What this script does
What it says it does
Restart the three patched web servers WEB01, WEB02 and WEB03
What the code actually does
Force-restarts every computer returned by Get-ADComputer -Filter *.
This does not match the stated intent.
Who and what it can reach
Tenant-wide. Every computer account returned by Get-ADComputer (count unknown without environment context) (Restart-Computer)
Irreversible operations
None detected
Why coverage is partially analysed
- Required roles and permissions are not assessed for Get-ADComputer (no permission catalogue yet for Active Directory).
- Commands run on remote computers whose state and identity are not known.
- Confirm the three server names in the change ticket.
- Run once without -Apply and review the -WhatIf output.
Findings4
What we found
Get-ADComputer returns every object; Restart-Computer is applied to each one.
5Get-ADComputer -Filter * | ForEach-Object { Restart-Computer -ComputerName $_.Name -Force }
Why it matters
Get-ADComputer -Filter * returns every computer object, and each one is passed to Restart-Computer.
What to change
Limit Get-ADComputer to the intended computers with -Filter or -SearchBase (for example one OU in the maintenance window), export the list for review, and act on it in batches.
What we found
Restart-Computer restarts every computer account returned by Get-ADComputer (count unknown without environment context) with -Force, even if users are signed in; services on them are interrupted.
5Get-ADComputer -Filter * | ForEach-Object { Restart-Computer -ComputerName $_.Name -Force }
Why it matters
-Force restarts machines even when users are signed in, so open work is lost on every affected computer.
What to change
Do not feed an unfiltered Get-ADComputer into Restart-Computer: limit it with -Filter or -SearchBase to the intended servers, export and review the list, then restart in batches inside a maintenance window and check each server is back before continuing.
| Permission | Type | Status | Reason |
|---|
Permission catalogue v0 is a seed and is being verified against the Microsoft Graph permissions reference.
Passed validation · re-parsed and rescanned
Resolved SPF-MG-014, SPF-CORE-021, SPF-CORE-040
Remaining SPF-WIN-001
Illustrative rewrite written by our team: explicit WEB01-03 list, -WhatIf by default, -Confirm on apply, pre-change export, stop on errors.
The proposed rewrite, as re-checked by the engine.
1#Requires -Modules ActiveDirectory2param([switch]$Apply)3$targets = @('WEB01', 'WEB02', 'WEB03')4$computers = foreach ($name in $targets) { Get-ADComputer -Identity $name -ErrorAction Stop }5$computers | Select-Object Name, DNSHostName | Export-Csv -Path 'C:\Change\restart-targets.csv' -NoTypeInformation6foreach ($c in $computers) {7 if ($Apply) {8 Restart-Computer -ComputerName $c.DNSHostName -Confirm -ErrorAction Stop9 } else {10 Restart-Computer -ComputerName $c.DNSHostName -WhatIf11 }12}
1 · Pilot
- Run the rewrite without -Apply and review the -WhatIf output: it must list WEB01, WEB02 and WEB03 only.
- Apply to WEB01 first and confirm it returns to service before continuing.
2 · Verify
- Check each server is reachable and its web service responds.
- Compare restart-targets.csv with the change ticket.
3 · Roll back
- A restart cannot be undone. If a server does not come back, follow the server recovery runbook and stop the change.
- Synthetic sample, not a real customer script. Findings, blast radius, coverage and the rewrite re-check are real engine output; the explanation, rewrite and plans were written by our team to illustrate the AI explainer, which is not switched on yet.
- PSScriptAnalyzer baseline is not yet enabled in engine 0.1; only ScriptPreflight rules ran.
- No live tenant or server data was used: object counts are not known.
- Parser
- 0.1.0
- PSScriptAnalyzer
- not-enabled
- Ruleset
- 0.6.2
- Catalogue
- 0.1.0
- Model
- written-by-team
- Prompt policy
- 0.1
- Schema
- 1.0.0
- Completed
- 6 Nov 2026, 20:54 UTC
Report checksum is recorded server-side.