API tools faq
paste
jagreygoose

Windows 10 Setup

jagreygoose
Oct 19th, 2018
475
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PowerShell 12.31 KB | None | 0 0
raw download clone embed print report
  1.     #region Environment
  2.    
  3.         # Set UAC to Low
  4.         Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Type DWord -Value 0 -ErrorAction SilentlyContinue | Out-Null
  5.         Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "PromptOnSecureDesktop" -Type DWord -Value 0 -ErrorAction SilentlyContinue | Out-Null
  6.  
  7.         # Licence Windows Products with key present
  8.         try{
  9.         Get-CimInstance -ClassName SoftwareLicensingProduct -Filter “PartialProductKey IS NOT NULL” |
  10.         Invoke-CimMethod -MethodName Activate -ErrorAction SilentlyContinue | out-null} catch{}
  11.    
  12.         # Set Windows 10 Active Hours to not interfere with work time.
  13.         $activeHoursRegPath = "HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings"
  14.  
  15.         if (Test-Path -Path "${activeHoursRegPath}") {
  16.  
  17.           $activeHoursStart = 8
  18.           $activeHoursEnd = 17
  19.  
  20.           Set-ItemProperty -Path "${activeHoursRegPath}" -Name "ActiveHoursStart" -Value "${activeHoursStart}" -ErrorAction SilentlyContinue | Out-Null
  21.           Set-ItemProperty -Path "${activeHoursRegPath}" -Name "ActiveHoursEnd" -Value "${activeHoursEnd}" -ErrorAction SilentlyContinue | Out-Null
  22.         }    
  23.  
  24.         # Check for Windows Image Errors
  25.         Dism /Online /NoRestart /Cleanup-Image /RestoreHealth /LimitAccess
  26.  
  27.         # Remove System Restore Point 24 Hour Cooldown
  28.         Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" -Name "SystemRestorePointCreationFrequency" -Type DWord -Value 0 -ErrorAction SilentlyContinue | Out-Null
  29.  
  30.     #endregion Environment
  31.  
  32.  
  33.     #region Local
  34.         # Configure Localization Settings.
  35.  
  36.         Set-TimeZone “GMT Standard Time”
  37.         Set-Culture en-GB
  38.         Set-WinSystemLocale en-GB
  39.         Set-WinHomeLocation  -GeoId 0xf2
  40.         Set-WinUserLanguageList -LanguageList en-GB -Force
  41.         # Set BIOS time to local time
  42.         Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\TimeZoneInformation" -Name "RealTimeIsUniversal" -ErrorAction SilentlyContinue
  43.  
  44.     #endregion Local
  45.  
  46.  
  47.     #region Power Settings
  48.         # Configure Power Settings.
  49.  
  50.         powercfg.exe -restoredefaultschemes
  51.         # https://www.symantec.com/connect/articles/tweaking-windows-7-power-plans-using-powercfg-command-line-options
  52.         # Switch Off Display Setting (0-4294967295) =Seconds
  53.         powercfg /SETDCVALUEINDEX SCHEME_CURRENT 7516b95f-f776-4464-8c53-06167f40cc99 3c0bc021-c8a8-4e07-a973-6b14cbcb2b7e 300  
  54.         powercfg /SETACVALUEINDEX SCHEME_CURRENT 7516b95f-f776-4464-8c53-06167f40cc99 3c0bc021-c8a8-4e07-a973-6b14cbcb2b7e 3600
  55.         # Display Brighness Setting (percent): 0-100
  56.         powercfg /SETDCVALUEINDEX SCHEME_CURRENT 7516b95f-f776-4464-8c53-06167f40cc99 aded5e82-b909-4619-9949-f5d71dac0bcb 50
  57.         powercfg /SETACVALUEINDEX SCHEME_CURRENT 7516b95f-f776-4464-8c53-06167f40cc99 aded5e82-b909-4619-9949-f5d71dac0bcb 100
  58.         # Graphics Quality
  59.         powercfg /SETDCVALUEINDEX SCHEME_CURRENT 44f3beca-a7c0-460e-9df2-bb8b99e0cba6 3619c3f2-afb2-4afc-b0e9-e7fef372de36 0    
  60.         powercfg /SETACVALUEINDEX SCHEME_CURRENT 44f3beca-a7c0-460e-9df2-bb8b99e0cba6 3619c3f2-afb2-4afc-b0e9-e7fef372de36 2
  61.         # Sleep Timeout Setting (seconds) =Seconds after which sleep to occur
  62.         powercfg /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 29f6c1db-86da-48c5-9fdb-f2b67b1f44da 900    
  63.         powercfg /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 29f6c1db-86da-48c5-9fdb-f2b67b1f44da 3600
  64.         # DC - On Battery | Wireless Adapter Settings -> Power Saving Mode -> Maximum Performance
  65.         powercfg /SETDCVALUEINDEX SCHEME_CURRENT 19cbb8fa-5279-450e-9fac-8a3d5fedd0c1 12bbebe6-58d6-4636-95bb-3217ef867c1a 0
  66.         # AC - Power Adapter | Wireless Adapter Settings -> Power Saving Mode -> Maximum Performance
  67.         powercfg /SETACVALUEINDEX SCHEME_CURRENT 19cbb8fa-5279-450e-9fac-8a3d5fedd0c1 12bbebe6-58d6-4636-95bb-3217ef867c1a 0      
  68.  
  69.     #endregion Power Settings
  70.  
  71.  
  72.     #region Certificates
  73.  
  74.         # Add Certificate to Local Trusted Root CA
  75.  
  76.         $CertString = "blahblahcertificateasstringhereblahblah"
  77.  
  78.         $Cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
  79.         $Cert.Import([Convert]::FromBase64String($CertString))
  80.  
  81.  
  82.         $store = new-object System.Security.Cryptography.X509Certificates.X509Store(
  83.             [System.Security.Cryptography.X509Certificates.StoreName]::Root,
  84.             "localmachine"
  85.         )
  86.  
  87.         $store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::"ReadWrite")
  88.         $store.Add($Cert)
  89.         $store.Close()
  90.    
  91.     #endregion Certificates
  92.  
  93.     #region Bitlocker
  94.         # Allow Bitlocker Without a Compatible TPM
  95.  
  96.         $gpopath= "HKLM:\SOFTWARE\Policies\Microsoft"
  97.         New-Item –Path "$gpopath" –Name FVE -Force -ErrorAction SilentlyContinue | out-null
  98.         New-ItemProperty -Path "$gpopath\FVE" -Name 'UseAdvancedStartup' -Value '1' -PropertyType DWORD -Force -ErrorAction SilentlyContinue | out-null
  99.         New-ItemProperty -Path "$gpopath\FVE" -Name 'EnableBDEWithNoTPM' -Value '1' -PropertyType DWORD -Force -ErrorAction SilentlyContinue | out-null
  100.         New-ItemProperty -Path "$gpopath\FVE" -Name 'UseTPM' -Value '2' -PropertyType DWORD -Force -ErrorAction SilentlyContinue | out-null
  101.         New-ItemProperty -Path "$gpopath\FVE" -Name 'UseTPMPIN' -Value '2' -PropertyType DWORD -Force -ErrorAction SilentlyContinue | out-null
  102.         New-ItemProperty -Path "$gpopath\FVE" -Name 'UseTPMKEY' -Value '2' -PropertyType DWORD -Force -ErrorAction SilentlyContinue | out-null
  103.         New-ItemProperty -Path "$gpopath\FVE" -Name 'UseTPMKeyPIN' -Value '2' -PropertyType DWORD -Force -ErrorAction SilentlyContinue | out-null
  104.  
  105.     #endregion Bitlocker
  106.  
  107.  
  108.     #region Network
  109.    
  110.  
  111.         # Prevent Mapped Drives From Auto Disconnecting
  112.         net config server /autodisconnect:-1 | Out-Null
  113.  
  114.     #endregion Network
  115.  
  116.     #region Firewall
  117.    
  118.        # Configure Firewall Rules
  119.  
  120.         # Allow WMI
  121.  
  122.         netsh advfirewall firewall set rule group="windows management instrumentation (wmi)" new enable=yes | out-null
  123.         New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Wbem\CIMOM" -Name "AllowAnonymousCallback" -Type DWord -Value 1  -Force | out-null
  124.    
  125.         # Allow NetBIOS
  126.  
  127.         if (-not $(Get-NetFirewallRule –DisplayName 'NetBIOS' | Get-NetFirewallPortFilter | Where { $_.LocalPort -eq '137' })){
  128.             netsh advfirewall firewall add rule name="NetBIOS" dir=in action=allow protocol=TCP localport=137 | out-null
  129.         }
  130.         if (-not $(Get-NetFirewallRule –DisplayName 'NetBIOS_1NetBIOS_2' | Get-NetFirewallPortFilter | Where { $_.LocalPort -eq '138' })){
  131.             netsh advfirewall firewall add rule name="NetBIOS_1NetBIOS_2" dir=in action=allow protocol=UDP localport=138 | out-null
  132.         }
  133.         if (-not $(Get-NetFirewallRule –DisplayName 'NetBIOS_2' | Get-NetFirewallPortFilter | Where { $_.LocalPort -eq '139' })){
  134.             netsh advfirewall firewall add rule name="NetBIOS_2" dir=in action=allow protocol=UDP localport=139 | out-null
  135.         }
  136.  
  137.         # Allow ICMP - http://shouldiblockicmp.com/
  138.    
  139.         if (-not $(Get-NetFirewallRule –DisplayName 'All ICMP V4' | Where {$_.Enabled -eq $true})){
  140.             netsh advfirewall firewall add rule name="All ICMP V4" protocol=icmpv4:any,any dir=in action=allow | out-null
  141.         }      
  142.         if (-not $(Get-NetFirewallRule –DisplayName 'All ICMP V6' | Where {$_.Enabled -eq $true})){
  143.             netsh advfirewall firewall add rule name="All ICMP V6" protocol=icmpv6:any,any dir=in action=allow | out-null
  144.         }
  145.  
  146.         # Allow Remote Administration
  147.    
  148.         netsh advfirewall firewall set rule group="Remote Administration" new enable=yes | out-null
  149.         New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "AllowRemoteRPC" -Type DWord -Value 1  -Force | out-null
  150.         New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Type DWord -Value 0  -Force | out-null
  151.    
  152.         # Allow File Printer Sharing
  153.  
  154.         netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=yes | out-null
  155.    
  156.         # Allow Network Discovery
  157.  
  158.         netsh advfirewall firewall set rule group="network discovery" new enable=yes | out-null
  159.  
  160.         # Allow SQL
  161.  
  162.         if (-not $(Get-NetFirewallRule –DisplayName 'SQL Port 1433' | Get-NetFirewallPortFilter | Where { $_.LocalPort -eq '1433' })){
  163.             netsh advfirewall firewall add rule name="SQL Port 1433" dir=in action=allow protocol=TCP localport=1433 | out-null
  164.         }
  165.         if (-not $(Get-NetFirewallRule –DisplayName 'SQL Port 1434' | Get-NetFirewallPortFilter | Where { $_.LocalPort -eq '1434' })){
  166.             netsh advfirewall firewall add rule name="SQL Port 1434" dir=in action=allow protocol=UDP localport=1434 | out-null
  167.         }
  168.  
  169.     #endregion Firewall
  170.  
  171.     #region Accessibility
  172.  
  173.         # Mouse Acceleration Settings
  174.         Set-ItemProperty "HKCU:\Control Panel\Mouse" "MouseSensitivity" "15" -ErrorAction SilentlyContinue | Out-Null
  175.         Set-ItemProperty "HKCU:\Control Panel\Mouse" "MouseSpeed" "0" -ErrorAction SilentlyContinue | Out-Null
  176.         Set-ItemProperty "HKCU:\Control Panel\Mouse" "MouseThreshold1" "0" -ErrorAction SilentlyContinue | Out-Null
  177.         Set-ItemProperty "HKCU:\Control Panel\Mouse" "MouseThreshold2" "0" -ErrorAction SilentlyContinue | Out-Null
  178.         Set-ItemProperty "HKCU:\Control Panel\Mouse" "SmoothMouseXCurve" ([byte[]](0x00, 0x00, 0x00,
  179.         0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0xCC, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00,
  180.         0x80, 0x99, 0x19, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x66, 0x26, 0x00, 0x00,
  181.         0x00, 0x00, 0x00, 0x00, 0x33, 0x33, 0x00, 0x00, 0x00, 0x00, 0x00)) -ErrorAction SilentlyContinue | Out-Null
  182.         Set-ItemProperty "HKCU:\Control Panel\Mouse" "SmoothMouseYCurve" ([byte[]](0x00, 0x00, 0x00,
  183.         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x38, 0x00, 0x00, 0x00, 0x00, 0x00,
  184.         0x00, 0x00, 0x70, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xA8, 0x00, 0x00,
  185.         0x00, 0x00, 0x00, 0x00, 0x00, 0xE0, 0x00, 0x00, 0x00, 0x00, 0x00)) -ErrorAction SilentlyContinue | Out-Null
  186.         Set-ItemProperty "HKCU:\Control Panel\Desktop" "UserPreferencesMask" ([byte[]](0x9e,
  187.         0x1e, 0x06, 0x80, 0x12, 0x00, 0x00, 0x00)) -ErrorAction SilentlyContinue | Out-Null
  188.  
  189.         $MethodDefinition = @"
  190.       [DllImport("user32.dll", EntryPoint = "SystemParametersInfo")]
  191.       public static extern bool SystemParametersInfo(uint uiAction, uint uiParam, uint pvParam, uint fWinIni);
  192.    "@
  193.         $User32Set = Add-Type -MemberDefinition $MethodDefinition -Name "User32Set" -Namespace Win32Functions -PassThru
  194.         $User32Set::SystemParametersInfo(0x0071,0,15,0) | Out-Null
  195.  
  196.  
  197.     # endregion Accessibility
  198.  
  199.  
  200.     #region Choco
  201.         # Chocolatey Package Manager."
  202.         $env:chocolateyUseWindowsCompression = 'true'
  203.         $packages = @(
  204.             "choco install choco-upgrade-all-at-startup"
  205.             "anydesk"
  206.             "winrar"
  207.             "google-drive-file-stream"
  208.             "adobereader"
  209.             "audacity"
  210.             "google-chrome-x64"
  211.             "sysinternals"
  212.             "vlc"
  213.             "everything"
  214.             "youtube-dl-gui.install"
  215.             "pdfsam.install"
  216.             "adwcleaner"
  217.             "bulkrenameutility.install"
  218.         )
  219.  
  220.  
  221.         If(Test-Path -Path "$env:ProgramData\Chocolatey") {
  222.  
  223.             choco feature enable -n=allowglobalconfirmation
  224.             choco feature enable -n=allowemptychecksums
  225.             choco upgrade chocolatey
  226.             choco upgrade all --ignore-checksums -y
  227.         }
  228.         Else {
  229.  
  230.           [System.Net.WebRequest]::DefaultWebProxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))  
  231.  
  232.           choco feature enable -n=allowglobalconfirmation
  233.           choco feature enable -n=allowemptychecksums
  234.           $packages | %{choco install $_  --ignore-checksums --force -y}
  235.         }
  236.  
  237.  
  238.     #endregion Choco
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!