Private/Assert-WUManualUpdateActionAllowed.ps1
|
function Assert-WUManualUpdateActionAllowed { <# .SYNOPSIS Prevents policy-disruptive update actions on cloud-orchestrated devices by default. .DESCRIPTION Endpoint registry state can confirm Intune/WUfB enrollment but cannot always prove whether the cloud assignment is Windows Autopatch or a custom Intune policy. This guard therefore treats any active cloud update enrollment as orchestrated. The override does not bypass Microsoft policy. It only acknowledges that the operator intentionally wants the module to perform the local action despite the cloud-management boundary. #> [CmdletBinding()] param( [Parameter(Mandatory)] [ValidateNotNullOrEmpty()] [string]$Action, [switch]$OverrideCloudOrchestration, [string]$LogPath ) $configuration = Get-WUConfiguration -LogPath $LogPath if (-not $configuration.CloudOrchestrationDetected) { return $configuration } $message = ( "Cloud update orchestration is active ($($configuration.PatchManagementSource)). " + "Refusing to $Action by default because local WUA/USO/upgrade actions cannot bypass " + "Intune or Windows Autopatch approvals, rollout timing, safeguard holds, or scan-source policy." ) if (-not $OverrideCloudOrchestration) { Write-WULog -Message $message -Level Error -LogPath $LogPath throw "$message Re-run with -OverrideCloudOrchestration only after validating the cloud deployment and maintenance window." } Write-WULog -Message "$message Explicit override supplied; continuing." -Level Warning -LogPath $LogPath return $configuration } |