diff --git a/CHANGELOG.md b/CHANGELOG.md index 0a21215..90918e0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [5.2.0] - 2026-10-07 + ### Changed - The one-shot `SPSUpdate-RebootConfirm` boot task (automatic reboot) now runs as **`NT AUTHORITY\SYSTEM`** instead of the farm InstallAccount decrypted from `secrets.psd1`. This removes the stored-credential dependency that could abort the reboot at task registration (`0x8007052E` when the secret did not match the account password) and decouples the reboot from password rotation. `Add-SPSScheduledTask` gains a `-RunAsSystem` switch (mutually exclusive with `-ExecuteAsCredential`). Because a `SYSTEM` task reaches a UNC status store as the computer account, the share must grant the farm computer accounts (e.g. `Domain Computers`) Modify — add them to `New-SPSDashboardSite.ps1 -WriteAccounts`; `-Action ConfirmReboot` logs a clear, actionable warning (and retries on the next boot) when the grant is missing. ([#64](https://github.com/luigilink/SPSUpdate/issues/64)) @@ -13,6 +15,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - A deferred automatic reboot that was already performed **out-of-band** (a manual restart or a Windows Update reboot) is now reconciled instead of restarting the server again: when a `.pending` reboot request predates the server's last boot time, `Invoke-SPSAutomaticReboot` marks the Reboot phase `Done` ("Reboot already completed out-of-band"), clears the pending marker and skips the restart. A fresh reboot required by an install performed in the same run is unaffected. ([#68](https://github.com/luigilink/SPSUpdate/issues/68)) - `-Action ProductUpdate` now refreshes the installed server's live **Patch Status** on the Binaries Installation card after the cumulative update is installed, so the column reflects the real post-install state (typically `Upgrade Required` until the Configuration Wizard runs) instead of keeping the pre-install value (`No Action Required`) until the next `Default` run. It reuses the same master-side patch-status read as the `Default` baseline (no remoting) and is status-only — the Content Databases and Configuration Wizard cards still evolve only during a `Default` run. A failed read preserves the last-known-good value. ([#59](https://github.com/luigilink/SPSUpdate/issues/59)) + +## [5.1.0] - 2026-10-06 + +### Added + - The near real-time dashboard now refreshes the live farm status at key transitions (the pre-patch baseline, after the Configuration Wizard completes, and the final render) instead of only at the pre-patch baseline. The master re-reads each server's patch status and re-publishes the content-database inventory with fresh upgrade status, so a successful campaign no longer shows a stale `Upgrade Required` Patch Status or a lingering pre-patch inconsistency banner once the farm is back to `No Action Required`. The Content Databases card also shows a database that SPSUpdate has already upgraded (State `Done`) as `No update pending` even before the next refresh. Server patch status and role are shown with short readable labels (for example `Upgrade Required`, `Application with Search`) via the new public helpers `ConvertTo-SPSPatchStatusLabel` and `ConvertTo-SPSRoleLabel`, instead of the raw enum names. ([#51](https://github.com/luigilink/SPSUpdate/issues/51)) - A standalone, idempotent helper `New-SPSDashboardSite.ps1` (in `src/`) that provisions the dashboard hosting target on an IIS/pull server — folder, SMB share (Modify for the write accounts), NTFS permissions, a static-file `web.config`, and either a dedicated IIS site or a sub-application under an existing site. It has no dependency on the `SPSUpdate.Common` module, so it can be copied on its own to the IIS server. A new wiki page, *Hosting the dashboard on IIS*, documents the validated setup (and the manual equivalent). ([#49](https://github.com/luigilink/SPSUpdate/issues/49)) - `Test-SPSUpdateReadiness.ps1` now checks the optional `Dashboard.OutputPath`: it verifies the folder exists and is writable, and warns when it is a master-local (drive-letter) path rather than a shared UNC path that worker runs can also reach. ([#49](https://github.com/luigilink/SPSUpdate/issues/49)) diff --git a/RELEASE-NOTES.md b/RELEASE-NOTES.md index 9065c96..31695f1 100644 --- a/RELEASE-NOTES.md +++ b/RELEASE-NOTES.md @@ -1,12 +1,20 @@ # SPSUpdate - Release Notes -## [5.0.1] - 2026-09-21 +## [5.2.0] - 2026-10-07 -This patch fixes the near real-time patching dashboard on farms that have no content -databases (for example a dedicated search farm). +SPSUpdate 5.2.0 refines the automatic reboot and the live patching dashboard introduced in 5.1.0. +The one-shot reboot-confirmation boot task now runs as `NT AUTHORITY\SYSTEM` (no stored +credential), a deferred reboot already performed out-of-band is reconciled instead of restarting +the server again, and the Binaries Installation card shows the real live patch status right after a +`ProductUpdate` installs a cumulative update. -### Fixed +### Changed -- On a farm without content databases, the mount/upgrade sequences were shown as **Failed** with "Cannot bind argument to parameter 'Name' because it is an empty string." The inventory generator (`Initialize-SPSContentDbJsonFile`) now always writes a valid file with four (possibly empty) sequences; the master run skips the mount/upgrade sequences entirely when there is no content database (so the dashboard shows only ProductUpdate, the Configuration Wizard and side-by-side); and each sequence sub-run defensively ignores empty entries. +- **Reboot-confirmation task runs as SYSTEM.** The one-shot `SPSUpdate-RebootConfirm` boot task now runs as `NT AUTHORITY\SYSTEM` instead of the farm InstallAccount decrypted from `secrets.psd1`, removing the stored-credential dependency that could abort the reboot at task registration (`0x8007052E`) and decoupling the reboot from password rotation. `Add-SPSScheduledTask` gains a `-RunAsSystem` switch (mutually exclusive with `-ExecuteAsCredential`). Because a SYSTEM task reaches a UNC status store as the computer account, grant the farm computer accounts (e.g. `Domain Computers`) Modify on the share — add them to `New-SPSDashboardSite.ps1 -WriteAccounts`; `-Action ConfirmReboot` logs a clear, actionable warning when the grant is missing. ([#64](https://github.com/luigilink/SPSUpdate/issues/64)) + +### Added + +- **Out-of-band reboot reconciliation.** A deferred automatic reboot that was already performed outside SPSUpdate (a manual restart or a Windows Update reboot) is now reconciled instead of restarting the server again: when a `.pending` reboot request predates the server's last boot time, `Invoke-SPSAutomaticReboot` marks the Reboot phase `Done` ("Reboot already completed out-of-band"), clears the pending marker and skips the restart. A fresh reboot required by an install performed in the same run is unaffected. ([#68](https://github.com/luigilink/SPSUpdate/issues/68)) +- **Live patch status after `ProductUpdate`.** `-Action ProductUpdate` now refreshes the installed server's live patch status on the Binaries Installation card after the cumulative update is installed, so the column reflects the real post-install state (typically `Upgrade Required` until the Configuration Wizard runs) instead of keeping the pre-install value until the next `Default` run. It reuses the same master-side patch-status read as the `Default` baseline (no remoting) and is status-only. A failed read preserves the last-known-good value. ([#59](https://github.com/luigilink/SPSUpdate/issues/59)) A full list of changes in each version can be found in the [change log](CHANGELOG.md) diff --git a/src/Modules/SPSUpdate.Common/SPSUpdate.Common.psd1 b/src/Modules/SPSUpdate.Common/SPSUpdate.Common.psd1 index 1ecd50f..09e396a 100644 --- a/src/Modules/SPSUpdate.Common/SPSUpdate.Common.psd1 +++ b/src/Modules/SPSUpdate.Common/SPSUpdate.Common.psd1 @@ -1,6 +1,6 @@ @{ RootModule = 'SPSUpdate.Common.psm1' - ModuleVersion = '5.0.1' + ModuleVersion = '5.2.0' GUID = 'd6f4e2b7-3a1c-4d8e-9f2a-6c5b7e0a1d34' Author = 'Jean-Cyril DROUHIN' CompanyName = 'luigilink' diff --git a/wiki/Home.md b/wiki/Home.md index 412fafa..27b3d40 100644 --- a/wiki/Home.md +++ b/wiki/Home.md @@ -2,7 +2,7 @@ **SPSUpdate** is a PowerShell tool that installs SharePoint Server cumulative updates and runs the post-setup Configuration Wizard (PSConfig) across a farm. It targets **SharePoint Server Subscription Edition** and requires only PowerShell 5.1 or later — there is no DSC dependency. -> SharePoint Server 2016 and 2019 reached end of support on 14 July 2026. For those versions, use the previous major release [v4.2.0](https://github.com/luigilink/SPSUpdate/releases/tag/v4.2.0). +> SharePoint Server 2016 and 2019 reached end of support on 14 July 2026. For those versions, use the [`4.x` line](https://github.com/luigilink/SPSUpdate/releases/tag/v4.3.0) (latest: v4.3.0). SPSUpdate installs the update binaries, mounts and/or upgrades content databases in parallel via scheduled tasks, runs PSConfig on the local and remote servers over **CredSSP remoting**, and configures the side-by-side patching token for zero-downtime upgrades. diff --git a/wiki/Usage.md b/wiki/Usage.md index 621e89f..8a9d349 100644 --- a/wiki/Usage.md +++ b/wiki/Usage.md @@ -68,7 +68,7 @@ by the `MountContentDatabase` flow. > Since v5.0.0 SPSUpdate is Subscription Edition only. To run `InitContentDB` on a > **SharePoint Server 2019 source farm** during a 2019 → Subscription Edition migration, use -> the previous major release [v4.2.0](https://github.com/luigilink/SPSUpdate/releases/tag/v4.2.0). +> the [`4.x` line](https://github.com/luigilink/SPSUpdate/releases/tag/v4.3.0) (latest: v4.3.0). It also writes a self-contained HTML report of the inventory under `Results\` (see below).