docs(coverage): report the fix of the piped AppliesTo, its reviews, and the acceptance of the final package
The report of Handoff 5 now tells what came after the final measurement of
61e936e:
- why a piped AppliesTo was dropped for a path (the default parameter set),
the fix (93ed2c7), the defect of that fix that the third independent review
found (the scope of a piped object reached the next one, 9783d2a), and the
corrections of what the documents said about empty and unconvertible
values (7bc7925, 2112ee3);
- three independent reviews and two checks of the third reviewer, with every
finding and its resolution, including the seven Minor findings of the
second check of 7bc7925 and of this report;
- the red and green runs of the tests, among them the runs of the tests of
the CSV route on the build before the fix and on 93ed2c7;
- the measurements of 9783d2a, 7bc7925, and 2112ee3 (1,492 cases per
configuration, 3,266 of 3,668 sequence points, the same 183 unvisited
methods) on the bytes of one build;
- the acceptance of the final package in the labs: the first lab (245, 0, 1
per edition), the unit suite on the three file servers and the client (16
configurations, 1,189 cases each), and the three cells of the matrix lab
(229, 0, 2 per edition), every end state clean; and the first start of the
cells, which did nothing because the command that I had given the
maintainer did not set the module path.
The Runs, Evidence, and ParameterSets tables are regenerated. The lines that
the ParameterSets table cites are mapped to the tests of 6143545.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: AI Assistant <ai@example.com>
"access","Add-NTFSAccess","PathComplex","True","33","6","1","36","Yes","Yes","No","Partly","Yes","Access.Tests.ps1:740 Should write an AddAceError for each item, change nothing, and return nothing with -PassThru | PathErrors.Tests.ps1:178 <Command> should keep the denied item unchanged, report <ErrorId>, and process the next item | Access.Tests.ps1:807 Should write all entries of the item after the change | PathErrors.Tests.ps1:230 Add-NTFSAccess should take ownership, add the entry, and set the owner back","6: SMB share as delegated and domain accounts - add keeps the owner (#34), add by foreign-domain account name, deny-entry fixtures (Live:253, 877, 927, 987, 1038, 1280)","No test pipes anything into the set (FileInfo/DirectoryInfo, or objects with Account/AccessRights properties), and none combines -PassThru with one failing and one succeeding path: continuation (PathErrors:178, no -PassThru) and no output after a failure (Access:740, all items fail) are asserted in separate tests. Several -Account values, a Deny entry written through -Path (type, no Synchronize) and positional binding are untested.","TestNeeded","Access.Tests.ps1:740-751 asserts ErrorId, category WriteError, TargetObject, ArgumentException, no output and unchanged SDDL for two failing paths; PathErrors.Tests.ps1:178-192 asserts one error with the blocked target, its SDDL unchanged and the next item's entry added; Access.Tests.ps1:807-815 asserts type, entry count and the added entry of -PassThru. BoundBy = scan 33 + PathErrors:108 and :178 (& $Command) + PermissionScopes:86 (splat, Form=Flags, Source=Path); about 14 of the 36 calls are the subject of an assertion, the rest are fixtures.","Partly","ParameterSets.Access.Tests.ps1:61,62 Should add one explicit entry for each path bound through the pipeline, by FullName and by property name, leaving the rest of each item unchanged | ParameterSets.Access.Tests.ps1:91 Should write one AddAceError for the blocked path, leave it unchanged, and return -PassThru entries only for the path it changed","several -Account values in one call; a Deny entry written through -Path checked for AccessControlType=Deny and no auto-added Synchronize; positional binding (Add-NTFSAccess $path $account $rights)","budget (all three; proposal 1c was traded for the pipeline and PassThru-combined tests)"
"access","Add-NTFSAccess","PathSimple","False","6","1","2","8","Partly","No","No","No","Yes","PermissionScopes.Tests.ps1:86 Should add and remove <Name> using <Form> on <Source>, preserving the other account | PermissionScopes.Tests.ps1:110 Should apply <Name> only to its intended descendants, including the OneLevel boundary | Access.Tests.ps1:1035 Should name the folder of an inheritable entry, also with -ExcludeExplicit | ObjectApis.Tests.ps1:747 Should name the item of a descriptor and write it to a folder by its path","1: SMB share - Deny ReadPermissions entry with -AppliesTo ThisFolderOnly as a fixture of the unknown-parent case (Live:1039); no assertion on the set itself","No test makes the set fail (missing path, denied write, deny entry without rights), pipes into it, or reads its result back with .NET: every read-back goes through -PassThru or Get-NTFSAccess. -AccessType Deny with -AppliesTo and the exclusion of -AppliesTo with -InheritanceFlags are untested.","TestNeeded","PermissionScopes.Tests.ps1:86-94 asserts type, flags, rights and ConvertToApplyTo of the -PassThru entry for 13 scopes (Form=AppliesTo, Source=Path) and :110-133 asserts which descendants inherit it, both read through the module's own cmdlets. Access.Tests.ps1:1035, Inheritance.Tests.ps1:326/365/474 and ObjectApis.Tests.ps1:747 use the set as a fixture. BoundBy = scan 6 + the splats PermissionScopes:84 and :86 (Source=Path); 2 of the 8 calls are the subject of an assertion.","Partly","ParameterSets.Access.Tests.ps1:113,129 Should report a missing path's error by category and target, still scope the next path's entry, and keep binding -Path through the pipeline once -AppliesTo selects the set | ParameterSets.Access.Tests.ps1:572 Should require -AppliesTo only in the Simple parameter sets, -InheritanceFlags/-PropagationFlags only in the Complex parameter sets, and reject combining -AppliesTo with -InheritanceFlags without changing the item","a denied write for this set; a Deny entry without rights (-AccessType Deny -AccessRights None) for this set; -AccessType Deny combined with -AppliesTo","budget (all three; the write-denial code path is shared with PathComplex and already covered there)"
"access","Add-NTFSAccess","PathComplex","True","33","6","1","36","Yes","Yes","No","Partly","Yes","Access.Tests.ps1:740 Should write an AddAceError for each item, change nothing, and return nothing with -PassThru | PathErrors.Tests.ps1:178 <Command> should keep the denied item unchanged, report <ErrorId>, and process the next item | Access.Tests.ps1:807 Should write all entries of the item after the change | PathErrors.Tests.ps1:230 Add-NTFSAccess should take ownership, add the entry, and set the owner back","6: SMB share as delegated and domain accounts - add keeps the owner (#34), add by foreign-domain account name, deny-entry fixtures (Live:253, 877, 927, 987, 1038, 1280)","No test pipes anything into the set (FileInfo/DirectoryInfo, or objects with Account/AccessRights properties), and none combines -PassThru with one failing and one succeeding path: continuation (PathErrors:178, no -PassThru) and no output after a failure (Access:740, all items fail) are asserted in separate tests. Several -Account values, a Deny entry written through -Path (type, no Synchronize) and positional binding are untested.","TestNeeded","Access.Tests.ps1:740-751 asserts ErrorId, category WriteError, TargetObject, ArgumentException, no output and unchanged SDDL for two failing paths; PathErrors.Tests.ps1:178-192 asserts one error with the blocked target, its SDDL unchanged and the next item's entry added; Access.Tests.ps1:807-815 asserts type, entry count and the added entry of -PassThru. BoundBy = scan 33 + PathErrors:108 and :178 (& $Command) + PermissionScopes:86 (splat, Form=Flags, Source=Path); about 14 of the 36 calls are the subject of an assertion, the rest are fixtures.","Partly","ParameterSets.Access.Tests.ps1:72,73 Should add one explicit entry for each path bound through the pipeline, by FullName and by property name, leaving the rest of each item unchanged | ParameterSets.Access.Tests.ps1:102 Should write one AddAceError for the blocked path, leave it unchanged, and return -PassThru entries only for the path it changed","several -Account values in one call; a Deny entry written through -Path checked for AccessControlType=Deny and no auto-added Synchronize; positional binding (Add-NTFSAccess $path $account $rights)","budget (all three; proposal 1c was traded for the pipeline and PassThru-combined tests)"
"access","Add-NTFSAccess","PathSimple","False","6","1","2","8","Partly","No","No","No","Yes","PermissionScopes.Tests.ps1:86 Should add and remove <Name> using <Form> on <Source>, preserving the other account | PermissionScopes.Tests.ps1:110 Should apply <Name> only to its intended descendants, including the OneLevel boundary | Access.Tests.ps1:1035 Should name the folder of an inheritable entry, also with -ExcludeExplicit | ObjectApis.Tests.ps1:747 Should name the item of a descriptor and write it to a folder by its path","1: SMB share - Deny ReadPermissions entry with -AppliesTo ThisFolderOnly as a fixture of the unknown-parent case (Live:1039); no assertion on the set itself","No test makes the set fail (missing path, denied write, deny entry without rights), pipes into it, or reads its result back with .NET: every read-back goes through -PassThru or Get-NTFSAccess. -AccessType Deny with -AppliesTo and the exclusion of -AppliesTo with -InheritanceFlags are untested.","TestNeeded","PermissionScopes.Tests.ps1:86-94 asserts type, flags, rights and ConvertToApplyTo of the -PassThru entry for 13 scopes (Form=AppliesTo, Source=Path) and :110-133 asserts which descendants inherit it, both read through the module's own cmdlets. Access.Tests.ps1:1035, Inheritance.Tests.ps1:326/365/474 and ObjectApis.Tests.ps1:747 use the set as a fixture. BoundBy = scan 6 + the splats PermissionScopes:84 and :86 (Source=Path); 2 of the 8 calls are the subject of an assertion.","Partly","ParameterSets.Access.Tests.ps1:247,259 Should report a missing path's error by category and target, still scope the next path's entry, and keep binding -Path through the pipeline once -AppliesTo selects the set | ParameterSets.Access.Tests.ps1:769 Should require -AppliesTo only in the Simple parameter sets, -InheritanceFlags/-PropagationFlags only in the Complex parameter sets, and reject combining -AppliesTo with -InheritanceFlags without changing the item","a denied write for this set; a Deny entry without rights (-AccessType Deny -AccessRights None) for this set; -AccessType Deny combined with -AppliesTo","budget (all three; the write-denial code path is shared with PathComplex and already covered there)"
"access","Add-NTFSAccess","SDSimple","False","2","0","2","4","Partly","No","No","No","Yes","Access.Tests.ps1:898 Add-NTFSAccess should still take -AppliesTo for a security descriptor | PermissionScopes.Tests.ps1:86 Should add and remove <Name> using <Form> on <Source>, preserving the other account | SecurityDescriptor.Tests.ps1:355 Should write the descriptor and report a read error for -PassThru, not a write error","0","Only InheritanceFlags for ThisFolderOnly is read back from the descriptor with .NET (Access:898); the 13 scopes are checked through the cmdlet's own -PassThru, and no test pipes descriptors in or passes several. A failing change (for example a deny entry without rights) ends the cmdlet with a terminating error and no test pins it (open item 1).","MaintainerDecision","Access.Tests.ps1:898-902 reads the rule from $sd.SecurityDescriptor with .NET; PermissionScopes.Tests.ps1:86-97 asserts type, flags, rights and, for Source=SecurityDescriptor, that the SDDL on disk is unchanged (13 cases). BoundBy = scan 2 (Access:898; SecurityDescriptor:355 is a fixture) + the splats PermissionScopes:84 and :86 (Source=SecurityDescriptor, Form=AppliesTo).","MaintainerDecision","","all 13 scopes read back with .NET for Source=SecurityDescriptor (only ThisFolderOnly already was, pre-existing); piped descriptors; several descriptors; the failing-change (deny entry without rights) terminating error, not pinned","budget (the 13-scope/pipe/several items, notes proposal (b2)#1 not implemented); MaintainerDecision (the failing-change open item)"
"access","Add-NTFSAccess","SDComplex","False","14","2","1","16","Yes","No","No","No","Yes","Access.Tests.ps1:822 Should write all entries of a security descriptor after the change and leave the item unchanged | Access.Tests.ps1:887 Add-NTFSAccess should apply the entry to the folder, its subfolders, and files by default | SecurityDescriptor.Tests.ps1:81 Should write the entry as the only explicit entry of the item | PermissionScopes.Tests.ps1:86 Should add and remove <Name> using <Form> on <Source>, preserving the other account","2: SMB share - descriptor written back keeps the owner (#34, Live:316) and the fixture of the later-command cases (Live:1151)","No test pipes descriptors into the cmdlet, and arrays of descriptors appear only as fixtures of Set-NTFSSecurityDescriptor (SecurityDescriptor.Tests.ps1:306, :324; PipelineControl.Tests.ps1:211). A failing descriptor (deny entry without rights) ends the cmdlet with a terminating error and no test pins it (open item 1).","MaintainerDecision","Access.Tests.ps1:822-827 asserts that -PassThru writes as many entries as $sd.SecurityDescriptor holds, one new explicit entry, and no Everyone entry on disk; :887-892 reads the default flags back with .NET; SecurityDescriptor.Tests.ps1:81-86 asserts exactly one explicit entry on disk after Set-NTFSSecurityDescriptor. BoundBy = scan 14 + Access:872 (& $_, asserts only no throw) + PermissionScopes:86 (splat); 5 of the 16 calls are the subject of an assertion.","MaintainerDecision","","piped descriptors into the cmdlet; arrays of descriptors used only as Set-NTFSSecurityDescriptor fixtures, not asserted for Add itself; the failing descriptor (deny entry without rights) terminating error, not pinned","budget (the pipe/array items, notes proposal (b2)#2 not implemented); MaintainerDecision (the failing-descriptor open item)"
"access","Remove-NTFSAccess","PathComplex","True","13","2","2","17","Yes","Yes","Yes","Partly","Partly","Access.Tests.ps1:539 Should write a RemoveAceError for each item, change nothing, and return nothing with -PassThru | Access.Tests.ps1:617 Should remove an inherit-only entry that Get-NTFSAccess returned, and nothing else | PathErrors.Tests.ps1:178 <Command> should keep the denied item unchanged, report <ErrorId>, and process the next item | Access.Tests.ps1:651 Should take only the requested generic right from the entry of the account when another account has an exact entry","2: SMB share - remove keeps the owner (#34, Live:264), remove by foreign-domain account name (Live:886)","No test combines -PassThru with one failing and one succeeding path, none asserts the type or the complete entry list of the -PassThru output, and the pipeline test pipes a single entry per case. Several -Account values and positional binding are untested.","TestNeeded","Access.Tests.ps1:539-550 asserts ErrorId, category, target, ArgumentException, no output and unchanged SDDL for two paths; :616-620 pipes Get-NTFSAccess output (binding by property name) and asserts the exact SDDL minus the entry in 3 cases; PathErrors.Tests.ps1:178-192 asserts the next item's entry is removed after one error. BoundBy = scan 13 + Access:617 (pipeline, resolves to PathComplex), PathErrors:108 and :178 (& $Command), PermissionScopes:99 (splat, Form=AppliesTo, Source=Path); all 17 calls are the subject of an assertion.","Partly","ParameterSets.Access.Tests.ps1:157 Should write one RemoveAceError for the blocked path, leave it unchanged, and return -PassThru entries only for the path it changed","the -PassThru output's count is not checked against the complete entry list of the surviving item (only non-emptiness, type, FullName, and absence of the removed account); the pipeline test still pipes only a single entry per call; several -Account values; positional binding","budget (all four)"
"access","Remove-NTFSAccess","PathSimple","False","0","0","2","1","Partly","No","No","No","Partly","PermissionScopes.Tests.ps1:99 Should add and remove <Name> using <Form> on <Source>, preserving the other account","0","Only the -RemoveSpecific form with -PassThru is bound (13 scopes, Form=Flags); removing rights without -RemoveSpecific, a Deny entry, a missing or denied path, several paths and piped input are untested for this set, and nothing reads the item back with .NET.","TestNeeded","BoundBy = 1 although the scan found 0: PermissionScopes.Tests.ps1:99 binds -AppliesTo when Form is Flags (add with flags, remove with -AppliesTo), 13 cases with Source=Path; it asserts that the account's entry is gone from the -PassThru output and the keeper stays once (:101-102) and that Get-NTFSAccess finds nothing (:103). No other test binds -AppliesTo with Remove-NTFSAccess.","Partly","ParameterSets.Access.Tests.ps1:179 Should take only the requested rights from an entry scoped by -AppliesTo without -RemoveSpecific, keep its flags, and leave another account's entry untouched","a Deny entry's rights-reduction without -RemoveSpecific; a missing or denied path for this set; several paths in one call; piped input","budget (all four; the shared path-resolution/write-denial code is already covered for PathComplex)"
"access","Remove-NTFSAccess","PathComplex","True","13","2","2","17","Yes","Yes","Yes","Partly","Partly","Access.Tests.ps1:539 Should write a RemoveAceError for each item, change nothing, and return nothing with -PassThru | Access.Tests.ps1:617 Should remove an inherit-only entry that Get-NTFSAccess returned, and nothing else | PathErrors.Tests.ps1:178 <Command> should keep the denied item unchanged, report <ErrorId>, and process the next item | Access.Tests.ps1:651 Should take only the requested generic right from the entry of the account when another account has an exact entry","2: SMB share - remove keeps the owner (#34, Live:264), remove by foreign-domain account name (Live:886)","No test combines -PassThru with one failing and one succeeding path, none asserts the type or the complete entry list of the -PassThru output, and the pipeline test pipes a single entry per case. Several -Account values and positional binding are untested.","TestNeeded","Access.Tests.ps1:539-550 asserts ErrorId, category, target, ArgumentException, no output and unchanged SDDL for two paths; :616-620 pipes Get-NTFSAccess output (binding by property name) and asserts the exact SDDL minus the entry in 3 cases; PathErrors.Tests.ps1:178-192 asserts the next item's entry is removed after one error. BoundBy = scan 13 + Access:617 (pipeline, resolves to PathComplex), PathErrors:108 and :178 (& $Command), PermissionScopes:99 (splat, Form=AppliesTo, Source=Path); all 17 calls are the subject of an assertion.","Partly","ParameterSets.Access.Tests.ps1:287 Should write one RemoveAceError for the blocked path, leave it unchanged, and return -PassThru entries only for the path it changed","the -PassThru output's count is not checked against the complete entry list of the surviving item (only non-emptiness, type, FullName, and absence of the removed account); the pipeline test still pipes only a single entry per call; several -Account values; positional binding","budget (all four)"
"access","Remove-NTFSAccess","PathSimple","False","0","0","2","1","Partly","No","No","No","Partly","PermissionScopes.Tests.ps1:99 Should add and remove <Name> using <Form> on <Source>, preserving the other account","0","Only the -RemoveSpecific form with -PassThru is bound (13 scopes, Form=Flags); removing rights without -RemoveSpecific, a Deny entry, a missing or denied path, several paths and piped input are untested for this set, and nothing reads the item back with .NET.","TestNeeded","BoundBy = 1 although the scan found 0: PermissionScopes.Tests.ps1:99 binds -AppliesTo when Form is Flags (add with flags, remove with -AppliesTo), 13 cases with Source=Path; it asserts that the account's entry is gone from the -PassThru output and the keeper stays once (:101-102) and that Get-NTFSAccess finds nothing (:103). No other test binds -AppliesTo with Remove-NTFSAccess.","Partly","ParameterSets.Access.Tests.ps1:376 Should take only the requested rights from an entry scoped by -AppliesTo without -RemoveSpecific, keep its flags, and leave another account's entry untouched","a Deny entry's rights-reduction without -RemoveSpecific; a missing or denied path for this set; several paths in one call; piped input","budget (all four; the shared path-resolution/write-denial code is already covered for PathComplex)"
"access","Remove-NTFSAccess","SDSimple","False","0","0","2","1","Partly","No","No","No","Partly","PermissionScopes.Tests.ps1:99 Should add and remove <Name> using <Form> on <Source>, preserving the other account","0","Same single splat test as PathSimple with a descriptor: the removal is read back only through -PassThru and Get-NTFSAccess, the item on disk is not checked after it, and nothing tests removal without -RemoveSpecific, piped descriptors or several descriptors. A failing removal ends the cmdlet with a terminating error and no test pins it (open item 1).","MaintainerDecision","BoundBy = 1 although the scan found 0: PermissionScopes.Tests.ps1:99 binds the set for Source=SecurityDescriptor, Form=Flags (13 cases) and asserts the -PassThru output (:101-102) and Get-NTFSAccess -SecurityDescriptor (:103) after the removal; the SDDL check at :96 runs before the removal.","MaintainerDecision","","removal read back only through -PassThru/Get-NTFSAccess, not the item on disk after it; removal without -RemoveSpecific; piped descriptors; several descriptors; the failing removal terminating error, not pinned","budget (the read-back/RemoveSpecific/pipe/several items, notes proposal (b2)#3 not implemented); MaintainerDecision (the failing-removal open item)"
"access","Remove-NTFSAccess","SDComplex","False","4","0","2","6","Partly","No","No","No","Partly","Access.Tests.ps1:915 Remove-NTFSAccess should remove a deny entry from the descriptor and leave the item unchanged | Access.Tests.ps1:682 Should remove an entry that matches exactly | Access.Tests.ps1:688 Should take the rights away from a matching entry without -RemoveSpecific | Access.Tests.ps1:676 Should keep an entry that does not match exactly","0","No test removes an entry that exists on disk from a descriptor and checks that the item keeps it until Set-NTFSSecurityDescriptor: the entries of Access:676-688 and :915 are added in memory only, so a write-through would go unnoticed. No piped or multiple descriptors, and a failing removal ends the cmdlet with a terminating error (open item 1).","MaintainerDecision","Access.Tests.ps1:676-692 reads $sd.SecurityDescriptor with .NET for -RemoveSpecific (kept or removed) and for the rights removal; :915-920 removes an in-memory Deny entry and checks that no such entry is on disk, which also holds if both cmdlets wrote through. BoundBy = scan 4 + Access:872 (& $_, no throw only) + PermissionScopes:99 (splat, Form=AppliesTo, Source=SecurityDescriptor, -PassThru check).","MaintainerDecision","","no test removes an on-disk entry from a descriptor and checks the item keeps it until Set-NTFSSecurityDescriptor (write-through check); no piped or multiple descriptors; the failing removal terminating error, not pinned","budget (the write-through/pipe/several items, notes proposal (b2)#3 not implemented); MaintainerDecision (the failing-removal open item)"
"access","Clear-NTFSAccess","Path","True","6","2","0","8","Partly","Partly","No","Yes","NA","PathErrors.Tests.ps1:178 <Command> should keep the denied item unchanged, report <ErrorId>, and process the next item | Access.Tests.ps1:932 Should leave the item with an empty, protected DACL | PathErrors.Tests.ps1:271 Clear-NTFSAccess -DisableInheritance should take ownership, clear and protect the DACL, and not set an unchanged owner back | PathErrors.Tests.ps1:289 Clear-NTFSAccess -DisableInheritance should report RestoreOwnerError for a previous owner that it cannot set back","2: SMB share - clear keeps the owner (#34, Live:274); -DisableInheritance as the owner takes ownership without a RestoreOwnerError (Live:957)","No test asserts that a plain Clear leaves the inherited entries and the inheritance flag untouched, or clears a folder (all unit tests use files). ClearAclError and ReadFileError are asserted by ErrorId and target without category, and nothing is piped in.","TestNeeded","PathErrors.Tests.ps1:178-192 asserts one ClearAclError for the blocked path, its SDDL unchanged and no explicit entry on the next item; Access.Tests.ps1:932-936 and PathErrors.Tests.ps1:271-277 assert a protected, empty DACL and the unchanged owner with .NET; PathErrors.Tests.ps1:289-294 asserts RestoreOwnerError with category WriteError and target (elevated only). BoundBy = scan 6 + PathErrors:108 and :178 (& $Command); 7 of the 8 calls are the subject of an assertion.","Closed","ParameterSets.Access.Tests.ps1:212 Should clear each piped folder's explicit entries, including an inherit-only one, and leave inherited entries and the owner untouched | ParameterSets.Access.Tests.ps1:237,248 Should report a missing path's ReadFileError and a blocked path's ClearAclError, each by category and target","",""
"access","Clear-NTFSAccess","SD","False","3","1","0","3","Partly","No","No","No","NA","SecurityDescriptorSets.Tests.ps1:60 Clear-NTFSAccess -DisableInheritance should leave the descriptor with an empty, protected DACL | SecurityDescriptorSets.Tests.ps1:45 Clear-NTFSAccess should remove the explicit access entries of the descriptor | SecurityDescriptor.Tests.ps1:236 Should not report an owner that did not change when the write that took ownership leaves an empty DACL","1: SMB share - cleared descriptor written with Set-NTFSSecurityDescriptor without a RestoreOwnerError (Live:966)","No test checks that a plain Clear of a descriptor keeps its inherited entries and inheritance flag, pipes descriptors in, or passes several. The set has no per-item handler and no test makes it fail; it is not among the open items, so no test is proposed for that.","TestNeeded","SecurityDescriptorSets.Tests.ps1:45-50 asserts 0 explicit entries in the descriptor, 1 still on disk, then 0 after Set-NTFSSecurityDescriptor; :60-68 asserts a protected, empty DACL in memory, the DACL on disk unchanged and the written result; SecurityDescriptor.Tests.ps1:236-244 asserts that the owner stays after the write (the call there is a fixture of a Set-NTFSSecurityDescriptor test). BoundBy = 3 (no ambiguous calls).","Closed","ParameterSets.Access.Tests.ps1:271 Should clear each piped descriptor's explicit entries in memory, leave the items unchanged until Set-NTFSSecurityDescriptor, and keep the owner","",""
"access","Get-NTFSAccess","Path","True","25","3","2","29","NA","Partly","No","Yes","Partly","PathErrors.Tests.ps1:108 <Command> should write a <ErrorId> for it and continue with the next path | PathErrors.Tests.ps1:145 <Command> should write a ReadSecurityError for it and continue with the next path | Access.Tests.ps1:55 Should return the entries of the first item once | DriveRoot.Tests.ps1:34 Get-NTFSAccess should return the access entries of the root folder","3: SMB share - entries of a path longer than 260 characters, foreign-domain account entries, unknown-parent InheritedFrom (Live:543, 859, 1048)","No test pipes FileInfo/DirectoryInfo into the set (or passes a folder object by position, #88), asserts what it returns without -Path (Owner.Tests.ps1:98 only checks that nothing throws), or asserts the category of ReadFileError and ReadSecurityError (the latter is WriteError after a failed ownership retry, see notes). No test asserts the emitted type or the declared OutputType.","TestNeeded","PathErrors.Tests.ps1:108-115 and :145-152 assert one error with ErrorId and target and output for the next path; Access.Tests.ps1:55-59 asserts the first item's entries appear once after a failing path, but the path fails only without elevation; Access.Tests.ps1:1108-1118 asserts a NULL DACL gives one entry with Sid, IsInherited and InheritedFrom, and DriveRoot.Tests.ps1:34-36 that the SID list equals Get-Acl. BoundBy = scan 25 + PathErrors:108/:145 + Owner.Tests.ps1:98 (& $cmdlet, no throw only) + PermissionScopes:103 (splat, Source=Path).","Partly","ParameterSets.Access.Tests.ps1:303,305,315 Should return the same entries for a folder bound through the pipeline and by position, and report a missing path's error by category and target | ParameterSets.Access.Tests.ps1:548 <Name> should declare <Types> as its output type","what the cmdlet returns without -Path at all (beyond not throwing, Owner.Tests.ps1:98); the category of ReadSecurityError after a failed ownership retry; BeOfType on an actual emitted object (only the declared OutputType is asserted)","budget (the no -Path case); would-pin (ReadSecurityError is WriteError after a failed retry but OpenError from the generic catch - asserting a category here would cement that inconsistency, per the notes); budget (BeOfType on a live object)"
"access","Get-NTFSAccess","SD","False","1","0","2","3","NA","No","Partly","No","Partly","SecurityDescriptorSets.Tests.ps1:139 Get-NTFSAccess should return the entries that it returns for the path | Access.Tests.ps1:1098 Should read a security descriptor with audit entries and name the same folders | PermissionScopes.Tests.ps1:103 Should add and remove <Name> using <Form> on <Source>, preserving the other account","0","No test uses -Account, -ExcludeExplicit or -ExcludeInherited with a descriptor except the empty-result check of PermissionScopes:103, so an entry added to the descriptor in memory is never shown in the output; no test passes several descriptors or pipes more than one. The set has no per-item handler and no failing descriptor is tested.","TestNeeded","SecurityDescriptorSets.Tests.ps1:139-143 pipes one descriptor and compares Sid, rights and IsInherited of every entry with the -Path result (one item; the output cannot tell the SecurityDescriptor parameter from -Path bound by FullName); Access.Tests.ps1:1098-1103 (elevated only) compares count and InheritedFrom with the path result. BoundBy = scan 1 + SecurityDescriptorSets:139 (pipeline) + PermissionScopes:103 (splat, Source=SecurityDescriptor, asserts only an empty result).","Partly","ParameterSets.Access.Tests.ps1:331,336,338,345 Should filter an entry added to a descriptor in memory by -Account, partition it with -ExcludeInherited and -ExcludeExplicit, and read two descriptors bound through the pipeline","no failing descriptor is tested for this set (no per-item handler)","Limit (the SD loop has no try/catch; an exception would be unhandled and terminating, not a graceful per-item error - the same situation as the Clear-NTFSAccess SD row, which the notes explicitly excuse and this row's Gap text does not)"
"access","Get-NTFSOrphanedAccess","Path","False","4","4","0","6","NA","Partly","No","Partly","Partly","Access.Tests.ps1:218 Should return the entries whose account cannot be resolved | Access.Tests.ps1:222 Should return only the entries of -Account | PathErrors.Tests.ps1:145 <Command> should write a ReadSecurityError for it and continue with the next path | PipelineControl.Tests.ps1:148 <Name> should stop after the first object for Select-Object -First 1 and change nothing else","4: SMB share - entry of a deleted domain account with its SID, inherited entry and -ExcludeInherited, foreign-domain accounts not reported (Live:504, 515, 516, 868)","-ExcludeExplicit and -ExcludeInherited are untested in unit tests (lab only), and PathErrors runs this cmdlet with Output=false, so no test shows that the next path is processed after an error; no pipeline input and no category for ReadFileError or ReadSecurityError. A read failure other than access denied is written as a warning, which no test reaches.","TestNeeded","Access.Tests.ps1:218-225 asserts 2 orphaned entries and, for -Account, 1 entry with its Sid; PathErrors.Tests.ps1:108-115 and :145-152 assert one error with ErrorId and target but cannot show continuation because Output is false for this cmdlet (:29, :56). BoundBy = scan 4 + PathErrors:108 and :145 (& $Command).","Partly","ParameterSets.Access.Tests.ps1:362,363,369,370 Should mark an orphaned entry explicit on its own folder and inherited on a child, partitioned by -ExcludeInherited and -ExcludeExplicit | ParameterSets.Access.Tests.ps1:379,393 Should write a ReadFileError for a missing path, still return the orphaned entry of the next path, and accept both bound through the pipeline","the category of ReadSecurityError after a failed ownership retry; a read failure other than access denied, which is written as a warning, not an error","budget (ReadSecurityError here has one consistent category, ReadError, unlike Get-NTFSAccess, so it was safely assertable but not attempted); would-pin (the warning-not-error choice; the notes explicitly decline to propose pinning it)"
"access","Get-NTFSOrphanedAccess","SD","False","1","0","0","1","NA","No","No","No","Partly","Access.Tests.ps1:231 Should read the entries of a security descriptor","0","Only the count (2) and FullName are asserted; -Account, -ExcludeExplicit and -ExcludeInherited with a descriptor, the orphaned Sids, several or piped descriptors, and a descriptor changed in memory are untested.","TestNeeded","BoundBy = 1 (unambiguous; the cmdlet has no ambiguous rows): Access.Tests.ps1:231-234 asserts 2 entries, each with FullName equal to the file. Nothing else binds the set.","Partly","ParameterSets.Access.Tests.ps1:408,409,410,420 Should filter a descriptor's orphaned entries by -Account, report both orphaned Sids by default, exclude them all with -ExcludeExplicit, and read two descriptors bound through the pipeline","-ExcludeInherited with a descriptor; a descriptor changed only in memory (not written to disk) still reporting its orphaned entries","budget (both; the same fixture already built in this test could have been extended)"
"access","Get-NTFSSimpleAccess","Path","False","20","1","2","21","NA","Partly","Yes","Yes","Yes","Access.Tests.ps1:353 Should report all entries of the first folder and of the following folder only what the parent does not cover | Access.Tests.ps1:362 Should compare the folders from the pipeline in the same way | Access.Tests.ps1:485 Should write an error for a path that does not exist and continue with the next path | Access.Tests.ps1:267 Should show the entries as a table with the account, the rights, and the type","1: SMB share - parent folder first and for the subfolder only its own entry, as the delegated account (Live:832)","The ReadError of a missing path is asserted by ErrorId only (no category or target), and no test makes a folder unreadable: unlike Get-NTFSAccess the cmdlet does not retry as the owner, so what an unreadable folder reports is unpinned.","TestNeeded","Access.Tests.ps1:353-358 and :362-364 assert all 4 entries of the parent and only the child's own entry, for -Path and for Get-Item2 objects piped in; :485-490 asserts one ReadError and that every output object belongs to the next path; :267-269 asserts the table view; :251-254 and the rights-reduction cases assert Identity.Sid and AccessRights. BoundBy = scan 20 + Access:362 (pipeline, resolves to Path).","Partly","ParameterSets.Access.Tests.ps1:448 Should report an unreadable folder's error by category and target and still report the next folder's entries","the ReadError of a missing path (as opposed to an unreadable one) is still asserted by ErrorId only, without category or target","budget (Access.Tests.ps1:485 cannot be edited under a one-new-file brief, and no equivalent new test for the missing-path precondition specifically was added)"
"access","Get-NTFSSimpleAccess","SD","False","1","0","2","2","NA","No","Partly","No","Partly","Access.Tests.ps1:476 Should report the security descriptor of a file | Access.Tests.ps1:260 Should read the entries of a security descriptor","0","Only non-empty output and FullName are asserted; -Account, -ExcludeExplicit, -ExcludeInherited, the reduced rights and several descriptors are untested for the descriptor set, and no failing descriptor is tested.","TestNeeded","Access.Tests.ps1:260-263 reads one descriptor; :476-479 pipes one descriptor of a file: the -Path set skips files (Access:468-473), so a non-empty result can only come from the SD set; both assert FullName only. BoundBy = scan 1 + Access:476 (pipeline, resolves to SD).","Partly","ParameterSets.Access.Tests.ps1:469,470,474,476,477,482 Should filter and partition a descriptor's entries like the equivalent -Path call, and read two descriptors bound through the pipeline","no failing descriptor is tested for this set (no per-item handler)","Limit (same no-per-item-handler situation as the Clear-NTFSAccess SD and Get-NTFSAccess SD rows)"
"access","Get-NTFSEffectiveAccess","Path","True","11","7","1","15","NA","Yes","No","Partly","Partly","Access.Tests.ps1:1140 Should report the native identity error for each <Source> and return no access entry | Access.Tests.ps1:86 Should leave out an account without access when -ExcludeNoneAccessEntries is used | Access.Tests.ps1:145 Should return the result of this computer and warn | PathErrors.Tests.ps1:108 <Command> should write a <ErrorId> for it and continue with the next path","7: SMB share, domain and delegated accounts - rights through domain groups and file-server groups with -ServerName, fallback warning, GetEffectiveAccessError for access denied (Live:419, 428, 438, 456, 478, 486, 895)","No unit test asserts the content of the rights (for example an allow and a deny entry on a file with a protected DACL: ReadData present, WriteData absent), pipes objects in, or shows in one call that a failing path emits nothing while the next path emits only its own result. The ReadEffectivePermissionError handlers cannot be reached because the library hides its failures, and remote and group-based results need the lab.","TestNeeded","Access.Tests.ps1:1140-1153 asserts for two failing paths ErrorId GetEffectiveAccessError, category ReadError, TargetObject, Win32Exception 1332, no output and unchanged SDDL; PathErrors.Tests.ps1:108-115 asserts ReadFileError and output for the next path; Access.Tests.ps1:86-95 asserts the ExcludeNone filter and :145-157 the warning text and equal rights. BoundBy = scan 11 + Access:1140 (splat, Source=Path) + PathErrors:108/:145 + Owner.Tests.ps1:98 (& $cmdlet, no throw only).","Partly","ParameterSets.Access.Tests.ps1:498 Should report an allowed right as present and a denied right as absent for a protected DACL | ParameterSets.Access.Tests.ps1:508 Should return one result per item bound through the pipeline, in order","one call combining a failing path (for example a missing one) with a succeeding one, showing the failing path emits nothing and the next emits only its own result; the ReadEffectivePermissionError handler; remote and group-based results","budget (the failing+succeeding combination); Limit (ReadEffectivePermissionError is unreachable - the library records failures instead of throwing); Limit (remote/group-based results need the lab)"
"access","Get-NTFSEffectiveAccess","SecurityDescriptor","False","2","0","1","3","NA","Yes","No","Partly","Partly","Access.Tests.ps1:1140 Should report the native identity error for each <Source> and return no access entry | Access.Tests.ps1:132 Should name the cause in the error, not the Security privilege | Access.Tests.ps1:107 Should compute the effective access of a security descriptor","0","No test shows that the result follows an entry added to the descriptor in memory (and not the file on disk), pipes descriptors in, or passes a mix of failing and succeeding descriptors; the rights themselves are not asserted.","TestNeeded","Access.Tests.ps1:1140-1153 (Source=SecurityDescriptor, 2 descriptors) asserts the same error triple, Win32Exception 1332 and no output; :132-137 asserts one GetEffectiveAccessError that does not blame the privilege; :107-111 asserts one result with the FullName of the file. BoundBy = scan 2 + Access:1140 (splat, Source=SecurityDescriptor).","Partly","ParameterSets.Access.Tests.ps1:524,530,539 Should follow a descriptor changed only in memory while the -Path result stays on disk, and read two descriptors bound through the pipeline","a mix of a failing and a succeeding descriptor in one call","Limit (the per-item catch exists but is unreachable in a unit sandbox; the library records the Authz failure instead of throwing, per the notes)"
"audit","Add-NTFSAudit","PathComplex","True","27","4","1","30","Yes","Yes","No","Yes","Yes","Audit.Tests.ps1:147 Should write an AddAceError for each item, change nothing, and return nothing with -PassThru | Audit.Tests.ps1:629 <Command> should use a held privilege or report a missing one and continue to the next path | Audit.Tests.ps1:178 Should add the audit entry and keep the owner | PermissionScopes.Tests.ps1:146 Should add and remove <Name> using <Form> on <Source>, preserving the other account","4 (NTFSSecurity.Live.Tests.ps1:348, 385, 1010, 1016): SMB share with domain accounts; owner kept; the delegated account gets an AddAceError that names the missing privilege and leaves the SDDL unchanged; the file server counts the SACL entries (:1441)","No test pipes paths or objects into -Path, binds Account/AccessRights/AuditFlags by property name, or adds for several accounts. No test asserts the result of a succeeding path that follows a failing one (PathErrors.Tests.ps1:124 only counts errors), and the owner retry after access denied cannot run on a local volume (Limit).","TestNeeded","Audit.Tests.ps1:149-158 asserts AddAceError, WriteError, target, ArgumentException, no -PassThru output and an unchanged SACL (Get-Acl -Audit) for two failing paths; :631-669 and :672-679 assert ReadFileError/OpenError/target, the FullName of the output, the SACL rule, and unchanged DACL/owner SDDL. BoundBy 30 = scan 27 + PermissionScopes:146 (13 of 52 cases) + 2 calls through & $Command that the scan cannot see (Audit.Tests.ps1:629, PathErrors.Tests.ps1:124); 23 of the 27 scanned calls are fixtures.","Partly","ParameterSets.Audit.Tests.ps1:123 Should add the audit entry for the piped <Set> object that exists, write a ReadFileError for the one that does not, and leave the DACL unchanged","AuditFlags not bound by property name; adding for several accounts in one call; the owner retry after access denied","budget; budget; Limit (needs a lab or a remote server)"
"audit","Add-NTFSAudit","PathSimple","False","5","0","2","7","Partly","No","No","No","Yes","PermissionScopes.Tests.ps1:146 Should add and remove <Name> using <Form> on <Source>, preserving the other account | Inheritance.Tests.ps1:386 Should set enabled=<Enable> on a <Type>, remove requested audit entries=<Remove>, and leave the DACL unchanged | Inheritance.Tests.ps1:424 Set-NTFSInheritance should re-enable audit inheritance on a <_> and keep its explicit audit entry","0","No call of this set fails on purpose, passes several paths, or pipes objects, and a conflict of -AppliesTo with -InheritanceFlags is not tested. The added entry is read back only from -PassThru and Get-NTFSAudit, and owner and DACL after the call are not asserted for this set.","TestNeeded","The only call under test is PermissionScopes.Tests.ps1:146 (Source=Path with the -AppliesTo form, 13 of 52 cases): :149-154 assert type, Inheritance/Propagation/AuditFlags and the scope name, and :161-163 that the other account remains. The other calls (PermissionScopes:144, Audit.Tests.ps1:618 and :690, Inheritance.Tests.ps1:386, :424, :503) are fixtures; BoundBy 7 = scan 5 + :144 and :146 resolved from the splat.","Closed","ParameterSets.Audit.Tests.ps1:123 Should add the audit entry for the piped <Set> object that exists, write a ReadFileError for the one that does not, and leave the DACL unchanged | ParameterSets.Audit.Tests.ps1:193 Should reject -AppliesTo combined with -InheritanceFlags with an AmbiguousParameterSet error and change nothing","",""
"audit","Add-NTFSAudit","SDSimple","False","0","0","2","2","Partly","No","No","No","Yes","PermissionScopes.Tests.ps1:146 Should add and remove <Name> using <Form> on <Source>, preserving the other account | Audit.Tests.ps1:89 Should take -Account at position 2 and -AccessRights at position 3 in the <_> parameter set","0","No test makes this set fail, passes or pipes several descriptors, or reads the changed descriptor with .NET; a descriptor without audit entries is tested only with the complex form. Exceptions of the change itself end the cmdlet (open item 1) and are not to be pinned.","TestNeeded","Only PermissionScopes.Tests.ps1:146 binds it (Source=SecurityDescriptor with -AppliesTo, 13 of 52 cases; the fixture at :144 in 26): :149-154 assert the -PassThru type and flags and :156 that the SACL of the item is unchanged (Get-Acl -Audit). Audit.Tests.ps1:89 checks the positions by reflection only; BoundBy 2 resolves the two splat calls, the scan found 0.","Partly","ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:154 Should add the audit entry for the piped <Set> object that has an audit section, write a ReadSecurityError for the one that does not, and leave the item on disk unchanged until Set-NTFSSecurityDescriptor writes it | ParameterSets.Audit.Tests.ps1:208 Should add the entry to the descriptor when -SecurityDescriptor, -Account, -AccessRights, and -AppliesTo are all named directly","exceptions from the change itself (open item 1)","MaintainerDecision (open item)"
"audit","Add-NTFSAudit","SDComplex","False","5","0","1","8","Yes","Partly","No","No","Yes","Audit.Tests.ps1:107 Should bind an account and access rights that are passed by position | Audit.Tests.ps1:120 Should return the audit entries of a security descriptor, not its access entries | SecurityDescriptor.Tests.ps1:120 Should write an added audit entry and keep the owner | Audit.Tests.ps1:425 <Command> should write an error and leave the descriptor without audit entries","0","Only the ErrorId is asserted for a descriptor without audit entries, not its category (InvalidData) or target, and no test pipes descriptors or passes several (one without audit entries), so pipeline binding and continuation are untested. Exceptions of the change itself are open item 1 and are not to be pinned.","TestNeeded","Audit.Tests.ps1:109-110 reads the in-memory SACL with .NET and :122-136 assert type, Sid, InheritanceEnabled and the unchanged access protection; SecurityDescriptor.Tests.ps1:124-126 asserts after Set-NTFSSecurityDescriptor that the owner is kept and the entry exists; PermissionScopes.Tests.ps1:156 asserts the item is untouched until written. BoundBy 8 = scan 5 + PermissionScopes:146 (13 of 52 cases) + & $Command at Audit.Tests.ps1:425 and Access.Tests.ps1:881 (Should -Not -Throw only).","Partly","ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:154 Should add the audit entry for the piped <Set> object that has an audit section, write a ReadSecurityError for the one that does not, and leave the item on disk unchanged until Set-NTFSSecurityDescriptor writes it","exceptions from the change itself (open item 1)","MaintainerDecision (open item)"
"audit","Remove-NTFSAudit","PathComplex","True","7","2","1","10","Yes","Yes","No","Yes","Yes","Audit.Tests.ps1:629 <Command> should use a held privilege or report a missing one and continue to the next path | Audit.Tests.ps1:361 Should keep an audit entry that does not match exactly, given the path | Audit.Tests.ps1:371 Should remove an audit entry that matches exactly, given the path | Audit.Tests.ps1:384 Should return the audit entries of the item, not its access entries","2 (NTFSSecurity.Live.Tests.ps1:357, 398): SMB share with domain accounts; owner kept; the delegated account gets a RemoveAceError that names the missing privilege and leaves the SDDL unchanged; the file server counts the SACL entries (:1441)","No test pipes paths or objects in, removes for several accounts, asserts the result of a succeeding path after a failing one, or removes only some rights (without -RemoveSpecific). An item without SACL is tested for no error only (Audit.Tests.ps1:406), and the owner retry cannot run on a local volume (Limit).","TestNeeded","Audit.Tests.ps1:631-669 and :672-679 assert ReadFileError/OpenError/target (RemoveAceError/WriteError/target as a basic user), the SACL changed with no rule left, and unchanged DACL/owner SDDL; :363-365 and :373-374 read back through Get-NTFSAudit. BoundBy 10 = scan 7 + PermissionScopes:159 (13 of 52 cases) + & $Command at Audit.Tests.ps1:629 and PathErrors.Tests.ps1:124; :386-388 assert type and the other entry but pass even if nothing was removed.","Partly","ParameterSets.Audit.Tests.ps1:225 Should remove the audit entry for the piped <Set> object that exists, write a ReadFileError for the one that does not, and keep the other account's entry | ParameterSets.Audit.Tests.ps1:286 Should narrow an entry that grants more rights than it removes, instead of deleting it","removing for several accounts in one call; state (empty Audit SDDL, unchanged DACL) of an item without a SACL; the owner retry after access denied","budget; budget; Limit (needs a lab or a remote server)"
"audit","Remove-NTFSAudit","PathSimple","False","0","0","1","1","Partly","No","No","No","Partly","PermissionScopes.Tests.ps1:159 Should add and remove <Name> using <Form> on <Source>, preserving the other account","0","Only one data-driven call binds it: no failing item, pipeline input, several items, or owner and DACL check after the call, the objects are checked by Sid only, and it never runs without -RemoveSpecific.","TestNeeded","PermissionScopes.Tests.ps1:159 binds it only when Source=Path and Form=Flags (13 of 52 cases, always with -RemoveSpecific): :161-163 assert that the entry of the account is gone from -PassThru, that the other account remains, and that Get-NTFSAudit returns nothing for the account. BoundBy 1: the scan found 0 and this ambiguous splat call is the only one that binds the set.","Closed","ParameterSets.Audit.Tests.ps1:225 Should remove the audit entry for the piped <Set> object that exists, write a ReadFileError for the one that does not, and keep the other account's entry | ParameterSets.Audit.Tests.ps1:304 Should remove the entry from the path when -Path, -Account, -AccessRights, and -AppliesTo are all named directly","",""
"audit","Remove-NTFSAudit","SDSimple","False","0","0","1","1","Partly","No","No","No","Partly","PermissionScopes.Tests.ps1:159 Should add and remove <Name> using <Form> on <Source>, preserving the other account","0","Only one data-driven call binds it: the changed descriptor is read only through -PassThru and Get-NTFSAudit, the item being untouched after the removal is not asserted, and no test makes it fail, pipes or passes several descriptors, or runs without -RemoveSpecific.","TestNeeded","PermissionScopes.Tests.ps1:159 binds it only when Source=SecurityDescriptor and Form=Flags (13 of 52 cases, always with -RemoveSpecific): :161-163 assert that the entry of the account is gone, that the other account remains, and that Get-NTFSAudit returns nothing; the SACL on disk is compared only after the Add (:156). BoundBy 1: the scan found 0 and this ambiguous splat call is the only one that binds the set.","Partly","ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:256 Should remove the audit entry for the piped <Set> object that has an audit section, write a ReadSecurityError for the one that does not, and keep the other account's entry | ParameterSets.Audit.Tests.ps1:321 Should remove the entry from the descriptor when -SecurityDescriptor, -Account, -AccessRights, and -AppliesTo are all named directly","the item on disk being untouched after the removal, until Set-NTFSSecurityDescriptor writes it","budget"
"audit","Remove-NTFSAudit","SDComplex","False","2","0","1","5","Partly","Partly","No","No","Partly","Audit.Tests.ps1:347 Should keep an audit entry that does not match exactly | Audit.Tests.ps1:353 Should remove an audit entry that matches exactly | Audit.Tests.ps1:425 <Command> should write an error and leave the descriptor without audit entries | PermissionScopes.Tests.ps1:159 Should add and remove <Name> using <Form> on <Source>, preserving the other account","0","The item being untouched after the removal and the result after Set-NTFSSecurityDescriptor are not asserted, the error test lacks category and target, and no test pipes or passes several descriptors, checks the -PassThru type, or asserts a removal without -RemoveSpecific. Exceptions of the change itself are open item 1 and are not to be pinned.","TestNeeded","Audit.Tests.ps1:349 and :355 read the in-memory SACL with .NET (non-matching entry kept, matching entry removed) and :427-432 assert one ReadSecurityError, no output and the SACL still empty; PermissionScopes.Tests.ps1:161-163 assert by Sid only. BoundBy 5 = scan 2 + PermissionScopes:159 (13 of 52 cases) + & $Command at Audit.Tests.ps1:425 and Access.Tests.ps1:881 (Should -Not -Throw only).","Partly","ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:256 Should remove the audit entry for the piped <Set> object that has an audit section, write a ReadSecurityError for the one that does not, and keep the other account's entry","the item on disk untouched after the removal and the result after Set-NTFSSecurityDescriptor; the -PassThru output type; exceptions from the change itself (open item 1)","budget; budget; MaintainerDecision (open item)"
"audit","Clear-NTFSAudit","Path","True","3","1","0","5","Yes","Yes","No","Yes","NA","Audit.Tests.ps1:629 <Command> should use a held privilege or report a missing one and continue to the next path | Audit.Tests.ps1:455 Should remove the audit entries and keep the owner | Audit.Tests.ps1:478 Should write no error and leave the access entries unchanged | Audit.Tests.ps1:495 Should write an error and leave the item unchanged","2 (NTFSSecurity.Live.Tests.ps1:652, plus :684 through & $Command that the scan cannot see): SMB share; explicit entry cleared with the inherited entry and the owner kept; the delegated account gets a ClearAclError that names the missing privilege and leaves the SDDL unchanged; the file server checks the SACL (:1453)","-DisableInheritance on a path is passed (Audit.Tests.ps1:629) but its end state (protected SACL, no copied inherited entries) is never asserted, and no test pipes paths or asserts the result of a succeeding path after a failing one. The owner retry after access denied cannot run on a local volume (Limit).","TestNeeded","Audit.Tests.ps1:457-459 asserts no error, owner kept (.NET) and no entry left (Get-NTFSAudit); :480-483 and :497-499 assert an unchanged DACL and, without the privilege, a ClearAclError with an unchanged SDDL; :631-669 and :672-679 add category and target. BoundBy 5 = scan 3 + & $Command at Audit.Tests.ps1:629 and PathErrors.Tests.ps1:124.","Partly","ParameterSets.Audit.Tests.ps1:339 Should clear the audit entries of each path taken from the pipeline and leave the DACL of each unchanged | ParameterSets.Audit.Tests.ps1:360 Should protect the SACL and not copy the parent's inherited entry when clearing a child path","the result of a succeeding path that follows a failing one; the owner retry after access denied","budget; Limit (needs a lab or a remote server)"
"audit","Clear-NTFSAudit","SD","False","2","0","0","3","Yes","Partly","No","No","NA","Audit.Tests.ps1:696 Should clear and protect the descriptor SACL without writing the <Type> | SecurityDescriptorSets.Tests.ps1:107 Clear-NTFSAudit should remove the explicit audit entries of the descriptor | Audit.Tests.ps1:425 <Command> should write an error and leave the descriptor without audit entries","0","No test pipes descriptors or passes several (one without audit entries), and the error test asserts the ErrorId but not category or target.","TestNeeded","Audit.Tests.ps1:698-705 asserts the in-memory SACL cleared and protected (.NET), the SACL of the item untouched until Set-NTFSSecurityDescriptor, then the state on disk and an unchanged DACL; SecurityDescriptorSets.Tests.ps1:109-112 asserts the same for the unprotected form. BoundBy 3 = scan 2 + & $Command at Audit.Tests.ps1:425 (error case only).","Closed","ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:381 Should clear each piped descriptor that has an audit section and continue past one that does not","",""
"audit","Get-NTFSAudit","Path","False","24","4","2","27","NA","Partly","No","Partly","Partly","Audit.Tests.ps1:529 Should name the folder that an inherited entry comes from, also with -ExcludeExplicit | Audit.Tests.ps1:48 Should write an error without the Security privilege instead of returning nothing | PathErrors.Tests.ps1:124 <Command> should write a ReadFileError for it and continue with the next path | Inheritance.Tests.ps1:387 Should set enabled=<Enable> on a <Type>, remove requested audit entries=<Remove>, and leave the DACL unchanged","4 (NTFSSecurity.Live.Tests.ps1:336, 373, 656, 657): SMB share with domain accounts; Sid, AuditFlags and rights of the entry; the delegated account gets a ReadSecurityError that names the missing privilege","No test pipes paths or FileInfo/DirectoryInfo into it, asserts the category of its errors or the target of ReadSecurityError, or (in unit tests) the type, AuditFlags and inheritance flags of the output. No unit test has a failing path followed by a path whose entries are asserted (Audit.Tests.ps1:70-73 documents that the second path of the test at :80 no longer fails), and the PermissionDenied branch cannot run on a local volume (Limit).","TestNeeded","Audit.Tests.ps1:50-52 asserts one ReadSecurityError by ErrorId only (basic user); :531-534 and :577-578 assert IsInherited and InheritedFrom; PathErrors.Tests.ps1:130-132 asserts ReadFileError and target for a missing path but discards the output (:124). BoundBy 27 = scan 24 + PermissionScopes:163 (26 of 52 cases) + & $Command at PathErrors.Tests.ps1:124 and Owner.Tests.ps1:98 (no -Path, Should -Not -Throw).","Partly","ParameterSets.Audit.Tests.ps1:410 Should return the entries of the existing path in either position and a ReadFileError, category OpenError, for the missing one | ParameterSets.Audit.Tests.ps1:439 Should return the entries of each path object taken from the pipeline by value | ParameterSets.Audit.Tests.ps1:454 Should write a ReadSecurityError with category OpenError and the path as target without the Security privilege","the PermissionDenied category branch of ReadSecurityError","Limit (needs a lab or a remote server)"
"audit","Get-NTFSAudit","SD","False","1","0","2","3","NA","Partly","Partly","No","Partly","Audit.Tests.ps1:61 Should write an error for a security descriptor that was read without the audit entries | SecurityDescriptorSets.Tests.ps1:160 Get-NTFSAudit should return the audit entries that it returns for the path | PermissionScopes.Tests.ps1:163 Should add and remove <Name> using <Form> on <Source>, preserving the other account","0","The output is compared only with the output of the Path set (no expected type, flags or values), at most one descriptor is piped, and no test passes several descriptors (one without audit entries). The error test lacks category and target.","TestNeeded","Audit.Tests.ps1:63-65 asserts no output and one ReadSecurityError; SecurityDescriptorSets.Tests.ps1:160-163 pipes one descriptor and asserts one entry equal to the Path result (Sid, AccessRights, AuditFlags); PermissionScopes.Tests.ps1:163 asserts only emptiness after a removal. BoundBy 3 = scan 1 + SecurityDescriptorSets:160 (piped by value, so SD) + PermissionScopes:163 (26 of 52 cases).","Partly","ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:468 Should return the entries of the piped descriptor that has an audit section and continue past one that does not","an expected type, flags, or values for the output, independent of comparing it to the Path set's output","budget"
"audit","Get-NTFSOrphanedAudit","Path","False","9","1","2","9","NA","Partly","No","Yes","Yes","Audit.Tests.ps1:228 Should return one object per entry whose account cannot be resolved | Audit.Tests.ps1:250 Should return an inherited entry, and nothing with -ExcludeInherited | Audit.Tests.ps1:279 Should write an error for a path that does not exist and continue with the next path without the Security privilege | Audit.Tests.ps1:304 Should write a ReadSecurityError without the Security privilege instead of returning nothing","1 (NTFSSecurity.Live.Tests.ps1:843): SMB share; the entry of a deleted domain account is returned with its SID, without error or warning","No test pipes paths into it, asserts the category of ReadError or ReadSecurityError, or runs -ExcludeExplicit, and the elevated continuation test passes on an empty result (Audit.Tests.ps1:273).","TestNeeded","Audit.Tests.ps1:230-232, :238-239 and :253-256 assert count, type, Sid and IsInherited; :282-286 (basic user) asserts ReadError for the missing path and a ReadSecurityError with its own target for the next path, which shows that the cmdlet continued, while :270-273 (elevated) asserts one error and then only a ForEach over the result. BoundBy 9 = scan 9.","Partly","ParameterSets.Audit.Tests.ps1:490 Should return the orphaned entries of each path taken from the pipeline and write a ReadError, category OpenError, for one that does not exist","the category of ReadSecurityError without the Security privilege; -ExcludeExplicit","budget; budget"
"audit","Get-NTFSOrphanedAudit","SD","False","0","0","2","2","NA","Partly","Partly","No","Partly","Audit.Tests.ps1:243 Should read the entries of a security descriptor | Audit.Tests.ps1:294 Should write an error for a security descriptor that was read without the audit entries","0","At most one descriptor is piped and none is passed in an array, so continuation is untested; -Account and -Exclude* with a descriptor, the entry type and Sid, and the category and target of the error are not asserted.","TestNeeded","Both calls pipe one descriptor, which PowerShell binds by value to -SecurityDescriptor (the elevated run of :296-298 proves it: a Path binding would return entries): :245-246 assert 2 entries with FullName and :296-298 assert no output and one ReadSecurityError. BoundBy 2 = the two ambiguous piped calls (Audit.Tests.ps1:243 and :294); the scan found 0.","Partly","ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:511 Should return the orphaned entries of the piped descriptor that has an audit section and continue past one that does not | ParameterSets.Audit.Tests.ps1:533 Should return the orphaned entries when -SecurityDescriptor is named directly","-Account and -ExcludeInherited/-ExcludeExplicit filters with a descriptor","budget"
"access","Clear-NTFSAccess","Path","True","6","2","0","8","Partly","Partly","No","Yes","NA","PathErrors.Tests.ps1:178 <Command> should keep the denied item unchanged, report <ErrorId>, and process the next item | Access.Tests.ps1:932 Should leave the item with an empty, protected DACL | PathErrors.Tests.ps1:271 Clear-NTFSAccess -DisableInheritance should take ownership, clear and protect the DACL, and not set an unchanged owner back | PathErrors.Tests.ps1:289 Clear-NTFSAccess -DisableInheritance should report RestoreOwnerError for a previous owner that it cannot set back","2: SMB share - clear keeps the owner (#34, Live:274); -DisableInheritance as the owner takes ownership without a RestoreOwnerError (Live:957)","No test asserts that a plain Clear leaves the inherited entries and the inheritance flag untouched, or clears a folder (all unit tests use files). ClearAclError and ReadFileError are asserted by ErrorId and target without category, and nothing is piped in.","TestNeeded","PathErrors.Tests.ps1:178-192 asserts one ClearAclError for the blocked path, its SDDL unchanged and no explicit entry on the next item; Access.Tests.ps1:932-936 and PathErrors.Tests.ps1:271-277 assert a protected, empty DACL and the unchanged owner with .NET; PathErrors.Tests.ps1:289-294 asserts RestoreOwnerError with category WriteError and target (elevated only). BoundBy = scan 6 + PathErrors:108 and :178 (& $Command); 7 of the 8 calls are the subject of an assertion.","Closed","ParameterSets.Access.Tests.ps1:409 Should clear each piped folder's explicit entries, including an inherit-only one, and leave inherited entries and the owner untouched | ParameterSets.Access.Tests.ps1:434,445 Should report a missing path's ReadFileError and a blocked path's ClearAclError, each by category and target","",""
"access","Clear-NTFSAccess","SD","False","3","1","0","3","Partly","No","No","No","NA","SecurityDescriptorSets.Tests.ps1:60 Clear-NTFSAccess -DisableInheritance should leave the descriptor with an empty, protected DACL | SecurityDescriptorSets.Tests.ps1:45 Clear-NTFSAccess should remove the explicit access entries of the descriptor | SecurityDescriptor.Tests.ps1:236 Should not report an owner that did not change when the write that took ownership leaves an empty DACL","1: SMB share - cleared descriptor written with Set-NTFSSecurityDescriptor without a RestoreOwnerError (Live:966)","No test checks that a plain Clear of a descriptor keeps its inherited entries and inheritance flag, pipes descriptors in, or passes several. The set has no per-item handler and no test makes it fail; it is not among the open items, so no test is proposed for that.","TestNeeded","SecurityDescriptorSets.Tests.ps1:45-50 asserts 0 explicit entries in the descriptor, 1 still on disk, then 0 after Set-NTFSSecurityDescriptor; :60-68 asserts a protected, empty DACL in memory, the DACL on disk unchanged and the written result; SecurityDescriptor.Tests.ps1:236-244 asserts that the owner stays after the write (the call there is a fixture of a Set-NTFSSecurityDescriptor test). BoundBy = 3 (no ambiguous calls).","Closed","ParameterSets.Access.Tests.ps1:468 Should clear each piped descriptor's explicit entries in memory, leave the items unchanged until Set-NTFSSecurityDescriptor, and keep the owner","",""
"access","Get-NTFSAccess","Path","True","25","3","2","29","NA","Partly","No","Yes","Partly","PathErrors.Tests.ps1:108 <Command> should write a <ErrorId> for it and continue with the next path | PathErrors.Tests.ps1:145 <Command> should write a ReadSecurityError for it and continue with the next path | Access.Tests.ps1:55 Should return the entries of the first item once | DriveRoot.Tests.ps1:34 Get-NTFSAccess should return the access entries of the root folder","3: SMB share - entries of a path longer than 260 characters, foreign-domain account entries, unknown-parent InheritedFrom (Live:543, 859, 1048)","No test pipes FileInfo/DirectoryInfo into the set (or passes a folder object by position, #88), asserts what it returns without -Path (Owner.Tests.ps1:98 only checks that nothing throws), or asserts the category of ReadFileError and ReadSecurityError (the latter is WriteError after a failed ownership retry, see notes). No test asserts the emitted type or the declared OutputType.","TestNeeded","PathErrors.Tests.ps1:108-115 and :145-152 assert one error with ErrorId and target and output for the next path; Access.Tests.ps1:55-59 asserts the first item's entries appear once after a failing path, but the path fails only without elevation; Access.Tests.ps1:1108-1118 asserts a NULL DACL gives one entry with Sid, IsInherited and InheritedFrom, and DriveRoot.Tests.ps1:34-36 that the SID list equals Get-Acl. BoundBy = scan 25 + PathErrors:108/:145 + Owner.Tests.ps1:98 (& $cmdlet, no throw only) + PermissionScopes:103 (splat, Source=Path).","Partly","ParameterSets.Access.Tests.ps1:500,502,512 Should return the same entries for a folder bound through the pipeline and by position, and report a missing path's error by category and target | ParameterSets.Access.Tests.ps1:745 <Name> should declare <Types> as its output type","what the cmdlet returns without -Path at all (beyond not throwing, Owner.Tests.ps1:98); the category of ReadSecurityError after a failed ownership retry; BeOfType on an actual emitted object (only the declared OutputType is asserted)","budget (the no -Path case); would-pin (ReadSecurityError is WriteError after a failed retry but OpenError from the generic catch - asserting a category here would cement that inconsistency, per the notes); budget (BeOfType on a live object)"
"access","Get-NTFSAccess","SD","False","1","0","2","3","NA","No","Partly","No","Partly","SecurityDescriptorSets.Tests.ps1:139 Get-NTFSAccess should return the entries that it returns for the path | Access.Tests.ps1:1098 Should read a security descriptor with audit entries and name the same folders | PermissionScopes.Tests.ps1:103 Should add and remove <Name> using <Form> on <Source>, preserving the other account","0","No test uses -Account, -ExcludeExplicit or -ExcludeInherited with a descriptor except the empty-result check of PermissionScopes:103, so an entry added to the descriptor in memory is never shown in the output; no test passes several descriptors or pipes more than one. The set has no per-item handler and no failing descriptor is tested.","TestNeeded","SecurityDescriptorSets.Tests.ps1:139-143 pipes one descriptor and compares Sid, rights and IsInherited of every entry with the -Path result (one item; the output cannot tell the SecurityDescriptor parameter from -Path bound by FullName); Access.Tests.ps1:1098-1103 (elevated only) compares count and InheritedFrom with the path result. BoundBy = scan 1 + SecurityDescriptorSets:139 (pipeline) + PermissionScopes:103 (splat, Source=SecurityDescriptor, asserts only an empty result).","Partly","ParameterSets.Access.Tests.ps1:528,533,535,542 Should filter an entry added to a descriptor in memory by -Account, partition it with -ExcludeInherited and -ExcludeExplicit, and read two descriptors bound through the pipeline","no failing descriptor is tested for this set (no per-item handler)","Limit (the SD loop has no try/catch; an exception would be unhandled and terminating, not a graceful per-item error - the same situation as the Clear-NTFSAccess SD row, which the notes explicitly excuse and this row's Gap text does not)"
"access","Get-NTFSOrphanedAccess","Path","False","4","4","0","6","NA","Partly","No","Partly","Partly","Access.Tests.ps1:218 Should return the entries whose account cannot be resolved | Access.Tests.ps1:222 Should return only the entries of -Account | PathErrors.Tests.ps1:145 <Command> should write a ReadSecurityError for it and continue with the next path | PipelineControl.Tests.ps1:148 <Name> should stop after the first object for Select-Object -First 1 and change nothing else","4: SMB share - entry of a deleted domain account with its SID, inherited entry and -ExcludeInherited, foreign-domain accounts not reported (Live:504, 515, 516, 868)","-ExcludeExplicit and -ExcludeInherited are untested in unit tests (lab only), and PathErrors runs this cmdlet with Output=false, so no test shows that the next path is processed after an error; no pipeline input and no category for ReadFileError or ReadSecurityError. A read failure other than access denied is written as a warning, which no test reaches.","TestNeeded","Access.Tests.ps1:218-225 asserts 2 orphaned entries and, for -Account, 1 entry with its Sid; PathErrors.Tests.ps1:108-115 and :145-152 assert one error with ErrorId and target but cannot show continuation because Output is false for this cmdlet (:29, :56). BoundBy = scan 4 + PathErrors:108 and :145 (& $Command).","Partly","ParameterSets.Access.Tests.ps1:559,560,566,567 Should mark an orphaned entry explicit on its own folder and inherited on a child, partitioned by -ExcludeInherited and -ExcludeExplicit | ParameterSets.Access.Tests.ps1:576,590 Should write a ReadFileError for a missing path, still return the orphaned entry of the next path, and accept both bound through the pipeline","the category of ReadSecurityError after a failed ownership retry; a read failure other than access denied, which is written as a warning, not an error","budget (ReadSecurityError here has one consistent category, ReadError, unlike Get-NTFSAccess, so it was safely assertable but not attempted); would-pin (the warning-not-error choice; the notes explicitly decline to propose pinning it)"
"access","Get-NTFSOrphanedAccess","SD","False","1","0","0","1","NA","No","No","No","Partly","Access.Tests.ps1:231 Should read the entries of a security descriptor","0","Only the count (2) and FullName are asserted; -Account, -ExcludeExplicit and -ExcludeInherited with a descriptor, the orphaned Sids, several or piped descriptors, and a descriptor changed in memory are untested.","TestNeeded","BoundBy = 1 (unambiguous; the cmdlet has no ambiguous rows): Access.Tests.ps1:231-234 asserts 2 entries, each with FullName equal to the file. Nothing else binds the set.","Partly","ParameterSets.Access.Tests.ps1:605,606,607,617 Should filter a descriptor's orphaned entries by -Account, report both orphaned Sids by default, exclude them all with -ExcludeExplicit, and read two descriptors bound through the pipeline","-ExcludeInherited with a descriptor; a descriptor changed only in memory (not written to disk) still reporting its orphaned entries","budget (both; the same fixture already built in this test could have been extended)"
"access","Get-NTFSSimpleAccess","Path","False","20","1","2","21","NA","Partly","Yes","Yes","Yes","Access.Tests.ps1:353 Should report all entries of the first folder and of the following folder only what the parent does not cover | Access.Tests.ps1:362 Should compare the folders from the pipeline in the same way | Access.Tests.ps1:485 Should write an error for a path that does not exist and continue with the next path | Access.Tests.ps1:267 Should show the entries as a table with the account, the rights, and the type","1: SMB share - parent folder first and for the subfolder only its own entry, as the delegated account (Live:832)","The ReadError of a missing path is asserted by ErrorId only (no category or target), and no test makes a folder unreadable: unlike Get-NTFSAccess the cmdlet does not retry as the owner, so what an unreadable folder reports is unpinned.","TestNeeded","Access.Tests.ps1:353-358 and :362-364 assert all 4 entries of the parent and only the child's own entry, for -Path and for Get-Item2 objects piped in; :485-490 asserts one ReadError and that every output object belongs to the next path; :267-269 asserts the table view; :251-254 and the rights-reduction cases assert Identity.Sid and AccessRights. BoundBy = scan 20 + Access:362 (pipeline, resolves to Path).","Partly","ParameterSets.Access.Tests.ps1:645 Should report an unreadable folder's error by category and target and still report the next folder's entries","the ReadError of a missing path (as opposed to an unreadable one) is still asserted by ErrorId only, without category or target","budget (Access.Tests.ps1:485 cannot be edited under a one-new-file brief, and no equivalent new test for the missing-path precondition specifically was added)"
"access","Get-NTFSSimpleAccess","SD","False","1","0","2","2","NA","No","Partly","No","Partly","Access.Tests.ps1:476 Should report the security descriptor of a file | Access.Tests.ps1:260 Should read the entries of a security descriptor","0","Only non-empty output and FullName are asserted; -Account, -ExcludeExplicit, -ExcludeInherited, the reduced rights and several descriptors are untested for the descriptor set, and no failing descriptor is tested.","TestNeeded","Access.Tests.ps1:260-263 reads one descriptor; :476-479 pipes one descriptor of a file: the -Path set skips files (Access:468-473), so a non-empty result can only come from the SD set; both assert FullName only. BoundBy = scan 1 + Access:476 (pipeline, resolves to SD).","Partly","ParameterSets.Access.Tests.ps1:666,667,671,673,674,679 Should filter and partition a descriptor's entries like the equivalent -Path call, and read two descriptors bound through the pipeline","no failing descriptor is tested for this set (no per-item handler)","Limit (same no-per-item-handler situation as the Clear-NTFSAccess SD and Get-NTFSAccess SD rows)"
"access","Get-NTFSEffectiveAccess","Path","True","11","7","1","15","NA","Yes","No","Partly","Partly","Access.Tests.ps1:1140 Should report the native identity error for each <Source> and return no access entry | Access.Tests.ps1:86 Should leave out an account without access when -ExcludeNoneAccessEntries is used | Access.Tests.ps1:145 Should return the result of this computer and warn | PathErrors.Tests.ps1:108 <Command> should write a <ErrorId> for it and continue with the next path","7: SMB share, domain and delegated accounts - rights through domain groups and file-server groups with -ServerName, fallback warning, GetEffectiveAccessError for access denied (Live:419, 428, 438, 456, 478, 486, 895)","No unit test asserts the content of the rights (for example an allow and a deny entry on a file with a protected DACL: ReadData present, WriteData absent), pipes objects in, or shows in one call that a failing path emits nothing while the next path emits only its own result. The ReadEffectivePermissionError handlers cannot be reached because the library hides its failures, and remote and group-based results need the lab.","TestNeeded","Access.Tests.ps1:1140-1153 asserts for two failing paths ErrorId GetEffectiveAccessError, category ReadError, TargetObject, Win32Exception 1332, no output and unchanged SDDL; PathErrors.Tests.ps1:108-115 asserts ReadFileError and output for the next path; Access.Tests.ps1:86-95 asserts the ExcludeNone filter and :145-157 the warning text and equal rights. BoundBy = scan 11 + Access:1140 (splat, Source=Path) + PathErrors:108/:145 + Owner.Tests.ps1:98 (& $cmdlet, no throw only).","Partly","ParameterSets.Access.Tests.ps1:695 Should report an allowed right as present and a denied right as absent for a protected DACL | ParameterSets.Access.Tests.ps1:705 Should return one result per item bound through the pipeline, in order","one call combining a failing path (for example a missing one) with a succeeding one, showing the failing path emits nothing and the next emits only its own result; the ReadEffectivePermissionError handler; remote and group-based results","budget (the failing+succeeding combination); Limit (ReadEffectivePermissionError is unreachable - the library records failures instead of throwing); Limit (remote/group-based results need the lab)"
"access","Get-NTFSEffectiveAccess","SecurityDescriptor","False","2","0","1","3","NA","Yes","No","Partly","Partly","Access.Tests.ps1:1140 Should report the native identity error for each <Source> and return no access entry | Access.Tests.ps1:132 Should name the cause in the error, not the Security privilege | Access.Tests.ps1:107 Should compute the effective access of a security descriptor","0","No test shows that the result follows an entry added to the descriptor in memory (and not the file on disk), pipes descriptors in, or passes a mix of failing and succeeding descriptors; the rights themselves are not asserted.","TestNeeded","Access.Tests.ps1:1140-1153 (Source=SecurityDescriptor, 2 descriptors) asserts the same error triple, Win32Exception 1332 and no output; :132-137 asserts one GetEffectiveAccessError that does not blame the privilege; :107-111 asserts one result with the FullName of the file. BoundBy = scan 2 + Access:1140 (splat, Source=SecurityDescriptor).","Partly","ParameterSets.Access.Tests.ps1:721,727,736 Should follow a descriptor changed only in memory while the -Path result stays on disk, and read two descriptors bound through the pipeline","a mix of a failing and a succeeding descriptor in one call","Limit (the per-item catch exists but is unreachable in a unit sandbox; the library records the Authz failure instead of throwing, per the notes)"
"audit","Add-NTFSAudit","PathComplex","True","27","4","1","30","Yes","Yes","No","Yes","Yes","Audit.Tests.ps1:147 Should write an AddAceError for each item, change nothing, and return nothing with -PassThru | Audit.Tests.ps1:629 <Command> should use a held privilege or report a missing one and continue to the next path | Audit.Tests.ps1:178 Should add the audit entry and keep the owner | PermissionScopes.Tests.ps1:146 Should add and remove <Name> using <Form> on <Source>, preserving the other account","4 (NTFSSecurity.Live.Tests.ps1:348, 385, 1010, 1016): SMB share with domain accounts; owner kept; the delegated account gets an AddAceError that names the missing privilege and leaves the SDDL unchanged; the file server counts the SACL entries (:1441)","No test pipes paths or objects into -Path, binds Account/AccessRights/AuditFlags by property name, or adds for several accounts. No test asserts the result of a succeeding path that follows a failing one (PathErrors.Tests.ps1:124 only counts errors), and the owner retry after access denied cannot run on a local volume (Limit).","TestNeeded","Audit.Tests.ps1:149-158 asserts AddAceError, WriteError, target, ArgumentException, no -PassThru output and an unchanged SACL (Get-Acl -Audit) for two failing paths; :631-669 and :672-679 assert ReadFileError/OpenError/target, the FullName of the output, the SACL rule, and unchanged DACL/owner SDDL. BoundBy 30 = scan 27 + PermissionScopes:146 (13 of 52 cases) + 2 calls through & $Command that the scan cannot see (Audit.Tests.ps1:629, PathErrors.Tests.ps1:124); 23 of the 27 scanned calls are fixtures.","Partly","ParameterSets.Audit.Tests.ps1:129 Should add the audit entry for the piped <Set> object that exists, write a ReadFileError for the one that does not, and leave the DACL unchanged","AuditFlags not bound by property name; adding for several accounts in one call; the owner retry after access denied","budget; budget; Limit (needs a lab or a remote server)"
"audit","Add-NTFSAudit","PathSimple","False","5","0","2","7","Partly","No","No","No","Yes","PermissionScopes.Tests.ps1:146 Should add and remove <Name> using <Form> on <Source>, preserving the other account | Inheritance.Tests.ps1:386 Should set enabled=<Enable> on a <Type>, remove requested audit entries=<Remove>, and leave the DACL unchanged | Inheritance.Tests.ps1:424 Set-NTFSInheritance should re-enable audit inheritance on a <_> and keep its explicit audit entry","0","No call of this set fails on purpose, passes several paths, or pipes objects, and a conflict of -AppliesTo with -InheritanceFlags is not tested. The added entry is read back only from -PassThru and Get-NTFSAudit, and owner and DACL after the call are not asserted for this set.","TestNeeded","The only call under test is PermissionScopes.Tests.ps1:146 (Source=Path with the -AppliesTo form, 13 of 52 cases): :149-154 assert type, Inheritance/Propagation/AuditFlags and the scope name, and :161-163 that the other account remains. The other calls (PermissionScopes:144, Audit.Tests.ps1:618 and :690, Inheritance.Tests.ps1:386, :424, :503) are fixtures; BoundBy 7 = scan 5 + :144 and :146 resolved from the splat.","Closed","ParameterSets.Audit.Tests.ps1:129 Should add the audit entry for the piped <Set> object that exists, write a ReadFileError for the one that does not, and leave the DACL unchanged | ParameterSets.Audit.Tests.ps1:314 Should reject -AppliesTo combined with -InheritanceFlags with an AmbiguousParameterSet error","",""
"audit","Add-NTFSAudit","SDSimple","False","0","0","2","2","Partly","No","No","No","Yes","PermissionScopes.Tests.ps1:146 Should add and remove <Name> using <Form> on <Source>, preserving the other account | Audit.Tests.ps1:89 Should take -Account at position 2 and -AccessRights at position 3 in the <_> parameter set","0","No test makes this set fail, passes or pipes several descriptors, or reads the changed descriptor with .NET; a descriptor without audit entries is tested only with the complex form. Exceptions of the change itself end the cmdlet (open item 1) and are not to be pinned.","TestNeeded","Only PermissionScopes.Tests.ps1:146 binds it (Source=SecurityDescriptor with -AppliesTo, 13 of 52 cases; the fixture at :144 in 26): :149-154 assert the -PassThru type and flags and :156 that the SACL of the item is unchanged (Get-Acl -Audit). Audit.Tests.ps1:89 checks the positions by reflection only; BoundBy 2 resolves the two splat calls, the scan found 0.","Partly","ParameterSets.Audit.Tests.ps1:102 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:161 Should add the audit entry for the piped <Set> object that has an audit section, write a ReadSecurityError for the one that does not, and leave the item on disk unchanged until Set-NTFSSecurityDescriptor writes it | ParameterSets.Audit.Tests.ps1:326 Should add the entry to the descriptor when -SecurityDescriptor, -Account, -AccessRights, and -AppliesTo are all named directly","exceptions from the change itself (open item 1)","MaintainerDecision (open item)"
"audit","Add-NTFSAudit","SDComplex","False","5","0","1","8","Yes","Partly","No","No","Yes","Audit.Tests.ps1:107 Should bind an account and access rights that are passed by position | Audit.Tests.ps1:120 Should return the audit entries of a security descriptor, not its access entries | SecurityDescriptor.Tests.ps1:120 Should write an added audit entry and keep the owner | Audit.Tests.ps1:425 <Command> should write an error and leave the descriptor without audit entries","0","Only the ErrorId is asserted for a descriptor without audit entries, not its category (InvalidData) or target, and no test pipes descriptors or passes several (one without audit entries), so pipeline binding and continuation are untested. Exceptions of the change itself are open item 1 and are not to be pinned.","TestNeeded","Audit.Tests.ps1:109-110 reads the in-memory SACL with .NET and :122-136 assert type, Sid, InheritanceEnabled and the unchanged access protection; SecurityDescriptor.Tests.ps1:124-126 asserts after Set-NTFSSecurityDescriptor that the owner is kept and the entry exists; PermissionScopes.Tests.ps1:156 asserts the item is untouched until written. BoundBy 8 = scan 5 + PermissionScopes:146 (13 of 52 cases) + & $Command at Audit.Tests.ps1:425 and Access.Tests.ps1:881 (Should -Not -Throw only).","Partly","ParameterSets.Audit.Tests.ps1:102 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:161 Should add the audit entry for the piped <Set> object that has an audit section, write a ReadSecurityError for the one that does not, and leave the item on disk unchanged until Set-NTFSSecurityDescriptor writes it","exceptions from the change itself (open item 1)","MaintainerDecision (open item)"
"audit","Remove-NTFSAudit","PathComplex","True","7","2","1","10","Yes","Yes","No","Yes","Yes","Audit.Tests.ps1:629 <Command> should use a held privilege or report a missing one and continue to the next path | Audit.Tests.ps1:361 Should keep an audit entry that does not match exactly, given the path | Audit.Tests.ps1:371 Should remove an audit entry that matches exactly, given the path | Audit.Tests.ps1:384 Should return the audit entries of the item, not its access entries","2 (NTFSSecurity.Live.Tests.ps1:357, 398): SMB share with domain accounts; owner kept; the delegated account gets a RemoveAceError that names the missing privilege and leaves the SDDL unchanged; the file server counts the SACL entries (:1441)","No test pipes paths or objects in, removes for several accounts, asserts the result of a succeeding path after a failing one, or removes only some rights (without -RemoveSpecific). An item without SACL is tested for no error only (Audit.Tests.ps1:406), and the owner retry cannot run on a local volume (Limit).","TestNeeded","Audit.Tests.ps1:631-669 and :672-679 assert ReadFileError/OpenError/target (RemoveAceError/WriteError/target as a basic user), the SACL changed with no rule left, and unchanged DACL/owner SDDL; :363-365 and :373-374 read back through Get-NTFSAudit. BoundBy 10 = scan 7 + PermissionScopes:159 (13 of 52 cases) + & $Command at Audit.Tests.ps1:629 and PathErrors.Tests.ps1:124; :386-388 assert type and the other entry but pass even if nothing was removed.","Partly","ParameterSets.Audit.Tests.ps1:343 Should remove the audit entry for the piped <Set> object that exists, write a ReadFileError for the one that does not, and keep the other account's entry | ParameterSets.Audit.Tests.ps1:466 Should narrow an entry that grants more rights than it removes, instead of deleting it","removing for several accounts in one call; state (empty Audit SDDL, unchanged DACL) of an item without a SACL; the owner retry after access denied","budget; budget; Limit (needs a lab or a remote server)"
"audit","Remove-NTFSAudit","PathSimple","False","0","0","1","1","Partly","No","No","No","Partly","PermissionScopes.Tests.ps1:159 Should add and remove <Name> using <Form> on <Source>, preserving the other account","0","Only one data-driven call binds it: no failing item, pipeline input, several items, or owner and DACL check after the call, the objects are checked by Sid only, and it never runs without -RemoveSpecific.","TestNeeded","PermissionScopes.Tests.ps1:159 binds it only when Source=Path and Form=Flags (13 of 52 cases, always with -RemoveSpecific): :161-163 assert that the entry of the account is gone from -PassThru, that the other account remains, and that Get-NTFSAudit returns nothing for the account. BoundBy 1: the scan found 0 and this ambiguous splat call is the only one that binds the set.","Closed","ParameterSets.Audit.Tests.ps1:343 Should remove the audit entry for the piped <Set> object that exists, write a ReadFileError for the one that does not, and keep the other account's entry | ParameterSets.Audit.Tests.ps1:484 Should remove the entry from the path when -Path, -Account, -AccessRights, and -AppliesTo are all named directly","",""
"audit","Remove-NTFSAudit","SDSimple","False","0","0","1","1","Partly","No","No","No","Partly","PermissionScopes.Tests.ps1:159 Should add and remove <Name> using <Form> on <Source>, preserving the other account","0","Only one data-driven call binds it: the changed descriptor is read only through -PassThru and Get-NTFSAudit, the item being untouched after the removal is not asserted, and no test makes it fail, pipes or passes several descriptors, or runs without -RemoveSpecific.","TestNeeded","PermissionScopes.Tests.ps1:159 binds it only when Source=SecurityDescriptor and Form=Flags (13 of 52 cases, always with -RemoveSpecific): :161-163 assert that the entry of the account is gone, that the other account remains, and that Get-NTFSAudit returns nothing; the SACL on disk is compared only after the Add (:156). BoundBy 1: the scan found 0 and this ambiguous splat call is the only one that binds the set.","Partly","ParameterSets.Audit.Tests.ps1:102 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:375 Should remove the audit entry for the piped <Set> object that has an audit section, write a ReadSecurityError for the one that does not, and keep the other account's entry | ParameterSets.Audit.Tests.ps1:501 Should remove the entry from the descriptor when -SecurityDescriptor, -Account, -AccessRights, and -AppliesTo are all named directly","the item on disk being untouched after the removal, until Set-NTFSSecurityDescriptor writes it","budget"
"audit","Remove-NTFSAudit","SDComplex","False","2","0","1","5","Partly","Partly","No","No","Partly","Audit.Tests.ps1:347 Should keep an audit entry that does not match exactly | Audit.Tests.ps1:353 Should remove an audit entry that matches exactly | Audit.Tests.ps1:425 <Command> should write an error and leave the descriptor without audit entries | PermissionScopes.Tests.ps1:159 Should add and remove <Name> using <Form> on <Source>, preserving the other account","0","The item being untouched after the removal and the result after Set-NTFSSecurityDescriptor are not asserted, the error test lacks category and target, and no test pipes or passes several descriptors, checks the -PassThru type, or asserts a removal without -RemoveSpecific. Exceptions of the change itself are open item 1 and are not to be pinned.","TestNeeded","Audit.Tests.ps1:349 and :355 read the in-memory SACL with .NET (non-matching entry kept, matching entry removed) and :427-432 assert one ReadSecurityError, no output and the SACL still empty; PermissionScopes.Tests.ps1:161-163 assert by Sid only. BoundBy 5 = scan 2 + PermissionScopes:159 (13 of 52 cases) + & $Command at Audit.Tests.ps1:425 and Access.Tests.ps1:881 (Should -Not -Throw only).","Partly","ParameterSets.Audit.Tests.ps1:102 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:375 Should remove the audit entry for the piped <Set> object that has an audit section, write a ReadSecurityError for the one that does not, and keep the other account's entry","the item on disk untouched after the removal and the result after Set-NTFSSecurityDescriptor; the -PassThru output type; exceptions from the change itself (open item 1)","budget; budget; MaintainerDecision (open item)"
"audit","Clear-NTFSAudit","Path","True","3","1","0","5","Yes","Yes","No","Yes","NA","Audit.Tests.ps1:629 <Command> should use a held privilege or report a missing one and continue to the next path | Audit.Tests.ps1:455 Should remove the audit entries and keep the owner | Audit.Tests.ps1:478 Should write no error and leave the access entries unchanged | Audit.Tests.ps1:495 Should write an error and leave the item unchanged","2 (NTFSSecurity.Live.Tests.ps1:652, plus :684 through & $Command that the scan cannot see): SMB share; explicit entry cleared with the inherited entry and the owner kept; the delegated account gets a ClearAclError that names the missing privilege and leaves the SDDL unchanged; the file server checks the SACL (:1453)","-DisableInheritance on a path is passed (Audit.Tests.ps1:629) but its end state (protected SACL, no copied inherited entries) is never asserted, and no test pipes paths or asserts the result of a succeeding path after a failing one. The owner retry after access denied cannot run on a local volume (Limit).","TestNeeded","Audit.Tests.ps1:457-459 asserts no error, owner kept (.NET) and no entry left (Get-NTFSAudit); :480-483 and :497-499 assert an unchanged DACL and, without the privilege, a ClearAclError with an unchanged SDDL; :631-669 and :672-679 add category and target. BoundBy 5 = scan 3 + & $Command at Audit.Tests.ps1:629 and PathErrors.Tests.ps1:124.","Partly","ParameterSets.Audit.Tests.ps1:519 Should clear the audit entries of each path taken from the pipeline and leave the DACL of each unchanged | ParameterSets.Audit.Tests.ps1:540 Should protect the SACL and not copy the parent's inherited entry when clearing a child path","the result of a succeeding path that follows a failing one; the owner retry after access denied","budget; Limit (needs a lab or a remote server)"
"audit","Clear-NTFSAudit","SD","False","2","0","0","3","Yes","Partly","No","No","NA","Audit.Tests.ps1:696 Should clear and protect the descriptor SACL without writing the <Type> | SecurityDescriptorSets.Tests.ps1:107 Clear-NTFSAudit should remove the explicit audit entries of the descriptor | Audit.Tests.ps1:425 <Command> should write an error and leave the descriptor without audit entries","0","No test pipes descriptors or passes several (one without audit entries), and the error test asserts the ErrorId but not category or target.","TestNeeded","Audit.Tests.ps1:698-705 asserts the in-memory SACL cleared and protected (.NET), the SACL of the item untouched until Set-NTFSSecurityDescriptor, then the state on disk and an unchanged DACL; SecurityDescriptorSets.Tests.ps1:109-112 asserts the same for the unprotected form. BoundBy 3 = scan 2 + & $Command at Audit.Tests.ps1:425 (error case only).","Closed","ParameterSets.Audit.Tests.ps1:102 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:561 Should clear each piped descriptor that has an audit section and continue past one that does not","",""
"audit","Get-NTFSAudit","Path","False","24","4","2","27","NA","Partly","No","Partly","Partly","Audit.Tests.ps1:529 Should name the folder that an inherited entry comes from, also with -ExcludeExplicit | Audit.Tests.ps1:48 Should write an error without the Security privilege instead of returning nothing | PathErrors.Tests.ps1:124 <Command> should write a ReadFileError for it and continue with the next path | Inheritance.Tests.ps1:387 Should set enabled=<Enable> on a <Type>, remove requested audit entries=<Remove>, and leave the DACL unchanged","4 (NTFSSecurity.Live.Tests.ps1:336, 373, 656, 657): SMB share with domain accounts; Sid, AuditFlags and rights of the entry; the delegated account gets a ReadSecurityError that names the missing privilege","No test pipes paths or FileInfo/DirectoryInfo into it, asserts the category of its errors or the target of ReadSecurityError, or (in unit tests) the type, AuditFlags and inheritance flags of the output. No unit test has a failing path followed by a path whose entries are asserted (Audit.Tests.ps1:70-73 documents that the second path of the test at :80 no longer fails), and the PermissionDenied branch cannot run on a local volume (Limit).","TestNeeded","Audit.Tests.ps1:50-52 asserts one ReadSecurityError by ErrorId only (basic user); :531-534 and :577-578 assert IsInherited and InheritedFrom; PathErrors.Tests.ps1:130-132 asserts ReadFileError and target for a missing path but discards the output (:124). BoundBy 27 = scan 24 + PermissionScopes:163 (26 of 52 cases) + & $Command at PathErrors.Tests.ps1:124 and Owner.Tests.ps1:98 (no -Path, Should -Not -Throw).","Partly","ParameterSets.Audit.Tests.ps1:590 Should return the entries of the existing path in either position and a ReadFileError, category OpenError, for the missing one | ParameterSets.Audit.Tests.ps1:619 Should return the entries of each path object taken from the pipeline by value | ParameterSets.Audit.Tests.ps1:634 Should write a ReadSecurityError with category OpenError and the path as target without the Security privilege","the PermissionDenied category branch of ReadSecurityError","Limit (needs a lab or a remote server)"
"audit","Get-NTFSAudit","SD","False","1","0","2","3","NA","Partly","Partly","No","Partly","Audit.Tests.ps1:61 Should write an error for a security descriptor that was read without the audit entries | SecurityDescriptorSets.Tests.ps1:160 Get-NTFSAudit should return the audit entries that it returns for the path | PermissionScopes.Tests.ps1:163 Should add and remove <Name> using <Form> on <Source>, preserving the other account","0","The output is compared only with the output of the Path set (no expected type, flags or values), at most one descriptor is piped, and no test passes several descriptors (one without audit entries). The error test lacks category and target.","TestNeeded","Audit.Tests.ps1:63-65 asserts no output and one ReadSecurityError; SecurityDescriptorSets.Tests.ps1:160-163 pipes one descriptor and asserts one entry equal to the Path result (Sid, AccessRights, AuditFlags); PermissionScopes.Tests.ps1:163 asserts only emptiness after a removal. BoundBy 3 = scan 1 + SecurityDescriptorSets:160 (piped by value, so SD) + PermissionScopes:163 (26 of 52 cases).","Partly","ParameterSets.Audit.Tests.ps1:102 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:648 Should return the entries of the piped descriptor that has an audit section and continue past one that does not","an expected type, flags, or values for the output, independent of comparing it to the Path set's output","budget"
"audit","Get-NTFSOrphanedAudit","Path","False","9","1","2","9","NA","Partly","No","Yes","Yes","Audit.Tests.ps1:228 Should return one object per entry whose account cannot be resolved | Audit.Tests.ps1:250 Should return an inherited entry, and nothing with -ExcludeInherited | Audit.Tests.ps1:279 Should write an error for a path that does not exist and continue with the next path without the Security privilege | Audit.Tests.ps1:304 Should write a ReadSecurityError without the Security privilege instead of returning nothing","1 (NTFSSecurity.Live.Tests.ps1:843): SMB share; the entry of a deleted domain account is returned with its SID, without error or warning","No test pipes paths into it, asserts the category of ReadError or ReadSecurityError, or runs -ExcludeExplicit, and the elevated continuation test passes on an empty result (Audit.Tests.ps1:273).","TestNeeded","Audit.Tests.ps1:230-232, :238-239 and :253-256 assert count, type, Sid and IsInherited; :282-286 (basic user) asserts ReadError for the missing path and a ReadSecurityError with its own target for the next path, which shows that the cmdlet continued, while :270-273 (elevated) asserts one error and then only a ForEach over the result. BoundBy 9 = scan 9.","Partly","ParameterSets.Audit.Tests.ps1:670 Should return the orphaned entries of each path taken from the pipeline and write a ReadError, category OpenError, for one that does not exist","the category of ReadSecurityError without the Security privilege; -ExcludeExplicit","budget; budget"
"audit","Get-NTFSOrphanedAudit","SD","False","0","0","2","2","NA","Partly","Partly","No","Partly","Audit.Tests.ps1:243 Should read the entries of a security descriptor | Audit.Tests.ps1:294 Should write an error for a security descriptor that was read without the audit entries","0","At most one descriptor is piped and none is passed in an array, so continuation is untested; -Account and -Exclude* with a descriptor, the entry type and Sid, and the category and target of the error are not asserted.","TestNeeded","Both calls pipe one descriptor, which PowerShell binds by value to -SecurityDescriptor (the elevated run of :296-298 proves it: a Path binding would return entries): :245-246 assert 2 entries with FullName and :296-298 assert no output and one ReadSecurityError. BoundBy 2 = the two ambiguous piped calls (Audit.Tests.ps1:243 and :294); the scan found 0.","Partly","ParameterSets.Audit.Tests.ps1:102 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:691 Should return the orphaned entries of the piped descriptor that has an audit section and continue past one that does not | ParameterSets.Audit.Tests.ps1:713 Should return the orphaned entries when -SecurityDescriptor is named directly","-Account and -ExcludeInherited/-ExcludeExplicit filters with a descriptor","budget"
"inheritance","Disable-NTFSAccessInheritance","Path","True","9","1","0","16","Partly","Partly","No","Partly","Yes","Inheritance.Tests.ps1:318 Should set enabled=<Enable> on a <Type>, remove requested entries=<Remove>, and report the written state | PathErrors.Tests.ps1:157 <Command> should keep the denied item unchanged, report <ErrorId>, and process the next item | PathErrors.Tests.ps1:301 Disable-NTFSAccessInheritance should take ownership, protect the DACL, and set the owner back | Inheritance.Tests.ps1:133 <_> should write an error and return nothing when the security descriptor cannot be read","1 (SMB as the delegated account, NTFSSecurity.Live.Tests.ps1:281-289: no error, owner Administrators kept, DACL protected by Get-Acl)","Not asserted: the error category (OpenError, WriteError), piped input (documented: Get-ChildItem2 | Disable-NTFSAccessInheritance -PassThru), a .NET readback of the kept or removed inherited entries (only Get-NTFSAccess reads them), RestoreOwnerError, -PassThru with a failing item among several, and the documented no-op when no -Path is given.","TestNeeded","Inheritance.Tests.ps1:341-360 asserts the -PassThru object (type, FullName, flag) and reads flag, owner and entries back only with Get-NTFSInheritance, Get-NTFSOwner and Get-NTFSAccess; the .NET readbacks assert flag and owner only (PathErrors.Tests.ps1:307-309 and 183-191, DriveRoot.Tests.ps1:113). Errors: PathErrors.Tests.ps1:110-112 and 180-182 assert ErrorId and target, never the category; no test pipes into the cmdlet. BoundBy 16 = scan 9 (6 are fixtures) + 7 calls through & $Command or & $_ (PathErrors:108,178; Inheritance:139,152,339,456; Privileges:123).","Partly","ParameterSets.Inheritance.Tests.ps1:178 Should set the DACL protected flag to <Enable> and the explicit/inherited rule counts for -Remove=<Remove> on a <Type>, read with Get-Acl | ParameterSets.Inheritance.Tests.ps1:345 <Command> should report <ErrorId> with category WriteError and target for the denied item, and still return the next item's new state with -PassThru | ParameterSets.Inheritance.Tests.ps1:368 <Command> should report RestoreOwnerError after a successful ownership retry and continue with the next path | ParameterSets.Inheritance.Tests.ps1:479 <Command> should take piped folders from Get-ChildItem2 and report the <Scope> inheritance state of each with -PassThru","OpenError category for a path that does not exist; the documented no-op without -Path","budget; budget"
"inheritance","Disable-NTFSAccessInheritance","SecurityDescriptor","False","1","0","0","2","Yes","NA","No","NA","Yes","SecurityDescriptorSets.Tests.ps1:71 Disable-NTFSAccessInheritance should protect the DACL of the descriptor and keep the inherited entries | Inheritance.Tests.ps1:543 <Command> should return the changed descriptor state without writing the <Type>","0","Not asserted: -RemoveInheritedAccessRules with a descriptor, the owner after the write, and several descriptors (array or pipeline). The set has no per-item handler, like the sets of open item 1 (which does not name it), but it cannot fail on a descriptor from Get-NTFSSecurityDescriptor.","TestNeeded","SecurityDescriptorSets.Tests.ps1:79-84 asserts the in-memory flag, the item unchanged before the write (Get-Acl), and after Set-NTFSSecurityDescriptor the flag and an explicit count equal to the inherited count (.NET); Inheritance.Tests.ps1:557-562 asserts count, FullName and flag of the -PassThru object. BoundBy 2 = scan 1 + Inheritance:555 (& $Command -SecurityDescriptor).","Partly","ParameterSets.Inheritance.Tests.ps1:255 <Command> -SecurityDescriptor should change the in-memory access entries per -<SwitchName>:<Remove>, applied to the item only after Set-NTFSSecurityDescriptor writes it | ParameterSets.Inheritance.Tests.ps1:513,547 <Command> -SecurityDescriptor should take two piped descriptors and report both in order, written only by Set-NTFSSecurityDescriptor","the owner unchanged after the descriptor write","budget"
"inheritance","Enable-NTFSAccessInheritance","Path","True","3","1","0","10","Partly","Partly","No","Partly","Yes","Inheritance.Tests.ps1:318 Should set enabled=<Enable> on a <Type>, remove requested entries=<Remove>, and report the written state | PathErrors.Tests.ps1:157 <Command> should keep the denied item unchanged, report <ErrorId>, and process the next item | PathErrors.Tests.ps1:312 Enable-NTFSAccessInheritance should take ownership, let the DACL inherit, and set the owner back | DriveRoot.Tests.ps1:110 Should block and restore the access inheritance of the folder that the drive maps","1 (SMB as the delegated account, NTFSSecurity.Live.Tests.ps1:291-299: no error, owner kept, DACL inherits again by Get-Acl)","Not asserted: the error category, piped input (documented: Get-NTFSInheritance output piped into Enable-NTFSAccessInheritance -RemoveExplicitAccessRules), a .NET readback of explicit and inherited entries after the call (only Get-NTFSAccess reads them), RestoreOwnerError, -PassThru with a failing item among several, and the documented no-op when no -Path is given.","TestNeeded","Inheritance.Tests.ps1:341-360 (Enable cases) asserts the object and reads re-inherited and explicit entries back only with Get-NTFSAccess; the .NET readbacks assert flag and owner only (PathErrors.Tests.ps1:319-321 and 190-191, DriveRoot.Tests.ps1:117). Errors as for Disable: ErrorId and target (PathErrors.Tests.ps1:110-112, 180-182), no category; no piped input. BoundBy 10 = scan 3 + 7 calls through & $Command or & $_ (PathErrors:108,178; Inheritance:139,152,339,456; Privileges:123).","Partly","ParameterSets.Inheritance.Tests.ps1:178 Should set the DACL protected flag to <Enable> and the explicit/inherited rule counts for -Remove=<Remove> on a <Type>, read with Get-Acl | ParameterSets.Inheritance.Tests.ps1:345 <Command> should report <ErrorId> with category WriteError and target for the denied item, and still return the next item's new state with -PassThru | ParameterSets.Inheritance.Tests.ps1:368 <Command> should report RestoreOwnerError after a successful ownership retry and continue with the next path | ParameterSets.Inheritance.Tests.ps1:479 <Command> should take piped folders from Get-ChildItem2 and report the <Scope> inheritance state of each with -PassThru","OpenError category for a path that does not exist; the documented no-op without -Path","budget; budget"
@ -49,14 +49,14 @@
"inheritance","Set-NTFSOwner","SecurityDescriptor","False","2","0","1","2","Partly","NA","No","NA","Partly","Owner.Tests.ps1:284 Should change only the descriptor in memory until Set-NTFSSecurityDescriptor writes it | Owner.Tests.ps1:303 Should write nothing without -PassThru and leave the owner of the item unchanged","0","The persisted-owner test is skipped for basic users (Owner.Tests.ps1:287-290); not asserted: DACL unchanged after the write, FullName and type of the -PassThru object (only the -Path set asserts them), and several descriptors (array or pipeline).","TestNeeded","Owner.Tests.ps1:296-300 asserts count, Owner.Sid, the item's owner unchanged until Set-NTFSSecurityDescriptor and changed after (.NET), but the test is skipped when the user owns new items (:287-290); :312-314 asserts no output without -PassThru, the in-memory owner and the item's owner unchanged. BoundBy 2 = scan 2.","Partly","ParameterSets.Inheritance.Tests.ps1:698,713 Set-NTFSOwner -SecurityDescriptor should change both owners in memory without touching the items, piped and passed directly to the parameter","the DACL unchanged after the write; the type of the -PassThru object (BeOfType)","budget; budget"
"inheritance","Get-NTFSSecurityDescriptor","__AllParameterSets","False","79","5","0","82","NA","Partly","No","Partly","Yes","SecurityDescriptor.Tests.ps1:52 Should report the inherited access entries as inherited | SecurityDescriptor.Tests.ps1:63 Should read the owner and the audit entries with the access entries | DriveRoot.Tests.ps1:39 Get-NTFSSecurityDescriptor should read the DACL of the root folder | PathErrors.Tests.ps1:140 <Command> should write a ReadSecurityError for it and continue with the next path","5 (SMB read-backs for the descriptor tests, NTFSSecurity.Live.Tests.ps1:315, 965, 1150, and InheritedFrom of a vanished item, :988, 1017)","Untested combinations: piped paths and file or folder objects (documented: Get-ChildItem2 | Get-NTFSSecurityDescriptor), no -Path (current location; Owner.Tests.ps1:92 asserts -Not -Throw only), the error category, and that the next item yields exactly one descriptor. [Limit] The documented ownership retry has no success path on a local volume.","TestNeeded","SecurityDescriptor.Tests.ps1:59-60 (inherited flags against the Get-Acl count) and :70-71 (owner against Get-Acl, audit rules) need the Security privilege; DriveRoot.Tests.ps1:42 compares the DACL SDDL with Get-Acl; PathErrors.Tests.ps1:110-115 and 147-152 assert ReadFileError and ReadSecurityError with target and non-empty output. BoundBy 82 = scan 79 + 3 calls through & $Command or & $_ (PathErrors:108,145; Owner:98).","Partly","ParameterSets.Inheritance.Tests.ps1:385 <Command> should write <ErrorId> with category OpenError for a path that does not exist, and return exactly one object for the next path | ParameterSets.Inheritance.Tests.ps1:727,738,745 Get-NTFSSecurityDescriptor should take piped folder objects, a standard Get-Item object, and a piped custom object by its Path property","the result for no -Path (current location); a successful ownership-retry read","budget; Limit, no local volume reaches the success path"
"inheritance","Set-NTFSSecurityDescriptor","__AllParameterSets","False","29","4","0","29","Yes","Yes","Yes","Yes","Yes","SecurityDescriptor.Tests.ps1:299 Should report a denied write, return no failed item, and write the next descriptor | SecurityDescriptor.Tests.ps1:249 Should report RestoreOwnerError for a previous owner that it cannot set back after the write | SecurityDescriptor.Tests.ps1:213 Should return the written descriptor with -PassThru also when it took ownership for the write | SecurityDescriptor.Tests.ps1:133 Should not write back the access entries of an unchanged descriptor","4 (SMB: writes the added entry and keeps the owner, NTFSSecurity.Live.Tests.ps1:317; writes the cleared DACL without RestoreOwnerError, :968; a later command that stops the pipeline leaves the second descriptor unwritten, :1154, 1165)","Untested combinations: positional binding (declared Position 2), the by-property-name pipeline form, and the category and target of the -PassThru ReadSecurityError (only its ErrorId is asserted, SecurityDescriptor.Tests.ps1:361). [Limit] A failing SACL write needs a lab.","None","SecurityDescriptor.Tests.ps1:308-317 pipes two descriptors with -PassThru and asserts WriteSdError, category WriteError, target, the denied item's SDDL unchanged (.NET), one object for the next item and its entry; :259-264 asserts RestoreOwnerError with category and target; :223-226 asserts the -PassThru object after an ownership retry. BoundBy 29 = scan 29 (no calls through variables).","None","","positional binding at Position 2; the by-property-name pipeline form; category and target of the -PassThru ReadSecurityError","would-pin, Position 2 vs siblings' Position 1 looks like an undecided inconsistency per the notes; budget, row judged GapKind None; budget, row judged GapKind None"
"items","Copy-Item2","__AllParameterSets","False","6","4","0","20","Yes","Yes","No","Yes","Partly","ItemCmdlets.Tests.ps1:786 <Command> should write a <ErrorId> for a source that another process has locked and continue with the next path | ItemCmdlets.Tests.ps1:815 <Command> should write a <ErrorId> for each source when the destination folder denies new files | ItemCmdlets.Tests.ps1:635 <_> should write DestinationFileAlreadyExists for a folder that exists at the destination and change nothing | ItemCmdlets.Tests.ps1:674 Copy-Item2 -Force should copy a folder into an existing folder of the same name and replace the files in both","4: -WhatIf onto an existing file on a share (#108, administrator); copy of a file and a folder as the delegated account; later-command stop on a share","No test pipes paths into it (documented: Get-ChildItem2 | Copy-Item2 -Destination), passes an empty or null -Path, a FileInfo object, a path with brackets, a path over 260 characters or a drive root, and -Force replacing an existing file is covered only through the folder merge. FileNotFound and the file case of DestinationFileAlreadyExists are asserted by error count only, and -PassThru asserts FullName but not the output type or that nothing is written without it.","TestNeeded","ItemCmdlets.Tests.ps1:786-801 and :815-827 assert ErrorId, category, target, exception type, only the second item's result and untouched sources; :605-613 and :644-649 read the folder conflict and the merge back; Owner.Tests.ps1:160-163 reads the copied content. 14 of the 20 call sites are '& $Command' calls in ItemCmdlets.Tests.ps1 (lines 514 to 814) that the scan does not resolve.","Partly","ParameterSets.Items.Tests.ps1:36 <Command> should accept <InputKind> piped by value and still process the surrounding items | ParameterSets.Items.Tests.ps1:229 <Command> should reject -Path <CaseName> instead of silently using the current location","a path with brackets; a path over 260 characters; a drive root; -Force replacing an existing file (still only covered through the folder merge); the file case of DestinationFileAlreadyExists with category/target (still error count only); -PassThru output type; that nothing is written without -PassThru","budget (all items; none needs a lab, none pins an open maintainer decision)"
"items","Get-ChildItem2","__AllParameterSets","False","34","8","0","36","NA","Yes","No","Yes","Yes","ItemCmdlets.Tests.ps1:98 Should apply <Case> without broadening the other attribute filters | ItemCmdlets.Tests.ps1:137 Should return the exact tree for <Case> | ItemCmdlets.Tests.ps1:312 Should report the denied folder and continue with the next path | ItemCmdlets.Tests.ps1:370 Should report a junction whose target was removed as a DirUnspecifiedError and continue with the next folder","8: over SMB: path over 260 characters (administrator), -Hidden and a listing (delegated account), -Filter cases, later-command stop with a denied nested folder","No test pipes folders or strings into -Path (documented by value and by FullName), asserts the result of omitting -Path or of a relative -Path (Owner.Tests.ps1:98 only asserts no throw), or lists a drive root or a path over 260 characters in a unit test. -Directory with -File, -Attributes with -Force/-Hidden/-System/-ReadOnly (documented: ignored), -Depth without -Recurse and the dir2 alias are unasserted, and FileNotFound and AttributesEmpty are asserted without category (and without target for AttributesEmpty); the -Filter dot rules are pinned already and are the maintainer's, so they are not counted here.","TestNeeded","ItemCmdlets.Tests.ps1:98-100 and :137-140 assert exact name sets for ten attribute-switch cases and for the Recurse/Depth/Directory/File/Filter cases; :282-289 and :340-348 assert ErrorId, category, target (and exception type) and that the next path or sibling is still listed; :44-49 and :402-406 assert the AlphaFS types; PathErrors.Tests.ps1:108-114 covers FileNotFound (ID and target only).","Partly","ParameterSets.Items.Tests.ps1:91 Should accept piped folders by value, write one error for a path that does not exist, and list the items of the other folders | ParameterSets.Items.Tests.ps1:111 Should accept folder objects piped from Get-ChildItem2 -Directory and list only the files directly below them","the result of an omitted -Path; the result of a relative -Path; a drive root in a unit test; a path over 260 characters in a unit test; -Directory with -File together; -Attributes with -Force/-Hidden/-System/-ReadOnly; -Depth without -Recurse; the dir2 alias; AttributesEmpty category and target","budget (all items; the -Filter dot rules are the maintainer's and were already excluded from this Gap)"
"items","Get-Item2","__AllParameterSets","False","17","1","0","19","NA","Partly","No","Partly","Partly","PathErrors.Tests.ps1:108 <Command> should write a <ErrorId> for it and continue with the next path | ItemCmdlets.Tests.ps1:965 Get-Item2 should resolve <Path> against the current location | Owner.Tests.ps1:235 Should take the items from the pipeline | PipelineControl.Tests.ps1:124 <Name> should stop after the first object for Select-Object -First 1 and change nothing else","1: FullName and Length of a file on a share (delegated account)","No test pipes paths into it (documented: 'C:\Data','C:\Data\Reports' | Get-Item2) or omits -Path (documented: the current location), and the output type (FileInfo or DirectoryInfo) and the Mode property are never asserted; bracket paths, paths over 260 characters and a drive root are untested. The FileNotFound category is not asserted and the output for the next path is checked only as non-empty.","TestNeeded","PathErrors.Tests.ps1:108-114 asserts one FileNotFound error with the missing path as target and non-empty output for the next path; ItemCmdlets.Tests.ps1:965-973 asserts HaveCount 1 and FullName for six relative paths. 15 of the 17 scan calls are fixtures that feed descriptors or other cmdlets (Access, Audit, Inheritance, ObjectApis, Owner, SecurityDescriptor).","Partly","ParameterSets.Items.Tests.ps1:133 Should accept piped items by value, return each in order with its output type, and write one error for a path that does not exist","an omitted -Path defaulting to the current location; bracket paths; paths over 260 characters; a drive root","budget (all items)"
"items","Move-Item2","__AllParameterSets","False","7","3","0","21","Yes","Yes","No","Yes","Yes","ItemCmdlets.Tests.ps1:786 <Command> should write a <ErrorId> for a source that another process has locked and continue with the next path | ItemCmdlets.Tests.ps1:815 <Command> should write a <ErrorId> for each source when the destination folder denies new files | ItemCmdlets.Tests.ps1:651 Move-Item2 -Force should replace an existing file with PassThru=<_> | ItemCmdlets.Tests.ps1:871 Should refuse to move <Kind> folder to another volume and leave it in place","3: -WhatIf onto an existing file on a share (administrator); move of a file as the delegated account; later-command stop on a share","No test pipes paths into it (documented), passes an empty or null -Path, moves a non-empty folder tree, or renames an item inside one folder on the same volume (the cross-volume cases need an elevated admin share), and -Force replacing a folder, bracket or wildcard paths, paths over 260 characters and a drive-root destination are untested. FileNotFound is asserted by error count only.","TestNeeded","ItemCmdlets.Tests.ps1:651-661 asserts the source is gone, the content at the destination and PassThru true and false; :576-592 asserts the moved file and folder (DirectoryInfo) and the removed source folder; :756-771 and :785-797 assert ErrorId, category, target, exception type and the other item's result. The cross-volume tests at :841-878 skip without an elevated admin share.","Partly","ParameterSets.Items.Tests.ps1:36 <Command> should accept <InputKind> piped by value and still process the surrounding items | ParameterSets.Items.Tests.ps1:229 <Command> should reject -Path <CaseName> instead of silently using the current location","moving a non-empty folder tree; renaming an item in place on the same volume; -Force replacing a folder; bracket or wildcard paths; paths over 260 characters; a drive-root destination","budget (all items)"
"items","Remove-Item2","__AllParameterSets","False","15","2","0","16","Yes","Yes","No","Yes","Partly","Remove-Item2.Tests.ps1:43 Should report DeleteError for a non-empty folder without -Recurse and continue with the next path | Remove-Item2.Tests.ps1:104 Should write DeleteError when a descendant is open without delete sharing, not a successful -PassThru result | Remove-Item2.Tests.ps1:126 Should delete a junction with -Recurse without deleting or changing its target | Remove-Item2.Tests.ps1:77 Should leave a folder tree unchanged with -Recurse -Force -WhatIf and write nothing with -PassThru","2: removal of a file on a share as the delegated account; later-command stop on a share","No test pipes items into it (documented: Get-ChildItem2 ... | Remove-Item2), omits -Path (documented: the cmdlet does nothing), passes an empty or null -Path (the ValidateNotNullOrEmpty guard that keeps it from meaning the current location), passes bracket or wildcard paths (documented: literal) or uses rm2/del2. FileNotFound is asserted by error count only (ItemCmdlets.Tests.ps1:537), the access-denied branch of DeleteError (category NotSpecified) is unasserted, and that a successful removal without -PassThru writes nothing is not asserted.","TestNeeded","Remove-Item2.Tests.ps1:43-52 asserts DeleteError, InvalidData, target, kept content, the removed next item and exactly one result; :104-114 and :152-158 assert DeleteError and no success-shaped result with the content kept; :126-130 asserts the junction is removed and its target content and SDDL are unchanged; :176-184 covers the -PassThur alias.","Partly","ParameterSets.Items.Tests.ps1:157 Should accept piped items by value, write one error for a non-empty folder, remove the files, and keep the folder | ParameterSets.Items.Tests.ps1:185 Remove-Item2 should reject -Path <CaseName> instead of removing the current location","-Path omitted entirely (documented: the cmdlet does nothing); bracket or wildcard paths; the rm2/del2 aliases; FileNotFound category/target (still error count only); the access-denied DeleteError branch (category NotSpecified); that a successful removal without -PassThru writes nothing","budget (all items)"
"items","Test-Path2","__AllParameterSets","False","14","3","0","14","NA","NA","Partly","Yes","Yes","ItemCmdlets.Tests.ps1:997 Should return <Expected> for a <Kind> with -PathType <PathType> | ItemCmdlets.Tests.ps1:1039 Should return $false for a path with the character <_> and continue with the next path | ItemCmdlets.Tests.ps1:1030 Should find a folder whose path is longer than 260 characters | ItemCmdlets.Tests.ps1:1011 Should take the items from the pipeline","3: file, folder and missing item with -PathType on a share (delegated account)","The pipeline test pipes one file; no test pipes several items (documented: Get-ChildItem2 -Recurse | Test-Path2 -PathType Leaf) or objects with PathType by property name, or tests a drive root, a UNC path or a bracket path. Errors are NA because the cmdlet writes $false for a missing or invalid path; its PathNotFound handler looks unreachable (see the notes).","TestNeeded","ItemCmdlets.Tests.ps1:997-1002 asserts one [bool] with the expected value for file, folder and missing item under all three -PathType values; :1009-1013 asserts no error and 'False,True' for six invalid characters followed by a valid path; :981-983 pipes one FileInfo; :992-1001 covers a folder path over 260 characters.","Open","","piping several items into -Path; -PathType bound by property name; a drive root; a UNC path; a bracket path","budget (deprioritized: PipelineInput was already Partly, not No, so lower priority than the cmdlets with no pipeline test at all)"
"items","Copy-Item2","__AllParameterSets","False","6","4","0","20","Yes","Yes","No","Yes","Partly","ItemCmdlets.Tests.ps1:793 <Command> should write a <ErrorId> for a source that another process has locked and continue with the next path | ItemCmdlets.Tests.ps1:822 <Command> should write a <ErrorId> for each source when the destination folder denies new files | ItemCmdlets.Tests.ps1:642 <_> should write DestinationFileAlreadyExists for a folder that exists at the destination and change nothing | ItemCmdlets.Tests.ps1:681 Copy-Item2 -Force should copy a folder into an existing folder of the same name and replace the files in both","4: -WhatIf onto an existing file on a share (#108, administrator); copy of a file and a folder as the delegated account; later-command stop on a share","No test pipes paths into it (documented: Get-ChildItem2 | Copy-Item2 -Destination), passes an empty or null -Path, a FileInfo object, a path with brackets, a path over 260 characters or a drive root, and -Force replacing an existing file is covered only through the folder merge. FileNotFound and the file case of DestinationFileAlreadyExists are asserted by error count only, and -PassThru asserts FullName but not the output type or that nothing is written without it.","TestNeeded","ItemCmdlets.Tests.ps1:793-808 and :822-834 assert ErrorId, category, target, exception type, only the second item's result and untouched sources; :605-613 and :644-649 read the folder conflict and the merge back; Owner.Tests.ps1:160-163 reads the copied content. 14 of the 20 call sites are '& $Command' calls in ItemCmdlets.Tests.ps1 (lines 514 to 814) that the scan does not resolve.","Partly","ParameterSets.Items.Tests.ps1:36 <Command> should accept <InputKind> piped by value and still process the surrounding items | ParameterSets.Items.Tests.ps1:229 <Command> should reject -Path <CaseName> instead of silently using the current location","a path with brackets; a path over 260 characters; a drive root; -Force replacing an existing file (still only covered through the folder merge); the file case of DestinationFileAlreadyExists with category/target (still error count only); -PassThru output type; that nothing is written without -PassThru","budget (all items; none needs a lab, none pins an open maintainer decision)"
"items","Get-ChildItem2","__AllParameterSets","False","34","8","0","36","NA","Yes","No","Yes","Yes","ItemCmdlets.Tests.ps1:98 Should apply <Case> without broadening the other attribute filters | ItemCmdlets.Tests.ps1:137 Should return the exact tree for <Case> | ItemCmdlets.Tests.ps1:319 Should report the denied folder and continue with the next path | ItemCmdlets.Tests.ps1:377 Should report a junction whose target was removed as a DirUnspecifiedError and continue with the next folder","8: over SMB: path over 260 characters (administrator), -Hidden and a listing (delegated account), -Filter cases, later-command stop with a denied nested folder","No test pipes folders or strings into -Path (documented by value and by FullName), asserts the result of omitting -Path or of a relative -Path (Owner.Tests.ps1:98 only asserts no throw), or lists a drive root or a path over 260 characters in a unit test. -Directory with -File, -Attributes with -Force/-Hidden/-System/-ReadOnly (documented: ignored), -Depth without -Recurse and the dir2 alias are unasserted, and FileNotFound and AttributesEmpty are asserted without category (and without target for AttributesEmpty); the -Filter dot rules are pinned already and are the maintainer's, so they are not counted here.","TestNeeded","ItemCmdlets.Tests.ps1:98-100 and :137-140 assert exact name sets for ten attribute-switch cases and for the Recurse/Depth/Directory/File/Filter cases; :282-289 and :340-348 assert ErrorId, category, target (and exception type) and that the next path or sibling is still listed; :44-49 and :402-406 assert the AlphaFS types; PathErrors.Tests.ps1:108-114 covers FileNotFound (ID and target only).","Partly","ParameterSets.Items.Tests.ps1:91 Should accept piped folders by value, write one error for a path that does not exist, and list the items of the other folders | ParameterSets.Items.Tests.ps1:111 Should accept folder objects piped from Get-ChildItem2 -Directory and list only the files directly below them","the result of an omitted -Path; the result of a relative -Path; a drive root in a unit test; a path over 260 characters in a unit test; -Directory with -File together; -Attributes with -Force/-Hidden/-System/-ReadOnly; -Depth without -Recurse; the dir2 alias; AttributesEmpty category and target","budget (all items; the -Filter dot rules are the maintainer's and were already excluded from this Gap)"
"items","Get-Item2","__AllParameterSets","False","17","1","0","19","NA","Partly","No","Partly","Partly","PathErrors.Tests.ps1:108 <Command> should write a <ErrorId> for it and continue with the next path | ItemCmdlets.Tests.ps1:972 Get-Item2 should resolve <Path> against the current location | Owner.Tests.ps1:235 Should take the items from the pipeline | PipelineControl.Tests.ps1:124 <Name> should stop after the first object for Select-Object -First 1 and change nothing else","1: FullName and Length of a file on a share (delegated account)","No test pipes paths into it (documented: 'C:\Data','C:\Data\Reports' | Get-Item2) or omits -Path (documented: the current location), and the output type (FileInfo or DirectoryInfo) and the Mode property are never asserted; bracket paths, paths over 260 characters and a drive root are untested. The FileNotFound category is not asserted and the output for the next path is checked only as non-empty.","TestNeeded","PathErrors.Tests.ps1:108-114 asserts one FileNotFound error with the missing path as target and non-empty output for the next path; ItemCmdlets.Tests.ps1:972-980 asserts HaveCount 1 and FullName for six relative paths. 15 of the 17 scan calls are fixtures that feed descriptors or other cmdlets (Access, Audit, Inheritance, ObjectApis, Owner, SecurityDescriptor).","Partly","ParameterSets.Items.Tests.ps1:133 Should accept piped items by value, return each in order with its output type, and write one error for a path that does not exist","an omitted -Path defaulting to the current location; bracket paths; paths over 260 characters; a drive root","budget (all items)"
"items","Move-Item2","__AllParameterSets","False","7","3","0","21","Yes","Yes","No","Yes","Yes","ItemCmdlets.Tests.ps1:793 <Command> should write a <ErrorId> for a source that another process has locked and continue with the next path | ItemCmdlets.Tests.ps1:822 <Command> should write a <ErrorId> for each source when the destination folder denies new files | ItemCmdlets.Tests.ps1:658 Move-Item2 -Force should replace an existing file with PassThru=<_> | ItemCmdlets.Tests.ps1:878 Should refuse to move <Kind> folder to another volume and leave it in place","3: -WhatIf onto an existing file on a share (administrator); move of a file as the delegated account; later-command stop on a share","No test pipes paths into it (documented), passes an empty or null -Path, moves a non-empty folder tree, or renames an item inside one folder on the same volume (the cross-volume cases need an elevated admin share), and -Force replacing a folder, bracket or wildcard paths, paths over 260 characters and a drive-root destination are untested. FileNotFound is asserted by error count only.","TestNeeded","ItemCmdlets.Tests.ps1:658-668 asserts the source is gone, the content at the destination and PassThru true and false; :576-592 asserts the moved file and folder (DirectoryInfo) and the removed source folder; :756-771 and :785-797 assert ErrorId, category, target, exception type and the other item's result. The cross-volume tests at :841-878 skip without an elevated admin share.","Partly","ParameterSets.Items.Tests.ps1:36 <Command> should accept <InputKind> piped by value and still process the surrounding items | ParameterSets.Items.Tests.ps1:229 <Command> should reject -Path <CaseName> instead of silently using the current location","moving a non-empty folder tree; renaming an item in place on the same volume; -Force replacing a folder; bracket or wildcard paths; paths over 260 characters; a drive-root destination","budget (all items)"
"items","Remove-Item2","__AllParameterSets","False","15","2","0","16","Yes","Yes","No","Yes","Partly","Remove-Item2.Tests.ps1:43 Should report DeleteError for a non-empty folder without -Recurse and continue with the next path | Remove-Item2.Tests.ps1:104 Should write DeleteError when a descendant is open without delete sharing, not a successful -PassThru result | Remove-Item2.Tests.ps1:126 Should delete a junction with -Recurse without deleting or changing its target | Remove-Item2.Tests.ps1:77 Should leave a folder tree unchanged with -Recurse -Force -WhatIf and write nothing with -PassThru","2: removal of a file on a share as the delegated account; later-command stop on a share","No test pipes items into it (documented: Get-ChildItem2 ... | Remove-Item2), omits -Path (documented: the cmdlet does nothing), passes an empty or null -Path (the ValidateNotNullOrEmpty guard that keeps it from meaning the current location), passes bracket or wildcard paths (documented: literal) or uses rm2/del2. FileNotFound is asserted by error count only (ItemCmdlets.Tests.ps1:544), the access-denied branch of DeleteError (category NotSpecified) is unasserted, and that a successful removal without -PassThru writes nothing is not asserted.","TestNeeded","Remove-Item2.Tests.ps1:43-52 asserts DeleteError, InvalidData, target, kept content, the removed next item and exactly one result; :104-114 and :152-158 assert DeleteError and no success-shaped result with the content kept; :126-130 asserts the junction is removed and its target content and SDDL are unchanged; :176-184 covers the -PassThur alias.","Partly","ParameterSets.Items.Tests.ps1:157 Should accept piped items by value, write one error for a non-empty folder, remove the files, and keep the folder | ParameterSets.Items.Tests.ps1:185 Remove-Item2 should reject -Path <CaseName> instead of removing the current location","-Path omitted entirely (documented: the cmdlet does nothing); bracket or wildcard paths; the rm2/del2 aliases; FileNotFound category/target (still error count only); the access-denied DeleteError branch (category NotSpecified); that a successful removal without -PassThru writes nothing","budget (all items)"
"items","Test-Path2","__AllParameterSets","False","14","3","0","14","NA","NA","Partly","Yes","Yes","ItemCmdlets.Tests.ps1:1004 Should return <Expected> for a <Kind> with -PathType <PathType> | ItemCmdlets.Tests.ps1:1046 Should return $false for a path with the character <_> and continue with the next path | ItemCmdlets.Tests.ps1:1037 Should find a folder whose path is longer than 260 characters | ItemCmdlets.Tests.ps1:1018 Should take the items from the pipeline","3: file, folder and missing item with -PathType on a share (delegated account)","The pipeline test pipes one file; no test pipes several items (documented: Get-ChildItem2 -Recurse | Test-Path2 -PathType Leaf) or objects with PathType by property name, or tests a drive root, a UNC path or a bracket path. Errors are NA because the cmdlet writes $false for a missing or invalid path; its PathNotFound handler looks unreachable (see the notes).","TestNeeded","ItemCmdlets.Tests.ps1:1004-1009 asserts one [bool] with the expected value for file, folder and missing item under all three -PathType values; :1009-1013 asserts no error and 'False,True' for six invalid characters followed by a valid path; :981-983 pipes one FileInfo; :992-1001 covers a folder path over 260 characters.","Open","","piping several items into -Path; -PathType bound by property name; a drive root; a UNC path; a bracket path","budget (deprioritized: PipelineInput was already Partly, not No, so lower priority than the cmdlets with no pipeline test at all)"
"items","Get-FileHash2","__AllParameterSets","False","12","2","0","13","Partly","Partly","Partly","Partly","Yes","FileHash.Tests.ps1:41 Should return the hash of Get-FileHash for <_> | FileHash.Tests.ps1:94 Should skip the folder and hash the files that follow it | FileHash.Tests.ps1:108 Should write an error and no result for the file | FileHash.Tests.ps1:153 Should report both the failed read and the failed owner restoration without returning a hash","2: SHA256 equals Get-FileHash on a share (delegated account); later-command stop at the verbose message","No test pipes FileInfo/DirectoryInfo objects or folders (documented: Get-ChildItem2 -Recurse | Get-FileHash2) or Algorithm by property name, hashes a relative path or a path over 260 characters, or puts the failing path first and asserts the next hash; no error category is asserted. The owner-restore tests run only elevated and read the owner back with Get-NTFSOwner, and the retry that succeeds after taking ownership is untested.","TestNeeded","FileHash.Tests.ps1:41-44 compares Hash and Algorithm with Get-FileHash for five algorithms; :94-98 skips a folder and hashes the next file with the SHA256 default; :108-115 asserts one error and no result for a locked file; :153-160 (elevated only) asserts RestoreOwnerError and GetHashError with target, no result and the restored owner; OutputTypes.Tests.ps1:57 asserts the type name.","Partly","ParameterSets.Items.Tests.ps1:531 Should accept Get-ChildItem2 objects piped by value, skip a folder, and match Get-FileHash for each file | ParameterSets.Items.Tests.ps1:565 Should write GetHashError with its category for a locked file first, hash the file that follows it, and resolve a relative path","-Algorithm bound by property name from the pipeline; a path over 260 characters; the ownership-retry-after-taking-ownership success path","-Algorithm by property name and >260 chars: budget; ownership-retry success: Limit (elevated-only, needs a DACL/owner setup not shown buildable)"
"items","Get-DiskSpace","__AllParameterSets","False","6","0","0","6","NA","Partly","NA","No","Yes","ItemCmdlets.Tests.ps1:1068 Should return the size of the system drive | ItemCmdlets.Tests.ps1:1086 Should return the volumes with a size greater than zero without -DriveLetter | ItemCmdlets.Tests.ps1:1102 Should warn and return nothing for a drive letter without a volume | ItemCmdlets.Tests.ps1:1110 Should reject a drive letter without a colon","0","No test passes several drive letters, so the documented warn-and-continue for a letter without a volume is never combined with a valid letter; lower-case letters, positional binding and the free-space values against an independent source are unasserted. The validation error is asserted by ErrorId only (no category or target).","TestNeeded","ItemCmdlets.Tests.ps1:1068-1073 asserts type, DriveName and TotalNumberOfBytes against System.IO.DriveInfo; :1072-1077 asserts the exact warning text and no output or error for a letter without a volume; :1056-1061 asserts every volume has a size above zero and the system drive is included; :1080-1081 asserts the ErrorId of the validation error.","Partly","ParameterSets.Items.Tests.ps1:470 Should return only the system drive and warn for a drive letter without a volume, regardless of order (<Order>) | ParameterSets.Items.Tests.ps1:491 Should accept a lower-case drive letter positionally and report the same total size as .NET","the free-space values (TotalNumberOfFreeBytes/FreeBytesAvailable) against an independent source (only TotalNumberOfBytes was compared); the validation error's category and target (still ErrorId only)","budget (both items)"
"items","Get-DiskSpace","__AllParameterSets","False","6","0","0","6","NA","Partly","NA","No","Yes","ItemCmdlets.Tests.ps1:1075 Should return the size of the system drive | ItemCmdlets.Tests.ps1:1093 Should return the volumes with a size greater than zero without -DriveLetter | ItemCmdlets.Tests.ps1:1109 Should warn and return nothing for a drive letter without a volume | ItemCmdlets.Tests.ps1:1117 Should reject a drive letter without a colon","0","No test passes several drive letters, so the documented warn-and-continue for a letter without a volume is never combined with a valid letter; lower-case letters, positional binding and the free-space values against an independent source are unasserted. The validation error is asserted by ErrorId only (no category or target).","TestNeeded","ItemCmdlets.Tests.ps1:1075-1080 asserts type, DriveName and TotalNumberOfBytes against System.IO.DriveInfo; :1072-1077 asserts the exact warning text and no output or error for a letter without a volume; :1056-1061 asserts every volume has a size above zero and the system drive is included; :1080-1081 asserts the ErrorId of the validation error.","Partly","ParameterSets.Items.Tests.ps1:470 Should return only the system drive and warn for a drive letter without a volume, regardless of order (<Order>) | ParameterSets.Items.Tests.ps1:491 Should accept a lower-case drive letter positionally and report the same total size as .NET","the free-space values (TotalNumberOfFreeBytes/FreeBytesAvailable) against an independent source (only TotalNumberOfBytes was compared); the validation error's category and target (still ErrorId only)","budget (both items)"
"items","New-NTFSHardLink","__AllParameterSets","False","14","2","0","17","Yes","Yes","Yes","Yes","Yes","Links.Tests.ps1:134 Should write a non-terminating error for each link that it cannot create and continue with the next one | Links.Tests.ps1:170 Should write a PermissionDenied error and create no link in a folder that denies new files | Links.Tests.ps1:67 Should return every name of the file with -PassThru | Links.Tests.ps1:79 Should give both names the same data","2: link creation on a share (administrator) and -PassThru, which writes GetHardLinkError there","Positional binding (documented example 2), a FileInfo object bound to -Path or -Target and the end of a pipeline by a later command are untested; the -PassThru GetHardLinkError on a share is asserted by ErrorId only (no category or target) and only with an elevated admin share. A hard link across volumes cannot be built on a one-volume host.","TestNeeded","Links.Tests.ps1:134-145 pipes four objects by property name and asserts three errors (ErrorId, categories, targets, message), the created link and unchanged files; :170-179 asserts PermissionDenied, exception type, no output and no link; :36-41, :67-73 and :79-84 read back existence, all names and the shared data. Three of the 17 call sites (Links.Tests.ps1:450, 468, 494) are '& $Command' calls that the scan does not resolve.","Partly","ParameterSets.Items.Tests.ps1:264 <Command> should reject <CaseName> instead of creating a link to the current folder | ParameterSets.Items.Tests.ps1:324 New-NTFSHardLink should stop after the first pass-through object for Select-Object -First 1 and leave the second request untouched","positional binding (documented example 2); a FileInfo object bound to -Path or -Target; the -PassThru GetHardLinkError category and target on an admin share (still ID only)","budget (all items; an elevated admin share is already available on this host, simply not used for this)"
"items","Get-NTFSHardLink","__AllParameterSets","False","9","1","0","10","NA","Partly","Yes","Yes","Partly","Links.Tests.ps1:224 Should write an error for a path that does not exist and continue with the next path | Links.Tests.ps1:236 Should write an error for a folder and continue with the next path | Links.Tests.ps1:214 Should take the files with more than one name from Get-ChildItem2 | Links.Tests.ps1:200 Should return every name of a file with hard links","1: writes GetHardLinkError on a share (administrator)","The output type is never asserted (only FullName and Mode), the error categories (InvalidArgument for a folder, ObjectNotFound, ReadError on a share) are unasserted, and positional binding and strings from the pipeline are untested. The UnauthorizedAccessException handler cannot be reached by a test because Windows lists the names without opening the file (Links.Tests.ps1:262).","TestNeeded","Links.Tests.ps1:224-229 and :236-243 assert one error (FileNotFound; GetHardLinkError with target and message) and exactly the next file; :214-218 pipes AlphaFS file objects and asserts the names of both linked files and not the third; :200-203 asserts all names of a linked file; PathErrors.Tests.ps1:108-114 asserts ID and target for a missing path.","Partly","ParameterSets.Items.Tests.ps1:297 Should accept piped strings by value, write errors with their categories for a folder and a missing path, and return the files in order","the ReadError category on a network share (still ID/target only); the UnauthorizedAccessException handler","ReadError on a share: budget (admin share available elevated, not implemented here); UnauthorizedAccessException handler: Limit (structurally unreachable, Windows lists hard-link names without opening the file)"
"items","New-NTFSSymbolicLink","__AllParameterSets","False","12","2","0","15","Yes","Yes","Yes","Partly","Yes","Links.Tests.ps1:297 Should create a link to a file that reads the data of the file | Links.Tests.ps1:387 Should write a non-terminating error for an existing -Path and continue with the next link | Links.Tests.ps1:420 Should write a PermissionDenied error and create no link in a folder that denies new files | Links.Tests.ps1:335 Should return a folder object for a link to a folder with -PassThru","2: link to a file and to a folder on a share (administrator); asserts no error only","No test creates a link after a failed one in a pipeline (every piped request fails so that the tests run without the privilege), and a link to a folder is checked only for the Directory attribute and reachability through Test-Path2, not for LinkType and target. The success paths run only with SeCreateSymbolicLinkPrivilege; positional binding and an empty -Target (the value that meant the current folder before rc7, while the tests check only the Mandatory metadata) are untested.","TestNeeded","Links.Tests.ps1:297-302 reads back LinkType, target and data of a file link; :387-393 pipes two objects by property name and asserts two errors (ErrorId, categories) and that no link exists; :420-429 asserts PermissionDenied, exception type and no output; :323-339 assert FileInfo and DirectoryInfo with -PassThru.","Partly","ParameterSets.Items.Tests.ps1:264 <Command> should reject <CaseName> instead of creating a link to the current folder | ParameterSets.Items.Tests.ps1:343 New-NTFSSymbolicLink should stop after the first pass-through object for Select-Object -First 1 and leave the second request untouched | ParameterSets.Items.Tests.ps1:367 Should write one ResourceExists error for an existing -Path and still create the links for the requests that follow it","positional binding; the folder link's LinkType and resolved target (only the file link's LinkType was asserted)","budget (both items)"
1
Group
Cmdlet
ParameterSet
Default
TestInvocationsScan
LiveInvocationsScan
AmbiguousInvocationsThatMayBindIt
BoundBy
StateAssertion
ErrorAssertion
PipelineInput
Continuation
OutputAssertion
KeyTests
LiveEvidence
Gap
GapKind
Evidence
StatusAfter
NewTests
Remaining
Reason
2
access
Add-NTFSAccess
PathComplex
True
33
6
1
36
Yes
Yes
No
Partly
Yes
Access.Tests.ps1:740 Should write an AddAceError for each item, change nothing, and return nothing with -PassThru | PathErrors.Tests.ps1:178 <Command> should keep the denied item unchanged, report <ErrorId>, and process the next item | Access.Tests.ps1:807 Should write all entries of the item after the change | PathErrors.Tests.ps1:230 Add-NTFSAccess should take ownership, add the entry, and set the owner back
6: SMB share as delegated and domain accounts - add keeps the owner (#34), add by foreign-domain account name, deny-entry fixtures (Live:253, 877, 927, 987, 1038, 1280)
No test pipes anything into the set (FileInfo/DirectoryInfo, or objects with Account/AccessRights properties), and none combines -PassThru with one failing and one succeeding path: continuation (PathErrors:178, no -PassThru) and no output after a failure (Access:740, all items fail) are asserted in separate tests. Several -Account values, a Deny entry written through -Path (type, no Synchronize) and positional binding are untested.
TestNeeded
Access.Tests.ps1:740-751 asserts ErrorId, category WriteError, TargetObject, ArgumentException, no output and unchanged SDDL for two failing paths; PathErrors.Tests.ps1:178-192 asserts one error with the blocked target, its SDDL unchanged and the next item's entry added; Access.Tests.ps1:807-815 asserts type, entry count and the added entry of -PassThru. BoundBy = scan 33 + PathErrors:108 and :178 (& $Command) + PermissionScopes:86 (splat, Form=Flags, Source=Path); about 14 of the 36 calls are the subject of an assertion, the rest are fixtures.
Partly
ParameterSets.Access.Tests.ps1:61,62 Should add one explicit entry for each path bound through the pipeline, by FullName and by property name, leaving the rest of each item unchanged | ParameterSets.Access.Tests.ps1:91 Should write one AddAceError for the blocked path, leave it unchanged, and return -PassThru entries only for the path it changedParameterSets.Access.Tests.ps1:72,73 Should add one explicit entry for each path bound through the pipeline, by FullName and by property name, leaving the rest of each item unchanged | ParameterSets.Access.Tests.ps1:102 Should write one AddAceError for the blocked path, leave it unchanged, and return -PassThru entries only for the path it changed
several -Account values in one call; a Deny entry written through -Path checked for AccessControlType=Deny and no auto-added Synchronize; positional binding (Add-NTFSAccess $path $account $rights)
budget (all three; proposal 1c was traded for the pipeline and PassThru-combined tests)
3
access
Add-NTFSAccess
PathSimple
False
6
1
2
8
Partly
No
No
No
Yes
PermissionScopes.Tests.ps1:86 Should add and remove <Name> using <Form> on <Source>, preserving the other account | PermissionScopes.Tests.ps1:110 Should apply <Name> only to its intended descendants, including the OneLevel boundary | Access.Tests.ps1:1035 Should name the folder of an inheritable entry, also with -ExcludeExplicit | ObjectApis.Tests.ps1:747 Should name the item of a descriptor and write it to a folder by its path
1: SMB share - Deny ReadPermissions entry with -AppliesTo ThisFolderOnly as a fixture of the unknown-parent case (Live:1039); no assertion on the set itself
No test makes the set fail (missing path, denied write, deny entry without rights), pipes into it, or reads its result back with .NET: every read-back goes through -PassThru or Get-NTFSAccess. -AccessType Deny with -AppliesTo and the exclusion of -AppliesTo with -InheritanceFlags are untested.
TestNeeded
PermissionScopes.Tests.ps1:86-94 asserts type, flags, rights and ConvertToApplyTo of the -PassThru entry for 13 scopes (Form=AppliesTo, Source=Path) and :110-133 asserts which descendants inherit it, both read through the module's own cmdlets. Access.Tests.ps1:1035, Inheritance.Tests.ps1:326/365/474 and ObjectApis.Tests.ps1:747 use the set as a fixture. BoundBy = scan 6 + the splats PermissionScopes:84 and :86 (Source=Path); 2 of the 8 calls are the subject of an assertion.
Partly
ParameterSets.Access.Tests.ps1:113,129 Should report a missing path's error by category and target, still scope the next path's entry, and keep binding -Path through the pipeline once -AppliesTo selects the set | ParameterSets.Access.Tests.ps1:572 Should require -AppliesTo only in the Simple parameter sets, -InheritanceFlags/-PropagationFlags only in the Complex parameter sets, and reject combining -AppliesTo with -InheritanceFlags without changing the itemParameterSets.Access.Tests.ps1:247,259 Should report a missing path's error by category and target, still scope the next path's entry, and keep binding -Path through the pipeline once -AppliesTo selects the set | ParameterSets.Access.Tests.ps1:769 Should require -AppliesTo only in the Simple parameter sets, -InheritanceFlags/-PropagationFlags only in the Complex parameter sets, and reject combining -AppliesTo with -InheritanceFlags without changing the item
a denied write for this set; a Deny entry without rights (-AccessType Deny -AccessRights None) for this set; -AccessType Deny combined with -AppliesTo
budget (all three; the write-denial code path is shared with PathComplex and already covered there)
4
access
Add-NTFSAccess
SDSimple
False
2
0
2
4
Partly
No
No
No
Yes
Access.Tests.ps1:898 Add-NTFSAccess should still take -AppliesTo for a security descriptor | PermissionScopes.Tests.ps1:86 Should add and remove <Name> using <Form> on <Source>, preserving the other account | SecurityDescriptor.Tests.ps1:355 Should write the descriptor and report a read error for -PassThru, not a write error
0
Only InheritanceFlags for ThisFolderOnly is read back from the descriptor with .NET (Access:898); the 13 scopes are checked through the cmdlet's own -PassThru, and no test pipes descriptors in or passes several. A failing change (for example a deny entry without rights) ends the cmdlet with a terminating error and no test pins it (open item 1).
MaintainerDecision
Access.Tests.ps1:898-902 reads the rule from $sd.SecurityDescriptor with .NET; PermissionScopes.Tests.ps1:86-97 asserts type, flags, rights and, for Source=SecurityDescriptor, that the SDDL on disk is unchanged (13 cases). BoundBy = scan 2 (Access:898; SecurityDescriptor:355 is a fixture) + the splats PermissionScopes:84 and :86 (Source=SecurityDescriptor, Form=AppliesTo).
MaintainerDecision
all 13 scopes read back with .NET for Source=SecurityDescriptor (only ThisFolderOnly already was, pre-existing); piped descriptors; several descriptors; the failing-change (deny entry without rights) terminating error, not pinned
budget (the 13-scope/pipe/several items, notes proposal (b2)#1 not implemented); MaintainerDecision (the failing-change open item)
5
access
Add-NTFSAccess
SDComplex
False
14
2
1
16
Yes
No
No
No
Yes
Access.Tests.ps1:822 Should write all entries of a security descriptor after the change and leave the item unchanged | Access.Tests.ps1:887 Add-NTFSAccess should apply the entry to the folder, its subfolders, and files by default | SecurityDescriptor.Tests.ps1:81 Should write the entry as the only explicit entry of the item | PermissionScopes.Tests.ps1:86 Should add and remove <Name> using <Form> on <Source>, preserving the other account
2: SMB share - descriptor written back keeps the owner (#34, Live:316) and the fixture of the later-command cases (Live:1151)
No test pipes descriptors into the cmdlet, and arrays of descriptors appear only as fixtures of Set-NTFSSecurityDescriptor (SecurityDescriptor.Tests.ps1:306, :324; PipelineControl.Tests.ps1:211). A failing descriptor (deny entry without rights) ends the cmdlet with a terminating error and no test pins it (open item 1).
MaintainerDecision
Access.Tests.ps1:822-827 asserts that -PassThru writes as many entries as $sd.SecurityDescriptor holds, one new explicit entry, and no Everyone entry on disk; :887-892 reads the default flags back with .NET; SecurityDescriptor.Tests.ps1:81-86 asserts exactly one explicit entry on disk after Set-NTFSSecurityDescriptor. BoundBy = scan 14 + Access:872 (& $_, asserts only no throw) + PermissionScopes:86 (splat); 5 of the 16 calls are the subject of an assertion.
MaintainerDecision
piped descriptors into the cmdlet; arrays of descriptors used only as Set-NTFSSecurityDescriptor fixtures, not asserted for Add itself; the failing descriptor (deny entry without rights) terminating error, not pinned
budget (the pipe/array items, notes proposal (b2)#2 not implemented); MaintainerDecision (the failing-descriptor open item)
6
access
Remove-NTFSAccess
PathComplex
True
13
2
2
17
Yes
Yes
Yes
Partly
Partly
Access.Tests.ps1:539 Should write a RemoveAceError for each item, change nothing, and return nothing with -PassThru | Access.Tests.ps1:617 Should remove an inherit-only entry that Get-NTFSAccess returned, and nothing else | PathErrors.Tests.ps1:178 <Command> should keep the denied item unchanged, report <ErrorId>, and process the next item | Access.Tests.ps1:651 Should take only the requested generic right from the entry of the account when another account has an exact entry
2: SMB share - remove keeps the owner (#34, Live:264), remove by foreign-domain account name (Live:886)
No test combines -PassThru with one failing and one succeeding path, none asserts the type or the complete entry list of the -PassThru output, and the pipeline test pipes a single entry per case. Several -Account values and positional binding are untested.
TestNeeded
Access.Tests.ps1:539-550 asserts ErrorId, category, target, ArgumentException, no output and unchanged SDDL for two paths; :616-620 pipes Get-NTFSAccess output (binding by property name) and asserts the exact SDDL minus the entry in 3 cases; PathErrors.Tests.ps1:178-192 asserts the next item's entry is removed after one error. BoundBy = scan 13 + Access:617 (pipeline, resolves to PathComplex), PathErrors:108 and :178 (& $Command), PermissionScopes:99 (splat, Form=AppliesTo, Source=Path); all 17 calls are the subject of an assertion.
Partly
ParameterSets.Access.Tests.ps1:157 Should write one RemoveAceError for the blocked path, leave it unchanged, and return -PassThru entries only for the path it changedParameterSets.Access.Tests.ps1:287 Should write one RemoveAceError for the blocked path, leave it unchanged, and return -PassThru entries only for the path it changed
the -PassThru output's count is not checked against the complete entry list of the surviving item (only non-emptiness, type, FullName, and absence of the removed account); the pipeline test still pipes only a single entry per call; several -Account values; positional binding
budget (all four)
7
access
Remove-NTFSAccess
PathSimple
False
0
0
2
1
Partly
No
No
No
Partly
PermissionScopes.Tests.ps1:99 Should add and remove <Name> using <Form> on <Source>, preserving the other account
0
Only the -RemoveSpecific form with -PassThru is bound (13 scopes, Form=Flags); removing rights without -RemoveSpecific, a Deny entry, a missing or denied path, several paths and piped input are untested for this set, and nothing reads the item back with .NET.
TestNeeded
BoundBy = 1 although the scan found 0: PermissionScopes.Tests.ps1:99 binds -AppliesTo when Form is Flags (add with flags, remove with -AppliesTo), 13 cases with Source=Path; it asserts that the account's entry is gone from the -PassThru output and the keeper stays once (:101-102) and that Get-NTFSAccess finds nothing (:103). No other test binds -AppliesTo with Remove-NTFSAccess.
Partly
ParameterSets.Access.Tests.ps1:179 Should take only the requested rights from an entry scoped by -AppliesTo without -RemoveSpecific, keep its flags, and leave another account's entry untouchedParameterSets.Access.Tests.ps1:376 Should take only the requested rights from an entry scoped by -AppliesTo without -RemoveSpecific, keep its flags, and leave another account's entry untouched
a Deny entry's rights-reduction without -RemoveSpecific; a missing or denied path for this set; several paths in one call; piped input
budget (all four; the shared path-resolution/write-denial code is already covered for PathComplex)
8
access
Remove-NTFSAccess
SDSimple
False
0
0
2
1
Partly
No
No
No
Partly
PermissionScopes.Tests.ps1:99 Should add and remove <Name> using <Form> on <Source>, preserving the other account
0
Same single splat test as PathSimple with a descriptor: the removal is read back only through -PassThru and Get-NTFSAccess, the item on disk is not checked after it, and nothing tests removal without -RemoveSpecific, piped descriptors or several descriptors. A failing removal ends the cmdlet with a terminating error and no test pins it (open item 1).
MaintainerDecision
BoundBy = 1 although the scan found 0: PermissionScopes.Tests.ps1:99 binds the set for Source=SecurityDescriptor, Form=Flags (13 cases) and asserts the -PassThru output (:101-102) and Get-NTFSAccess -SecurityDescriptor (:103) after the removal; the SDDL check at :96 runs before the removal.
MaintainerDecision
removal read back only through -PassThru/Get-NTFSAccess, not the item on disk after it; removal without -RemoveSpecific; piped descriptors; several descriptors; the failing removal terminating error, not pinned
budget (the read-back/RemoveSpecific/pipe/several items, notes proposal (b2)#3 not implemented); MaintainerDecision (the failing-removal open item)
9
access
Remove-NTFSAccess
SDComplex
False
4
0
2
6
Partly
No
No
No
Partly
Access.Tests.ps1:915 Remove-NTFSAccess should remove a deny entry from the descriptor and leave the item unchanged | Access.Tests.ps1:682 Should remove an entry that matches exactly | Access.Tests.ps1:688 Should take the rights away from a matching entry without -RemoveSpecific | Access.Tests.ps1:676 Should keep an entry that does not match exactly
0
No test removes an entry that exists on disk from a descriptor and checks that the item keeps it until Set-NTFSSecurityDescriptor: the entries of Access:676-688 and :915 are added in memory only, so a write-through would go unnoticed. No piped or multiple descriptors, and a failing removal ends the cmdlet with a terminating error (open item 1).
MaintainerDecision
Access.Tests.ps1:676-692 reads $sd.SecurityDescriptor with .NET for -RemoveSpecific (kept or removed) and for the rights removal; :915-920 removes an in-memory Deny entry and checks that no such entry is on disk, which also holds if both cmdlets wrote through. BoundBy = scan 4 + Access:872 (& $_, no throw only) + PermissionScopes:99 (splat, Form=AppliesTo, Source=SecurityDescriptor, -PassThru check).
MaintainerDecision
no test removes an on-disk entry from a descriptor and checks the item keeps it until Set-NTFSSecurityDescriptor (write-through check); no piped or multiple descriptors; the failing removal terminating error, not pinned
budget (the write-through/pipe/several items, notes proposal (b2)#3 not implemented); MaintainerDecision (the failing-removal open item)
10
access
Clear-NTFSAccess
Path
True
6
2
0
8
Partly
Partly
No
Yes
NA
PathErrors.Tests.ps1:178 <Command> should keep the denied item unchanged, report <ErrorId>, and process the next item | Access.Tests.ps1:932 Should leave the item with an empty, protected DACL | PathErrors.Tests.ps1:271 Clear-NTFSAccess -DisableInheritance should take ownership, clear and protect the DACL, and not set an unchanged owner back | PathErrors.Tests.ps1:289 Clear-NTFSAccess -DisableInheritance should report RestoreOwnerError for a previous owner that it cannot set back
2: SMB share - clear keeps the owner (#34, Live:274); -DisableInheritance as the owner takes ownership without a RestoreOwnerError (Live:957)
No test asserts that a plain Clear leaves the inherited entries and the inheritance flag untouched, or clears a folder (all unit tests use files). ClearAclError and ReadFileError are asserted by ErrorId and target without category, and nothing is piped in.
TestNeeded
PathErrors.Tests.ps1:178-192 asserts one ClearAclError for the blocked path, its SDDL unchanged and no explicit entry on the next item; Access.Tests.ps1:932-936 and PathErrors.Tests.ps1:271-277 assert a protected, empty DACL and the unchanged owner with .NET; PathErrors.Tests.ps1:289-294 asserts RestoreOwnerError with category WriteError and target (elevated only). BoundBy = scan 6 + PathErrors:108 and :178 (& $Command); 7 of the 8 calls are the subject of an assertion.
Closed
ParameterSets.Access.Tests.ps1:212 Should clear each piped folder's explicit entries, including an inherit-only one, and leave inherited entries and the owner untouched | ParameterSets.Access.Tests.ps1:237,248 Should report a missing path's ReadFileError and a blocked path's ClearAclError, each by category and targetParameterSets.Access.Tests.ps1:409 Should clear each piped folder's explicit entries, including an inherit-only one, and leave inherited entries and the owner untouched | ParameterSets.Access.Tests.ps1:434,445 Should report a missing path's ReadFileError and a blocked path's ClearAclError, each by category and target
11
access
Clear-NTFSAccess
SD
False
3
1
0
3
Partly
No
No
No
NA
SecurityDescriptorSets.Tests.ps1:60 Clear-NTFSAccess -DisableInheritance should leave the descriptor with an empty, protected DACL | SecurityDescriptorSets.Tests.ps1:45 Clear-NTFSAccess should remove the explicit access entries of the descriptor | SecurityDescriptor.Tests.ps1:236 Should not report an owner that did not change when the write that took ownership leaves an empty DACL
1: SMB share - cleared descriptor written with Set-NTFSSecurityDescriptor without a RestoreOwnerError (Live:966)
No test checks that a plain Clear of a descriptor keeps its inherited entries and inheritance flag, pipes descriptors in, or passes several. The set has no per-item handler and no test makes it fail; it is not among the open items, so no test is proposed for that.
TestNeeded
SecurityDescriptorSets.Tests.ps1:45-50 asserts 0 explicit entries in the descriptor, 1 still on disk, then 0 after Set-NTFSSecurityDescriptor; :60-68 asserts a protected, empty DACL in memory, the DACL on disk unchanged and the written result; SecurityDescriptor.Tests.ps1:236-244 asserts that the owner stays after the write (the call there is a fixture of a Set-NTFSSecurityDescriptor test). BoundBy = 3 (no ambiguous calls).
Closed
ParameterSets.Access.Tests.ps1:271 Should clear each piped descriptor's explicit entries in memory, leave the items unchanged until Set-NTFSSecurityDescriptor, and keep the ownerParameterSets.Access.Tests.ps1:468 Should clear each piped descriptor's explicit entries in memory, leave the items unchanged until Set-NTFSSecurityDescriptor, and keep the owner
12
access
Get-NTFSAccess
Path
True
25
3
2
29
NA
Partly
No
Yes
Partly
PathErrors.Tests.ps1:108 <Command> should write a <ErrorId> for it and continue with the next path | PathErrors.Tests.ps1:145 <Command> should write a ReadSecurityError for it and continue with the next path | Access.Tests.ps1:55 Should return the entries of the first item once | DriveRoot.Tests.ps1:34 Get-NTFSAccess should return the access entries of the root folder
3: SMB share - entries of a path longer than 260 characters, foreign-domain account entries, unknown-parent InheritedFrom (Live:543, 859, 1048)
No test pipes FileInfo/DirectoryInfo into the set (or passes a folder object by position, #88), asserts what it returns without -Path (Owner.Tests.ps1:98 only checks that nothing throws), or asserts the category of ReadFileError and ReadSecurityError (the latter is WriteError after a failed ownership retry, see notes). No test asserts the emitted type or the declared OutputType.
TestNeeded
PathErrors.Tests.ps1:108-115 and :145-152 assert one error with ErrorId and target and output for the next path; Access.Tests.ps1:55-59 asserts the first item's entries appear once after a failing path, but the path fails only without elevation; Access.Tests.ps1:1108-1118 asserts a NULL DACL gives one entry with Sid, IsInherited and InheritedFrom, and DriveRoot.Tests.ps1:34-36 that the SID list equals Get-Acl. BoundBy = scan 25 + PathErrors:108/:145 + Owner.Tests.ps1:98 (& $cmdlet, no throw only) + PermissionScopes:103 (splat, Source=Path).
Partly
ParameterSets.Access.Tests.ps1:303,305,315 Should return the same entries for a folder bound through the pipeline and by position, and report a missing path's error by category and target | ParameterSets.Access.Tests.ps1:548 <Name> should declare <Types> as its output typeParameterSets.Access.Tests.ps1:500,502,512 Should return the same entries for a folder bound through the pipeline and by position, and report a missing path's error by category and target | ParameterSets.Access.Tests.ps1:745 <Name> should declare <Types> as its output type
what the cmdlet returns without -Path at all (beyond not throwing, Owner.Tests.ps1:98); the category of ReadSecurityError after a failed ownership retry; BeOfType on an actual emitted object (only the declared OutputType is asserted)
budget (the no -Path case); would-pin (ReadSecurityError is WriteError after a failed retry but OpenError from the generic catch - asserting a category here would cement that inconsistency, per the notes); budget (BeOfType on a live object)
13
access
Get-NTFSAccess
SD
False
1
0
2
3
NA
No
Partly
No
Partly
SecurityDescriptorSets.Tests.ps1:139 Get-NTFSAccess should return the entries that it returns for the path | Access.Tests.ps1:1098 Should read a security descriptor with audit entries and name the same folders | PermissionScopes.Tests.ps1:103 Should add and remove <Name> using <Form> on <Source>, preserving the other account
0
No test uses -Account, -ExcludeExplicit or -ExcludeInherited with a descriptor except the empty-result check of PermissionScopes:103, so an entry added to the descriptor in memory is never shown in the output; no test passes several descriptors or pipes more than one. The set has no per-item handler and no failing descriptor is tested.
TestNeeded
SecurityDescriptorSets.Tests.ps1:139-143 pipes one descriptor and compares Sid, rights and IsInherited of every entry with the -Path result (one item; the output cannot tell the SecurityDescriptor parameter from -Path bound by FullName); Access.Tests.ps1:1098-1103 (elevated only) compares count and InheritedFrom with the path result. BoundBy = scan 1 + SecurityDescriptorSets:139 (pipeline) + PermissionScopes:103 (splat, Source=SecurityDescriptor, asserts only an empty result).
Partly
ParameterSets.Access.Tests.ps1:331,336,338,345 Should filter an entry added to a descriptor in memory by -Account, partition it with -ExcludeInherited and -ExcludeExplicit, and read two descriptors bound through the pipelineParameterSets.Access.Tests.ps1:528,533,535,542 Should filter an entry added to a descriptor in memory by -Account, partition it with -ExcludeInherited and -ExcludeExplicit, and read two descriptors bound through the pipeline
no failing descriptor is tested for this set (no per-item handler)
Limit (the SD loop has no try/catch; an exception would be unhandled and terminating, not a graceful per-item error - the same situation as the Clear-NTFSAccess SD row, which the notes explicitly excuse and this row's Gap text does not)
14
access
Get-NTFSOrphanedAccess
Path
False
4
4
0
6
NA
Partly
No
Partly
Partly
Access.Tests.ps1:218 Should return the entries whose account cannot be resolved | Access.Tests.ps1:222 Should return only the entries of -Account | PathErrors.Tests.ps1:145 <Command> should write a ReadSecurityError for it and continue with the next path | PipelineControl.Tests.ps1:148 <Name> should stop after the first object for Select-Object -First 1 and change nothing else
4: SMB share - entry of a deleted domain account with its SID, inherited entry and -ExcludeInherited, foreign-domain accounts not reported (Live:504, 515, 516, 868)
-ExcludeExplicit and -ExcludeInherited are untested in unit tests (lab only), and PathErrors runs this cmdlet with Output=false, so no test shows that the next path is processed after an error; no pipeline input and no category for ReadFileError or ReadSecurityError. A read failure other than access denied is written as a warning, which no test reaches.
TestNeeded
Access.Tests.ps1:218-225 asserts 2 orphaned entries and, for -Account, 1 entry with its Sid; PathErrors.Tests.ps1:108-115 and :145-152 assert one error with ErrorId and target but cannot show continuation because Output is false for this cmdlet (:29, :56). BoundBy = scan 4 + PathErrors:108 and :145 (& $Command).
Partly
ParameterSets.Access.Tests.ps1:362,363,369,370 Should mark an orphaned entry explicit on its own folder and inherited on a child, partitioned by -ExcludeInherited and -ExcludeExplicit | ParameterSets.Access.Tests.ps1:379,393 Should write a ReadFileError for a missing path, still return the orphaned entry of the next path, and accept both bound through the pipelineParameterSets.Access.Tests.ps1:559,560,566,567 Should mark an orphaned entry explicit on its own folder and inherited on a child, partitioned by -ExcludeInherited and -ExcludeExplicit | ParameterSets.Access.Tests.ps1:576,590 Should write a ReadFileError for a missing path, still return the orphaned entry of the next path, and accept both bound through the pipeline
the category of ReadSecurityError after a failed ownership retry; a read failure other than access denied, which is written as a warning, not an error
budget (ReadSecurityError here has one consistent category, ReadError, unlike Get-NTFSAccess, so it was safely assertable but not attempted); would-pin (the warning-not-error choice; the notes explicitly decline to propose pinning it)
15
access
Get-NTFSOrphanedAccess
SD
False
1
0
0
1
NA
No
No
No
Partly
Access.Tests.ps1:231 Should read the entries of a security descriptor
0
Only the count (2) and FullName are asserted; -Account, -ExcludeExplicit and -ExcludeInherited with a descriptor, the orphaned Sids, several or piped descriptors, and a descriptor changed in memory are untested.
TestNeeded
BoundBy = 1 (unambiguous; the cmdlet has no ambiguous rows): Access.Tests.ps1:231-234 asserts 2 entries, each with FullName equal to the file. Nothing else binds the set.
Partly
ParameterSets.Access.Tests.ps1:408,409,410,420 Should filter a descriptor's orphaned entries by -Account, report both orphaned Sids by default, exclude them all with -ExcludeExplicit, and read two descriptors bound through the pipelineParameterSets.Access.Tests.ps1:605,606,607,617 Should filter a descriptor's orphaned entries by -Account, report both orphaned Sids by default, exclude them all with -ExcludeExplicit, and read two descriptors bound through the pipeline
-ExcludeInherited with a descriptor; a descriptor changed only in memory (not written to disk) still reporting its orphaned entries
budget (both; the same fixture already built in this test could have been extended)
16
access
Get-NTFSSimpleAccess
Path
False
20
1
2
21
NA
Partly
Yes
Yes
Yes
Access.Tests.ps1:353 Should report all entries of the first folder and of the following folder only what the parent does not cover | Access.Tests.ps1:362 Should compare the folders from the pipeline in the same way | Access.Tests.ps1:485 Should write an error for a path that does not exist and continue with the next path | Access.Tests.ps1:267 Should show the entries as a table with the account, the rights, and the type
1: SMB share - parent folder first and for the subfolder only its own entry, as the delegated account (Live:832)
The ReadError of a missing path is asserted by ErrorId only (no category or target), and no test makes a folder unreadable: unlike Get-NTFSAccess the cmdlet does not retry as the owner, so what an unreadable folder reports is unpinned.
TestNeeded
Access.Tests.ps1:353-358 and :362-364 assert all 4 entries of the parent and only the child's own entry, for -Path and for Get-Item2 objects piped in; :485-490 asserts one ReadError and that every output object belongs to the next path; :267-269 asserts the table view; :251-254 and the rights-reduction cases assert Identity.Sid and AccessRights. BoundBy = scan 20 + Access:362 (pipeline, resolves to Path).
Partly
ParameterSets.Access.Tests.ps1:448 Should report an unreadable folder's error by category and target and still report the next folder's entriesParameterSets.Access.Tests.ps1:645 Should report an unreadable folder's error by category and target and still report the next folder's entries
the ReadError of a missing path (as opposed to an unreadable one) is still asserted by ErrorId only, without category or target
budget (Access.Tests.ps1:485 cannot be edited under a one-new-file brief, and no equivalent new test for the missing-path precondition specifically was added)
17
access
Get-NTFSSimpleAccess
SD
False
1
0
2
2
NA
No
Partly
No
Partly
Access.Tests.ps1:476 Should report the security descriptor of a file | Access.Tests.ps1:260 Should read the entries of a security descriptor
0
Only non-empty output and FullName are asserted; -Account, -ExcludeExplicit, -ExcludeInherited, the reduced rights and several descriptors are untested for the descriptor set, and no failing descriptor is tested.
TestNeeded
Access.Tests.ps1:260-263 reads one descriptor; :476-479 pipes one descriptor of a file: the -Path set skips files (Access:468-473), so a non-empty result can only come from the SD set; both assert FullName only. BoundBy = scan 1 + Access:476 (pipeline, resolves to SD).
Partly
ParameterSets.Access.Tests.ps1:469,470,474,476,477,482 Should filter and partition a descriptor's entries like the equivalent -Path call, and read two descriptors bound through the pipelineParameterSets.Access.Tests.ps1:666,667,671,673,674,679 Should filter and partition a descriptor's entries like the equivalent -Path call, and read two descriptors bound through the pipeline
no failing descriptor is tested for this set (no per-item handler)
Limit (same no-per-item-handler situation as the Clear-NTFSAccess SD and Get-NTFSAccess SD rows)
18
access
Get-NTFSEffectiveAccess
Path
True
11
7
1
15
NA
Yes
No
Partly
Partly
Access.Tests.ps1:1140 Should report the native identity error for each <Source> and return no access entry | Access.Tests.ps1:86 Should leave out an account without access when -ExcludeNoneAccessEntries is used | Access.Tests.ps1:145 Should return the result of this computer and warn | PathErrors.Tests.ps1:108 <Command> should write a <ErrorId> for it and continue with the next path
7: SMB share, domain and delegated accounts - rights through domain groups and file-server groups with -ServerName, fallback warning, GetEffectiveAccessError for access denied (Live:419, 428, 438, 456, 478, 486, 895)
No unit test asserts the content of the rights (for example an allow and a deny entry on a file with a protected DACL: ReadData present, WriteData absent), pipes objects in, or shows in one call that a failing path emits nothing while the next path emits only its own result. The ReadEffectivePermissionError handlers cannot be reached because the library hides its failures, and remote and group-based results need the lab.
TestNeeded
Access.Tests.ps1:1140-1153 asserts for two failing paths ErrorId GetEffectiveAccessError, category ReadError, TargetObject, Win32Exception 1332, no output and unchanged SDDL; PathErrors.Tests.ps1:108-115 asserts ReadFileError and output for the next path; Access.Tests.ps1:86-95 asserts the ExcludeNone filter and :145-157 the warning text and equal rights. BoundBy = scan 11 + Access:1140 (splat, Source=Path) + PathErrors:108/:145 + Owner.Tests.ps1:98 (& $cmdlet, no throw only).
Partly
ParameterSets.Access.Tests.ps1:498 Should report an allowed right as present and a denied right as absent for a protected DACL | ParameterSets.Access.Tests.ps1:508 Should return one result per item bound through the pipeline, in orderParameterSets.Access.Tests.ps1:695 Should report an allowed right as present and a denied right as absent for a protected DACL | ParameterSets.Access.Tests.ps1:705 Should return one result per item bound through the pipeline, in order
one call combining a failing path (for example a missing one) with a succeeding one, showing the failing path emits nothing and the next emits only its own result; the ReadEffectivePermissionError handler; remote and group-based results
budget (the failing+succeeding combination); Limit (ReadEffectivePermissionError is unreachable - the library records failures instead of throwing); Limit (remote/group-based results need the lab)
19
access
Get-NTFSEffectiveAccess
SecurityDescriptor
False
2
0
1
3
NA
Yes
No
Partly
Partly
Access.Tests.ps1:1140 Should report the native identity error for each <Source> and return no access entry | Access.Tests.ps1:132 Should name the cause in the error, not the Security privilege | Access.Tests.ps1:107 Should compute the effective access of a security descriptor
0
No test shows that the result follows an entry added to the descriptor in memory (and not the file on disk), pipes descriptors in, or passes a mix of failing and succeeding descriptors; the rights themselves are not asserted.
TestNeeded
Access.Tests.ps1:1140-1153 (Source=SecurityDescriptor, 2 descriptors) asserts the same error triple, Win32Exception 1332 and no output; :132-137 asserts one GetEffectiveAccessError that does not blame the privilege; :107-111 asserts one result with the FullName of the file. BoundBy = scan 2 + Access:1140 (splat, Source=SecurityDescriptor).
Partly
ParameterSets.Access.Tests.ps1:524,530,539 Should follow a descriptor changed only in memory while the -Path result stays on disk, and read two descriptors bound through the pipelineParameterSets.Access.Tests.ps1:721,727,736 Should follow a descriptor changed only in memory while the -Path result stays on disk, and read two descriptors bound through the pipeline
a mix of a failing and a succeeding descriptor in one call
Limit (the per-item catch exists but is unreachable in a unit sandbox; the library records the Authz failure instead of throwing, per the notes)
20
audit
Add-NTFSAudit
PathComplex
True
27
4
1
30
Yes
Yes
No
Yes
Yes
Audit.Tests.ps1:147 Should write an AddAceError for each item, change nothing, and return nothing with -PassThru | Audit.Tests.ps1:629 <Command> should use a held privilege or report a missing one and continue to the next path | Audit.Tests.ps1:178 Should add the audit entry and keep the owner | PermissionScopes.Tests.ps1:146 Should add and remove <Name> using <Form> on <Source>, preserving the other account
4 (NTFSSecurity.Live.Tests.ps1:348, 385, 1010, 1016): SMB share with domain accounts; owner kept; the delegated account gets an AddAceError that names the missing privilege and leaves the SDDL unchanged; the file server counts the SACL entries (:1441)
No test pipes paths or objects into -Path, binds Account/AccessRights/AuditFlags by property name, or adds for several accounts. No test asserts the result of a succeeding path that follows a failing one (PathErrors.Tests.ps1:124 only counts errors), and the owner retry after access denied cannot run on a local volume (Limit).
TestNeeded
Audit.Tests.ps1:149-158 asserts AddAceError, WriteError, target, ArgumentException, no -PassThru output and an unchanged SACL (Get-Acl -Audit) for two failing paths; :631-669 and :672-679 assert ReadFileError/OpenError/target, the FullName of the output, the SACL rule, and unchanged DACL/owner SDDL. BoundBy 30 = scan 27 + PermissionScopes:146 (13 of 52 cases) + 2 calls through & $Command that the scan cannot see (Audit.Tests.ps1:629, PathErrors.Tests.ps1:124); 23 of the 27 scanned calls are fixtures.
Partly
ParameterSets.Audit.Tests.ps1:123 Should add the audit entry for the piped <Set> object that exists, write a ReadFileError for the one that does not, and leave the DACL unchangedParameterSets.Audit.Tests.ps1:129 Should add the audit entry for the piped <Set> object that exists, write a ReadFileError for the one that does not, and leave the DACL unchanged
AuditFlags not bound by property name; adding for several accounts in one call; the owner retry after access denied
budget; budget; Limit (needs a lab or a remote server)
21
audit
Add-NTFSAudit
PathSimple
False
5
0
2
7
Partly
No
No
No
Yes
PermissionScopes.Tests.ps1:146 Should add and remove <Name> using <Form> on <Source>, preserving the other account | Inheritance.Tests.ps1:386 Should set enabled=<Enable> on a <Type>, remove requested audit entries=<Remove>, and leave the DACL unchanged | Inheritance.Tests.ps1:424 Set-NTFSInheritance should re-enable audit inheritance on a <_> and keep its explicit audit entry
0
No call of this set fails on purpose, passes several paths, or pipes objects, and a conflict of -AppliesTo with -InheritanceFlags is not tested. The added entry is read back only from -PassThru and Get-NTFSAudit, and owner and DACL after the call are not asserted for this set.
TestNeeded
The only call under test is PermissionScopes.Tests.ps1:146 (Source=Path with the -AppliesTo form, 13 of 52 cases): :149-154 assert type, Inheritance/Propagation/AuditFlags and the scope name, and :161-163 that the other account remains. The other calls (PermissionScopes:144, Audit.Tests.ps1:618 and :690, Inheritance.Tests.ps1:386, :424, :503) are fixtures; BoundBy 7 = scan 5 + :144 and :146 resolved from the splat.
Closed
ParameterSets.Audit.Tests.ps1:123 Should add the audit entry for the piped <Set> object that exists, write a ReadFileError for the one that does not, and leave the DACL unchanged | ParameterSets.Audit.Tests.ps1:193 Should reject -AppliesTo combined with -InheritanceFlags with an AmbiguousParameterSet error and change nothingParameterSets.Audit.Tests.ps1:129 Should add the audit entry for the piped <Set> object that exists, write a ReadFileError for the one that does not, and leave the DACL unchanged | ParameterSets.Audit.Tests.ps1:314 Should reject -AppliesTo combined with -InheritanceFlags with an AmbiguousParameterSet error
22
audit
Add-NTFSAudit
SDSimple
False
0
0
2
2
Partly
No
No
No
Yes
PermissionScopes.Tests.ps1:146 Should add and remove <Name> using <Form> on <Source>, preserving the other account | Audit.Tests.ps1:89 Should take -Account at position 2 and -AccessRights at position 3 in the <_> parameter set
0
No test makes this set fail, passes or pipes several descriptors, or reads the changed descriptor with .NET; a descriptor without audit entries is tested only with the complex form. Exceptions of the change itself end the cmdlet (open item 1) and are not to be pinned.
TestNeeded
Only PermissionScopes.Tests.ps1:146 binds it (Source=SecurityDescriptor with -AppliesTo, 13 of 52 cases; the fixture at :144 in 26): :149-154 assert the -PassThru type and flags and :156 that the SACL of the item is unchanged (Get-Acl -Audit). Audit.Tests.ps1:89 checks the positions by reflection only; BoundBy 2 resolves the two splat calls, the scan found 0.
Partly
ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:154 Should add the audit entry for the piped <Set> object that has an audit section, write a ReadSecurityError for the one that does not, and leave the item on disk unchanged until Set-NTFSSecurityDescriptor writes it | ParameterSets.Audit.Tests.ps1:208 Should add the entry to the descriptor when -SecurityDescriptor, -Account, -AccessRights, and -AppliesTo are all named directlyParameterSets.Audit.Tests.ps1:102 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:161 Should add the audit entry for the piped <Set> object that has an audit section, write a ReadSecurityError for the one that does not, and leave the item on disk unchanged until Set-NTFSSecurityDescriptor writes it | ParameterSets.Audit.Tests.ps1:326 Should add the entry to the descriptor when -SecurityDescriptor, -Account, -AccessRights, and -AppliesTo are all named directly
exceptions from the change itself (open item 1)
MaintainerDecision (open item)
23
audit
Add-NTFSAudit
SDComplex
False
5
0
1
8
Yes
Partly
No
No
Yes
Audit.Tests.ps1:107 Should bind an account and access rights that are passed by position | Audit.Tests.ps1:120 Should return the audit entries of a security descriptor, not its access entries | SecurityDescriptor.Tests.ps1:120 Should write an added audit entry and keep the owner | Audit.Tests.ps1:425 <Command> should write an error and leave the descriptor without audit entries
0
Only the ErrorId is asserted for a descriptor without audit entries, not its category (InvalidData) or target, and no test pipes descriptors or passes several (one without audit entries), so pipeline binding and continuation are untested. Exceptions of the change itself are open item 1 and are not to be pinned.
TestNeeded
Audit.Tests.ps1:109-110 reads the in-memory SACL with .NET and :122-136 assert type, Sid, InheritanceEnabled and the unchanged access protection; SecurityDescriptor.Tests.ps1:124-126 asserts after Set-NTFSSecurityDescriptor that the owner is kept and the entry exists; PermissionScopes.Tests.ps1:156 asserts the item is untouched until written. BoundBy 8 = scan 5 + PermissionScopes:146 (13 of 52 cases) + & $Command at Audit.Tests.ps1:425 and Access.Tests.ps1:881 (Should -Not -Throw only).
Partly
ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:154 Should add the audit entry for the piped <Set> object that has an audit section, write a ReadSecurityError for the one that does not, and leave the item on disk unchanged until Set-NTFSSecurityDescriptor writes itParameterSets.Audit.Tests.ps1:102 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:161 Should add the audit entry for the piped <Set> object that has an audit section, write a ReadSecurityError for the one that does not, and leave the item on disk unchanged until Set-NTFSSecurityDescriptor writes it
exceptions from the change itself (open item 1)
MaintainerDecision (open item)
24
audit
Remove-NTFSAudit
PathComplex
True
7
2
1
10
Yes
Yes
No
Yes
Yes
Audit.Tests.ps1:629 <Command> should use a held privilege or report a missing one and continue to the next path | Audit.Tests.ps1:361 Should keep an audit entry that does not match exactly, given the path | Audit.Tests.ps1:371 Should remove an audit entry that matches exactly, given the path | Audit.Tests.ps1:384 Should return the audit entries of the item, not its access entries
2 (NTFSSecurity.Live.Tests.ps1:357, 398): SMB share with domain accounts; owner kept; the delegated account gets a RemoveAceError that names the missing privilege and leaves the SDDL unchanged; the file server counts the SACL entries (:1441)
No test pipes paths or objects in, removes for several accounts, asserts the result of a succeeding path after a failing one, or removes only some rights (without -RemoveSpecific). An item without SACL is tested for no error only (Audit.Tests.ps1:406), and the owner retry cannot run on a local volume (Limit).
TestNeeded
Audit.Tests.ps1:631-669 and :672-679 assert ReadFileError/OpenError/target (RemoveAceError/WriteError/target as a basic user), the SACL changed with no rule left, and unchanged DACL/owner SDDL; :363-365 and :373-374 read back through Get-NTFSAudit. BoundBy 10 = scan 7 + PermissionScopes:159 (13 of 52 cases) + & $Command at Audit.Tests.ps1:629 and PathErrors.Tests.ps1:124; :386-388 assert type and the other entry but pass even if nothing was removed.
Partly
ParameterSets.Audit.Tests.ps1:225 Should remove the audit entry for the piped <Set> object that exists, write a ReadFileError for the one that does not, and keep the other account's entry | ParameterSets.Audit.Tests.ps1:286 Should narrow an entry that grants more rights than it removes, instead of deleting itParameterSets.Audit.Tests.ps1:343 Should remove the audit entry for the piped <Set> object that exists, write a ReadFileError for the one that does not, and keep the other account's entry | ParameterSets.Audit.Tests.ps1:466 Should narrow an entry that grants more rights than it removes, instead of deleting it
removing for several accounts in one call; state (empty Audit SDDL, unchanged DACL) of an item without a SACL; the owner retry after access denied
budget; budget; Limit (needs a lab or a remote server)
25
audit
Remove-NTFSAudit
PathSimple
False
0
0
1
1
Partly
No
No
No
Partly
PermissionScopes.Tests.ps1:159 Should add and remove <Name> using <Form> on <Source>, preserving the other account
0
Only one data-driven call binds it: no failing item, pipeline input, several items, or owner and DACL check after the call, the objects are checked by Sid only, and it never runs without -RemoveSpecific.
TestNeeded
PermissionScopes.Tests.ps1:159 binds it only when Source=Path and Form=Flags (13 of 52 cases, always with -RemoveSpecific): :161-163 assert that the entry of the account is gone from -PassThru, that the other account remains, and that Get-NTFSAudit returns nothing for the account. BoundBy 1: the scan found 0 and this ambiguous splat call is the only one that binds the set.
Closed
ParameterSets.Audit.Tests.ps1:225 Should remove the audit entry for the piped <Set> object that exists, write a ReadFileError for the one that does not, and keep the other account's entry | ParameterSets.Audit.Tests.ps1:304 Should remove the entry from the path when -Path, -Account, -AccessRights, and -AppliesTo are all named directlyParameterSets.Audit.Tests.ps1:343 Should remove the audit entry for the piped <Set> object that exists, write a ReadFileError for the one that does not, and keep the other account's entry | ParameterSets.Audit.Tests.ps1:484 Should remove the entry from the path when -Path, -Account, -AccessRights, and -AppliesTo are all named directly
26
audit
Remove-NTFSAudit
SDSimple
False
0
0
1
1
Partly
No
No
No
Partly
PermissionScopes.Tests.ps1:159 Should add and remove <Name> using <Form> on <Source>, preserving the other account
0
Only one data-driven call binds it: the changed descriptor is read only through -PassThru and Get-NTFSAudit, the item being untouched after the removal is not asserted, and no test makes it fail, pipes or passes several descriptors, or runs without -RemoveSpecific.
TestNeeded
PermissionScopes.Tests.ps1:159 binds it only when Source=SecurityDescriptor and Form=Flags (13 of 52 cases, always with -RemoveSpecific): :161-163 assert that the entry of the account is gone, that the other account remains, and that Get-NTFSAudit returns nothing; the SACL on disk is compared only after the Add (:156). BoundBy 1: the scan found 0 and this ambiguous splat call is the only one that binds the set.
Partly
ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:256 Should remove the audit entry for the piped <Set> object that has an audit section, write a ReadSecurityError for the one that does not, and keep the other account's entry | ParameterSets.Audit.Tests.ps1:321 Should remove the entry from the descriptor when -SecurityDescriptor, -Account, -AccessRights, and -AppliesTo are all named directlyParameterSets.Audit.Tests.ps1:102 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:375 Should remove the audit entry for the piped <Set> object that has an audit section, write a ReadSecurityError for the one that does not, and keep the other account's entry | ParameterSets.Audit.Tests.ps1:501 Should remove the entry from the descriptor when -SecurityDescriptor, -Account, -AccessRights, and -AppliesTo are all named directly
the item on disk being untouched after the removal, until Set-NTFSSecurityDescriptor writes it
budget
27
audit
Remove-NTFSAudit
SDComplex
False
2
0
1
5
Partly
Partly
No
No
Partly
Audit.Tests.ps1:347 Should keep an audit entry that does not match exactly | Audit.Tests.ps1:353 Should remove an audit entry that matches exactly | Audit.Tests.ps1:425 <Command> should write an error and leave the descriptor without audit entries | PermissionScopes.Tests.ps1:159 Should add and remove <Name> using <Form> on <Source>, preserving the other account
0
The item being untouched after the removal and the result after Set-NTFSSecurityDescriptor are not asserted, the error test lacks category and target, and no test pipes or passes several descriptors, checks the -PassThru type, or asserts a removal without -RemoveSpecific. Exceptions of the change itself are open item 1 and are not to be pinned.
TestNeeded
Audit.Tests.ps1:349 and :355 read the in-memory SACL with .NET (non-matching entry kept, matching entry removed) and :427-432 assert one ReadSecurityError, no output and the SACL still empty; PermissionScopes.Tests.ps1:161-163 assert by Sid only. BoundBy 5 = scan 2 + PermissionScopes:159 (13 of 52 cases) + & $Command at Audit.Tests.ps1:425 and Access.Tests.ps1:881 (Should -Not -Throw only).
Partly
ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:256 Should remove the audit entry for the piped <Set> object that has an audit section, write a ReadSecurityError for the one that does not, and keep the other account's entryParameterSets.Audit.Tests.ps1:102 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:375 Should remove the audit entry for the piped <Set> object that has an audit section, write a ReadSecurityError for the one that does not, and keep the other account's entry
the item on disk untouched after the removal and the result after Set-NTFSSecurityDescriptor; the -PassThru output type; exceptions from the change itself (open item 1)
budget; budget; MaintainerDecision (open item)
28
audit
Clear-NTFSAudit
Path
True
3
1
0
5
Yes
Yes
No
Yes
NA
Audit.Tests.ps1:629 <Command> should use a held privilege or report a missing one and continue to the next path | Audit.Tests.ps1:455 Should remove the audit entries and keep the owner | Audit.Tests.ps1:478 Should write no error and leave the access entries unchanged | Audit.Tests.ps1:495 Should write an error and leave the item unchanged
2 (NTFSSecurity.Live.Tests.ps1:652, plus :684 through & $Command that the scan cannot see): SMB share; explicit entry cleared with the inherited entry and the owner kept; the delegated account gets a ClearAclError that names the missing privilege and leaves the SDDL unchanged; the file server checks the SACL (:1453)
-DisableInheritance on a path is passed (Audit.Tests.ps1:629) but its end state (protected SACL, no copied inherited entries) is never asserted, and no test pipes paths or asserts the result of a succeeding path after a failing one. The owner retry after access denied cannot run on a local volume (Limit).
TestNeeded
Audit.Tests.ps1:457-459 asserts no error, owner kept (.NET) and no entry left (Get-NTFSAudit); :480-483 and :497-499 assert an unchanged DACL and, without the privilege, a ClearAclError with an unchanged SDDL; :631-669 and :672-679 add category and target. BoundBy 5 = scan 3 + & $Command at Audit.Tests.ps1:629 and PathErrors.Tests.ps1:124.
Partly
ParameterSets.Audit.Tests.ps1:339 Should clear the audit entries of each path taken from the pipeline and leave the DACL of each unchanged | ParameterSets.Audit.Tests.ps1:360 Should protect the SACL and not copy the parent's inherited entry when clearing a child pathParameterSets.Audit.Tests.ps1:519 Should clear the audit entries of each path taken from the pipeline and leave the DACL of each unchanged | ParameterSets.Audit.Tests.ps1:540 Should protect the SACL and not copy the parent's inherited entry when clearing a child path
the result of a succeeding path that follows a failing one; the owner retry after access denied
budget; Limit (needs a lab or a remote server)
29
audit
Clear-NTFSAudit
SD
False
2
0
0
3
Yes
Partly
No
No
NA
Audit.Tests.ps1:696 Should clear and protect the descriptor SACL without writing the <Type> | SecurityDescriptorSets.Tests.ps1:107 Clear-NTFSAudit should remove the explicit audit entries of the descriptor | Audit.Tests.ps1:425 <Command> should write an error and leave the descriptor without audit entries
0
No test pipes descriptors or passes several (one without audit entries), and the error test asserts the ErrorId but not category or target.
TestNeeded
Audit.Tests.ps1:698-705 asserts the in-memory SACL cleared and protected (.NET), the SACL of the item untouched until Set-NTFSSecurityDescriptor, then the state on disk and an unchanged DACL; SecurityDescriptorSets.Tests.ps1:109-112 asserts the same for the unprotected form. BoundBy 3 = scan 2 + & $Command at Audit.Tests.ps1:425 (error case only).
Closed
ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:381 Should clear each piped descriptor that has an audit section and continue past one that does notParameterSets.Audit.Tests.ps1:102 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:561 Should clear each piped descriptor that has an audit section and continue past one that does not
30
audit
Get-NTFSAudit
Path
False
24
4
2
27
NA
Partly
No
Partly
Partly
Audit.Tests.ps1:529 Should name the folder that an inherited entry comes from, also with -ExcludeExplicit | Audit.Tests.ps1:48 Should write an error without the Security privilege instead of returning nothing | PathErrors.Tests.ps1:124 <Command> should write a ReadFileError for it and continue with the next path | Inheritance.Tests.ps1:387 Should set enabled=<Enable> on a <Type>, remove requested audit entries=<Remove>, and leave the DACL unchanged
4 (NTFSSecurity.Live.Tests.ps1:336, 373, 656, 657): SMB share with domain accounts; Sid, AuditFlags and rights of the entry; the delegated account gets a ReadSecurityError that names the missing privilege
No test pipes paths or FileInfo/DirectoryInfo into it, asserts the category of its errors or the target of ReadSecurityError, or (in unit tests) the type, AuditFlags and inheritance flags of the output. No unit test has a failing path followed by a path whose entries are asserted (Audit.Tests.ps1:70-73 documents that the second path of the test at :80 no longer fails), and the PermissionDenied branch cannot run on a local volume (Limit).
TestNeeded
Audit.Tests.ps1:50-52 asserts one ReadSecurityError by ErrorId only (basic user); :531-534 and :577-578 assert IsInherited and InheritedFrom; PathErrors.Tests.ps1:130-132 asserts ReadFileError and target for a missing path but discards the output (:124). BoundBy 27 = scan 24 + PermissionScopes:163 (26 of 52 cases) + & $Command at PathErrors.Tests.ps1:124 and Owner.Tests.ps1:98 (no -Path, Should -Not -Throw).
Partly
ParameterSets.Audit.Tests.ps1:410 Should return the entries of the existing path in either position and a ReadFileError, category OpenError, for the missing one | ParameterSets.Audit.Tests.ps1:439 Should return the entries of each path object taken from the pipeline by value | ParameterSets.Audit.Tests.ps1:454 Should write a ReadSecurityError with category OpenError and the path as target without the Security privilegeParameterSets.Audit.Tests.ps1:590 Should return the entries of the existing path in either position and a ReadFileError, category OpenError, for the missing one | ParameterSets.Audit.Tests.ps1:619 Should return the entries of each path object taken from the pipeline by value | ParameterSets.Audit.Tests.ps1:634 Should write a ReadSecurityError with category OpenError and the path as target without the Security privilege
the PermissionDenied category branch of ReadSecurityError
Limit (needs a lab or a remote server)
31
audit
Get-NTFSAudit
SD
False
1
0
2
3
NA
Partly
Partly
No
Partly
Audit.Tests.ps1:61 Should write an error for a security descriptor that was read without the audit entries | SecurityDescriptorSets.Tests.ps1:160 Get-NTFSAudit should return the audit entries that it returns for the path | PermissionScopes.Tests.ps1:163 Should add and remove <Name> using <Form> on <Source>, preserving the other account
0
The output is compared only with the output of the Path set (no expected type, flags or values), at most one descriptor is piped, and no test passes several descriptors (one without audit entries). The error test lacks category and target.
TestNeeded
Audit.Tests.ps1:63-65 asserts no output and one ReadSecurityError; SecurityDescriptorSets.Tests.ps1:160-163 pipes one descriptor and asserts one entry equal to the Path result (Sid, AccessRights, AuditFlags); PermissionScopes.Tests.ps1:163 asserts only emptiness after a removal. BoundBy 3 = scan 1 + SecurityDescriptorSets:160 (piped by value, so SD) + PermissionScopes:163 (26 of 52 cases).
Partly
ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:468 Should return the entries of the piped descriptor that has an audit section and continue past one that does notParameterSets.Audit.Tests.ps1:102 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:648 Should return the entries of the piped descriptor that has an audit section and continue past one that does not
an expected type, flags, or values for the output, independent of comparing it to the Path set's output
budget
32
audit
Get-NTFSOrphanedAudit
Path
False
9
1
2
9
NA
Partly
No
Yes
Yes
Audit.Tests.ps1:228 Should return one object per entry whose account cannot be resolved | Audit.Tests.ps1:250 Should return an inherited entry, and nothing with -ExcludeInherited | Audit.Tests.ps1:279 Should write an error for a path that does not exist and continue with the next path without the Security privilege | Audit.Tests.ps1:304 Should write a ReadSecurityError without the Security privilege instead of returning nothing
1 (NTFSSecurity.Live.Tests.ps1:843): SMB share; the entry of a deleted domain account is returned with its SID, without error or warning
No test pipes paths into it, asserts the category of ReadError or ReadSecurityError, or runs -ExcludeExplicit, and the elevated continuation test passes on an empty result (Audit.Tests.ps1:273).
TestNeeded
Audit.Tests.ps1:230-232, :238-239 and :253-256 assert count, type, Sid and IsInherited; :282-286 (basic user) asserts ReadError for the missing path and a ReadSecurityError with its own target for the next path, which shows that the cmdlet continued, while :270-273 (elevated) asserts one error and then only a ForEach over the result. BoundBy 9 = scan 9.
Partly
ParameterSets.Audit.Tests.ps1:490 Should return the orphaned entries of each path taken from the pipeline and write a ReadError, category OpenError, for one that does not existParameterSets.Audit.Tests.ps1:670 Should return the orphaned entries of each path taken from the pipeline and write a ReadError, category OpenError, for one that does not exist
the category of ReadSecurityError without the Security privilege; -ExcludeExplicit
budget; budget
33
audit
Get-NTFSOrphanedAudit
SD
False
0
0
2
2
NA
Partly
Partly
No
Partly
Audit.Tests.ps1:243 Should read the entries of a security descriptor | Audit.Tests.ps1:294 Should write an error for a security descriptor that was read without the audit entries
0
At most one descriptor is piped and none is passed in an array, so continuation is untested; -Account and -Exclude* with a descriptor, the entry type and Sid, and the category and target of the error are not asserted.
TestNeeded
Both calls pipe one descriptor, which PowerShell binds by value to -SecurityDescriptor (the elevated run of :296-298 proves it: a Path binding would return entries): :245-246 assert 2 entries with FullName and :296-298 assert no output and one ReadSecurityError. BoundBy 2 = the two ambiguous piped calls (Audit.Tests.ps1:243 and :294); the scan found 0.
Partly
ParameterSets.Audit.Tests.ps1:95 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:511 Should return the orphaned entries of the piped descriptor that has an audit section and continue past one that does not | ParameterSets.Audit.Tests.ps1:533 Should return the orphaned entries when -SecurityDescriptor is named directlyParameterSets.Audit.Tests.ps1:102 <Command> should write a ReadSecurityError with category InvalidData and the descriptor as target for the <Set> set, and change nothing | ParameterSets.Audit.Tests.ps1:691 Should return the orphaned entries of the piped descriptor that has an audit section and continue past one that does not | ParameterSets.Audit.Tests.ps1:713 Should return the orphaned entries when -SecurityDescriptor is named directly
-Account and -ExcludeInherited/-ExcludeExplicit filters with a descriptor
budget
34
inheritance
Disable-NTFSAccessInheritance
Path
True
9
1
0
16
Partly
Partly
No
Partly
Yes
Inheritance.Tests.ps1:318 Should set enabled=<Enable> on a <Type>, remove requested entries=<Remove>, and report the written state | PathErrors.Tests.ps1:157 <Command> should keep the denied item unchanged, report <ErrorId>, and process the next item | PathErrors.Tests.ps1:301 Disable-NTFSAccessInheritance should take ownership, protect the DACL, and set the owner back | Inheritance.Tests.ps1:133 <_> should write an error and return nothing when the security descriptor cannot be read
1 (SMB as the delegated account, NTFSSecurity.Live.Tests.ps1:281-289: no error, owner Administrators kept, DACL protected by Get-Acl)
Not asserted: the error category (OpenError, WriteError), piped input (documented: Get-ChildItem2 | Disable-NTFSAccessInheritance -PassThru), a .NET readback of the kept or removed inherited entries (only Get-NTFSAccess reads them), RestoreOwnerError, -PassThru with a failing item among several, and the documented no-op when no -Path is given.
TestNeeded
Inheritance.Tests.ps1:341-360 asserts the -PassThru object (type, FullName, flag) and reads flag, owner and entries back only with Get-NTFSInheritance, Get-NTFSOwner and Get-NTFSAccess; the .NET readbacks assert flag and owner only (PathErrors.Tests.ps1:307-309 and 183-191, DriveRoot.Tests.ps1:113). Errors: PathErrors.Tests.ps1:110-112 and 180-182 assert ErrorId and target, never the category; no test pipes into the cmdlet. BoundBy 16 = scan 9 (6 are fixtures) + 7 calls through & $Command or & $_ (PathErrors:108,178; Inheritance:139,152,339,456; Privileges:123).
Partly
ParameterSets.Inheritance.Tests.ps1:178 Should set the DACL protected flag to <Enable> and the explicit/inherited rule counts for -Remove=<Remove> on a <Type>, read with Get-Acl | ParameterSets.Inheritance.Tests.ps1:345 <Command> should report <ErrorId> with category WriteError and target for the denied item, and still return the next item's new state with -PassThru | ParameterSets.Inheritance.Tests.ps1:368 <Command> should report RestoreOwnerError after a successful ownership retry and continue with the next path | ParameterSets.Inheritance.Tests.ps1:479 <Command> should take piped folders from Get-ChildItem2 and report the <Scope> inheritance state of each with -PassThru
OpenError category for a path that does not exist; the documented no-op without -Path
budget; budget
35
inheritance
Disable-NTFSAccessInheritance
SecurityDescriptor
False
1
0
0
2
Yes
NA
No
NA
Yes
SecurityDescriptorSets.Tests.ps1:71 Disable-NTFSAccessInheritance should protect the DACL of the descriptor and keep the inherited entries | Inheritance.Tests.ps1:543 <Command> should return the changed descriptor state without writing the <Type>
0
Not asserted: -RemoveInheritedAccessRules with a descriptor, the owner after the write, and several descriptors (array or pipeline). The set has no per-item handler, like the sets of open item 1 (which does not name it), but it cannot fail on a descriptor from Get-NTFSSecurityDescriptor.
TestNeeded
SecurityDescriptorSets.Tests.ps1:79-84 asserts the in-memory flag, the item unchanged before the write (Get-Acl), and after Set-NTFSSecurityDescriptor the flag and an explicit count equal to the inherited count (.NET); Inheritance.Tests.ps1:557-562 asserts count, FullName and flag of the -PassThru object. BoundBy 2 = scan 1 + Inheritance:555 (& $Command -SecurityDescriptor).
Partly
ParameterSets.Inheritance.Tests.ps1:255 <Command> -SecurityDescriptor should change the in-memory access entries per -<SwitchName>:<Remove>, applied to the item only after Set-NTFSSecurityDescriptor writes it | ParameterSets.Inheritance.Tests.ps1:513,547 <Command> -SecurityDescriptor should take two piped descriptors and report both in order, written only by Set-NTFSSecurityDescriptor
the owner unchanged after the descriptor write
budget
36
inheritance
Enable-NTFSAccessInheritance
Path
True
3
1
0
10
Partly
Partly
No
Partly
Yes
Inheritance.Tests.ps1:318 Should set enabled=<Enable> on a <Type>, remove requested entries=<Remove>, and report the written state | PathErrors.Tests.ps1:157 <Command> should keep the denied item unchanged, report <ErrorId>, and process the next item | PathErrors.Tests.ps1:312 Enable-NTFSAccessInheritance should take ownership, let the DACL inherit, and set the owner back | DriveRoot.Tests.ps1:110 Should block and restore the access inheritance of the folder that the drive maps
1 (SMB as the delegated account, NTFSSecurity.Live.Tests.ps1:291-299: no error, owner kept, DACL inherits again by Get-Acl)
Not asserted: the error category, piped input (documented: Get-NTFSInheritance output piped into Enable-NTFSAccessInheritance -RemoveExplicitAccessRules), a .NET readback of explicit and inherited entries after the call (only Get-NTFSAccess reads them), RestoreOwnerError, -PassThru with a failing item among several, and the documented no-op when no -Path is given.
TestNeeded
Inheritance.Tests.ps1:341-360 (Enable cases) asserts the object and reads re-inherited and explicit entries back only with Get-NTFSAccess; the .NET readbacks assert flag and owner only (PathErrors.Tests.ps1:319-321 and 190-191, DriveRoot.Tests.ps1:117). Errors as for Disable: ErrorId and target (PathErrors.Tests.ps1:110-112, 180-182), no category; no piped input. BoundBy 10 = scan 3 + 7 calls through & $Command or & $_ (PathErrors:108,178; Inheritance:139,152,339,456; Privileges:123).
Partly
ParameterSets.Inheritance.Tests.ps1:178 Should set the DACL protected flag to <Enable> and the explicit/inherited rule counts for -Remove=<Remove> on a <Type>, read with Get-Acl | ParameterSets.Inheritance.Tests.ps1:345 <Command> should report <ErrorId> with category WriteError and target for the denied item, and still return the next item's new state with -PassThru | ParameterSets.Inheritance.Tests.ps1:368 <Command> should report RestoreOwnerError after a successful ownership retry and continue with the next path | ParameterSets.Inheritance.Tests.ps1:479 <Command> should take piped folders from Get-ChildItem2 and report the <Scope> inheritance state of each with -PassThru
OpenError category for a path that does not exist; the documented no-op without -Path
budget; budget
49
inheritance
Set-NTFSOwner
SecurityDescriptor
False
2
0
1
2
Partly
NA
No
NA
Partly
Owner.Tests.ps1:284 Should change only the descriptor in memory until Set-NTFSSecurityDescriptor writes it | Owner.Tests.ps1:303 Should write nothing without -PassThru and leave the owner of the item unchanged
0
The persisted-owner test is skipped for basic users (Owner.Tests.ps1:287-290); not asserted: DACL unchanged after the write, FullName and type of the -PassThru object (only the -Path set asserts them), and several descriptors (array or pipeline).
TestNeeded
Owner.Tests.ps1:296-300 asserts count, Owner.Sid, the item's owner unchanged until Set-NTFSSecurityDescriptor and changed after (.NET), but the test is skipped when the user owns new items (:287-290); :312-314 asserts no output without -PassThru, the in-memory owner and the item's owner unchanged. BoundBy 2 = scan 2.
Partly
ParameterSets.Inheritance.Tests.ps1:698,713 Set-NTFSOwner -SecurityDescriptor should change both owners in memory without touching the items, piped and passed directly to the parameter
the DACL unchanged after the write; the type of the -PassThru object (BeOfType)
budget; budget
50
inheritance
Get-NTFSSecurityDescriptor
__AllParameterSets
False
79
5
0
82
NA
Partly
No
Partly
Yes
SecurityDescriptor.Tests.ps1:52 Should report the inherited access entries as inherited | SecurityDescriptor.Tests.ps1:63 Should read the owner and the audit entries with the access entries | DriveRoot.Tests.ps1:39 Get-NTFSSecurityDescriptor should read the DACL of the root folder | PathErrors.Tests.ps1:140 <Command> should write a ReadSecurityError for it and continue with the next path
5 (SMB read-backs for the descriptor tests, NTFSSecurity.Live.Tests.ps1:315, 965, 1150, and InheritedFrom of a vanished item, :988, 1017)
Untested combinations: piped paths and file or folder objects (documented: Get-ChildItem2 | Get-NTFSSecurityDescriptor), no -Path (current location; Owner.Tests.ps1:92 asserts -Not -Throw only), the error category, and that the next item yields exactly one descriptor. [Limit] The documented ownership retry has no success path on a local volume.
TestNeeded
SecurityDescriptor.Tests.ps1:59-60 (inherited flags against the Get-Acl count) and :70-71 (owner against Get-Acl, audit rules) need the Security privilege; DriveRoot.Tests.ps1:42 compares the DACL SDDL with Get-Acl; PathErrors.Tests.ps1:110-115 and 147-152 assert ReadFileError and ReadSecurityError with target and non-empty output. BoundBy 82 = scan 79 + 3 calls through & $Command or & $_ (PathErrors:108,145; Owner:98).
Partly
ParameterSets.Inheritance.Tests.ps1:385 <Command> should write <ErrorId> with category OpenError for a path that does not exist, and return exactly one object for the next path | ParameterSets.Inheritance.Tests.ps1:727,738,745 Get-NTFSSecurityDescriptor should take piped folder objects, a standard Get-Item object, and a piped custom object by its Path property
the result for no -Path (current location); a successful ownership-retry read
budget; Limit, no local volume reaches the success path
51
inheritance
Set-NTFSSecurityDescriptor
__AllParameterSets
False
29
4
0
29
Yes
Yes
Yes
Yes
Yes
SecurityDescriptor.Tests.ps1:299 Should report a denied write, return no failed item, and write the next descriptor | SecurityDescriptor.Tests.ps1:249 Should report RestoreOwnerError for a previous owner that it cannot set back after the write | SecurityDescriptor.Tests.ps1:213 Should return the written descriptor with -PassThru also when it took ownership for the write | SecurityDescriptor.Tests.ps1:133 Should not write back the access entries of an unchanged descriptor
4 (SMB: writes the added entry and keeps the owner, NTFSSecurity.Live.Tests.ps1:317; writes the cleared DACL without RestoreOwnerError, :968; a later command that stops the pipeline leaves the second descriptor unwritten, :1154, 1165)
Untested combinations: positional binding (declared Position 2), the by-property-name pipeline form, and the category and target of the -PassThru ReadSecurityError (only its ErrorId is asserted, SecurityDescriptor.Tests.ps1:361). [Limit] A failing SACL write needs a lab.
None
SecurityDescriptor.Tests.ps1:308-317 pipes two descriptors with -PassThru and asserts WriteSdError, category WriteError, target, the denied item's SDDL unchanged (.NET), one object for the next item and its entry; :259-264 asserts RestoreOwnerError with category and target; :223-226 asserts the -PassThru object after an ownership retry. BoundBy 29 = scan 29 (no calls through variables).
None
positional binding at Position 2; the by-property-name pipeline form; category and target of the -PassThru ReadSecurityError
would-pin, Position 2 vs siblings' Position 1 looks like an undecided inconsistency per the notes; budget, row judged GapKind None; budget, row judged GapKind None
52
items
Copy-Item2
__AllParameterSets
False
6
4
0
20
Yes
Yes
No
Yes
Partly
ItemCmdlets.Tests.ps1:786 <Command> should write a <ErrorId> for a source that another process has locked and continue with the next path | ItemCmdlets.Tests.ps1:815 <Command> should write a <ErrorId> for each source when the destination folder denies new files | ItemCmdlets.Tests.ps1:635 <_> should write DestinationFileAlreadyExists for a folder that exists at the destination and change nothing | ItemCmdlets.Tests.ps1:674 Copy-Item2 -Force should copy a folder into an existing folder of the same name and replace the files in bothItemCmdlets.Tests.ps1:793 <Command> should write a <ErrorId> for a source that another process has locked and continue with the next path | ItemCmdlets.Tests.ps1:822 <Command> should write a <ErrorId> for each source when the destination folder denies new files | ItemCmdlets.Tests.ps1:642 <_> should write DestinationFileAlreadyExists for a folder that exists at the destination and change nothing | ItemCmdlets.Tests.ps1:681 Copy-Item2 -Force should copy a folder into an existing folder of the same name and replace the files in both
4: -WhatIf onto an existing file on a share (#108, administrator); copy of a file and a folder as the delegated account; later-command stop on a share
No test pipes paths into it (documented: Get-ChildItem2 | Copy-Item2 -Destination), passes an empty or null -Path, a FileInfo object, a path with brackets, a path over 260 characters or a drive root, and -Force replacing an existing file is covered only through the folder merge. FileNotFound and the file case of DestinationFileAlreadyExists are asserted by error count only, and -PassThru asserts FullName but not the output type or that nothing is written without it.
TestNeeded
ItemCmdlets.Tests.ps1:786-801 and :815-827 assert ErrorId, category, target, exception type, only the second item's result and untouched sources; :605-613 and :644-649 read the folder conflict and the merge back; Owner.Tests.ps1:160-163 reads the copied content. 14 of the 20 call sites are '& $Command' calls in ItemCmdlets.Tests.ps1 (lines 514 to 814) that the scan does not resolve.ItemCmdlets.Tests.ps1:793-808 and :822-834 assert ErrorId, category, target, exception type, only the second item's result and untouched sources; :605-613 and :644-649 read the folder conflict and the merge back; Owner.Tests.ps1:160-163 reads the copied content. 14 of the 20 call sites are '& $Command' calls in ItemCmdlets.Tests.ps1 (lines 514 to 814) that the scan does not resolve.
Partly
ParameterSets.Items.Tests.ps1:36 <Command> should accept <InputKind> piped by value and still process the surrounding items | ParameterSets.Items.Tests.ps1:229 <Command> should reject -Path <CaseName> instead of silently using the current location
a path with brackets; a path over 260 characters; a drive root; -Force replacing an existing file (still only covered through the folder merge); the file case of DestinationFileAlreadyExists with category/target (still error count only); -PassThru output type; that nothing is written without -PassThru
budget (all items; none needs a lab, none pins an open maintainer decision)
53
items
Get-ChildItem2
__AllParameterSets
False
34
8
0
36
NA
Yes
No
Yes
Yes
ItemCmdlets.Tests.ps1:98 Should apply <Case> without broadening the other attribute filters | ItemCmdlets.Tests.ps1:137 Should return the exact tree for <Case> | ItemCmdlets.Tests.ps1:312 Should report the denied folder and continue with the next path | ItemCmdlets.Tests.ps1:370 Should report a junction whose target was removed as a DirUnspecifiedError and continue with the next folderItemCmdlets.Tests.ps1:98 Should apply <Case> without broadening the other attribute filters | ItemCmdlets.Tests.ps1:137 Should return the exact tree for <Case> | ItemCmdlets.Tests.ps1:319 Should report the denied folder and continue with the next path | ItemCmdlets.Tests.ps1:377 Should report a junction whose target was removed as a DirUnspecifiedError and continue with the next folder
8: over SMB: path over 260 characters (administrator), -Hidden and a listing (delegated account), -Filter cases, later-command stop with a denied nested folder
No test pipes folders or strings into -Path (documented by value and by FullName), asserts the result of omitting -Path or of a relative -Path (Owner.Tests.ps1:98 only asserts no throw), or lists a drive root or a path over 260 characters in a unit test. -Directory with -File, -Attributes with -Force/-Hidden/-System/-ReadOnly (documented: ignored), -Depth without -Recurse and the dir2 alias are unasserted, and FileNotFound and AttributesEmpty are asserted without category (and without target for AttributesEmpty); the -Filter dot rules are pinned already and are the maintainer's, so they are not counted here.
TestNeeded
ItemCmdlets.Tests.ps1:98-100 and :137-140 assert exact name sets for ten attribute-switch cases and for the Recurse/Depth/Directory/File/Filter cases; :282-289 and :340-348 assert ErrorId, category, target (and exception type) and that the next path or sibling is still listed; :44-49 and :402-406 assert the AlphaFS types; PathErrors.Tests.ps1:108-114 covers FileNotFound (ID and target only).
Partly
ParameterSets.Items.Tests.ps1:91 Should accept piped folders by value, write one error for a path that does not exist, and list the items of the other folders | ParameterSets.Items.Tests.ps1:111 Should accept folder objects piped from Get-ChildItem2 -Directory and list only the files directly below them
the result of an omitted -Path; the result of a relative -Path; a drive root in a unit test; a path over 260 characters in a unit test; -Directory with -File together; -Attributes with -Force/-Hidden/-System/-ReadOnly; -Depth without -Recurse; the dir2 alias; AttributesEmpty category and target
budget (all items; the -Filter dot rules are the maintainer's and were already excluded from this Gap)
54
items
Get-Item2
__AllParameterSets
False
17
1
0
19
NA
Partly
No
Partly
Partly
PathErrors.Tests.ps1:108 <Command> should write a <ErrorId> for it and continue with the next path | ItemCmdlets.Tests.ps1:965 Get-Item2 should resolve <Path> against the current location | Owner.Tests.ps1:235 Should take the items from the pipeline | PipelineControl.Tests.ps1:124 <Name> should stop after the first object for Select-Object -First 1 and change nothing elsePathErrors.Tests.ps1:108 <Command> should write a <ErrorId> for it and continue with the next path | ItemCmdlets.Tests.ps1:972 Get-Item2 should resolve <Path> against the current location | Owner.Tests.ps1:235 Should take the items from the pipeline | PipelineControl.Tests.ps1:124 <Name> should stop after the first object for Select-Object -First 1 and change nothing else
1: FullName and Length of a file on a share (delegated account)
No test pipes paths into it (documented: 'C:\Data','C:\Data\Reports' | Get-Item2) or omits -Path (documented: the current location), and the output type (FileInfo or DirectoryInfo) and the Mode property are never asserted; bracket paths, paths over 260 characters and a drive root are untested. The FileNotFound category is not asserted and the output for the next path is checked only as non-empty.
TestNeeded
PathErrors.Tests.ps1:108-114 asserts one FileNotFound error with the missing path as target and non-empty output for the next path; ItemCmdlets.Tests.ps1:965-973 asserts HaveCount 1 and FullName for six relative paths. 15 of the 17 scan calls are fixtures that feed descriptors or other cmdlets (Access, Audit, Inheritance, ObjectApis, Owner, SecurityDescriptor).PathErrors.Tests.ps1:108-114 asserts one FileNotFound error with the missing path as target and non-empty output for the next path; ItemCmdlets.Tests.ps1:972-980 asserts HaveCount 1 and FullName for six relative paths. 15 of the 17 scan calls are fixtures that feed descriptors or other cmdlets (Access, Audit, Inheritance, ObjectApis, Owner, SecurityDescriptor).
Partly
ParameterSets.Items.Tests.ps1:133 Should accept piped items by value, return each in order with its output type, and write one error for a path that does not exist
an omitted -Path defaulting to the current location; bracket paths; paths over 260 characters; a drive root
budget (all items)
55
items
Move-Item2
__AllParameterSets
False
7
3
0
21
Yes
Yes
No
Yes
Yes
ItemCmdlets.Tests.ps1:786 <Command> should write a <ErrorId> for a source that another process has locked and continue with the next path | ItemCmdlets.Tests.ps1:815 <Command> should write a <ErrorId> for each source when the destination folder denies new files | ItemCmdlets.Tests.ps1:651 Move-Item2 -Force should replace an existing file with PassThru=<_> | ItemCmdlets.Tests.ps1:871 Should refuse to move <Kind> folder to another volume and leave it in placeItemCmdlets.Tests.ps1:793 <Command> should write a <ErrorId> for a source that another process has locked and continue with the next path | ItemCmdlets.Tests.ps1:822 <Command> should write a <ErrorId> for each source when the destination folder denies new files | ItemCmdlets.Tests.ps1:658 Move-Item2 -Force should replace an existing file with PassThru=<_> | ItemCmdlets.Tests.ps1:878 Should refuse to move <Kind> folder to another volume and leave it in place
3: -WhatIf onto an existing file on a share (administrator); move of a file as the delegated account; later-command stop on a share
No test pipes paths into it (documented), passes an empty or null -Path, moves a non-empty folder tree, or renames an item inside one folder on the same volume (the cross-volume cases need an elevated admin share), and -Force replacing a folder, bracket or wildcard paths, paths over 260 characters and a drive-root destination are untested. FileNotFound is asserted by error count only.
TestNeeded
ItemCmdlets.Tests.ps1:651-661 asserts the source is gone, the content at the destination and PassThru true and false; :576-592 asserts the moved file and folder (DirectoryInfo) and the removed source folder; :756-771 and :785-797 assert ErrorId, category, target, exception type and the other item's result. The cross-volume tests at :841-878 skip without an elevated admin share.ItemCmdlets.Tests.ps1:658-668 asserts the source is gone, the content at the destination and PassThru true and false; :576-592 asserts the moved file and folder (DirectoryInfo) and the removed source folder; :756-771 and :785-797 assert ErrorId, category, target, exception type and the other item's result. The cross-volume tests at :841-878 skip without an elevated admin share.
Partly
ParameterSets.Items.Tests.ps1:36 <Command> should accept <InputKind> piped by value and still process the surrounding items | ParameterSets.Items.Tests.ps1:229 <Command> should reject -Path <CaseName> instead of silently using the current location
moving a non-empty folder tree; renaming an item in place on the same volume; -Force replacing a folder; bracket or wildcard paths; paths over 260 characters; a drive-root destination
budget (all items)
56
items
Remove-Item2
__AllParameterSets
False
15
2
0
16
Yes
Yes
No
Yes
Partly
Remove-Item2.Tests.ps1:43 Should report DeleteError for a non-empty folder without -Recurse and continue with the next path | Remove-Item2.Tests.ps1:104 Should write DeleteError when a descendant is open without delete sharing, not a successful -PassThru result | Remove-Item2.Tests.ps1:126 Should delete a junction with -Recurse without deleting or changing its target | Remove-Item2.Tests.ps1:77 Should leave a folder tree unchanged with -Recurse -Force -WhatIf and write nothing with -PassThru
2: removal of a file on a share as the delegated account; later-command stop on a share
No test pipes items into it (documented: Get-ChildItem2 ... | Remove-Item2), omits -Path (documented: the cmdlet does nothing), passes an empty or null -Path (the ValidateNotNullOrEmpty guard that keeps it from meaning the current location), passes bracket or wildcard paths (documented: literal) or uses rm2/del2. FileNotFound is asserted by error count only (ItemCmdlets.Tests.ps1:537), the access-denied branch of DeleteError (category NotSpecified) is unasserted, and that a successful removal without -PassThru writes nothing is not asserted.No test pipes items into it (documented: Get-ChildItem2 ... | Remove-Item2), omits -Path (documented: the cmdlet does nothing), passes an empty or null -Path (the ValidateNotNullOrEmpty guard that keeps it from meaning the current location), passes bracket or wildcard paths (documented: literal) or uses rm2/del2. FileNotFound is asserted by error count only (ItemCmdlets.Tests.ps1:544), the access-denied branch of DeleteError (category NotSpecified) is unasserted, and that a successful removal without -PassThru writes nothing is not asserted.
TestNeeded
Remove-Item2.Tests.ps1:43-52 asserts DeleteError, InvalidData, target, kept content, the removed next item and exactly one result; :104-114 and :152-158 assert DeleteError and no success-shaped result with the content kept; :126-130 asserts the junction is removed and its target content and SDDL are unchanged; :176-184 covers the -PassThur alias.
Partly
ParameterSets.Items.Tests.ps1:157 Should accept piped items by value, write one error for a non-empty folder, remove the files, and keep the folder | ParameterSets.Items.Tests.ps1:185 Remove-Item2 should reject -Path <CaseName> instead of removing the current location
-Path omitted entirely (documented: the cmdlet does nothing); bracket or wildcard paths; the rm2/del2 aliases; FileNotFound category/target (still error count only); the access-denied DeleteError branch (category NotSpecified); that a successful removal without -PassThru writes nothing
budget (all items)
57
items
Test-Path2
__AllParameterSets
False
14
3
0
14
NA
NA
Partly
Yes
Yes
ItemCmdlets.Tests.ps1:997 Should return <Expected> for a <Kind> with -PathType <PathType> | ItemCmdlets.Tests.ps1:1039 Should return $false for a path with the character <_> and continue with the next path | ItemCmdlets.Tests.ps1:1030 Should find a folder whose path is longer than 260 characters | ItemCmdlets.Tests.ps1:1011 Should take the items from the pipelineItemCmdlets.Tests.ps1:1004 Should return <Expected> for a <Kind> with -PathType <PathType> | ItemCmdlets.Tests.ps1:1046 Should return $false for a path with the character <_> and continue with the next path | ItemCmdlets.Tests.ps1:1037 Should find a folder whose path is longer than 260 characters | ItemCmdlets.Tests.ps1:1018 Should take the items from the pipeline
3: file, folder and missing item with -PathType on a share (delegated account)
The pipeline test pipes one file; no test pipes several items (documented: Get-ChildItem2 -Recurse | Test-Path2 -PathType Leaf) or objects with PathType by property name, or tests a drive root, a UNC path or a bracket path. Errors are NA because the cmdlet writes $false for a missing or invalid path; its PathNotFound handler looks unreachable (see the notes).
TestNeeded
ItemCmdlets.Tests.ps1:997-1002 asserts one [bool] with the expected value for file, folder and missing item under all three -PathType values; :1009-1013 asserts no error and 'False,True' for six invalid characters followed by a valid path; :981-983 pipes one FileInfo; :992-1001 covers a folder path over 260 characters.ItemCmdlets.Tests.ps1:1004-1009 asserts one [bool] with the expected value for file, folder and missing item under all three -PathType values; :1009-1013 asserts no error and 'False,True' for six invalid characters followed by a valid path; :981-983 pipes one FileInfo; :992-1001 covers a folder path over 260 characters.
Open
piping several items into -Path; -PathType bound by property name; a drive root; a UNC path; a bracket path
budget (deprioritized: PipelineInput was already Partly, not No, so lower priority than the cmdlets with no pipeline test at all)
58
items
Get-FileHash2
__AllParameterSets
False
12
2
0
13
Partly
Partly
Partly
Partly
Yes
FileHash.Tests.ps1:41 Should return the hash of Get-FileHash for <_> | FileHash.Tests.ps1:94 Should skip the folder and hash the files that follow it | FileHash.Tests.ps1:108 Should write an error and no result for the file | FileHash.Tests.ps1:153 Should report both the failed read and the failed owner restoration without returning a hash
2: SHA256 equals Get-FileHash on a share (delegated account); later-command stop at the verbose message
No test pipes FileInfo/DirectoryInfo objects or folders (documented: Get-ChildItem2 -Recurse | Get-FileHash2) or Algorithm by property name, hashes a relative path or a path over 260 characters, or puts the failing path first and asserts the next hash; no error category is asserted. The owner-restore tests run only elevated and read the owner back with Get-NTFSOwner, and the retry that succeeds after taking ownership is untested.
TestNeeded
FileHash.Tests.ps1:41-44 compares Hash and Algorithm with Get-FileHash for five algorithms; :94-98 skips a folder and hashes the next file with the SHA256 default; :108-115 asserts one error and no result for a locked file; :153-160 (elevated only) asserts RestoreOwnerError and GetHashError with target, no result and the restored owner; OutputTypes.Tests.ps1:57 asserts the type name.
Partly
ParameterSets.Items.Tests.ps1:531 Should accept Get-ChildItem2 objects piped by value, skip a folder, and match Get-FileHash for each file | ParameterSets.Items.Tests.ps1:565 Should write GetHashError with its category for a locked file first, hash the file that follows it, and resolve a relative path
-Algorithm bound by property name from the pipeline; a path over 260 characters; the ownership-retry-after-taking-ownership success path
-Algorithm by property name and >260 chars: budget; ownership-retry success: Limit (elevated-only, needs a DACL/owner setup not shown buildable)
59
items
Get-DiskSpace
__AllParameterSets
False
6
0
0
6
NA
Partly
NA
No
Yes
ItemCmdlets.Tests.ps1:1068 Should return the size of the system drive | ItemCmdlets.Tests.ps1:1086 Should return the volumes with a size greater than zero without -DriveLetter | ItemCmdlets.Tests.ps1:1102 Should warn and return nothing for a drive letter without a volume | ItemCmdlets.Tests.ps1:1110 Should reject a drive letter without a colonItemCmdlets.Tests.ps1:1075 Should return the size of the system drive | ItemCmdlets.Tests.ps1:1093 Should return the volumes with a size greater than zero without -DriveLetter | ItemCmdlets.Tests.ps1:1109 Should warn and return nothing for a drive letter without a volume | ItemCmdlets.Tests.ps1:1117 Should reject a drive letter without a colon
0
No test passes several drive letters, so the documented warn-and-continue for a letter without a volume is never combined with a valid letter; lower-case letters, positional binding and the free-space values against an independent source are unasserted. The validation error is asserted by ErrorId only (no category or target).
TestNeeded
ItemCmdlets.Tests.ps1:1068-1073 asserts type, DriveName and TotalNumberOfBytes against System.IO.DriveInfo; :1072-1077 asserts the exact warning text and no output or error for a letter without a volume; :1056-1061 asserts every volume has a size above zero and the system drive is included; :1080-1081 asserts the ErrorId of the validation error.ItemCmdlets.Tests.ps1:1075-1080 asserts type, DriveName and TotalNumberOfBytes against System.IO.DriveInfo; :1072-1077 asserts the exact warning text and no output or error for a letter without a volume; :1056-1061 asserts every volume has a size above zero and the system drive is included; :1080-1081 asserts the ErrorId of the validation error.
Partly
ParameterSets.Items.Tests.ps1:470 Should return only the system drive and warn for a drive letter without a volume, regardless of order (<Order>) | ParameterSets.Items.Tests.ps1:491 Should accept a lower-case drive letter positionally and report the same total size as .NET
the free-space values (TotalNumberOfFreeBytes/FreeBytesAvailable) against an independent source (only TotalNumberOfBytes was compared); the validation error's category and target (still ErrorId only)
budget (both items)
60
items
New-NTFSHardLink
__AllParameterSets
False
14
2
0
17
Yes
Yes
Yes
Yes
Yes
Links.Tests.ps1:134 Should write a non-terminating error for each link that it cannot create and continue with the next one | Links.Tests.ps1:170 Should write a PermissionDenied error and create no link in a folder that denies new files | Links.Tests.ps1:67 Should return every name of the file with -PassThru | Links.Tests.ps1:79 Should give both names the same data
2: link creation on a share (administrator) and -PassThru, which writes GetHardLinkError there
Positional binding (documented example 2), a FileInfo object bound to -Path or -Target and the end of a pipeline by a later command are untested; the -PassThru GetHardLinkError on a share is asserted by ErrorId only (no category or target) and only with an elevated admin share. A hard link across volumes cannot be built on a one-volume host.
TestNeeded
Links.Tests.ps1:134-145 pipes four objects by property name and asserts three errors (ErrorId, categories, targets, message), the created link and unchanged files; :170-179 asserts PermissionDenied, exception type, no output and no link; :36-41, :67-73 and :79-84 read back existence, all names and the shared data. Three of the 17 call sites (Links.Tests.ps1:450, 468, 494) are '& $Command' calls that the scan does not resolve.
Partly
ParameterSets.Items.Tests.ps1:264 <Command> should reject <CaseName> instead of creating a link to the current folder | ParameterSets.Items.Tests.ps1:324 New-NTFSHardLink should stop after the first pass-through object for Select-Object -First 1 and leave the second request untouched
positional binding (documented example 2); a FileInfo object bound to -Path or -Target; the -PassThru GetHardLinkError category and target on an admin share (still ID only)
budget (all items; an elevated admin share is already available on this host, simply not used for this)
61
items
Get-NTFSHardLink
__AllParameterSets
False
9
1
0
10
NA
Partly
Yes
Yes
Partly
Links.Tests.ps1:224 Should write an error for a path that does not exist and continue with the next path | Links.Tests.ps1:236 Should write an error for a folder and continue with the next path | Links.Tests.ps1:214 Should take the files with more than one name from Get-ChildItem2 | Links.Tests.ps1:200 Should return every name of a file with hard links
1: writes GetHardLinkError on a share (administrator)
The output type is never asserted (only FullName and Mode), the error categories (InvalidArgument for a folder, ObjectNotFound, ReadError on a share) are unasserted, and positional binding and strings from the pipeline are untested. The UnauthorizedAccessException handler cannot be reached by a test because Windows lists the names without opening the file (Links.Tests.ps1:262).
TestNeeded
Links.Tests.ps1:224-229 and :236-243 assert one error (FileNotFound; GetHardLinkError with target and message) and exactly the next file; :214-218 pipes AlphaFS file objects and asserts the names of both linked files and not the third; :200-203 asserts all names of a linked file; PathErrors.Tests.ps1:108-114 asserts ID and target for a missing path.
Partly
ParameterSets.Items.Tests.ps1:297 Should accept piped strings by value, write errors with their categories for a folder and a missing path, and return the files in order
the ReadError category on a network share (still ID/target only); the UnauthorizedAccessException handler
ReadError on a share: budget (admin share available elevated, not implemented here); UnauthorizedAccessException handler: Limit (structurally unreachable, Windows lists hard-link names without opening the file)
62
items
New-NTFSSymbolicLink
__AllParameterSets
False
12
2
0
15
Yes
Yes
Yes
Partly
Yes
Links.Tests.ps1:297 Should create a link to a file that reads the data of the file | Links.Tests.ps1:387 Should write a non-terminating error for an existing -Path and continue with the next link | Links.Tests.ps1:420 Should write a PermissionDenied error and create no link in a folder that denies new files | Links.Tests.ps1:335 Should return a folder object for a link to a folder with -PassThru
2: link to a file and to a folder on a share (administrator); asserts no error only
No test creates a link after a failed one in a pipeline (every piped request fails so that the tests run without the privilege), and a link to a folder is checked only for the Directory attribute and reachability through Test-Path2, not for LinkType and target. The success paths run only with SeCreateSymbolicLinkPrivilege; positional binding and an empty -Target (the value that meant the current folder before rc7, while the tests check only the Mandatory metadata) are untested.
TestNeeded
Links.Tests.ps1:297-302 reads back LinkType, target and data of a file link; :387-393 pipes two objects by property name and asserts two errors (ErrorId, categories) and that no link exists; :420-429 asserts PermissionDenied, exception type and no output; :323-339 assert FileInfo and DirectoryInfo with -PassThru.
Partly
ParameterSets.Items.Tests.ps1:264 <Command> should reject <CaseName> instead of creating a link to the current folder | ParameterSets.Items.Tests.ps1:343 New-NTFSSymbolicLink should stop after the first pass-through object for Select-Object -First 1 and leave the second request untouched | ParameterSets.Items.Tests.ps1:367 Should write one ResourceExists error for an existing -Path and still create the links for the requests that follow it
positional binding; the folder link's LinkType and resolved target (only the file link's LinkType was asserted)
"Live suite, matrix cell OSFile22 with OSWin11E (mx1, instrumented)","PowerShell 7, four roles","229","0","2","231","live-matrix\mx1-OSFile22\mx1-OSFile22-counts.csv"
"Live suite, matrix cell OSFile25 with OSWin11E (mx1, instrumented)","Windows PowerShell 5.1, four roles","229","0","2","231","live-matrix\mx1-OSFile25\mx1-OSFile25-counts.csv"
"Live suite, matrix cell OSFile25 with OSWin11E (mx1, instrumented)","PowerShell 7, four roles","229","0","2","231","live-matrix\mx1-OSFile25\mx1-OSFile25-counts.csv"
"Live suite, matrix cell OSFile19 with OSWin11E (mxf, final build of 8a625c8, not instrumented)","Windows PowerShell 5.1, four roles","229","0","2","231","live-matrix-final\mxf-OSFile19\mxf-OSFile19-counts.csv"
"Live suite, matrix cell OSFile19 with OSWin11E (mxf, final build of 8a625c8, not instrumented)","PowerShell 7, four roles","229","0","2","231","live-matrix-final\mxf-OSFile19\mxf-OSFile19-counts.csv"
"Live suite, matrix cell OSFile22 with OSWin11E (mxf, final build of 8a625c8, not instrumented)","Windows PowerShell 5.1, four roles","229","0","2","231","live-matrix-final\mxf-OSFile22\mxf-OSFile22-counts.csv"
"Live suite, matrix cell OSFile22 with OSWin11E (mxf, final build of 8a625c8, not instrumented)","PowerShell 7, four roles","229","0","2","231","live-matrix-final\mxf-OSFile22\mxf-OSFile22-counts.csv"
"Live suite, matrix cell OSFile25 with OSWin11E (mxf, final build of 8a625c8, not instrumented)","Windows PowerShell 5.1, four roles","229","0","2","231","live-matrix-final\mxf-OSFile25\mxf-OSFile25-counts.csv"
"Live suite, matrix cell OSFile25 with OSWin11E (mxf, final build of 8a625c8, not instrumented)","PowerShell 7, four roles","229","0","2","231","live-matrix-final\mxf-OSFile25\mxf-OSFile25-counts.csv"
"Live suite, matrix cell OSFile19 with OSWin11E (ap8, final package of 7bc7925 with the DLLs of 9783d2a, not instrumented)","Windows PowerShell 5.1, four roles","229","0","2","231","live-matrix-ap8\ap8-OSFile19\ap8-OSFile19-counts.csv"
"Live suite, matrix cell OSFile19 with OSWin11E (ap8, final package of 7bc7925 with the DLLs of 9783d2a, not instrumented)","PowerShell 7, four roles","229","0","2","231","live-matrix-ap8\ap8-OSFile19\ap8-OSFile19-counts.csv"
"Live suite, matrix cell OSFile22 with OSWin11E (ap8, final package of 7bc7925 with the DLLs of 9783d2a, not instrumented)","Windows PowerShell 5.1, four roles","229","0","2","231","live-matrix-ap8\ap8-OSFile22\ap8-OSFile22-counts.csv"
"Live suite, matrix cell OSFile22 with OSWin11E (ap8, final package of 7bc7925 with the DLLs of 9783d2a, not instrumented)","PowerShell 7, four roles","229","0","2","231","live-matrix-ap8\ap8-OSFile22\ap8-OSFile22-counts.csv"
"Live suite, matrix cell OSFile25 with OSWin11E (ap8, final package of 7bc7925 with the DLLs of 9783d2a, not instrumented)","Windows PowerShell 5.1, four roles","229","0","2","231","live-matrix-ap8\ap8-OSFile25\ap8-OSFile25-counts.csv"
"Live suite, matrix cell OSFile25 with OSWin11E (ap8, final package of 7bc7925 with the DLLs of 9783d2a, not instrumented)","PowerShell 7, four roles","229","0","2","231","live-matrix-ap8\ap8-OSFile25\ap8-OSFile25-counts.csv"
"Final validate (b2cb47b, host)","Windows PowerShell 5.1, elevated","1429","0","26","1455","final\validate\elevated-Desktop.xml"
"Final validate (b2cb47b, host)","Windows PowerShell 5.1, basic user","1179","0","276","1455","final\validate\basic-Desktop.xml"
"Final validate (b2cb47b, host)","PowerShell 7, elevated","1398","0","57","1455","final\validate\elevated-Core.xml"
@ -47,12 +59,83 @@
"Final coverage (61e936e, host)","Windows PowerShell 5.1, basic user","1183","0","276","1459","final5\coverage\basic-Desktop.xml"
"Final coverage (61e936e, host)","PowerShell 7, elevated","1402","0","57","1459","final5\coverage\elevated-Core.xml"
"Final coverage (61e936e, host)","PowerShell 7, basic user","1152","0","307","1459","final5\coverage\basic-Core.xml"
"Final validate (93ed2c7, host)","Windows PowerShell 5.1, elevated","1452","0","26","1478","final6\validate\elevated-Desktop.xml"
"Final validate (93ed2c7, host)","Windows PowerShell 5.1, basic user","1194","0","284","1478","final6\validate\basic-Desktop.xml"
"Final validate (93ed2c7, host)","PowerShell 7, elevated","1421","0","57","1478","final6\validate\elevated-Core.xml"
"Final validate (93ed2c7, host)","PowerShell 7, basic user","1163","0","315","1478","final6\validate\basic-Core.xml"
"Final coverage (93ed2c7, host)","Windows PowerShell 5.1, elevated","1452","0","26","1478","final6\coverage\elevated-Desktop.xml"
"Final coverage (93ed2c7, host)","Windows PowerShell 5.1, basic user","1194","0","284","1478","final6\coverage\basic-Desktop.xml"
"Final coverage (93ed2c7, host)","PowerShell 7, elevated","1421","0","57","1478","final6\coverage\elevated-Core.xml"
"Final coverage (93ed2c7, host)","PowerShell 7, basic user","1163","0","315","1478","final6\coverage\basic-Core.xml"
"Final validate (9783d2a, host)","Windows PowerShell 5.1, elevated","1464","0","26","1490","final7\validate\elevated-Desktop.xml"
"Final validate (9783d2a, host)","Windows PowerShell 5.1, basic user","1200","0","290","1490","final7\validate\basic-Desktop.xml"
"Final validate (9783d2a, host)","PowerShell 7, elevated","1433","0","57","1490","final7\validate\elevated-Core.xml"
"Final validate (9783d2a, host)","PowerShell 7, basic user","1169","0","321","1490","final7\validate\basic-Core.xml"
"Final coverage (9783d2a, host)","Windows PowerShell 5.1, elevated","1464","0","26","1490","final7\coverage\elevated-Desktop.xml"
"Final coverage (9783d2a, host)","Windows PowerShell 5.1, basic user","1200","0","290","1490","final7\coverage\basic-Desktop.xml"
"Final coverage (9783d2a, host)","PowerShell 7, elevated","1433","0","57","1490","final7\coverage\elevated-Core.xml"
"Final coverage (9783d2a, host)","PowerShell 7, basic user","1169","0","321","1490","final7\coverage\basic-Core.xml"
"Final validate (7bc7925, host)","Windows PowerShell 5.1, elevated","1466","0","26","1492","final8\validate\elevated-Desktop.xml"
"Final validate (7bc7925, host)","Windows PowerShell 5.1, basic user","1201","0","291","1492","final8\validate\basic-Desktop.xml"
"Final validate (7bc7925, host)","PowerShell 7, elevated","1435","0","57","1492","final8\validate\elevated-Core.xml"
"Final validate (7bc7925, host)","PowerShell 7, basic user","1170","0","322","1492","final8\validate\basic-Core.xml"
"Final coverage (7bc7925, host)","Windows PowerShell 5.1, elevated","1466","0","26","1492","final8\coverage\elevated-Desktop.xml"
"Final coverage (7bc7925, host)","Windows PowerShell 5.1, basic user","1201","0","291","1492","final8\coverage\basic-Desktop.xml"
"Final coverage (7bc7925, host)","PowerShell 7, elevated","1435","0","57","1492","final8\coverage\elevated-Core.xml"
"Final coverage (7bc7925, host)","PowerShell 7, basic user","1170","0","322","1492","final8\coverage\basic-Core.xml"
"Final validate (2112ee3, host)","Windows PowerShell 5.1, elevated","1466","0","26","1492","final9\validate\elevated-Desktop.xml"
"Final validate (2112ee3, host)","Windows PowerShell 5.1, basic user","1201","0","291","1492","final9\validate\basic-Desktop.xml"
"Final validate (2112ee3, host)","PowerShell 7, elevated","1435","0","57","1492","final9\validate\elevated-Core.xml"
"Final validate (2112ee3, host)","PowerShell 7, basic user","1170","0","322","1492","final9\validate\basic-Core.xml"
"Final coverage (2112ee3, host)","Windows PowerShell 5.1, elevated","1466","0","26","1492","final9\coverage\elevated-Desktop.xml"
"Final coverage (2112ee3, host)","Windows PowerShell 5.1, basic user","1201","0","291","1492","final9\coverage\basic-Desktop.xml"
"Final coverage (2112ee3, host)","PowerShell 7, elevated","1435","0","57","1492","final9\coverage\elevated-Core.xml"
"Final coverage (2112ee3, host)","PowerShell 7, basic user","1170","0","322","1492","final9\coverage\basic-Core.xml"
"Focused: the two ParameterSets files on the build before the fix (tdd3red2, red)","PowerShell 7, basic user","38","8","29","75","tdd3\tdd3red2-basiccore.log"
"Focused: the two ParameterSets files on the build before the fix (tdd3red2, red)","Windows PowerShell 5.1, basic user","38","8","29","75","tdd3\tdd3red2-basicdesktop.log"
"Focused: the two ParameterSets files on the build before the fix (tdd3red2, red)","PowerShell 7, elevated","62","12","1","75","tdd3\tdd3red2-elevatedcore.log"
"Focused: the two ParameterSets files on the build before the fix (tdd3red2, red)","Windows PowerShell 5.1, elevated","62","12","1","75","tdd3\tdd3red2-elevateddesktop.log"
"Focused: the two files and the Items file on 93ed2c7 (tdd3green, green)","PowerShell 7, basic user","173","0","36","209","tdd3\tdd3green-basiccore.log"
"Focused: the two files and the Items file on 93ed2c7 (tdd3green, green)","Windows PowerShell 5.1, basic user","174","0","35","209","tdd3\tdd3green-basicdesktop.log"
"Focused: the two files and the Items file on 93ed2c7 (tdd3green, green)","PowerShell 7, elevated","207","0","2","209","tdd3\tdd3green-elevatedcore.log"
"Focused: the two files and the Items file on 93ed2c7 (tdd3green, green)","Windows PowerShell 5.1, elevated","208","0","1","209","tdd3\tdd3green-elevateddesktop.log"
"Focused: the two files with the mixed-pipeline rows on 93ed2c7 (tdd4red2, red)","PowerShell 7, basic user","48","4","35","87","tdd4\tdd4red2-basiccore.log"
"Focused: the two files with the mixed-pipeline rows on 93ed2c7 (tdd4red2, red)","Windows PowerShell 5.1, basic user","48","4","35","87","tdd4\tdd4red2-basicdesktop.log"
"Focused: the two files with the mixed-pipeline rows on 93ed2c7 (tdd4red2, red)","PowerShell 7, elevated","78","8","1","87","tdd4\tdd4red2-elevatedcore.log"
"Focused: the two files with the mixed-pipeline rows on 93ed2c7 (tdd4red2, red)","Windows PowerShell 5.1, elevated","78","8","1","87","tdd4\tdd4red2-elevateddesktop.log"
"Focused: the three files on 9783d2a (tdd4green, green)","PowerShell 7, basic user","179","0","42","221","tdd4\tdd4green-basiccore.log"
"Focused: the three files on 9783d2a (tdd4green, green)","Windows PowerShell 5.1, basic user","180","0","41","221","tdd4\tdd4green-basicdesktop.log"
"Focused: the three files on 9783d2a (tdd4green, green)","PowerShell 7, elevated","219","0","2","221","tdd4\tdd4green-elevatedcore.log"
"Focused: the three files on 9783d2a (tdd4green, green)","Windows PowerShell 5.1, elevated","220","0","1","221","tdd4\tdd4green-elevateddesktop.log"
"Focused: the two files with the Import-Csv and $null rows on the build before the fix, 8a625c8 (tdd5red, red)","PowerShell 7, basic user","38","15","36","89","tdd5red\logs\tdd5red-basiccore.log"
"Focused: the two files with the Import-Csv and $null rows on the build before the fix, 8a625c8 (tdd5red, red)","Windows PowerShell 5.1, basic user","38","15","36","89","tdd5red\logs\tdd5red-basicdesktop.log"
"Focused: the two files with the Import-Csv and $null rows on the build before the fix, 8a625c8 (tdd5red, red)","PowerShell 7, elevated","62","26","1","89","tdd5red\logs\tdd5red-elevatedcore.log"
"Focused: the two files with the Import-Csv and $null rows on the build before the fix, 8a625c8 (tdd5red, red)","Windows PowerShell 5.1, elevated","62","26","1","89","tdd5red\logs\tdd5red-elevateddesktop.log"
"Focused: the two files with the Import-Csv and $null rows on 93ed2c7 (tdd5red93, red)","PowerShell 7, basic user","48","5","36","89","tdd5red93\logs\tdd5red93-basiccore.log"
"Focused: the two files with the Import-Csv and $null rows on 93ed2c7 (tdd5red93, red)","Windows PowerShell 5.1, basic user","48","5","36","89","tdd5red93\logs\tdd5red93-basicdesktop.log"
"Focused: the two files with the Import-Csv and $null rows on 93ed2c7 (tdd5red93, red)","PowerShell 7, elevated","78","10","1","89","tdd5red93\logs\tdd5red93-elevatedcore.log"
"Focused: the two files with the Import-Csv and $null rows on 93ed2c7 (tdd5red93, red)","Windows PowerShell 5.1, elevated","78","10","1","89","tdd5red93\logs\tdd5red93-elevateddesktop.log"
"Focused: the two files with the Import-Csv and $null rows on 9783d2a (tdd5, green)","PowerShell 7, basic user","53","0","36","89","tdd5\tdd5-basiccore.log"
"Focused: the two files with the Import-Csv and $null rows on 9783d2a (tdd5, green)","Windows PowerShell 5.1, basic user","53","0","36","89","tdd5\tdd5-basicdesktop.log"
"Focused: the two files with the Import-Csv and $null rows on 9783d2a (tdd5, green)","PowerShell 7, elevated","88","0","1","89","tdd5\tdd5-elevatedcore.log"
"Focused: the two files with the Import-Csv and $null rows on 9783d2a (tdd5, green)","Windows PowerShell 5.1, elevated","88","0","1","89","tdd5\tdd5-elevateddesktop.log"
"Focused: the two files of 2112ee3, three audit titles changed, on the package of 9783d2a (tdd6, green)","PowerShell 7, basic user","53","0","36","89","tdd6\tdd6-basiccore.log"
"Focused: the two files of 2112ee3, three audit titles changed, on the package of 9783d2a (tdd6, green)","Windows PowerShell 5.1, basic user","53","0","36","89","tdd6\tdd6-basicdesktop.log"
"Focused: the two files of 2112ee3, three audit titles changed, on the package of 9783d2a (tdd6, green)","PowerShell 7, elevated","88","0","1","89","tdd6\tdd6-elevatedcore.log"
"Focused: the two files of 2112ee3, three audit titles changed, on the package of 9783d2a (tdd6, green)","Windows PowerShell 5.1, elevated","88","0","1","89","tdd6\tdd6-elevateddesktop.log"
"Focused: Items file, mutation B of GetChildItem2 (item written inside the scope)","Windows PowerShell 5.1, elevated","130","4","0","134","tdd3\mutB-elevateddesktop.log"
"Focused: Items file, mutation A of GetChildItem2 (culture not restored)","PowerShell 7, elevated","129","4","1","134","tdd3\mutA2-elevatedcore.log"
"Focused: Items file, mutation A of GetChildItem2 (culture not restored)","Windows PowerShell 5.1, elevated","130","4","0","134","tdd3\mutA2-elevateddesktop.log"
"Focused: Items file, mutation C of GetChildItem2 (culture restored only after an item)","PowerShell 7, elevated","129","4","1","134","tdd4\mutC-elevatedcore.log"
"Focused: Items file, mutation C of GetChildItem2 (culture restored only after an item)","Windows PowerShell 5.1, elevated","130","4","0","134","tdd4\mutC-elevateddesktop.log"
"Live suite, first lab, build of b2cb47b (fix1, not instrumented)","Windows PowerShell 5.1, four roles","245","0","1","246","live-fix1\fix1-Desktop-counts.csv"
"Live suite, first lab, build of b2cb47b (fix1, not instrumented)","PowerShell 7, four roles","245","0","1","246","live-fix1\fix1-Core-counts.csv"
"Live suite, first lab, intermediate build of 0028ccd (fix3, not instrumented)","Windows PowerShell 5.1, four roles","245","0","1","246","live-fix3\fix3-Desktop-counts.csv"
"Live suite, first lab, intermediate build of 0028ccd (fix3, not instrumented)","PowerShell 7, four roles","245","0","1","246","live-fix3\fix3-Core-counts.csv"
"Live suite, first lab, final build of 8a625c8 (fix4, not instrumented)","Windows PowerShell 5.1, four roles","245","0","1","246","live-fix4\fix4-Desktop-counts.csv"
"Live suite, first lab, final build of 8a625c8 (fix4, not instrumented)","PowerShell 7, four roles","245","0","1","246","live-fix4\fix4-Core-counts.csv"
"Live suite, first lab, final build of 9783d2a (acc-ap7, not instrumented)","Windows PowerShell 5.1, four roles","245","0","1","246","live-ap7\acc-ap7-Desktop-counts.csv"
"Live suite, first lab, final build of 9783d2a (acc-ap7, not instrumented)","PowerShell 7, four roles","245","0","1","246","live-ap7\acc-ap7-Core-counts.csv"
"Unit suite on the file servers (fix1, 22 files, tests of b2cb47b)","OSFile25, PowerShell 7, basic user","881","0","271","1152","localsuite-final\fix1-localsuite-summary.csv"
"Unit suite on the file servers (fix1, 22 files, tests of b2cb47b)","OSFile25, PowerShell 7, elevated","1130","1","21","1152","localsuite-final\fix1-localsuite-summary.csv"
"Unit suite on the file servers (fix1, 22 files, tests of b2cb47b)","OSFile25, Windows PowerShell 5.1, basic user","883","0","269","1152","localsuite-final\fix1-localsuite-summary.csv"
@ -119,3 +202,31 @@
"Unit suite on the Windows 11 client (fix5c, 22 files, final build and tests of 61e936e)","OSWin11, PowerShell 7, elevated","1135","0","21","1156","localsuite-final5-client\fix5c-localsuite-summary.csv"
"Unit suite on the Windows 11 client (fix5c, 22 files, final build and tests of 61e936e)","OSWin11, Windows PowerShell 5.1, basic user","887","0","269","1156","localsuite-final5-client\fix5c-localsuite-summary.csv"
"Unit suite on the Windows 11 client (fix5c, 22 files, final build and tests of 61e936e)","OSWin11, Windows PowerShell 5.1, elevated","1137","0","19","1156","localsuite-final5-client\fix5c-localsuite-summary.csv"
"Unit suite on the file servers (s-ap6, 22 files, build and tests of 93ed2c7; the chain was stopped, the stage ran on)","OSFile25, PowerShell 7, basic user","896","0","279","1175","localsuite-ap6\s-ap6-localsuite-summary.csv"
"Unit suite on the file servers (s-ap6, 22 files, build and tests of 93ed2c7; the chain was stopped, the stage ran on)","OSFile25, PowerShell 7, elevated","1154","0","21","1175","localsuite-ap6\s-ap6-localsuite-summary.csv"
"Unit suite on the file servers (s-ap6, 22 files, build and tests of 93ed2c7; the chain was stopped, the stage ran on)","OSFile25, Windows PowerShell 5.1, basic user","898","0","277","1175","localsuite-ap6\s-ap6-localsuite-summary.csv"
"Unit suite on the file servers (s-ap6, 22 files, build and tests of 93ed2c7; the chain was stopped, the stage ran on)","OSFile25, Windows PowerShell 5.1, elevated","1156","0","19","1175","localsuite-ap6\s-ap6-localsuite-summary.csv"
"Unit suite on the file servers (s-ap6, 22 files, build and tests of 93ed2c7; the chain was stopped, the stage ran on)","OSFile19, PowerShell 7, basic user","896","0","279","1175","localsuite-ap6\s-ap6-localsuite-summary.csv"
"Unit suite on the file servers (s-ap6, 22 files, build and tests of 93ed2c7; the chain was stopped, the stage ran on)","OSFile19, PowerShell 7, elevated","1154","0","21","1175","localsuite-ap6\s-ap6-localsuite-summary.csv"
"Unit suite on the file servers (s-ap6, 22 files, build and tests of 93ed2c7; the chain was stopped, the stage ran on)","OSFile19, Windows PowerShell 5.1, basic user","898","0","277","1175","localsuite-ap6\s-ap6-localsuite-summary.csv"
"Unit suite on the file servers (s-ap6, 22 files, build and tests of 93ed2c7; the chain was stopped, the stage ran on)","OSFile19, Windows PowerShell 5.1, elevated","1156","0","19","1175","localsuite-ap6\s-ap6-localsuite-summary.csv"
"Unit suite on the file servers (s-ap6, 22 files, build and tests of 93ed2c7; the chain was stopped, the stage ran on)","OSFile22, PowerShell 7, basic user","896","0","279","1175","localsuite-ap6\s-ap6-localsuite-summary.csv"
"Unit suite on the file servers (s-ap6, 22 files, build and tests of 93ed2c7; the chain was stopped, the stage ran on)","OSFile22, PowerShell 7, elevated","1154","0","21","1175","localsuite-ap6\s-ap6-localsuite-summary.csv"
"Unit suite on the file servers (s-ap6, 22 files, build and tests of 93ed2c7; the chain was stopped, the stage ran on)","OSFile22, Windows PowerShell 5.1, basic user","898","0","277","1175","localsuite-ap6\s-ap6-localsuite-summary.csv"
"Unit suite on the file servers (s-ap6, 22 files, build and tests of 93ed2c7; the chain was stopped, the stage ran on)","OSFile22, Windows PowerShell 5.1, elevated","1156","0","19","1175","localsuite-ap6\s-ap6-localsuite-summary.csv"
"Unit suite on the file servers (s-ap8, 22 files, final package and tests of 7bc7925)","OSFile25, PowerShell 7, basic user","903","0","286","1189","localsuite-ap8\s-ap8-localsuite-summary.csv"
"Unit suite on the file servers (s-ap8, 22 files, final package and tests of 7bc7925)","OSFile25, PowerShell 7, elevated","1168","0","21","1189","localsuite-ap8\s-ap8-localsuite-summary.csv"
"Unit suite on the file servers (s-ap8, 22 files, final package and tests of 7bc7925)","OSFile25, Windows PowerShell 5.1, basic user","905","0","284","1189","localsuite-ap8\s-ap8-localsuite-summary.csv"
"Unit suite on the file servers (s-ap8, 22 files, final package and tests of 7bc7925)","OSFile25, Windows PowerShell 5.1, elevated","1170","0","19","1189","localsuite-ap8\s-ap8-localsuite-summary.csv"
"Unit suite on the file servers (s-ap8, 22 files, final package and tests of 7bc7925)","OSFile19, PowerShell 7, basic user","903","0","286","1189","localsuite-ap8\s-ap8-localsuite-summary.csv"
"Unit suite on the file servers (s-ap8, 22 files, final package and tests of 7bc7925)","OSFile19, PowerShell 7, elevated","1168","0","21","1189","localsuite-ap8\s-ap8-localsuite-summary.csv"
"Unit suite on the file servers (s-ap8, 22 files, final package and tests of 7bc7925)","OSFile19, Windows PowerShell 5.1, basic user","905","0","284","1189","localsuite-ap8\s-ap8-localsuite-summary.csv"
"Unit suite on the file servers (s-ap8, 22 files, final package and tests of 7bc7925)","OSFile19, Windows PowerShell 5.1, elevated","1170","0","19","1189","localsuite-ap8\s-ap8-localsuite-summary.csv"
"Unit suite on the file servers (s-ap8, 22 files, final package and tests of 7bc7925)","OSFile22, PowerShell 7, basic user","903","0","286","1189","localsuite-ap8\s-ap8-localsuite-summary.csv"
"Unit suite on the file servers (s-ap8, 22 files, final package and tests of 7bc7925)","OSFile22, PowerShell 7, elevated","1168","0","21","1189","localsuite-ap8\s-ap8-localsuite-summary.csv"
"Unit suite on the file servers (s-ap8, 22 files, final package and tests of 7bc7925)","OSFile22, Windows PowerShell 5.1, basic user","905","0","284","1189","localsuite-ap8\s-ap8-localsuite-summary.csv"
"Unit suite on the file servers (s-ap8, 22 files, final package and tests of 7bc7925)","OSFile22, Windows PowerShell 5.1, elevated","1170","0","19","1189","localsuite-ap8\s-ap8-localsuite-summary.csv"
"Unit suite on the Windows 11 client (sc-ap8, 22 files, final package and tests of 7bc7925)","OSWin11, PowerShell 7, basic user","903","0","286","1189","localsuite-ap8-client\sc-ap8-localsuite-summary.csv"
"Unit suite on the Windows 11 client (sc-ap8, 22 files, final package and tests of 7bc7925)","OSWin11, PowerShell 7, elevated","1168","0","21","1189","localsuite-ap8-client\sc-ap8-localsuite-summary.csv"
"Unit suite on the Windows 11 client (sc-ap8, 22 files, final package and tests of 7bc7925)","OSWin11, Windows PowerShell 5.1, basic user","905","0","284","1189","localsuite-ap8-client\sc-ap8-localsuite-summary.csv"
"Unit suite on the Windows 11 client (sc-ap8, 22 files, final package and tests of 7bc7925)","OSWin11, Windows PowerShell 5.1, elevated","1170","0","19","1189","localsuite-ap8-client\sc-ap8-localsuite-summary.csv"
1
Run
Configuration
Passed
Failed
Skipped
Total
Source
23
Live suite, matrix cell OSFile22 with OSWin11E (mx1, instrumented)
PowerShell 7, four roles
229
0
2
231
live-matrix\mx1-OSFile22\mx1-OSFile22-counts.csv
24
Live suite, matrix cell OSFile25 with OSWin11E (mx1, instrumented)
Windows PowerShell 5.1, four roles
229
0
2
231
live-matrix\mx1-OSFile25\mx1-OSFile25-counts.csv
25
Live suite, matrix cell OSFile25 with OSWin11E (mx1, instrumented)
PowerShell 7, four roles
229
0
2
231
live-matrix\mx1-OSFile25\mx1-OSFile25-counts.csv
26
Live suite, matrix cell OSFile19 with OSWin11E (mxf, final build of 8a625c8, not instrumented)
Raimund Andree
3 weeks ago