This is the 2026-10-16 v1.0.0 baseline, prepared after an explicit maintainer version reset. Earlier downloads with the same version label may contain different bytes. Identify this baseline by its current release SHA-256 values, not the label alone.
- The reviewed, self-contained Windows PowerShell 5.1 script with Kerberos/LDAPS, direct membership verification, bounded retries, and CMTrace logging.
- Matching documentation, responsive artwork, editor tasks, and automated tests.
- A public standalone gist with the same script bytes, MIT license, and checksum file.
- Preserve transient LDAP error codes when server text resembles a locally generated missing-group diagnostic; retry exhaustion remains transient.
- Use the visible Pages brand text as its accessible link name.
Security defaults are unchanged from the reviewed source. The script remains MIT licensed; required third-party asset notices are retained.
Use Windows PowerShell 5.1 as Local System in an active ConfigMgr task sequence, in full Windows after domain join and restart. Kerberos over LDAPS remains the default. Preserve native success/failure credential cleanup and the saved result. Check the deployment guide before changing an existing package-source layout.
Validation covers parsing, static analysis, Pester, generated artwork, version/tag agreement, and exact-byte source checksums. The existing workflow creates a prerelease candidate; downloaded-asset verification and explicit maintainer approval precede regular/latest promotion without changing the tag or asset bytes.
Live ConfigMgr and Active Directory testing was not executed. A regular release does not certify your environment. Use the validation checklist before broad rollout.
See development for workstation setup and release process for package verification and approval.