diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7a31347eb..5edfbd6dd 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,7 +8,7 @@
version: 2
updates:
- package-ecosystem: "dotnet-sdk"
- directory: "/AppControl Manager"
+ directory: "/AppControl Manager/"
schedule:
interval: "weekly"
day: "thursday"
@@ -18,8 +18,8 @@ updates:
- ".NET SDK"
- package-ecosystem: "nuget"
directories:
- - "/AppControl Manager"
- - "/Harden-Windows-Security Module"
+ - "/AppControl Manager/"
+ - "/Harden-Windows-Security Module/"
schedule:
interval: "daily"
time: "07:30"
diff --git a/.github/workflows/Build AppControl Manager MSIX Package.yml b/.github/workflows/Build AppControl Manager MSIX Package.yml
index f53ec1c89..40988ae17 100644
--- a/.github/workflows/Build AppControl Manager MSIX Package.yml
+++ b/.github/workflows/Build AppControl Manager MSIX Package.yml
@@ -43,7 +43,7 @@ jobs:
if ($LASTEXITCODE -ne 0) { throw [System.InvalidOperationException]::New('Failed to install .NET SDK') }
Write-Host -Object "`nInstalling Visual Studio Build Tools" -ForegroundColor Magenta
- $null = winget install --id Microsoft.VisualStudio.2022.BuildTools --exact --accept-package-agreements --accept-source-agreements --uninstall-previous --force --source winget --override '--force --wait --passive --add Microsoft.VisualStudio.Workload.ManagedDesktop --add Microsoft.VisualStudio.Workload.MSBuildTools --add Microsoft.VisualStudio.Workload.UniversalBuildTools --add Microsoft.VisualStudio.ComponentGroup.WindowsAppSDK.Cs --add Microsoft.VisualStudio.Component.VC.Tools.x86.x64 --add Microsoft.VisualStudio.Component.VC.v141.x86.x64 --add Microsoft.VisualStudio.Component.Windows11SDK.26100 --includeRecommended'
+ $null = winget install --id Microsoft.VisualStudio.2022.BuildTools --exact --accept-package-agreements --accept-source-agreements --uninstall-previous --force --source winget --override '--force --wait --passive --add Microsoft.VisualStudio.Workload.ManagedDesktop --add Microsoft.VisualStudio.Workload.VCTools --add Microsoft.VisualStudio.Workload.MSBuildTools --add Microsoft.VisualStudio.Workload.UniversalBuildTools --add Microsoft.VisualStudio.ComponentGroup.WindowsAppSDK.Cs --add Microsoft.VisualStudio.Component.VC.Tools.x86.x64 --add Microsoft.VisualStudio.Component.VC.v141.x86.x64 --add Microsoft.VisualStudio.Component.Windows11SDK.26100 --includeRecommended'
if ($LASTEXITCODE -ne 0) { throw [System.InvalidOperationException]::New('Failed to install Visual Studio Build Tools') }
Write-Host -Object "`nInstalling Visual C++ Redistributable" -ForegroundColor Magenta
@@ -52,6 +52,14 @@ jobs:
- name: Check out the repository code
uses: actions/checkout@v4
+ # Runs certain Harden Windows Security application's categories in order to provide security for the build process that starts in the next step
+ - name: Securing the environment
+ id: securing
+ shell: pwsh
+ run: |
+ Install-Module -Name 'Harden-Windows-Security-Module' -Force
+ Protect-WindowsSecurity -Categories MicrosoftSecurityBaselines,MicrosoftDefender,AttackSurfaceReductionRules,MiscellaneousConfigurations -Verbose
+
- name: Building And Packaging the AppControl Manager
id: main_buildOp
shell: pwsh
@@ -578,3 +586,53 @@ jobs:
# Create the pull request
gh pr create --title $CommitMessageAndPRTitle --body $PRBody --base main --label 'Automated 🤖' --assignee HotCakeX
+
+ - name: Add Body Text to the Draft Release
+ shell: pwsh
+ run: |
+ $ReleaseId = "${{ needs.build.outputs.DRAFT_RELEASE_ID }}"
+ $Repo = "${{ github.repository }}"
+
+ [string]$Note = @"
+
+ # What's New
+
+
+
+ > [!IMPORTANT]\
+ > **How To Install: Copy and Paste this command in a PowerShell window as Admin. ([Technical explanation available here](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager#how-to-install-or-update-the-app))**
+ > ``````powershell
+ > (irm 'https://raw.githubusercontent.com/HotCakeX/Harden-Windows-Security/main/Harden-Windows-Security.ps1')+'AppControl'|iex
+ > ``````
+
+
+
+
+
+ How to [verify](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds#verifying-artifact-attestations-with-the-github-cli) the MSIXBundle's authenticity:
+
+ ``````
+ gh attestation verify "Path To MSIXBundle" --repo HotCakeX/Harden-Windows-Security --format json
+ ``````
+
+ You can [install the GitHub CLI](https://github.com/cli/cli?tab=readme-ov-file#windows) from Winget:
+
+ ``````
+ winget install --id GitHub.cli
+ ``````
+
+
+
+ > [!NOTE]\
+ > As mentioned at the top, please **[refer to this page](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager#how-to-install-or-update-the-app)** for installation instructions.
+
+
+
+ "@
+
+ $Payload = @{ body = $Note } | ConvertTo-Json
+ $Url = "https://api.github.com/repos/$Repo/releases/$ReleaseId"
+ Invoke-RestMethod -Uri $Url -Method Patch -Headers @{
+ "Authorization" = "token ${{ secrets.GITHUB_TOKEN }}"
+ "Content-Type" = "application/json"
+ } -Body $Payload
diff --git a/AppControl Manager/AppControl Manager.csproj b/AppControl Manager/AppControl Manager.csproj
index 641584b3e..57768cd46 100644
--- a/AppControl Manager/AppControl Manager.csproj
+++ b/AppControl Manager/AppControl Manager.csproj
@@ -36,7 +36,6 @@
-->
10.0.26100.56
-
true
-
False
True
-
- false
-
-
-
+ false
+
+
disable
A modern secure application that simplifies management of Application Control in Windows.
https://github.com/HotCakeX/Harden-Windows-Security
@@ -70,7 +71,6 @@
App Control,WDAC,AppControl For Business, AppControl Manager
https://github.com/HotCakeX/Harden-Windows-Security/releases
-
False
@@ -79,7 +79,6 @@
SHA512
False
-
MSIXOutputX64\
True
@@ -90,33 +89,35 @@
True
AppControlManager
- False
+ false
send
- 1.8.9.0
+ 1.9.0.0
$(FileVersion)
en-US
LICENSE
AppControlManager.Program
True
-
True
-
$(FileVersion)
© 2024-Present
AppControl Manager
-
-
True
-
+ all
+ git
+ True
-
+
+
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
-
-
+
+
+
+
all
runtime; build; native; contentfiles; analyzers; buildtransitive
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/AppControl Manager/Excluded Code/SiPolicy Sample.xml b/AppControl Manager/Excluded Code/SiPolicy Sample.xml
new file mode 100644
index 000000000..123b5a7df
--- /dev/null
+++ b/AppControl Manager/Excluded Code/SiPolicy Sample.xml
@@ -0,0 +1,417 @@
+
+
+ 1.0.0.0
+ {11111111-1111-1111-1111-111111111111}
+ {11111111-1111-1111-1111-111111111111}
+ {2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 12345
+
+
+
+ SampleString
+
+
+
+
+ true
+
+
+
+
+ 100
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Val1
+ Val2
+ Val3
+
+
+ Val4
+ Val5
+ Val6
+
+
+ Val7
+ Val8
+ Val9
+
+
+
+
+ Val10
+ Val11
+ Val12
+
+
+ Val13
+ Val14
+ Val15
+
+
+ Val16
+ Val17
+ Val18
+
+
+
+
+ Val19
+ Val20
+ Val21
+
+
+ Val22
+ Val23
+ Val24
+
+
+ Val25
+ Val26
+ Val27
+
+
+
+
\ No newline at end of file
diff --git a/AppControl Manager/Excluded Code/SiPolicyAlt/Definitions.cs b/AppControl Manager/Excluded Code/SiPolicyAlt/Definitions.cs
deleted file mode 100644
index 8785d8ae6..000000000
--- a/AppControl Manager/Excluded Code/SiPolicyAlt/Definitions.cs
+++ /dev/null
@@ -1,375 +0,0 @@
-using System;
-using System.Collections.Generic;
-
-#pragma warning disable
-
-namespace AppControlManager.SiPolicyAlt
-{
- ///
- /// This class will be potentially used in the future to create serialization/deserialization manually to be trim and NativeAOT compatible
- /// It currently completely represents the SiPolicy based on the auto-generated class
- ///
- public class SiPolicy
- {
- public string VersionEx { get; set; }
- public string PolicyTypeID { get; set; }
- public string PlatformID { get; set; }
- public string PolicyID { get; set; }
- public string BasePolicyID { get; set; }
- public List Rules { get; set; }
- public List EKUs { get; set; }
- public List FileRules { get; set; }
- public List Signers { get; set; }
- public List SigningScenarios { get; set; }
- public List UpdatePolicySigners { get; set; }
- public List CiSigners { get; set; }
- public uint HvciOptions { get; set; }
- public bool HvciOptionsSpecified { get; set; }
- public List Settings { get; set; }
- public List Macros { get; set; }
- public List SupplementalPolicySigners { get; set; }
- public AppSettingRegion AppSettings { get; set; }
- public string FriendlyName { get; set; }
- public PolicyType PolicyType { get; set; }
- public bool PolicyTypeSpecified { get; set; }
- }
-
- public class RuleType
- {
- public OptionType Item { get; set; }
- }
-
- public enum OptionType
- {
- EnabledUMCI,
- EnabledBootMenuProtection,
- EnabledIntelligentSecurityGraphAuthorization,
- EnabledInvalidateEAsonReboot,
- RequiredWHQL,
- EnabledDeveloperModeDynamicCodeTrust,
- EnabledAllowSupplementalPolicies,
- DisabledRuntimeFilePathRuleProtection,
- EnabledRevokedExpiredAsUnsigned,
- EnabledAuditMode,
- DisabledFlightSigning,
- EnabledInheritDefaultPolicy,
- EnabledUnsignedSystemIntegrityPolicy,
- EnabledDynamicCodeSecurity,
- RequiredEVSigners,
- EnabledBootAuditOnFailure,
- EnabledAdvancedBootOptionsMenu,
- DisabledScriptEnforcement,
- RequiredEnforceStoreApplications,
- EnabledSecureSettingPolicy,
- EnabledManagedInstaller,
- EnabledUpdatePolicyNoReboot,
- EnabledConditionalWindowsLockdownPolicy
- }
-
- public class EKUs
- {
- public List Items { get; set; }
- }
-
- public class EKU
- {
- public string ID { get; set; }
- public string Value { get; set; }
- public string FriendlyName { get; set; }
- }
-
- public class FileRules
- {
- public List AllowItems { get; set; }
- public List DenyItems { get; set; }
- public List FileAttribItems { get; set; }
- public List FileRuleItems { get; set; }
-
- public FileRules()
- {
- AllowItems = [];
- DenyItems = [];
- FileAttribItems = [];
- FileRuleItems = [];
- }
- }
-
- public class Allow
- {
- public string ID { get; set; }
- public string FriendlyName { get; set; }
- public string FileName { get; set; }
- public string InternalName { get; set; }
- public string FileDescription { get; set; }
- public string ProductName { get; set; }
- public string PackageFamilyName { get; set; }
- public string PackageVersion { get; set; }
- public string MinimumFileVersion { get; set; }
- public string MaximumFileVersion { get; set; }
- public string Hash { get; set; }
- public string AppIDs { get; set; }
- public string FilePath { get; set; }
- }
-
- public class Deny
- {
- public string ID { get; set; }
- public string FriendlyName { get; set; }
- public string FileName { get; set; }
- public string InternalName { get; set; }
- public string FileDescription { get; set; }
- public string ProductName { get; set; }
- public string PackageFamilyName { get; set; }
- public string PackageVersion { get; set; }
- public string MinimumFileVersion { get; set; }
- public string MaximumFileVersion { get; set; }
- public string Hash { get; set; }
- public string AppIDs { get; set; }
- public string FilePath { get; set; }
- }
-
- public class FileAttrib
- {
- public string ID { get; set; }
- public string FriendlyName { get; set; }
- public string FileName { get; set; }
- public string InternalName { get; set; }
- public string FileDescription { get; set; }
- public string ProductName { get; set; }
- public string PackageFamilyName { get; set; }
- public string PackageVersion { get; set; }
- public string MinimumFileVersion { get; set; }
- public string MaximumFileVersion { get; set; }
- public string Hash { get; set; }
- public string AppIDs { get; set; }
- public string FilePath { get; set; }
- }
-
- public class FileRule
- {
- public string ID { get; set; }
- public string FriendlyName { get; set; }
- public string FileName { get; set; }
- public string InternalName { get; set; }
- public string FileDescription { get; set; }
- public string ProductName { get; set; }
- public string PackageFamilyName { get; set; }
- public string PackageVersion { get; set; }
- public string MinimumFileVersion { get; set; }
- public string MaximumFileVersion { get; set; }
- public string Hash { get; set; }
- public string AppIDs { get; set; }
- public string FilePath { get; set; }
- public RuleTypeType Type { get; set; }
- }
-
- public enum RuleTypeType
- {
- Match,
- Exclude,
- Attribute
- }
-
- public class Signer
- {
- public CertRoot CertRoot { get; set; }
- public List CertEKU { get; set; }
- public CertIssuer CertIssuer { get; set; }
- public CertPublisher CertPublisher { get; set; }
- public CertOemID CertOemID { get; set; }
- public List FileAttribRef { get; set; }
- public string Name { get; set; }
- public string ID { get; set; }
- public DateTime SignTimeAfter { get; set; }
- public bool SignTimeAfterSpecified { get; set; }
- }
-
- public enum CertEnumType
- {
- TBS,
- Wellknown
- }
-
- public class CertRoot
- {
- public CertEnumType Type { get; set; }
- public string Value { get; set; }
- }
-
- public class CertEKU
- {
- public string ID { get; set; }
- }
-
- public class CertIssuer
- {
- public string Value { get; set; }
- }
-
- public class CertPublisher
- {
- public string Value { get; set; }
- }
-
-
- public class CertOemID
- {
- public string Value { get; set; }
- }
-
- public class FileAttribRef
- {
- public string RuleID { get; set; }
- }
-
- public enum PolicyType
- {
- BasePolicy,
- SupplementalPolicy,
- AppIDTaggingPolicy,
- }
-
- public class AppSettingRegion
- {
- public List App { get; set; }
- }
-
- public class AppRoot
- {
- public List Setting { get; set; }
- public string Manifest { get; set; }
- }
-
- public class AppSetting
- {
- public List Value { get; set; }
- public string Name { get; set; }
- }
-
- public class SupplementalPolicySigner
- {
- public string SignerId { get; set; }
- }
-
- public class Macro
- {
- public string Id { get; set; }
- public string Value { get; set; }
- }
-
- public class Setting
- {
- public SettingValueType Value { get; set; }
- public string Provider { get; set; }
- public string Key { get; set; }
- public string ValueName { get; set; }
- }
-
- public class SettingValueType
- {
- public object Item { get; set; }
- }
-
- public class CiSigner
- {
- public string SignerId { get; set; }
- }
-
- public class UpdatePolicySigner
- {
- public string SignerId { get; set; }
- }
-
- public class SigningScenario
- {
- public ProductSigners ProductSigners { get; set; }
- public TestSigners TestSigners { get; set; }
- public TestSigningSigners TestSigningSigners { get; set; }
- public AppIDTags AppIDTags { get; set; }
- public string ID { get; set; }
- public string FriendlyName { get; set; }
- public byte Value { get; set; }
- public string InheritedScenarios { get; set; }
- public ushort MinimumHashAlgorithm { get; set; }
- public bool MinimumHashAlgorithmSpecified { get; set; }
- }
-
- public class ProductSigners
- {
- public AllowedSigners AllowedSigners { get; set; }
- public DeniedSigners DeniedSigners { get; set; }
- public FileRulesRef FileRulesRef { get; set; }
- }
-
- public class TestSigners
- {
- public AllowedSigners AllowedSigners { get; set; }
- public DeniedSigners DeniedSigners { get; set; }
- public FileRulesRef FileRulesRef { get; set; }
- }
-
- public class TestSigningSigners
- {
- public AllowedSigners AllowedSigners { get; set; }
- public DeniedSigners DeniedSigners { get; set; }
- public FileRulesRef FileRulesRef { get; set; }
- }
-
- public class AppIDTags
- {
- public List AppIDTag { get; set; }
- public bool EnforceDLL { get; set; }
- public bool EnforceDLLSpecified { get; set; }
- }
-
- public class AppIDTag
- {
- public string Key { get; set; }
- public string Value { get; set; }
- }
-
- public class AllowedSigners
- {
- public List AllowedSigner { get; set; }
- public string Workaround { get; set; }
- }
-
- public class AllowedSigner
- {
- public List ExceptDenyRule { get; set; }
- public string SignerId { get; set; }
- }
-
- public class ExceptDenyRule
- {
- public string DenyRuleID { get; set; }
- }
-
- public class DeniedSigners
- {
- public List DeniedSigner { get; set; }
- public string Workaround { get; set; }
- }
-
- public class DeniedSigner
- {
- public List ExceptAllowRule { get; set; }
- public string SignerId { get; set; }
- }
-
- public class ExceptAllowRule
- {
- public string AllowRuleID { get; set; }
- }
-
- public class FileRulesRef
- {
- public List FileRuleRef { get; set; }
- public string Workaround { get; set; }
- }
-
- public class FileRuleRef
- {
- public string RuleID { get; set; }
- }
-}
diff --git a/AppControl Manager/MainWindow.xaml b/AppControl Manager/MainWindow.xaml
index 3ae97c57f..bc975a693 100644
--- a/AppControl Manager/MainWindow.xaml
+++ b/AppControl Manager/MainWindow.xaml
@@ -77,7 +77,6 @@
-
@@ -121,7 +120,6 @@
SuggestionChosen="SearchBox_SuggestionChosen"
PlaceholderText="Search menu items..." Margin="0"/>
-
-
-
-
-
+
diff --git a/AppControl Manager/global.json b/AppControl Manager/global.json
index d325929a3..506a09b26 100644
--- a/AppControl Manager/global.json
+++ b/AppControl Manager/global.json
@@ -1,6 +1,6 @@
{
"sdk": {
- "version": "9.0.102",
+ "version": "9.0.200",
"rollForward": "latestMajor",
"allowPrerelease": true
}
diff --git a/Wiki posts/App Control for Business/WDAC Notes.md b/Wiki posts/App Control for Business/WDAC Notes.md
index 1f07c61d7..da05df678 100644
--- a/Wiki posts/App Control for Business/WDAC Notes.md
+++ b/Wiki posts/App Control for Business/WDAC Notes.md
@@ -587,6 +587,16 @@ It doesn't matter how long or short the IDs are in the policy XML file, such as
+## The Effect of Disabled:Flight Signing Policy Rule Option on Windows Insider Builds
+
+If you deploy an App Control policy that has the `Disabled:Flight Signing` rule option, the Windows Insider page in Windows Settings will not let you choose insider channels whose builds are signed with flight root certificates. For example, if you are on the Release Preview channel, you won't have the option to switch to any other channel and the channel selection can be unavailable in Windows Insider section. To make it appear again, you can re-deploy the policy with `Disabled:Flight Signing` rule option removed from it and then reboot the system. This is to ensure that the user won't accidentally/intentionally get himself/herself into a boot failure situation.
+
+
+
+
+
+
+
## 
[Continue reading about BYOVD protection with App Control for Business](#-continue-reading-about-byovd-protection-with-wdac)
#### [App Control policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-policy-for-BYOVD-Kernel-mode-only-protection) for BYOVD Kernel mode only protection
diff --git a/Wiki posts/AppControl Manager/AppControl Manager.md b/Wiki posts/AppControl Manager/AppControl Manager.md
index 5a9bf5fa5..7bb489325 100644
--- a/Wiki posts/AppControl Manager/AppControl Manager.md
+++ b/Wiki posts/AppControl Manager/AppControl Manager.md
@@ -193,19 +193,7 @@ Here is the complete list of all of the URLs the AppControl Manager application
-## How To Install AppControl Manager Completely Offline? (Method 1)
-
-1. Download the latest MSIXBundle package of the AppControl Manager from the [GitHub releases](https://github.com/HotCakeX/Harden-Windows-Security/releases) or build it from [the source code](https://github.com/HotCakeX/Harden-Windows-Security/tree/main/AppControl%20Manager) yourself.
-
-2. Use the following PowerShell syntax to Install the AppControl Manager. ***No Admin privilege required***
-
-```powershell
-Add-AppxPackage -Path "Path To the MSIXBundle" -AllowUnsigned
-```
-
-
-
-## How To Install AppControl Manager Completely Offline? (Method 2)
+## How To Install AppControl Manager Completely Offline?
1. Download [this PowerShell script](https://github.com/HotCakeX/Harden-Windows-Security/blob/main/Harden-Windows-Security.ps1).
@@ -309,7 +297,7 @@ if ($LASTEXITCODE -ne 0) { throw [System.InvalidOperationException]::New('Failed
# https://learn.microsoft.com/en-us/visualstudio/install/workload-component-id-vs-build-tools
# https://learn.microsoft.com/en-us/visualstudio/install/use-command-line-parameters-to-install-visual-studio
# https://learn.microsoft.com/en-us/visualstudio/install/workload-component-id-vs-community
-winget install --id Microsoft.VisualStudio.2022.BuildTools --exact --accept-package-agreements --accept-source-agreements --uninstall-previous --force --source winget --override '--force --wait --passive --add Microsoft.VisualStudio.Workload.ManagedDesktop --add Microsoft.VisualStudio.Workload.MSBuildTools --add Microsoft.VisualStudio.Workload.UniversalBuildTools --add Microsoft.VisualStudio.ComponentGroup.WindowsAppSDK.Cs --add Microsoft.VisualStudio.Component.VC.Tools.x86.x64 --add Microsoft.VisualStudio.Component.VC.v141.x86.x64 --add Microsoft.VisualStudio.Component.Windows11SDK.26100 --includeRecommended'
+winget install --id Microsoft.VisualStudio.2022.BuildTools --exact --accept-package-agreements --accept-source-agreements --uninstall-previous --force --source winget --override '--force --wait --passive --add Microsoft.VisualStudio.Workload.ManagedDesktop --add Microsoft.VisualStudio.Workload.VCTools --add Microsoft.VisualStudio.Workload.MSBuildTools --add Microsoft.VisualStudio.Workload.UniversalBuildTools --add Microsoft.VisualStudio.ComponentGroup.WindowsAppSDK.Cs --add Microsoft.VisualStudio.Component.VC.Tools.x86.x64 --add Microsoft.VisualStudio.Component.VC.v141.x86.x64 --add Microsoft.VisualStudio.Component.Windows11SDK.26100 --includeRecommended'
if ($LASTEXITCODE -ne 0) { throw [System.InvalidOperationException]::New('Failed to install Visual Studio Build Tools') }