Merge branch 'development' into claude/issue-10004-20260314-1653

Author: andreasjordan

bin/dbatools-buildref-index.json

@@ -1,5 +1,5 @@
 {
-    "LastUpdated": "2026-03-12T00:00:00",
+    "LastUpdated": "2026-03-13T00:00:00",
     "Data": [
         {
             "Version": "8.0.47",
@@ -5082,6 +5082,11 @@
             "Version": "16.0.4240",
             "KBList": "5077464"
         },
+        {
+            "CU": "CU24",
+            "Version": "16.0.4245",
+            "KBList": "5080999"
+        },
         {
             "Version": "17.0.100",
             "Name": "2025"
@@ -5125,6 +5130,11 @@
         {
             "Version": "17.0.4020",
             "KBList": "5077466"
+        },
+        {
+            "CU": "CU3",
+            "Version": "17.0.4025",
+            "KBList": "5077896"
         }
     ]
 }

bin/dbatools-index.json

@@ -11,7 +11,7 @@
     RootModule         = 'dbatools.psm1'
 
     # Version number of this module.
-    ModuleVersion      = '2.7.26'
+    ModuleVersion      = '2.7.27'
 
     # ID used to uniquely identify this module
     GUID               = '9d139310-ce45-41ce-8e8b-d76335aa1789'
@@ -196,6 +196,7 @@
         'Get-DbaAgHadr',
         'Get-DbaAgListener',
         'Get-DbaAgReplica',
+        'Get-DbaAgRingBuffer',
         'Get-DbaAvailabilityGroup',
         'Get-DbaAvailableCollation',
         'Get-DbaBackupDevice',
@@ -539,6 +540,7 @@
         'Remove-DbaAgentAlert',
         'Remove-DbaAgentJob',
         'Remove-DbaAgentJobCategory',
+        'Remove-DbaAgentJobSchedule',
         'Remove-DbaAgentJobStep',
         'Remove-DbaAgentOperator',
         'Remove-DbaAgentSchedule',
@@ -621,6 +623,7 @@
         'Set-DbaDbFileGroup',
         'Set-DbaDbFileGrowth',
         'Set-DbaDbIdentity',
+        'Set-DbaDbMailAccount',
         'Set-DbaDbMirror',
         'Set-DbaDbOwner',
         'Set-DbaDbQueryStoreOption',
@@ -668,6 +671,7 @@
         'Sync-DbaLoginPassword',
         'Sync-DbaLoginPermission',
         'Test-DbaAgentJobOwner',
+        'Test-DbaAgPolicyState',
         'Test-DbaAvailabilityGroup',
         'Test-DbaBackupInformation',
         'Test-DbaBuild',
@@ -703,6 +707,7 @@
         'Test-DbaOptimizeForAdHoc',
         'Test-DbaPath',
         'Test-DbaPowerPlan',
+        'Test-DbaInstantFileInitialization',
         'Test-DbaReplLatency',
         'Test-DbaSpn',
         'Test-DbaTempDbConfig',

dbatools.psd1

@@ -555,6 +555,7 @@ if ($PSVersionTable.PSVersion.Major -lt 5) {
         'Remove-DbaAgentJob',
         'New-DbaAgentJobStep',
         'Set-DbaAgentJobStep',
+        'Remove-DbaAgentJobSchedule',
         'Remove-DbaAgentJobStep',
         'New-DbaAgentSchedule',
         'Set-DbaAgentSchedule',
@@ -607,6 +608,7 @@ if ($PSVersionTable.PSVersion.Major -lt 5) {
         'Mount-DbaDatabase',
         'Dismount-DbaDatabase',
         'Get-DbaAgReplica',
+        'Get-DbaAgRingBuffer',
         'Get-DbaAgDatabase',
         'Get-DbaAgDatabaseReplicaState',
         'Get-DbaModule',
@@ -710,6 +712,7 @@ if ($PSVersionTable.PSVersion.Major -lt 5) {
         'New-DbaDbMailServer',
         'New-DbaDbMailAccount',
         'New-DbaDbMailProfile',
+        'Set-DbaDbMailAccount',
         'Get-DbaResourceGovernor',
         'Get-DbaRgResourcePool',
         'Get-DbaRgWorkloadGroup',
@@ -893,6 +896,7 @@ if ($PSVersionTable.PSVersion.Major -lt 5) {
         'Remove-DbaDbFileGroup',
         'Set-DbaDbFileGroup',
         'Remove-DbaLinkedServer',
+        'Test-DbaAgPolicyState',
         'Test-DbaAvailabilityGroup',
         'Export-DbaUser',
         'Get-DbaSsisExecutionHistory',
@@ -1085,6 +1089,7 @@ if ($PSVersionTable.PSVersion.Major -lt 5) {
         'Get-DbaDiskSpace',
         'Test-DbaDiskAllocation',
         'Test-DbaPowerPlan',
+        'Test-DbaInstantFileInitialization',
         'Set-DbaPowerPlan',
         'Test-DbaDiskAlignment',
         'Get-DbaStartupParameter',

dbatools.psm1

@@ -8,6 +8,7 @@ function Start-DbccCheck {
     )
 
     $servername = $server.name
+    $escapedDbName = $DbName.Replace("]", "]]")
 
     if ($Pscmdlet.ShouldProcess($sourceserver, "Running dbcc check on $DbName on $servername")) {
         if ($server.ConnectionContext.StatementTimeout -ne 0) {
@@ -17,17 +18,24 @@ function Start-DbccCheck {
         try {
             if ($table) {
                 $null = $server.databases[$DbName].CheckTables('None')
-                Write-Verbose "Dbcc CheckTables finished successfully for $DbName on $servername"
+                Write-Verbose "DBCC CheckTables finished successfully for $DbName on $servername"
+                return [PSCustomObject]@{
+                    Status = "Success"
+                    Output = $null
+                }
             } else {
                 if ($MaxDop) {
-                    $null = $server.Query("DBCC CHECKDB ([$DbName]) WITH MAXDOP = $MaxDop")
-                    Write-Verbose "Dbcc CHECKDB finished successfully for $DbName on $servername"
+                    $query = "DBCC CHECKDB ([$escapedDbName]) WITH MAXDOP = $MaxDop"
                 } else {
-                    $null = $server.Query("DBCC CHECKDB ([$DbName])")
-                    Write-Verbose "Dbcc CHECKDB finished successfully for $DbName on $servername"
+                    $query = "DBCC CHECKDB ([$escapedDbName])"
+                }
+                $dbccOutput = Invoke-DbaQuery -SqlInstance $server -Query $query -MessagesToOutput -EnableException
+                Write-Verbose "DBCC CHECKDB finished successfully for $DbName on $servername"
+                return [PSCustomObject]@{
+                    Status = "Success"
+                    Output = $dbccOutput
                 }
             }
-            return "Success"
         } catch {
             $originalException = $_.Exception
             $loopNo = 0
@@ -61,7 +69,10 @@ function Start-DbccCheck {
             } catch {
                 $null
             }
-            return $message.Trim()
+            return [PSCustomObject]@{
+                Status = $message.Trim()
+                Output = $null
+            }
         }
     }
-}
+}

private/functions/Start-DbccCheck.ps1

@@ -71,6 +71,29 @@ function Update-ServiceStatus {
         $svcControlBlock = {
             $group = $_.Group
             $computerName = $_.Name
+            # Create a CIM session preferring DCOM to avoid requiring WinRM on the target machine.
+            # CIM instances become deserialized when crossing runspace boundaries and lose their
+            # session context, causing Invoke-CimMethod to attempt a new WinRM connection by default.
+            # Using DCOM avoids this WinRM dependency for machines where WinRM is not configured.
+            $splatCimDcomOption = @{
+                Protocol = "Dcom"
+            }
+            $cimDcomOption = New-CimSessionOption @splatCimDcomOption
+            $splatCimSessionDcom = @{
+                ComputerName  = $computerName
+                SessionOption = $cimDcomOption
+                ErrorAction   = "Stop"
+            }
+            try {
+                $cimSession = New-CimSession @splatCimSessionDcom
+            } catch {
+                # Fall back to default protocol (WinRM) if DCOM is unavailable
+                try {
+                    $cimSession = New-CimSession -ComputerName $computerName -ErrorAction "Stop"
+                } catch {
+                    $cimSession = $null
+                }
+            }
             $servicePriorityCollection = $group.ServicePriority | Select-Object -unique | Sort-Object -Property @{ Expression = { [int]$_ }; Descending = $action -ne 'stop' }
             foreach ($priority in $servicePriorityCollection) {
                 $services = $group | Where-Object { $_.ServicePriority -eq $priority }
@@ -104,6 +127,23 @@ function Update-ServiceStatus {
         $invokeResults = @()
         foreach ($service in $servicesToRestart) {
             if ($Pscmdlet.ShouldProcess("Sending $action request to service $($service.ServiceName) on $($service.ComputerName)")) {
+                # Get a fresh CIM instance via the DCOM session to avoid issues with deserialized
+                # CIM objects crossing runspace boundaries without their session context.
+                if ($cimSession) {
+                    try {
+                        $splatGetFreshCim = @{
+                            CimSession = $cimSession
+                            Namespace  = "root\cimv2"
+                            Query      = "SELECT * FROM Win32_Service WHERE Name = '$($service.ServiceName)'"
+                        }
+                        $freshCimObj = Get-CimInstance @splatGetFreshCim
+                        if ($freshCimObj) {
+                            $service._CimObject = $freshCimObj
+                        }
+                    } catch {
+                        # Fall back to using the existing deserialized CIM object if session refresh fails
+                    }
+                }
                 #Invoke corresponding CIM method
                 $invokeResult = Invoke-CimMethod -InputObject $service._CimObject -MethodName $methodName
                 $invokeResults += [psobject]@{
@@ -123,7 +163,19 @@ function Update-ServiceStatus {
                 foreach ($result in ($invokeResults | Where-Object CheckPending -eq $true)) {
                     try {
                         #Refresh Cim instance - not using Get-DbaCmObject because module is not loaded here, but it only refreshes existing object
-                        $result.Service._CimObject = $result.Service._CimObject | Get-CimInstance
+                        if ($cimSession) {
+                            $splatRefreshCim = @{
+                                CimSession = $cimSession
+                                Namespace  = "root\cimv2"
+                                Query      = "SELECT State FROM Win32_Service WHERE Name = '$($result.Service.ServiceName)'"
+                            }
+                            $refreshedCimObj = Get-CimInstance @splatRefreshCim
+                            if ($refreshedCimObj) {
+                                $result.Service._CimObject = $refreshedCimObj
+                            }
+                        } else {
+                            $result.Service._CimObject = $result.Service._CimObject | Get-CimInstance
+                        }
                     } catch {
                         $result.ServiceExitCode = -3
                         $result.ServiceState = 'Unknown'
@@ -177,6 +229,11 @@ function Update-ServiceStatus {
             $result
         }
     }
+    # Clean up the CIM session created for DCOM connections
+    if ($cimSession) {
+        Remove-CimSession -CimSession $cimSession -ErrorAction "SilentlyContinue"
+        $cimSession = $null
+    }
 }
 
 $actionText = switch ($action) { stop { 'stopped' }; start { 'started' }; restart { 'restarted' } }

private/functions/Update-ServiceStatus.ps1

@@ -83,6 +83,12 @@ function Add-DbaAgDatabase {
         When enabled, Restore-DbaDatabase uses the replica's default data and log directories instead of attempting to replicate the primary's folder structure.
         This is automatically set to true when the primary and replica servers run on different operating system platforms (e.g., Windows primary with Linux replica).
 
+    .PARAMETER MasterKeySecurePassword
+        Password for creating or opening the database master key on secondary replicas when adding TDE-encrypted databases.
+        When a database is protected by Transparent Data Encryption (TDE), the certificate used to protect the Database Encryption Key must exist on every secondary replica.
+        Providing this parameter together with SharedPath allows the command to automatically copy the TDE certificate from the primary to each secondary replica.
+        If the secondary already has a master key, this password is used to create one if it is missing.
+
     .PARAMETER WhatIf
         Shows what would happen if the command were to run. No actions are actually performed.
 
@@ -242,6 +248,9 @@ function Add-DbaAgDatabase {
         [switch]$SkipReuseSourceFolderStructure,
         [Parameter(ParameterSetName = 'NonPipeline')]
         [Parameter(ParameterSetName = 'Pipeline')]
+        [Security.SecureString]$MasterKeySecurePassword,
+        [Parameter(ParameterSetName = 'NonPipeline')]
+        [Parameter(ParameterSetName = 'Pipeline')]
         [switch]$EnableException
     )
 
@@ -365,6 +374,49 @@ function Add-DbaAgDatabase {
                 }
             }
 
+            # For TDE-encrypted databases, the master certificate must exist on every secondary replica
+            # before a backup can be restored or automatic seeding can succeed.
+            if ($db.EncryptionEnabled -and $db.HasDatabaseEncryptionKey -and $db.DatabaseEncryptionKey.EncryptorType -eq "ServerCertificate") {
+                $encryptorName = $db.DatabaseEncryptionKey.EncryptorName
+                Write-Message -Level Verbose -Message "Database $($db.Name) is TDE-encrypted using certificate '$encryptorName'. Checking secondary replicas."
+                if ($SharedPath) {
+                    $failure = $false
+                    foreach ($replicaName in $replicaServerSMO.Keys) {
+                        $replicaServer = $replicaServerSMO[$replicaName]
+                        $existingCert = Get-DbaDbCertificate -SqlInstance $replicaServer -Database master -Certificate $encryptorName
+                        if (-not $existingCert) {
+                            if ($Pscmdlet.ShouldProcess($replicaServer, "Copy TDE certificate '$encryptorName' from primary to replica $replicaName")) {
+                                try {
+                                    Write-Message -Level Verbose -Message "TDE certificate '$encryptorName' not found on $replicaName. Copying from primary."
+                                    $splatTdeCert = @{
+                                        Source          = $server
+                                        Destination     = $replicaServer
+                                        Database        = "master"
+                                        Certificate     = $encryptorName
+                                        SharedPath      = $SharedPath
+                                        EnableException = $true
+                                    }
+                                    if ($MasterKeySecurePassword) {
+                                        $splatTdeCert.MasterKeyPassword = $MasterKeySecurePassword
+                                    }
+                                    $null = Copy-DbaDbCertificate @splatTdeCert
+                                } catch {
+                                    $failure = $true
+                                    Stop-Function -Message "Failed to copy TDE certificate '$encryptorName' to replica $replicaName." -ErrorRecord $_ -Continue
+                                }
+                            }
+                        } else {
+                            Write-Message -Level Verbose -Message "TDE certificate '$encryptorName' already exists on replica $replicaName."
+                        }
+                    }
+                    if ($failure) {
+                        Stop-Function -Message "Failed to copy TDE certificate to all replicas for database $($db.Name)." -Continue
+                    }
+                } else {
+                    Write-Message -Level Warning -Message "Database $($db.Name) is TDE-encrypted with certificate '$encryptorName', but no SharedPath was provided. The TDE certificate must exist on all secondary replicas before the database can be added. Use -SharedPath and optionally -MasterKeySecurePassword to enable automatic certificate copying."
+                }
+            }
+
             $progress['Status'] = "Step 2/5: Running backup and restore if needed"
             Write-Message -Level Verbose -Message $progress['Status']
             Write-Progress @progress