$ErrorActionPreference = "Stop"

$logPath = "$env:TEMP\SyncML_ACL_Audit_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"

function Write-Log {
    param([string]$message)
    $timestamp = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
    $entry = "$timestamp`t$message"
    Add-Content -Path $logPath -Value $entry
    Write-Host $message  # Optional: still display to console
}

function Get-RegistryKey64 {
    param(
        [string]$subKey,
        [bool]$writable = $false
    )
    try {
        return [Microsoft.Win32.RegistryKey]::OpenBaseKey(
            [Microsoft.Win32.RegistryHive]::LocalMachine,
            [Microsoft.Win32.RegistryView]::Registry64
        ).OpenSubKey($subKey, $writable)
    } catch {
        return $null
    }
}

$success = $true

Write-Log "=== Starting SyncML ACL Permission Script ==="
Write-Log "Log file: $logPath"

$rebootRequiredPath = "SOFTWARE\Microsoft\Provisioning\OMADM\SyncML\RebootRequired"
$syncmlPath = "SOFTWARE\Microsoft\Provisioning\OMADM\SyncML"

try {
    $regKey = Get-RegistryKey64 $syncmlPath $true
    if (-not $regKey) {
        Write-Log "[WARN] Registry key HKLM:\$syncmlPath does not exist or cannot be opened as 64-bit SYSTEM. Skipping ACL modification."
        $success = $false
        throw "Registry key not found"
    }

    $rebootRequiredKey = Get-RegistryKey64 "$syncmlPath\RebootRequired" $true
    if ($rebootRequiredKey) {
        $rebootRequiredKey.Close()
        Remove-Item -Path "HKLM:\$rebootRequiredPath" -Recurse -Force
        Write-Log "Removed existing RebootRequired key."
    } else {
        Write-Log "No RebootRequired key found."
    }

    # 1. Disable inheritance and copy ACEs
    $acl = $regKey.GetAccessControl()
    $acl.SetAccessRuleProtection($true, $true)
    $regKey.SetAccessControl($acl)
    Write-Log "Disabled inheritance on SyncML key."

    # 2. Re-read ACL (flattened)
    $acl = $regKey.GetAccessControl()

    # 3. Add DENY ACE for Everyone (SID S-1-1-0) for write/delete/create
    $everyoneSid = New-Object System.Security.Principal.SecurityIdentifier("S-1-1-0")
    $denyRights = `
        [System.Security.AccessControl.RegistryRights]::SetValue `
        -bor [System.Security.AccessControl.RegistryRights]::CreateSubKey `
        -bor [System.Security.AccessControl.RegistryRights]::Delete `
        -bor [System.Security.AccessControl.RegistryRights]::WriteKey
    $denyRule = New-Object System.Security.AccessControl.RegistryAccessRule(
        $everyoneSid,
        $denyRights,
        [System.Security.AccessControl.InheritanceFlags]::None,
        [System.Security.AccessControl.PropagationFlags]::None,
        [System.Security.AccessControl.AccessControlType]::Deny
    )
    $acl.AddAccessRule($denyRule)
    Write-Log "Added DENY Write/Delete/CreateSubKey ACE for Everyone (SID S-1-1-0, this key only)."

    # 4. Apply and close
    $regKey.SetAccessControl($acl)
    $regKey.Close()
    Write-Log "ACL changes applied and key closed."

    # Fetch and export the ACL to the log file (append)
    $regKeyVerify = Get-RegistryKey64 $syncmlPath $false
    $finalAcl = $regKeyVerify.GetAccessControl().Access | Select-Object IdentityReference, RegistryRights, IsInherited, InheritanceFlags, PropagationFlags, AccessControlType
    $regKeyVerify.Close()

    Write-Log "=== Final ACL for $syncmlPath ==="
    foreach ($ace in $finalAcl) {
        Write-Log ("ACE: " + ($ace | Out-String).Trim())
    }
    Write-Log "=== End of ACL ==="

} catch {
    Write-Log "[ERROR] $($_.Exception.Message)"
    $success = $false
}

if ($success) {
    Write-Log "[RESULT] Script completed successfully."
} else {
    Write-Log "[RESULT] Script failed. See above for errors."
}

Write-Log "=== Script finished at $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') ==="