You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Restore WaaSMedicSvc and clear SYSTEM deny rules in Restore Defaults - #5233
Restore Defaults on the Updates tab (Invoke-WPFUpdatesdefault) no longer restores WaaSMedicSvc, so a machine where another tweak tool disabled that service stays disabled. Its Set-Service call was removed in #4845, and #4267 and #5095 show that call is denied because the service is launch protected. In #4309 the intent was stated that Restore Defaults should give the best shot at recovering from other tools, and #5096 already restores this service through its registry value on the Win11 Creator path.
Some tools also add a deny rule for SYSTEM on the update service registry keys to stop Windows from re-enabling them. Set-Service goes through the Service Control Manager, which runs as SYSTEM, so I expect it to fail on those keys until the rule is gone.
Changes
Remove SYSTEM deny rules from the BITS, wuauserv, UsoSvc and WaaSMedicSvc service keys before restoring startup types. Rules for other accounts are left alone, and the ACL is only written when a SYSTEM deny rule exists. Rules are matched by SID (S-1-5-18) because the account name is localized on some Windows languages.
Set WaaSMedicSvc back to Manual through its Start registry value, skipping the write when it is already 3. Set-Service is still not called for this service.
Log failures of either step as warnings and continue with the rest of the workflow.
Add a note to the Updates guide.
Disable Updates is unchanged and does not touch WaaSMedicSvc.
Testing
pester/update-profiles.Tests.ps1: 23 of 23 pass. 5 of the 7 new tests fail against the old function; the other 2 assert that nothing is changed.
Final-head local Pester 5.8.0: 1048 passed, 0 failed, 1 expected UAC-dependent skip; full hosted Windows CI is recorded below.
.\Compile.ps1 passes and winutil.ps1 is not included in this PR.
Script Analyzer reports no findings on the changed function.
The repair paths were exercised on a disposable hosted Windows runner, including real service-key writes and restoration of the original state; details are recorded below. Hardened consumer service ACLs remain unverified. Protected operations remain best-effort and produce warnings if Windows denies access.
Compile passed. Pester 5.8.0: 1,048 passed, 0 failed, 1 expected skip because the compiled headless test would open UAC. PSScriptAnalyzer 1.20.0: zero Error diagnostics; convention warnings remain. Direct built-in Codex review: no actionable findings.
Disposable Windows runner capability test passed all 13 real registry/DACL/SCM operations, including WaaSMedicSvc Start=4 to Start=3. Original Start values and SDDL were restored for BITS, wuauserv, UsoSvc, and WaaSMedicSvc. Real temporary registry keys confirmed explicit SYSTEM deny removal, inherited-deny preservation, and preservation of unrelated rules.
The runner used Windows build 26100 and SYSTEM-owned service keys. This does not establish access on every hardened consumer installation; the guide describes best-effort repair and warnings for protected keys. No workstation service or registry settings were changed during validation.
Final-head Unit Tests CI passed on commit 09247f534500346c3176d78c3f91628a8673a65d: 1049 Pester tests passed, zero failures/skips, and PSScriptAnalyzer passed. The existing workflow ran against that exact commit on a temporary validation branch because the contributor fork had no full test run. Hosted CodeRabbit approved this head; the final independent Sol skeptic review found no actionable concerns. No unresolved review threads remain.
Restore Defaults stopped touching WaaSMedicSvc when its Set-Service call
was removed, because the launch protected service denies that call. A
machine where another tweak tool disabled the service therefore stayed
disabled, and Set-Service can also fail on update service keys where such
a tool denied SYSTEM write access.
Remove SYSTEM deny rules from the update service keys before restoring
startup types, and set WaaSMedicSvc back to Manual through its registry
start value. Failures are logged as warnings and the workflow continues.
No actionable comments were generated in the recent review.
Summary
Summary by CodeRabbit
Bug Fixes
The Windows Default profile now attempts to remove SYSTEM-account deny rules from Windows Update service registry keys and restore WaaSMedicSvc to Manual startup.
If a registry key cannot be checked or updated, the profile logs a warning and continues with the remaining restoration steps.
Documentation
Updated the Windows Default notes to describe the registry permission and service startup changes, including possible failures on protected keys.
The Windows Default profile now removes SYSTEM deny rules from four Windows Update service registry keys and restores WaaSMedicSvc to Manual. Tests cover successful updates, ordering, and warning behavior when registry operations fail.
Changes: Windows Update Defaults Restoration
Layer / File(s)
Summary
Remove SYSTEM deny rules functions/public/Invoke-WPFUpdatesdefault.ps1, pester/update-profiles.Tests.ps1
The default-profile function removes SYSTEM deny rules from the BITS, wuauserv, UsoSvc, and WaaSMedicSvc registry-key ACLs when present. Tests check ACL rule preservation, operation order, and warning behavior if ACL updates fail.
The function sets WaaSMedicSvc's Start value to 3 when needed. Tests check skipped writes and warning behavior if the write fails. The guide notes describe the attempted repairs and possible warnings for protected keys.
ChrisTitusTech/winutil issue 5095 — Reports that Set-Service cannot restore WaaSMedicSvc and leaves Start=4. This PR writes Start=3 in the Restore Defaults path.
ChrisTitusTech/winutil issue 5196 — Reports failures when Restore Defaults re-enables Windows Update services. This PR changes ACL and startup restoration for the same services, but does not address the reported update error or service module failure.
Possibly related PRs
ChrisTitusTech/winutil#5096 — Restores WaaSMedicSvc by writing Start=3 in the FirstLogon flow. This PR applies the same registry update in the Restore Defaults flow.
Merge Risk: Minimal · up to 09247
The restoration changes are ready to merge after normal checks. Protected Windows keys may still prevent a repair, in which case the workflow warns and continues.
Architecture risk: Low · up to 77e85
The change affects 3 systems.
Changed systems:docs, functions, pester
Architecture concerns
No architecture-level concerns identified.
Review details
Systems and components
observed — docs (service) was modified; 1 changed file maps to changed impact.
observed — functions (service) was modified; 1 changed file maps to changed impact.
observed — pester (service) was modified; 1 changed file maps to changed impact.
Before / after behavior
observed — Modified behavior in docs/src/content/docs/guides/updates.mdx: The Windows Default notes add that SYSTEM-account deny rules on update service registry keys are removed and WaaSMedicSvc is set to Manual; the prior notes did not mention these actions.
observed — Modified behavior in functions/public/Invoke-WPFUpdatesdefault.ps1: For the four listed service keys, the function now removes access-deny rules applying to the SYSTEM SID and writes the updated ACL when such rules exist. ACL access or update failures are caught and logged as warnings; previously there was no corresponding ACL handling.
observed — Modified behavior in functions/public/Invoke-WPFUpdatesdefault.ps1: The function now checks the WaaSMedicSvcStart value and, when it differs from 3, sets it to 3 to restore Manual startup. Registry-write failures are caught and logged as warnings.
observed — Modified behavior in pester/update-profiles.Tests.ps1: Adds a test ACL builder that grants SYSTEM full control and optionally adds deny rules for supplied SIDs, plus the registry paths for BITS, wuauserv, UsoSvc, and WaaSMedicSvc.
Pre-merge checks: 4
Check name
Status
Explanation
Title check
The title clearly summarizes the main changes: restoring WaaSMedicSvc and removing SYSTEM deny rules during Restore Defaults.
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Description check
The pull request description clearly describes restoring WaaSMedicSvc, removing SYSTEM deny rules from update-service registry keys, warning on failures, adding tests, and updating documentation. Thes…
Full details: Description check
Explanation
The pull request description clearly describes restoring WaaSMedicSvc, removing SYSTEM deny rules from update-service registry keys, warning on failures, adding tests, and updating documentation. These topics match the changeset.
Finishing Touches
Generate unit tests (beta)
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Tip
🎯 Customize your risk assessments
Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.
✅ Automatic approvals, with your rules
Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: ef371ee9-b4fc-4566-903b-2f493cfc9049
Commits
Reviewing files that changed from the base of the PR and between 77e8556 and 09247f5.
Files selected for processing: 1
docs/src/content/docs/guides/updates.mdx
Files skipped from review as they are similar to previous changes: 1
docs/src/content/docs/guides/updates.mdx
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Type of Change
Description
Restore Defaults on the Updates tab (
Invoke-WPFUpdatesdefault) no longer restoresWaaSMedicSvc, so a machine where another tweak tool disabled that service stays disabled. ItsSet-Servicecall was removed in #4845, and #4267 and #5095 show that call is denied because the service is launch protected. In #4309 the intent was stated that Restore Defaults should give the best shot at recovering from other tools, and #5096 already restores this service through its registry value on the Win11 Creator path.Some tools also add a deny rule for
SYSTEMon the update service registry keys to stop Windows from re-enabling them.Set-Servicegoes through the Service Control Manager, which runs asSYSTEM, so I expect it to fail on those keys until the rule is gone.Changes
SYSTEMdeny rules from theBITS,wuauserv,UsoSvcandWaaSMedicSvcservice keys before restoring startup types. Rules for other accounts are left alone, and the ACL is only written when aSYSTEMdeny rule exists. Rules are matched by SID (S-1-5-18) because the account name is localized on some Windows languages.WaaSMedicSvcback to Manual through itsStartregistry value, skipping the write when it is already3.Set-Serviceis still not called for this service.Disable Updates is unchanged and does not touch
WaaSMedicSvc.Testing
pester/update-profiles.Tests.ps1: 23 of 23 pass. 5 of the 7 new tests fail against the old function; the other 2 assert that nothing is changed..\Compile.ps1passes andwinutil.ps1is not included in this PR.The repair paths were exercised on a disposable hosted Windows runner, including real service-key writes and restoration of the original state; details are recorded below. Hardened consumer service ACLs remain unverified. Protected operations remain best-effort and produce warnings if Windows denies access.
Issue related to PR
Review validation
Validated head:
09247f534500346c3176d78c3f91628a8673a65d.Compile passed. Pester 5.8.0: 1,048 passed, 0 failed, 1 expected skip because the compiled headless test would open UAC. PSScriptAnalyzer 1.20.0: zero Error diagnostics; convention warnings remain. Direct built-in Codex review: no actionable findings.
Disposable Windows runner capability test passed all 13 real registry/DACL/SCM operations, including WaaSMedicSvc Start=4 to Start=3. Original Start values and SDDL were restored for BITS, wuauserv, UsoSvc, and WaaSMedicSvc. Real temporary registry keys confirmed explicit SYSTEM deny removal, inherited-deny preservation, and preservation of unrelated rules.
The runner used Windows build 26100 and SYSTEM-owned service keys. This does not establish access on every hardened consumer installation; the guide describes best-effort repair and warnings for protected keys. No workstation service or registry settings were changed during validation.
Additional compatibility snapshot with feat(install): bundle app icons and speed up the app list #5199, feat: queue actions while a job is running, with reorder and cancel #5207, and feat(ui): add working view to Install and Tweaks tabs #5147: compile passed; 1,147 Pester tests passed, 0 failed, 1 expected UAC skip; analyzer reported zero Errors; native WPF FIFO handoff passed. The snapshot was temporary and was not committed.
Compile-and-Check passed after this head was pushed.
Final-head Unit Tests CI passed on commit
09247f534500346c3176d78c3f91628a8673a65d: 1049 Pester tests passed, zero failures/skips, and PSScriptAnalyzer passed. The existing workflow ran against that exact commit on a temporary validation branch because the contributor fork had no full test run. Hosted CodeRabbit approved this head; the final independent Sol skeptic review found no actionable concerns. No unresolved review threads remain.