notepad and some other error

[NefilimPL]

First, I’d like to point out that Sandbox includes BuildOne Notepad.

There’s an error with CiTool.exe —is this supposed to happen?

The operation completed successfully.
The operation completed successfully.
The operation completed successfully.
The operation completed successfully.
CiTool.exe : The term 'CiTool.exe' is not recognized as the name of a cmdlet, function, script file, or operable
program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At C:\Users\WDAGUtilityAccount\Desktop\HostShared\SandboxStartup.ps1:21 char:1
+ CiTool.exe --refresh --json | Out-Null # Refreshes policy. Use json o ...
+ 
    + CategoryInfo          : ObjectNotFound: (CiTool.exe:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException


Adding 'Open PowerShell/CMD Here' context menu options
The operation completed successfully.
The operation completed successfully.
The operation completed successfully.
The operation completed successfully.
The operation completed successfully.
The operation completed successfully.

Adding txt document new file option
The operation completed successfully.
The operation completed successfully.
The operation completed successfully.
The operation completed successfully.

Adding PowerShell new file option
The operation completed successfully.
The operation completed successfully.
The operation completed successfully.
The operation completed successfully.
The operation completed successfully.
The operation completed successfully.
The operation completed successfully.
Notepad not found, context menu options will not be added.
Notepad++ not found, context menu options will not be added.
.txt=txtfile
Pause:

Uncommenting Set Theme Dark Mode.ps1 section has no effect. (and yes file is in shared folder)

	<!-- Run the powershell script from the mapped folder -->
	<LogonCommand>
		<!-- The seemingly redundant command nesting makes it so the powershell window is visible when running. -->
		<Command>powershell -executionpolicy Bypass -command "start powershell {-file C:\Users\WDAGUtilityAccount\Desktop\HostShared\SandboxStartup.ps1 -launchingSandbox}"</Command>
		<!-- Note: You can add more powershell commands in additional blocks. For example you can uncomment the line below. -->
		<!-- <Command>powershell -executionpolicy Bypass -command "start powershell {-file \"C:\Users\WDAGUtilityAccount\Desktop\HostShared\Set Theme Dark Mode.ps1\"}"</Command> -->
	</LogonCommand>

[ThioJoe]

I think that must somehow be an old version of the sandbox. Not sure though.

The message about notepad and notepad++ is a personal thing you'd need to manually set up, it's described in the script itself in the comments.

[syncconsult]

@NefilimPL - I'm seeing the exact same thing you are. The DarkTheme doesn't run, and the CiTool error. (And yes, my Dark Theme file is in the shared folder.)

[ThioJoe]

What version of windows is on the host?

Also see: https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-versions

[NefilimPL]

@ThioJoe
i just open windows 10 on my work pc and there is notepad
on my 2x personal pc both win11 have notepad (one is on latest test branch i dont think its cannary)
one of them is windows 11 (not in test branch)
23H2 22635.2915

notepad was released if i remember correcly
22H2 22621.1344

mayby in 24H2 there is no included notepad for some of branches of windows like canary or other insider builds.

[syncconsult]

I might be reading between the lines here, but is it suggested that we be running 24H2?
Because I'm on 23H2 - And if that's the source of the dark theme not running automatically, then at least I know why.

[ThioJoe]

mayby in 24H2 there is no included notepad for some of branches of windows like canary or other insider builds.

Yes it's known that the latest versions of sandbox don't have these. For example this article mentions it:

"Beginning in Windows 11, version 24H2, inbox store apps like Calculator, Photos, Notepad and Terminal are not available inside Windows Sandbox. Ability to use these apps will be added soon."

I might be reading between the lines here, but is it suggested that we be running 24H2?
Because I'm on 23H2 - And if that's the source of the dark theme not running automatically, then at least I know why.

That would definitely be the reason, but as for whether it's suggested to switch to 24H2, that's up to you.

Apparently Windows Sandbox itself is also available in the Microsoft Store, and if you install it through that I assume you'd get the latest version of it regardless of windows version. Or at least if you're on windows 11.

[syncconsult]

Yeh, I should have clarified. "Suggested that we be running 24H2 to have the other scripts run/install automatically."
But I know exactly what you mean.

[Idkauffs]

I have come upon the same issue with the .ps1 files not launching automatically (on the latest Windows Sandbox and Windows 11 (Windows 11 Pro 23H2 22631.5472) versions (that are available to me) as to my knowledge).

This doesn't just affect the Dark theme script it affects every single script that gets launched (although the dark theme script visually is the easiest to see it failed)

Noteworthy is that the .ps1 files can be manually launched wich then prompts a run confirmation within powershell itself

Security warning
Run only scripts that you trust. While scripts from the internet can be useful, this script can potentially harm your
computer. If you trust this script, use the Unblock-File cmdlet to allow the script to run without this warning
message. Do you want to run C:\Users\WDAGUtilityAccount\Desktop\HostShared\Set Theme Dark Mode.ps1?
[D] Do not run  [R] Run once  [S] Suspend  [?] Help (default is "D"):

Double clicking on the .ps1 files also doesn't work. It prompts a security warning (the same warning comes when launching it with powershell via the context menue):

and then opens it in notepad not powershell
(unchecking Always ask before opening this file doesn't do anything and just gets rechecked the next time you try launching it)

All necesary and optional files are working and in the correct folder

(I can't screenshot the startup powershell output due to it disapearing too quickly but it shows the exact same error)

From what I can gather online there is a way to bypass that execution limitation https://stackoverflow.com/questions/728143/ignore-security-warning-running-script-from-command-line but I don't know wether that would fix the autorun issues, seeing as the powershell scripts already get executed via -executionpolicy Bypass

(I tried fiddeling a bit with the code but I can't seem to get it to autolaunch in any real way)

[Idkauffs]

After testing a bit more, it seems you can circumvent this problem by simply copy-pasting the code from Set Theme Dark Mode.ps1 (or any other .ps1 script) into the SandboxStartup.ps1 script and only auto-running that upon launch. (Make sure to remove the Explorer force-close from the Dark Theme script to avoid closing it twice.)
Wich could look something like this:

param(
    # Can include this switch when running from the .wsb file to indicate it's the first launch of the sandbox
    # Useful if re-running this script within the sandbox as a test, but don't want certain parts to run again
    [switch]$launchingSandbox
)

#Set-PSDebug -Trace 1

# Change context menu to old style
reg.exe add "HKCU\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" /f /ve

# Show file extensions
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f

# Show hidden files
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Hidden" /t REG_DWORD /d 1 /f

# Fix for slow MSI package install. See: https://github.com/microsoft/Windows-Sandbox/issues/68#issuecomment-2754867968
reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f
CiTool.exe --refresh --json | Out-Null # Refreshes policy. Use json output param or else it will prompt for confirmation, even with Out-Null

# Change execution policy for powershell to allow running scripts. Normally it shows an error about a more specific policy (Process level Bypass policy), but it doesn't matter so we hide it via try/catch
try { Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope LocalMachine -ErrorAction Stop | Out-Null } catch {}

# -----------------------------------------------------------------------------------------

# ---- Add 'Open PowerShell Here' and 'Open CMD Here' to context menu -------
$powershellPath = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
$cmdPath = "C:\Windows\System32\cmd.exe"
Write-Host "`nAdding 'Open PowerShell/CMD Here' context menu options"
reg add "HKEY_CLASSES_ROOT\Directory\Background\shell\MyPowerShell" /ve /d "Open PowerShell Here" /f
reg add "HKEY_CLASSES_ROOT\Directory\Background\shell\MyPowerShell" /v "Icon" /t REG_SZ /d "$powershellPath,0" /f
reg add "HKEY_CLASSES_ROOT\Directory\Background\shell\MyPowerShell\command" /ve /d "powershell.exe -noexit -command Set-Location -literalPath '%V'" /f
reg add "HKEY_CLASSES_ROOT\Directory\Background\shell\Mycmd" /ve /d "Open CMD Here" /f
reg add "HKEY_CLASSES_ROOT\Directory\Background\shell\Mycmd" /v "Icon" /t REG_SZ /d "$cmdPath,0" /f
reg add "HKEY_CLASSES_ROOT\Directory\Background\shell\Mycmd\command" /ve /d "cmd.exe /s /k cd /d `"\`"%V`"\`"" /f

# ---- Add File Types to Context Menu > New ----
# ShellNew Text Document - .txt
Write-host "`nAdding txt document new file option"
reg add "HKEY_CLASSES_ROOT\txtfile" /ve /d "Text Document" /f
reg add "HKEY_CLASSES_ROOT\.txt\ShellNew" /f
# Use --% to not have powershell parse the arguments, otherwise it won't pass the empty string for the /d parameter
reg --% add "HKEY_CLASSES_ROOT\.txt\ShellNew" /v "NullFile" /t REG_SZ /d "" /f
reg add "HKEY_CLASSES_ROOT\.txt\ShellNew" /v "ItemName" /t REG_SZ /d "New Text Document" /f

# ShellNew PowerShell Script - .ps1 -- Also happens to make .ps1 scripts clickable to run because of the association with "ps1file"
Write-host "`nAdding PowerShell new file option"
reg add "HKEY_CLASSES_ROOT\.ps1" /ve /d "ps1file" /f
reg add "HKEY_CLASSES_ROOT\ps1file" /ve /d "PowerShell Script" /f
reg add "HKEY_CLASSES_ROOT\ps1file\DefaultIcon" /ve /d "%SystemRoot%\System32\imageres.dll,-5372" /f
reg add "HKEY_CLASSES_ROOT\.ps1\ShellNew" /ve /d "ps1file" /f
reg add "HKEY_CLASSES_ROOT\.ps1\ShellNew" /f
reg --% add "HKEY_CLASSES_ROOT\.ps1\ShellNew" /v "NullFile" /t REG_SZ /d "" /f
reg add "HKEY_CLASSES_ROOT\.ps1\ShellNew" /v "ItemName" /t REG_SZ /d "script" /f

# =============================== OPTIONAL - Notepad and Notepad++ ===============================

# If you've included Notepad and/or Notepad++ in the shared folder, set the path to them here. Since notepad isn't included in the sandbox for some reason
# If they aren't found, each step will be skipped, so you can run this script without them.

# NotePad Tip: Go to C:\Windows on your main computer and copy Notepad.exe, then copy notepad.exe.mui from your main language folder, such as C:\Windows\en-US
#    Important: Notepad.exe.mui can't simply go next to notepad.exe. You need to actually create the language folder (like en-US) again next to notepad.exe and put it in that. Otherwise notepad won't run.
$notepadPath = "C:\Users\WDAGUtilityAccount\Desktop\HostShared\notepad.exe"
# For Notepad++, use the portable version
$notepadPlusPlusPath = "C:\Users\WDAGUtilityAccount\Desktop\HostShared\Notepad++\Notepad++.exe"

# Check if the Notepad and Notepad++ paths exist, if not, set them to null
If (!(Test-Path $notepadPath)) { $notepadPath = $null; Write-Host "Notepad not found, context menu options will not be added." }
If (!(Test-Path $notepadPlusPlusPath)) { $notepadPlusPlusPath = $null; Write-Host "Notepad++ not found, context menu options will not be added." }

# ---- Add 'Edit With Notepad' and 'Open Notepad' to context menu (If Available) -------
If ($null -ne $notepadPath) {
	Write-Host "`nAdding Edit with notepad context menu options"
	reg add "HKEY_CLASSES_ROOT\*\shell\Edit with Notepad" /f
	reg add "HKEY_CLASSES_ROOT\*\shell\Edit with Notepad" /v "Icon" /t REG_SZ /d "$notepadPath,0" /f
	reg add "HKEY_CLASSES_ROOT\*\shell\Edit with Notepad\command" /ve /d "`"$notepadPath`" `"%1`"" /f
	reg add "HKEY_CLASSES_ROOT\Directory\Background\shell\Notepad" /ve /d "Open Notepad" /f
	reg add "HKEY_CLASSES_ROOT\Directory\Background\shell\Notepad" /v "Icon" /t REG_SZ /d "$notepadPath,0" /f
	reg add "HKEY_CLASSES_ROOT\Directory\Background\shell\Notepad\command" /ve /d "`"$notepadPath`"" /f
}

# ---- Add 'Edit With Notepad++' and 'Open Notepad++' to context menu (If Available) -------
If ($null -ne $notepadPlusPlusPath) {
	Write-Host "`nAdding Edit/Open with Notepad++ context menu options"
	reg add "HKEY_CLASSES_ROOT\*\shell\Edit with Notepad++" /f
	reg add "HKEY_CLASSES_ROOT\*\shell\Edit with Notepad++" /v "Icon" /t REG_SZ /d "$notepadPlusPlusPath,0" /f
	# Notepad++ needs the file path to be in quotes. To get the quotes to show up in registry, need to use two quotes, and need to escape both with powershell `"
	reg add "HKEY_CLASSES_ROOT\*\shell\Edit with Notepad++\command" /ve /t REG_EXPAND_SZ /d "`"$notepadPlusPlusPath`" -settingsDir=`"%appdata%`" `"`"%1`"`"" /f
	reg add "HKEY_CLASSES_ROOT\Directory\Background\shell\Notepad++" /ve /d "Open Notepad++" /f
	reg add "HKEY_CLASSES_ROOT\Directory\Background\shell\Notepad++" /v "Icon" /t REG_SZ /d "$notepadPlusPlusPath,0" /f
	reg add "HKEY_CLASSES_ROOT\Directory\Background\shell\Notepad++\command" /ve /t REG_EXPAND_SZ /d "`"$notepadPlusPlusPath`" -settingsDir=`"%appdata%`"" /f
}

# Set .txt files to open with Notepad, or Notepad++ if available
cmd /c assoc .txt=txtfile
If (($null -ne $notepadPath) -or ($null -ne $notepadPlusPlusPath)) {
	If (!(Test-Path 'HKLM:\SOFTWARE\Classes\txtfile\shell\open\command')) { New-Item -Path 'HKLM:\SOFTWARE\Classes\txtfile\shell\open\command' -Force }
	# Prefer Notepad++ if available, otherwise use Notepad
	If ($null -ne $notepadPlusPlusPath) { 
		Set-ItemProperty -Path 'HKLM:\SOFTWARE\Classes\txtfile\shell\open\command' -Name '(Default)' -Value ('"{0}" -settingsDir=%appdata% "%1"' -f $editorPath) -Type ExpandString -Force
	} Else {  # If Npp isn't available, condition above means we know notepadPath is still available
		cmd /c ftype txtfile=`"$notepadPath`" "%1"
	} 
}

# Enable Dark Mode for Apps
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" -Name "AppsUseLightTheme" -Value 0

# Enable Dark Mode for System
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" -Name "SystemUsesLightTheme" -Value 0

# Set the Wallpaper
$wallpaperPath = "C:\Windows\Web\Wallpaper\Windows\img19.jpg"
$code = @'
using System.Runtime.InteropServices;
public class Wallpaper {
    [DllImport("user32.dll", CharSet=CharSet.Auto)]
    public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni);
}
'@

Add-Type $code
$SPI_SETDESKWALLPAPER = 0x0014
$UPDATE_INI_FILE = 0x01
$SEND_CHANGE = 0x02

[Wallpaper]::SystemParametersInfo($SPI_SETDESKWALLPAPER, 0, $wallpaperPath, ($UPDATE_INI_FILE -bor $SEND_CHANGE))


# ================================ FINALIZATION ================================

# Restart Explorer so changes take effect
Stop-Process -Name explorer -Force

# Open an explorer window to the host-shared folder on first launch
if ($launchingSandbox) { Start-Process explorer.exe C:\Users\WDAGUtilityAccount\Desktop\HostShared }

# Uncomment to pause after running
#Read-Host "Pause"

The exact placement of the code is ultimatly irelavant to my knowlage. (I have just placed it at end here due to personal preference)

This does end up in quite a sizable powershell script if you input every optional powershell script into it but I don't think that is all too bad.

Regarding the CiTool.exe error:
Windows Sandbox doesn’t include CiTool.exe natively, even if the host has it: (atleast on Windows 11 23H2)
Host machine:

Sandbox:

Even if you copy CiTool.exe into the sandbox from the shared folder, invoking it produces no output:

PS C:\Users\WDAGUtilityAccount> Test-Path C:\Windows\System32\CiTool.exe
True
PS C:\Users\WDAGUtilityAccount> Citool.exe
PS C:\Users\WDAGUtilityAccount>

If it were working, it should output the help description by default (partially visible in the host screenshot above).

[ThioJoe]

Double clicking on the .ps1 files also doesn't work.

Well in Windows you were never able to simply run a powershell script to run it by default, so that is not a surprise. The startup script adds that ability via registry tweaks, so if that doesn't run you wouldn't be able to. And actually the fact that the startup script makes powershell scripts executable by double clicking is kind of a side-effect of some of the file association tweaks, so that might not work on Windows 10 for example, and possibly not even in 23H2.

---

The 2 lines with setting the VerifiedAndReputablePolicyState and using CiTool shouldn't be a problem because they're related to the WDAC policy stuff, and I believe the corresponding feature (Smart App Control) was not added until 24H2 anyway, so you can remove those two lines if using 23H2.

---

As for the trouble running the scripts, does it work if you only have one set of <Command> tags running a single script? In other words does it run the startup script if you do not un-comment the line to run the dark mode script? If that's the case, it might just be that 23H2 can only run a single command (in fact it's not really documented even in the latest version that multiple work, I just noticed it does).

In any case, if you can at least get the one startup script to run, you can just call any other scripts from within it by adding a line like this (I would put it near the bottom right before the line that restarts Explorer):

& 'C:\Users\WDAGUtilityAccount\Desktop\HostShared\Set Theme Dark Mode.ps1'

You'd just put an ampersand & then the path to the script in quotes. Either double quotes or single quotes should work. You can add more lines like that for each script.

[Idkauffs]

Sorry for the Late reply as I have been fighting with Windows Sandbox just straight up refusing to launch after finaly being able to upgrade to 24H2.
Yes running only 1 powershell script with in the .wsb works just fine (also I forgot you could just invoke new powershell scripts with an ampersand so thank you).