v1.98.62 — Storage Migration Service (module 69, 70 modules total) (#19)

New feature: Modules/69-StorageMigration.ps1 installs Storage Migration
Service (SMS) — Microsoft's file-server migration tool.

Functions: Test-SMSInstalled, Test-SMSProxyInstalled, Get-SMSStatus,
Install-SMSRole, Install-SMSProxy, Show-StorageMigrationManagement.

What it does:
- Installs the SMS orchestrator role (coordinates migration projects).
- Optionally installs the SMS-Proxy feature (run on the destination
  server for local-speed transfers).
- Reports orchestrator/proxy state, SMS service status, and the
  Get-SMSState orchestrator state.

Scope: deliberately honest — stands up the SMS roles and reports state.
The migration jobs (Inventory > Transfer > Cutover, identity swap) are
an interactive multi-phase per-project workflow that Microsoft drives
through Windows Admin Center; the menu says so plainly.

Integration (9 points): loader list, Header -Action ValidateSet,
50-EntryPoint action list + StorageMigrationSetup dispatch,
48-MenuDisplay Roles & Features menu, 49-MenuRunner dispatch,
00-Initialization config block, 56-OperationsMenu Import-Defaults
merge, defaults.example.json, Run-Tests.ps1 Section 164 (22 tests).
Module count 69->70, action count 180->181.

Completes the five Tier-1 feature modules for this cycle: Azure Arc,
Defender for Endpoint, WSUS, AD CS, and Storage Migration Service.

PSSA 0/0, regex harness 4759/4759, Pester 312/312.

Author: TheAbider

Changelog.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## v1.98.62
+
+New feature module: **Storage Migration Service** (module 69 — RackStack is now 70 modules).
+
+`Modules/69-StorageMigration.ps1` installs Storage Migration Service (SMS), Microsoft's tool for migrating file servers — their shares, data, security, and even server identity — onto modern Windows Server.
+
+**What it does:**
+- Installs the SMS orchestrator role (`SMS`) — the role that coordinates a migration project.
+- Optionally installs the SMS proxy (`SMS-Proxy`) — run on the destination Windows Server so migration data transfers locally instead of round-tripping through the orchestrator.
+- Reports orchestrator/proxy install state, the SMS service status, and the orchestrator state from `Get-SMSState`.
+- Interactive menu under **Configure Server → Roles & Features → [7] Storage Migration Service**, plus a headless CLI action `RackStack.exe -Action StorageMigrationSetup` (installs the orchestrator, and the proxy too when `StorageMigration.InstallProxy` is set).
+
+**Scope (deliberately honest):** this module stands up the SMS *roles*. The migration jobs themselves — Inventory → Transfer → Cutover, including source/destination pairing and the identity-swap decision — are an interactive, multi-phase, per-project workflow that Microsoft drives through Windows Admin Center. RackStack gets SMS installed and ready; the menu states plainly that job orchestration is a WAC workflow.
+
+**Config:** new `$script:StorageMigration` block in `00-Initialization.ps1` (single `InstallProxy` toggle), overridable via the new `StorageMigration` section in `defaults.example.json` (deep-merged by `Import-Defaults`).
+
+**Integration:** module registered in the loader, the `-Action` ValidateSet, the CLI action list + dispatch, the Roles & Features menu, and the structural test harness (new Section 164, 22 tests). Module count references (69 → 70) and CLI-action count (180 → 181) updated across `Run-Tests.ps1`, `sync-to-monolithic.ps1`, and `README.md`. RackStack now exposes 181 CLI actions across 70 modules.
+
+This completes the five Tier-1 feature modules planned for this development cycle: Azure Arc onboarding, Microsoft Defender for Endpoint onboarding, WSUS server setup, AD CS Certificate Authority bootstrap, and Storage Migration Service.
+
 ## v1.98.61
 
 New feature module: **AD CS Certificate Authority bootstrap** (module 68 — RackStack is now 69 modules).

Header.ps1

@@ -30,7 +30,7 @@
     7h3 4b1d3r
 
 .VERSION
-    1.98.61
+    1.98.62
 
 .LAST UPDATED
     05/19/2026
@@ -1391,7 +1391,7 @@
 param(
     # CLI headless mode: run a specific action without interactive menus
     # Usage: RackStack.exe -Action Cleanup [-Tier Standard] [-Silent] [-OutputFormat JSON]
-    [ValidateSet('Cleanup', 'Debloat', 'HealthCheck', 'Batch', 'QuickScan', 'Inventory', 'DriftCheck', 'Snapshot', 'Compliance', 'Harden', 'Remediate', 'Aggregate', 'Compare', 'Export', 'Trend', 'CertCheck', 'ReportHTML', 'ListeningPorts', 'SoftwareList', 'Uptime', 'ServiceAudit', 'EventAudit', 'NetInfo', 'ScheduledExport', 'ValidateConfig', 'Watch', 'Query', 'Diff', 'Baseline', 'Alert', 'FleetScan', 'PatchStatus', 'UserAudit', 'FirewallAudit', 'TaskAudit', 'DiskAudit', 'TLSAudit', 'SMBAudit', 'DriverAudit', 'TimeAudit', 'BootAudit', 'GPOAudit', 'MemoryAudit', 'ProcessAudit', 'BackupAudit', 'ShareAudit', 'DNSAudit', 'PowerAudit', 'RegistryAudit', 'ProfileAudit', 'HyperVAudit', 'NetworkAudit', 'StorageAudit', 'FeatureAudit', 'AutoStartAudit', 'BIOSAudit', 'ClusterAudit', 'AuditPolicyAudit', 'EnvAudit', 'CrashAudit', 'LocalGroupAudit', 'WMIAudit', 'TempAudit', 'UpdatePolicyAudit', 'IISAudit', 'SSHAudit', 'BitLockerAudit', 'PrintAudit', 'CredGuardAudit', 'PortAudit', 'AntivirusAudit', 'DotNetAudit', 'RDPAudit', 'VPNAudit', 'HostsFileAudit', 'NetStatAudit', 'LicenseAudit', 'USBDeviceAudit', 'AppLockerAudit', 'EventSubAudit', 'HotfixAudit', 'SysInfoAudit', 'LogonAudit', 'ACLAudit', 'RecoveryAudit', 'ServiceAccountAudit', 'ProxyAudit', 'PendingRebootAudit', 'PageFileAudit', 'CPUAudit', 'DefenderExclusionAudit', 'KerberosAudit', 'DHCPAudit', 'NUMAAudit', 'SymlinkAudit', 'StartupScriptAudit', 'SecureChannelAudit', 'ComObjectAudit', 'FirewallLogAudit', 'ScheduledRebootAudit', 'PowerShellAudit', 'RouteTableAudit', 'TokenPrivilegeAudit', 'WindowsCapabilityAudit', 'ARPTableAudit', 'LocaleAudit', 'TaskHistoryAudit', 'NTFSAudit', 'Win11Cleanup', 'DarkMode', 'LightMode', 'iSCSIAudit', 'NICTeamAudit', 'SMBSessionAudit', 'WindowsUpdateAudit', 'ClusterQuorumAudit', 'S2DAudit', 'VirtualSwitchAudit', 'MPIOPathAudit', 'ServiceRecoveryAudit', 'VMOvercommitAudit', 'DedupAudit', 'ClusterNetworkAudit', 'ReplicaLagAudit', 'HandleLeakAudit', 'ShadowCopyAudit', 'QoSPolicyAudit', 'LiveMigrationAudit', 'DomainTrustAudit', 'DiskLatencyAudit', 'NICOffloadAudit', 'StorageTimeoutAudit', 'EventLogCapacityAudit', 'TcpSettingsAudit', 'WinRMAudit', 'ClusterHealthScore', 'VMInventoryExport', 'VMSnapshotAudit', 'StorageHealthScore', 'CSVSpaceAudit', 'SMBConnectionAudit', 'VolumeLabelAudit', 'NICErrorAudit', 'VMResourceWaste', 'HealthDashboard', 'SCCMClientAudit', 'SCOMAgentAudit', 'WACConnectivityAudit', 'AzureADAudit', 'ServerScore', 'FleetReport', 'PasswordPolicy', 'FirewallRuleAudit', 'GPResultAudit', 'DNSCacheAudit', 'TPMAudit', 'SecureBootAudit', 'TimeSkewAudit', 'NetworkProfileAudit', 'InsecureServiceAudit', 'SelfTest', 'CheckForUpdate', 'ExportLogs', 'UpdateSelf', 'Rollback', 'ScheduleUpdateCheck', 'Dashboard', 'History', 'Replay', 'AzureArcEnroll', 'DefenderEndpointOnboard', 'WSUSSetup', 'ADCSSetup')]
+    [ValidateSet('Cleanup', 'Debloat', 'HealthCheck', 'Batch', 'QuickScan', 'Inventory', 'DriftCheck', 'Snapshot', 'Compliance', 'Harden', 'Remediate', 'Aggregate', 'Compare', 'Export', 'Trend', 'CertCheck', 'ReportHTML', 'ListeningPorts', 'SoftwareList', 'Uptime', 'ServiceAudit', 'EventAudit', 'NetInfo', 'ScheduledExport', 'ValidateConfig', 'Watch', 'Query', 'Diff', 'Baseline', 'Alert', 'FleetScan', 'PatchStatus', 'UserAudit', 'FirewallAudit', 'TaskAudit', 'DiskAudit', 'TLSAudit', 'SMBAudit', 'DriverAudit', 'TimeAudit', 'BootAudit', 'GPOAudit', 'MemoryAudit', 'ProcessAudit', 'BackupAudit', 'ShareAudit', 'DNSAudit', 'PowerAudit', 'RegistryAudit', 'ProfileAudit', 'HyperVAudit', 'NetworkAudit', 'StorageAudit', 'FeatureAudit', 'AutoStartAudit', 'BIOSAudit', 'ClusterAudit', 'AuditPolicyAudit', 'EnvAudit', 'CrashAudit', 'LocalGroupAudit', 'WMIAudit', 'TempAudit', 'UpdatePolicyAudit', 'IISAudit', 'SSHAudit', 'BitLockerAudit', 'PrintAudit', 'CredGuardAudit', 'PortAudit', 'AntivirusAudit', 'DotNetAudit', 'RDPAudit', 'VPNAudit', 'HostsFileAudit', 'NetStatAudit', 'LicenseAudit', 'USBDeviceAudit', 'AppLockerAudit', 'EventSubAudit', 'HotfixAudit', 'SysInfoAudit', 'LogonAudit', 'ACLAudit', 'RecoveryAudit', 'ServiceAccountAudit', 'ProxyAudit', 'PendingRebootAudit', 'PageFileAudit', 'CPUAudit', 'DefenderExclusionAudit', 'KerberosAudit', 'DHCPAudit', 'NUMAAudit', 'SymlinkAudit', 'StartupScriptAudit', 'SecureChannelAudit', 'ComObjectAudit', 'FirewallLogAudit', 'ScheduledRebootAudit', 'PowerShellAudit', 'RouteTableAudit', 'TokenPrivilegeAudit', 'WindowsCapabilityAudit', 'ARPTableAudit', 'LocaleAudit', 'TaskHistoryAudit', 'NTFSAudit', 'Win11Cleanup', 'DarkMode', 'LightMode', 'iSCSIAudit', 'NICTeamAudit', 'SMBSessionAudit', 'WindowsUpdateAudit', 'ClusterQuorumAudit', 'S2DAudit', 'VirtualSwitchAudit', 'MPIOPathAudit', 'ServiceRecoveryAudit', 'VMOvercommitAudit', 'DedupAudit', 'ClusterNetworkAudit', 'ReplicaLagAudit', 'HandleLeakAudit', 'ShadowCopyAudit', 'QoSPolicyAudit', 'LiveMigrationAudit', 'DomainTrustAudit', 'DiskLatencyAudit', 'NICOffloadAudit', 'StorageTimeoutAudit', 'EventLogCapacityAudit', 'TcpSettingsAudit', 'WinRMAudit', 'ClusterHealthScore', 'VMInventoryExport', 'VMSnapshotAudit', 'StorageHealthScore', 'CSVSpaceAudit', 'SMBConnectionAudit', 'VolumeLabelAudit', 'NICErrorAudit', 'VMResourceWaste', 'HealthDashboard', 'SCCMClientAudit', 'SCOMAgentAudit', 'WACConnectivityAudit', 'AzureADAudit', 'ServerScore', 'FleetReport', 'PasswordPolicy', 'FirewallRuleAudit', 'GPResultAudit', 'DNSCacheAudit', 'TPMAudit', 'SecureBootAudit', 'TimeSkewAudit', 'NetworkProfileAudit', 'InsecureServiceAudit', 'SelfTest', 'CheckForUpdate', 'ExportLogs', 'UpdateSelf', 'Rollback', 'ScheduleUpdateCheck', 'Dashboard', 'History', 'Replay', 'AzureArcEnroll', 'DefenderEndpointOnboard', 'WSUSSetup', 'ADCSSetup', 'StorageMigrationSetup')]
     [string]$Action,
 
     [ValidateSet('Light', 'Standard', 'Aggressive')]

Modules/00-Initialization.ps1

@@ -184,6 +184,13 @@ $script:ADCS = @{
     ValidityYears = 10                  # Root CA certificate validity (1-25 years)
 }
 
+# Storage Migration Service (override via defaults.json "StorageMigration")
+# InstallProxy controls whether the StorageMigrationSetup CLI action also
+# installs the SMS-Proxy feature (run the proxy on the destination server).
+$script:StorageMigration = @{
+    InstallProxy = $false               # Also install SMS-Proxy when running StorageMigrationSetup
+}
+
 # Folder file cache - keyed by folder path, each entry has Files array and CacheTime
 $script:FileCache = @{}
 
@@ -218,7 +225,7 @@ if (-not $PSCommandPath -and $script:ScriptPath) {
 if (-not $script:ModuleRoot -and $script:ScriptPath) {
     $script:ModuleRoot = [System.IO.Path]::GetDirectoryName($script:ScriptPath)
 }
-$script:ScriptVersion = "1.98.61"
+$script:ScriptVersion = "1.98.62"
 $script:ScriptStartTime = Get-Date
 
 # Post-update cleanup: UpdateSelf / Rollback leave a `.pending-delete` sibling next to RackStack.exe.

Modules/48-MenuDisplay.ps1

@@ -393,6 +393,12 @@ function Show-RolesFeaturesMenu {
     } -CacheSeconds 120
     $adcsColor = if ($adcsStatusText -eq "CA configured") { "Success" } elseif ($adcsStatusText -eq "CA config needed") { "Warning" } else { "Warning" }
 
+    $smsStatusText = Get-CachedValue -Key "SMSState" -FetchScript {
+        $sm = Get-SMSStatus
+        if ($sm.OrchestratorInstalled) { "Installed" } else { "Not Installed" }
+    } -CacheSeconds 120
+    $smsColor = if ($smsStatusText -eq "Installed") { "Success" } else { "Warning" }
+
     Write-OutputColor "" -color "Info"
     Write-OutputColor "  ╔════════════════════════════════════════════════════════════════════════╗" -color "Info"
     Write-OutputColor "  ║$(("                           ROLES & FEATURES").PadRight(72))║" -color "Info"
@@ -406,6 +412,7 @@ function Show-RolesFeaturesMenu {
     Write-MenuItem "[4]  Install $($script:AgentInstaller.ToolName) Agent" -Status $agentStatus -StatusColor $agentColor
     Write-MenuItem "[5]  WSUS Update Server ►" -Status $wsusStatusText -StatusColor $wsusColor
     Write-MenuItem "[6]  Certificate Services (AD CS) ►" -Status $adcsStatusText -StatusColor $adcsColor
+    Write-MenuItem "[7]  Storage Migration Service ►" -Status $smsStatusText -StatusColor $smsColor
     Write-OutputColor "  └────────────────────────────────────────────────────────────────────────┘" -color "Info"
     Write-OutputColor "" -color "Info"
     Write-OutputColor "  [B] ◄ Back to Server Config" -color "Info"

Modules/49-MenuRunner.ps1

@@ -232,9 +232,10 @@ function Start-Show-RolesFeaturesMenu {
             "4" { Install-Agent }
             "5" { Show-WSUSManagement }
             "6" { Show-ADCSManagement }
+            "7" { Show-StorageMigrationManagement }
             "back" { return }
             default {
-                Write-OutputColor "  Invalid choice. Enter 1-6 or B." -color "Error"
+                Write-OutputColor "  Invalid choice. Enter 1-7 or B." -color "Error"
                 Start-Sleep -Milliseconds 500
             }
         }

Modules/50-EntryPoint.ps1

@@ -398,6 +398,7 @@ function Assert-Elevation {
                 @{ Action = 'DefenderEndpointOnboard'; Description = 'Onboard this server to Microsoft Defender for Endpoint (runs the onboarding .cmd from defaults.json DefenderEndpoint)' }
                 @{ Action = 'WSUSSetup';        Description = 'Install + post-install + default-configure the WSUS update server (config from defaults.json WSUS)' }
                 @{ Action = 'ADCSSetup';        Description = 'Install the AD CS role (CA configuration is interactive-only — it needs a typed confirmation)' }
+                @{ Action = 'StorageMigrationSetup'; Description = 'Install the Storage Migration Service orchestrator role (+proxy if StorageMigration.InstallProxy is set)' }
                 @{ Action = 'Batch';            Description = 'JSON-driven full configuration' }
             )
             if ($script:CLIOutputFormat -eq 'JSON') {
@@ -1948,6 +1949,36 @@ footer{text-align:center;color:#999;font-size:12px;padding:16px}
             }
             [Environment]::Exit([int](-not $adcsRole))
         }
+        'StorageMigrationSetup' {
+            # Install the Storage Migration Service orchestrator role, and the
+            # proxy too if defaults.json StorageMigration.InstallProxy is set.
+            # Migration jobs themselves run interactively via Windows Admin
+            # Center. Exit 0 if the orchestrator role is installed.
+            Write-OutputColor "  Installing Storage Migration Service..." -color "Info"
+            $smsRole  = Install-SMSRole
+            $smsProxy = $false
+            if ($null -ne $script:StorageMigration -and $script:StorageMigration.InstallProxy) {
+                $smsProxy = Install-SMSProxy
+            }
+            if ($smsRole) {
+                Write-OutputColor "  SMS roles installed. Drive migration jobs from Windows Admin Center." -color "Info"
+            }
+            if ($script:CLIOutputFormat -eq 'JSON') {
+                $smsStatus = Get-SMSStatus
+                $jsonResult = @{
+                    Tool                  = $script:ToolFullName
+                    Version               = $script:ScriptVersion
+                    Action                = 'StorageMigrationSetup'
+                    Timestamp             = (Get-Date -Format "yyyy-MM-ddTHH:mm:ss")
+                    Hostname              = $env:COMPUTERNAME
+                    Success               = [bool]$smsRole
+                    OrchestratorInstalled = [bool]$smsStatus.OrchestratorInstalled
+                    ProxyInstalled        = [bool]$smsStatus.ProxyInstalled
+                }
+                Write-Output ($jsonResult | ConvertTo-Json -Depth 10)
+            }
+            [Environment]::Exit([int](-not $smsRole))
+        }
         'Batch' {
             if (-not $script:CLIConfig) {
                 Write-OutputColor "  ERROR: -Action Batch requires -Config <path>" -color "Error"

Modules/56-OperationsMenu.ps1

@@ -1104,6 +1104,21 @@ function Import-Defaults {
         }
     }
 
+    # Update Storage Migration Service settings (deep-merge from defaults.json "StorageMigration")
+    $acSms = $merged.StorageMigration
+    if ($acSms) {
+        if ($acSms -is [PSCustomObject]) {
+            foreach ($prop in $acSms.PSObject.Properties) {
+                if ($script:StorageMigration.ContainsKey($prop.Name)) { $script:StorageMigration[$prop.Name] = $prop.Value }
+            }
+        }
+        elseif ($acSms -is [hashtable]) {
+            foreach ($key in $acSms.Keys) {
+                if ($script:StorageMigration.ContainsKey($key)) { $script:StorageMigration[$key] = $acSms[$key] }
+            }
+        }
+    }
+
     # Import custom license keys from merged defaults (supports company + personal)
     $script:CustomKMSKeys = @{}
     $script:CustomAVMAKeys = @{}