From 013e66ebdc3b9079ce1bbfdc8ee40e17afdf1f02 Mon Sep 17 00:00:00 2001
From: KnifMelti <gaj@knifmelti.se>
Date: Sat, 4 Feb 2023 01:08:38 +0100
Subject: [PATCH 1/9] Corrected and Safe

---
 README.md                                     |   3 +
 Winget-AutoUpdate-Install.ps1                 |  13 +-
 Winget-AutoUpdate/Winget-Upgrade.ps1          | 112 +++++++++---------
 .../functions/Get-WingetOutdatedApps.ps1      |   2 +-
 .../functions/Invoke-PostUpdateActions.ps1    |  12 ++
 5 files changed, 85 insertions(+), 57 deletions(-)

diff --git a/README.md b/README.md
index 39c476a..2e7547c 100644
--- a/README.md
+++ b/README.md
@@ -103,6 +103,9 @@ Thanks to [Weatherlights](https://github.com/Weatherlights) in [#256 (reply in t
 **-ModsPath**  
 Get Mods from external Path (**URL/UNC/Local**) - download/copy to `mods` in Winget-AutoUpdate installation location if external mods are newer.  
 
+Security:  
+If -ModsPath is used during installation WAU assumes it's an enterprise environment and adds a **Deny rule** to the file rights for the directory `mods` for **Local Users** (SID: S-1-5-32-545) making it impossible to implement own scripts that can be executed in **SYSTEM** context.
+
 For **URL**: This requires a site directory with **Directory Listing Enabled** and no index page overriding the listing of files (or an index page with href listing of all the **Mods** to be downloaded):  
 ```
 <ul>
diff --git a/Winget-AutoUpdate-Install.ps1 b/Winget-AutoUpdate-Install.ps1
index f4b1087..ffa46be 100644
--- a/Winget-AutoUpdate-Install.ps1
+++ b/Winget-AutoUpdate-Install.ps1
@@ -367,7 +367,7 @@ function Install-WingetAutoUpdate {
             New-ItemProperty $regPath -Name WAU_BypassListForUsers -Value 1 -PropertyType DWord -Force | Out-Null
         }
 
-        #Set ACL for users on logfile
+        #Set ACL for Authenticated Users on logfile
         $LogFile = "$WingetUpdatePath\logs\updates.log"
         if (test-path $LogFile) {
             $NewAcl = Get-Acl -Path $LogFile
@@ -380,6 +380,17 @@ function Install-WingetAutoUpdate {
             Set-Acl -Path $LogFile -AclObject $NewAcl
         }
 
+        #Most likely an enterprise with central mods, not a home user
+        if ($ModsPath) {
+            # Set ReadOnly on Mods Directory for Local Users - Security risk if not done (they could create a script of their own - System Context)!
+            $directory = Get-Item -Path "$WingetUpdatePath\mods"
+            $acl = Get-Acl -Path $directory.FullName
+            $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
+            $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "Write", "Deny")
+            $acl.SetAccessRule($rule)
+            Set-Acl -Path $directory.FullName -AclObject $acl
+        }
+
         #Create Shortcuts
         if ($StartMenuShortcut) {
             if (!(Test-Path "${env:ProgramData}\Microsoft\Windows\Start Menu\Programs\Winget-AutoUpdate (WAU)")) {
diff --git a/Winget-AutoUpdate/Winget-Upgrade.ps1 b/Winget-AutoUpdate/Winget-Upgrade.ps1
index 55a2e24..febaccc 100644
--- a/Winget-AutoUpdate/Winget-Upgrade.ps1
+++ b/Winget-AutoUpdate/Winget-Upgrade.ps1
@@ -203,70 +203,72 @@ if (Test-Network) {
         Write-Log "Checking application updates on Winget Repository..." "yellow"
         $outdated = Get-WingetOutdatedApps
 
-        #If something is wrong with the winget source, exit
-        if ($outdated -like "Problem:*") {
-            Write-Log "Critical: An error occured, exiting..." "red"
-            Write-Log "$outdated" "red"
-            New-Item "$WorkingDir\logs\error.txt" -Value "$outdated" -Force
-            Exit 1
+        #If something unusual happened
+        if ($outdated -like "An unusual*") {
+            Write-Log "$outdated" "cyan"
+            $outdated = $False
         }
 
-        #Log list of app to update
-        foreach ($app in $outdated) {
-            #List available updates
-            $Log = "-> Available update : $($app.Name). Current version : $($app.Version). Available version : $($app.AvailableVersion)."
-            $Log | Write-host
-            $Log | out-file -filepath $LogFile -Append
-        }
-
-        #Count good update installations
-        $Script:InstallOK = 0
-
-        #Trick under user context when -BypassListForUsers is used
-        if ($IsSystem -eq $false -and $WAUConfig.WAU_BypassListForUsers -eq $true) {
-            Write-Log "Bypass system list in user context is Enabled."
-            $UseWhiteList = $false
-            $toSkip = $null
-        }
-
-        #If White List
-        if ($UseWhiteList) {
-            #For each app, notify and update
+        #Run only if $outdated is populated!
+        if ($outdated) {
+            #Log list of app to update
             foreach ($app in $outdated) {
-                if (($toUpdate -contains $app.Id) -and $($app.Version) -ne "Unknown") {
-                    Update-App $app
-                }
-                #if current app version is unknown
-                elseif ($($app.Version) -eq "Unknown") {
-                    Write-Log "$($app.Name) : Skipped upgrade because current version is 'Unknown'" "Gray"
-                }
-                #if app is in "excluded list"
-                else {
-                    Write-Log "$($app.Name) : Skipped upgrade because it is not in the included app list" "Gray"
+                #List available updates
+                $Log = "-> Available update : $($app.Name). Current version : $($app.Version). Available version : $($app.AvailableVersion)."
+                $Log | Write-host
+                $Log | out-file -filepath $LogFile -Append
+            }
+
+            #Count good update installations
+            $Script:InstallOK = 0
+
+            #Trick under user context when -BypassListForUsers is used
+            if ($IsSystem -eq $false -and $WAUConfig.WAU_BypassListForUsers -eq $true) {
+                Write-Log "Bypass system list in user context is Enabled."
+                $UseWhiteList = $false
+                $toSkip = $null
+            }
+
+            #If White List
+            if ($UseWhiteList) {
+                #For each app, notify and update
+                foreach ($app in $outdated) {
+                    if (($toUpdate -contains $app.Id) -and $($app.Version) -ne "Unknown") {
+                        Update-App $app
+                    }
+                    #if current app version is unknown
+                    elseif ($($app.Version) -eq "Unknown") {
+                        Write-Log "$($app.Name) : Skipped upgrade because current version is 'Unknown'" "Gray"
+                    }
+                    #if app is in "excluded list"
+                    else {
+                        Write-Log "$($app.Name) : Skipped upgrade because it is not in the included app list" "Gray"
+                    }
                 }
             }
-        }
-        #If Black List or default
-        else {
-            #For each app, notify and update
-            foreach ($app in $outdated) {
-                if (-not ($toSkip -contains $app.Id) -and $($app.Version) -ne "Unknown") {
-                    Update-App $app
-                }
-                #if current app version is unknown
-                elseif ($($app.Version) -eq "Unknown") {
-                    Write-Log "$($app.Name) : Skipped upgrade because current version is 'Unknown'" "Gray"
-                }
-                #if app is in "excluded list"
-                else {
-                    Write-Log "$($app.Name) : Skipped upgrade because it is in the excluded app list" "Gray"
+            #If Black List or default
+            else {
+                #For each app, notify and update
+                foreach ($app in $outdated) {
+                    if (-not ($toSkip -contains $app.Id) -and $($app.Version) -ne "Unknown") {
+                        Update-App $app
+                    }
+                    #if current app version is unknown
+                    elseif ($($app.Version) -eq "Unknown") {
+                        Write-Log "$($app.Name) : Skipped upgrade because current version is 'Unknown'" "Gray"
+                    }
+                    #if app is in "excluded list"
+                    else {
+                        Write-Log "$($app.Name) : Skipped upgrade because it is in the excluded app list" "Gray"
+                    }
                 }
             }
+
+            if ($InstallOK -gt 0) {
+                Write-Log "$InstallOK apps updated ! No more update." "Green"
+            }
         }
 
-        if ($InstallOK -gt 0) {
-            Write-Log "$InstallOK apps updated ! No more update." "Green"
-        }
         if ($InstallOK -eq 0) {
             Write-Log "No new update." "Green"
         }
diff --git a/Winget-AutoUpdate/functions/Get-WingetOutdatedApps.ps1 b/Winget-AutoUpdate/functions/Get-WingetOutdatedApps.ps1
index ae6aa50..53cc0a7 100644
--- a/Winget-AutoUpdate/functions/Get-WingetOutdatedApps.ps1
+++ b/Winget-AutoUpdate/functions/Get-WingetOutdatedApps.ps1
@@ -13,7 +13,7 @@ function Get-WingetOutdatedApps {
 
     #Start Convertion of winget format to an array. Check if "-----" exists (Winget Error Handling)
     if (!($upgradeResult -match "-----")) {
-        return "Problem:`n$upgradeResult"
+        return "An unusual thing happened (maybe all apps are upgraded):`n$upgradeResult"
     }
 
     #Split winget output to lines
diff --git a/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1 b/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
index e9eeb5d..ec614d1 100644
--- a/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
+++ b/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
@@ -53,6 +53,18 @@ function Invoke-PostUpdateActions {
         Write-Log "-> MaxLogFiles/MaxLogSize setting was missing. Fixed with 3/1048576 (in bytes, default is 1048576 = 1 MB)."
     }
 
+    #Most likely an enterprise with central mods, not a home user
+    $ModsPath = Get-ItemProperty $regPath -Name WAU_ModsPath -ErrorAction SilentlyContinue
+    if ($ModsPath) {
+        # Set ReadOnly on Mods Directory for Local Users - Security risk if not done (they could create a script of their own - System Context)!
+        $directory = Get-Item -Path "$WingetUpdatePath\mods"
+        $acl = Get-Acl -Path $directory.FullName
+        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
+        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "Write", "Deny")
+        $acl.SetAccessRule($rule)
+        Set-Acl -Path $directory.FullName -AclObject $acl
+    }
+
     #Convert about.xml if exists (previous WAU versions) to reg
     $WAUAboutPath = "$WorkingDir\config\about.xml"
     if (test-path $WAUAboutPath) {

From 973b578e2e0807b69d07d9dc4a87c1e29bdeb8c2 Mon Sep 17 00:00:00 2001
From: KnifMelti <gaj@knifmelti.se>
Date: Sat, 4 Feb 2023 04:17:35 +0100
Subject: [PATCH 2/9] Done

---
 README.md                                     |  3 --
 Winget-AutoUpdate-Install.ps1                 | 44 ++++++++++++++----
 .../functions/Invoke-PostUpdateActions.ps1    | 46 ++++++++++++++-----
 3 files changed, 69 insertions(+), 24 deletions(-)

diff --git a/README.md b/README.md
index 2e7547c..39c476a 100644
--- a/README.md
+++ b/README.md
@@ -103,9 +103,6 @@ Thanks to [Weatherlights](https://github.com/Weatherlights) in [#256 (reply in t
 **-ModsPath**  
 Get Mods from external Path (**URL/UNC/Local**) - download/copy to `mods` in Winget-AutoUpdate installation location if external mods are newer.  
 
-Security:  
-If -ModsPath is used during installation WAU assumes it's an enterprise environment and adds a **Deny rule** to the file rights for the directory `mods` for **Local Users** (SID: S-1-5-32-545) making it impossible to implement own scripts that can be executed in **SYSTEM** context.
-
 For **URL**: This requires a site directory with **Directory Listing Enabled** and no index page overriding the listing of files (or an index page with href listing of all the **Mods** to be downloaded):  
 ```
 <ul>
diff --git a/Winget-AutoUpdate-Install.ps1 b/Winget-AutoUpdate-Install.ps1
index ffa46be..f0a24ef 100644
--- a/Winget-AutoUpdate-Install.ps1
+++ b/Winget-AutoUpdate-Install.ps1
@@ -380,16 +380,40 @@ function Install-WingetAutoUpdate {
             Set-Acl -Path $LogFile -AclObject $NewAcl
         }
 
-        #Most likely an enterprise with central mods, not a home user
-        if ($ModsPath) {
-            # Set ReadOnly on Mods Directory for Local Users - Security risk if not done (they could create a script of their own - System Context)!
-            $directory = Get-Item -Path "$WingetUpdatePath\mods"
-            $acl = Get-Acl -Path $directory.FullName
-            $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
-            $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "Write", "Deny")
-            $acl.SetAccessRule($rule)
-            Set-Acl -Path $directory.FullName -AclObject $acl
-        }
+        #Security: Mods directory must be protected (Users could create scripts of their own - then they're run in System Context)!
+        $directory = Get-Item -Path "$WingetUpdatePath\mods"
+        $acl = Get-Acl -Path $directory.FullName
+        #Disable inheritance
+        $acl.SetAccessRuleProtection($True, $True)
+        # Remove any existing rules
+        $acl.Access | ForEach-Object { $acl.RemoveAccessRule($_) }
+        #SYSTEM Full - S-1-5-18
+        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-18")
+        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
+        $acl.SetAccessRule($rule)
+        # Save the updated ACL
+        Set-Acl -Path $directory.FullName -AclObject $acl | Out-Null
+
+        #Administrators Full - S-1-5-32-544
+        $acl = Get-Acl -Path $directory.FullName
+        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
+        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
+        $acl.SetAccessRule($rule)
+        Set-Acl -Path $directory.FullName -AclObject $acl
+        
+        #Local Users ReadAndExecute - S-1-5-32-545 S-1-5-11
+        $acl = Get-Acl -Path $directory.FullName
+        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
+        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
+        $acl.SetAccessRule($rule)
+        Set-Acl -Path $directory.FullName -AclObject $acl
+
+        #Authenticated Users ReadAndExecute - S-1-5-11
+        $acl = Get-Acl -Path $directory.FullName
+        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-11")
+        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
+        $acl.SetAccessRule($rule)
+        Set-Acl -Path $directory.FullName -AclObject $acl
 
         #Create Shortcuts
         if ($StartMenuShortcut) {
diff --git a/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1 b/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
index ec614d1..bd6a608 100644
--- a/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
+++ b/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
@@ -53,17 +53,41 @@ function Invoke-PostUpdateActions {
         Write-Log "-> MaxLogFiles/MaxLogSize setting was missing. Fixed with 3/1048576 (in bytes, default is 1048576 = 1 MB)."
     }
 
-    #Most likely an enterprise with central mods, not a home user
-    $ModsPath = Get-ItemProperty $regPath -Name WAU_ModsPath -ErrorAction SilentlyContinue
-    if ($ModsPath) {
-        # Set ReadOnly on Mods Directory for Local Users - Security risk if not done (they could create a script of their own - System Context)!
-        $directory = Get-Item -Path "$WingetUpdatePath\mods"
-        $acl = Get-Acl -Path $directory.FullName
-        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "Write", "Deny")
-        $acl.SetAccessRule($rule)
-        Set-Acl -Path $directory.FullName -AclObject $acl
-    }
+    #Security: Mods directory must be protected (Users could create scripts of their own - then they're run in System Context)!
+    $WingetUpdatePath = Get-ItemProperty $regPath -Name InstallLocation -ErrorAction SilentlyContinue
+    $directory = Get-Item -Path "$WingetUpdatePath\mods"
+    $acl = Get-Acl -Path $directory.FullName
+    #Disable inheritance
+    $acl.SetAccessRuleProtection($True, $True)
+    # Remove any existing rules
+    $acl.Access | ForEach-Object { $acl.RemoveAccessRule($_) }
+    #SYSTEM Full - S-1-5-18
+    $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-18")
+    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
+    $acl.SetAccessRule($rule)
+    # Save the updated ACL
+    Set-Acl -Path $directory.FullName -AclObject $acl | Out-Null
+
+    #Administrators Full - S-1-5-32-544
+    $acl = Get-Acl -Path $directory.FullName
+    $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
+    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
+    $acl.SetAccessRule($rule)
+    Set-Acl -Path $directory.FullName -AclObject $acl
+    
+    #Local Users ReadAndExecute - S-1-5-32-545 S-1-5-11
+    $acl = Get-Acl -Path $directory.FullName
+    $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
+    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
+    $acl.SetAccessRule($rule)
+    Set-Acl -Path $directory.FullName -AclObject $acl
+
+    #Authenticated Users ReadAndExecute - S-1-5-11
+    $acl = Get-Acl -Path $directory.FullName
+    $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-11")
+    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
+    $acl.SetAccessRule($rule)
+    Set-Acl -Path $directory.FullName -AclObject $acl
 
     #Convert about.xml if exists (previous WAU versions) to reg
     $WAUAboutPath = "$WorkingDir\config\about.xml"

From a1a427ec254d6cc00f18960f9f35c73f267757ee Mon Sep 17 00:00:00 2001
From: KnifMelti <gaj@knifmelti.se>
Date: Sat, 4 Feb 2023 14:06:07 +0100
Subject: [PATCH 3/9] Log - No new update

---
 Winget-AutoUpdate/Winget-Upgrade.ps1 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Winget-AutoUpdate/Winget-Upgrade.ps1 b/Winget-AutoUpdate/Winget-Upgrade.ps1
index febaccc..39e4285 100644
--- a/Winget-AutoUpdate/Winget-Upgrade.ps1
+++ b/Winget-AutoUpdate/Winget-Upgrade.ps1
@@ -269,7 +269,7 @@ if (Test-Network) {
             }
         }
 
-        if ($InstallOK -eq 0) {
+        if ($InstallOK -eq 0 -or !$InstallOK) {
             Write-Log "No new update." "Green"
         }
 

From 80f61d9b15c90431d4815d966658b157b815f775 Mon Sep 17 00:00:00 2001
From: KnifMelti <gaj@knifmelti.se>
Date: Sun, 5 Feb 2023 00:10:32 +0100
Subject: [PATCH 4/9] All done now!

---
 Winget-AutoUpdate-Install.ps1                 | 77 ++++++++++++-------
 .../functions/Invoke-PostUpdateActions.ps1    | 77 ++++++++++++-------
 2 files changed, 96 insertions(+), 58 deletions(-)

diff --git a/Winget-AutoUpdate-Install.ps1 b/Winget-AutoUpdate-Install.ps1
index f0a24ef..9e5d3b7 100644
--- a/Winget-AutoUpdate-Install.ps1
+++ b/Winget-AutoUpdate-Install.ps1
@@ -381,40 +381,59 @@ function Install-WingetAutoUpdate {
         }
 
         #Security: Mods directory must be protected (Users could create scripts of their own - then they're run in System Context)!
+        #Check if Local Users have write rights in Mods directory or not
         $directory = Get-Item -Path "$WingetUpdatePath\mods"
         $acl = Get-Acl -Path $directory.FullName
-        #Disable inheritance
-        $acl.SetAccessRuleProtection($True, $True)
-        # Remove any existing rules
-        $acl.Access | ForEach-Object { $acl.RemoveAccessRule($_) }
-        #SYSTEM Full - S-1-5-18
-        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-18")
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
-        $acl.SetAccessRule($rule)
-        # Save the updated ACL
-        Set-Acl -Path $directory.FullName -AclObject $acl | Out-Null
-
-        #Administrators Full - S-1-5-32-544
-        $acl = Get-Acl -Path $directory.FullName
-        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
-        $acl.SetAccessRule($rule)
-        Set-Acl -Path $directory.FullName -AclObject $acl
-        
-        #Local Users ReadAndExecute - S-1-5-32-545 S-1-5-11
-        $acl = Get-Acl -Path $directory.FullName
+        #Local Users - S-1-5-32-545
         $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
-        $acl.SetAccessRule($rule)
-        Set-Acl -Path $directory.FullName -AclObject $acl
+        #Translate SID to Locale Name
+        $ntAccount = $userSID.Translate([System.Security.Principal.NTAccount])
+        $userName = $ntAccount.Value
+        $userRights = [System.Security.AccessControl.FileSystemRights]"Write"
+        
+        $hasWriteAccess = $False
+        
+        foreach ($access in $acl.Access) {
+            if ($access.IdentityReference.Value -eq $userName -and $access.FileSystemRights -eq $userRights) {
+                $hasWriteAccess = $True
+                break
+            }
+        }
+        
+        if ($hasWriteAccess) {
+            #Disable inheritance
+            $acl.SetAccessRuleProtection($True, $True)
+            # Remove any existing rules
+            $acl.Access | ForEach-Object { $acl.RemoveAccessRule($_) }
+            #SYSTEM Full - S-1-5-18
+            $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-18")
+            $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
+            $acl.SetAccessRule($rule)
+            # Save the updated ACL
+            Set-Acl -Path $directory.FullName -AclObject $acl
 
-        #Authenticated Users ReadAndExecute - S-1-5-11
-        $acl = Get-Acl -Path $directory.FullName
-        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-11")
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
-        $acl.SetAccessRule($rule)
-        Set-Acl -Path $directory.FullName -AclObject $acl
+            #Administrators Full - S-1-5-32-544
+            $acl = Get-Acl -Path $directory.FullName
+            $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
+            $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
+            $acl.SetAccessRule($rule)
+            Set-Acl -Path $directory.FullName -AclObject $acl
+            
+            #Local Users ReadAndExecute - S-1-5-32-545 S-1-5-11
+            $acl = Get-Acl -Path $directory.FullName
+            $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
+            $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
+            $acl.SetAccessRule($rule)
+            Set-Acl -Path $directory.FullName -AclObject $acl
 
+            #Authenticated Users ReadAndExecute - S-1-5-11
+            $acl = Get-Acl -Path $directory.FullName
+            $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-11")
+            $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
+            $acl.SetAccessRule($rule)
+            Set-Acl -Path $directory.FullName -AclObject $acl
+        }
+                        
         #Create Shortcuts
         if ($StartMenuShortcut) {
             if (!(Test-Path "${env:ProgramData}\Microsoft\Windows\Start Menu\Programs\Winget-AutoUpdate (WAU)")) {
diff --git a/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1 b/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
index bd6a608..18ba7ca 100644
--- a/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
+++ b/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
@@ -54,40 +54,59 @@ function Invoke-PostUpdateActions {
     }
 
     #Security: Mods directory must be protected (Users could create scripts of their own - then they're run in System Context)!
+    #Check if Local Users have write rights in Mods directory or not
     $WingetUpdatePath = Get-ItemProperty $regPath -Name InstallLocation -ErrorAction SilentlyContinue
     $directory = Get-Item -Path "$WingetUpdatePath\mods"
     $acl = Get-Acl -Path $directory.FullName
-    #Disable inheritance
-    $acl.SetAccessRuleProtection($True, $True)
-    # Remove any existing rules
-    $acl.Access | ForEach-Object { $acl.RemoveAccessRule($_) }
-    #SYSTEM Full - S-1-5-18
-    $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-18")
-    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
-    $acl.SetAccessRule($rule)
-    # Save the updated ACL
-    Set-Acl -Path $directory.FullName -AclObject $acl | Out-Null
-
-    #Administrators Full - S-1-5-32-544
-    $acl = Get-Acl -Path $directory.FullName
-    $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
-    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
-    $acl.SetAccessRule($rule)
-    Set-Acl -Path $directory.FullName -AclObject $acl
-    
-    #Local Users ReadAndExecute - S-1-5-32-545 S-1-5-11
-    $acl = Get-Acl -Path $directory.FullName
+    #Local Users - S-1-5-32-545
     $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
-    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
-    $acl.SetAccessRule($rule)
-    Set-Acl -Path $directory.FullName -AclObject $acl
+    #Translate SID to Locale Name
+    $ntAccount = $userSID.Translate([System.Security.Principal.NTAccount])
+    $userName = $ntAccount.Value
+    $userRights = [System.Security.AccessControl.FileSystemRights]"Write"
+    
+    $hasWriteAccess = $False
+    
+    foreach ($access in $acl.Access) {
+        if ($access.IdentityReference.Value -eq $userName -and $access.FileSystemRights -eq $userRights) {
+            $hasWriteAccess = $True
+            break
+        }
+    }
+    
+    if ($hasWriteAccess) {
+        #Disable inheritance
+        $acl.SetAccessRuleProtection($True, $True)
+        # Remove any existing rules
+        $acl.Access | ForEach-Object { $acl.RemoveAccessRule($_) }
+        #SYSTEM Full - S-1-5-18
+        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-18")
+        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
+        $acl.SetAccessRule($rule)
+        # Save the updated ACL
+        Set-Acl -Path $directory.FullName -AclObject $acl
 
-    #Authenticated Users ReadAndExecute - S-1-5-11
-    $acl = Get-Acl -Path $directory.FullName
-    $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-11")
-    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
-    $acl.SetAccessRule($rule)
-    Set-Acl -Path $directory.FullName -AclObject $acl
+        #Administrators Full - S-1-5-32-544
+        $acl = Get-Acl -Path $directory.FullName
+        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
+        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
+        $acl.SetAccessRule($rule)
+        Set-Acl -Path $directory.FullName -AclObject $acl
+        
+        #Local Users ReadAndExecute - S-1-5-32-545 S-1-5-11
+        $acl = Get-Acl -Path $directory.FullName
+        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
+        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
+        $acl.SetAccessRule($rule)
+        Set-Acl -Path $directory.FullName -AclObject $acl
+
+        #Authenticated Users ReadAndExecute - S-1-5-11
+        $acl = Get-Acl -Path $directory.FullName
+        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-11")
+        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
+        $acl.SetAccessRule($rule)
+        Set-Acl -Path $directory.FullName -AclObject $acl
+    }
 
     #Convert about.xml if exists (previous WAU versions) to reg
     $WAUAboutPath = "$WorkingDir\config\about.xml"

From d20fddf0975c6dff09567e5ec7661f6cfa342c98 Mon Sep 17 00:00:00 2001
From: KnifMelti <gaj@knifmelti.se>
Date: Sun, 5 Feb 2023 15:17:43 +0100
Subject: [PATCH 5/9] Log

---
 Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1 | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1 b/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
index 18ba7ca..8303eec 100644
--- a/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
+++ b/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
@@ -106,6 +106,10 @@ function Invoke-PostUpdateActions {
         $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
         $acl.SetAccessRule($rule)
         Set-Acl -Path $directory.FullName -AclObject $acl
+
+        #log
+        Write-Log "-> The mods directory is now secured!."
+
     }
 
     #Convert about.xml if exists (previous WAU versions) to reg

From 7e04696cc0379d0fb3b470150fd1e07c7f955c34 Mon Sep 17 00:00:00 2001
From: KnifMelti <gaj@knifmelti.se>
Date: Mon, 6 Feb 2023 07:47:06 +0100
Subject: [PATCH 6/9] Function for ModsProtect

---
 Winget-AutoUpdate-Install.ps1                 | 59 +++--------------
 .../functions/Invoke-ModsProtect.ps1          | 60 ++++++++++++++++++
 .../functions/Invoke-PostUpdateActions.ps1    | 63 +++----------------
 3 files changed, 75 insertions(+), 107 deletions(-)
 create mode 100644 Winget-AutoUpdate/functions/Invoke-ModsProtect.ps1

diff --git a/Winget-AutoUpdate-Install.ps1 b/Winget-AutoUpdate-Install.ps1
index 9e5d3b7..3ab3a11 100644
--- a/Winget-AutoUpdate-Install.ps1
+++ b/Winget-AutoUpdate-Install.ps1
@@ -380,58 +380,15 @@ function Install-WingetAutoUpdate {
             Set-Acl -Path $LogFile -AclObject $NewAcl
         }
 
-        #Security: Mods directory must be protected (Users could create scripts of their own - then they're run in System Context)!
-        #Check if Local Users have write rights in Mods directory or not
-        $directory = Get-Item -Path "$WingetUpdatePath\mods"
-        $acl = Get-Acl -Path $directory.FullName
-        #Local Users - S-1-5-32-545
-        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
-        #Translate SID to Locale Name
-        $ntAccount = $userSID.Translate([System.Security.Principal.NTAccount])
-        $userName = $ntAccount.Value
-        $userRights = [System.Security.AccessControl.FileSystemRights]"Write"
-        
-        $hasWriteAccess = $False
-        
-        foreach ($access in $acl.Access) {
-            if ($access.IdentityReference.Value -eq $userName -and $access.FileSystemRights -eq $userRights) {
-                $hasWriteAccess = $True
-                break
-            }
+        #Security check
+        Write-host "`nChecking Mods Directory:" -ForegroundColor Yellow
+        . "$WingetUpdatePath\functions\Invoke-ModsProtect.ps1"
+        $Protected = Invoke-ModsProtect "$WingetUpdatePath\mods"
+        if ($Protected) {
+            Write-Host "The mods directory is now secured!`n" -ForegroundColor Green
         }
-        
-        if ($hasWriteAccess) {
-            #Disable inheritance
-            $acl.SetAccessRuleProtection($True, $True)
-            # Remove any existing rules
-            $acl.Access | ForEach-Object { $acl.RemoveAccessRule($_) }
-            #SYSTEM Full - S-1-5-18
-            $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-18")
-            $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
-            $acl.SetAccessRule($rule)
-            # Save the updated ACL
-            Set-Acl -Path $directory.FullName -AclObject $acl
-
-            #Administrators Full - S-1-5-32-544
-            $acl = Get-Acl -Path $directory.FullName
-            $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
-            $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
-            $acl.SetAccessRule($rule)
-            Set-Acl -Path $directory.FullName -AclObject $acl
-            
-            #Local Users ReadAndExecute - S-1-5-32-545 S-1-5-11
-            $acl = Get-Acl -Path $directory.FullName
-            $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
-            $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
-            $acl.SetAccessRule($rule)
-            Set-Acl -Path $directory.FullName -AclObject $acl
-
-            #Authenticated Users ReadAndExecute - S-1-5-11
-            $acl = Get-Acl -Path $directory.FullName
-            $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-11")
-            $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
-            $acl.SetAccessRule($rule)
-            Set-Acl -Path $directory.FullName -AclObject $acl
+        elseif (!$Protected) {
+            Write-Host "The mods directory was already secured!`n" -ForegroundColor Green
         }
                         
         #Create Shortcuts
diff --git a/Winget-AutoUpdate/functions/Invoke-ModsProtect.ps1 b/Winget-AutoUpdate/functions/Invoke-ModsProtect.ps1
new file mode 100644
index 0000000..98eff2e
--- /dev/null
+++ b/Winget-AutoUpdate/functions/Invoke-ModsProtect.ps1
@@ -0,0 +1,60 @@
+#Function to check if Mods Directory is secured.
+#Security: Mods directory must be protected (Users could create scripts of their own - then they'll run in System Context)!
+#Check if Local Users have write rights in Mods directory or not (and take action if necessary):
+
+function Invoke-ModsProtect ($ModsPath) {
+    $directory = Get-Item -Path $ModsPath
+    $acl = Get-Acl -Path $directory.FullName
+    #Local Users - S-1-5-32-545
+    $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
+    #Translate SID to Locale Name
+    $ntAccount = $userSID.Translate([System.Security.Principal.NTAccount])
+    $userName = $ntAccount.Value
+    $userRights = [System.Security.AccessControl.FileSystemRights]"Write"
+    
+    $hasWriteAccess = $False
+    
+    foreach ($access in $acl.Access) {
+        if ($access.IdentityReference.Value -eq $userName -and $access.FileSystemRights -eq $userRights) {
+            $hasWriteAccess = $True
+            break
+        }
+    }
+    
+    if ($hasWriteAccess) {
+        #Disable inheritance
+        $acl.SetAccessRuleProtection($True, $True)
+        # Remove any existing rules
+        $acl.Access | ForEach-Object { $acl.RemoveAccessRule($_) }
+        #SYSTEM Full - S-1-5-18
+        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-18")
+        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
+        $acl.SetAccessRule($rule)
+        # Save the updated ACL
+        Set-Acl -Path $directory.FullName -AclObject $acl
+
+        #Administrators Full - S-1-5-32-544
+        $acl = Get-Acl -Path $directory.FullName
+        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
+        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
+        $acl.SetAccessRule($rule)
+        Set-Acl -Path $directory.FullName -AclObject $acl
+        
+        #Local Users ReadAndExecute - S-1-5-32-545 S-1-5-11
+        $acl = Get-Acl -Path $directory.FullName
+        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
+        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
+        $acl.SetAccessRule($rule)
+        Set-Acl -Path $directory.FullName -AclObject $acl
+
+        #Authenticated Users ReadAndExecute - S-1-5-11
+        $acl = Get-Acl -Path $directory.FullName
+        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-11")
+        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
+        $acl.SetAccessRule($rule)
+        Set-Acl -Path $directory.FullName -AclObject $acl
+
+        return $True
+    }
+    return $False
+}
\ No newline at end of file
diff --git a/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1 b/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
index 8303eec..35d2acb 100644
--- a/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
+++ b/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
@@ -53,63 +53,14 @@ function Invoke-PostUpdateActions {
         Write-Log "-> MaxLogFiles/MaxLogSize setting was missing. Fixed with 3/1048576 (in bytes, default is 1048576 = 1 MB)."
     }
 
-    #Security: Mods directory must be protected (Users could create scripts of their own - then they're run in System Context)!
-    #Check if Local Users have write rights in Mods directory or not
-    $WingetUpdatePath = Get-ItemProperty $regPath -Name InstallLocation -ErrorAction SilentlyContinue
-    $directory = Get-Item -Path "$WingetUpdatePath\mods"
-    $acl = Get-Acl -Path $directory.FullName
-    #Local Users - S-1-5-32-545
-    $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
-    #Translate SID to Locale Name
-    $ntAccount = $userSID.Translate([System.Security.Principal.NTAccount])
-    $userName = $ntAccount.Value
-    $userRights = [System.Security.AccessControl.FileSystemRights]"Write"
-    
-    $hasWriteAccess = $False
-    
-    foreach ($access in $acl.Access) {
-        if ($access.IdentityReference.Value -eq $userName -and $access.FileSystemRights -eq $userRights) {
-            $hasWriteAccess = $True
-            break
-        }
+    #Security check
+    Write-Log "-> Checking Mods Directory:" "yellow"
+    $Protected = Invoke-ModsProtect "$($WAUConfig.InstallLocation)\mods"
+    if ($Protected) {
+        Write-Log "-> The mods directory is now secured!" "green"
     }
-    
-    if ($hasWriteAccess) {
-        #Disable inheritance
-        $acl.SetAccessRuleProtection($True, $True)
-        # Remove any existing rules
-        $acl.Access | ForEach-Object { $acl.RemoveAccessRule($_) }
-        #SYSTEM Full - S-1-5-18
-        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-18")
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
-        $acl.SetAccessRule($rule)
-        # Save the updated ACL
-        Set-Acl -Path $directory.FullName -AclObject $acl
-
-        #Administrators Full - S-1-5-32-544
-        $acl = Get-Acl -Path $directory.FullName
-        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
-        $acl.SetAccessRule($rule)
-        Set-Acl -Path $directory.FullName -AclObject $acl
-        
-        #Local Users ReadAndExecute - S-1-5-32-545 S-1-5-11
-        $acl = Get-Acl -Path $directory.FullName
-        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
-        $acl.SetAccessRule($rule)
-        Set-Acl -Path $directory.FullName -AclObject $acl
-
-        #Authenticated Users ReadAndExecute - S-1-5-11
-        $acl = Get-Acl -Path $directory.FullName
-        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-11")
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
-        $acl.SetAccessRule($rule)
-        Set-Acl -Path $directory.FullName -AclObject $acl
-
-        #log
-        Write-Log "-> The mods directory is now secured!."
-
+    elseif (!$Protected) {
+        Write-Log "-> The mods directory was already secured!" "green"
     }
 
     #Convert about.xml if exists (previous WAU versions) to reg

From 95abd0f80778e08c4040e910725735707b9f07fb Mon Sep 17 00:00:00 2001
From: KnifMelti <gaj@knifmelti.se>
Date: Tue, 7 Feb 2023 05:50:18 +0100
Subject: [PATCH 7/9] Set WAU_ModsPath if not set when upgrading online

---
 Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1 | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1 b/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
index 35d2acb..97a91ae 100644
--- a/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
+++ b/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
@@ -53,6 +53,15 @@ function Invoke-PostUpdateActions {
         Write-Log "-> MaxLogFiles/MaxLogSize setting was missing. Fixed with 3/1048576 (in bytes, default is 1048576 = 1 MB)."
     }
 
+    #Set WAU_ModsPath if not set
+    $ModsPath = Get-ItemProperty $regPath -Name WAU_ModsPath -ErrorAction SilentlyContinue
+    if (!$ModsPath) {
+        New-ItemProperty $regPath -Name WAU_ModsPath -Force | Out-Null
+
+        #log
+        Write-Log "-> ModsPath setting was missing. Fixed with empty string."
+    }
+
     #Security check
     Write-Log "-> Checking Mods Directory:" "yellow"
     $Protected = Invoke-ModsProtect "$($WAUConfig.InstallLocation)\mods"

From 2471438c3b524332ec64c413fee2708613cf42e1 Mon Sep 17 00:00:00 2001
From: KnifMelti <gaj@knifmelti.se>
Date: Tue, 7 Feb 2023 06:04:13 +0100
Subject: [PATCH 8/9] ListPath as well...

---
 Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1 | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1 b/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
index 97a91ae..de89e3c 100644
--- a/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
+++ b/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
@@ -53,6 +53,15 @@ function Invoke-PostUpdateActions {
         Write-Log "-> MaxLogFiles/MaxLogSize setting was missing. Fixed with 3/1048576 (in bytes, default is 1048576 = 1 MB)."
     }
 
+    #Set WAU_ListPath if not set
+    $ListPath = Get-ItemProperty $regPath -Name WAU_ListPath -ErrorAction SilentlyContinue
+    if (!$ListPath) {
+        New-ItemProperty $regPath -Name WAU_ListPath -Force | Out-Null
+
+        #log
+        Write-Log "-> ListPath setting was missing. Fixed with empty string."
+    }
+
     #Set WAU_ModsPath if not set
     $ModsPath = Get-ItemProperty $regPath -Name WAU_ModsPath -ErrorAction SilentlyContinue
     if (!$ModsPath) {

From c505773f8cf1086664c9094c919ef6c16ba5e14a Mon Sep 17 00:00:00 2001
From: KnifMelti <gaj@knifmelti.se>
Date: Tue, 7 Feb 2023 20:06:54 +0100
Subject: [PATCH 9/9] A bit of error handling in ModsProtect

---
 Winget-AutoUpdate-Install.ps1                 |   7 +-
 .../functions/Invoke-ModsProtect.ps1          | 107 +++++++++---------
 .../functions/Invoke-PostUpdateActions.ps1    |   7 +-
 3 files changed, 66 insertions(+), 55 deletions(-)

diff --git a/Winget-AutoUpdate-Install.ps1 b/Winget-AutoUpdate-Install.ps1
index 3ab3a11..b836d5a 100644
--- a/Winget-AutoUpdate-Install.ps1
+++ b/Winget-AutoUpdate-Install.ps1
@@ -384,12 +384,15 @@ function Install-WingetAutoUpdate {
         Write-host "`nChecking Mods Directory:" -ForegroundColor Yellow
         . "$WingetUpdatePath\functions\Invoke-ModsProtect.ps1"
         $Protected = Invoke-ModsProtect "$WingetUpdatePath\mods"
-        if ($Protected) {
+        if ($Protected -eq $True) {
             Write-Host "The mods directory is now secured!`n" -ForegroundColor Green
         }
-        elseif (!$Protected) {
+        elseif ($Protected -eq $False) {
             Write-Host "The mods directory was already secured!`n" -ForegroundColor Green
         }
+        else {
+            Write-Host "Error: The mods directory couldn't be verified as secured!`n" -ForegroundColor Red
+        }
                         
         #Create Shortcuts
         if ($StartMenuShortcut) {
diff --git a/Winget-AutoUpdate/functions/Invoke-ModsProtect.ps1 b/Winget-AutoUpdate/functions/Invoke-ModsProtect.ps1
index 98eff2e..b800571 100644
--- a/Winget-AutoUpdate/functions/Invoke-ModsProtect.ps1
+++ b/Winget-AutoUpdate/functions/Invoke-ModsProtect.ps1
@@ -3,58 +3,63 @@
 #Check if Local Users have write rights in Mods directory or not (and take action if necessary):
 
 function Invoke-ModsProtect ($ModsPath) {
-    $directory = Get-Item -Path $ModsPath
-    $acl = Get-Acl -Path $directory.FullName
-    #Local Users - S-1-5-32-545
-    $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
-    #Translate SID to Locale Name
-    $ntAccount = $userSID.Translate([System.Security.Principal.NTAccount])
-    $userName = $ntAccount.Value
-    $userRights = [System.Security.AccessControl.FileSystemRights]"Write"
-    
-    $hasWriteAccess = $False
-    
-    foreach ($access in $acl.Access) {
-        if ($access.IdentityReference.Value -eq $userName -and $access.FileSystemRights -eq $userRights) {
-            $hasWriteAccess = $True
-            break
-        }
-    }
-    
-    if ($hasWriteAccess) {
-        #Disable inheritance
-        $acl.SetAccessRuleProtection($True, $True)
-        # Remove any existing rules
-        $acl.Access | ForEach-Object { $acl.RemoveAccessRule($_) }
-        #SYSTEM Full - S-1-5-18
-        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-18")
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
-        $acl.SetAccessRule($rule)
-        # Save the updated ACL
-        Set-Acl -Path $directory.FullName -AclObject $acl
-
-        #Administrators Full - S-1-5-32-544
-        $acl = Get-Acl -Path $directory.FullName
-        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
-        $acl.SetAccessRule($rule)
-        Set-Acl -Path $directory.FullName -AclObject $acl
-        
-        #Local Users ReadAndExecute - S-1-5-32-545 S-1-5-11
+    try {
+        $directory = Get-Item -Path $ModsPath -ErrorAction SilentlyContinue
         $acl = Get-Acl -Path $directory.FullName
+        #Local Users - S-1-5-32-545
         $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
-        $acl.SetAccessRule($rule)
-        Set-Acl -Path $directory.FullName -AclObject $acl
-
-        #Authenticated Users ReadAndExecute - S-1-5-11
-        $acl = Get-Acl -Path $directory.FullName
-        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-11")
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
-        $acl.SetAccessRule($rule)
-        Set-Acl -Path $directory.FullName -AclObject $acl
-
-        return $True
+        #Translate SID to Locale Name
+        $ntAccount = $userSID.Translate([System.Security.Principal.NTAccount])
+        $userName = $ntAccount.Value
+        $userRights = [System.Security.AccessControl.FileSystemRights]"Write"
+        
+        $hasWriteAccess = $False
+        
+        foreach ($access in $acl.Access) {
+            if ($access.IdentityReference.Value -eq $userName -and $access.FileSystemRights -eq $userRights) {
+                $hasWriteAccess = $True
+                break
+            }
+        }
+        
+        if ($hasWriteAccess) {
+            #Disable inheritance
+            $acl.SetAccessRuleProtection($True, $True)
+            # Remove any existing rules
+            $acl.Access | ForEach-Object { $acl.RemoveAccessRule($_) }
+            #SYSTEM Full - S-1-5-18
+            $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-18")
+            $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
+            $acl.SetAccessRule($rule)
+            # Save the updated ACL
+            Set-Acl -Path $directory.FullName -AclObject $acl
+    
+            #Administrators Full - S-1-5-32-544
+            $acl = Get-Acl -Path $directory.FullName
+            $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
+            $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
+            $acl.SetAccessRule($rule)
+            Set-Acl -Path $directory.FullName -AclObject $acl
+            
+            #Local Users ReadAndExecute - S-1-5-32-545 S-1-5-11
+            $acl = Get-Acl -Path $directory.FullName
+            $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
+            $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
+            $acl.SetAccessRule($rule)
+            Set-Acl -Path $directory.FullName -AclObject $acl
+    
+            #Authenticated Users ReadAndExecute - S-1-5-11
+            $acl = Get-Acl -Path $directory.FullName
+            $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-11")
+            $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
+            $acl.SetAccessRule($rule)
+            Set-Acl -Path $directory.FullName -AclObject $acl
+    
+            return $True
+        }
+        return $False
+    }
+    catch {
+        return "Error"
     }
-    return $False
 }
\ No newline at end of file
diff --git a/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1 b/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
index de89e3c..5bfe644 100644
--- a/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
+++ b/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
@@ -74,12 +74,15 @@ function Invoke-PostUpdateActions {
     #Security check
     Write-Log "-> Checking Mods Directory:" "yellow"
     $Protected = Invoke-ModsProtect "$($WAUConfig.InstallLocation)\mods"
-    if ($Protected) {
+    if ($Protected -eq $True) {
         Write-Log "-> The mods directory is now secured!" "green"
     }
-    elseif (!$Protected) {
+    elseif ($Protected -eq $False) {
         Write-Log "-> The mods directory was already secured!" "green"
     }
+    else {
+        Write-Log "-> Error: The mods directory couldn't be verified as secured!" "red"
+    }
 
     #Convert about.xml if exists (previous WAU versions) to reg
     $WAUAboutPath = "$WorkingDir\config\about.xml"