From b8a44140b70c3efb41b3d0afd44fec1d2820d650 Mon Sep 17 00:00:00 2001
From: Oscar Virot <virot@virot.com>
Date: Wed, 13 Nov 2024 21:41:09 +0100
Subject: [PATCH] Also checks if the provider is registered with Get-WinEvent
 before unregistering

---
 TameMyCerts/install.ps1 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/TameMyCerts/install.ps1 b/TameMyCerts/install.ps1
index db5d666..5853d84 100644
--- a/TameMyCerts/install.ps1
+++ b/TameMyCerts/install.ps1
@@ -173,8 +173,8 @@ process {
         }
 
         # If EWT Logging manifest exist unregister that one.
-        If (Test-Path -Path "$BaseDirectory\$($PolicyModuleName).events.man") {
-	    Write-Verbose "Found the required files for EWT logging, unregistering with wevtutil"
+        If (((Get-WinEvent -ListProvider $PolicyModuleName -ErrorAction SilentlyContinue) -ne $Null) -and (Test-Path -Path "$BaseDirectory\$($PolicyModuleName).events.man")) {
+	        Write-Verbose "Found the required files for EWT logging, unregistering with wevtutil"
             Start-Process `
                 -FilePath "$($env:SystemRoot)\System32\wevtutil.exe" `
                 -ArgumentList "um", """$BaseDirectory\$($PolicyModuleName).events.man""" `