From d53b01243201ee1310afd670cb140a9c10af048a Mon Sep 17 00:00:00 2001
From: Malin Fossum <malinfossum.dev@proton.me>
Date: Tue, 25 Aug 2026 08:41:52 +0200
Subject: [PATCH 1/2] Add tweak to block Logitech Download Assistant
 auto-install

Mirrors the WPFTweaksRazerBlock folder-deny approach: clear
C:\Program Files\LogiDownloadAssistant, recreate it empty, and deny
Everyone write access so the Windows Update software-component package
cannot re-deliver the payload. UndoScript removes the deny ACE.

Unlike the Razer tweak, no global SearchOrderConfig/DisableCoInstallers
registry changes: those alter driver search system-wide and do not stop
software-component packages.

Fixes #5029
---
 config/tweaks.json | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/config/tweaks.json b/config/tweaks.json
index a67e19b9b6..6b9cefc076 100644
--- a/config/tweaks.json
+++ b/config/tweaks.json
@@ -1001,6 +1001,33 @@
     ],
     "link": "https://winutil.christitus.com/code-reference/tweaks/z--advanced-tweaks---caution/razerblock"
   },
+  "WPFTweaksLogiBlock": {
+    "Content": "Logitech Download Assistant Auto-Install - Disable",
+    "Description": "Blocks the Logi Download Assistant that Windows Update keeps reinstalling with Logitech device drivers. Logitech hardware keeps working without it.",
+    "category": "z__Advanced Tweaks - CAUTION",
+    "panel": "1",
+    "InvokeScript": [
+      "
+      Stop-Process -Name \"logi_download_assistant\" -Force -ErrorAction SilentlyContinue
+
+      $LogiPath = \"$Env:ProgramFiles\\LogiDownloadAssistant\"
+
+      if (Test-Path $LogiPath) {
+        Remove-Item $LogiPath\\* -Recurse -Force
+      } else {
+        New-Item -Path $LogiPath -ItemType Directory
+      }
+
+      icacls $LogiPath /deny \"Everyone:(W)\"
+      "
+    ],
+    "UndoScript": [
+      "
+      icacls \"$Env:ProgramFiles\\LogiDownloadAssistant\" /remove:d Everyone
+      "
+    ],
+    "link": "https://winutil.christitus.com/code-reference/tweaks/z--advanced-tweaks---caution/logiblock"
+  },
   "WPFTweaksDisableNotifications": {
     "Content": "System Tray Notifications & Calendar - Disable",
     "Description": "Disables all Notifications INCLUDING Calendar.",

From 9c253df60cc84ee0424f6fca050eab18b729e7b3 Mon Sep 17 00:00:00 2001
From: Malin Fossum <malinfossum.dev@proton.me>
Date: Tue, 25 Aug 2026 09:41:42 +0200
Subject: [PATCH 2/2] Harden Logi block tweak per review: SID, 64-bit path,
 exit codes

- Use the locale-independent *S-1-1-0 SID instead of the English
  "Everyone" name, which fails to resolve on non-English Windows.
- Resolve the 64-bit Program Files directory via ProgramW6432 with a
  ProgramFiles fallback, so a 32-bit host cannot target the x86 folder.
- Throw when icacls exits non-zero so Invoke-WinUtilScript logs the
  failure instead of reporting the tweak as completed.
- Skip the undo icacls call when the folder no longer exists.
---
 config/tweaks.json | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/config/tweaks.json b/config/tweaks.json
index 6b9cefc076..4c1ea72cef 100644
--- a/config/tweaks.json
+++ b/config/tweaks.json
@@ -1010,7 +1010,8 @@
       "
       Stop-Process -Name \"logi_download_assistant\" -Force -ErrorAction SilentlyContinue
 
-      $LogiPath = \"$Env:ProgramFiles\\LogiDownloadAssistant\"
+      $ProgramFiles64 = if ($Env:ProgramW6432) { $Env:ProgramW6432 } else { $Env:ProgramFiles }
+      $LogiPath = \"$ProgramFiles64\\LogiDownloadAssistant\"
 
       if (Test-Path $LogiPath) {
         Remove-Item $LogiPath\\* -Recurse -Force
@@ -1018,12 +1019,19 @@
         New-Item -Path $LogiPath -ItemType Directory
       }
 
-      icacls $LogiPath /deny \"Everyone:(W)\"
+      icacls $LogiPath /deny \"*S-1-1-0:(W)\"
+      if ($LASTEXITCODE -ne 0) { throw \"icacls failed to deny write access on $LogiPath (exit code $LASTEXITCODE)\" }
       "
     ],
     "UndoScript": [
       "
-      icacls \"$Env:ProgramFiles\\LogiDownloadAssistant\" /remove:d Everyone
+      $ProgramFiles64 = if ($Env:ProgramW6432) { $Env:ProgramW6432 } else { $Env:ProgramFiles }
+      $LogiPath = \"$ProgramFiles64\\LogiDownloadAssistant\"
+
+      if (Test-Path $LogiPath) {
+        icacls $LogiPath /remove:d \"*S-1-1-0\"
+        if ($LASTEXITCODE -ne 0) { throw \"icacls failed to remove the write-deny rule on $LogiPath (exit code $LASTEXITCODE)\" }
+      }
       "
     ],
     "link": "https://winutil.christitus.com/code-reference/tweaks/z--advanced-tweaks---caution/logiblock"