From 873ba8702908bd88dca7a18ee5a2b3aec8a04c27 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 5 Dec 2025 18:20:32 +0000
Subject: [PATCH] Improve PowerShell script with error handling and add
 manifest clarification

Co-authored-by: chipitsine <2217296+chipitsine@users.noreply.github.com>
---
 ANTIVIRUS.md                             | 41 ++++++++++++++++++++++--
 src/BuildFiles/Manifests/common.manifest |  5 +++
 2 files changed, 43 insertions(+), 3 deletions(-)

diff --git a/ANTIVIRUS.md b/ANTIVIRUS.md
index 3e5dc900..aa8f61b6 100644
--- a/ANTIVIRUS.md
+++ b/ANTIVIRUS.md
@@ -144,6 +144,8 @@ For automated deployment, use this PowerShell script (requires Administrator pri
 
 ```powershell
 # Add Windows Defender exclusions for SoftEther VPN
+# Requires Administrator privileges
+
 $exclusionPaths = @(
     "C:\Program Files\SoftEther VPN Client",
     "C:\Program Files\SoftEther VPN Client Developer Edition",
@@ -155,14 +157,47 @@ $exclusionPaths = @(
     "C:\ProgramData\SoftEther VPN Server"
 )
 
+# Check if running as Administrator
+$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+
+if (-not $isAdmin) {
+    Write-Error "This script requires Administrator privileges. Please run PowerShell as Administrator."
+    exit 1
+}
+
+# Check if Windows Defender module is available
+if (-not (Get-Module -ListAvailable -Name Defender)) {
+    Write-Error "Windows Defender PowerShell module is not available on this system."
+    exit 1
+}
+
+$successCount = 0
+$errorCount = 0
+
 foreach ($path in $exclusionPaths) {
     if (Test-Path $path) {
-        Add-MpPreference -ExclusionPath $path
-        Write-Host "Added exclusion: $path"
+        try {
+            Add-MpPreference -ExclusionPath $path -ErrorAction Stop
+            Write-Host "✓ Added exclusion: $path" -ForegroundColor Green
+            $successCount++
+        }
+        catch {
+            Write-Warning "✗ Failed to add exclusion for: $path"
+            Write-Warning "  Error: $($_.Exception.Message)"
+            $errorCount++
+        }
+    }
+    else {
+        Write-Host "- Skipped (not found): $path" -ForegroundColor Gray
     }
 }
 
-Write-Host "SoftEther VPN exclusions configured successfully."
+Write-Host "`nSummary:" -ForegroundColor Cyan
+Write-Host "  Successfully added: $successCount exclusion(s)" -ForegroundColor Green
+if ($errorCount -gt 0) {
+    Write-Host "  Failed: $errorCount exclusion(s)" -ForegroundColor Red
+}
+Write-Host "`nSoftEther VPN exclusions configured." -ForegroundColor Cyan
 ```
 
 Save as `Add-SoftEtherVPN-Exclusions.ps1` and run as Administrator.
diff --git a/src/BuildFiles/Manifests/common.manifest b/src/BuildFiles/Manifests/common.manifest
index 6955e115..2961aac2 100644
--- a/src/BuildFiles/Manifests/common.manifest
+++ b/src/BuildFiles/Manifests/common.manifest
@@ -8,6 +8,11 @@
 		processorArchitecture="*"
 	/>
 	<description>SoftEther VPN - Open Source Multi-protocol VPN Software</description>
+	<!-- 
+		trustInfo: Uses 'asInvoker' level which is correct for VPN client applications.
+		VPN services are installed as Windows services with appropriate privileges.
+		Client executables request elevation via UAC only when needed for specific operations.
+	-->
 	<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
 		<security>
 			<requestedPrivileges>