<#
.SYNOPSIS
 Hardened setup for a scheduled WinGet auto-updater task.
#>$ErrorActionPreference='Stop'$Folder="C:\Automation"$ScriptPath="$Folder\BackgroundUpdater.ps1"$LogPath="$Folder\updater_log.txt"$TaskName="Automated_WinGet_Updater"$RegKeyPath="HKLM:\SOFTWARE\WinGetAutomation"$RegHashName="ExpectedScriptHash"functionWrite-Section{param([string]$Message,[string]$Color='Gray')Write-Host$Message-ForegroundColor$Color}try{# -------------------------------------------------------------------# 0. Confirm elevation and capture the real interactive user identity# -------------------------------------------------------------------$identity=[System.Security.Principal.WindowsIdentity]::GetCurrent()$principal=New-ObjectSystem.Security.Principal.WindowsPrincipal($identity)if(-not$principal.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)){throw"This script must be run from an elevated (Administrator) PowerShell session."}$CurrentUser=$identity.NameWrite-Section"Running elevated as $CurrentUser."'Gray'# -------------------------------------------------------------------# 1. Force clear any existing automation folder to ensure a fresh slate# -------------------------------------------------------------------if(Test-Path$Folder){$existing=Get-Item$Folder-Forceif($existing.Attributes-band[IO.FileAttributes]::ReparsePoint){throw"$Folder is a reparse point / junction / symlink. Refusing to reuse it."}Write-Section"Existing deployment detected. Resetting ACLs and force-deleting $Folder..."'Yellow'&icacls$Folder/reset/T/C/Q|Out-NullRemove-Item-Path$Folder-Recurse-Force}New-Item-ItemTypeDirectory-Path$Folder|Out-Null# Lock it down immediately$icaclsArgs=@($Folder,'/inheritance:r','/grant',"*S-1-5-32-544:(OI)(CI)F",'/grant',"*S-1-5-18:(OI)(CI)F",'/grant',"${CurrentUser}:(OI)(CI)RX",'/T','/C','/Q')$icaclsOutput=&icacls@icaclsArgs2>&1if($LASTEXITCODE-ne0){throw"icacls failed to lock down $Folder (exit code $LASTEXITCODE): $icaclsOutput"}# Verify ACL using proper SID Translation$acl=Get-Acl$Folderif(-not$acl.AreAccessRulesProtected){throw"$Folder still inherits parent permissions after icacls /inheritance:r - aborting."}$hasAdminFull=$acl.Access|Where-Object{$sid=$_.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value$sid-eq'S-1-5-32-544'-and$_.FileSystemRights-match'FullControl'}if(-not$hasAdminFull){throw"Expected Administrators FullControl ACE not found on $Folder after lockdown - aborting."}Write-Section"Folder $Folder created and locked down (verified) before any payload was written."'Green'# -------------------------------------------------------------------# 2. Write the updater payload# -------------------------------------------------------------------$UpdaterCode=@"
`$ErrorActionPreference = 'Stop'
`$LogPath = "$LogPath"

if ((Test-Path `$LogPath) -and ((Get-Item `$LogPath).Length -gt 2097152)) {
 (Get-Content `$LogPath -Tail 500) | Set-Content `$LogPath -Encoding UTF8
}

try {
 Start-Transcript -Path `$LogPath -Append | Out-Null
 Write-Host "Starting background WinGet update sequence: `$(Get-Date -Format o)"

 # Securely resolve WinGet path to prevent PATH hijacking
 `$WinGetPath = "`$env:LOCALAPPDATA\Microsoft\WindowsApps\winget.exe"

 if (-not (Test-Path `$WinGetPath)) { throw "winget.exe could not be found at secure path." }

 & `$WinGetPath upgrade --all --include-unknown --silent --accept-package-agreements --accept-source-agreements
 `$wingetExit = `$LASTEXITCODE
 if (`$wingetExit -eq 0) {
 Write-Host "Sequence completed successfully (exit code 0)."
 } else {
 Write-Host "WARNING: winget exited with code `$wingetExit."
 }
}
catch {
 Write-Host "ERROR: `$_"
}
finally {
 Stop-Transcript | Out-Null
}
"@Set-Content-Path$ScriptPath-Value$UpdaterCode-EncodingUTF8-ForceWrite-Section"Payload written to $ScriptPath."'Gray'# -------------------------------------------------------------------# 3. Pin an integrity hash in HKLM# -------------------------------------------------------------------$expectedHash=(Get-FileHash-Path$ScriptPath-AlgorithmSHA256).Hashif(-not(Test-Path$RegKeyPath)){New-Item-Path$RegKeyPath-Force|Out-Null}Set-ItemProperty-Path$RegKeyPath-Name$RegHashName-Value$expectedHash-TypeStringWrite-Section"Integrity hash pinned at $RegKeyPath\$RegHashName."'Gray'# -------------------------------------------------------------------# 4. Build a scheduled task Action that verifies the payload's hash# -------------------------------------------------------------------$VerifyAndRun=@'
$ErrorActionPreference = 'Stop'
$scriptPath = 'REPLACE_SCRIPT_PATH'
$regKeyPath = 'REPLACE_REG_KEY'
$regHashName = 'REPLACE_REG_NAME'
try {
 $expected = (Get-ItemProperty -Path $regKeyPath -Name $regHashName -ErrorAction Stop).$regHashName
 $actual = (Get-FileHash -Path $scriptPath -Algorithm SHA256 -ErrorAction Stop).Hash
 if ($expected -ne $actual) {
 throw "Hash Mismatch! Aborting execution."
 }
 & $scriptPath
}
catch {
 throw "Verification Failed."
}
'@$VerifyAndRun=$VerifyAndRun.Replace('REPLACE_SCRIPT_PATH',$ScriptPath).Replace('REPLACE_REG_KEY',$RegKeyPath).Replace('REPLACE_REG_NAME',$RegHashName)$EncodedCommand=[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($VerifyAndRun))$PowerShellExe="$env:windir\System32\WindowsPowerShell\v1.0\powershell.exe"# -------------------------------------------------------------------# 5. Register the scheduled task# -------------------------------------------------------------------$Trigger=New-ScheduledTaskTrigger-AtLogOn$Trigger.Delay="PT15M"$Action=New-ScheduledTaskAction-Execute$PowerShellExe`
-Argument"-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy RemoteSigned -EncodedCommand $EncodedCommand"$Principal=New-ScheduledTaskPrincipal-UserId$CurrentUser-LogonTypeInteractive-RunLevelHighest$Settings=New-ScheduledTaskSettingsSet-CompatibilityWin8$existingTask=Get-ScheduledTask-TaskName$TaskName-ErrorActionSilentlyContinueif($existingTask){Write-Section"An existing task named '$TaskName' was found and will be replaced."'Yellow'}Register-ScheduledTask-TaskName$TaskName-Trigger$Trigger-Action$Action-Principal$Principal-Settings$Settings-Force|Out-Null# -------------------------------------------------------------------# 6. Final verification pass# -------------------------------------------------------------------$verifyTask=Get-ScheduledTask-TaskName$TaskName-ErrorActionSilentlyContinue$verifyAcl=Get-Acl$Folder$verifyHash=(Get-FileHash-Path$ScriptPath-AlgorithmSHA256).Hash$regHash=(Get-ItemProperty-Path$RegKeyPath-Name$RegHashName).$RegHashName$allGood=$trueif(-not$verifyTask){Write-Section"FAILED: scheduled task not found after registration."'Red'$allGood=$false}if($verifyHash-ne$regHash){Write-Section"FAILED: pinned hash does not match the file currently on disk."'Red'$allGood=$false}if($allGood){Write-Host""Write-Host"Success: '$ScriptPath' created with auto-trimming logs and a hash-verifying launcher,"-ForegroundColorGreenWrite-Host" triggered 15 minutes after logon as task '$TaskName'."-ForegroundColorGreenWrite-Host"Hardening applied: ACL locked before write, integrity hash pinned in HKLM,"-ForegroundColorCyanWrite-Host" winget resolved by absolute path."-ForegroundColorCyan}else{throw"One or more post-install verification checks failed. See above."}}catch{Write-Host""Write-Host"Setup failed: $_"-ForegroundColorRed}