Windows

---

name: Windows description: Windows-specific patterns, security practices, and operational traps that cause silent failures. metadata: category: system skills: ["windows", "powershell", "security", "automation"]

---

Credential Management

Never hardcode passwords in scripts — use Windows Credential Manager:

  # Store
  cmdkey /generic:"MyService" /user:"admin" /pass:"secret"
  # Retrieve in script
  $cred = Get-StoredCredential -Target "MyService"
  

For scripts, use Get-Credential and export securely:

  $cred | Export-Clixml -Path "cred.xml"  # Encrypted to current user/machine
  $cred = Import-Clixml -Path "cred.xml"
  

Silent Failures

Windows Defender silently quarantines downloaded scripts/executables — check quarantine if script disappears

Group Policy overrides local settings silently — gpresult /r to see what's actually applied

Antivirus real-time scanning blocks file operations intermittently — add exclusions for build/automation folders

PowerShell -ErrorAction SilentlyContinue hides problems — use Stop and handle explicitly

Symbolic Links

Creating symlinks requires admin OR SeCreateSymbolicLinkPrivilege — regular users fail silently

Enable Developer Mode for symlinks without admin: Settings → For Developers → Developer Mode

mklink is CMD-only, PowerShell uses New-Item -ItemType SymbolicLink

Script Signing

Unsigned scripts fail on restricted machines with confusing errors — sign for production:

  $cert = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert
  Set-AuthenticodeSignature -FilePath script.ps1 -Certificate $cert
  

AllSigned policy requires ALL scripts signed including profile.ps1

Operational Safety

Always -WhatIf first on destructive operations — Remove-Item -Recurse -WhatIf

Start-Transcript for audit trail — forgotten until incident investigation

NTFS permissions: icacls for CLI, but inheritance rules are non-obvious — test changes on copy first

WinRM Remoting

Enable correctly: Enable-PSRemoting -Force isn't enough on workgroups

Workgroup machines need TrustedHosts: Set-Item WSMan:\localhost\Client\TrustedHosts -Value "server1,server2"

HTTPS remoting needs certificate setup — HTTP sends credentials readable on network

Event Logging

Scripts should log to Windows Event Log for centralized monitoring:

  New-EventLog -LogName Application -Source "MyScript" -ErrorAction SilentlyContinue
  Write-EventLog -LogName Application -Source "MyScript" -EventId 1000 -Message "Started"
  

Custom event sources require admin to create — create during install, not runtime

File Locking

Windows locks files aggressively — test file access before operations:

  try { [IO.File]::OpenWrite($path).Close(); $true } catch { $false }
  

Scheduled tasks writing to same file as user → conflicts. Use unique temp files and atomic rename

Temp File Hygiene

$env:TEMP fills silently — scripts should cleanup with try/finally:

  $tmp = New-TemporaryFile
  try { ... } finally { Remove-Item $tmp -Force }
  

Orphaned temp files accumulate across reboots — unlike Linux /tmp

Service Account Gotchas

Services run in different user context — $env:USERPROFILE points to system profile, not user's

Network access from SYSTEM account uses machine credentials — may fail where user succeeds

Mapped drives don't exist for services — use UNC paths \\server\share