From 1a26934499c62524aef01187170d89139804dab2 Mon Sep 17 00:00:00 2001
From: Jeffrey <9938813+Raphire@users.noreply.github.com>
Date: Sun, 16 Aug 2026 18:49:15 +0200
Subject: [PATCH] Improve error handling in Set-StoreSearchSuggestionsDisabled
 (#739)

---
 .../Features/Set-StoreSearchSuggestions.ps1   | 16 +++++++++----
 Tests/Set-StoreSearchSuggestions.Tests.ps1    | 23 +++++++++++++++----
 2 files changed, 30 insertions(+), 9 deletions(-)

diff --git a/Scripts/Features/Set-StoreSearchSuggestions.ps1 b/Scripts/Features/Set-StoreSearchSuggestions.ps1
index d376110..85b3959 100644
--- a/Scripts/Features/Set-StoreSearchSuggestions.ps1
+++ b/Scripts/Features/Set-StoreSearchSuggestions.ps1
@@ -73,11 +73,17 @@ function Set-StoreSearchSuggestionsDisabled {
         New-Item -Path $StoreAppsDatabase -ItemType File -Force | Out-Null
     }
     
-    $AccountSid = [System.Security.Principal.SecurityIdentifier]::new('S-1-1-0') # 'EVERYONE' group
-    $Acl = Get-Acl -Path $StoreAppsDatabase
-    $Ace = [System.Security.AccessControl.FileSystemAccessRule]::new($AccountSid, 'FullControl', 'Deny')
-    $Acl.SetAccessRule($Ace) | Out-Null
-    Set-Acl -Path $StoreAppsDatabase -AclObject $Acl | Out-Null
+    try {
+        $AccountSid = [System.Security.Principal.SecurityIdentifier]::new('S-1-1-0') # 'EVERYONE' group
+        $Acl = Get-Acl -Path $StoreAppsDatabase -ErrorAction Stop
+        $Ace = [System.Security.AccessControl.FileSystemAccessRule]::new($AccountSid, 'FullControl', 'Deny')
+        $Acl.SetAccessRule($Ace) | Out-Null
+        Set-Acl -Path $StoreAppsDatabase -AclObject $Acl -ErrorAction Stop | Out-Null
+    }
+    catch {
+        Write-Warning "Failed to restrict ACL for store database '$StoreAppsDatabase': $($_.Exception.Message)"
+        return
+    }
 
     Write-Host "Disabled Microsoft Store search suggestions for user $userName"
 }
diff --git a/Tests/Set-StoreSearchSuggestions.Tests.ps1 b/Tests/Set-StoreSearchSuggestions.Tests.ps1
index 0da4bc1..468cf8f 100644
--- a/Tests/Set-StoreSearchSuggestions.Tests.ps1
+++ b/Tests/Set-StoreSearchSuggestions.Tests.ps1
@@ -126,18 +126,33 @@ Describe 'Set-StoreSearchSuggestionsDisabled' {
         $acl.AddedRules | Should -HaveCount 1
     }
 
-    It 'surfaces ACL failures instead of reporting the database as disabled' {
+    It 'warns and does not report success when reading the ACL fails' {
         $script:Params = @{}
         Mock Test-Path { $true }
         Mock Get-Acl { throw 'access denied' }
         Mock Set-Acl { throw 'ACL must not be written after a read failure.' }
+        Mock Write-Warning {}
 
-        {
-            Set-StoreSearchSuggestionsDisabled -StoreAppsDatabase 'C:\Users\Alice\AppData\Local\Packages\store.db'
-        } | Should -Throw '*access denied*'
+        Set-StoreSearchSuggestionsDisabled -StoreAppsDatabase 'C:\Users\Alice\AppData\Local\Packages\store.db'
 
+        Should -Invoke Write-Warning -Times 1 -Exactly
+        Should -Invoke Write-Host -Times 0 -Exactly -ParameterFilter { $Object -like 'Disabled Microsoft Store search suggestions*' }
         Should -Invoke Set-Acl -Times 0 -Exactly
     }
+
+    It 'warns and does not report success when writing the ACL fails' {
+        $script:Params = @{}
+        $acl = New-TestStoreDatabaseAcl
+        Mock Test-Path { $true }
+        Mock Get-Acl { $acl }
+        Mock Set-Acl { throw 'access denied' }
+        Mock Write-Warning {}
+
+        Set-StoreSearchSuggestionsDisabled -StoreAppsDatabase 'C:\Users\Alice\AppData\Local\Packages\store.db'
+
+        Should -Invoke Write-Warning -Times 1 -Exactly
+        Should -Invoke Write-Host -Times 0 -Exactly -ParameterFilter { $Object -like 'Disabled Microsoft Store search suggestions*' }
+    }
 }
 
 Describe 'Set-StoreSearchSuggestionsEnabled' {