From 80fdeb912a76e686149e5db898d0ac99d5236f53 Mon Sep 17 00:00:00 2001
From: Patrick Meinecke <SeeminglyScience@users.noreply.github.com>
Date: Wed, 26 Aug 2026 15:45:21 -0400
Subject: [PATCH] Fix `FileOnlyEntry` crashing on older versions of Windows
 (#27880)

---
 .../security/wldpNativeMethods.cs             | 57 ++++++++++++-------
 1 file changed, 37 insertions(+), 20 deletions(-)

diff --git a/src/System.Management.Automation/security/wldpNativeMethods.cs b/src/System.Management.Automation/security/wldpNativeMethods.cs
index fa104fc0b6b..9445d8d0df8 100644
--- a/src/System.Management.Automation/security/wldpNativeMethods.cs
+++ b/src/System.Management.Automation/security/wldpNativeMethods.cs
@@ -97,35 +97,52 @@ internal static bool IsFileOnlyEntryEnabled()
 
         private static bool TestBooleanWldpSetting(string settingName)
         {
-            int hr = WldpNativeMethods.WldpGetApplicationSettingBoolean(
-                AppManifestId,
-                settingName,
-                out bool result);
+            bool result = SafeWldpGetApplicationSettingBoolean(settingName);
 
-            PSEtwLog.LogWDACQueryEvent(
-                "WldpGetApplicationSettingBoolean",
-                settingName,
-                hr,
-                result ? 1 : 0);
+            if (result)
+            {
+                return true;
+            }
 
-            if (hr is not 0)
+            string debugValue = Environment.GetEnvironmentVariable(
+                $"__PSLockdownPolicy_{settingName}",
+                EnvironmentVariableTarget.Machine);
+
+            if (debugValue is "1")
             {
-                result = false;
+                result = true;
             }
 
-            if (!result)
+            return result;
+        }
+
+        private static bool SafeWldpGetApplicationSettingBoolean(string settingName)
+        {
+            try
             {
-                string debugValue = Environment.GetEnvironmentVariable(
-                    $"__PSLockdownPolicy_{settingName}",
-                    EnvironmentVariableTarget.Machine);
+                int hr = WldpNativeMethods.WldpGetApplicationSettingBoolean(
+                    AppManifestId,
+                    settingName,
+                    out bool result);
 
-                if (debugValue is "1")
-                {
-                    result = true;
-                }
+                PSEtwLog.LogWDACQueryEvent(
+                    "WldpGetApplicationSettingBoolean",
+                    settingName,
+                    hr,
+                    result ? 1 : 0);
+
+                return hr is 0 && result;
             }
+            catch (Exception ex) when (ex is DllNotFoundException or EntryPointNotFoundException)
+            {
+                PSEtwLog.LogWDACQueryEvent(
+                    "WldpGetApplicationSettingBoolean_Failed",
+                    settingName,
+                    ex.HResult,
+                    0);
 
-            return result;
+                return false;
+            }
         }
 
         /// <summary>