# High memory remediation automatic tier
# Lever 1 stop maintenance tasks
# Lever 2 enable memory compression
# Lever 3 pause DiagTrack
# Runs elevated as SYSTEM idempotent safe to repeat
# Must not use return at top level so later sections still run
# State changes dual write to stdout and the Application event log for a tamper evident trail

$eventLogName = 'Application'
$eventSourceName = 'ZohoDEXRemediation'

function Write-RemediationEvent {
    param(
        [string]$Message,
        [int]$EventId,
        [string]$EntryType = 'Information'
    )
    Write-Output $Message
    try {
        $sourceExists = [System.Diagnostics.EventLog]::SourceExists($eventSourceName)
        if ($sourceExists -eq $false) {
            [System.Diagnostics.EventLog]::CreateEventSource($eventSourceName, $eventLogName)
        }
        $entryTypeValue = [System.Diagnostics.EventLogEntryType]::Information
        if ($EntryType -eq 'Warning') {
            $entryTypeValue = [System.Diagnostics.EventLogEntryType]::Warning
        }
        [System.Diagnostics.EventLog]::WriteEntry($eventSourceName, $Message, $entryTypeValue, $EventId)
    } catch {
        Write-Output ('audit_warn: event log write failed for event {0}' -f $EventId)
    }
}

$maintenanceTasks = @(
    @('\Microsoft\Windows\Application Experience\', 'Microsoft Compatibility Appraiser')
    @('\Microsoft\Windows\Application Experience\', 'ProgramDataUpdater')
    @('\Microsoft\Windows\Maintenance\', 'WinSAT')
)

foreach ($entry in $maintenanceTasks) {
    $taskFolder = $entry[0]
    $taskName = $entry[1]
    $task = Get-ScheduledTask -TaskPath $taskFolder -TaskName $taskName -ErrorAction SilentlyContinue
    if ($task -ne $null -and $task.State -eq 'Running') {
        Stop-ScheduledTask -TaskPath $taskFolder -TaskName $taskName -ErrorAction Stop
        Write-RemediationEvent -Message ('stopped: task {0}' -f $taskName) -EventId 5201
    } else {
        Write-Output ('skip: task {0} not running' -f $taskName)
    }
}

$memoryAgent = Get-MMAgent
if ($memoryAgent.MemoryCompression -eq $false) {
    Enable-MMAgent -MemoryCompression -ErrorAction Stop
    Write-RemediationEvent -Message 'enabled: memory compression' -EventId 5202
} else {
    Write-Output 'skip: memory compression already enabled'
}

$diagTrackService = Get-Service -Name DiagTrack -ErrorAction SilentlyContinue
if ($diagTrackService -ne $null -and $diagTrackService.Status -eq 'Running') {
    Stop-Service -Name DiagTrack -ErrorAction Stop
    Write-RemediationEvent -Message 'paused: DiagTrack service' -EventId 5203 -EntryType 'Warning'
} else {
    Write-Output 'skip: DiagTrack not running'
}