<#
.SYNOPSIS
    Enables Windows Master Location Services and app-level location access.
#>

# 1. Close Settings app to force a UI refresh when reopened
Stop-Process -Name "SystemSettings" -Force -ErrorAction SilentlyContinue

# 2. Configure and start the Geolocation Service (lfsvc)
Write-Output "Configuring Geolocation service (lfsvc)..."
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\lfsvc" -Name "Start" -Value 2 -Type DWord -Force
Start-Service -Name "lfsvc" -ErrorAction SilentlyContinue

# 3. Set service configuration status flag
$svcConfigPath = "HKLM:\SYSTEM\CurrentControlSet\Services\lfsvc\Service\Configuration"
if (-not (Test-Path $svcConfigPath)) { New-Item -Path$svcConfigPath -Force | Out-Null }
Set-ItemProperty -Path $svcConfigPath -Name "Status" -Value 1 -Type DWord -Force

# 4. Remove any conflicting local policies
$policyPaths = @(
    "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors",
    "HKCU:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors"
)
foreach ($path in$policyPaths) {
    if (Test-Path $path) {
        Remove-ItemProperty -Path $path -Name "DisableLocation" -ErrorAction SilentlyContinue
        Remove-ItemProperty -Path $path -Name "DisableLocationScripting" -ErrorAction SilentlyContinue
        Remove-ItemProperty -Path $path -Name "DisableSensors" -ErrorAction SilentlyContinue
    }
}

# 5. Enable Master Device-Level Location Switch (HKLM)
$hklmConsentPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location"
if (-not (Test-Path $hklmConsentPath)) { New-Item -Path$hklmConsentPath -Force | Out-Null }
Set-ItemProperty -Path $hklmConsentPath -Name "Value" -Value "Allow" -Type String -Force

# 6. Enable User-Level Location Switch (HKCU and all loaded user hives)
$hkcuConsentPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location"
if (-not (Test-Path $hkcuConsentPath)) { New-Item -Path$hkcuConsentPath -Force | Out-Null }
Set-ItemProperty -Path $hkcuConsentPath -Name "Value" -Value "Allow" -Type String -Force

$userSids = Get-ChildItem "Registry::HKEY_USERS" | Where-Object { $_.PSChildName -match "^S-1-5-21-\d+-\d+-\d+-\d+$" }
foreach ($sid in$user`