Release notes

v1.0.1

Version 1.0.1 of the self-contained Windows PowerShell 5.1 script for ConfigMgr OSD targets a regular GitHub release. The workflow validates and packages a prerelease candidate. The maintainer verifies downloaded assets and approves promotion of the same release to regular/latest. The release label describes distribution, not production testing or universal compatibility.

Changes

• Preserve LDAP and directory result codes when exceptions contain an inner cause. Invalid credentials stop further bind attempts; duplicate-member races still require membership verification.
• Classify structured errors by their codes rather than letting server text override a transient result.
• Dispose domain, domain-controller, site, and script-owned secure-password resources when finished, including failure paths.
• Deduplicate group names case-insensitively while preserving their input order.
• Extend mocked regression coverage and simplify the deployment, troubleshooting, and validation guides.

Deployment

Run as Local System in an active ConfigMgr Task Sequence in full Windows, after domain join and restart, using Windows PowerShell 5.1. Set the hidden custom variables ADGroupUserName and ADGroupPassword immediately before the script step. Clear both on success and failure, preserving the script’s exit code.

Kerberos over LDAPS on TCP 636 remains the default. There is no automatic transport or authentication fallback. An exit code of 0 requires verified direct membership in every requested group; successful additions are not rolled back if another group fails.

Download the versioned ZIP and its matching SHA-256 sidecar together from GitHub Releases. Check the release’s current status and verify the archive hash before packaging the script. Promotion changes release metadata, not the tag or asset bytes; see the two-stage release process. Published versions are not silently replaced.

Validation and rollout

Windows PowerShell 5.1 parser checks, PSScriptAnalyzer 1.25.0, Pester 5.7.1, and exact-byte source manifest verification pass for this source. Automated tests use mocked Task Sequence and LDAP boundaries; they do not write to a live directory. Consult CI for the relevant revision’s remote validation status.

Live ConfigMgr and Active Directory testing was not executed. Before broad rollout, complete the environment-validation checklist in a controlled Task Sequence, review compatibility and security, and verify credential cleanup and failure propagation.