultAccess, -Language, -OfflineMode, -AllowDragAndDrop, -PasswordManagerOfflineMode, -AllowApiKey, -DefaultVault, and -PassThru parameters to Edit-RDMUserTemplate, alongside the existing -AddVault/-RemoveVault
Added a -VaultTemplate parameter to New-RDMVault to create a new vault pre-populated from an existing vault template on Devolutions Server and Devolutions Hub
Blocked deletion of the currently-selected vault by Remove-RDMVault, which now raises an error
Changed Edit-RDMUserTemplate to raise a catchable error on workspaces that don't support user templates (e.g., Hub, local), instead of silently warning and doing nothing
Deprecated the -Workspace parameter on Edit-RDMUserTemplate; the cmdlet now operates on the current workspace by default, and using -Workspace emits a warning
Emits a warning and returns $null from Get-RDMCommand -Tool SSH instead of a file path, since SSH is no longer bundled
Invoke-RDMEntryCheckOut and Invoke-RDMEntryCheckIn now issue a single batched request for all entries piped through in one call instead of one request per entry on Devolutions Server workspace
IsJitAccount on New-DSPamAccount is deprecated in favor of -JitAccountMode CreateDelete; it still works, but now emits a deprecation warning
Marked Get-RDMForbiddenPassword and Set-RDMForbiddenPassword as deprecated
New-DSPamProvider and Update-DSPamProvider now accept a -LinkedCredential parameter to link an existing PAM account (from Get-DSPamAccount) as the provider's credential instead of a Username/Password pair; the cmdlet raises a catchable error if the supplied object is not a PAM account
New-DSPamProvider now returns the created PamProvider object instead of returning nothing
New-DSVault, Update-DSVault, and New-DSPamVault now emit a warning instead of failing when their -User, -UserGroup, or -Application parameters can't be applied because the workspace uses the role-assignment model; the vault operation itself still succeeds
On Devolutions Server workspaces running 2026.3.0 or later, Add-/Remove-RDMUserVaultAccess and Add-/Remove-RDMUserGroupVaultAccess simply assign or unassign the Vault User role on that vault instead of writing to the legacy per-vault list, and warn, naming the role, if the target still has access through another role assignment after a revoke
PSConnectionHistory now includes a HistoryTypeDescription property showing what kind of change it was (Update, Insert, Delete, Restore, or Move)
RDM license cmdlets now work on Hub data sources
RDM user cmdlets now work on Hub data sources
RDM user group cmdlets now work on Hub data sources
Remove-RDMDeletedEntry now raises a targeted error when a piped-in history record is not a deleted-entry record (i.e., not obtained from Get-RDMDeletedEntry), instead of processing it silently
Set-DSVaultUser, Set-DSVaultUserGroup, Set-DSVaultApplication, and Get-DSVaultPermission now raise a clear error directing callers to the new role-assignment cmdlets when run against a workspace that has switched to the role-assignment model, instead of appearing to succeed while doing nothing
Set-RDMEntry and Set-RDMEntryPassword now validate forbidden passwords
Update-DSPamAccount can now switch an existing account's JIT mode between None and EnableDisable, which it previously couldn't change at all after creation. CreateDelete remains settable only at creation (New-DSPamAccount) and can't be changed once set
Update-DSPamProvider now emits a warning when a -LinkedCredential switch will delete the provider's current self-rotation-managed account
Fixes
7
Fixed a TypeLoadException when authenticating to Microsoft Graph (Connect-MgGraph) after importing Devolutions.PowerShell, caused by a conflict between bundled Azure/Graph/Identity assemblies
Fixed Bitwarden synchronizers warning with "The Bitwarden synchronizer is not supported." on Open-RDMSyncEntry
Fixed bug in Invoke-RDMEntryCheckOut where folders couldn't be checked out if one of their children was checked out
Fixed New-DCEntry not persisting document attachment metadata when using -DocumentPath parameter
Fixed Rename-RDMGroup allowing a folder to be renamed to a name that collides with an existing sibling or descendant group
Fixed Set-RDMEntry and New-RDMFavoriteFolder's duplicate-folder-name check missing collisions with folders hidden from the user by permissions
Fixed Set-RDMEntryCredentials reporting a user vault entry's previous credential mode instead of the mode just set (e.g. Inherited) when the entry was queried again in the same PowerShell session
Fixed a TypeLoadException when authenticating to Microsoft Graph (Connect-MgGraph) after importing Devolutions.PowerShell, caused by a conflict between bundled Azure/Graph/Identity assemblies
Fixed New-DCEntry cmdlet not persisting document attachment metadata when using -DocumentPath parameter
Export-RDMActivityLogsReport and Export-RDMEntrySecurityAnalyzerReport now write correct CSV/XML column headers when the RDM UI language contains accented or non-ASCII characters
Fixed Get-DSEntriesPermissions attempting to get permission info for virtual folders
Fixed Get-DSEntry causing null reference exceptions when called with an ID matching no entry
Get-DCGatewaySettings renamed to Get-DCDevoGatewaySettings
New-DCGateway renamed to New-DCDevoGateway
New-DCGatewaySettings renamed to New-DCDevoGatewaySettings
Remove-DCGateway renamed to Remove-DCDevoGateway
Set-DCGateway renamed to Set-DCDevoGateway
Set-DCGatewaySettings renamed to Set-DCDevoGatewaySettings
New features
9
Added Add-RDMEntryPasswordListItem to add password list items to a Password List entry
Added Get-DSDeletedUserGroup to fetch deleted user groups from Devolutions Server
Added Get-RDMEntryParameter, Add-RDMEntryParameter, Set-RDMEntryParameter, and Remove-RDMEntryParameter cmdlets to read and manage command-line parameter values
Added Get-RDMEntryPasswordListItem to fetch password list items from a Password List entry
Added New-RDMPasswordListItemCustomField to create custom fields which can be added to Password List entry items
Added Remove-DSDeletedUserGroup to permanently remove deleted user groups from Devolutions Server
Added Remove-RDMEntryPasswordListItem to remove password list items from a Password List entry
Added Restore-DSDeletedUserGroup to restore deleted user groups on Devolutions Server
Added Set-RDMEntryPasswordListItem to modify password list items on a Password List entry
Improvements
3
Added -ID parameter to Get-RDMUser and Get-RDMUserGroup
Exposed Parameter1DataType through Parameter5DataType and ExtraParametersData on the Cmd object returned by Get-RDMEntry, so scripts working with $entry.Cmd directly can now read and change a parameter's type, not just its default value
Renamed Export-RDMPasswordAnalyzerReport to Export-RDMEntrySecurityAnalyzerReport (old name still works but emits a deprecation warning)
Fixes
3
Fixed -Attachment parameter on Update-RDMEntryDocument quietly wiping data when attachment filename is unavailable
Fixed Export-RDMEntrySecurityAnalyzerReport automatically correcting a missing file extension with a warning when -Path is provided without one
Fixed Export-RDMPasswordAnalyzerReport HTML export crashing with an unhelpful message
Added Protect-RDMEntry cmdlet to seal credential and document entries on Devolutions Server; replaces the previous pattern of setting SealState on the entry object
Added Remove-DSGatewayFarm to remove gateway farms
Improvements
8
Added -UseEntryPasswordPolicy and -PasswordPolicy parameters to Export-RDMPasswordAnalyzerReport to evaluate the compliance of passwords against a password policy
Added deprecated warning to Start-RDMInstance
Improved error message when providing a wrong vault ID across multiple cmdlets: Get-DSEntry, Get-DSFolders, Get-DSRootEntry, Get-DSPamFolder, and Get-DSEntriesPermissions
Invoke-RDMParentEntry now supports -WhatIf and -Confirm
Invoke-RDMUnparentEntry now supports -WhatIf and -Confirm
Set-RDMEntry now raises a catchable error when the target entry is sealed, instead of silently downgrading the seal state
Set-RDMEntryStatus now accepts Archived and Broken as valid -Status values, matching the statuses available in the Devolutions Remote Desktop Manager client
Unprotect-RDMSealedEntry now raises a catchable error when the unseal operation fails on the server, instead of emitting a warning
Fixes
10
Fixed a crash when wildcard entries (e.g., *.example.com) were present in the custom proxy bypass list
Fixed an issue where the -Entry parameter in New-RDMRandomPassword was not using the correct inherited password policy when the entry's complexity was set to inherit from its parent folder
Fixed cmdlet aliases (for example Get-RDMDataSource) not being recognized in a new session until the module was explicitly imported
Fixed Get-RDMDiagnostic always returning false for IsLicenseValid and empty for LicenseType
Fixed Get-RDMEntryDocument throwing parameter set error when using -CaseSensitive with -LiteralName
Fixed New-RDMEntryDocumentation throwing NullReferenceException on SQLite
Fixed New-RDMRandomPassword throwing a NullReferenceException when the entry's password complexity policy resolves to the root in workspaces not supporting it
Fixed New/Set/Remove-RDMEntryDocumentation not running security checks on the appropriate vault
Fixed Set-RDMEntry, Set-RDMEntryStatus, Set-RDMEntryOTP, Set-RDMEntryPrivateKey, Set-RDMEntryPrivateKeyCertificateData, and Set-RDMPlaylistShared incorrectly mutating the in-memory object when -WhatIf was
Fixed Set-RDMEntryDocument not properly updating Phonebook entries
Raised minimal powershell version to 7.6 to use the module
New features
1
Added a new Update-RDMOption cmdlet to reload module options when a concurrent RDM instance has modified them
Improvements
19
Added -DefaultElevationGroupID to New-DSPamAccount to save default JIT elevation group identifiers (AD SIDs or Entra ID object IDs) on a PAM account at creation time
Added -DefaultElevationGroupID to Update-DSPamAccount to replace or clear the saved default
Added -Detailed switch to Get-DSPamAccount to retrieve full account data for all accounts in a single bulk call, equivalent to fetching each account individually with -AccountID
Added -ElevationGroupID to Invoke-DSPamCheckout: omit to auto-apply the account's saved default, supply identifiers to override, or pass @() to skip JIT elevation entirely even when a default is configured
Added -PageSize parameter to Get-DSPamAccount to control how many accounts are fetched per request when retrieving bulk results (default: 500)
Deprecated the -HubPersonal parameter in New-RDMDataSource
Export-RDMEntry now accepts entries as pipeline input
Improved Get-RDMWorkspaceCustomVariable and Set-RDMWorkspaceCustomVariable cmdlets to correctly enumerate and consume pipeline objects
Invoke-DSPamCheckout now accepts a -MfaCode parameter (string or SecureString via PSPassword) to satisfy MFA-on-checkout policies; the cmdlet automatically resolves the user's configured TOTP authenticator, and the code can be retrieved from a stored OTP entry using Get-DSEntryOTP
New-DSPamCheckoutPolicy and Update-DSPamCheckoutPolicy now support a -CheckoutMFAMode parameter to configure MFA enforcement on PAM checkout (Default, None, Mandatory, or MandatoryOnElevationOnly)
Removed version management configuration prompt when upgrading a data source
Renamed -HubBusiness to -Cloud on New-RDMDatasource and *-RDMHubVaultAccess cmdlets to *-RDMCloudVaultAccess (old names kept as aliases)
Renamed "connection" and "session" to "entry" across cmdlets, parameters, and documentation
Renamed "data source" to "workspace" across cmdlets, parameters, and documentation
Renamed "password template" to "password policy" across cmdlets, parameters, and documentation
Renamed "repository" to "vault" across cmdlets, parameters, and documentation
Renamed "role" to "user group" across cmdlets, parameters, and documentation
Renamed "virtual gateway" to "ruleset" across cmdlets, parameters, and documentation
Update-RDMEntries no longer reloads options
Fixes
5
Fixed a null-reference exception in New-DSPamCheckoutPolicy and Update-DSPamCheckoutPolicy when the server returned an error response
Fixed Export-RDMActivityLogsReport - -After/-Before parameters now honor time-of-day instead of being truncated to whole-day boundaries
Fixed recently created users not being fetched by Add-RDMRoleToUser for its -UserName parameter
Fixed Set-RDMEntry failing with "The entry is checked out" when saving a new entry with manual checkout mode
Fixed Update-DSPamCheckoutPolicy throwing an argument exception when -Name was omitted while supplying other parameters
Added ConvertFrom-RDMWebsiteLegacyEntry to convert legacy website entries to the modern website entry type
Added Get-DSActivityLog cmdlet to retrieve activity log entries from Devolutions Server with date range and user filtering
Added Get-DSAdministrationLog cmdlet to retrieve administration log entries from Devolutions Server
Added Get-DSPamLog cmdlet to retrieve PAM log entries from Devolutions Server, with support for filtering by message type
Added Get-DSPamPasswordRotationLog cmdlet to retrieve PAM password rotation log entries from Devolutions Server
Added Get-RDMVaultCustomVariable to retrieve a vault's custom variables
Added New-RDMVaultCustomVariable to add a custom variable to a vault
Added Remove-RDMVaultCustomVariable to remove custom variables from a vault
Added Set-RDMVaultCustomVariable to modify a vault's custom variables
Improvements
2
Added Scope and Before parameters to Remove-RDMDeletedEntry to enable mass-removing deleted entries before a given time
Updated cmdlet help for Update-DSEntryBase and New-DSEntryBase to recommend -Depth 10 when piping entries through ConvertTo-Json, preventing a type conversion error on deep properties such as lifecycle policy actions
Fixes
3
Fixed Devolutions.PowerShell.Extension already loaded preventing the import of Devolutions.PowerShell
Fixed Invoke-RDMEntryCheckOut preventing checkouts for entries set to multiple/infinite checkouts
Fixed Set-RDMEntryProperty with WhatIf still modifying property of entry
Added -AlwaysAskForOldPassword parameter to New-RDMRepository and Set-RDMRepository to require the current master password to be verified before it can be changed or cleared
Added -MasterPassword parameter to New-RDMRepository and Set-RDMRepository to protect the vault with a password
Added -OldMasterPassword parameter to Set-RDMRepository to supply the current master password when changing or clearing it on a vault with 'Always ask for old password' enabled
Added -Owners parameter to New-RDMRepository and Set-RDMRepository to assign vault owners
Added -SortPriority parameter to New-RDMRepository to set the vault's sort priority
Added -VaultSecurityLevel parameter to New-RDMRepository and Set-RDMRepository to set the security level of the vault (DVLS only)
Added -Visibility parameter to New-RDMRepository to control who can request access to the vault
Improved PSRepositoryInfo format to enable direct modification of more vault properties: AlwaysAskForOldPassword, ContentType, Owners, SortPriority, VaultSecurityLevel, and Visibility
Fixes
3
Fixed an issue where Get-RDMOAuthToken would throw a type initializer exception for System.Text.Json.JsonSerializer
Fixed DPS cmdlets failing on Linux with "Microsoft.Data.SqlClient is not supported on this platform"
Fixed Export-RDMOptionFile -Datasources clearing datasource credentials from the current option file silently
Fixed an issue where the -DeobfuscateSensitives parameter of Export-HubEntriesForExport had no effect when exporting entries to CSV, causing passwords to remain encrypted
Removed support for Dropbox and Google Drive data sources. New-RDMDataSource no longer allows creating these types
New features
11
Added Convert-DSGatewayKDCProxySettings to extract KDC proxy settings from a gateway
Added Enable-RDMTelemetry and Disable-RDMTelemetry cmdlets to control anonymous usage statistics collection in the PowerShell module
Added Get-DPSDatabaseVersion to retrieve the Devolutions Server database version
Added Get-DSLoginAttempt to retrieve login attempts
Added Get-RDMEntryPrivateKeyCertificateData cmdlet to retrieve embedded SSH certificate data as SecureString or plain text
Added Get-RDMEntryTags to retrieve an entry's tags
Added New-DSGatewayKDCProxySettings to create KDC proxy configuration objects
Added New-DSGatewaySecurity to create GatewaySecurity objects
Added Set-RDMEntryPrivateKeyCertificateData cmdlet to set embedded SSH certificate data and automatically configure the certificate type to Data
Added Set-RDMEntryTags to modify an entry's tags
Added Start-DSTrial cmdlet to activate a Devolutions Server trial license
Improvements
14
Added -AsHandbook parameter to Get-RDMEntryDocumentation to return legacy PSHandbook format for backward compatibility
Added -Filter parameter to Get-RDMEntryDocumentation to search both title and content for backward compatibility
Added -NoEnumerate switch parameter to Invoke-RDMLoadFromInventorySession to optionally return results as a collection instead of individual objects
Added -PassphraseMaximumLength parameter to set a maximum length limit (0-100 characters) for generated passphrases in New-RDMRandomPassword
Added support for appending special characters to passphrase words in New-RDMRandomPassword to better meet password complexity requirements
Added support for using a raw database connection string in DPS cmdlets
Added warning when a user without a license connects to a SQL Server data source
Aliased redundant Session cmdlets to their equivalent Entry cmdlets (e.g., Get-RDMSession is now an alias of Get-RDMEntry)
Improved error messages when creating entry types that are not supported in certain vaults
Improved RDMEntryDocumentation cmdlets to provide clear error messages for unsupported data sources
Renamed -PassphraseLength parameter to -WordCount for clarity (the old parameter name still works as an alias) in New-RDMRandomPassword
Reworked telemetry collection in the PowerShell module to track anonymous usage statistics (cmdlet names, module version, data source type, and platform information)
Updated gateway cmdlets (New/Update for Gateway, VirtualGateway, and GatewayFarm) to accept the Security parameter
Updated New-DSGateway and Update-DSGateway to accept KDC proxy settings with the KdcProxySettings parameter
Fixes
9
Fixed a null reference exception when using Set-RDMEntryDocumentation on a SQLite data source
Fixed an issue where multiple cmdlets incorrectly allowed the root entry to be provided
Fixed an issue where the Get-RDMEntry cmdlet would incorrectly return entries when the required license was not available
Fixed Get-DSEntry forcing users to provide a VaultID when -SearchAllVaults is specified
Added Get-DSDeletedUser and Get-RDMDeletedUser cmdlets to retrieve paginated list of deleted users (Devolutions Server only)
Added Get-RDMForbiddenPassword to retrieve forbidden passwords
Added Remove-DSDeletedUser and Remove-RDMDeletedUser cmdlets to permanently remove deleted users (Devolutions Server only)
Added Remove-RDMPlaylistLocal to remove local playlists
Added Remove-RDMPlaylistShared to remove shared playlists
Added Restore-DSDeletedUser and Restore-RDMDeletedUser cmdlets to restore deleted users (Devolutions Server only)
Added Set-RDMForbiddenPassword to update the forbidden password list
Fixes
3
Fixed "Not Implemented" exception when moving entries to an existing folder - users are now prompted to merge the folders or create copies
Fixed checkout validation logic that was incorrectly blocking all move operations with a "checkout active" error, even when no entries were checked out by other users
Fixed Open-RDMSession causing an unexpected guid format in Remote Desktop Manager
Added Backup-DPSConfigurationFile and Backup-DPSInstallationFiles to backup DVLS files before updates
Added Get-DPSProduct to download the latest DVLS version for Linux or Windows
Added Restore-DPSConfigurationFiles, Restore-DPSCustomFolders, and Restore-DPSAnomalyDetectionFolder to restore DVLS files after updates
Added the IsDefault property to PowerShell data source objects, allowing users to easily identify which data source is configured as the default when using cmdlets like Get-RDMDataSource
Export-RDMSession now adds the extension of the chosen format automatically
Fixes
2
Fixed bug where Update-DSPamFolder would create a virtual folder on name update
Fixed issue where cmdlets used in a Linux context could not find the appsettings.json file due to case sensitivity
Create a new PSPamPropScriptConfiguration object, which can be utilized to define the parameters for a PAM script configuration, with New-DSScriptConfiguration
Retrieve a PAM AnyIdentity template by its name using Get-DSPamProviderTemplate
Retrieve a specific PAM script configuration by its ID using Get-DSScriptConfiguration
Retrieve a specific PAM script configuration template by ID using Get-DSScriptTemplate
Return a summary of all PAM script configuration templates using Get-DSScriptTemplateSummary
Return a summary of all PAM script configurations using Get-DSScriptConfigurationSummary
Save a specified PAM script configuration using Set-DSScriptConfiguration
Improvements
1
Enable Hub application identities to utilize the Import-RDMVault cmdlet with the appropriate permissions
Fixes
3
Fixed all license assignments that are missing when the user is not an administrator when using Get-RDMLicense
Fixed DS cmdlets failing with the WebApiRedirect status
Fixed New-RDMEntry cmdlet ignoring the VaultMode parameter
Get-DSPamScanResult now returns a unified object across all result types, with certain properties either missing or renamed (upn => UserPrincipalName, FullName => Name) (HostID, DomainName, ADDomainID, AlreadyCreated, CanBeAdded are all removed)
Get-RDMEntryOTPKey requires an administrator or vault owner to use as it is required in RDM
New features
4
Add Export-RDMX509Certificate cmdlet to export the certificate of an X509 certificate entry
Add Import-RDMX509Certificate cmdlet to import the certificate into an X509 certificate entry
Enable new permission to prevent modifications to session recording properties
Enable new permission to prevent modifications to VPN/Tunnel/Gateway properties
Improvements
3
Add basic IIS support when creating a configuration with DPS cmdlets
Improve Get-RDMEntryOTPKey cmdlet to work with all entries with OTP directly configured instead of only OTP credentials
Support optional checkout mode for linked PAM account credentials
Fixes
1
Resolve variables in the entry name in the confirmation message when unsealing the entry with Unprotect-RDMSealedEntry
Add 'Get-DSOktaUser' and 'Import-DSOktaUser' cmdlets to enable the import of Okta users
Integrate 'Add-DSPlaylistEntry' to add connections to an existing playlist
Integrate 'New-DSPlaylistEntry' to establish a new playlist
Integrate 'Remove-DSPlaylistEntry' to remove connections from an existing playlist
Improvements
6
'Get-RDMEntryOTP' and 'Set-RDMEntryOTP' now support OTP in password list by utilizing the new parameter 'PasswordListItemID' or receiving prompt
Enable setting the client secret of an Azure Key Vault entry directly from the PSConnection
Enable the property 'Key' in Set-RDMEntryOTP to accept either a string or a secure string
Include 'Name' property to the PSPasswordListItem object
Parameter 'Connections' added to 'New-RDMPlaylistShared' and 'Set-RDMPlaylistShared' cmdlets to facilitate adding connections in a playlist
Transform 'Get-RDMSessionOTP', 'Set-RDMSessionOTP', 'Get-RDMPrivateSessionOTP', and 'Set-RDMPrivateSessionOTP' as aliases to the corresponding 'RDMEntryOTP' cmdlet
Update the minimum PowerShell version requirement to 7.5.0
New features
1
Add cmdlet "Unlock-RDMApplication" to access the application when it is password-protected
Improvements
3
Include a notification in Get-DSServerLicense indicating that from DVLS version 2025.1.0.0 onwards, a server license is no longer necessary
Include a notification in Register-DSServerLicense indicating that from DVLS version 2025.1.0.0 onwards, a server license is no longer necessary
The parameter "PamAccount" of Update-DSPamAccount now accepts the PAM account ID
Fixes
6
Fixed "Open-RDMSyncSession" failing when using the option "Use LDAP over SSL"
Fixed bypass of password-protected vault
Fixed missing file name in error message from Import-RDMSession
Fixed Set-RDMSession and Set-RDMEntry returning the error 'Connection has an invalid group specified' when saving multiple entries in Devolutions Server data source
Fixed SQL permission issue when non-admin user assigned to a group with admin rights
Resolved the issue with password resolution in Devolutions Server and Hub data sources for Get-RDMSessionPassword and Get-RDMEntryPassword
