Skip to content

Guard newUsers.ps1 against re-running on accidental Windows profile reset #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Copilot wants to merge 4 commits into from
Closed

Guard newUsers.ps1 against re-running on accidental Windows profile reset #1

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b5d793c
Initial plan
Copilot Mar 10, 2026
b782bc8
Fix newUsers.ps1 to skip re-running when a user profile is accidental…
Copilot Mar 10, 2026
6d65d70
Address PR review comments on newUsers.ps1
Copilot Mar 10, 2026
670b6e6
Change user setup checks in newUsers.ps1
Stensel8 Mar 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 12 additions & 4 deletions src/playbook/Executables/AtlasModules/Scripts/newUsers.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
if (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs; exit
# Guard against re-running on already-configured accounts (e.g., after profile reset)
$sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
if ((Get-ItemProperty -Path "HKLM:\SOFTWARE\AtlasOS\UserSetup" -Name $sid -ErrorAction SilentlyContinue).$sid -eq 1) { exit }

Copilot AI Mar 25, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The re-run guard uses Get-ItemProperty and then dynamic member access (…).$sid, which is a bit brittle/opaque for a registry value name containing dashes. Consider using Get-ItemPropertyValue (or explicitly reading the property via .PSObject.Properties) so the intent is clearer and you avoid edge cases around property name handling.

Suggested change
if ((Get-ItemProperty -Path "HKLM:\SOFTWARE\AtlasOS\UserSetup" -Name $sid -ErrorAction SilentlyContinue).$sid -eq 1) { exit }
if ((Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\AtlasOS\UserSetup" -Name $sid -ErrorAction SilentlyContinue) -eq 1) { exit }

Copilot uses AI. Check for mistakes.

if (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs; exit
}

$windir = [Environment]::GetFolderPath('Windows')
Expand Down Expand Up @@ -51,6 +55,10 @@ $Browser
& "$atlasModules\Scripts\taskbarPins.ps1" $Browser
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" -Name "SearchboxTaskbarMode" -Value 1

# Mark setup complete for this SID to prevent re-runs after profile reset
New-Item -Path "HKLM:\SOFTWARE\AtlasOS\UserSetup" -Force | Out-Null
New-ItemProperty -Path "HKLM:\SOFTWARE\AtlasOS\UserSetup" -Name $sid -Value 1 -PropertyType DWord -Force | Out-Null
Comment on lines +59 to +60

Copilot AI Mar 25, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The marker write is currently fully silent (Out-Null) and doesn’t force failures to stop execution. If creating the HKLM key/value fails (permissions/registry corruption), the script will still proceed to logoff and the guard won’t be set, reintroducing the accidental re-run problem later. Consider making these writes terminating (e.g., -ErrorAction Stop) and handling failure (at least emit an error and avoid logging off).

Suggested change
New-Item -Path "HKLM:\SOFTWARE\AtlasOS\UserSetup" -Force | Out-Null
New-ItemProperty -Path "HKLM:\SOFTWARE\AtlasOS\UserSetup" -Name $sid -Value 1 -PropertyType DWord -Force | Out-Null
try {
New-Item -Path "HKLM:\SOFTWARE\AtlasOS\UserSetup" -Force -ErrorAction Stop | Out-Null
New-ItemProperty -Path "HKLM:\SOFTWARE\AtlasOS\UserSetup" -Name $sid -Value 1 -PropertyType DWord -Force -ErrorAction Stop | Out-Null
} catch {
Write-Error "Failed to mark user setup completion in HKLM:\SOFTWARE\AtlasOS\UserSetup for SID '$sid'. Aborting logoff. $_"
exit 1
}

Copilot uses AI. Check for mistakes.

# Leave
Start-Sleep 5
logoff
Start-Sleep 5
logoff
Loading