SysManager 1.56.2 aflaai

[1.56.2] - 2026-07-29
Security
- Blocked per-user PowerShell module hijacking in administrator sessions. Since the initial v0.3.0 runner, both in-process runspaces and child powershell.exe processes inherited the caller's PSModulePath, whose first entry normally points to the current user's writable Documents folder. A planted module could therefore be auto-loaded with SysManager's administrator token when a built-in command such as Get-NetAdapter was resolved. Elevated in-process work now moves into an isolated Windows PowerShell 5.1 child whose environment contains only canonical machine-owned module roots under Program Files and System32; existing child-process execution receives the same restriction. Normal unelevated sessions retain per-user module support, and the parent process environment is never rewritten.
Fixed
- Kept optional Windows Update history installation on the correct privilege boundary. SysManager now installs PSWindowsUpdate only from a normal, non-administrator session into the current user's module directory. The installer verifies the canonical PowerShell Gallery endpoint and explicitly selects PSGallery; an elevated session refuses the install instead of consuming user-writable PowerShellGet repository state with an administrator token. Failed module imports now expose installation guidance instead of reporting a successful empty history.
- Handled locked-down systems without a working Windows PowerShell 5.1 host. If policy, installation damage, or a disabled executable prevents the isolated administrator runspace from starting, the runner now maps that failure to the existing unavailable/failed service states. External PowerShell launches remain pinned to the canonical system path even when the host is missing, preventing executable search-order fallback. The runner deliberately does not fall back to an elevated in-process runspace, which would weaken the module-discovery boundary.
- Preserved PowerShell parameter and task-result semantics. Defender mutation scripts now declare every bound parameter instead of silently receiving null variables, and Scheduled Maintenance correctly decodes unsigned high-bit Task Scheduler result codes after out-of-process serialization.
- Reported partial elevated operations honestly. Edge disable/restore now reports failure when its registry policy changes but scheduled-task updates cannot run, and restore-point creation returns a clean failure state when the isolated PowerShell host is unavailable.
Verify the download
Get-FileHash .\SysManager-v1.56.2.exe -Algorithm SHA256
Expected SHA256: F84468F0C9FDB9D6B294A971CC28D1C7E36D8F3288A044E2F23C24882B18E981