SysManager 1.56.2

What's new for you

SysManager 1.56.2 makes administrator features safer and more predictable. Elevated PowerShell operations no longer search module folders that a standard user can modify. On locked-down or damaged Windows installations, affected features now report that PowerShell is unavailable instead of crashing or claiming success. Windows Update history, Defender settings, scheduled tasks, Edge controls, and restore points also report failures more accurately.

[1.56.2] - 2026-07-29

Security

• Blocked per-user PowerShell module hijacking in administrator sessions. Since the initial v0.3.0 runner, both in-process runspaces and child powershell.exe processes inherited the caller's PSModulePath, whose first entry normally points to the current user's writable Documents folder. A planted module could therefore be auto-loaded with SysManager's administrator token when a built-in command such as Get-NetAdapter was resolved. Elevated in-process work now moves into an isolated Windows PowerShell 5.1 child whose environment contains only canonical machine-owned module roots under Program Files and System32; existing child-process execution receives the same restriction. Normal unelevated sessions retain per-user module support, and the parent process environment is never rewritten.

Fixed

• Kept optional Windows Update history installation on the correct privilege boundary. SysManager now installs PSWindowsUpdate only from a normal, non-administrator session into the current user's module directory. The installer verifies the canonical PowerShell Gallery endpoint and explicitly selects PSGallery; an elevated session refuses the install instead of consuming user-writable PowerShellGet repository state with an administrator token. Failed module imports now expose installation guidance instead of reporting a successful empty history.
• Handled locked-down systems without a working Windows PowerShell 5.1 host. If policy, installation damage, or a disabled executable prevents the isolated administrator runspace from starting, the runner now maps that failure to the existing unavailable/failed service states. External PowerShell launches remain pinned to the canonical system path even when the host is missing, preventing executable search-order fallback. The runner deliberately does not fall back to an elevated in-process runspace, which would weaken the module-discovery boundary.
• Preserved PowerShell parameter and task-result semantics. Defender mutation scripts now declare every bound parameter instead of silently receiving null variables, and Scheduled Maintenance correctly decodes unsigned high-bit Task Scheduler result codes after out-of-process serialization.
• Reported partial elevated operations honestly. Edge disable/restore now reports failure when its registry policy changes but scheduled-task updates cannot run, and restore-point creation returns a clean failure state when the isolated PowerShell host is unavailable.

---

Verify the download

Get-FileHash .\SysManager-v1.56.2.exe -Algorithm SHA256

Expected SHA256: F84468F0C9FDB9D6B294A971CC28D1C7E36D8F3288A044E2F23C24882B18E981