Release v2.3.0: add DSInternals version check and auto-update

Test-WeakADPasswords.ps1 now validates the installed DSInternals
version at startup:
- v6.2 (unsigned) warns that native DLLs are blocked and replication
  will fail; directs operator to Update-Module DSInternals.
- Below v7.0 prompts to auto-update via Update-Module -Force and
  exits cleanly so the new version is loaded on re-run.
- v7.0+ passes silently.

All versions bumped to unified v2.3.0.

Bump-Version.ps1

@@ -8,7 +8,7 @@
 ##################################################
 ## Project: Elysium                             ##
 ## File: Bump-Version.ps1                       ##
-## Version: 2.2.4                               ##
+## Version: 2.3.0                               ##
 ## Support: support@cqre.net                    ##
 ##################################################
 

CHANGELOG.md

@@ -6,6 +6,23 @@ Starting with **v2.2.0**, Elysium uses a **unified project version**. All script
 
 ---
 
+## [2.3.0] — 2026-06-09
+
+### Added
+- `Test-WeakADPasswords.ps1` now checks the installed DSInternals version at startup:
+  - **v6.2** (unsigned) is flagged with a warning explaining that unsigned native DLLs are blocked and replication will fail. Remediation: `Update-Module DSInternals`.
+  - **Below v7.0** triggers an interactive prompt offering to run `Update-Module DSInternals -Force` automatically. If accepted, the script updates the module and exits cleanly so the operator can re-run with the new version loaded.
+  - v7.0+ is required because it fixes intermittent CRC errors mid-replication and `Test-PasswordQuality` result truncation bugs.
+
+---
+
+## [2.2.5] — 2026-06-09
+
+### Fixed
+- The DSInternals `Zone.Identifier` block error message (added in v2.2.4) now dynamically resolves the actual DSInternals module path via `Get-Module` instead of hardcoding `$env:ProgramFiles\WindowsPowerShell\DSInternals`. The `Unblock-File` command in the error now points to the correct installation directory.
+
+---
+
 ## [2.2.4] — 2026-06-09
 
 ### Fixed

Elysium.Common.ps1

@@ -1,4 +1,4 @@
-$script:ElysiumVersion = '2.2.4'
+$script:ElysiumVersion = '2.3.0'
 
 function Invoke-RestartWithExecutable {
     param(

Elysium.ps1

@@ -7,7 +7,7 @@
 ##################################################
 ## Project: Elysium                             ##
 ## File: Elysium.ps1                            ##
-## Version: 2.2.4                               ##
+## Version: 2.3.0                               ##
 ## Support: support@cqre.net                    ##
 ##################################################
 

ElysiumSettings.txt.sample

@@ -8,7 +8,7 @@
 ##################################################
 ## Project: Elysium                             ##
 ## File: ElysiumSettings.txt                    ##
-## Version: 2.2.4                               ##
+## Version: 2.3.0                               ##
 ## Support: support@cqre.net                    ##
 ##################################################
 

Extract-NTHashes.ps1

@@ -7,7 +7,7 @@
 ##################################################
 ## Project: Elysium                             ##
 ## File: Extract-NTHashes.ps1                   ##
-## Version: 2.2.4                               ##
+## Version: 2.3.0                               ##
 ## Support: support@cqre.net                    ##
 ##################################################
 

Prepare-KHDBStorage.ps1

@@ -7,7 +7,7 @@
 ##################################################
 ## Project: Elysium                             ##
 ## File: Prepare-KHDBStorage.ps1                ##
-## Version: 2.2.4                               ##
+## Version: 2.3.0                               ##
 ## Support: support@cqre.net                    ##
 ##################################################
 

Test-WeakADPasswords.ps1

@@ -8,7 +8,7 @@
 ##################################################
 ## Project: Elysium                             ##
 ## File: Test-WeakADPasswords.ps1               ##
-## Version: 2.2.4                               ##
+## Version: 2.3.0                               ##
 ## Support: support@cqre.net                    ##
 ##################################################
 
@@ -354,7 +354,10 @@ function Import-CompatModule {
         if ($nonFipsErrors.Count -gt 0) {
             $nonFipsMsg = $nonFipsErrors[0].Exception.Message
             if ($nonFipsMsg -match 'Zone\.Identifier|alternate data stream') {
-                throw ("DSInternals native DLL is blocked by Windows (Zone.Identifier). Run the following on the target machine and retry:`n  Get-ChildItem -Path '$env:ProgramFiles\WindowsPowerShell\DSInternals' -Recurse | Unblock-File")
+                $dsModule = Get-Module -Name DSInternals -ErrorAction SilentlyContinue
+                if (-not $dsModule) { $dsModule = Get-Module -ListAvailable -Name DSInternals -ErrorAction SilentlyContinue | Select-Object -First 1 }
+                $dsPath = if ($dsModule) { $dsModule.ModuleBase } else { '<DSInternals module path>' }
+                throw ("DSInternals native DLL is blocked by Windows (Zone.Identifier). Run the following on the target machine and retry:`n  Get-ChildItem -Path '$dsPath' -Recurse | Unblock-File")
             }
             Write-Warning ("DSInternals import reported non-fatal warning(s): {0}" -f $nonFipsMsg)
         }
@@ -389,6 +392,26 @@ try {
     }
 }
 
+# Version check: v6.2 was unsigned (blocks native DLLs, causes replication failures);
+# v7.0 fixes intermittent CRC errors mid-replication and Test-PasswordQuality result truncation.
+$dsInternalsVersion = (Get-Module -Name DSInternals).Version
+$minimumVersion = [version]'7.0'
+$unsignedVersion = [version]'6.2'
+if ($dsInternalsVersion -eq $unsignedVersion) {
+    Write-Warning ("DSInternals {0} is not digitally signed, which blocks its native DLLs and causes replication failures. Update to v7.0+: Update-Module DSInternals" -f $dsInternalsVersion)
+} elseif ($dsInternalsVersion -lt $minimumVersion) {
+    $resp = Read-Host ("DSInternals {0} is installed; v7.0 fixes intermittent replication CRC errors and result truncation. Update now? [Y/N]" -f $dsInternalsVersion)
+    if ($resp -match '^(?i:y|yes)$') {
+        try {
+            Update-Module -Name DSInternals -Force -ErrorAction Stop
+            Write-Host '[+] DSInternals updated. Please re-run the script to load the new version.'
+            exit 0
+        } catch {
+            Write-Warning ("DSInternals update failed: {0}" -f $_.Exception.Message)
+        }
+    }
+}
+
 # Resolve KHDB path with fallbacks
 $installationPath = $ElysiumSettings["InstallationPath"]
 if ([string]::IsNullOrWhiteSpace($installationPath)) { $installationPath = $scriptRoot }

Uninstall.ps1

@@ -7,7 +7,7 @@
 ##################################################
 ## Project: Elysium                             ##
 ## File: Uninstall.ps1                          ##
-## Version: 2.2.4                               ##
+## Version: 2.3.0                               ##
 ## Support: support@cqre.net                    ##
 ##################################################
 

Update-KHDB.ps1

@@ -7,7 +7,7 @@
 ##################################################
 ## Project: Elysium                             ##
 ## File: Update-KHDB.ps1                        ##
-## Version: 2.2.4                               ##
+## Version: 2.3.0                               ##
 ## Support: support@cqre.net                    ##
 ##################################################
 

Update-LithnetStore.ps1

@@ -7,7 +7,7 @@
 ##################################################
 ## Project: Elysium                             ##
 ## File: Update-LithnetStore.ps1                ##
-## Version: 2.2.4                               ##
+## Version: 2.3.0                               ##
 ## Support: support@cqre.net                    ##
 ##################################################