v1.17.2 — Robustness sweep: 8 fixes across 10 modules

Process handle leak, CIM init fallback, TcpClient dispose,
null Subject/Command/Description/cachePath guards, @() wrapper.

38968 lines | 63 modules | 1854 tests | PSSA 0

Author: TheAbider

Changelog.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## v1.17.2
+
+- **Bug Fix:** Process handle leak in credential storage — `cmdkey.exe` process was never disposed after use; timeout path would also crash reading `ExitCode` on a still-running process. Now uses `try/finally` with `Dispose()` (35-Utilities).
+- **Bug Fix:** Script initialization falls back to registry when CIM service is unresponsive — unguarded `Get-CimInstance` at top level would crash the entire tool before any menu could display. Now falls back to `HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentBuildNumber` (00-Initialization).
+- **Bug Fix:** Port scan disposes `TcpClient` on error — if `BeginConnect` or `WaitOne` threw, the socket handle leaked. Now uses `try/finally` for cleanup (58-NetworkDiagnostics).
+- **Bug Fix:** Certificate display guards against null Subject — certificates with Subject Alternative Names only can have null `Subject`, causing blank output instead of "(no subject)" (37-HealthCheck, 35-Utilities).
+- **Bug Fix:** Command history display guards against null Command — corrupted or hand-edited `history.json` would crash `.PadRight()` on null (55-QoLFeatures).
+- **Bug Fix:** VHD download checks cache path before use — if host storage was never initialized, `.Substring()` on null path would crash (41-VHDManagement).
+- **Bug Fix:** Adapter table guards against null InterfaceDescription — virtual or transitional adapters can have null description, crashing `.PadRight()` (06-NetworkAdapters).
+- **Bug Fix:** Quick setup storage detection uses `@()` wrapper for PS 5.1 — single-item pipeline results lack `.Count` property without array wrapping (50-EntryPoint).
+- 63 modules, 1854 tests
+
 ## v1.17.1
 
 - **Bug Fix:** VM Checkpoint Management uses `*-VMSnapshot` cmdlets instead of `*-VMCheckpoint` — Server 2012 R2 only has the `VMSnapshot` variants; `VMCheckpoint` was introduced in Server 2016. Affects list, restore, and delete operations (52-VMCheckpoints).

Header.ps1

@@ -30,11 +30,22 @@
     7h3 4b1d3r
 
 .VERSION
-    1.17.1
+    1.17.2
 
 .LAST UPDATED
     03/04/2026
 
+.CHANGELOG v1.17.2
+    ROBUSTNESS SWEEP — 8 FIXES:
+    - FIX: Process handle leak in credential storage — cmdkey.exe process was never disposed; timeout path would also crash reading ExitCode on a still-running process (35-Utilities)
+    - FIX: Script initialization falls back to registry when CIM service is unresponsive — unguarded Get-CimInstance at top level would crash the entire tool before any menu could display (00-Initialization)
+    - FIX: Port scan disposes TcpClient on error — if BeginConnect or WaitOne threw, the socket handle leaked; now uses try/finally (58-NetworkDiagnostics)
+    - FIX: Certificate display guards against null Subject — certs with Subject Alternative Names only have null Subject, causing blank output (37-HealthCheck, 35-Utilities)
+    - FIX: Command history display guards against null Command — corrupted or hand-edited history JSON would crash PadRight on null (55-QoLFeatures)
+    - FIX: VHD download checks cache path before use — if host storage was never initialized, Substring on null path would crash (41-VHDManagement)
+    - FIX: Adapter table guards against null InterfaceDescription — virtual or transitional adapters can have null description, crashing PadRight (06-NetworkAdapters)
+    - FIX: Quick setup storage detection uses @() wrapper for PS 5.1 — single-item pipeline results lack .Count property without array wrapping (50-EntryPoint)
+
 .CHANGELOG v1.17.1
     PS 5.1 COMPATIBILITY FIX:
     - FIX: VM Checkpoint Management uses *-VMSnapshot cmdlets instead of *-VMCheckpoint — Server 2012 R2 only has the VMSnapshot variants; VMCheckpoint was added in Server 2016 (52-VMCheckpoints)

Modules/00-Initialization.ps1

@@ -135,13 +135,13 @@ if (-not $script:ModuleRoot) { $script:ModuleRoot = $PSScriptRoot }
 if (-not $script:ModuleRoot -and $script:ScriptPath) {
     $script:ModuleRoot = [System.IO.Path]::GetDirectoryName($script:ScriptPath)
 }
-$script:ScriptVersion = "1.17.1"
+$script:ScriptVersion = "1.17.2"
 $script:ScriptStartTime = Get-Date
 
 # OS version detection (for feature compatibility)
 # 2012/2012 R2 lack SET, Storage Replica, Defender PowerShell module
 # 2008 R2 SP1 supported with WMF 5.1 installed (run Install-Prerequisites.ps1)
-$script:OSBuildNumber = [int](Get-CimInstance Win32_OperatingSystem).BuildNumber
+$script:OSBuildNumber = try { [int](Get-CimInstance Win32_OperatingSystem -ErrorAction Stop).BuildNumber } catch { [int](Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').CurrentBuildNumber }
 $script:IsServer2008R2 = $script:OSBuildNumber -eq 7601        # 6.1.7601 (SP1)
 $script:IsServer2012 = $script:OSBuildNumber -eq 9200           # 6.2.9200
 $script:IsServer2012R2 = $script:OSBuildNumber -eq 9600         # 6.3.9600

Modules/06-NetworkAdapters.ps1

@@ -299,7 +299,7 @@ function Show-AdaptersTable {
     Write-OutputColor $separator -color "Info"
 
     foreach ($adapter in $adapters) {
-        $desc = $adapter.InterfaceDescription
+        $desc = if ($adapter.InterfaceDescription) { $adapter.InterfaceDescription } else { "" }
         if ($desc.Length -gt $columnWidths.Description) {
             $desc = $desc.Substring(0, $columnWidths.Description - 3) + "..."
         }

Modules/35-Utilities.ps1

@@ -714,9 +714,15 @@ function Save-StoredCredential {
         $startInfo.RedirectStandardOutput = $true
         $startInfo.RedirectStandardError = $true
         $proc = [System.Diagnostics.Process]::Start($startInfo)
-        $proc.WaitForExit(10000)
-        $password = $null
-        return ($proc.ExitCode -eq 0)
+        try {
+            $exited = $proc.WaitForExit(10000)
+            $password = $null
+            if (-not $exited) { return $false }
+            return ($proc.ExitCode -eq 0)
+        }
+        finally {
+            if ($proc) { $proc.Dispose() }
+        }
     }
     catch {
         Write-OutputColor "Failed to save credential: $_" -color "Error"
@@ -1178,7 +1184,7 @@ function Show-CertificateExpiryCheck {
             })
             foreach ($cert in $certs) {
                 $daysLeft = [math]::Round(($cert.NotAfter - $now).TotalDays, 0)
-                $subject = $cert.Subject
+                $subject = if ($cert.Subject) { $cert.Subject } else { "(no subject)" }
                 if ($subject.Length -gt 40) { $subject = $subject.Substring(0, 37) + "..." }
                 $allCerts += [PSCustomObject]@{
                     Store     = $store.Name

Modules/37-HealthCheck.ps1

@@ -134,7 +134,7 @@ function Show-SystemHealthCheck {
             Write-OutputColor "  No certificates in LocalMachine\My store." -color "Info"
         } else {
             foreach ($cert in ($allCerts | Sort-Object NotAfter)) {
-                $subject = $cert.Subject
+                $subject = if ($cert.Subject) { $cert.Subject } else { "(no subject)" }
                 if ($subject.Length -gt 40) { $subject = $subject.Substring(0, 37) + "..." }
                 $daysLeft = [math]::Floor(($cert.NotAfter - $now).TotalDays)
                 $expiryStr = "$($cert.NotAfter.ToString('yyyy-MM-dd')) (${daysLeft}d)"

Modules/41-VHDManagement.ps1

@@ -155,6 +155,10 @@ function Get-SyspreppedVHD {
     }
 
     # Pre-check: verify destination has enough free space
+    if (-not $cachePath) {
+        Write-OutputColor "  VHD cache path not configured. Run Host Storage Setup first." -color "Error"
+        return $null
+    }
     $destDriveLetter = $cachePath.Substring(0, 1)
     $destVolume = Get-Volume -DriveLetter $destDriveLetter -ErrorAction SilentlyContinue
     if ($destVolume) {

Modules/50-EntryPoint.ps1

@@ -993,7 +993,7 @@ function Start-BatchMode {
         $storageAlready = $false
         if ($checkDrive) {
             $checkPaths = @("$($checkDrive):\Virtual Machines", "$($checkDrive):\ISOs", "$($checkDrive):\Virtual Machines\_BaseImages")
-            $storageAlready = ($checkPaths | Where-Object { Test-Path $_ }).Count -eq 3
+            $storageAlready = @($checkPaths | Where-Object { Test-Path $_ }).Count -eq 3
         }
         if ($storageAlready) {
             Write-OutputColor "  [$stepNum/$totalSteps] Host storage: already initialized on $($checkDrive):" -color "Debug"

Modules/55-QoLFeatures.ps1

@@ -286,7 +286,8 @@ function Show-CommandHistory {
         $recentHistory = $script:CommandHistory | Select-Object -Last 20
         $index = 1
         foreach ($cmd in $recentHistory) {
-            $cmdStr = if ($cmd.Command.Length -gt 40) { $cmd.Command.Substring(0,37) + "..." } else { $cmd.Command.PadRight(40) }
+            $cmdName = if ($cmd.Command) { $cmd.Command } else { "(unknown)" }
+            $cmdStr = if ($cmdName.Length -gt 40) { $cmdName.Substring(0,37) + "..." } else { $cmdName.PadRight(40) }
             $timeStr = if ($cmd.Timestamp -and $cmd.Timestamp.Length -ge 16) { $cmd.Timestamp.Substring(5,11) } else { "           " }
             Write-OutputColor "  │  [$($index.ToString().PadLeft(2))] $cmdStr $timeStr│" -color "Info"
             $index++

Modules/58-NetworkDiagnostics.ps1

@@ -496,19 +496,19 @@ function Invoke-QuickPortScan {
     foreach ($p in $ports) {
         $jobs.Add((Start-Job -ScriptBlock {
             param($IP, $Port)
+            $tcp = $null
             try {
                 $tcp = New-Object System.Net.Sockets.TcpClient
                 $connect = $tcp.BeginConnect($IP, $Port, $null, $null)
                 $wait = $connect.AsyncWaitHandle.WaitOne(2000, $false)
                 if ($wait -and $tcp.Connected) {
                     $tcp.EndConnect($connect)
-                    $tcp.Close()
                     return "OPEN"
                 }
-                $tcp.Close()
                 return "CLOSED"
             }
             catch { return "CLOSED" }
+            finally { if ($tcp) { $tcp.Close() } }
         } -ArgumentList $target, $p.Port))
     }