Fix localized enrollment recovery

scripts/Enable-LabRemoteAccess.ps1

@@ -20,6 +20,20 @@ $remoteDesktopUsersSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-
 $remoteDesktopUsersGroup = ($remoteDesktopUsersSid.Translate([Security.Principal.NTAccount]).Value -split '\\', 2)[1]
 
 if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, "Enable RDP and grant $RemoteDesktopPrincipal access")) {
+    function Invoke-PowerCfgBestEffort {
+        param([Parameter(Mandatory)][string[]]$Arguments)
+
+        # Start-Process keeps powercfg's policy-override diagnostic on its own
+        # stderr stream. In PowerShell 7, directly invoking that native command
+        # turns stderr into a terminating ErrorRecord under $ErrorActionPreference
+        # = 'Stop', which previously aborted this unrelated remediation work.
+        $process = Start-Process -FilePath "$env:SystemRoot\System32\powercfg.exe" `
+            -ArgumentList $Arguments -Wait -PassThru -WindowStyle Hidden
+        if ($process.ExitCode -ne 0) {
+            Write-Warning "powercfg $($Arguments -join ' ') returned exit code $($process.ExitCode); continuing enrollment repair."
+        }
+    }
+
     foreach ($powerChange in @(
         @('monitor-timeout-ac', '0'),
         @('monitor-timeout-dc', '0'),
@@ -27,15 +41,9 @@ if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, "Enable RDP and grant $RemoteDesk
         @('standby-timeout-dc', '0'),
         @('hibernate-timeout-ac', '0'),
         @('hibernate-timeout-dc', '0'))) {
-        & powercfg.exe /change $powerChange[0] $powerChange[1]
-        if ($LASTEXITCODE -ne 0) {
-            throw "powercfg /change $($powerChange[0]) failed with exit code $LASTEXITCODE."
-        }
-    }
-    & powercfg.exe /hibernate off
-    if ($LASTEXITCODE -ne 0) {
-        throw "powercfg /hibernate off failed with exit code $LASTEXITCODE."
+        Invoke-PowerCfgBestEffort -Arguments @('/change', $powerChange[0], $powerChange[1])
     }
+    Invoke-PowerCfgBestEffort -Arguments @('/hibernate', 'off')
 
     Set-ItemProperty -LiteralPath 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' `
         -Name fDenyTSConnections -Type DWord -Value 0