David Gardiner - PowerShell

Delete old GitHub Actions artifacts with PowerShell

2026-03-21T16:00:00.000+10:30

I received an email from GitHub overnight saying:

You have used 90% of the Actions storage included for the flcdrg account

Your plan includes 2 GB of Actions storage per month at no extra cost. You have used 90% so far this billing cycle. 1.8 GB used / 2 GB included

Oh dear, that's not good. Time for some Spring (or Autumn as it is in Australia) cleaning!

I found a useful post by Elio Struyf - Clean up old GitHub Actions artifacts with a script, which contains a Bash script to delete old artifacts. PowerShell is my preferred scripting language so I first asked Copilot to convert the Bash script to PowerShell.

I then ran it on some repositories that I new had lots of artifacts, but noticed that the paging was not working quite right, and that it was skipping artifacts if it couldn't parse the date field.

I made two changes:

Read all the data in one go using the --paginate --slurp parameters. This solves the problem that I think was happening when you read a page of results, then deleted them, and then asked the API for the next page, but the counts would now be out due to the deleted items.
Ensure the date string is parsed using US date format (as it was defaulting to Australian format and then getting confused with dates that didn't make sense)

Here's the final script:

param(
    [Parameter(Position = 0)]
    [string]$Repo,

    [Parameter(Position = 1)]
    [int]$DaysOld = 5
)

if (-not (Get-Command gh -ErrorAction SilentlyContinue)) {
    Write-Error "GitHub CLI (gh) is not installed or not available in PATH."
    exit 1
}

$null = gh auth status *> $null
if ($LASTEXITCODE -ne 0) {
    Write-Host "Please authenticate with the GitHub CLI using 'gh auth login'."
    exit 1
}

if ([string]::IsNullOrWhiteSpace($Repo)) {
    Write-Host "Usage: .\delete-github-action-artifacts.ps1 <owner/repo> [days-old]"
    Write-Host "Example: .\delete-github-action-artifacts.ps1 owner/repo 5"
    exit 1
}

Write-Host "Cleaning up artifacts older than $DaysOld days for repository: $Repo"

$pagesResponse = gh api --paginate --slurp -H "Accept: application/vnd.github+json" "/repos/$Repo/actions/artifacts?per_page=100" | ConvertFrom-Json
$allArtifacts = @()

foreach ($pageResponse in @($pagesResponse)) {
    if ($null -ne $pageResponse.artifacts) {
        $allArtifacts += @($pageResponse.artifacts)
    }
}

if (-not $allArtifacts -or $allArtifacts.Count -eq 0) {
    Write-Host "No artifacts found."
}
else {
    foreach ($artifact in $allArtifacts) {
        $id = $artifact.id
        $name = $artifact.name
        $createdAt = $artifact.created_at

        if ($null -eq $id -or [string]::IsNullOrWhiteSpace($name) -or [string]::IsNullOrWhiteSpace($createdAt)) {
            $artifactJson = $artifact | ConvertTo-Json -Compress
            Write-Host "Skipping invalid artifact data: $artifactJson"
            continue
        }

        try {
            $createdAtUtc = [DateTimeOffset]::Parse($createdAt, [System.Globalization.CultureInfo]::InvariantCulture).UtcDateTime

            $ageDays = [int][Math]::Floor(([DateTime]::UtcNow - $createdAtUtc).TotalDays)

            if ($ageDays -gt $DaysOld) {
                Write-Host "Deleting artifact: $name (ID: $id, Age: $ageDays days)"
                $null = gh api -X DELETE "/repos/$Repo/actions/artifacts/$id" 2>$null

                if ($LASTEXITCODE -ne 0) {
                    Write-Host "Failed to delete artifact: $name (ID: $id)"
                }
            }
            else {
                Write-Host "Keeping artifact: $name (ID: $id, Age: $ageDays days, Created At: $createdAt)"
            }

        }
        catch {
            Write-Host "Deleting artifact: $name (ID: $id, Created At: $createdAt)"
            $null = gh api -X DELETE "/repos/$Repo/actions/artifacts/$id" 2>$null

            if ($LASTEXITCODE -ne 0) {
                Write-Host "Failed to delete artifact: $name (ID: $id)"
            }

        }

    }
}

Write-Host "Cleanup completed."

I've also published it as a GitHub Gist at https://gist.github.com/flcdrg/f204fc3f84247fe6247d654c0a673b73

Prevention

The main cause of accumulating artifacts is by using the actions/upload-artifact action in GitHub Actions workflows. I've now updated those actions to include the retention-days property so that artifacts are automatically deleted after a few days.

eg.

      - name: Upload wrangler.jsonc
        uses: actions/upload-artifact@v7
        with:
          name: wrangler.jsonc
          path: wrangler.jsonc
          retention-days: 2

Cross-platform PowerShell commands in npm scripts

2025-09-09T17:00:00.000+09:30

I'm a big fan of Bob the Builder's catchphrase "Use the right tool for the job". Not that he first came up with it, but his song is quite catchy😃

A tool I often reach for when needing to script functionality is PowerShell. What I really like is that often while you can achieve similar results with Bash stringing together various Unix tools, the PowerShell equivalent almost always much more readable.

And that really matters when someone is trying to understand what a script is doing (and that someone is usually me a few days or weeks later!).

My blog uses Markdown (.md) files for posts, and I make use of the VZ File Templates Visual Studio Code extension, with a template file to start new posts.

The template contains a front-matter section that I then customise for the post:

title: Blog post title
date: '$year$-$monthPadded$-$dayPadded$T$hoursPadded$:$minutesPadded$:00.000+09:30'
#image: /assets
#imageAlt: image description
# description: summary of post
tags:
- A Tag

I wanted to add some simple validation to my blog to check that the front matter in post Markdown files was valid - where "valid" means that I had not forgotten to update those placeholder values appropriately.

I came up with the following PowerShell to do this:

if (Get-ChildItem -Path ./src/posts -Filter '*.md' -Recurse | Where-Object { 
    (Get-Content $_.FullName -Raw) -match '^(description: summary of post|image: /assets|imageAlt: image description title: Blog post title)$' 
    }
) { 
    Write-Host 'Front matter has not been updated'; exit 1 
} else { 
    Write-Host 'All front matter is properly updated' 
}

So if the description, image, imageAlt or title lines aren't updated it will fail.

I could just add this to a build pipeline, but I like the idea of being able to run the same logic locally, as well as from a pipeline. I could have put it into a .ps1 script, but given the script wasn't that long, and the project in question is already using Node and has a package.json file, using a npm (or pnpm) script seemed reasonable.

I added the following to package.json:

  "scripts": {
    "validate-frontmatter": "pwsh -noprofile -Command \"if (Get-ChildItem -Path ./src/posts -Filter '*.md' -Recurse | Where-Object { (Get-Content $_.FullName -Raw) -match '^(description: summary of post|image: /assets|imageAlt: image description|title: Blog post title)$' }) { Write-Host 'Front matter has not been updated'; exit 1 } else { Write-Host 'All front matter is properly updated' }\"",
  },

and confirmed it worked locally by running pnpm validate-frontmatter, and it also ran when called in the build pipeline.

It was a while later that I bothered to review the details of the build step and to my surprise there were a whole bunch of errors being logged, though they didn't cause the step to fail:

 Get-Content: Cannot find path '/home/runner/setup-pnpm/node_modules/.bin/pnpm.FullName' because it does not exist.

That is really strange!

Why is it trying to get the FullName property of the pnpm binary?
The Get-ChildItem is supposed to be only searching under ./src/posts for *.md files, so how it it even ending up at that path?

The only thing I could think of was maybe it related to the actual "Get-Content $_.FullName" part?

$_ in PowerShell is supposed to be the current item when you're iterating over items from a pipeline. The pipeline is running on an Ubuntu build agent with Bash as the default shell. So maybe, just maybe is there a chance that the $_ is being interpreted by Bash before it gets seen by PowerShell?

My first attempt was to escape the $ with a backslash, but VS Code threw up a bunch of squigglies warning me that was invalid JSON. What about two backslashes? That seems valid:

Get-Content -Raw \\$_.FullName

BINGO! And that worked in the pipeline!

But turns out it doesn't now when run in Windows.

So how can we make it compatible with both Bash/Ubuntu and Windows? I don't think we can in the one line. The option I went with was to use a helper package run-script-os. Our scripts now become the following:

    "validate-frontmatter": "run-script-os",
    "validate-frontmatter:default": "pwsh -noprofile -Command \"if (Get-ChildItem -Path ./src/posts -Filter '*.md' -Recurse | Where-Object { (Get-Content -Raw \\$_.FullName) -match '^(description: summary of post|image: /assets|imageAlt: image description|title: Blog post title)$' }) { Write-Host 'Front matter has not been updated'; exit 1 } else { Write-Host 'All front matter is properly updated' }\"",
    "validate-frontmatter:windows": "pwsh -noprofile -Command \"if (Get-ChildItem -Path ./src/posts -Filter '*.md' -Recurse | Where-Object { (Get-Content $_.FullName -Raw) -match '^(description: summary of post|image: /assets|imageAlt: image description|title: Blog post title)$' }) { Write-Host 'Front matter has not been updated'; exit 1 } else { Write-Host 'All front matter is properly updated' }\"",

validate-frontmatter:windows is now the original version that works on Windows. validate-frontmatter:default is the updated version that should work on non-Windows platforms. validate-frontmatter now just calls run-script-os which figures out which other script to defer to depending on the current platform.

You can see the final version in my astro-blog-engine GitHub repository

Alternate solution

The alternative would be to not use inline PowerShell but move the logic to a separate .ps1 script file. That way the package.json script line doesn't contain any $_ variables that are at risk of being interpreted by the wrong shell. If the script logic was any longer or complex then that would be a good solution.

Changing the Windows touchpad settings programmatically

2025-04-13T19:00:00.000+09:30

Now that I've got a reliable process for reinstalling Windows, I do have a list of things that I'd like to automate to get it configured "just right". As such, I've created a new repository on GitHub and added issues to track each one of these. While my Boxstarter scripts will remain for now as GitHub Gists, I think it's going to be easier to manage all of these things together in the one Git repository.

One customisation I like to make to Windows is to disable the 'Tap with a single finger to single-click' for the touchpad. I find I'm less likely to accidentally click on something when I was just tapping the touch pad to move the cursor if I turn this off.

I found some online articles that suggested this was managed by the Registry setting HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\PrecisionTouchPad. Experimenting with this seems to be partly true. I can see the Registry value TapsEnabled is updated when I enable or disable the checkbox in Windows Settings. But the reverse did not seem to be true - if I modified the Registry key, Windows Settings doesn't change, nor does the touchpad behaviour.

Further searching lead me to the Tuning Guidelines page of the Windows Hardware Precision Touchpad Implementation Guide. I'm no hardware manufacturer, but this does document the TapsEnabled setting. Interestinly, down the bottom of that page it does also mention:

As of Windows 11, build 26027, the user's touchpad settings can be queried and modified dynamically via the SystemParametersInfo API

I'm running Windows 11 24H2, which is build 26100, so that 'SystemParametersInfo' API should be available to me. Let's see if calling that does the trick.

My C/C++ is pretty rusty, whereas I'm quite at home in C# or PowerShell. My preference would be to use .NET P/Invoke to call the Windows API.

As I've learned from previous times using P/Invoke, The trick to getting it working properly is to make sure you have the method signature(s) and data structures correct.

While my final goal is to call this from a PowerShell script, prototyping in a simple .NET console application should allow me to quickly test my definitions, plus get C# syntax highlighting and code completion within my IDE.

Let's try and find an existing definition of SystemParametersInfo. I searched for ".NET PInvoke" and noticed https://github.com/dotnet/pinvoke, but that repository is archived and you are instead pointed to https://github.com/microsoft/CsWin32. This project provides a .NET source generator that will create Win32 P/Invoke methods for you, based off of the latest metadata from the Windows team. That sounds perfect!

As per the documentation, I added a package reference

dotnet add package Microsoft.Windows.CsWin32

Then created a NativeMethods.txt file and added SystemParametersInfo to it.

I then edited Program.cs and tried to use my new method:

Except SPI_GETTOUCHPADPARAMETERS isn't available!

The documentation suggested you can get newer metadata for the source generator to use by adding a reference to the latest prerelease Microsoft.Windows.SDK.Win32Metadata package. I tried that, but still no joy. I've raised an issue in the microsoft/win32metadata repo, but for now it looks like I'll need to hand-roll a few of the types myself.

The docs for SPI_GETTOUCHPADPARAMETERS say the following:

The pvParam parameter must point to a TOUCHPAD_PARAMETERS structure.
The uiParam parameter must specify the size of the structure.
The value of the versionNumber field in the TOUCHPAD_PARAMETERS structure must be set to the appropriate value for the version of the structure being used.

The TOUCHPAD_PARAMETERS structure is documented using C++. I asked GitHub Copilot if it could translate that into equivalent C# for me. It came up with this:

// DO NOT USE THIS - IT IS INCORRECT!!
[StructLayout(LayoutKind.Sequential)]
public struct TOUCHPAD_PARAMETERS
{
    public uint VersionNumber;
    public uint MaxSupportedContacts;
    public LEGACY_TOUCHPAD_FEATURES LegacyTouchpadFeatures;

    // Bit fields are represented as individual boolean fields in C#
    public bool TouchpadPresent;
    public bool LegacyTouchpadPresent;
    public bool ExternalMousePresent;
    public bool TouchpadEnabled;
    public bool TouchpadActive;
    public bool FeedbackSupported;
    public bool ClickForceSupported;

    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 25)]
    public bool[] Reserved1;

    public bool AllowActiveWhenMousePresent;
    public bool FeedbackEnabled;
    public bool TapEnabled;
    public bool TapAndDragEnabled;
    public bool TwoFingerTapEnabled;
    public bool RightClickZoneEnabled;
    public bool MouseAccelSettingHonored;
    public bool PanEnabled;
    public bool ZoomEnabled;
    public bool ScrollDirectionReversed;

    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 22)]
    public bool[] Reserved2;

    public TOUCHPAD_SENSITIVITY_LEVEL SensitivityLevel;
    public uint CursorSpeed;
    public uint FeedbackIntensity;
    public uint ClickForceSensitivity;
    public uint RightClickZoneWidth;
    public uint RightClickZoneHeight;
}

And likewise for the two enums LEGACY_TOUCHPAD_FEATURES enumeration and TOUCHPAD_SENSITIVITY_LEVEL enumeration.

One thing you need to do is set the VersionNumber property to TOUCHPAD_PARAMETERS_LATEST_VERSION. Except I searched to find out what the value of that is, and no results. I ended up resorting to installing the Windows 11 SDK so I could locate WinUser.h and then I found this:

#define TOUCHPAD_PARAMETERS_LATEST_VERSION 1
#define TOUCHPAD_PARAMETERS_VERSION_1 1

But then trying to call SystemParametersInfo was not working. That lead me down a bit of a rabbit hole to finally conclude that something is still wrong with the mapping in TOUCHPAD_PARAMETERS. The original structure in C++ is this:

typedef struct TOUCHPAD_PARAMETERS {
  UINT                       versionNumber;
  UINT                       maxSupportedContacts;
  LEGACY_TOUCHPAD_FEATURES   legacyTouchpadFeatures;
  BOOL                       touchpadPresent : 1;
  BOOL                       legacyTouchpadPresent : 1;
  BOOL                       externalMousePresent : 1;
  BOOL                       touchpadEnabled : 1;
  BOOL                       touchpadActive : 1;
  BOOL                       feedbackSupported : 1;
  BOOL                       clickForceSupported : 1;
  BOOL                       Reserved1 : 25;
  BOOL                       allowActiveWhenMousePresent : 1;
  BOOL                       feedbackEnabled : 1;
  BOOL                       tapEnabled : 1;
  BOOL                       tapAndDragEnabled : 1;
  BOOL                       twoFingerTapEnabled : 1;
  BOOL                       rightClickZoneEnabled : 1;
  BOOL                       mouseAccelSettingHonored : 1;
  BOOL                       panEnabled : 1;
  BOOL                       zoomEnabled : 1;
  BOOL                       scrollDirectionReversed : 1;
  BOOL                       Reserved2 : 22;
  TOUCHPAD_SENSITIVITY_LEVEL sensitivityLevel;
  UINT                       cursorSpeed;
  UINT                       feedbackIntensity;
  UINT                       clickForceSensitivity;
  UINT                       rightClickZoneWidth;
  UINT                       rightClickZoneHeight;
} TOUCHPAD_PARAMETERS, *PTOUCH_PAD_PARAMETERS, TOUCHPAD_PARAMETERS_V1, *PTOUCHPAD_PARAMETERS_V1;

Notice all those numbers after many of the fields? Those indicate it is a C bit field. And guess what feature C# doesn't currently support?

In that discussion though there is a suggestion that you can use BitVector32 or BitArray as a workaround. For usability, we can add properties in to expose access to the individual bits in the BitVector32 field. Also note that the values passed in via the [] is a bitmask, not an array index. (Yes, that tricked me the first time too!)

[StructLayout(LayoutKind.Sequential)]
public struct TOUCHPAD_PARAMETERS
{
    public uint VersionNumber;
    public uint MaxSupportedContacts;
    public LEGACY_TOUCHPAD_FEATURES LegacyTouchpadFeatures;

    private BitVector32 First;

    public bool TouchpadPresent
    {
        get => First[1];
        set => First[1] = value;
    }

    public bool LegacyTouchpadPresent
    {
        get => First[2];
        set => First[2] = value;
    }

With that done, we can now call SystemParametersInfo like this:

const uint SPI_GETTOUCHPADPARAMETERS = 0x00AE;

unsafe
{
    TOUCHPAD_PARAMETERS param;
    param.VersionNumber = 1;

    var size = (uint)Marshal.SizeOf<TOUCHPAD_PARAMETERS>();
    var result = PInvoke.SystemParametersInfo((SYSTEM_PARAMETERS_INFO_ACTION)SPI_GETTOUCHPADPARAMETERS,
        size, &param, 0);

And it works! Now curiously, the Windows Settings page doesn't update in real time, but if you go to a different page and then navigate back to the Touchpad page, the setting has updated!

We can refactor the code slightly to put it into a helper static class, so it's easier to call from PowerShell. To make this easier I created a second Console application, but this time I didn't add any source generators, so I would be forced to ensure that all required code was available You can view the source code here.

I could then copy the C# into a PowerShell script and use the Add-Type command to include it in the current PowerShell session. Note the use of -CompilerOptions "/unsafe", which we need to specify as we're using the unsafe keyword in our C# code.

$source=@'
using System;
using System.Collections.Specialized;
using System.Runtime.InteropServices;
using System.Runtime.Versioning;

public static class SystemParametersInfoHelper
{
    [DllImport("USER32.dll", ExactSpelling = true, EntryPoint = "SystemParametersInfoW", SetLastError = true), DefaultDllImportSearchPaths(DllImportSearchPath.System32)]
    [SupportedOSPlatform("windows5.0")]
    internal static extern unsafe bool SystemParametersInfo(uint uiAction, uint uiParam, [Optional] void* pvParam, uint fWinIni);

    public static void DisableSingleTap()
    {
        const uint SPI_GETTOUCHPADPARAMETERS = 0x00AE;
        const uint SPI_SETTOUCHPADPARAMETERS = 0x00AF;

        unsafe
        {
            // Use a fixed buffer to handle the managed type issue  
            TOUCHPAD_PARAMETERS param;
            param.VersionNumber = 1;

            var size = (uint)Marshal.SizeOf<TOUCHPAD_PARAMETERS>();
            var result = SystemParametersInfo(SPI_GETTOUCHPADPARAMETERS, size, &param, 0);

            if (param.TapEnabled)
            {
                param.TapEnabled = false;

                result = SystemParametersInfo(SPI_SETTOUCHPADPARAMETERS, size, &param, 3);
            }
        }
    }
}

[StructLayout(LayoutKind.Sequential)]
public struct TOUCHPAD_PARAMETERS
{
    ...
'@

Add-Type -TypeDefinition $source -Language CSharp -PassThru -CompilerOptions "/unsafe" | Out-Null
[SystemParametersInfoHelper]::DisableSingleTap()

The complete version of the script is available here.

That's one problem solved. Just a few more to go!

Customising and optimising Windows 11 installation

2025-04-08T20:30:00.000+09:30

In theory, I'd like to reinstall my laptop regularly - say every couple of months? In practise, it's easy to keep putting it off. One of the detractions was not just the time to re-install Windows, but also to then install all the various device drivers. So time goes by and next you realise it's been a year or longer.

If you use the built in Windows Reset feature, then it's been my observation that this seems to preserve not only any OEM drivers, but also any OEM bloatware too. I was interested in the idea of installing a 'vanilla' Windows OS, with just the OEM drivers, but no bloat. And while I'm at it, can I automate a few of the other installation steps?

Step 0. Partition your disk

If you want to make this whole process easier, having a separate partition (or second physical drive) for all your data/documents/files will mean you can completely blow away your C: drive where Windows is installed, and all those files in the other partition will be untouched.

In my case, I partitioned my SSD to have D: as my Dev Drive (which uses the newer ReFS file system).

Having a full system backup is another great idea. Knowing that if something goes wrong and you have a way to restore your system back to how it was before you started it process is reassuring. I take advantage of Synology Active Backup for Business to take full backups of my machines, as well as taking using OneDrive for storing other important files and documents.

Step 1. Create a bootable Windows USB drive

Head over to https://www.microsoft.com/en-au/software-download/windows11 and follow the steps to download the Windows 11 ISO image.

Next, get Rufus and use that to create a bootable USB drive. You probably want to select NTFS for the format, as you will likely need to store more data than can fit in FAT32.

Why do this instead of using Microsoft's Media Creator Tool? The results are similar, but the tool creates a sources\install.esd file. If you create a bootable USB from the ISO, then the file created is sources\install.wim. Yes, it is possible to convert an .esd to .wim, but this way you don't need to bother, and your USB is formatted in a way it can fit larger files.

Step 2. Create a working directory

mkdir c:\MachineImaging
cd c:\MachineImaging

Step 3. Mount the .WIM file

The Windows Image .WIM file is a special file format that can contain one or more Windows images. There's a tool built in to Windows - DISM.EXE that is used for working with .WIM files. Conveniently, there's also a Dism PowerShell module with equivalent cmdlets. I find these a bit friendlier to use, as you get parameter completion etc.

We're going to copy the .WIM file from the ISO (or bootable USB we just created), but I'm also going to extract out just the particular image index I plan to use. This will make things simpler later on.

We can list all the images included in a .WIM file like this:

Get-WindowsImage -ImagePath d:\sources\install.wim

ImageIndex       : 1
ImageName        : Windows 11 Home
ImageDescription : Windows 11 Home
ImageSize        : 18,727,965,088 bytes

ImageIndex       : 2
ImageName        : Windows 11 Home N
ImageDescription : Windows 11 Home N
ImageSize        : 18,190,503,625 bytes

ImageIndex       : 3
ImageName        : Windows 11 Home Single Language
ImageDescription : Windows 11 Home Single Language
ImageSize        : 18,725,453,549 bytes

ImageIndex       : 4
ImageName        : Windows 11 Education
ImageDescription : Windows 11 Education
ImageSize        : 19,230,378,207 bytes

ImageIndex       : 5
ImageName        : Windows 11 Education N
ImageDescription : Windows 11 Education N
ImageSize        : 18,698,289,981 bytes

ImageIndex       : 6
ImageName        : Windows 11 Pro
ImageDescription : Windows 11 Pro
ImageSize        : 19,250,929,144 bytes

ImageIndex       : 7
ImageName        : Windows 11 Pro N
ImageDescription : Windows 11 Pro N
ImageSize        : 18,700,496,532 bytes

ImageIndex       : 8
ImageName        : Windows 11 Pro Education
ImageDescription : Windows 11 Pro Education
ImageSize        : 19,230,428,845 bytes

ImageIndex       : 9
ImageName        : Windows 11 Pro Education N
ImageDescription : Windows 11 Pro Education N
ImageSize        : 18,698,315,750 bytes

ImageIndex       : 10
ImageName        : Windows 11 Pro for Workstations
ImageDescription : Windows 11 Pro for Workstations
ImageSize        : 19,230,479,483 bytes

ImageIndex       : 11
ImageName        : Windows 11 Pro N for Workstations
ImageDescription : Windows 11 Pro N for Workstations
ImageSize        : 18,698,341,519 bytes

"Windows 11 Pro" has ImageIndex 6. That's the one I'm interested in.

Now we can export just that image:

Export-WindowsImage -SourceImagePath d:\sources\install.wim -SourceIndex 6 -DestinationImagePath install.wim -CompressionType max

For good measure, we'll keep a 'known good version' copy, so that if we discover our install has problems, we can roll back to the previous known good.

Copy-Item install.wim knowngood.wim

Step 4. Add drivers

I should point out that I originally was following the instructions outlined in this post. Those instructions cover how to capture the currently installed drivers on a machine, exporting them out, and then adding them to an install image. I tried this but my install hung. I'm not really sure why - probably one of the drivers wasn't happy tring to install at OS install time? I'm not sure - it should work in theory.

So instead I remembered that most OEM manufacturers not only make the latest device drivers available for their hardware, but often they also provide a 'bundle' download with all the current drivers in one .zip, intended for just this scenario.

My current laptop is a Dell XPS 9530, and their Windows 11 Driver Pack is listed here with a download link. It 2.8GB!

Unzip that into a subdirectory (c:\MachineImaging\DeployDriverPack)

Now we can add all the drivers in one go using this command

Add-WindowsDriver -Recurse -Path mount -Driver .\DeployDriverPack

If you're more conservative, you could add a single driver (by removing the -Recurse parameter and changing the path) or just the audio drivers, and test out the image before adding more.

Step 5. Enable or disable Windows optional features

You also have the ability to select which Windows features are enabled or disabled by default.

You can query what features are available and their current status using:

Get-WindowsOptionalFeature -Path mount | Sort-Object -Property FeatureName

To enable a feature, do this:

Enable-WindowsOptionalFeature -Path mount -FeatureName VirtualMachinePlatform

(The VirtualMachinePlatform feature is used by WSL, so by ensuring it is enabled that should mean that WSL installs quicker later on)

I also enabled Telnet and NetFx4Extended-ASPNET45

Likewise you can disable features that you don't anticipate needing using Disable-WindowsOptionalFeature

Step 6. Copy the updated WIM back to your USB

First we need to unmount the image:

Dismount-WindowsImage -Path mount -Save

This will take a few minutes to complete. When it does, the C:\MachineImaging\install.wim file will have grown quite a bit.

Now copy this file back to the USB (assuming your bootable Windows USB drive is E:)

Copy-Item install.wim E:\sources

Step 7. Extra automation with an `autounattend.xml` file

The image we've got is a good start, but we're still going to be asked lots of questions during the install. Wouldn't it be nice to have most of those pre-answered? The way to do this is to create an autounattend.xml file. There are Microsoft-provided tools to do this, which are included as part of the Windows ADK, but that's really intended for folks running large Windows networks.

An easier alternative is this very nifty autounattend.xml generator website.

I set the following settings:

Language - English (Australian)
Home location - Australia
Computer name
Time zone - Adelaide
Use custom diskpart to configure Windows partition. In my case I know that partition 3 of disk 0 is where I want Windows to be installed, and I also want to do a clean format of the partition
```
SELECT DISK=0
SELECT PARTITION=3
FORMAT QUICK FS=NTFS LABEL="Windows"
```
Use generic product key and install 'Pro'
Always show file extensions
Show End task command in the taskbar

Configure icons in the taskbar to just show Windows Explorer and Windows Terminal (Ideally I'd pin a few other applications but they aren't installed until after the OS install so you can't use this for that)

<LayoutModificationTemplate xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification" xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout" Version="1">
<CustomTaskbarLayoutCollection PinListPlacement="Replace">
    <defaultlayout:TaskbarLayout>
    <taskbar:TaskbarPinList>
        <taskbar:DesktopApp DesktopApplicationID="Microsoft.Windows.Explorer" />
        <taskbar:UWA AppUserModelID="Microsoft.WindowsTerminal_8wekyb3d8bbwe!App" />        
    </taskbar:TaskbarPinList>
    </defaultlayout:TaskbarLayout>
</CustomTaskbarLayoutCollection>
</LayoutModificationTemplate>

Disable widgets
Don't show Bing results
Remove all pins in the start menu
Enable long paths
Allow execution of PowerShell scripts
Hide Edge first run experience
Delete empty c:\Windows.old folder
Remove bloatware
- 3D Viewer
- Bing search
- Clock
- Cortana
- Family
- Get Help
- Handwriting
- Mail and Calendar
- Maps
- Math input
- Mixed reality
- Movies and TV
- News
- Office 365
- Paint
- Paint 3D
- People
- Photos
- Power Automate
- PowerShell ISE
- Quick Assist
- Skype
- Solitaire
- Speech
- Sticky notes
- Teams
- Tips
- To do
- Voice recorder
- Wallet
- Weather
- Windows Fax and Scan
- Windows media player
- Wordpad
- XBox apps
- Your Phone

Scripts to run when first user logs in after Windows has been installed (I'm installing Chocolatey, as I'll be using that almost immediately once I sign in the first time).

Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))

choco feature enable -n=allowGlobalConfirmation
choco feature enable -n=useRememberedArgumentsForUpgrades

And then download the file and save it in the root of your bootable USB

Step 8. Try it out

You will need to restart your target machine and get it to boot off the USB drive. For my laptop, the easiest way to do that is to hit F12 when the Dell logo appears while powering up. You may also have to go into your BIOS/UEFI settings to disable secure boot mode and enable booting from USB. The Rufus instructions suggest that it may work without disabling secure boot mode, but I did it anyway.

If all goes well, you'll see a few different Windows installation screens, but won't get prompted where to install, which keyboard or location to use.

You will still get some UI prompts that can't be avoided (like entering your Microsoft Account details), but at the end after a few reboots you should be greeted by a clean install of Windows, and if you check the Windows Device Manager, there should not be any unknown devices. Likewise, looking in Settings | Apps, should show either no or the bare minimum of applications. No bloatware to be seen!

You'll still need to allow the latest Windows cumulative updates to install (adding that to the WIM file is a task for another day), and there may still be some driver updates that Windows discovers that are newer, but not too many.

I timed it and the entire OS install process (including unavoidable manual steps) took only 15 minutes!

After that you're ready to install and run Boxstarter to install all your tools and other applications. You can see my Boxstarter scripts in this GitHub Gist.

Future plans

It's worth thinking about what else could be include in the custom Windows image or the autounattend.xml file, to further streamline the installation process. For example, the latest cumulative updates?

The other part that would be great to automate is all the numerous tasks you need to perform to finish setting up application software, signing into things, setting up your web browser, have Git configured correctly, OneDrive(s) and the list goes on. Some of these (especially the signing in/authenticating) ones may always require manual intervention, but the others may be able to be scripted, if not totally then at least partially.

Why is PowerShell not expanding variables for a command?

2025-02-14T12:00:00.000+10:30

This had me perplexed. I have a PowerShell script that calls Docker and passes in some build arguments like this:

docker build --secret id=npm,src=$($env:USERPROFILE)/.npmrc --progress=plain -t imagename .

But it was failing with this error:

ERROR: failed to stat $($env:USERPROFILE)/.npmrc: CreateFile $($env:USERPROFILE)/.npmrc: The filename, directory name, or volume label syntax is incorrect.

It should be evaluating the $($env:USERPROFILE) expression to the current user's profile/home directory, but it isn't.

Is there some recent breaking change in how PowerShell evaluates arguments to a native command? I skimmed the release notes but nothing jumped out.

I know you can use the "stop-parsing token" --% to stop PowerShell from interpreting subsequent text on the line as commands or expressions, but I wasn't using that.

In fact the whole about_Parsing documentation is a good read to understand the different modes and how PowerShell passes arguments to native and PowerShell commands. But I still couldn't figure it out.

So what's going on?

Another tool I find useful when trying to diagnose issues with passing arguments is EchoArgs. It too reported the argument was not being evaluated.

But then I noticed something curious on the command line:

That comma is being rendered in my command line in grey, but the rest of the arguments are white (with the exception of the variable expression). Could that be the problem?

Let's try enclosing the arguments in double quotes..

docker build --secret "id=npm,src=$($env:USERPROFILE)/.npmrc" --progress=plain -t imagename .

Notice the colours on the command line - the comma is not different now:

And the colouring on the command line also hints that it is not treating the comma as something special.

And now our Docker command works!

Passing arguments to npm in PowerShell

2025-01-31T12:00:00.000+10:30

This just caught me out. I was following the tutorial for the Astro web framework and it contains instructions to run this command:

npm create astro@latest -- --template minimal

The tutorial suggested you would then be prompted to enter a target directory.

Except I wasn't - I was seeing an interactive menu asking me to choose a template. This seemed weird as it kind of looks like the arguments above are telling it which template to use.

After a bit of experimenting I narrowed down the problem to running the command from PowerShell! (The command works fine in Bash or CMD). There's something in that line that PowerShell must be interpreting rather than just passing through to npm.

The solution that worked for me was to escape the dash. eg.

npm create astro@latest `-- --template minimal

With that, npm seems to see the correct arguments and runs as per the tutorial instructions.

Automatic updating of Chocolatey packages with .NET

2024-03-31T17:00:00.000+10:30

I maintain quite a few Chocolatey packages. The source for these packages lives in https://github.com/flcdrg/au-packages/, and until recently I used the AU PowerShell module to detect and publish updated versions of the packages.

The first issue was that unfortunately, the original maintainer of the AU module archived the project on GitHub. The Chocolatey Community stepped in and is now maintaining a fork here.

The second issue I hit that was causing issues was a compatibility issue with newer versions of PowerShell 7. AU was originally written for Windows PowerShell 5, but I have made extensive use of features of PowerShell 6 and 7 in my update scripts. That didn't seem to cause issues until the GitHub Actions agents were updated from PowerShell 7.2 to 7.4 in January.

The specific problem would reveal itself like this:

Chocolatey had an error occur: System.ArgumentException: File specified is either not found or not a .nupkg file. 'D:\a\au-packages\au-packages\microsoft-teams.install\microsoft-teams.install.1.7.0.3653.nupkg '

For some reason, the AU module was able to generate a new version of a package, but when it called the Chocolatey CLI (choco.exe) and passed the path to the nupkg file, it appeared that there was a trailing space in the filename!

I spent hours trying to debug this to no avail. This was not made any easier by the fact that AU uses PowerShell Jobs to spin up separate processes for each package so they can be processed in parallel. I could not get debugging to work inside a Job when using the Visual Studio Code PowerShell debugger. Even the old-style debugging approach of Write-Host "I got here" didn't work very well as all output of the job is captured isn't easy to extract (let alone being able to inspect the original variables as proper objects rather than serialised strings)

Eventually, I decided I was wasting my time trying to solve this, and maybe if I rewrote the updating logic myself I could mitigate the issue.

There are essentially two parts to the AU module - the bits that support updating an individual package, and then there are the bits that run over all your packages. It's that second part that makes use of PowerShell Jobs and I suspected was the source of the problem.

I figured rewriting that part in C#/.NET would mean I had a much nicer debugging experience (should I need it). I wanted to leave the individual package updating alone - it would be a significant effort to migrate all the custom update.ps1 scripts to something else.

au-dotnet

And so au-dotnet was born.

It is a reasonably simple .NET 8 console application that iterates over all the packages in my au-packages repository, and then calls the PowerShell update.ps1 script in each to see if there is a new version to generate and publish.

Rather than just call out to the operating system to run each update.ps1 script, I decided to embed PowerShell in the application. This gives me a bit more control over how the scripts are run and the ability to capture any script output (and errors) from each run.

Hosting PowerShell

Figuring out how to host PowerShell in a .NET 8 application took a little bit of research. Many of the articles you find (and even some of the official documentation) are still aimed at Windows PowerShell.

The key was to reference these three NuGet packages (and use the same version of each package):

Microsoft.PowerShell.Commands.Diagnostics
Microsoft.PowerShell.SDK
System.Management.Automation

You can then create a PowerShell Class instance like this:

var iss = InitialSessionState.CreateDefault2();
iss.ExecutionPolicy = Microsoft.PowerShell.ExecutionPolicy.RemoteSigned;

var ps = PowerShell.Create(iss);

You can capture any output via the Streams property. eg. Here I am logging any errors from PowerShell as a GitHub Action error:

ps.Streams.Error.DataAdded += (_, args) =>
{
    core.WriteError(ps.Streams.Error[args.Index].ToString());
};

Running specific PowerShell cmdlets can be done via the AddCommand method. eg.

ps.AddCommand("Set-Location").AddParameter("Path", directory).Invoke();

Whereas running arbitrary PowerShell scripts is done via the AddScript method. eg.

ps.AddScript("$ErrorView = 'DetailedView'").Invoke();

If the script is in a separate .ps1 file, the only way I've found so far is to load that file into a string and pass it in. It would be nicer if you could point it at the file (so debugging/errors could include line numbers) but I have yet to find a way to do that.

var output = ps.AddScript(File.ReadAllText(Path.Combine(directory, "update.ps1")))
.Invoke();

One thing to remember is you must call the Invoke method to actually run the scripts or commands you've just added.

GitHub Action logging and summary

Because I know the application will be run in a GitHub Actions workflow, I made use of the excellent GitHub.Actions.Core NuGet package for formatting output, as well as generating a nice build summary that lists all packages that were updated in the current run.

Commit and publish

If a new package is created (eg. a .nupkg file now exists) then we assume this file can be submitted to the Chocolatey Community Repository. choco push is then called to upload the package. Remember this was where we hit that error with the trailing space? Pleasingly the .NET version doesn't exhibit this behaviour, so that problem is solved.

Assuming the package is submitted successfully then we call `git`` to stage any modified files from this package and add a tag indicating the package that was updated.

After all packages have been processed, we will commit all staged files and push the commit back to the repo, so that we get a version history of all the package changes.

Enhancements

I am currently using my fork of the chocolatey-au module, which has one minor enhancement. It adds a Files collection property to the AUPackage PowerShell class. This collection is populated with the paths of all the files that were downloaded (and had their checksums calculated).

I make use of this for some of my packages to pre-emptively upload the files to VirusTotal. This can help fast-track the packages being approved by Chocolatey as it means the Chocolatey virus scanning step is already completed. Because I use the VirusTotal CLI tool for this, it also means I can upload files up to 650MB (compared to Chocolatey's current 200MB limit due to using an older API).

I have submitted the Files property enhancement to chocolatey-au.

Summary

You can see this in action in the latest workflow runs at https://github.com/flcdrg/au-packages/actions.

Which Western Digital Red NAS hard disk should I buy? (2024 update)

2024-02-26T07:00:00.000+10:30

Back in 2021, I first reviewed the options for Western Digital Red 4TB NAS hard disks. My Synology DS1621xs+ NAS has recently started warning me that storage space is getting low, so let's review the prices (and also consider the larger capacities) currently available from Western Digital in 2024.

Western Digital differentiates its Red NAS drives into three groups/recommended workloads: Red (lighter SOHO), Red Plus (write-intensive), and Red Pro (highest-intensity).

Model number	Product Number	Capacity (TB)	Internal rate (MB/s)	Cache (MB)	RPM	Recording Technology	Approx. Date	Spec sheet	Price (AUD)	Price (USD)
Red	WD40EFAX	4	180	256	5400	SMR	Aug-20	Link	230	n/a
Red Plus	WD40EFZX	4	175	128	5400	CMR	Jan-21	Link	257	111
Red Plus	WD40EFPX	4	180	256	5400	CMR	Sep-22	Link	202	n/a
Red Plus	WD60EFPX	6	180	256	5400	CMR	Sep-22	Link	289	n/a
Red Plus	WD80EFZZ	8	185	128	5640	CMR	Jan-22	Link	313	n/a
Red Plus	WD80EFPX	8	215	256	5640	CMR	Nov-23	Link	308	179
Red Plus	WD101EFBX	10	215	256	7200	CMR	Jan-20	Link	398	199
Red Plus	WD120EFBX	12	196	256	7200	CMR	Jan-21	Link	515	n/a
Red Plus	WD140EFGX	14	210	512	7200	CMR	Jan-20	Link	658	n/a
Red Pro	WD4003FFBX	4	217	256	7200	CMR	Sep-20	Link	212	n/a
Red Pro	WD6003FFBX	6	238	256	7200	CMR	Feb-18	Link	339	204
Red Pro	WD8003FFBX	8	235	256	7200	CMR	Apr-18	Link	404	229
Red Pro	WD102KFBX	10	256	256	7200	CMR	Jan-20	Link	465	269
Red Pro	WD121KFBX	12	240	256	7200	CMR	May-19	Link	491	285
Red Pro	WD161KFGX	16	259	256	7200	CMR	Sep-20	Link	554	308
Red Pro	WD181KFGX	18	272	512	7200	CMR	Sep-20	Link	583	342
Red Pro	WD221KFGX	22	256	512	7200	CMR	Jul-22	Link	849	419

Notes

Prices listed are from Amazon as of 25th February 2024. Click through the links to get the latest price, they seem to change daily!
The AUD price links to Amazon Australia and the US price links to Amazon.com. (Amazon links are affiliate links)
I live in Australia, hence the Amazon AU links, but sometimes the US prices are more competitive - it pays to compare both.
Dates are from the oldest specification sheets I've found for that model or data listed on the Amazon page.
Recording technology: SMR - Shingled Magnetic Recording, CMR - Conventional Magnetic Recording. More info

My choice

I've previously bought 4TB drives, but I'm thinking this time I might go for something larger. Because of the RAID configuration I am using, I'll only be effectively using 4TB of the new drive. But this is planning for the future, as when I buy a subsequent larger drive I'll then get access to the full capacity of both drives. The 'Red Plus' models look fine for my purposes. I don't need the extra features offered by the 'Red Pro' line.

As I write this, the 10G Red Plus WD101EFBX has a discounted price on Amazon US (plus I have some Amazon US gift card credit waiting to be used), so that looks like a good deal. I was originally looking at the 8TB drives, but for only USD20 extra you get another 2TB, so why not?

Table formatting

As a side note, I collated the information in the table above using Excel. Initially, I was going to use a Visual Studio Code extension to paste the Excel content into a Markdown table format, but then formatting the links was not going to be easy. I then realised I could use PowerShell to manage the formatting if I saved the spreadsheet as a .CSV format. PowerShell automation for the win!

eg.

$data = (get-content 'C:\Users\david\OneDrive\Documents\Western Digital Hard disk costs.csv') | ConvertFrom-Csv
$data | ForEach-Object { "| " + $_.'Model number' + " | " + $_.'Product Number' + " | " + $_.'Capacity (TB)' + " | " + $_.'Internal rate (MB/s)' + " | " + $_.'Cache (MB)' + " | " + $_.RPM + " | " + $_.'Recording Technology' + " | " + $_.'Approx. Date' + " | [Link](" + $_.'Spec sheet' + ") | [" + $_.'Price (AUD)' + "](" + $_.'Amazon AU'+ ") | [" + $_.'Price (USD)' + "](" + $_.'Amazon US' + ") |" } | clip

Azure DevOps API PropertiesCollections

2023-06-20T22:30:00.000+09:30

I was looking at some of the Azure DevOps API documentation and noticed that some of the endpoints mention a properties object of type PropertiesCollection. Unfortunately, the details for that data structure are not particularly helpful, and I couldn't figure out how to use it. Some pages include examples, but none that I could find included an expanded properties object.

To figure out how to use it, I created a simple .NET console application. I added references to the following NuGet packages:

Microsoft.TeamFoundationServer.Client
Microsoft.VisualStudio.Services.InteractiveClient
Microsoft.VisualStudio.Services.Release.Client

using Microsoft.VisualStudio.Services.Common;
using Microsoft.VisualStudio.Services.ReleaseManagement.WebApi.Clients;
using Microsoft.VisualStudio.Services.WebApi;

const string collectionUri = "https://dev.azure.com/organisation";
const string projectName = "MyProject";
const string pat = "YOUR-PAT-HERE";
const int releaseId = 20;

var creds = new VssBasicCredential(string.Empty, pat);

// Connect to Azure DevOps Services
var connection = new VssConnection(new Uri(collectionUri), creds);

using var client = connection.GetClient<ReleaseHttpClient>();

// Get data about a specific release
var release = await client.GetReleaseAsync(projectName, releaseId);

release.Properties.Add("Thing", "hey");

// Send the updated release back to Azure DevOps Services
var result = await client.UpdateReleaseAsync(release!, projectName, releaseId);

Console.WriteLine();

This allowed me to create a property key and value, that I could then examine by querying the item (in this case a 'classic' release), by calling the GET endpoint. eg.

https://vsrm.dev.azure.com/{organization}/{project}/_apis/release/releases/{releaseId}?propertyFilters=Thing&api-version=7.0

Note that you need to specify the propertyFilters parameter. Otherwise the `properties`` object will not be included in the response.

And in doing that, we can see the JSON data structure!

    "properties": {
        "Thing": {
            "$type": "System.String",
            "$value": "hey"
        }
    }

So, to add a property, you need to add a new key/value pair to the properties object, where the key is the name of the property, and the value is an object with two properties: $type and $value. The $type property is the type of the value, and the $value property is the value itself.

The documentation clarifies the types supported:

Values of type Byte[], Int32, Double, DateType and String preserve their type, other primitives are retuned as a String. Byte[] expected as base64 encoded string.

(I think 'DateType' is a typo, and should be 'DateTime')

Now that we know the shape of the data, I can jump back to PowerShell and use that to add a new property:

$uri = "https://vsrm.dev.azure.com/$($organisation)/$($project)/_apis/release/releases/$($releaseId)?api-version=7.0&propertyFilters=Extra"

$result = Invoke-RestMethod -Uri $uri -Method Get -Headers $headers

if (-not ($result.properties.Extra)) {
    $result.properties | Add-Member -MemberType NoteProperty -Name "Extra" -Value @{
        "`$type" = "System.String"
        "`$value" = "haaaa"
    }
}
$body = $result | ConvertTo-Json -Depth 20

"Updating via PUT"

Invoke-RestMethod -Uri $uri -Method Put -Headers $headers -Body $body -ContentType "application/json"

Finding free subnets in an Azure Virtual Network

2023-04-03T08:00:00.000+09:30

An Azure Virtual Network (as the docs say) is "the fundamental building block for your private network in Azure". Often abbreviated to "VNet". When a VNet is created, you specify the available IP address range using CIDR notation. If you create a VNET through the Azure Portal, it defaults to 10.1.0.0/16, which equates to 65536 IP addresses (10.1.0.0 - 10.1.255.255).

A VNet contains one or more subnets, where the IP range for each subnet is assigned from the VNet's allocation. One thing to note - you can't resize a VNet. Once it has been created, that's it. If you use up all the available IP addresses, your only options are to create a new VNet and peer it to the original VNet, or if the newer VNet is larger, migrate all your services over to it (which may not be trivial).

If a VNet has been in use for some time or is used by multiple teams, you can end up with fragmentation - gaps between allocated subnets. This could happen because new subnets are allocated by choosing a 'nice' number to start on (rather than following immediately from the last allocated), or from a previously allocated subnet being deleted. e.g.

In this VNet it turns out we have some gaps. While the temptation might be to allocate the next subnet starting at 10.0.2.0, depending on the size required, we might be able to use one of the available gaps instead.

Now maybe you can read CIDR IP addresses in your sleep and can not only spot the gaps but know intuitively what ranges you could allocate. For the rest of us, I'd either resort to a pencil and paper or (more likely) see if I could script out the answer using PowerShell.

And so I created a PowerShell script to query a VNet and list both the existing subnets and also the available gaps (and CIDR ranges that could use those gaps). I started sharing this script with a few of my SixPivot colleagues, as they were experiencing the same situation. I realised it would be good to make this more widely available, so the result is my first PowerShell module published to the PowerShell Gallery (under the SixPivot name) - SixPivot.Azure, which contains the Find-FreeSubnets function.

Using the Find-FreeSubnets cmdlet

First off, install the module:

Install-Module SixPivot.Azure

If you haven't previously connected to Azure then you'll need to do this:

Connect-AzAccount

Now you can use Find-FreeSubnets. You need to know the resource group and VNET name. eg.

Find-FreeSubnets -ResourceGroup rg-freesubnet-australiaeast -VNetName vnet-freesubnet-australiaeast

This will produce output similar to the following:

VNet Start VNet End     Available      Subnets
---------- --------     ---------      -------
10.0.0.0   10.0.255.255 {48, 8, 65184} {10.0.0.0/24, 10.0.1.0/28, 10.0.1.64/28, 10.0.1.88/29}

The output is structured data. If you assign it to a variable, then you can dig down into the different parts.

$vnet = Find-FreeSubnets -ResourceGroup rg-freesubnet-australiaeast -VNetName

For the VNET itself, you can get the start and end addresses using VNetStart and VNetEnd properties.

$vnet.VNetStart, $vnet.VNetEnd
10.0.0.0
10.0.255.255

You can see the currently allocated subnets via the Subnets property:

$vnet.Subnets

Address space Range start Range end
------------- ----------- ---------
10.0.0.0/24   10.0.0.0    10.0.0.255
10.0.1.0/28   10.0.1.0    10.0.1.15
10.0.1.64/28  10.0.1.64   10.0.1.79
10.0.1.88/29  10.0.1.88   10.0.1.95

And finally, (and this is the good bit!), the available subnets via the Available property

$vnet.Available

Start     End          Size  Available ranges
-----     ---          ----  ----------------
10.0.1.16 10.0.1.63    48    {10.0.1.16/28, 10.0.1.32/27, 10.0.1.32/28, 10.0.1.48/28}
10.0.1.80 10.0.1.87    8
10.0.1.96 10.0.255.255 65184 {10.0.1.96/27, 10.0.1.96/28, 10.0.1.112/28, 10.0.1.128/25…}

For a particular Start and End, you can see potential CIDR ranges with the CIDRAvailable property:

$vnet.Available[0].CIDRAvailable
10.0.1.16/28
10.0.1.32/27
10.0.1.32/28
10.0.1.48/28

$vnet.Available[2].CIDRAvailable
10.0.1.96/27
10.0.1.96/28
10.0.1.112/28
10.0.1.128/25
10.0.1.128/26
10.0.1.128/27
10.0.1.128/28
10.0.1.144/28
...

Possible prefix lengths of 25, 26, 27 or 28 are shown. The output for the second example actually scrolled way off the page, so watch out if the available Size is quite large.

From the first available range, I could use either:

10.0.1.16/28 and 10.0.1.32/27
or 10.0.1.16/28, 10.0.1.32/28 and 10.0.1.48/28

Future enhancements

The cmdlet is useful already, but one feature I'd like to add is to be able to pass in one or more CIDR prefix lengths (eg. 28,28,27) and allow it to find compatible non-overlapping ranges automatically.