Default all users to local Windows profiles

scripts/Enable-SguAzureUserRoaming.ps1

@@ -29,10 +29,15 @@ param(
     [int]$FsLogixProfileSizeMiB = 30000,
     [string]$AzFilesHybridModulePath,
     [switch]$UseDeviceAuthentication,
-    [switch]$DeleteExistingStaffLocalProfiles
+    [switch]$DeleteExistingStaffLocalProfiles,
+    [switch]$AcknowledgeUserRoamingRisks,
+    [string]$FsLogixDeploymentGpoName = 'SGU - FSLogix client deployment'
 )
 
 $ErrorActionPreference = 'Stop'
+if (-not $AcknowledgeUserRoamingRisks -and -not $WhatIfPreference) {
+    throw 'User roaming is an optional high-risk feature. Pass -AcknowledgeUserRoamingRisks only after reviewing docs/user-roaming.md, testing sign-in and sign-out, and accepting the documented storage and recovery failure modes.'
+}
 
 function Assert-Administrator {
     $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
@@ -158,6 +163,8 @@ function Set-SguGpoRegistryValue {
     )
 
     if ($PSCmdlet.ShouldProcess("$GpoName :: $Key\\$ValueName", "Set $Type policy value")) {
+        Remove-GPRegistryValue -Name $GpoName -Domain $DomainName -Server $Server `
+            -Key $Key -ValueName "**del.$ValueName" -ErrorAction SilentlyContinue | Out-Null
         Set-GPRegistryValue -Name $GpoName -Domain $DomainName -Server $Server `
             -Key $Key -ValueName $ValueName -Type $Type -Value $Value | Out-Null
     }
@@ -431,6 +438,24 @@ $staffGpo = Ensure-SguGpoLink -Name $StaffGpoName -TargetOuDn $laboratoryOuDn `
 $fsLogixRoot = 'HKLM\SOFTWARE\FSLogix\Profiles'
 Set-SguGpoRegistryValue -GpoName $staffGpo.DisplayName -DomainName $domainName `
     -Server $DomainController -Key $fsLogixRoot -ValueName 'Enabled' -Type DWord -Value 0
+Set-SguGpoRegistryValue -GpoName $staffGpo.DisplayName -DomainName $domainName `
+    -Server $DomainController -Key 'HKLM\SYSTEM\CurrentControlSet\Services\frxsvc' `
+    -ValueName 'Start' -Type DWord -Value 2
+Set-SguGpoRegistryValue -GpoName $staffGpo.DisplayName -DomainName $domainName `
+    -Server $DomainController -Key 'HKLM\SYSTEM\CurrentControlSet\Services\frxccds' `
+    -ValueName 'Start' -Type DWord -Value 2
+$deploymentGpo = Get-GPO -Name $FsLogixDeploymentGpoName -Domain $domainName `
+    -Server $DomainController -ErrorAction SilentlyContinue
+if ($deploymentGpo) {
+    $deploymentLink = @(Get-GPInheritance -Target $laboratoryOuDn -Domain $domainName `
+        -Server $DomainController).GpoLinks |
+        Where-Object DisplayName -eq $FsLogixDeploymentGpoName | Select-Object -First 1
+    if ($deploymentLink -and -not [bool]$deploymentLink.Enabled -and
+        $PSCmdlet.ShouldProcess($laboratoryOuDn, "Enable '$FsLogixDeploymentGpoName'")) {
+        Set-GPLink -Name $FsLogixDeploymentGpoName -Target $laboratoryOuDn `
+            -Domain $domainName -Server $DomainController -LinkEnabled Yes | Out-Null
+    }
+}
 $fsLogixValues = [ordered]@{
     Enabled = @{ Type = 'DWord'; Value = 1 }
     DeleteLocalProfileWhenVHDShouldApply = @{