Update win-update-registry.ps1 to v1.1

[anmocanu]

.VERSION
v1.1: [May 2026] - Updated the script (current)
- Fixed Get-VM failure when Hyper-V module is not available on host.
- Added guarded nested VM validation with safe fallback logging.
- Added explicit runtime parameter validation for rootKey, propertyType, controlSet, and required inputs.
- Updated helper import to Get-Disk-Partitions-v2 and aligned partition processing flow.
- Added rescue OS drive exclusion to avoid modifying the running rescue VM hive.
- Added per-partition reg load failure handling (skip bad partition, continue others).
- Added structured step-by-step logging, timestamped CSE log output, and final status tracking.
- Improved error handling to continue processing partitions safely and report aggregate result.
v1.0: Initial version

[EdwinBernal1]

Issues Found

🟡 Validation mismatch: allows unsupported root hives for reg load

Script validates rootKey as one of HKLM, HKCC, HKCR, HKCU, HKU, but reg load supports hive mount targets under HKLM/HKU in practical use. Allowing HKCC/HKCR/HKCU can pass validation and still fail at runtime.

Recommendation: restrict accepted rootKey to HKLM and HKU for this script path.

🟡 Load failure detection relies on output text, not exit code

Failure handling checks $loadResult -match 'ERROR' rather than $LASTEXITCODE. This is fragile for localization/nonstandard output.

Recommendation: treat nonzero $LASTEXITCODE as authoritative and use text only for diagnostics.

[EdwinBernal1]

@anmocanu could you help us with the review of these findings

Findings

Critical

File	Context	Issue	Recommendation
—	—	None (blocking)	—

Warning

File	Context	Issue	Recommendation
win-update-registry.ps1	Param() removed	Behavioral change: relies entirely on az vm repair run injecting parameters as script variables. Local invocation with named parameters (-relativePath ...) no longer binds; loses [ValidateSet]/Mandatory engine enforcement (replaced by manual checks).	Confirm this matches how vm-repair delivers parameters and that the loss of native binding is acceptable; document the local-testing path (a DEBUG variable block is provided).
win-update-registry.ps1	new-key creation	The script now New-Item-creates the target registry path when it does not exist, then sets the value — a broader capability than "update existing."	Ensure callers understand a typo in relativePath will silently create a new key rather than error.
win-update-registry.ps1	logging	Desktop-only log, not the plugin dir.	Dual-write for auto-collection (batch-level).

Info

File	Context	Suggestion
win-update-registry.ps1	backup + rollback	Per-partition hive backup with rollback-on-failure is a strong safety addition.
win-update-registry.ps1	propertyValue check	Uses $null -eq $propertyValue (not IsNullOrEmpty), so "0" and "" are accepted — correct for 0, confirm empty-string values are intended.
win-update-registry.ps1	removed double-throw	Old code had throw $_ followed by unreachable return $STATUS_ERROR; new flow is cleaner.

Operational Risk Assessment

Factor	Rating	Notes
Scope	Low-Medium	Single script; targeted registry edit.
Destructive ops	Low-Medium	Writes a single property (or creates a key) — backed up first.
Rollback possible	Yes	Per-partition .hiv backup + rollback on failure.
Testing documented	Partial	.SCENARIO_RECREATION/.VERIFICATION provided; confirm a run.
Gen compatibility	Gen1+Gen2	Operates on the lettered Windows volume; ControlSet logic generation-agnostic.