fix: another elevated permission issue

Author: jacksyrm

playbook/Configuration/tweaks.yml

@@ -10,9 +10,9 @@ actions:
   # engine invocation; per-tweak order and enable/disable live in
   # Scripts\Tweaks\tweaks.manifest.psd1 (comment a line out to disable it).
   #
-  # Every tweak is now PowerShell - there are no !task includes. Tweaks needing the
-  # interactive user (theme/lock-screen and pin-to-Home COM) run via RunAs in their
-  # .psd1 (the engine bounces them to the user session with Invoke-AtlasAsUser).
+  # Every tweak is now PowerShell - there are no !task includes. Per-user shell COM
+  # (theme, lock-screen, pin-to-Home) is applied by Initialize-NewUser at first logon,
+  # not from these SYSTEM-context phases.
   #
   # ----------------------- END NOTES ----------------------- #
 

playbook/Executables/AtlasModules/Scripts/Initialize-NewUser.ps1

@@ -161,6 +161,16 @@ if ($setupMarker -lt 1) {
             # Set ThemeMRU (recent themes)
             Set-AtlasTheme -Path "$([Environment]::GetFolderPath('Windows'))\Resources\Themes\atlas-v0.5.x-dark.theme"
             Set-AtlasThemeMru | Out-Null
+
+            # Re-pin Music & Videos to File Explorer Home (they drop off once recent files
+            # are disabled). Shell COM against the running explorer, so it runs here at
+            # first logon rather than from the SYSTEM install phase.
+            try {
+                & (Join-Path -Path ([Environment]::GetFolderPath('Windows')) -ChildPath 'AtlasModules\Scripts\Tasks\Add-MusicVideosToHome.ps1')
+            }
+            catch {
+                Write-Warning "Failed to pin Music & Videos to Home: $($_.Exception.Message)"
+            }
         }
 
         # Set lockscreen wallpaper

playbook/Executables/AtlasModules/Scripts/Tweaks/README.md

@@ -46,7 +46,7 @@ All keys are optional except `Name`. Keys are applied in the order listed below.
 | `MinBuild` / `MaxBuild` | integer | Only apply on this Windows build range (inclusive). Maps the old YAML `builds: ['>=22000']` (`MinBuild = 22000`) and `builds: ['<22000']` (`MaxBuild = 21999`). Not enforced when the build number can't be read. |
 | `OnUpgrade` | `'Both'` (default), `'Skip'` or `'Only'` | `Skip` = fresh installs only, `Only` = upgrade installs only, `Both` = always. The default matches the legacy YAML semantics (actions without an `onUpgrade` gate ran on fresh installs and upgrades). |
 | `Oobe` | bool | When `$false`, the tweak is skipped during OOBE installs. |
-| `RunAs` | `'User'` or `'UserElevated'` | Runs the companion `Script` in the interactive user's session (via `Invoke-AtlasAsUser`) instead of in the TrustedInstaller engine process. For tweaks that drive the running shell (theme apply, pin-to-Home COM) or must act as the real user. Only affects `Script`; the other keys still run in the engine context. Requires the Tweaks phase (SYSTEM); if there is no interactive session the step is skipped with a warning. |
+| `RunAs` | `'User'` or `'UserElevated'` | Runs the companion `Script` in the interactive user's session (via `Invoke-AtlasAsUser`) instead of in the TrustedInstaller engine process. Only affects `Script`; the other keys still run in the engine context. **Do not use this for shell COM that restarts explorer (theme apply, pin-to-Home): during the SYSTEM install phase the child is parented under the phase, so a shell restart tears the phase down. Put that work in `Initialize-NewUser.ps1`, which runs at first logon in the real user session.** No shipped tweak currently uses `RunAs`. |
 | `Registry` | array of hashtables | Registry operations, see below. |
 | `Services` | array of hashtables | `@{ Name; StartupType (int 0-4); Operation }`. `Operation` is `'Change'` (default; writes the service key's `Start` value directly so protected services work), `'Stop'` or `'Start'`. `StartupType` is required for `Change`: 0 = Boot, 1 = System, 2 = Automatic, 3 = Manual, 4 = Disabled. |
 | `ScheduledTasks` | array of hashtables | `@{ Path; Operation }` with `Operation` = `'Disable'` (default) or `'Enable'`, applied via `schtasks.exe /Change`. A missing task only logs a warning. |

playbook/Executables/AtlasModules/Scripts/Tweaks/misc/add-music-videos-to-home.ps1

@@ -1,12 +1,11 @@
 @{
     Name        = 'Refresh Theme On Upgrade'
-    Description  = 'On upgrades, refreshes the theme MRU and keeps the Atlas theme as the default for new users.'
+    Description  = 'On upgrades, keeps the Atlas theme as the default for new users. The
+ThemeFile policy enforces the theme at the next logon without any interactive shell COM.'
     OnUpgrade   = 'Only'
-    RunAs       = 'UserElevated'
     Registry    = @(
         # Set the Atlas theme as the default for new accounts (default-user hive, loaded
         # during install).
         @{ Path = 'HKU\AME_UserHive_Default\Software\Policies\Microsoft\Windows\Personalization'; Name = 'ThemeFile'; Type = 'ExpandString'; Data = '%windir%\Resources\Themes\atlas-v0.5.x-dark.theme' }
     )
-    Script      = 'atlas-theme-upgrade.ps1'
 }

playbook/Executables/AtlasModules/Scripts/Tweaks/misc/add-music-videos-to-home.psd1

@@ -1,19 +1,10 @@
-# Companion of atlas-theme.psd1 (RunAs = UserElevated, fresh installs).
-# Applies the Atlas theme + lock-screen in the interactive user's session (COM
-# IThemeManager / WinRT lock-screen need the running shell). Best-effort: theming is
-# cosmetic, so a failure here must not abort the install.
+# Companion of atlas-theme.psd1. Runs in the install engine (TrustedInstaller); the
+# interactive theme/lock-screen apply lives in Initialize-NewUser (first logon).
+# Disables the rotating lock-screen "fun facts" for every provisioned account
+# (Enterprise/Education only). Dynamic subkeys under HKLM, so it can't be a static
+# Registry entry.
 $ErrorActionPreference = 'Continue'
 
-& (Join-Path -Path ([Environment]::GetFolderPath('Windows')) -ChildPath 'AtlasModules\initPowerShell.ps1')
-Import-Module Atlas.Themes -ErrorAction SilentlyContinue
-
-$themePath = Join-Path -Path ([Environment]::GetFolderPath('Windows')) -ChildPath 'Resources\Themes\atlas-v0.5.x-dark.theme'
-Set-AtlasTheme -Path $themePath
-Set-AtlasThemeMru
-Set-AtlasLockscreenImage
-
-# Disable the rotating lock-screen "fun facts" for every provisioned account
-# (Enterprise/Education only). Dynamic subkeys, so it can't be a static Registry entry.
 $creativeKey = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Creative'
 if (Test-Path -LiteralPath $creativeKey) {
     foreach ($userKey in (Get-ChildItem -LiteralPath $creativeKey).PSPath) {

playbook/Executables/AtlasModules/Scripts/Tweaks/qol/appearance/atlas-theme-upgrade.ps1

@@ -1,15 +1,11 @@
 @{
     Name        = 'Add Theme'
-    Description  = 'Applies the Atlas dark theme and lock-screen on fresh installs.'
-    # Fresh installs only; the upgrade path (re-apply theme MRU + default-user theme file)
-    # is atlas-theme-upgrade.psd1.
+    Description  = 'Lock-screen policy for fresh installs. The dark theme and lock-screen
+image are applied by Initialize-NewUser at first logon, where the shell COM runs in the
+real user session; applying them here (from the SYSTEM install phase) restarts the shell
+and tears down the phase.'
     OnUpgrade   = 'Skip'
-    # Applying a theme (IThemeManager) and the lock-screen image are COM calls against the
-    # running shell, so the companion runs in the interactive user's elevated session.
-    RunAs       = 'UserElevated'
     Registry    = @(
-        # Reliable policy writes stay in the engine (run as TrustedInstaller) so they apply
-        # even if the user-session theme apply below cannot run.
         @{ Path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization'; Name = 'LockScreenOverlaysDisabled'; Type = 'DWord'; Data = 1 }
         @{ Path = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'RotatingLockScreenEnabled'; Type = 'DWord'; Data = 0 }
     )

playbook/Executables/AtlasModules/Scripts/Tweaks/qol/appearance/atlas-theme-upgrade.psd1

@@ -99,7 +99,8 @@
                 'disable-auto-app-archival'
                 'add-sharing-settings-shortcut'
                 'appearance/blue-tooltips'
-                # Theme/lock-screen COM runs in the user session via RunAs (Invoke-AtlasAsUser).
+                # atlas-theme sets lock-screen policy; the theme itself is applied by
+                # Initialize-NewUser at first logon (interactive shell COM).
                 'appearance/atlas-theme'
                 'appearance/atlas-theme-upgrade'
                 'appearance/disallow-theme-changes'
@@ -213,8 +214,7 @@
                 'set-profile-pictures'
                 'backup-services'
                 'update-client-cbs'
-                # set-power-settings runs LAST, invoked directly from tweaks.yml after the
-                # add-music-videos COM task (kept out of the phase run so it stays "done last").
+                # set-power-settings runs LAST, invoked directly from tweaks.yml.
             )
         }
         @{
@@ -227,11 +227,8 @@
                 'add-newUser-script'
                 'config-oem-information'
                 'create-shortcuts'
-                # Shell "pin to Home" COM runs in the user session via RunAs (Invoke-AtlasAsUser).
-                'add-music-videos-to-home'
-                # enable-notifications runs LAST of all tweaks, invoked directly from tweaks.yml
-                # after the add-music-videos COM task, so notifications re-enable only after
-                # everything else.
+                # enable-notifications runs LAST of all tweaks, invoked directly from tweaks.yml,
+                # so notifications re-enable only after everything else.
             )
         }
     )