Implementing PSRemoting at Devolutions: Lessons Learned - Marc-André Moreau - PSConfEU 2026

PowerShell Conference EU June 1-4, 2026 Dorint Pallas Wiesbaden https://github.com/psconfeu/2026 (slides, code) Marc-André Moreau introduces the session as a discussion of lessons learned while implementing PowerShell remoting in Devolutions products. He explains that the company has had to make PowerShell work in several different ways, using multiple approaches across languages and platforms. He also briefly introduces his background and gives an overview of Devolutions’ products, including Remote Desktop Manager, Devolutions Gateway, PowerShell Universal and Uniget UI. He then outlines the main topics of the talk: launching interactive PowerShell sessions, PowerShell remoting over SSH, using the PowerShell SDK, local PowerShell remoting, and PowerShell remoting in the browser. He describes Remote Desktop Manager as a connection manager where the user selects a host and credentials, then connects directly, which requires secure credential injection. For embedded terminals, Marc explains how the classic console host could be reparented into the application window, but required manual sizing. He then describes the changes needed for Windows Terminal, including building and patching a custom distribution so it could be embedded correctly and use configuration generated by Remote Desktop Manager. Marc next covers secure credential injection. He explains that passing passwords directly on the command line would expose them, so instead the application launches a subprocess with a command that reads the real payload from a named pipe. The named pipe is created per session, used once, and then destroyed. He then moves to PowerShell remoting over SSH. On the client side, PowerShell simply launches `ssh.exe` and communicates through standard input and output. On the server side, SSH starts PowerShell as a subsystem and raw PowerShell remoting traffic flows through the tunnel. Marc explains that password support is missing here, so Devolutions patched Win32 OpenSSH to read a password from a named pipe. The talk then turns to the PowerShell SDK. Marc notes that it ships a copy of PowerShell inside the application, brings trimming and native AOT challenges, and can conflict with assemblies used by PowerShell modules. He describes how Devolutions moved to local PowerShell remoting instead of running everything in process, first through localhost WinRM and then through a subprocess-based approach using standard input and output. Finally, Marc discusses browser-based PowerShell remoting. He describes earlier and newer implementations using JavaScript, Rust and WebAssembly, with WebSocket tunnels through Devolutions Gateway and just-in-time tokens for both the remoting connection and Kerberos/KDC access. He concludes with lessons learned: PowerShell SDK is useful but limited for advanced scenarios, local remoting can simplify isolation and compatibility issues, and custom stacks are sometimes necessary when existing remoting models do not fit the product requirements. Chapters: 00:00:00 Implementing PSRemoting at Devolutions: Lessons Learned - Marc-André Moreau - PSConfEU 2026 00:00:20 Remoting Lessons Overview 00:03:27 Session Launching Challenges 00:05:05 Embedding PowerShell Terminals 00:07:59 Secure Credential Handoffs 00:11:26 SSH Remoting Internals 00:19:53 PowerShell SDK Limits 00:22:44 Local Remoting Workarounds 00:29:42 SDK Futures and Fixes 00:31:29 Browser-Based Remoting 00:35:17 Key Takeaways