SearchHighlightOff aborts Phase 5 on Microsoft-account devices — IsDynamicSearchBoxEnabled is protected by Consumer Cloud Policy

[gaoac]

Summary

On a Windows 11 machine signed in with a Microsoft account, dev-config.ps1 -Action Full aborts at Phase 5/11 with:

-> Disable Show search highlights...

Calm OS setup stopped early.
  Windows blocked changing HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings\IsDynamicSearchBoxEnabled. Administrator access or Windows policy may restrict this setting.
  (_registry.ps1 line 50)

The setup is otherwise fully idempotent and resumes correctly, but it never gets past Phase 5, so Phases 6–11 never run.

Environment

• OS: Windows 11, build 10.0.26300
• Signed in with a Microsoft account (not a local account, not an Entra/work account)
• Ran both as a normal user (-NoElevate) and as an elevated administrator — same failure in both cases
• PowerShell 7.6.6 (PSEdition: Core)

What I checked (and ruled out)

I went through the usual suspects before concluding this is a policy issue:

Check	Result
ACL on HKCU\...\SearchSettings	User has FullControl; owner is the user
HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer	Empty
HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search	Empty
HKLM\SOFTWARE\Microsoft\PolicyManager\current\device (recursive, filtered by Search)	Empty
gpresult /h	"User has no RSoP data"
HKLM\SOFTWARE\Microsoft\Enrollments	Only the three built-in authorities (Deploy, Cloud, Local); no real MDM enrollment
HKCU\...\SearchSettings value enumeration	IsDynamicSearchBoxEnabled isn't even present as a value
Elevated Set-ItemProperty / .NET RegistryKey.SetValue	Both fail with UnauthorizedAccessException ("Attempted to perform an unauthorized operation")
Settings UI → Privacy & security → Search	Shows "Some of these settings are managed by your organization", and the "Show search highlights" toggle is greyed out / disabled

So this isn't an ACL problem, an MDM enrollment, a Group Policy, or a missing elevation. The write is blocked at the kernel level.

Root cause

This looks like Windows 11's Consumer Cloud Policy protection. When the device is signed in with a Microsoft account, Windows treats a set of search-related settings as cloud-managed and marks the corresponding registry keys so that no user-mode process — including an elevated administrator — can write them. The Settings UI itself surfaces this as "managed by your organization" and disables the toggle.

The practical consequence for the script: the desired end state (Show search highlights = off) is already in effect on these machines. The script simply cannot confirm it by writing the value.

Suggested fix

steps/registry-taskbar-search.ps1 already has a mechanism for exactly this situation. The WidgetServiceOff entry carries:

# Windows may protect the Widgets policy even from an administrator.
@{
    Name        = 'WidgetServiceOff'
    KeyPath     = 'HKLM\SOFTWARE\Policies\Microsoft\Dsh'
    ValueName   = 'AllowNewsAndInterests'
    Value       = 0
    Description = 'Disable Widgets'
    BestEffort  = $true
}

But SearchHighlightOff does not:

@{
    Name        = 'SearchHighlightOff'
    KeyPath     = 'HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings'
    ValueName   = 'IsDynamicSearchBoxEnabled'
    Value       = 0
    Description = 'Disable Show search highlights'
}

I verified locally that adding BestEffort = $true to the SearchHighlightOff entry lets Phase 5 complete (the item is skipped when the write is denied) and the script proceeds to Phases 6–11. Given that WidgetServiceOff is already documented as best-effort for the same class of OS protection, it would make sense to mark SearchHighlightOff the same way.

Workaround (for anyone hitting this in the meantime)

Edit C:\ProgramData\CalmOS\steps\registry-taskbar-search.ps1, add BestEffort = $true to the SearchHighlightOff entry, then re-run:

& "C:\ProgramData\CalmOS\dev-config.ps1" -Action Full -AllowUnsigned

Offer

Happy to open a PR against the src/ tree (not the signed release copies) if that's the preferred path — let me know.