# Detent Point > Plain talk about systems work. ## Site - [Detent Point LLC](https://detentpoint.com/): Detent Point LLC builds PowerShell and SQL Server tools for people who run systems: six shipped, more in testing. - [About](https://detentpoint.com/about): Detent Point LLC: an independent software company in Vancouver, WA, building PowerShell and SQL Server tools for people who run systems. - [Best PowerShell IDE in 2026: DetentShell vs VS Code vs ISE vs PowerShell Studio](https://detentpoint.com/best-powershell-ide): Four PowerShell editors, one honest comparison: what each one is actually for, verified against source and documentation, not a feature-sheet contest. - [ClusterValidator: Windows Server Failover Cluster validation](https://detentpoint.com/clustervalidator): Sixteen read-only checks across your Windows Server Failover Cluster: storage, quorum, heartbeat, patch parity, AD identity. Built for clusters hosting SQL Server FCIs. - [Contact](https://detentpoint.com/contact): Email Detent Point LLC. A person reads it and replies within 1-2 business days. - [A Git MCP server for write operations: branch, commit, push](https://detentpoint.com/git-mcp-server): GitEasy MCP gives an AI agent 22 plain-English git tools that actually change your repo: branch, commit, push, all with safe-push checks. - [GitEasy MCP: Pricing & Plans](https://detentpoint.com/giteasy): 22 plain-English git commands as MCP tools. Connect once, then branch, commit, and push without leaving your AI client. - [How to use GitEasy MCP](https://detentpoint.com/giteasy/how): Connect GitEasy MCP to Claude Desktop, Cursor, or any MCP client: get a key, add the server, and use 22 plain-English git tools. - [Privacy Policy](https://detentpoint.com/legal/privacy): How Detent Point LLC handles your data: we collect the minimum needed to run the service, and we never sell it. - [Terms of Service](https://detentpoint.com/legal/terms): The terms of service for Detent Point LLC products and services, in plain language, with a separate complete document for each product that has one. - [ClusterValidator Terms of Service](https://detentpoint.com/legal/terms/clustervalidator): The terms of service for ClusterValidator, in plain language: what it does, what it does not promise, and how plan allowances are counted. - [SqlCertForge Terms of Service](https://detentpoint.com/legal/terms/sqlcertforge): The terms of service for SqlCertForge, in plain language: what it does, what it does not promise, and how licensing works. - [Volume & site licensing](https://detentpoint.com/licensing): DetentShell licensing for teams: a quote, an invoice with your PO, and an offline deployment that fits your tooling. No activation server, no phone-home. - [MCPatrol: MCP Server Monitoring](https://detentpoint.com/mcpatrol): MCPatrol watches your Model Context Protocol servers around the clock, from a phone app or a browser console on the same account. - [Pester testing in PowerShell: a working guide](https://detentpoint.com/pester-testing-powershell): How Pester testing works in PowerShell, and how DetentShell's built-in generator turns a function into a real test scaffold with one click. - [PowerShell 7 ISE: the ISE-style IDE built for PowerShell 7](https://detentpoint.com/powershell-7-ise): PowerShell 7 has no ISE from Microsoft. DetentShell is an independent ISE-style IDE built for PowerShell 7: same two-pane layout, same shortcuts. - [A PowerShell editor that behaves like the ISE](https://detentpoint.com/powershell-editor): Looking for an editor application for writing PowerShell, not a way to edit a file from inside a console session. DetentShell is that: ISE-style, built for PowerShell 7. - [PowerShell ISE explained: why it stops at 5.1, and what to use for 7](https://detentpoint.com/powershell-ise): What the Windows PowerShell ISE is, why Microsoft stopped developing it, and what a PowerShell 7 user should use instead. - [PowerShell ISE vs PowerShell: what's different, and what replaced it](https://detentpoint.com/powershell-ise-vs-powershell): The ISE is a Windows PowerShell 5.1 tool that never made it to PowerShell 7. Here is what actually changed, and what to use for 7 instead. - [Products](https://detentpoint.com/products): Six shipped tools for people who run systems: PowerShell, SQL Server, Git, and documentation. All built and maintained by Detent Point LLC. - [Coming soon](https://detentpoint.com/products/coming-soon): Five more tools in testing from Detent Point LLC: Backup Validation, ModuleWorkshop, ComplianceSuite, PesterForge, and SQL Suite. - [Releases](https://detentpoint.com/releases): Every public release across Detent Point products, newest first, with a link to the listing or page that carries the detail. - [SpnManager](https://detentpoint.com/spnmanager): Kerberos SPN auditing and repair for Active Directory. Finds the service principal names that are missing, wrong, or on the wrong account, and shows you the fix before it changes anything. - [Adoption guide](https://detentpoint.com/spnmanager/adoption-guide): A 203-page guide covering every phase of using SpnManager, from deciding whether it applies to your estate through to running it on a schedule, followed by the full command reference. - [Command reference](https://detentpoint.com/spnmanager/wiki): Every SpnManager command, with a view for management, practitioners, learners, software approval, dependencies and compliance. - [Add-SqlSpn](https://detentpoint.com/spnmanager/wiki/add-sqlspn): The Add-SqlSpn cmdlet is a crucial tool for managing Service Principal Names (SPNs) in a SQL environment. It's used by system administrators who need to co... - [Assert-SqlAccountStandard](https://detentpoint.com/spnmanager/wiki/assert-sqlaccountstandard): Active Directory account validation is crucial for ensuring compliance with organizational policies and standards. The Assert-SqlAccountStandard cmdlet fro... - [Export-ApplianceSsoSpnRunbook](https://detentpoint.com/spnmanager/wiki/export-appliancessospnrunbook): The Export-ApplianceSsoSpnRunbook command is used by security teams to automate the process of resolving Service Principal Name (SPN) gaps for appliance SS... - [Export-JavaSpnegoSpnRunbook](https://detentpoint.com/spnmanager/wiki/export-javaspnegospnrunbook): As a manager, you care about the business value of Export-JavaSpnegoSpnRunbook when dealing with Java SPNEGO web SPN gaps. This command is used by the secu... - [Export-KeytabDriftRunbook](https://detentpoint.com/spnmanager/wiki/export-keytabdriftrunbook): Export-KeytabDriftRunbook is used by administrators to create a runbook for confirming and resolving POSSIBLE-keytab-skew findings reported by Get-KeytabDr... - [Export-LinuxJoinedSpnRunbook](https://detentpoint.com/spnmanager/wiki/export-linuxjoinedspnrunbook): The Export-LinuxJoinedSpnRunbook cmdlet helps organizations manage Linux hosts joined to their Active Directory domain by identifying and resolving HOST SP... - [Export-OracleDbSpnRunbook](https://detentpoint.com/spnmanager/wiki/export-oracledbspnrunbook): Export-OracleDbSpnRunbook is used by database administrators to close Oracle Database Kerberos SPN gaps detected by Get-OracleDbSpnAudit. These gaps can ca... - [Export-SapSpnRunbook](https://detentpoint.com/spnmanager/wiki/export-sapspnrunbook): Business value: The Export-SapSpnRunbook cmdlet helps managers identify SAP NetWeaver SPN gaps and generate a hand-off runbook to resolve the issue. - [Export-SpnAuditHandoff](https://detentpoint.com/spnmanager/wiki/export-spnaudithandoff): The Export-SpnAuditHandoff command is used by administrators to facilitate the transfer of SPN management responsibilities between teams or roles. This bus... - [Export-SpnForestReport](https://detentpoint.com/spnmanager/wiki/export-spnforestreport): The Export-SpnForestReport cmdlet is a critical tool for AD administrators to render forest-wide SPN audit results into a self-contained HTML report. This... - [Export-SpnRegistrationScript](https://detentpoint.com/spnmanager/wiki/export-spnregistrationscript): Export-SpnRegistrationScript provides business value to organizations that need to manage Service Principal Names (SPNs) for their applications. This cmdle... - [Export-SqlSpnRegistrationScript](https://detentpoint.com/spnmanager/wiki/export-sqlspnregistrationscript): Business value: This command streamlines the SPN registration process by automating the generation of a setspn command bundle for AD admins to run, reducin... - [Get-AdcsSpnCandidate](https://detentpoint.com/spnmanager/wiki/get-adcsspncandidate): As a manager, you may be interested in the following aspects of Get-AdcsSpnCandidate: - [Get-AdfsSpnCandidate](https://detentpoint.com/spnmanager/wiki/get-adfsspncandidate): The Get-AdfsSpnCandidate cmdlet is used to build the expected HTTP SPN set for an ADFS federation service. This cmdlet provides business value by ensuring... - [Get-ApplianceSsoSpnAudit](https://detentpoint.com/spnmanager/wiki/get-appliancessospnaudit): Business value lies in ensuring Kerberos-constrained-delegation (KCD) posture for F5 / NetScaler / KEMP virtual services is correctly configured on the AD-... - [Get-AzureAdSsoSpnCandidate](https://detentpoint.com/spnmanager/wiki/get-azureadssospncandidate): Business value: This command provides visibility into the Azure AD Seamless SSO configuration, helping administrators ensure seamless single sign-on is pro... - [Get-DfsSpnCandidate](https://detentpoint.com/spnmanager/wiki/get-dfsspncandidate): Managers care about the business value of detecting DFS namespace roots and identifying CNAME alias SPN gaps because it: - [Get-DnsSpnCandidate](https://detentpoint.com/spnmanager/wiki/get-dnsspncandidate): The Get-DnsSpnCandidate command from the SpnManager module helps administrators ensure DNS SPN settings are correctly configured for their organization's s... - [Get-EncryptionTypeAudit](https://detentpoint.com/spnmanager/wiki/get-encryptiontypeaudit): Business Value - [Get-ExchangeSpnCandidate](https://detentpoint.com/spnmanager/wiki/get-exchangespncandidate): Get-ExchangeSpnCandidate helps Exchange administrators ensure correct Kerberos authentication by building the expected HTTP and RPC SPN set for an Exchange... - [Get-IisSpnCandidate](https://detentpoint.com/spnmanager/wiki/get-iisspncandidate): As a manager, the Get-IisSpnCandidate command from the SpnManager module provides valuable insights into IIS site bindings and their associated HTTP SPN ca... - [Get-JavaSpnegoSpnAudit](https://detentpoint.com/spnmanager/wiki/get-javaspnegospnaudit): This command provides business value by ensuring the security posture of Java/Tomcat/JBoss/WildFly/Hadoop SPNEGO hosts in Active Directory (AD). It audits... - [Get-KcdDelegationAudit](https://detentpoint.com/spnmanager/wiki/get-kcddelegationaudit): Business value - [Get-KeytabDriftAudit](https://detentpoint.com/spnmanager/wiki/get-keytabdriftaudit): The Get-KeytabDriftAudit cmdlet is a crucial tool for identifying potential security risks in the Active Directory (AD) posture. It flags keytab-bearing se... - [Get-LinuxJoinedSpnAudit](https://detentpoint.com/spnmanager/wiki/get-linuxjoinedspnaudit): The Get-LinuxJoinedSpnAudit cmdlet provides visibility into the AD-side HOST SPN posture for Linux hosts joined to AD. This is particularly useful for orga... - [Get-OracleDbSpnAudit](https://detentpoint.com/spnmanager/wiki/get-oracledbspnaudit): The Get-OracleDbSpnAudit command provides visibility into the AD-side oracle SPN posture for an Oracle Database Kerberos host. This is essential for ensuri... - [Get-PrintSpnCandidate](https://detentpoint.com/spnmanager/wiki/get-printspncandidate): The Get-PrintSpnCandidate cmdlet provides business value by ensuring that the expected SPNs (Service Principal Names) are present for a print server. This... - [Get-RbcdDelegationAudit](https://detentpoint.com/spnmanager/wiki/get-rbcddelegationaudit): Business value for administrators who manage Active Directory delegation is to identify resource-based constrained delegation (RBCD) grants and their assoc... - [Get-RdpSpnCandidate](https://detentpoint.com/spnmanager/wiki/get-rdpspncandidate): Get-RdpSpnCandidate is used by IT administrators to ensure the TERMSRV SPNs for Remote Desktop Services are correctly configured on a target machine. This... - [Get-SapSpnAudit](https://detentpoint.com/spnmanager/wiki/get-sapspnaudit): This command provides a read-only audit of the AD-side SAP SSO SPN posture for a SAP SNC + SPNEGO host. The primary use case is to identify potential secur... - [Get-SharePointSpnCandidate](https://detentpoint.com/spnmanager/wiki/get-sharepointspncandidate): As a manager responsible for SharePoint security and access management, you should be aware of the Get-SharePointSpnCandidate command from the SpnManager m... - [Get-SmbSpnCandidate](https://detentpoint.com/spnmanager/wiki/get-smbspncandidate): As a manager, you should care about the Get-SmbSpnCandidate command when planning SMB file services for your organization. This command helps ensure that t... - [Get-SpnProvider](https://detentpoint.com/spnmanager/wiki/get-spnprovider): The Get-SpnProvider command is a crucial tool for administrators who manage Service Principal Name (SPN) providers within the SpnManager module. This comma... - [Get-SqlSpnAccount](https://detentpoint.com/spnmanager/wiki/get-sqlspnaccount): Business value: The Get-SqlSpnAccount cmdlet is used to verify the existence of a standard Active Directory account and retrieve its normalized descriptor.... - [Get-SqlSpnDiscoveryEngine](https://detentpoint.com/spnmanager/wiki/get-sqlspndiscoveryengine): Business value - [Get-SqlSpnInfrastructure](https://detentpoint.com/spnmanager/wiki/get-sqlspninfrastructure): + Authentication issues - [Get-SqlSpnPolicyConfig](https://detentpoint.com/spnmanager/wiki/get-sqlspnpolicyconfig): Business value for Get-SqlSpnPolicyConfig lies in its ability to ensure effective account-compliance OU configuration for SQL policies. - [Get-SsasSpnCandidate](https://detentpoint.com/spnmanager/wiki/get-ssasspncandidate): + Database administrators - [Get-SsrsSpnCandidate](https://detentpoint.com/spnmanager/wiki/get-ssrsspncandidate): Get-SsrsSpnCandidate is used to detect SQL Server Reporting Services (SSRS) and return HTTP SPN candidates. This command is useful for organizations that u... - [Get-UnconstrainedDelegationAudit](https://detentpoint.com/spnmanager/wiki/get-unconstraineddelegationaudit): Managers care about unconstrained Kerberos delegation exposures because they can lead to security breaches and unauthorized access to sensitive resources.... - [Get-WinRmSpnCandidate](https://detentpoint.com/spnmanager/wiki/get-winrmspncandidate): The Get-WinRmSpnCandidate command is used to build the expected WSMAN SPN set for a target machine. This is a crucial step in preparing for Windows Remote... - [Invoke-SpnAuditEngine](https://detentpoint.com/spnmanager/wiki/invoke-spnauditengine): Business value: This cmdlet is used to run one or more audit providers against a target computer, ensuring that the configuration meets the required standa... - [Invoke-SpnDuplicateScan](https://detentpoint.com/spnmanager/wiki/invoke-spnduplicatescan): As a manager, you care when duplicate Service Principal Names (SPNs) are found in the forest because they can lead to authentication issues and security vu... - [Invoke-SpnExecutionEngine](https://detentpoint.com/spnmanager/wiki/invoke-spnexecutionengine): The Invoke-SpnExecutionEngine cmdlet provides a way to automate the registration or removal of Service Principal Names (SPNs) for a given SpnPlan object. T... - [Invoke-SpnForestAudit](https://detentpoint.com/spnmanager/wiki/invoke-spnforestaudit): When a manager needs to ensure that all computers in the organization are properly configured with Service Principal Names (SPNs), they should use the Invo... - [Invoke-SpnLifecycle](https://detentpoint.com/spnmanager/wiki/invoke-spnlifecycle): The Invoke-SpnLifecycle command provides a convenient way to manage Service Principal Names (SPNs) through the SpnManager module. This feature is essential... - [Invoke-SqlSpnExecutionEngine](https://detentpoint.com/spnmanager/wiki/invoke-sqlspnexecutionengine): The Invoke-SqlSpnExecutionEngine cmdlet executes an SPN plan by running a series of steps to ensure that the plan is properly registered and configured in... - [New-AdcsSpnAuditPlan](https://detentpoint.com/spnmanager/wiki/new-adcsspnauditplan): The New-AdcsSpnAuditPlan command is a key component of the AD CS infrastructure management process. Its primary purpose is to identify potential security v... - [New-AdcsSpnPlan](https://detentpoint.com/spnmanager/wiki/new-adcsspnplan): As a manager, you should care about the New-AdcsSpnPlan command when planning for service principal name (SPN) registration in your organization's Active D... - [New-AdfsSpnPlan](https://detentpoint.com/spnmanager/wiki/new-adfsspnplan): Business Value - [New-DfsSpnAuditPlan](https://detentpoint.com/spnmanager/wiki/new-dfsspnauditplan): The New-DfsSpnAuditPlan command is used by DFS administrators to identify potential issues with Service Principal Names (SPNs) associated with a DFS namesp... - [New-DfsSpnPlan](https://detentpoint.com/spnmanager/wiki/new-dfsspnplan): Business value: - [New-DnsSpnAuditPlan](https://detentpoint.com/spnmanager/wiki/new-dnsspnauditplan): The New-DnsSpnAuditPlan command is used to identify potential DNS SPN issues on a machine account in Active Directory (AD). This is particularly useful whe... - [New-ExchangeSpnAuditPlan](https://detentpoint.com/spnmanager/wiki/new-exchangespnauditplan): Business Value - [New-ExchangeSpnPlan](https://detentpoint.com/spnmanager/wiki/new-exchangespnplan): The New-ExchangeSpnPlan cmdlet is used to build a DR-524 SpnPlan from an Exchange SpnCandidate for HTTP SPN only. - [New-IisSpnPlan](https://detentpoint.com/spnmanager/wiki/new-iisspnplan): As a manager, it's essential to understand the business value of using New-IisSpnPlan from the SpnManager module. This command helps ensure that IIS app po... - [New-PrintSpnAuditPlan](https://detentpoint.com/spnmanager/wiki/new-printspnauditplan): The New-PrintSpnAuditPlan command from the SpnManager module provides a comprehensive way to identify potential security risks in Active Directory (AD) by... - [New-RdpSpnAuditPlan](https://detentpoint.com/spnmanager/wiki/new-rdpspnauditplan): The New-RdpSpnAuditPlan command is used to identify potential issues with Remote Desktop Services (RDS) SPNs in Active Directory. This command helps organi... - [New-SharePointSpnPlan](https://detentpoint.com/spnmanager/wiki/new-sharepointspnplan): The New-SharePointSpnPlan cmdlet helps ensure that SharePoint service accounts are properly configured to maintain high availability and security. Business... - [New-SmbSpnAuditPlan](https://detentpoint.com/spnmanager/wiki/new-smbspnauditplan): Business Value - [New-SqlSpnPlan](https://detentpoint.com/spnmanager/wiki/new-sqlspnplan): SpnManager command reference for New-SqlSpnPlan. - [New-SsasSpnPlan](https://detentpoint.com/spnmanager/wiki/new-ssasspnplan): Business value: This command is crucial for building a secure Service Principal Name (SPN) plan for SQL Server Analysis Services candidates, ensuring compl... - [New-SsrsSpnPlan](https://detentpoint.com/spnmanager/wiki/new-ssrsspnplan): Business value: This command builds an SPN registration plan for SQL Server Reporting Services (SSRS), ensuring secure authentication with Active Directory... - [New-WinRmSpnAuditPlan](https://detentpoint.com/spnmanager/wiki/new-winrmspnauditplan): The New-WinRmSpnAuditPlan command from the SpnManager module is a crucial tool for IT administrators responsible for managing Windows Remote Management (WS... - [Remove-SqlSpn](https://detentpoint.com/spnmanager/wiki/remove-sqlspn): Removing stale Service Principal Names (SPNs) is a crucial task in maintaining the health of your Active Directory. This command helps ensure that only val... - [Set-SqlSpnPolicyConfig](https://detentpoint.com/spnmanager/wiki/set-sqlspnpolicyconfig): This cmdlet is used to configure the OU roots that SQL policies validate against for a session. The business value lies in ensuring that service accounts a... - [Show-SqlSpnDiagnostic](https://detentpoint.com/spnmanager/wiki/show-sqlspndiagnostic): The Show-SqlSpnDiagnostic command is used to provide visibility into recent SPN audit log files, enabling managers to quickly assess the impact of their ac... - [Start-SpnManager](https://detentpoint.com/spnmanager/wiki/start-spnmanager): Business value: The Start-SpnManager cmdlet provides an interactive wizard for SpnManager forest-wide SPN audit, allowing administrators to ensure the secu... - [Start-SqlSpnConfiguration](https://detentpoint.com/spnmanager/wiki/start-sqlspnconfiguration): + They want to ensure that all SPNs are registered correctly and compliant with policy. - [Start-SqlSpnManager](https://detentpoint.com/spnmanager/wiki/start-sqlspnmanager): As a manager, you care about the security and integrity of your organization's Active Directory infrastructure. The Start-SqlSpnManager cmdlet is an intera... - [Test-SpnAuditPlan](https://detentpoint.com/spnmanager/wiki/test-spnauditplan): The Test-SpnAuditPlan cmdlet is a crucial component of the SpnManager module, ensuring that the shape of the SpnAuditPlan is valid before it's handed off f... - [Test-SpnPlan](https://detentpoint.com/spnmanager/wiki/test-spnplan): Test-SpnPlan is a critical component of the SpnManager module, ensuring that SpnPlans conform to the expected shape before execution. This validation step... - [Test-SqlSpnKerberosAuth](https://detentpoint.com/spnmanager/wiki/test-sqlspnkerberosauth): Test-SqlSpnKerberosAuth provides visibility into the security protocols used by SQL Server connections. This command is essential for organizations that re... - [Test-SqlSpnPlan](https://detentpoint.com/spnmanager/wiki/test-sqlspnplan): As a manager, you care about the business value of validating a plan object's shape before execution. This is crucial for preventing costly errors and ensu... - [Always Encrypted column master keys and the certificate behind them](https://detentpoint.com/sql-server-always-encrypted-column-master-key): Always Encrypted rests on a column master key held outside the database. How to register a certificate-backed CMK and audit whether the certificate it points to is still present. - [Restoring an encrypted SQL Server backup: the certificate has to be there first](https://detentpoint.com/sql-server-backup-encryption-certificate): Backup encryption protects the .bak with a certificate. Restore it somewhere that doesn't hold that certificate and it fails. How to check restorability before you need the backup. - [Finding every SQL Server certificate before one expires](https://detentpoint.com/sql-server-certificate-expiration-inventory): A SQL Server holds certificates in half a dozen independent places. How to inventory all of them across an estate, with expiry, in one read-only pass — free. - [Certificate authentication for SQL Server mirroring and Always On endpoints](https://detentpoint.com/sql-server-endpoint-certificate-authentication): Database mirroring, Always On, and Service Broker endpoints can authenticate each other by certificate instead of Windows logins. How to set it up, export the public half, and grant the partner CONNECT. - [Backing up the SQL Server TDE certificate: the step that decides whether an encrypted database is recoverable](https://detentpoint.com/sql-server-tde-certificate-backup): Transparent Data Encryption protects the database with a certificate. Lose it and the backups are unreadable. How to know the TDE certificate is backed up and restorable before you need it. - [TrustServerCertificate errors in SQL Server: what they mean, and the fix that isn't just turning it on](https://detentpoint.com/sql-server-trust-server-certificate): Why SQL Server connections started failing on certificate trust, what TrustServerCertificate=true actually trades away, and how to fix it properly instead. - [SqlCertForge: Pricing & Plans](https://detentpoint.com/sqlcertforge): SqlCertForge does the SQL Server certificate work and proves it took: TLS binding for the engine and Reporting Services, endpoint certificate authentication, Always Encrypted keys, client trust. The read-only audit of every certificate surface is free. - [SqlCertForge adoption guide](https://detentpoint.com/sqlcertforge/adoption-guide): An 81-page guide covering every phase of putting certificates on SQL Server, Reporting Services, and Power BI Report Server, followed by the full 40-command reference. - [SqlCertForge command reference](https://detentpoint.com/sqlcertforge/wiki): Every SqlCertForge command, with a view for management, practitioners, learners, software approval, dependencies and compliance. - [Add-SqlCertClientTrust](https://detentpoint.com/sqlcertforge/wiki/add-sqlcertclienttrust): Imports an issuer or root certificate into a client machine's trusted-root store (LocalMachine\Root) so the client trusts SQL Server or Reporting Services... - [Add-SqlCertPrivateKeyAccess](https://detentpoint.com/sqlcertforge/wiki/add-sqlcertprivatekeyaccess): Grants the SQL Server service account Read on the certificate's private key — the single step whose omission silently leaves a server unencrypted. - [Backup-SqlTdeCertificate](https://detentpoint.com/sqlcertforge/wiki/backup-sqltdecertificate): Escrows a TDE certificate and its private key to files on the SQL Server's file system, with the private key protected by a password you supply. The privat... - [Copy-SqlCertificate](https://detentpoint.com/sqlcertforge/wiki/copy-sqlcertificate): Migrates a master certificate — a TDE or backup-encryption certificate, with its private key — from a source SQL instance to a target, by escrowing on the... - [Export-SqlEndpointCertificate](https://detentpoint.com/sqlcertforge/wiki/export-sqlendpointcertificate): Exports the public half of an endpoint certificate to a file, to hand to a partner replica. It never exports the private key — there is no parameter that c... - [Get-RsHttpConfig](https://detentpoint.com/sqlcertforge/wiki/get-rshttpconfig): Inventories everything Reporting Services owns in the Windows HTTP layer — reserved URLs, SSL certificate bindings, and the real browseable URLs — in one r... - [Get-SqlCertInventory](https://detentpoint.com/sqlcertforge/wiki/get-sqlcertinventory): Inventories every SQL Server certificate surface on an instance — engine binding, Reporting Services, TDE, backup encryption, endpoints, and cell-level — w... - [Get-SqlCertRenewalJob](https://detentpoint.com/sqlcertforge/wiki/get-sqlcertrenewaljob): Lists the registered renewal jobs and each one's last recorded run. Read-only and offline, and free. - [Grant-SqlEndpointCertAccess](https://detentpoint.com/sqlcertforge/wiki/grant-sqlendpointcertaccess): Grants a partner replica CONNECT on the endpoint by importing its public certificate, creating a login from that certificate, and granting the login CONNEC... - [Import-SqlCert](https://detentpoint.com/sqlcertforge/wiki/import-sqlcert): Imports a .pfx into the machine certificate store on one or more nodes — with every node agreeing on the same thumbprint by construction. - [Install-RsConnectionCertificate](https://detentpoint.com/sqlcertforge/wiki/install-rsconnectioncertificate): One command for the common Reporting Services / Power BI Report Server case: reserve the vanity HTTPS URL, bind the certificate, restart, and confirm the s... - [Install-SqlConnectionCertificate](https://detentpoint.com/sqlcertforge/wiki/install-sqlconnectioncertificate): End-to-end orchestrator: takes a SQL Server from no TLS to a verified, encrypted endpoint — request, issue, install, permission, bind, and confirm, in the... - [Invoke-SqlCertRenewalJob](https://detentpoint.com/sqlcertforge/wiki/invoke-sqlcertrenewaljob): Runs one renewal job — the entry point every scheduler calls. Renews only when the certificate is due (or -Force), and never takes a working server offline... - [Invoke-SqlTdeCertificateRotation](https://detentpoint.com/sqlcertforge/wiki/invoke-sqltdecertificaterotation): Rotates the TDE server certificate: creates a new certificate, escrows it, and re-encrypts every encrypted database's key to it — refusing to move any data... - [New-SqlCellCertificateKey](https://detentpoint.com/sqlcertforge/wiki/new-sqlcellcertificatekey): Provisions the cell-level encryption key hierarchy in a user database — a certificate and a symmetric key encrypted by it — and can grant named principals... - [New-SqlCertRequest](https://detentpoint.com/sqlcertforge/wiki/new-sqlcertrequest): Generates a SAN certificate signing request (CSR) for SQL connection encryption — the first step, done to spec so the issued cert actually works with SQL S... - [New-SqlTdeCertificate](https://detentpoint.com/sqlcertforge/wiki/new-sqltdecertificate): Creates the Transparent Data Encryption server certificate in master — the certificate that protects a database's encryption key. Requires a database maste... - [Register-SqlCertRenewalJob](https://detentpoint.com/sqlcertforge/wiki/register-sqlcertrenewaljob): Sets up automatic certificate renewal: saves a job spec and creates a schedule entry that renews a certificate before it expires — under Windows Task Sched... - [Register-SqlColumnMasterKey](https://detentpoint.com/sqlcertforge/wiki/register-sqlcolumnmasterkey): Registers Always Encrypted column master key metadata (CREATE COLUMN MASTER KEY) that points a database at a key-store certificate. It registers the refere... - [Remove-RsUrlReservation](https://detentpoint.com/sqlcertforge/wiki/remove-rsurlreservation): Removes a Reporting Services URL reservation the RS-native way — keeping HTTP.sys and RS configuration in sync, unlike netsh http delete urlacl. - [Restore-SqlTdeCertificate](https://detentpoint.com/sqlcertforge/wiki/restore-sqltdecertificate): Re-creates a TDE certificate on a rebuilt or disaster-recovery instance from the escrowed certificate file, private-key file, and backup password. Requires... - [Set-RsCertBinding](https://detentpoint.com/sqlcertforge/wiki/set-rscertbinding): Binds a TLS certificate to a Reporting Services HTTPS endpoint the RS-native way — updating RS config and HTTP.sys together, with a -Force path that replac... - [Set-RsUrlReservation](https://detentpoint.com/sqlcertforge/wiki/set-rsurlreservation): Reserves a URL for a Reporting Services endpoint the RS-native way — RS applies the correct service-account permission automatically, so you never compute... - [Set-SqlCertBinding](https://detentpoint.com/sqlcertforge/wiki/set-sqlcertbinding): Binds a certificate to one or more SQL instances — the step that tells SQL Server which certificate to use. Works identically on standalone instances and A... - [Set-SqlEndpointCertAuthentication](https://detentpoint.com/sqlcertforge/wiki/set-sqlendpointcertauthentication): Ensures a database-mirroring / Always On or Service Broker endpoint authenticates with a given local certificate — creating the endpoint with certificate a... - [Set-SsasHttpsBinding](https://detentpoint.com/sqlcertforge/wiki/set-ssashttpsbinding): Binds an existing certificate, by thumbprint, to the SSAS msmdpump HTTP.sys IP:port so SSAS-over-HTTP serves HTTPS with it. It binds only — it doesn't issu... - [Submit-SqlCertRequest](https://detentpoint.com/sqlcertforge/wiki/submit-sqlcertrequest): Submits a CSR to an AD CS certificate authority and retrieves the issued certificate — handling the common case where the CA holds the request for approval... - [Test-RsCertBinding](https://detentpoint.com/sqlcertforge/wiki/test-rscertbinding): Reports the certificate bound to a Reporting Services endpoint — thumbprint and expiry — and flags HTTP-only mode or an expired cert. Read-only, and free. - [Test-RsHttpsEndpoint](https://detentpoint.com/sqlcertforge/wiki/test-rshttpsendpoint): The functional round-trip check WMI can't give you: it discovers the real URL, makes an HTTPS request, and inspects the certificate actually served on the... - [Test-SqlBackupEncryptionReadiness](https://detentpoint.com/sqlcertforge/wiki/test-sqlbackupencryptionreadiness): Reports whether certificate-encrypted backups can still be restored on this server — for each encrypting certificate, whether it is present here and whethe... - [Test-SqlCellKeyHierarchy](https://detentpoint.com/sqlcertforge/wiki/test-sqlcellkeyhierarchy): Reports the cell-level encryption hierarchy in a user database — each certificate, the symmetric key(s) it protects, and which database principals may use... - [Test-SqlCertBinding](https://detentpoint.com/sqlcertforge/wiki/test-sqlcertbinding): Reports the certificate binding SQL Server will use — bound thumbprint, Force Encryption state, and expiry — across one or many nodes. Read-only, and free. - [Test-SqlCertClientTrust](https://detentpoint.com/sqlcertforge/wiki/test-sqlcertclienttrust): Reports whether a client machine trusts a SQL Server (or Reporting Services) TLS issuer certificate — whether the issuer/root certificate you supply is pre... - [Test-SqlCertRenewalJob](https://detentpoint.com/sqlcertforge/wiki/test-sqlcertrenewaljob): Previews a renewal job — would it renew now, and why? — without changing anything. Read-only, and free. - [Test-SqlColumnMasterKey](https://detentpoint.com/sqlcertforge/wiki/test-sqlcolumnmasterkey): Reports each Always Encrypted column master key in a database — its provider and key path, how many column encryption keys depend on it, and, for certifica... - [Test-SqlEndpointCertAuth](https://detentpoint.com/sqlcertforge/wiki/test-sqlendpointcertauth): Reports whether a database-mirroring / Always On or Service Broker endpoint authenticates by certificate — its state, the certificate, thumbprint, and expi... - [Test-SqlPolyBaseCertificate](https://detentpoint.com/sqlcertforge/wiki/test-sqlpolybasecertificate): Reports what is verifiable about a SQL instance's PolyBase TLS surface — whether PolyBase is installed, its scale-out compute nodes, and (optionally) the c... - [Test-SqlTdeConfiguration](https://detentpoint.com/sqlcertforge/wiki/test-sqltdeconfiguration): Reports the Transparent Data Encryption state of an instance — the database master key, which databases are encrypted, and whether every certificate that p... - [Test-SsasHttpsBinding](https://detentpoint.com/sqlcertforge/wiki/test-ssashttpsbinding): Reports the TLS certificate bound to the SSAS msmdpump HTTP.sys IP:port — thumbprint, and the resolved subject and expiry — or that none is bound. Read-onl... - [Unregister-SqlCertRenewalJob](https://detentpoint.com/sqlcertforge/wiki/unregister-sqlcertrenewaljob): Removes a renewal job — its schedule entry, and (unless you keep it) its spec. The run log stays as history. - [Terms of Service](https://detentpoint.com/terms): This page has moved to /legal/terms. - [Test-Cluster and beyond: validating a SQL Server failover cluster](https://detentpoint.com/test-cluster): Windows Server's built-in Test-Cluster cmdlet validates a cluster before you build it. ClusterValidator checks FCI health after, on a schedule, read-only. - [WikiEngine](https://detentpoint.com/wikiengine): Point it at a PowerShell module and get a structured, searchable reference. When publisher help is missing, it says so instead of inventing content. - [WikiMint: Pricing & Plans](https://detentpoint.com/wikimint): Turns source code into structured wiki documentation. Call it from an AI agent, a CI/CD pipeline, or Confluence, and the docs stay current. - [WikiMint for COBOL](https://detentpoint.com/wikimint/cobol): WikiMint turns COBOL source into Confluence pages. Every statement on a page comes from a line of code, and the same code gives the same pages on every run. Free pilot on one application. - [WikiMint Documentation](https://detentpoint.com/wikimint/documentation): How to install WikiMint in Confluence, generate documentation from pasted code, read the audit trail, and get support. - [WikiMint Data Processing Agreement](https://detentpoint.com/wikimint/dpa): The Data Processing Agreement for the WikiMint Confluence app, following GDPR Article 28(3), with the EU Standard Contractual Clauses and UK Addendum incorporated by reference. - [What WikiMint reads from your code, by language](https://detentpoint.com/wikimint/languages): WikiMint reads source code and writes documentation from what the code states. It reads more of some languages than others, and this page says exactly how much, so nothing on a generated page has to be taken on trust. Every row was checked against the harvester source, not against a description of it. - [WikiMint Privacy Policy](https://detentpoint.com/wikimint/privacy): The app-specific privacy policy for the WikiMint Confluence app: what the app sends, what it stores, what it never collects, and your rights. - [WikiMint Security](https://detentpoint.com/wikimint/security): The security measures in operation for the WikiMint Confluence app: encryption in transit, request limits, credential handling, and breach notification within 72 hours. - [WikiMint Support and Service Levels](https://detentpoint.com/wikimint/support): The support channel, hours, response times, and service level statement for WikiMint for Confluence. ## DetentShell - [A Windows IDE for PowerShell 7](https://detentpoint.com/detentshell): A Windows IDE for PowerShell 7, for people still using the ISE on 5.1. Script tabs and a real console. - [Pester tutorial series](https://detentpoint.com/detentshell/blog): A 25-part Pester series from DetentShell's own author, plus what's coming for DetentShell's own blog. - [Changelog](https://detentpoint.com/detentshell/changelog): DetentShell release notes and development history, pulled from the real commit history. There is no email list; this page is how you stay informed. - [Compare](https://detentpoint.com/detentshell/compare): DetentShell next to the ISE, VS Code, and SAPIEN PowerShell Studio: one verified comparison table, scored honestly, downloadable as a PDF. - [Docs](https://detentpoint.com/detentshell/docs): DetentShell documentation: getting started, the shortcut reference, everyday how-tos, and a look under the hood. Written against the actual code. - [Getting started](https://detentpoint.com/detentshell/docs/getting-started): From install to your first script: what you see on first launch, how sessions and script tabs work, and where your settings live. - [How-tos](https://detentpoint.com/detentshell/docs/how-tos): Step-by-step walkthroughs of five DetentShell tasks: Pester test generation, Quick Fix, targeting PowerShell 5.1, F1 help, and remote sessions. - [Keyboard shortcuts](https://detentpoint.com/detentshell/docs/shortcuts): Every DetentShell keyboard shortcut, from the app's own key bindings. Gestures matching the ISE are marked, since muscle memory should transfer. - [Download](https://detentpoint.com/detentshell/download): DetentShell is in the Microsoft Store, with a free trial. Per-user install, no elevation, clean uninstall. - [FAQ](https://detentpoint.com/detentshell/faq): System requirements, licensing, AI behavior, telemetry, and how DetentShell handles Windows PowerShell 5.1 scripts. - [Features](https://detentpoint.com/detentshell/features): PowerShell 7 didn't have an ISE. Now it does. What's actually in it, checked against the shipped code. - [Format / Indent](https://detentpoint.com/detentshell/format): DetentShell's planned Format/Indent button reindents a script with PSScriptAnalyzer's own formatter. Designed and built, not yet in a shipped release. - [PesterForge](https://detentpoint.com/detentshell/pester): One-click Pester test generation inside DetentShell, free and built in. Generate, fill the placeholders, run, watch it go green. - [Roadmap](https://detentpoint.com/detentshell/roadmap): The current state of DetentShell: what’s built and tested, what’s still cooking, and where we’re headed. The changelog records what actually lands. - [Screenshots](https://detentpoint.com/detentshell/screenshots): Real screenshots of the current DetentShell release build: the editor, the console, live Windows PowerShell 5.1 session tabs, and the themes. - [Security advisories](https://detentpoint.com/detentshell/security): Security fixes in DetentShell: the versions affected, what each fix changes, and the update that carries it. - [Wiki](https://detentpoint.com/detentshell/wiki): Nine pages of DetentShell documentation, each written in up to six voices: manager, practitioner, learner, software approval, dependencies, and compliance. Read the voice that matches how you are evaluating. - [Accessibility](https://detentpoint.com/detentshell/wiki/accessibility): What is verified: WCAG AA contrast on every build and automated control-name checks. What is not yet: end-to-end testing with Narrator, Magnifier, or keyboard-only use. If you rely on assistive technology, help us test and earn a license. - [Debugging](https://detentpoint.com/detentshell/wiki/debugging): Click the gutter to set a breakpoint, press F5, and execution stops on the red dot. The keys are the ones you know: F10 over, F11 into, Shift+F11 out, F5 to continue, Shift+F5 to end. - [Tutorial: generate your first Pester tests](https://detentpoint.com/detentshell/wiki/generate-your-first-tests): Twenty minutes, one small function, and at the end you have a saved test file watching it. Every step shows the output to expect, from a real run of the example. - [Generating Pester tests](https://detentpoint.com/detentshell/wiki/generating-tests): Point the tool at a function and get a Pester v5 test file, with the parts it can prove asserted, and the parts only you know marked FILL IN instead of guessed. - [Getting started with DetentShell](https://detentpoint.com/detentshell/wiki/getting-started): DetentShell opens with the layout ISE users know: a menu bar, an icon toolbar, a console at the bottom, and a script pane that stays out of the way until you need it. If you have spent years in the ISE, you already know your way around. - [Tutorial: harden a script with Quick Fix](https://detentpoint.com/detentshell/wiki/harden-a-script-with-quick-fix): Fifteen minutes with a deliberately rough script. Quick Fix runs five hardening transforms against the function under your caret, shows each proposed change side by side, and touches nothing until you click Apply. - [Quick Fix](https://detentpoint.com/detentshell/wiki/quick-fix): Five script-hardening changes: try/catch wrapping, strict mode, parameter validation, dangerous-command guards, and secure error messages. Each previewed side by side and applied only when you say so. - [Windows PowerShell 5.1 and remote sessions](https://detentpoint.com/detentshell/wiki/remote-and-51): Windows PowerShell 5.1 in its own tab next to your PowerShell 7, and remote tabs that keep the machine name in front of your eyes. - [Running scripts](https://detentpoint.com/detentshell/wiki/running-scripts): F5 runs the script, F8 runs just the selection, and the Stop button ends a runaway script. DetentShell also knows which PowerShell your script belongs on, and tells you before you run it. - [The console](https://detentpoint.com/detentshell/wiki/the-console): Each session's console shares its runspace with your script runs, remembers your history, renders color, and turns interactive prompts into dialogs instead of hangs. - [The editor](https://detentpoint.com/detentshell/wiki/the-editor): The script pane is a full PowerShell 7 editor. It completes commands from your live session, folds long blocks out of the way, inserts snippets, and formats code when you ask it to. ## PesterForge - [PesterForge writes your Pester tests](https://detentpoint.com/pesterforge): PesterForge generates ready-to-run Pester tests for PowerShell functions, audits coverage, and scaffolds test projects. Built on Pester. Free module. - [PesterForge changelog](https://detentpoint.com/pesterforge/changelog): PesterForge release notes, distilled from the engineering changelog: what changed in each version and what it means for the tests you generate. - [PesterForge for developers](https://detentpoint.com/pesterforge/developers): Point New-PesterTests at a PowerShell function and get a ready-to-run Pester test: real assertions where proven, FILL IN stubs for the rest. - [PesterForge for IT teams](https://detentpoint.com/pesterforge/enterprise): Coverage reports for an auditor, test generation with zero network calls by default, output scrubbed for machine names. Every claim names its test. - [PesterForge FAQ](https://detentpoint.com/pesterforge/faq): What's free, how PesterForge relates to Pester, network behavior, using it from Claude Code, where DetentShell fits, and the Microsoft question. - [PesterForge Features](https://detentpoint.com/pesterforge/features): What each PesterForge command does: generate Pester tests, audit coverage, measure testability, scaffold a test project, and run the suite. - [PesterForge MCP: Overview](https://detentpoint.com/pesterforge/mcp): PesterForge's test engine as MCP tools for Claude Code and other MCP-compatible clients. Four read-only tools are free; the file-writing tools are paid. - [PesterForge MCP setup](https://detentpoint.com/pesterforge/mcp/setup): Add PesterForge MCP to Claude Code or any MCP client. Stdio by default, every setting a PESTERFORGE_ env var, logging on stderr where it belongs. - [PesterForge MCP tool reference](https://detentpoint.com/pesterforge/mcp/tools): All seven PesterForge MCP tools in one table: what each one does and which ones are free. - [PesterForge: Pricing & Plans](https://detentpoint.com/pesterforge/pricing): The PesterForge module and four read-only MCP tools are free. Paid tiers add two file-writing tools, free for a limited time at launch. - [PesterForge quick start](https://detentpoint.com/pesterforge/quick-start): Install PesterForge, generate a Pester test file for one of your functions, run it, and audit your module for coverage gaps. Five steps, real commands. - [PesterForge security](https://detentpoint.com/pesterforge/security): PesterForge MCP security: no network calls by default, air-gap safe output, injection containment, clean cancellation. Proven by named tests. - [How PesterForge Compares](https://detentpoint.com/pesterforge/vs): A fact-checked look at where PesterForge sits next to Pester, SAPIEN PowerShell Studio and PrimalScript, and Ironman PowerShell Pro Tools. - [PesterForge inside DetentShell](https://detentpoint.com/pesterforge/workbench): DetentShell is a modern IDE for PowerShell 7. PesterForge ships inside it as the built-in test generator, free in the app, running in-process. ## Blog - [Blog](https://detentpoint.com/blog): Every Detent Point product blog in one place: DetentShell, PesterForge, ClusterValidator, SqlCertForge, WikiMint, GitEasy, MCPatrol, and more. Searchable. - [What we actually use HTTP 402 for](https://detentpoint.com/blog/402-payments): We wanted the forgotten Payment Required status code for license checkout. It ended up somewhere better: letting AI agents buy single API calls. - [I'm a DBA, not a developer — here's how I save my SQL to Git without learning Git](https://detentpoint.com/blog/dba-saves-sql-to-git-without-learning-git): A SQL DBA explains how GitEasy wraps Git in plain-English PowerShell commands so non-developers can save and publish work without learning the jargon. - [An ISE for PowerShell 7](https://detentpoint.com/blog/detentshell-an-ise-for-powershell-7): Microsoft has said it plainly: the Windows PowerShell ISE is no longer being developed. It belongs to Windows PowerShell 5.1, and 5.1 is in maintenance.... - [Autocomplete that knows what you imported](https://detentpoint.com/blog/detentshell-autocomplete-that-knows-your-session): There are two ways to build PowerShell completion. Ship a static catalog of known cmdlets and hope it covers what the user types, or ask the engine that... - [Console color without wrecking your log files](https://detentpoint.com/blog/detentshell-console-color-and-clean-log-files): PowerShell 7 colors its output with ANSI escape codes. Get-ChildItem gets colored file names, table headers come out green, and in a terminal the engine... - [Debugging with the keys you already know](https://detentpoint.com/blog/detentshell-debugging-with-the-keys-you-know): Set a breakpoint by clicking the gutter or pressing F9. Press F5. Execution stops on the red dot. F10 steps over, F11 steps into, Shift+F11 steps out, F... - [F1 when the help isn't downloaded yet](https://detentpoint.com/blog/detentshell-f1-before-update-help): Press F1 on Get-ChildItem in a fresh PowerShell 7 install and you run into one of the platform’s quieter awkward facts: there is almost no help on the b... - [Our test generator writes "FILL IN" instead of guessing](https://detentpoint.com/blog/detentshell-fill-in-instead-of-guessing): A test generator can see your function’s shape: the parameters, the output, the calls inside. It cannot see what the function is supposed to do. Correct... - [From a generated test to project coverage](https://detentpoint.com/blog/detentshell-from-generated-test-to-coverage): A generated test file sitting in a tab is only interesting once. The Pester panel is what makes it part of a routine. The panel (View menu, or it appear... - [Getting Read-Host right in a GUI host](https://detentpoint.com/blog/detentshell-getting-read-host-right): There’s a classic failure in embedded PowerShell consoles, and it starts with a script asking a question. Read-Host in a GUI host that didn’t plan for i... - [How tabs and sessions share state](https://detentpoint.com/blog/detentshell-how-tabs-and-sessions-share-state): Our own test checklist got this wrong once, so it earns a full explanation. The checklist item was named “multi-tab isolation.” Set $secret = 42 in tab... - [One script runs every test before a release](https://detentpoint.com/blog/detentshell-one-script-before-every-release): The question that started this was asked out loud, a little annoyed: we have done a crap ton of testing in the past. Is there any way of making sure we... - [Running PowerShell 7 and 5.1 in the same window](https://detentpoint.com/blog/detentshell-powershell-7-and-51-side-by-side): Ask an admin which PowerShell they use and the answer is usually both. PowerShell 7 for new work. Windows PowerShell 5.1 for the module that never got p... - [Quick Fix previews everything before it touches your script](https://detentpoint.com/blog/detentshell-quick-fix-previews-everything): Automated code fixers have earned their reputation. Most people have watched one “clean up” a working script into a broken one, or rewrite a file in pla... - [Reading a 2,000-line script you didn't write](https://detentpoint.com/blog/detentshell-reading-a-script-you-didnt-write): The scripts that matter are rarely tidy. The one you inherit is two thousand lines long, defines forty functions, and was organized by appending. Detent... - [Remote tabs show you whose machine you're on](https://detentpoint.com/blog/detentshell-remote-tabs-show-you-where-you-are): The most expensive command in remote administration is the one that runs on the wrong box. Everyone who manages servers has done it or watched it: ident... - [Show-Command and snippets](https://detentpoint.com/blog/detentshell-show-command-and-snippets): Both of these features were cut from the plan at one point. Both got built anyway, and when the question of removing them came up, the argument that set... - [Small features from the ISE we refused to lose](https://detentpoint.com/blog/detentshell-small-things-from-the-ise): None of these would headline a release. Together they’re most of what made the ISE feel lived-in, so they all came along. Edit Profile, on the Tools men... - [How we test DetentShell's UI in Windows Sandbox](https://detentpoint.com/blog/detentshell-testing-the-app-by-clicking-on-it): Our unit suite once told us the debugger was fine while F5 was dead at every breakpoint. Nine hundred tests, all green. Every command and view-model beh... - [The badge that tells you a script won't survive PowerShell 7](https://detentpoint.com/blog/detentshell-the-compatibility-badge): The risky scripts in any shop are the ones nobody has tried on PowerShell 7 yet. They sit in a folder, they matter, and the assumption is they’ll port f... - [We run the same test suite in pwsh and in DetentShell](https://detentpoint.com/blog/detentshell-the-same-tests-run-in-pwsh): Anyone who’s used an embedded PowerShell console has a story about the day it behaved differently from the real one. The engine is identical; the hostin... - [The tab label nobody could see](https://detentpoint.com/blog/detentshell-the-tab-label-nobody-could-see): We once shipped a tab you couldn’t read. The label rendered, technically, in a color that matched its background in one particular theme. A screenshot r... - [There's no telemetry in DetentShell](https://detentpoint.com/blog/detentshell-there-is-no-telemetry): Most feature lists describe what a product does. This one is about what DetentShell doesn’t do, on purpose, because for a scripting tool the absences ma... - [What happens when you click Stop](https://detentpoint.com/blog/detentshell-what-happens-when-you-click-stop): Everyone writes an accidental while ($true) eventually. The interesting question is what the next ten seconds look like. Here they’re uneventful. Click... - [What Narrator hears when it opens DetentShell](https://detentpoint.com/blog/detentshell-what-narrator-hears): Turn on Narrator and tab across the toolbar of most home-grown developer tools. You’ll hear “button.” Then “button” again. Fourteen times, if the toolba... - [Why debugging makes you save first](https://detentpoint.com/blog/detentshell-why-debugging-asks-you-to-save): Start a debug run on an unsaved buffer in DetentShell and you get a prompt: save, or cancel. There is no third button. This generates questions, so here... - [Save-Work: one command, four Git steps, and three ways I almost leaked your password](https://detentpoint.com/blog/giteasy-save-work-deep-dive): A deep look at how GitEasy's core command works under the hood — including the credential security problems I found and fixed along the way. - [Meet ClusterValidator](https://detentpoint.com/blog/launch): A read-only health validator for Windows Server Failover Clusters. It runs in your network, needs no license for small estates, and changes nothing. - [Uptime isn't the whole story: monitoring MCP inventory drift](https://detentpoint.com/blog/mcpatrol-mcp-inventory-drift): An MCP server can be up while a tool your agents depend on quietly vanishes or changes schema. Why inventory change detection matters as much as uptime,... - [Checking registry listings without scraping anyone](https://detentpoint.com/blog/mcpatrol-registry-checks-without-scraping): mcp.so and Glama disallow crawling their search pages — and both publish sitemaps. How MCPatrol verifies your MCP server listings with a handful of site... - [I measured my own test generator against 195 real functions. It was humbling.](https://detentpoint.com/blog/measuring-my-own-test-generator): What happened when I pointed PesterForge's evaluation harness at dbatools and my own modules — the numbers, the bugs it exposed, and why the failures pe... - [How ClusterValidator works offline](https://detentpoint.com/blog/offline-architecture): No license server, no phone-home. How a signed file and a local public key replace the call home. - [Capstone: The Complete Partner Feed Guardian Testing Strategy](https://detentpoint.com/blog/pester-capstone-the-complete-partner-feed-guardian-testing-strategy): Assemble unit, integration, preflight, deployment, production, drift, and recovery suites into one controlled PowerShell lifecycle. - [Deployment Verification and Progressive Rollout with Pester](https://detentpoint.com/blog/pester-deployment-verification-and-progressive-rollout-with-pester): A successful copy or install command is not proof that the right code is loaded, callable, and safe to roll across production. - [Design PowerShell That Can Be Tested—and Stopped](https://detentpoint.com/blog/pester-design-powershell-that-can-be-tested-and-stopped): Production safety starts before Pester: separate inspection, decisions, planning, approval, execution, and verification. - [Announcing "Pester for Beginners" — the whole 25-part series, all at once](https://detentpoint.com/blog/pester-for-beginners-series-launch): A complete beginner-to-confident series on testing PowerShell with Pester 5 — written offline, finished first, and released as one full set. - [Pester 6 Is Here: What It Means for the Pester for Beginners Series](https://detentpoint.com/blog/pester-pester-6-is-here-what-it-means-for-the-pester-for-beginners-series): Pester 6 changes assertions, discovery, mocking, coverage, and execution—but your Pester 5 knowledge is still useful. - [Pester, Drift Detection, Monitoring, and Alerts](https://detentpoint.com/blog/pester-pester-drift-detection-monitoring-and-alerts): Pester can evaluate production expectations, but it should not quietly become your metrics database, dashboard, paging system, and incident process. - [Preflight: Stop Before the First Production Change](https://detentpoint.com/blog/pester-preflight-stop-before-the-first-production-change): Use Pester as a strict preflight gate that proves the target, identity, starting state, approvals, and recovery path are ready. - [Rollback, Recovery, and Incident-Generated Pester Tests](https://detentpoint.com/blog/pester-rollback-recovery-and-incident-generated-pester-tests): A rollback plan is only a theory until Pester proves the prerequisites, restored version, recovered state, and permanent regression test. - [Safe Production Tests and Synthetic Transactions with Pester](https://detentpoint.com/blog/pester-safe-production-tests-and-synthetic-transactions-with-pester): Production tests do not have to be read-only, but every state change must be isolated, identifiable, limited, reversible, and owned. - [State Changes, Partial Failure, and Safe Repetition](https://detentpoint.com/blog/pester-state-changes-partial-failure-and-safe-repetition): Test what remains after a production operation fails halfway—and prove that rerunning it will not make the damage worse. - [The Fast Gate: Decisions, Boundaries, and Regression Tests](https://detentpoint.com/blog/pester-the-fast-gate-decisions-boundaries-and-regression-tests): Build a Pester suite that blocks unsafe code changes without requiring live infrastructure. - [The Real Dependency and the Real Execution Identity](https://detentpoint.com/blog/pester-the-real-dependency-and-the-real-execution-identity): A script that works for you may still fail under the scheduled account, module path, secret store, and noninteractive session used in production. - [What Decision Does This Pester Test Control?](https://detentpoint.com/blog/pester-what-decision-does-this-pester-test-control): A production test is useful only when you know what risk it addresses and what its result is allowed to stop. - [Read-only is the point](https://detentpoint.com/blog/readonly-validation): Why ClusterValidator observes your cluster and refuses to touch it, and what that buys you at 2 a.m. and in an audit. - [SQL Server 2025 renamed a certificate type and my green test suite never noticed](https://detentpoint.com/blog/sql-server-2025-renamed-a-certificate-type): Six real bugs live validation caught after the mocked unit tests passed every one of them, and why a mock that returns the expected value is testing itself. - [SqlCertForge 2.0: every certificate on SQL Server, not just the TLS binding](https://detentpoint.com/blog/sqlcertforge-2-every-certificate): The tool that bound a TLS certificate to SQL Server now inventories every certificate surface — TDE, Always Encrypted, endpoints, backup encryption, cell-level, PolyBase — and proved every one of them on real SQL Server 2025. - [I built a Kerberos SPN tool because setspn.exe made me feel stupid](https://detentpoint.com/blog/sqlspnmanager-deep-dive): SqlSpnManager was the first module I published to PowerShell Gallery — and not the first one I built. Here's what it does, why it exists, and how the pl... - [Why we built WikiMint](https://detentpoint.com/blog/why-we-built-wikiengine): The day an AI tool confidently documented a parameter that did not exist.