#Requires -Version 5.1
<#
    JbTecWiz Support Centre -- generated fix script

    Fault : Office is stuck on an old build, or a bad update needs rolling back
    Fix   : Roll back to the previous build
    Source: https://jbtecwiz.com/support/win-office-update-channel

    Run as     : PowerShell as administrator
    Expect     : 45 minutes
    Risk       : medium
    Reversible : yes

    WHEN THIS IS THE RIGHT FIX
    An update broke something and you need the previous build while it is
    investigated. A pinned build stops receiving security updates, so treat
    this as a temporary measure with an end date rather than a
    configuration.

    HOW TO UNDO IT
    Set UpdatesEnabled back to True and run /update user to return to the
    current build.

    This script walks the fix one step at a time and asks before each
    one. Steps with no command are things you do yourself -- it prints
    those and waits. Run with -DryRun to print without executing.
#>

[CmdletBinding()]
param(
    # Print every step and command without running anything.
    [switch]$DryRun,
    # Do not ask before each step. Read the script first if you use this.
    [switch]$Unattended
)

$ErrorActionPreference = 'Stop'
$script:Failed = 0

# - THIS SCRIPT WILL NOT RUN UNTIL YOU EDIT IT -
# The commands below contain values only you can supply. Search the
# script for each one, replace it, then delete this block.
$script:MustEdit = @(
    '16.0.17928.20114'   # an example build number
)
if ($script:MustEdit.Count) {
    Write-Host ""
    Write-Host '  This script needs editing before it can run.' -ForegroundColor Yellow
    Write-Host '  Replace each of these with a real value:' -ForegroundColor Yellow
    $script:MustEdit | ForEach-Object { Write-Host ("    " + $_) -ForegroundColor Yellow }
    Write-Host ""
    Write-Host '  Then delete the $script:MustEdit block near the top.'
    Write-Host ""
    exit 2
}

# This fix is documented as needing an elevated session.
$id = [Security.Principal.WindowsIdentity]::GetCurrent()
if (-not (New-Object Security.Principal.WindowsPrincipal $id).IsInRole(
        [Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Host ''
    Write-Host '  This fix needs an elevated PowerShell.' -ForegroundColor Yellow
    Write-Host '  Close this window, right-click PowerShell, Run as administrator,'
    Write-Host '  and run the script again.'
    Write-Host ''
    exit 3
}

function Write-Rule { param([string]$Text)
    Write-Host ''
    Write-Host ('-' * 70) -ForegroundColor DarkGray
    if ($Text) { Write-Host $Text -ForegroundColor Cyan }
}

function Show-Prose { param([string]$Text, [string]$Colour = "Gray")
    if (-not $Text) { return }
    $words = $Text -split "\s+"; $line = "  "
    foreach ($w in $words) {
        if (($line.Length + $w.Length) -gt 74) { Write-Host $line -ForegroundColor $Colour; $line = "  " }
        $line += "$w "
    }
    if ($line.Trim()) { Write-Host $line -ForegroundColor $Colour }
}

function Invoke-Step {
    param(
        [int]$Number, [string]$Do, [string]$Why,
        [scriptblock]$Command, [switch]$Manual, [string]$Shell = "powershell"
    )
    Write-Rule "  Step $Number of 5"
    Show-Prose $Do "White"
    if ($Why) { Write-Host ""; Show-Prose $Why "DarkGray" }

    if ($Manual) {
        Write-Host ''
        Write-Host '  -> Do this yourself, then press Enter to carry on.' -ForegroundColor Yellow
        if (-not $Unattended -and -not $DryRun) { [void](Read-Host) }
        return
    }

    Write-Host ''
    foreach ($l in ($Command.ToString().Trim() -split "`n")) {
        Write-Host ("    " + $l.Trim()) -ForegroundColor Green
    }
    Write-Host ''

    if ($DryRun) { Write-Host "  (dry run -- not executed)" -ForegroundColor DarkGray; return }
    if (-not $Unattended) {
        $a = Read-Host "  Run this step? [Y]es / [S]kip / [Q]uit"
        if ($a -match "^[Qq]") { Write-Host "  Stopped at your request."; exit 0 }
        if ($a -match "^[Ss]") { Write-Host "  Skipped." -ForegroundColor DarkGray; return }
    }
    try { & $Command }
    catch {
        $script:Failed++
        Write-Host ("  Step $Number failed: " + $_.Exception.Message) -ForegroundColor Red
        Show-Prose "The rest of the fix may depend on this. Read the write-up before carrying on." "Red"
        if (-not $Unattended) {
            $c = Read-Host "  Carry on anyway? [y/N]"
            if ($c -notmatch "^[Yy]") { exit 1 }
        }
    }
}

Write-Rule
Write-Host '  Office is stuck on an old build, or a bad update needs rolling back' -ForegroundColor White
Write-Host '  Roll back to the previous build' -ForegroundColor Cyan
Write-Host ''
Write-Host '  Risk: medium   Reversible   45 minutes'
Write-Rule

if (-not $Unattended -and -not $DryRun) {
    $go = Read-Host '  Ready? [y/N]'
    if ($go -notmatch "^[Yy]") { Write-Host "  Nothing was changed."; exit 0 }
}

Invoke-Step -Number 1 -Do 'Record the current version before changing anything, so you can come back to it.' -Command {
    Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' | Select-Object ClientVersionToReport, UpdateChannel
}

Invoke-Step -Number 2 -Do 'Find the build number you want from Microsoft''s update history for your channel. Note the full four-part version, for example 16.0.17928.20114.' -Why 'Only the last few builds per channel stay on the content network. A version older than that will fail to download and leave the installation exactly where it was, which is at least harmless.' -Command {
    Start-Process 'https://learn.microsoft.com/officeupdates/update-history-microsoft365-apps-by-date'
}

Invoke-Step -Number 3 -Do 'Stop updates first, or the machine will simply update forward again within the day.' -Command {
    Set-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' -Name UpdatesEnabled -Value 'False'
}

Invoke-Step -Number 4 -Do 'Roll back to the chosen build. Close every Office application first.' -Command {
    & "$env:CommonProgramFiles\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user updatetoversion=16.0.17928.20114 displaylevel=true forceappshutdown=true
}

Invoke-Step -Number 5 -Do 'Set a date to re-enable updates. A machine pinned to an old build and forgotten stops receiving security fixes, which is a worse problem than the one you are working around.' -Why 'This is the step that gets skipped, and it is the reason estates end up with machines years behind. Write the date down somewhere that is not this machine.' -Manual

Write-Rule "  Confirm it worked"
Show-Prose 'The version reported is the one you asked for, and the broken behaviour is gone.' 'White'
Write-Host ''
if (-not $DryRun) {
    Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' | Select-Object ClientVersionToReport
}

Write-Rule
if ($script:Failed -gt 0) {
    Write-Host ("  Finished with " + $script:Failed + " failed step(s).") -ForegroundColor Yellow
    Show-Prose 'Read the full write-up at https://jbtecwiz.com/support/win-office-update-channel' 'Yellow'
} else {
    Write-Host '  Finished.' -ForegroundColor Green
}
Write-Host ''
Show-Prose 'To undo: Set UpdatesEnabled back to True and run /update user to return to the current build.' 'DarkGray'
Write-Rule