0

I work in the software development side of an ISV. We're thinking of using PowerShell for some utilities in and around the core application (which itself is ASP.NET).

One of my colleagues said to me that most serious customers would consider PowerShell to be a complete no-no in a production environment, and would reject this out-of-hand. Is he right?

4
  • 8
    Considering PowerShell has been Microsofts core shell and automation offering for (what...ten?) years and is in a highly mature state, one might: 1) ask what alternative is suggested by your colleague. 2) ask for a well founded source to his stance. 3) suggest proper QA to handle risks (just as with anything else really). It's like saying bash is inappropriate for use on a Linux platform.
    – ErikE
    Jun 23, 2015 at 12:12
  • 7
    One thing to consider is that you should sign your code with a valid certificate so that you're not asking your customers to change their execution policy. A serious customer would and should reject that.
    – mfinni
    Jun 23, 2015 at 12:52
  • 1
    @mfinni yes. I sign every script I sent out to our customers, and I made Sign-Script alias that does this easily. But so many people don't. Jun 27, 2015 at 2:52
  • Thanks so much for all the comments and replies. I guess my colleague's concerns were just a bit out of date. We'll proceed with using powershell and make sure to sign the scripts before issuing them to customers.
    – Andy
    Jul 3, 2015 at 5:58

3 Answers 3

4

PowerShell is included and enabled by default in the last several versions of Windows Server.

If the "serious customers" are using Microsoft technology, then they are almost certainly using PowerShell already, even if it's hidden behind other management GUIs, or have PowerShell present even if they aren't deliberately using it.

Microsoft server software in 2015 is managed by PowerShell.

And extending out to third parties including VMware, NetApp, Equallogic

It is possible to remove PowerShell, I'd be interested to hear of anyone who does, or what the limits of Windows Server 2012 R2 are with it removed.

1
  • 1
    I just un-installed PowerShell on a fresh 2012 R2 and it got turned into Server Core in the process. Explorer shell, mmc.exe all gone. At this point I could still install and manage IIS from the command line. Many of these products and roles have supporting PowerShell cmdlets, but I would say most of them do not require PowerShell yet. Most of them still use COM APIs and PowerShell is just a layer on top of those. But it seems with newer management tools, Microsoft relies more and more on PowerShell, fine with me. Jun 24, 2015 at 13:46
1

Think about the alternatives, you could use batch-commands, vb-scripts or your own compiled binaries to manage your product. Why would a potential customer trust these technologies any more than PowerShell?

While PowerShell is considered very powerful in the end you can do everything with any of these technologies. In the end they all call Windows APIs.

So, PowerShell is not less secure than the alternatives. It is actually pretty easy to require all scripts to be signed before the can be run (you can do the same with vb-scripts though).

Also as an administrator I would prefer a PowerShell script over a C# binary because I could quickly check and review what the script is doing.

With things like the Just Enough Administration toolkit one can limit what and when certain administrators can do certain things, locking down the system even further.

So, not allowing PowerShell in a professional Windows shop is weird to say the least.

Try managing a Windows Nano Server without PowerShell.

Why not talk to some of your potential customers and ask them about this. I'm interested to hear any arguments against using PowerShell.

1

Sounds like your colleague needs to do some reading. PowerShell is at the core of everything in Windows 2012. Part of the goal of PowerShell is to eliminate the need for teams at MS to create their own wizards and GUIs...just create PowerShell cmdlets for everything and then put a GUI on top of it. Not everything is there yet, but the AD promotion wizard is a perfect example. Go through the clicks and you're left with a PowerShell command that you could have used in the first place.

PowerShell all the way....do it over the HTTPS connection and you're as secure, or maybe even moreso, than any SSH-based connection your Linux admins probably use.

Not the answer you're looking for? Browse other questions tagged .