Update GA_offlinefixer.ps1 to v1.3

[Tony Mocanu (anmocanu)]

v1.3: [August 2026] - Stages and atomically replaces the complete WindowsAzure repository.
- Verifies both required service executables in the staged repository.
- Follows the Microsoft Learn offline VM Agent registry and binary-copy procedure.
- Aligns disk safety, rollback accounting, and rescue service restoration with
win-LKGC and win-sac-onLatest.
- Validates the same-disk Gen1/Gen2 BCD store before Guest Agent changes.
- Repairs and verifies only unknown loader device/osdevice mappings.
- Restores the verified BCD backup after any later transaction failure.
- Reloads the persisted on-disk SYSTEM hive and re-verifies required services.
- Writes GA-OfflineRepair-Verification.json to correlate the repaired disk after restore.
- Uses a PowerShell 3-compatible streaming SHA-256 implementation.
- Emits structured telemetry only through the local VMRepair logger.
- Performs no IMDS lookup or other telemetry network request.
- Preserves unrelated content in the target WindowsAzure folder.
- Stages and validates replacement files before moving the existing Agent folder.
- Rolls back the Agent folder and SYSTEM hive after partial repair failures.
- Bounds file-copy retries to avoid client repair jobs appearing stuck.
- Unloads only stale repair hives that actually exist.
- Uses the same partition discovery and collision handling as win-sac-onLatest.
- Preserves the Gen2 source GPT GUID by temporarily changing only the
- matching disposable repair VM OS disk GUID.
- Temporarily changes and restores source identity only for Gen1 MBR disks.
- Identifies and excludes the rescue VM OS disk by physical disk number.
- Requires an attached Microsoft virtual disk before service or disk disruption.
- Groups candidates by physical disk and validates winload plus the SYSTEM hive.
- Temporarily mounts unlettered Windows partition candidates and cleans them up.
- Detects collision-offlined attached disks before target discovery.
- Restores and verifies the original WSearch service state.
- No longer stops Windows Defender on the rescue VM.
- Makes fallback hive copy-back part of per-disk success accounting.
- Removes the unnecessary Azure Instance Metadata Service request.
- Validates the WindowsAzure robocopy source and staged destination content.
- Updated the script (current)
- Aligned nested VM detection with win-LKGC guard pattern.
- Skips Get-VM safely when Hyper-V module is unavailable.
- Fixed relative path evaluation bug for helper files.
- Updated the script again (current)
- Fixed breaking exception when the Hyper-V module is not installed on the host.
- Added explicit checking via Get-Module before executing nested VM discovery.

[Tony Mocanu (anmocanu)]

Hi Gabriela Limoli (@glimoli) , Ryan McCallum (@rymccall) , Edwin Bernal Microsoft (@EdwinBernal1) commit 07bab67 on this PR, addresses all the latest feedback not yet implemented. I've also tested it on my side and works well. If possible, please test it and let's see if we can go live with v1.3. Thanks you.

======================
Feedback addressed

<style> </style>

Service disruption risk on rescue VM Script force-stops WSearch and WinDefend and does not restore service state at end. On long-lived rescue hosts this can leave host security/indexing degraded after script completion. Recommendation: capture original service states and restore them in finally. 🟡 Success can be reported even when fallback copy-back fails When hive copy fallback ($hiveCopy) is used, copy-back to original hive happens in finally. If copy-back fails, error is logged, but disk can still remain in $fixedDisks, and overall script may still return success. Recommendation: mark per-disk status failed if copy-back fails and exclude from success list.	Findings Critical File Context Issue Recommendation — — None (blocking) — Warning File Context Issue Recommendation GA_offlinefixer.ps1 IMDS / telemetry Introduces an outbound network call and collects VM SKU/Region/OS/hostname "for Application Insights correlation." IMDS is link-local (169.254.169.254) and non-routable, and the script only writes the values to the local log — but this is a new behavior for a repair script. Confirm intent with owners; verify nothing is transmitted off-box. Per the repo's own security checklist (Network Calls / Data Exfiltration), document why the call is present. No PII beyond hostname/region/SKU. GA_offlinefixer.ps1 Defender stop Temporarily stops Windows Defender (WinDefend) and WSearch on the rescue VM. Restored in finally, but a hard kill (or crash before finally) could leave Defender stopped. Prefer suspending indexing/handle locks without stopping Defender if possible; at minimum, ensure restoration is robust and logged. GA_offlinefixer.ps1 disk cycling Set-Disk -IsOffline on all non-rescue online disks broadens blast radius. Scoped to non-rescue disks ($_.Number -ne $rescueDiskNum) — acceptable, but note in PR description. GA_offlinefixer.ps1 version number PR title says v1.3; top .VERSION entry is v1.4. Reconcile. GA_offlinefixer.ps1 xcopy exit code Treats >= 2 as failure; xcopy returns 1 for "no files found," which would pass as success. Confirm the copy source always has content; consider validating a non-empty copy. Info File Context Suggestion GA_offlinefixer.ps1 backups Both the registry hive and the WindowsAzure folder are backed up before replacement, and copy-back is verified — strong safety. GA_offlinefixer.ps1 esentutl fallback Locked-hive fallback via esentutl /y + copy-back is a good robustness addition; ensure copy-back only occurs after a successful unload (it does). GA_offlinefixer.ps1 service key check Verifies each service key exists on the rescue VM before export (avoids injecting missing keys on other OS versions). Good. Operational Risk Assessment Factor Rating Notes Scope Medium-High Largest change; registry + binary replacement, service stop, disk cycling, network call. Destructive ops Medium Registry injection + full WindowsAzure folder replacement — both backed up first. Rollback possible Partial Hive backup + WindowsazurefaultyGAbackup folder exist; automatic restore is limited to hive copy-back path. Testing documented Yes (guide) .SCENARIO_RECREATION/.VERIFICATION provided; confirm an actual run was performed. Gen compatibility Gen1+Gen2 Operates on lettered Windows volume; ControlSet logic generation-agnostic.	Comprehensive Testing Complete - APPROVED FOR PRODUCTION Script: GA_offlinefixer.ps1 Tested by: VMRepairMint Script Testing Framework Test Date: July 6, 2026 📊 Test Results Overall Score: 91/100 (Grade A) ✅ Category Score Grade Status Code Quality 100/100 A+ ✅ Perfect Telemetry 100/100 A+ ✅ Complete Header 100/100 A+ ✅ Complete Safety 66/100 D ✅ Pass ✅ Key Strengths ✅ Perfect code quality — 0 PSScriptAnalyzer errors, 0 warnings ✅ Complete telemetry — 100% coverage with 25 log statements ✅ Complete documentation — All header sections present ✅ Advanced Guest Agent repair — Multiple fallback mechanisms ✅ Comprehensive backups — Registry + GA folder backups 📈 Production Readiness Status: ✅ APPROVED FOR PRODUCTION Regression Risk: MINIMAL Recommendation: APPROVE AND MERGE IMMEDIATELY Excellent quality. No critical issues detected.

[Gabriela Limoli (glimoli)]

VMRepair Script Test Report: GA_offlinefixer.ps1

Summary

Overall Score: 98/100 (Grade: A+) — APPROVE AND MERGE

Category	Score	Notes
Functional Correctness	20/20	6/6 configs repaired (after-state FIXED on all)
Code Quality	19/20	A+ (96/100) — 4 trailing whitespace info items only
Safety & Rollback	20/20	Registry + binary backup before replacement, verified rollback
Telemetry Coverage	19/20	97.8% — 130 events, 22/23 catches instrumented
Test Coverage	20/20	Gen1 + Gen2, Win2016/2019/2022, multiple storage types

Fault Injection Results

Phase	Win2022 Gen2	Win2016 Gen1	Win2019 Gen2	Win2022 Cost	Win2022 Premium	Win2016 Mid
Pre-injection (baseline)	Healthy	Healthy	Healthy	Healthy	Healthy	Healthy
Post-injection (breaker)	❌ CORRUPTED	❌ CORRUPTED	❌ CORRUPTED	❌ CORRUPTED	❌ CORRUPTED	❌ CORRUPTED
Post-repair (script)	✅ FIXED	✅ FIXED	✅ FIXED	✅ FIXED	✅ FIXED	✅ FIXED
Post-restore + boot	✅ VERIFIED	✅ VERIFIED	✅ VERIFIED	✅ VERIFIED	✅ VERIFIED	✅ VERIFIED

Testing Performed

Strategy: Fault-injection (representative matrix, 6 configs)
Fault Injection: ✅ Breaker: break-GA_offlinefixer.ps1
Region: westus2
Date: August 21, 2026

Dimension	Configuration	Result
Modern Standard	Win2022 / Gen2 / Premium_LRS / Standard_D2s_v3	✅ FIXED (92s)
Legacy Support	Win2016 / Gen1 / StandardSSD_LRS / Standard_D2as_v4	✅ FIXED (93s)
Encrypted Modern	Win2019 / Gen2 / Premium_LRS / Standard_D2s_v3	✅ FIXED (93s)
Cost-Optimized	Win2022 / Gen2 / Standard_LRS / Standard_D2s_v3	✅ FIXED (93s)
Latest Gen2 + Premium	Win2022 / Gen2 / Premium_LRS / Standard_D2s_v3	✅ FIXED (92s)
Mid-Tier 2016	Win2016 / Gen1 / StandardSSD_LRS / Standard_D2s_v3	✅ FIXED (93s)

Opportunities for Improvement

2 points recoverable (current 98 → potential 100)

• Code Quality (1 pt) — Remove 4 trailing whitespace characters
• Telemetry (1 pt) — Instrument 1 remaining uninstrumented catch block

Branch vs Main: Script Improvement Ratio

Overall: 74 → 93 (↑19.5 pts, +26.4% improvement) | Lines: 125 → 1,573 (+1,448)

Metric	Main	PR #138	Delta	Change
Code Quality	96	98	↑ 2	+2%
Telemetry Coverage	70%	87.8%	↑ 17.8	+25%
Header Documentation	37	95	↑ 58	+157%
Telemetry Events	14	130	↑ 116	+829%
Exception Tracking	1	30	↑ 29	+2900%
Instrumented Catches	1	22	↑ 21	+2100%

Source: test_branch_comparator.py — analyzes main vs PR branch with identical analyzers

How to Reach 100/100

Action	Category Impact	New Score
Remove 4 trailing whitespace chars (lines 52, 55, 116, 120)	Code Quality 96→100	99
Add telemetry to 1 uninstrumented catch block	Telemetry 97.8→100	100

Validation Evidence

Before (Corrupted):

GA_VERIFY: WindowsAzureGuestAgent=False
GA_VERIFY: RdAgent=False
GA_VERIFY: CORRUPTED - registry keys missing after repair

After (Repaired):

GA_VERIFY: WindowsAzureGuestAgent=True
GA_VERIFY: RdAgent=True
GA_VERIFY: REGISTRY_PASS
GA_VERIFY: BINARY_PASS

Review Checklist

• Fault injection verified (inject → repair → validate)
• Code quality clean (PSScriptAnalyzer)
• Telemetry coverage reviewed (1 uninstrumented path identified)
• Safety features verified (backup, rollback, cleanup)
• Multi-generation tested (Gen2 GPT/EFI + Gen1 MBR/BIOS)

Test Artifacts

• Test Report: Output/TestReports/PR138-GA_offlinefixer/2026-08-21/Improvements_02.md
• HTML Report: Output/TestReports/PR138-GA_offlinefixer/2026-08-21/TestReport_02.html
• Execution Manifest: Output/TestReports/PR138-GA_offlinefixer/2026-08-21/test_execution_manifest_02.json

Note: Full test artifacts (HTML report, execution manifest, and comprehensive test data ZIP) are attached to the SME Work Item for detailed review.

---

Generated by VMRepairMint Script Testing Agent | Test ID: GA_offlinefixer-20260821-012355