# Block_KB5065426.ps1
# Fully blocks installation of Windows Update KB5065426 on this machine

# Check if running as Administrator
if (-not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(
    [Security.Principal.WindowsBuiltInRole] "Administrator")) {
    Write-Host "Please run this script as Administrator (Run as Administrator)." -ForegroundColor Red
    pause
    exit
}

$KB = "KB5065426"

Write-Host "`nChecking if $KB is already installed..." -ForegroundColor Cyan
$installed = Get-HotFix | Where-Object { $_.HotFixID -eq $KB }

if ($installed) {
    Write-Host "The update is already installed — uninstalling now..." -ForegroundColor Yellow
    wusa /uninstall /kb:5065426 /quiet /norestart
    Start-Sleep -Seconds 10
}

Write-Host "Adding $KB to Windows Update block list..." -ForegroundColor Cyan

# Create WindowsUpdate policy key if it doesn't exist
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -ErrorAction SilentlyContinue | Out-Null

# Create registry value to block the specific KB update
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" `
    -Name "DoNotIncludeKBs" -Value $KB -PropertyType String -Force | Out-Null

Write-Host "`n✅ Update $KB has been successfully blocked!" -ForegroundColor Green
Write-Host "To apply immediately, run: gpupdate /force"
Write-Host "To verify, run this command:" -ForegroundColor Cyan
Write-Host "reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /v DoNotIncludeKBs"
