From 17939bee8c682ac17d0e18cf6db6b8fc13401e74 Mon Sep 17 00:00:00 2001
From: Manuel Thalmann <m@nuth.ch>
Date: Sat, 10 Aug 2024 15:19:14 +0200
Subject: [PATCH] Disable UAC after logging in MS account

---
 scripts/Windows/OS/Install.ps1 | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/scripts/Windows/OS/Install.ps1 b/scripts/Windows/OS/Install.ps1
index be4c8be8..149cce02 100644
--- a/scripts/Windows/OS/Install.ps1
+++ b/scripts/Windows/OS/Install.ps1
@@ -500,6 +500,7 @@ $null = New-Module {
 
                             if ($currentUser -lt $users.Count) {
                                 $user = Get-LocalUser $users[$currentUser];
+                                $msAccount = Get-UserConfig -UserName "$user" -Name "microsoftAccount";
 
                                 Add-LocalGroupMember `
                                     -SID ([SecurityIdentifier]::new([WellKnownSidType]::BuiltinAdministratorsSid, $null))`
@@ -510,7 +511,7 @@ $null = New-Module {
                                     Disable-LocalUser $env:UserName;
                                     Enable-LocalUser $user;
 
-                                    if (Get-UserConfig -UserName "$user" -Name "microsoftAccount") {
+                                    if ($msAccount) {
                                         Enable-UAC;
                                         Disable-Autologin;
                                         Enable-OneShotListener;
@@ -521,6 +522,14 @@ $null = New-Module {
 
                                     Restart-Intermediate -DefaultUser;
                                     return;
+                                } else {
+                                    if ($msAccount) {
+                                        if (-not (Test-Admin)) {
+                                            Invoke-OneShot DisableUAC;
+                                            Restart-Computer;
+                                            return;
+                                        }
+                                    }
                                 }
 
                                 if (-not (Get-UserConfig -UserName "$user" "microsoftAccount")) {