Update GA_offlinefixer.ps1 to v1.3

[anmocanu]

This script repairs a broken Azure Guest Agent by restoring registry keys and binaries from a rescue VM. It includes detailed steps for loading the SYSTEM hive, backing up, injecting service keys, and verifying the restoration process. .VERSION
v1.3: [May 2026] - Updated the script (current)
- Aligned nested VM detection with win-LKGC guard pattern.
- Skips Get-VM safely when Hyper-V module is unavailable.
v1.2: [May 2026] - Updated the script again (current)
- Fixed breaking exception when the Hyper-V module is not installed on the host.
- Added explicit checking via Get-Module before executing nested VM discovery.
v1.1: [May 2026] - Updated the script
- Included advanced Gen2 unlettered EFI fallback and dynamic drive-letter assignment.
v1.0: Initial commit. This was the version 1.0 of the script.

[EdwinBernal1]

Issues Found

🟡 Service disruption risk on rescue VM

Script force-stops WSearch and WinDefend and does not restore service state at end. On long-lived rescue hosts this can leave host security/indexing degraded after script completion.

Recommendation: capture original service states and restore them in finally.

🟡 Success can be reported even when fallback copy-back fails

When hive copy fallback ($hiveCopy) is used, copy-back to original hive happens in finally. If copy-back fails, error is logged, but disk can still remain in $fixedDisks, and overall script may still return success.

Recommendation: mark per-disk status failed if copy-back fails and exclude from success list.

[anmocanu]

addressed these feedbacks in the last commit aec8064

[EdwinBernal1]

@anmocanu could you help us with the review of these findings

Findings

Critical

File	Context	Issue	Recommendation
—	—	None (blocking)	—

Warning

File	Context	Issue	Recommendation
GA_offlinefixer.ps1	IMDS / telemetry	Introduces an outbound network call and collects VM SKU/Region/OS/hostname "for Application Insights correlation." IMDS is link-local (169.254.169.254) and non-routable, and the script only writes the values to the local log — but this is a new behavior for a repair script.	Confirm intent with owners; verify nothing is transmitted off-box. Per the repo's own security checklist (Network Calls / Data Exfiltration), document why the call is present. No PII beyond hostname/region/SKU.
GA_offlinefixer.ps1	Defender stop	Temporarily stops Windows Defender (WinDefend) and WSearch on the rescue VM. Restored in finally, but a hard kill (or crash before finally) could leave Defender stopped.	Prefer suspending indexing/handle locks without stopping Defender if possible; at minimum, ensure restoration is robust and logged.
GA_offlinefixer.ps1	disk cycling	Set-Disk -IsOffline on all non-rescue online disks broadens blast radius.	Scoped to non-rescue disks ($_.Number -ne $rescueDiskNum) — acceptable, but note in PR description.
GA_offlinefixer.ps1	version number	PR title says v1.3; top .VERSION entry is v1.4.	Reconcile.
GA_offlinefixer.ps1	xcopy exit code	Treats >= 2 as failure; xcopy returns 1 for "no files found," which would pass as success.	Confirm the copy source always has content; consider validating a non-empty copy.

Info

File	Context	Suggestion
GA_offlinefixer.ps1	backups	Both the registry hive and the WindowsAzure folder are backed up before replacement, and copy-back is verified — strong safety.
GA_offlinefixer.ps1	esentutl fallback	Locked-hive fallback via esentutl /y + copy-back is a good robustness addition; ensure copy-back only occurs after a successful unload (it does).
GA_offlinefixer.ps1	service key check	Verifies each service key exists on the rescue VM before export (avoids injecting missing keys on other OS versions). Good.

Operational Risk Assessment

Factor	Rating	Notes
Scope	Medium-High	Largest change; registry + binary replacement, service stop, disk cycling, network call.
Destructive ops	Medium	Registry injection + full WindowsAzure folder replacement — both backed up first.
Rollback possible	Partial	Hive backup + WindowsazurefaultyGAbackup folder exist; automatic restore is limited to hive copy-back path.
Testing documented	Yes (guide)	.SCENARIO_RECREATION/.VERIFICATION provided; confirm an actual run was performed.
Gen compatibility	Gen1+Gen2	Operates on lettered Windows volume; ControlSet logic generation-agnostic.