# Temporarily allow Microsoft Store and install Company Portal
# Domain GPO should re-apply the block later if configured

$ErrorActionPreference = "Stop"

$StorePolicyPath = "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore"
$CompanyPortalStoreId = "9WZDNCRFJ3PZ"

Write-Host "Temporarily allowing Microsoft Store..." -ForegroundColor Cyan

if (-not (Test-Path $StorePolicyPath)) {
    New-Item -Path $StorePolicyPath -Force | Out-Null
}

# Disable the common Store block policies locally
Set-ItemProperty -Path $StorePolicyPath -Name RemoveWindowsStore -Type DWord -Value 0
Set-ItemProperty -Path $StorePolicyPath -Name RequirePrivateStoreOnly -Type DWord -Value 0

Write-Host "Refreshing computer policy..." -ForegroundColor Cyan
gpupdate /target:computer /force

Write-Host "Checking for winget..." -ForegroundColor Cyan

if (-not (Get-Command winget.exe -ErrorAction SilentlyContinue)) {
    throw "winget.exe was not found. App Installer / Windows Package Manager may be missing or disabled."
}

Write-Host "Installing Microsoft Company Portal..." -ForegroundColor Cyan

winget install `
    --id $CompanyPortalStoreId `
    --source msstore `
    --accept-source-agreements `
    --accept-package-agreements

Write-Host "Done. Launch Company Portal and have the user sign in." -ForegroundColor Green
Write-Host "Domain GPO should re-block Microsoft Store at the next policy refresh if configured." -ForegroundColor Yellow