Update win-LKGC.ps1 to 1.3.1

[Tony Mocanu (anmocanu)]

v1.3: [Aug 2026] - Aligns disk collision handling with the latest SAC repair path.
Preserves the attached source disk identity, temporarily changes only the
disposable repair OS disk for matching Gen2 GPT collisions, and restores
and verifies every temporary identity before reporting success.
v1.2.2: [Aug 2026] - Selects the existing LastKnownGood control set instead of incrementing
Select values and treats the absence of an alternate LKGC as a safe no-op.
Validates referenced control sets and their core Control and Services trees.
Prevents 0xc0000225 from missing or incomplete ControlSet references.
Adds logger-compatible JSON telemetry, SYSTEM hive backup, post-write
verification, unload retries, and backup rollback after failed writes.
Rejects invalid zero or negative boot control-set references before writes
and retries stale offline-hive cleanup before loading each SYSTEM hive.
Adds SAC-aligned repair-context detection, repair-disk exclusion, unlettered
Windows partition discovery, temporary drive assignment, and cleanup.
v1.2.1: [Aug 2026] - Added structured VMRepair telemetry for LKGC restoration.
Update [Jul 2026] - Partition Architecture Alignment: Refactored the core disk processing
loop to group by DiskNumber and map drive properties exactly like the
validated sac-enabler.ps1 framework.
v1.2: [May - Jul 2026] - Production Hardening & Handle Updates

[Tony Mocanu (anmocanu)]

Hi Gabriela Limoli (@glimoli) , Ryan McCallum (@rymccall) , Edwin Bernal Microsoft (@EdwinBernal1) , commit cca6790 on this PR, addresses all the latest feedback not yet implemented. I've also tested it on my side and works well. If possible, please test it and let's see if we can go live with v1.3. Thanks you!

=========================
Feedback addressed:

<style> </style>

Service disruption risk on rescue VM Script force-stops WSearch and WinDefend and does not restore service state at end. On long-lived rescue hosts this can leave host security/indexing degraded after script completion. Recommendation: capture original service states and restore them in finally. 🟡 Success can be reported even when fallback copy-back fails When hive copy fallback ($hiveCopy) is used, copy-back to original hive happens in finally. If copy-back fails, error is logged, but disk can still remain in $fixedDisks, and overall script may still return success. Recommendation: mark per-disk status failed if copy-back fails and exclude from success list.	Findings Critical File Context Issue Recommendation — — None (blocking) — Warning File Context Issue Recommendation GA_offlinefixer.ps1 IMDS / telemetry Introduces an outbound network call and collects VM SKU/Region/OS/hostname "for Application Insights correlation." IMDS is link-local (169.254.169.254) and non-routable, and the script only writes the values to the local log — but this is a new behavior for a repair script. Confirm intent with owners; verify nothing is transmitted off-box. Per the repo's own security checklist (Network Calls / Data Exfiltration), document why the call is present. No PII beyond hostname/region/SKU. GA_offlinefixer.ps1 Defender stop Temporarily stops Windows Defender (WinDefend) and WSearch on the rescue VM. Restored in finally, but a hard kill (or crash before finally) could leave Defender stopped. Prefer suspending indexing/handle locks without stopping Defender if possible; at minimum, ensure restoration is robust and logged. GA_offlinefixer.ps1 disk cycling Set-Disk -IsOffline on all non-rescue online disks broadens blast radius. Scoped to non-rescue disks ($_.Number -ne $rescueDiskNum) — acceptable, but note in PR description. GA_offlinefixer.ps1 version number PR title says v1.3; top .VERSION entry is v1.4. Reconcile. GA_offlinefixer.ps1 xcopy exit code Treats >= 2 as failure; xcopy returns 1 for "no files found," which would pass as success. Confirm the copy source always has content; consider validating a non-empty copy. Info File Context Suggestion GA_offlinefixer.ps1 backups Both the registry hive and the WindowsAzure folder are backed up before replacement, and copy-back is verified — strong safety. GA_offlinefixer.ps1 esentutl fallback Locked-hive fallback via esentutl /y + copy-back is a good robustness addition; ensure copy-back only occurs after a successful unload (it does). GA_offlinefixer.ps1 service key check Verifies each service key exists on the rescue VM before export (avoids injecting missing keys on other OS versions). Good. Operational Risk Assessment Factor Rating Notes Scope Medium-High Largest change; registry + binary replacement, service stop, disk cycling, network call. Destructive ops Medium Registry injection + full WindowsAzure folder replacement — both backed up first. Rollback possible Partial Hive backup + WindowsazurefaultyGAbackup folder exist; automatic restore is limited to hive copy-back path. Testing documented Yes (guide) .SCENARIO_RECREATION/.VERIFICATION provided; confirm an actual run was performed. Gen compatibility Gen1+Gen2 Operates on lettered Windows volume; ControlSet logic generation-agnostic.	Comprehensive Testing Complete - APPROVED FOR PRODUCTION Script: GA_offlinefixer.ps1 Tested by: VMRepairMint Script Testing Framework Test Date: July 6, 2026 📊 Test Results Overall Score: 91/100 (Grade A) ✅ Category Score Grade Status Code Quality 100/100 A+ ✅ Perfect Telemetry 100/100 A+ ✅ Complete Header 100/100 A+ ✅ Complete Safety 66/100 D ✅ Pass ✅ Key Strengths ✅ Perfect code quality — 0 PSScriptAnalyzer errors, 0 warnings ✅ Complete telemetry — 100% coverage with 25 log statements ✅ Complete documentation — All header sections present ✅ Advanced Guest Agent repair — Multiple fallback mechanisms ✅ Comprehensive backups — Registry + GA folder backups 📈 Production Readiness Status: ✅ APPROVED FOR PRODUCTION Regression Risk: MINIMAL Recommendation: APPROVE AND MERGE IMMEDIATELY Excellent quality. No critical issues detected.

[Gabriela Limoli (glimoli)]

VMRepair Script Testing Results — win-LKGC.ps1 v1.3

Test Framework: VMRepairMint | Strategy: Representative (breaker-integrated) | Date: 2026-08-20

Summary

Metric	Result
Overall Score	C (60/100)
Execution Success	4/4 VMs passed (100% of provisioned)
Code Quality	B (84/100) — 0 errors, 0 warnings, 16 info
Telemetry Coverage	33.7% — 1/12 catch blocks, 1/15 resolution paths instrumented

Test Matrix

Configuration	OS	Gen	VM Size	Breaker	Repair	After-State
Modern Standard	Win2022	V2	D2s_v3	✅ Injected	exit 0	✅ FIXED
Encrypted Modern	Win2019	V2	D2s_v3	✅ Injected	exit 0	✅ FIXED
Cost-Optimized	Win2022	V2	A2_v2	✅ Injected	exit 0	✅ FIXED
Mid-Tier 2016	Win2016	V1	D2s_v3	✅ Injected	exit 0	✅ FIXED
Legacy Gen1	—	—	—	⚠️ SKU capacity	—	SKIPPED
Latest Gen2 + Premium	—	—	—	⚠️ Disk attach timeout	—	SKIPPED

All 4 provisioned VMs had the LKGCNeeded fault injected (Current=1, Default=1, Failed=0, LKG=2) and the repair script successfully switched boot to ControlSet002.

Fault Injection Validation

BEFORE (breaker): Current=1, Default=1, Failed=0, LKG=2
AFTER  (repair):  Current=2, Default=2, Failed=1, LKG=2
Result: SCRIPT FINISHED PROPERLY, CHANGES_APPLIED=TRUE

Telemetry Gap Analysis

The script has a well-designed Write-LkgcTelemetry function, but only 7 of 22 required emission points are instrumented:

• 10/12 catch blocks use Log-Error only (no structured telemetry) — root-cause data invisible to App Insights
• 14/15 resolution-path branches log decisions via Log-Info/Log-Warning but don't emit telemetry — can't query which code path fired

A telemetry-enhanced reference implementation (all 15 additions, +86 lines) has been attached to the SME WI.

Recommendations

1. Telemetry — Add Write-LkgcTelemetry with RootCause property to uninstrumented catch blocks and ResolutionPath property to decision branches
2. Test coverage — Test NoAlternateLKGC (LKG=Current, no-op) and MissingControlSet (LKG=3, invalid ref) scenarios
3. Gen1 coverage — Validate MBR collision path with a Gen1 VM

Artifacts

Full test report, improvements document, and telemetry reference script attached to Azure-VM-POD WI #64443.

---

_{Generated by VMRepairMint Testing Framework}

[Tony Mocanu (anmocanu)]

Hi Gabriela Limoli (@glimoli) , the latest commit aee2d6e addresses the latest feedback. Let's see if we get a higher score to go live with v1.3.1. Thanks