# High memory remediation consent tier
# Lever 4 pause WSearch
# Runs elevated as SYSTEM idempotent safe to repeat
# Stopping this service interrupts search and file indexing until the service starts again
# State changes dual write to stdout and the Application event log for a tamper evident trail

$eventLogName = 'Application'
$eventSourceName = 'ZohoDEXRemediation'

function Write-RemediationEvent {
    param(
        [string]$Message,
        [int]$EventId,
        [string]$EntryType = 'Information'
    )
    Write-Output $Message
    try {
        $sourceExists = [System.Diagnostics.EventLog]::SourceExists($eventSourceName)
        if ($sourceExists -eq $false) {
            [System.Diagnostics.EventLog]::CreateEventSource($eventSourceName, $eventLogName)
        }
        $entryTypeValue = [System.Diagnostics.EventLogEntryType]::Information
        if ($EntryType -eq 'Warning') {
            $entryTypeValue = [System.Diagnostics.EventLogEntryType]::Warning
        }
        [System.Diagnostics.EventLog]::WriteEntry($eventSourceName, $Message, $entryTypeValue, $EventId)
    } catch {
        Write-Output ('audit_warn: event log write failed for event {0}' -f $EventId)
    }
}

$searchService = Get-Service -Name WSearch -ErrorAction SilentlyContinue
if ($searchService -ne $null -and $searchService.Status -eq 'Running') {
    Stop-Service -Name WSearch -ErrorAction Stop
    Write-RemediationEvent -Message 'paused: WSearch service' -EventId 5204
} else {
    Write-Output 'skip: WSearch not running'
}