API tools faq
paste
TheRoboKitten

Windows 10 Security/Hardening Powershell Script 5.0

TheRoboKitten
Mar 23rd, 2017
3,211
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PowerShell 117.71 KB | None | 0 0
raw download clone embed print report
  1. ##########
  2. # Win10 Initial Setup Script
  3. # Author: Disassembler, Gr1d:, TheRoc
  4. # Edited by Gr1D:
  5. # dasm's script: https://github.com/Disassembler0/Win10-Initial-Setup-Script/
  6. # TheROC's E.T. Disable script: https://gist.github.com/thoroc/86d354d029dda303598a
  7.  
  8. # THIS IS VERSION 4.0, error suppression is turned on. Debugging needs to be completed in add-appxpackage and Onedrive uninstall sections.
  9. # This script leaves more MS defaults on, including MSE and smart-screen,
  10. # but blocks a ton of domains and disables remote assistance secures java, sets up ipsec..
  11. # (please set your own key - SEE BELOW A FEW LINES) and disables SSL. Even changes your mac. To disable skynet turn off smartscreen and antivirus.
  12.  
  13. # NOTE: READ THIS SCRIPT CAREFULLY BEFORE RUNNING IT. ADJUST COMMENTS AS APPROPRIATE.
  14. # This script will reboot your machine when completed.
  15. # Setting up a new machine? See http://ninite.com (for devs, http://chocolatey.org)
  16. ##########
  17.  
  18. # Ask for elevated permissions if required
  19.  
  20. $ErrorActionPreference= 'silentlycontinue'
  21.  
  22. If (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")) {
  23.     Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs
  24.     Exit
  25. }
  26.  
  27.  
  28. #
  29. # PLEASE EDIT THE BELOW LINE TO SET YOUR IPSEC PASSWORD (This may be randomly generated in the future)
  30. $ThePreSharedKey = 'PasswordCHANGEME'
  31.  
  32.  
  33. Write-Progress -Activity "Backing up registry. This may take awhile..." -Status "Progress:" -PercentComplete 1
  34. del C:\registry-backup-hklm.reg
  35. del C:\registry-backup-hkcu.reg
  36. del C:\registry-backup-hkcr.reg
  37.  
  38. reg export HKLM C:\registry-backup-hklm.reg | Out-Null
  39. reg export HKCU C:\registry-backup-hkcu.reg | Out-Null
  40. reg export HKCR C:\registry-backup-hkcr.reg | Out-Null
  41. Write-Progress -Activity "Backing up registry. This may take awhile..." -Status "Progress:" -PercentComplete 100
  42. ##########
  43. # Privacy Settings
  44. ##########
  45. Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 1
  46. # Disable Telemetry
  47. # Disable Telemetry
  48. Write-Host "Disabling Telemetry..."
  49. Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 0
  50. Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 0
  51. Set-ItemProperty -Path "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 0
  52.  
  53. # Enable Telemetry
  54. # Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 3
  55. # Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 3
  56. # Set-ItemProperty -Path "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 3
  57.  
  58. # Disable Wi-Fi Sense
  59. Write-Host "Disabling Wi-Fi Sense..."
  60. If (!(Test-Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting")) {
  61.     New-Item -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" -Force | Out-Null
  62. }
  63. Set-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" -Name "Value" -Type DWord -Value 0
  64. Set-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotspots" -Name "Value" -Type DWord -Value 0
  65. Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 15
  66. # Enable Wi-Fi Sense
  67. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" -Name "Value" -Type DWord -Value 1
  68. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotspots" -Name "Value" -Type DWord -Value 1
  69.  
  70. # Disable SmartScreen Filter
  71. # Write-Host "Disabling SmartScreen Filter..."
  72. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer" -Name "SmartScreenEnabled" -Type String -Value "Off"
  73. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AppHost" -Name "EnableWebContentEvaluation" -Type DWord -Value 0
  74.  
  75. # Enable SmartScreen Filter
  76. Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer" -Name "SmartScreenEnabled" -Type String -Value "RequireAdmin"
  77. Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AppHost" -Name "EnableWebContentEvaluation"
  78.  
  79. # Disable Bing Search in Start Menu
  80. Write-Host "Disabling Bing Search in Start Menu..."
  81. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "BingSearchEnabled" -Type DWord -Value 0
  82.  
  83. # Enable Bing Search in Start Menu
  84. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "BingSearchEnabled"
  85. Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 30
  86. # Disable Start Menu suggestions
  87. Write-Host "Disabling Start Menu suggestions..."
  88. Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" -Name "SystemPaneSuggestionsEnabled" -Type DWord -Value 0
  89.  
  90. # Enable Start Menu suggestions
  91. # Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" -Name "SystemPaneSuggestionsEnabled" -Type DWord -Value 1
  92.  
  93. # Disable Location Tracking
  94. Write-Host "Disabling Location Tracking..."
  95. Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Sensor\Overrides\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}" -Name "SensorPermissionState" -Type DWord -Value 0
  96. Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\lfsvc\Service\Configuration" -Name "Status" -Type DWord -Value 0
  97.  
  98. # Enable Location Tracking
  99. # Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Sensor\Overrides\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}" -Name "SensorPermissionState" -Type DWord -Value 1
  100. # Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\lfsvc\Service\Configuration" -Name "Status" -Type DWord -Value 1
  101. Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 45
  102. # Disable Feedback
  103. Write-Host "Disabling Feedback..."
  104. If (!(Test-Path "HKCU:\Software\Microsoft\Siuf\Rules")) {
  105.     New-Item -Path "HKCU:\Software\Microsoft\Siuf\Rules" -Force | Out-Null
  106. }
  107. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Siuf\Rules" -Name "NumberOfSIUFInPeriod" -Type DWord -Value 0
  108.  
  109. # Enable Feedback
  110. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Siuf\Rules" -Name "NumberOfSIUFInPeriod"
  111.  
  112. # Disable Advertising ID
  113. Write-Host "Disabling Advertising ID..."
  114. If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo")) {
  115.     New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" | Out-Null
  116. }
  117. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" -Name "Enabled" -Type DWord -Value 0
  118.  
  119. # Enable Advertising ID
  120. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" -Name "Enabled"
  121. Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 60
  122. # Disable Cortana
  123. Write-Host "Disabling Cortana..."
  124. If (!(Test-Path "HKCU:\Software\Microsoft\Personalization\Settings")) {
  125.     New-Item -Path "HKCU:\Software\Microsoft\Personalization\Settings" -Force | Out-Null
  126. }
  127. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Personalization\Settings" -Name "AcceptedPrivacyPolicy" -Type DWord -Value 0
  128. If (!(Test-Path "HKCU:\Software\Microsoft\InputPersonalization")) {
  129.     New-Item -Path "HKCU:\Software\Microsoft\InputPersonalization" -Force | Out-Null
  130. }
  131. Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization" -Name "RestrictImplicitTextCollection" -Type DWord -Value 1
  132. Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization" -Name "RestrictImplicitInkCollection" -Type DWord -Value 1
  133. If (!(Test-Path "HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore")) {
  134.     New-Item -Path "HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore" -Force | Out-Null
  135. }
  136. Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore" -Name "HarvestContacts" -Type DWord -Value 0
  137.  
  138. # Enable Cortana
  139. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Personalization\Settings" -Name "AcceptedPrivacyPolicy"
  140. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization" -Name "RestrictImplicitTextCollection" -Type DWord -Value 0
  141. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization" -Name "RestrictImplicitInkCollection" -Type DWord -Value 0
  142. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore" -Name "HarvestContacts"
  143.  
  144. # Restrict Windows Update P2P only to local network
  145. Write-Host "Restricting Windows Update P2P only to local network..."
  146. Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" -Name "DODownloadMode" -Type DWord -Value 1
  147. If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization")) {
  148.     New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization" | Out-Null
  149. }
  150. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization" -Name "SystemSettingsDownloadMode" -Type DWord -Value 3
  151.  Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 75
  152. # Unrestrict Windows Update P2P
  153. # Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" -Name "DODownloadMode"
  154. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization" -Name "SystemSettingsDownloadMode"
  155.  
  156. # Remove AutoLogger file and restrict directory
  157. Write-Host "Removing AutoLogger file and restricting directory..."
  158. $autoLoggerDir = "$env:PROGRAMDATA\Microsoft\Diagnosis\ETLLogs\AutoLogger"
  159. If (Test-Path "$autoLoggerDir\AutoLogger-Diagtrack-Listener.etl") {
  160.     Remove-Item "$autoLoggerDir\AutoLogger-Diagtrack-Listener.etl"
  161. }
  162. icacls $autoLoggerDir /deny SYSTEM:`(OI`)`(CI`)F | Out-Null
  163.  
  164. # Unrestrict AutoLogger directory
  165. # $autoLoggerDir = "$env:PROGRAMDATA\Microsoft\Diagnosis\ETLLogs\AutoLogger"
  166. # icacls $autoLoggerDir /grant:r SYSTEM:`(OI`)`(CI`)F | Out-Null
  167.  
  168. # Stop and disable Diagnostics Tracking Service
  169. Write-Host "Stopping and disabling Diagnostics Tracking Service..."
  170. Stop-Service "DiagTrack"
  171. Set-Service "DiagTrack" -StartupType Disabled
  172.  
  173. # Enable and start Diagnostics Tracking Service
  174. # Set-Service "DiagTrack" -StartupType Automatic
  175. # Start-Service "DiagTrack"
  176. Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 90
  177. # Stop and disable WAP Push Service
  178. Write-Host "Stopping and disabling WAP Push Service..."
  179. Stop-Service "dmwappushservice"
  180. Set-Service "dmwappushservice" -StartupType Disabled
  181.  
  182. # Enable and start WAP Push Service
  183. # Set-Service "dmwappushservice" -StartupType Automatic
  184. # Start-Service "dmwappushservice"
  185. # Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\dmwappushservice" -Name "DelayedAutoStart" -Type DWord -Value 1
  186.  
  187. Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 100
  188.  
  189. ##########
  190. # Service Tweaks
  191. ##########
  192. Write-Progress -Activity "Setting some service tweaks..." -Status "Progress:" -PercentComplete 1
  193. # Lower UAC level
  194. # Write-Host "Lowering UAC level..."
  195. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Type DWord -Value 0
  196. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "PromptOnSecureDesktop" -Type DWord -Value 0
  197.  
  198. # Raise UAC level
  199. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Type DWord -Value 5
  200. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "PromptOnSecureDesktop" -Type DWord -Value 1
  201.  
  202. # Enable sharing mapped drives between users
  203. # Write-Host "Enabling sharing mapped drives between users..."
  204. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLinkedConnections" -Type DWord -Value 1
  205.  
  206. # Disable sharing mapped drives between users
  207. Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLinkedConnections"
  208.  
  209. # Disable Firewall
  210. # Write-Host "Disabling Firewall..."
  211. # Set-NetFirewallProfile -Profile * -Enabled False
  212.  
  213. # Enable Firewall
  214. Set-NetFirewallProfile -Profile * -Enabled True
  215.  
  216. # Disable Windows Defender
  217. # Write-Host "Disabling Windows Defender..."
  218. # Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Type DWord -Value 1
  219.  
  220. #### Configure the two below options when NOT running windows defender. (These sound pretty shady.. SKYNET!)
  221.  
  222. # Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" -ValueName **del.SpynetReporting -Type String -Data ""
  223. # Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" -ValueName SubmitSamplesConsent -Type DWord -Data 2
  224.  
  225. # Enable Windows Defender
  226. Remove-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware"
  227. Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Type DWord -Value 0
  228. Write-Progress -Activity "Setting some service tweaks..." -Status "Progress:" -PercentComplete 45
  229.  
  230. # Disable Windows Update automatic restart
  231. Write-Host "Disabling Windows Update automatic restart..def."
  232. Set-ItemProperty -Path "HKLM:\Software\Microsoft\WindowsUpdate\UX\Settings" -Name "UxOption" -Type DWord -Value 1
  233.  
  234. # Enable Windows Update automatic restart
  235. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\WindowsUpdate\UX\Settings" -Name "UxOption" -Type DWord -Value 0
  236.  
  237. # Stop and disable Home Groups services
  238. Write-Host "Stopping and disabling Home Groups services..."
  239. Stop-Service "HomeGroupListener"
  240. Set-Service "HomeGroupListener" -StartupType Disabled
  241. Write-Progress -Activity "Setting some service tweaks..." -Status "Progress:" -PercentComplete 80
  242. Stop-Service "HomeGroupProvider"
  243. Set-Service "HomeGroupProvider" -StartupType Disabled
  244.  
  245. # Enable and start Home Groups services
  246. # Set-Service "HomeGroupListener" -StartupType Manual
  247. # Set-Service "HomeGroupProvider" -StartupType Manual
  248. # Start-Service "HomeGroupProvider"
  249.  
  250. # Disable Remote Assistance
  251. Write-Host "Disabling Remote Assistance..."
  252. Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Remote Assistance" -Name "fAllowToGetHelp" -Type DWord -Value 0
  253. Write-Progress -Activity "Setting some service tweaks..." -Status "Progress:" -PercentComplete 80
  254. # Enable Remote Assistance
  255. # Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Remote Assistance" -Name "fAllowToGetHelp" -Type DWord -Value 1
  256.  
  257. # Enable Remote Desktop w/o Network Level Authentication
  258. # Write-Host "Enabling Remote Desktop w/o Network Level Authentication..."
  259. # Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Type DWord -Value 0
  260. # Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication" -Type DWord -Value 0
  261.  
  262. # Disable Remote Desktop
  263. Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Type DWord -Value 1
  264. Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication" -Type DWord -Value 1
  265. Write-Progress -Activity "Setting some service tweaks..." -Status "Progress:" -PercentComplete 100
  266.  
  267.  
  268. ##########
  269. # UI Tweaks
  270. ##########
  271. Write-Progress -Activity "Setting some UI tweaks..." -Status "Progress:" -PercentComplete 1
  272. # Disable Action Center
  273. Write-Host "Disabling Action Center..."
  274. If (!(Test-Path "HKCU:\Software\Policies\Microsoft\Windows\Explorer")) {
  275.   New-Item -Path "HKCU:\Software\Policies\Microsoft\Windows\Explorer" | Out-Null
  276. }
  277. Set-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Windows\Explorer" -Name "DisableNotificationCenter" -Type DWord -Value 1
  278. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\PushNotifications" -Name "ToastEnabled" -Type DWord -Value 0
  279.  
  280. # Enable Action Center
  281. # Remove-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Windows\Explorer" -Name "DisableNotificationCenter"
  282. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\PushNotifications" -Name "ToastEnabled"
  283.  
  284. # Disable Lock screen
  285. # Write-Host "Disabling Lock screen..."
  286. # If (!(Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization")) {
  287. #   New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" | Out-Null
  288. # }
  289. # Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" -Name "NoLockScreen" -Type DWord -Value 1
  290.  
  291. # Enable Lock screen
  292. Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" -Name "NoLockScreen"
  293.  
  294. # Disable Lock screen (Anniversary Update workaround)
  295. #If ([System.Environment]::OSVersion.Version.Build -gt 14392) { # Apply only for Redstone 1 or newer
  296. #   $service = New-Object -com Schedule.Service
  297. #   $service.Connect()
  298. #   $task = $service.NewTask(0)
  299. #   $task.Settings.DisallowStartIfOnBatteries = $false
  300. #   $trigger = $task.Triggers.Create(9)
  301. #   $trigger = $task.Triggers.Create(11)
  302. #   $trigger.StateChange = 8
  303. #   $action = $task.Actions.Create(0)
  304. #   $action.Path = "reg.exe"
  305. #   $action.Arguments = "add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData /t REG_DWORD /v AllowLockScreen /d 0 /f"
  306. #   $service.GetFolder("\").RegisterTaskDefinition("Disable LockScreen", $task, 6, "NT AUTHORITY\SYSTEM", $null, 4) | Out-Null
  307. #}
  308.  
  309. # Enable Lock screen (Anniversary Update workaround)
  310. #If ([System.Environment]::OSVersion.Version.Build -gt 14392) { # Apply only for Redstone 1 or newer
  311. #   Unregister-ScheduledTask -TaskName "Disable LockScreen" -Confirm:$false -ErrorAction SilentlyContinue
  312. #}
  313. Write-Progress -Activity "Setting some UI tweaks..." -Status "Progress:" -PercentComplete 15
  314. # Disable Autoplay
  315. Write-Host "Disabling Autoplay..."
  316. Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers" -Name "DisableAutoplay" -Type DWord -Value 1
  317.  
  318. # Enable Autoplay
  319. # Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers" -Name "DisableAutoplay" -Type DWord -Value 0
  320.  
  321. # Disable Autorun for all drives
  322. Write-Host "Disabling Autorun for all drives..."
  323. If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer")) {
  324.   New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" | Out-Null
  325. }
  326. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoDriveTypeAutoRun" -Type DWord -Value 255
  327.  
  328. # Enable Autorun
  329. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoDriveTypeAutoRun"
  330. Write-Progress -Activity "Setting some UI tweaks..." -Status "Progress:" -PercentComplete 30
  331. #Disable Sticky keys prompt
  332. Write-Host "Disabling Sticky keys prompt..."
  333. Set-ItemProperty -Path "HKCU:\Control Panel\Accessibility\StickyKeys" -Name "Flags" -Type String -Value "506"
  334.  
  335. # Enable Sticky keys prompt
  336. # Set-ItemProperty -Path "HKCU:\Control Panel\Accessibility\StickyKeys" -Name "Flags" -Type String -Value "510"
  337.  
  338. # Hide Search button / box
  339. Write-Host "Hiding Search Box / Button..."
  340. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "SearchboxTaskbarMode" -Type DWord -Value 0
  341.  
  342. # Show Search button / box
  343. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "SearchboxTaskbarMode"
  344.  
  345. # Hide Task View button
  346. # Write-Host "Hiding Task View button..."
  347. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "ShowTaskViewButton" -Type DWord -Value 0
  348.  
  349. # Show Task View button
  350. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "ShowTaskViewButton"
  351.  
  352. # Show small icons in taskbar
  353. # Write-Host "Showing small icons in taskbar..."
  354. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarSmallIcons" -Type DWord -Value 1
  355.  
  356. # Show large icons in taskbar
  357. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarSmallIcons"
  358.  
  359. # Show titles in taskbar
  360. # Write-Host "Showing titles in taskbar..."
  361. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarGlomLevel" -Type DWord -Value 1
  362.  
  363. # Hide titles in taskbar
  364. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarGlomLevel"
  365.  
  366. # Show all tray icons
  367. # write-Host "Showing all tray icons..."
  368. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer" -Name "EnableAutoTray" -Type DWord -Value 0
  369.  
  370. # Hide tray icons as needed
  371. Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer" -Name "EnableAutoTray"
  372. Write-Progress -Activity "Setting some UI tweaks..." -Status "Progress:" -PercentComplete 45
  373. # Show known file extensions
  374. Write-Host "Showing known file extensions..."
  375. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "HideFileExt" -Type DWord -Value 0
  376.  
  377. # Hide known file extensions
  378. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "HideFileExt" -Type DWord -Value 1
  379.  
  380. # Show hidden files
  381. Write-Host "Showing hidden files..."
  382. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "Hidden" -Type DWord -Value 1
  383.  
  384. # Hide hidden files
  385. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "Hidden" -Type DWord -Value 2
  386.  
  387. # Change default Explorer view to "Computer"
  388. Write-Host "Changing default Explorer view to `"Computer`"..."
  389. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "LaunchTo" -Type DWord -Value 1
  390. Write-Progress -Activity "Setting some UI tweaks..." -Status "Progress:" -PercentComplete 75
  391. # Change default Explorer view to "Quick Access"
  392. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "LaunchTo"
  393.  
  394. # Show Computer shortcut on desktop
  395. Write-Host "Showing Computer shortcut on desktop..."
  396. If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu")) {
  397.   New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" | Out-Null
  398. }
  399. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" -Type DWord -Value 0
  400. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" -Type DWord -Value 0
  401. Write-Progress -Activity "Setting some UI tweaks..." -Status "Progress:" -PercentComplete 100
  402. # Hide Computer shortcut from desktop
  403. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"
  404. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"
  405.  
  406. # Remove Desktop icon from computer namespace
  407. # Write-Host "Removing Desktop icon from computer namespace..."
  408. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}" -Recurse -ErrorAction SilentlyContinue
  409.  
  410. # Add Desktop icon to computer namespace
  411. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"
  412.  
  413. # Remove Documents icon from computer namespace
  414. # Write-Host "Removing Documents icon from computer namespace..."
  415. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{d3162b92-9365-467a-956b-92703aca08af}" -Recurse -ErrorAction SilentlyContinue
  416. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}" -Recurse -ErrorAction SilentlyContinue
  417.  
  418. # Add Documents icon to computer namespace
  419. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{d3162b92-9365-467a-956b-92703aca08af}"
  420. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}"
  421.  
  422. # Remove Downloads icon from computer namespace
  423. # Write-Host "Removing Downloads icon from computer namespace..."
  424. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{088e3905-0323-4b02-9826-5d99428e115f}" -Recurse -ErrorAction SilentlyContinue
  425. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{374DE290-123F-4565-9164-39C4925E467B}" -Recurse -ErrorAction SilentlyContinue
  426.  
  427. # Add Downloads icon to computer namespace
  428. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{088e3905-0323-4b02-9826-5d99428e115f}"
  429. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{374DE290-123F-4565-9164-39C4925E467B}"
  430.  
  431. # Remove Music icon from computer namespace
  432. # Write-Host "Removing Music icon from computer namespace..."
  433. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}" -Recurse -ErrorAction SilentlyContinue
  434. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}" -Recurse -ErrorAction SilentlyContinue
  435.  
  436. # Add Music icon to computer namespace
  437. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}"
  438. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}"
  439.  
  440. # Remove Pictures icon from computer namespace
  441. # Write-Host "Removing Pictures icon from computer namespace..."
  442. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}" -Recurse -ErrorAction SilentlyContinue
  443. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}" -Recurse -ErrorAction SilentlyContinue
  444.  
  445. # Add Pictures icon to computer namespace
  446. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}"
  447. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}"
  448.  
  449. # Remove Videos icon from computer namespace
  450. # Write-Host "Removing Videos icon from computer namespace..."
  451. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}" -Recurse -ErrorAction SilentlyContinue
  452. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A0953C92-50DC-43bf-BE83-3742FED03C9C}" -Recurse -ErrorAction SilentlyContinue
  453.  
  454. # Add Videos icon to computer namespace
  455. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}"
  456. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A0953C92-50DC-43bf-BE83-3742FED03C9C}"
  457.  
  458. ## Add secondary en-US keyboard
  459. #Write-Host "Adding secondary en-US keyboard..."
  460. #$langs = Get-WinUserLanguageList
  461. #$langs.Add("en-US")
  462. #Set-WinUserLanguageList $langs -Force
  463.  
  464. # Remove secondary en-US keyboard
  465. Set-WinUserLanguageList En-US -Force
  466.  
  467.  
  468.  
  469. ##########
  470. # Remove unwanted applications
  471. ##########
  472. Write-Progress -Activity "Removing Unwanted Apps" -Status "Progress:" -PercentComplete 1
  473. # Disable OneDrive
  474. Write-Host "Disabling OneDrive..."
  475. If (!(Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive")) {
  476.     New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" | Out-Null
  477. }
  478. Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" -Name "DisableFileSyncNGSC" -Type DWord -Value 1
  479.  
  480. # Enable OneDrive
  481. # Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" -Name "DisableFileSyncNGSC"
  482.  
  483. # Uninstall OneDrive
  484. Write-Host "Uninstalling OneDrive... May sometimes hang"
  485. Stop-Process -Name OneDrive -ErrorAction SilentlyContinue
  486. Start-Sleep -s 3
  487. $onedrive = "$env:SYSTEMROOT\SysWOW64\OneDriveSetup.exe"
  488. If (!(Test-Path $onedrive)) {
  489.     $onedrive = "$env:SYSTEMROOT\System32\OneDriveSetup.exe"
  490. }
  491. Start-Process $onedrive "/uninstall" -NoNewWindow -Wait
  492. Start-Sleep -s 3
  493. Stop-Process -Name explorer -ErrorAction SilentlyContinue
  494. Start-Sleep -s 3
  495. Remove-Item "$env:USERPROFILE\OneDrive" -Force -Recurse -ErrorAction SilentlyContinue
  496. Remove-Item "$env:LOCALAPPDATA\Microsoft\OneDrive" -Force -Recurse -ErrorAction SilentlyContinue
  497. Remove-Item "$env:PROGRAMDATA\Microsoft OneDrive" -Force -Recurse -ErrorAction SilentlyContinue
  498. If (Test-Path "$env:SYSTEMDRIVE\OneDriveTemp") {
  499.     Remove-Item "$env:SYSTEMDRIVE\OneDriveTemp" -Force -Recurse -ErrorAction SilentlyContinue
  500. }
  501. If (!(Test-Path "HKCR:")) {
  502.     New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
  503. }
  504. Remove-Item -Path "HKCR:\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" -Recurse -ErrorAction SilentlyContinue
  505. Remove-Item -Path "HKCR:\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" -Recurse -ErrorAction SilentlyContinue
  506.  
  507. # Install OneDrive
  508. # $onedrive = "$env:SYSTEMROOT\SysWOW64\OneDriveSetup.exe"
  509. # If (!(Test-Path $onedrive)) {
  510. #   $onedrive = "$env:SYSTEMROOT\System32\OneDriveSetup.exe"
  511. # }
  512. # Start-Process $onedrive -NoNewWindow
  513.  
  514. # Uninstall default bloatware... Needs to be checked
  515. Write-Host "Uninstalling default bloatware..."
  516. Get-AppxPackage "Microsoft.3DBuilder" | Remove-AppxPackage
  517. Get-AppxPackage "Microsoft.Advertising.Xaml" | Remove-AppxPackage
  518. # Get-AppxPackage "Microsoft.Windows.Cortana" | Remove-AppxPackage (Remove through features)
  519. # Get-AppxPackage "Microsoft.MicrosoftEdge" | Remove-AppxPackage (Remove through features)
  520. Get-AppxPackage "Microsoft.Services.Store.Engagement" | Remove-AppxPackage
  521. Get-AppxPackage "51518DarkProjekt.DarkNote" | Remove-AppxPackage
  522. Get-AppxPackage "AFF540DC.CurrencyConverter" | Remove-AppxPackage
  523. # Get-AppxPackage "Microsoft.XboxIdentityProvider" | Remove-AppxPackag (Cant be removed for some reason now?)
  524. Get-AppxPackage "Microsoft.StorePurchaseApp" | Remove-AppxPackage
  525. Write-Progress -Activity "Removing Unwanted Apps" -Status "Progress:" -PercentComplete 30
  526. Get-AppxPackage "Microsoft.WindowsStore" | Remove-AppxPackage
  527. # Get-AppxPackage "Windows.MiracastView" | Remove-AppxPackage (Remove through features)
  528. # Get-AppxPackage "Windows.ContactSupport" | Remove-AppxPackage (Remove through features)
  529. # Get-AppxPackage "Microsoft.XboxGameCallableUI" | Remove-AppxPackage (Remove through features)
  530. # Get-AppxPackage "Microsoft.Windows.SecondaryTileExperience" | Remove-AppxPackage
  531. # Get-AppxPackage "Microsoft.Windows.ParentalControls" | Remove-AppxPackage (Remove through features)
  532. Get-AppxPackage "Microsoft.BingFinance" | Remove-AppxPackage
  533. # Get-AppxPackage "Microsoft.BingNews" | Remove-AppxPackage
  534. Get-AppxPackage "Microsoft.BingSports" | Remove-AppxPackage
  535. Write-Progress -Activity "Removing Unwanted Apps" -Status "Progress:" -PercentComplete 45
  536. Get-AppxPackage "Microsoft.BingWeather" | Remove-AppxPackage
  537. Get-AppxPackage "Microsoft.Getstarted" | Remove-AppxPackage
  538. Get-AppxPackage "Microsoft.MicrosoftOfficeHub" | Remove-AppxPackage
  539. Get-AppxPackage "Microsoft.MicrosoftSolitaireCollection" | Remove-AppxPackage
  540. Get-AppxPackage "Microsoft.Office.OneNote" | Remove-AppxPackage
  541. Get-AppxPackage "Microsoft.People" | Remove-AppxPackage
  542. Get-AppxPackage "Microsoft.SkypeApp" | Remove-AppxPackage
  543. # Get-AppxPackage "Microsoft.Windows.Photos" | Remove-AppxPackage
  544. Get-AppxPackage "Microsoft.WindowsAlarms" | Remove-AppxPackage
  545. Write-Progress -Activity "Removing Unwanted Apps" -Status "Progress:" -PercentComplete 60
  546. Get-AppxPackage "Microsoft.WindowsCamera" | Remove-AppxPackage
  547. # Get-AppxPackage "microsoft.windowscommunicationsapps" | Remove-AppxPackage (This is windows Mail)
  548. Get-AppxPackage "Microsoft.WindowsMaps" | Remove-AppxPackage
  549. Get-AppxPackage "Microsoft.WindowsPhone" | Remove-AppxPackage
  550. Get-AppxPackage "Microsoft.WindowsSoundRecorder" | Remove-AppxPackage
  551. Get-AppxPackage "Microsoft.XboxApp" | Remove-AppxPackage
  552. Get-AppxPackage "Microsoft.ZuneMusic" | Remove-AppxPackage
  553. Get-AppxPackage "Microsoft.ZuneVideo" | Remove-AppxPackage
  554. Get-AppxPackage "Microsoft.AppConnector" | Remove-AppxPackage
  555. Get-AppxPackage "Microsoft.ConnectivityStore" | Remove-AppxPackage
  556. Get-AppxPackage "Microsoft.Office.Sway" | Remove-AppxPackage
  557. Get-AppxPackage "Microsoft.Messaging" | Remove-AppxPackage
  558. Get-AppxPackage "Microsoft.CommsPhone" | Remove-AppxPackage
  559. Get-AppxPackage "9E2F88E3.Twitter" | Remove-AppxPackage
  560. Get-AppxPackage "king.com.CandyCrushSodaSaga" | Remove-AppxPackage
  561. Write-Progress -Activity "Removing Unwanted Apps" -Status "Progress:" -PercentComplete 75
  562. Get-AppxPackage "4DF9E0F8.Netflix" | Remove-AppxPackage
  563. Get-AppxPackage "Drawboard.DrawboardPDF" | Remove-AppxPackage
  564. # Get-AppxPackage "Microsoft.MicrosoftStickyNotes" | Remove-AppxPackage
  565. Get-AppxPackage "Microsoft.OneConnect" | Remove-AppxPackage
  566. Get-AppxPackage "D52A8D61.FarmVille2CountryEscape" | Remove-AppxPackage
  567. Get-AppxPackage "GAMELOFTSA.Asphalt8Airborne" | Remove-AppxPackage
  568. Get-AppxPackage "Microsoft.WindowsFeedbackHub" | Remove-AppxPackage
  569. Write-Progress -Activity "Removing Unwanted Apps" -Status "Progress:" -PercentComplete 100
  570.  
  571. Write-Progress -Activity "Installing Wanted Apps" -Status "Progress:" -PercentComplete 1
  572. # Install default Microsoft applications..
  573. Write-Host "Needs to be checked... Installing packages"
  574. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.3DBuilder").InstallLocation)\AppXManifest.xml"
  575. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.BingFinance").InstallLocation)\AppXManifest.xml"
  576. Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.BingNews").InstallLocation)\AppXManifest.xml"
  577. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.BingSports").InstallLocation)\AppXManifest.xml"
  578. Write-Progress -Activity "Installing Wanted Apps" -Status "Progress:" -PercentComplete 15
  579. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.BingWeather").InstallLocation)\AppXManifest.xml"
  580. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Getstarted").InstallLocation)\AppXManifest.xml"
  581. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.MicrosoftOfficeHub").InstallLocation)\AppXManifest.xml"
  582. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.MicrosoftSolitaireCollection").InstallLocation)\AppXManifest.xml"
  583. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Office.OneNote").InstallLocation)\AppXManifest.xml"
  584. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.People").InstallLocation)\AppXManifest.xml"
  585. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.SkypeApp").InstallLocation)\AppXManifest.xml"
  586. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Windows.Photos").InstallLocation)\AppXManifest.xml"
  587. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsAlarms").InstallLocation)\AppXManifest.xml"
  588. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsCamera").InstallLocation)\AppXManifest.xml"
  589. Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.windowscommunicationsapps").InstallLocation)\AppXManifest.xml"
  590. Write-Progress -Activity "Installing Wanted Apps" -Status "Progress:" -PercentComplete 30
  591. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsMaps").InstallLocation)\AppXManifest.xml"
  592. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsPhone").InstallLocation)\AppXManifest.xml"
  593. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsSoundRecorder").InstallLocation)\AppXManifest.xml"
  594. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.XboxApp").InstallLocation)\AppXManifest.xml"
  595. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.ZuneMusic").InstallLocation)\AppXManifest.xml"
  596. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.ZuneVideo").InstallLocation)\AppXManifest.xml"
  597. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.AppConnector").InstallLocation)\AppXManifest.xml"
  598. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.ConnectivityStore").InstallLocation)\AppXManifest.xml"
  599. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Office.Sway").InstallLocation)\AppXManifest.xml"
  600. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Messaging").InstallLocation)\AppXManifest.xml"
  601. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.CommsPhone").InstallLocation)\AppXManifest.xml"
  602. Write-Progress -Activity "Installing Wanted Apps" -Status "Progress:" -PercentComplete 45
  603. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "9E2F88E3.Twitter").InstallLocation)\AppXManifest.xml"
  604. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "king.com.CandyCrushSodaSaga").InstallLocation)\AppXManifest.xml"
  605. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "4DF9E0F8.Netflix").InstallLocation)\AppXManifest.xml"
  606. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Drawboard.DrawboardPDF").InstallLocation)\AppXManifest.xml"
  607. Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.MicrosoftStickyNotes").InstallLocation)\AppXManifest.xml"
  608. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.OneConnect").InstallLocation)\AppXManifest.xml"
  609. Write-Progress -Activity "Installing Wanted Apps" -Status "Progress:" -PercentComplete 60
  610. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "D52A8D61.FarmVille2CountryEscape").InstallLocation)\AppXManifest.xml"
  611. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "GAMELOFTSA.Asphalt8Airborne").InstallLocation)\AppXManifest.xml"
  612. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsFeedbackHub").InstallLocation)\AppXManifest.xml"
  613. # In case you have removed them for good, you can try to restore the files using installation medium as follows
  614. # New-Item C:\Mnt -Type Directory | Out-Null
  615. # dism /Mount-Image /ImageFile:D:\sources\install.wim /index:1 /ReadOnly /MountDir:C:\Mnt
  616. # robocopy /S /SEC /R:0 "C:\Mnt\Program Files\WindowsApps" "C:\Program Files\WindowsApps"
  617. # dism /Unmount-Image /Discard /MountDir:C:\Mnt
  618. # Remove-Item -Path C:\Mnt -Recurse
  619. Write-Progress -Activity "Installing Wanted Apps" -Status "Progress:" -PercentComplete 75
  620. # Disable Xbox DVR
  621. # New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" | Out-Null (fix this)
  622. Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Name "AllowGameDVR" -Type DWord -Value 0
  623.  
  624. # Enable Xbox DVR
  625. # New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" | Out-Null
  626. # Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Name "AllowGameDVR" -ErrorAction SilentlyContinue
  627.  
  628. # Uninstall Windows Media Player
  629. # Write-Host "Uninstalling Windows Media Player..."
  630. # dism /online /Disable-Feature /FeatureName:MediaPlayback /Quiet /NoRestart
  631.  
  632. # Install Windows Media Player
  633. # dism /online /Enable-Feature /FeatureName:MediaPlayback /Quiet /NoRestart
  634.  
  635. # Uninstall Work Folders Client
  636. Write-Host "Uninstalling Work Folders Client..."
  637. dism /online /Disable-Feature /FeatureName:WorkFolders-Client /Quiet /NoRestart
  638.  
  639. # Install Work Folders Client
  640. # dism /online /Enable-Feature /FeatureName:WorkFolders-Client /Quiet /NoRestart
  641. Write-Progress -Activity "Installing Wanted Apps" -Status "Progress:" -PercentComplete 100
  642.  
  643. # Set Photo Viewer as default for bmp, gif, jpg and png
  644. Write-Host "Setting Photo Viewer as default for bmp, gif, jpg, png and tif..."
  645. If (!(Test-Path "HKCR:")) {
  646.     New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
  647. }
  648. ForEach ($type in @("Paint.Picture", "giffile", "jpegfile", "pngfile")) {
  649.     New-Item -Path $("HKCR:\$type\shell\open") -Force | Out-Null
  650.     New-Item -Path $("HKCR:\$type\shell\open\command") | Out-Null
  651.     Set-ItemProperty -Path $("HKCR:\$type\shell\open") -Name "MuiVerb" -Type ExpandString -Value "@%ProgramFiles%\Windows Photo Viewer\photoviewer.dll,-3043"
  652.     Set-ItemProperty -Path $("HKCR:\$type\shell\open\command") -Name "(Default)" -Type ExpandString -Value "%SystemRoot%\System32\rundll32.exe `"%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll`", ImageView_Fullscreen %1"
  653. }
  654.  
  655. # Remove or reset default open action for bmp, gif, jpg and png
  656. If (!(Test-Path "HKCR:")) {
  657.   New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
  658. }
  659. Remove-Item -Path "HKCR:\Paint.Picture\shell\open" -Recurse
  660. Remove-ItemProperty -Path "HKCR:\giffile\shell\open" -Name "MuiVerb"
  661. Set-ItemProperty -Path "HKCR:\giffile\shell\open" -Name "CommandId" -Type String -Value "IE.File"
  662. Set-ItemProperty -Path "HKCR:\giffile\shell\open\command" -Name "(Default)" -Type String -Value "`"$env:SystemDrive\Program Files\Internet Explorer\iexplore.exe`" %1"
  663. Set-ItemProperty -Path "HKCR:\giffile\shell\open\command" -Name "DelegateExecute" -Type String -Value "{17FE9752-0B5A-4665-84CD-569794602F5C}"
  664. Remove-Item -Path "HKCR:\jpegfile\shell\open" -Recurse
  665. Remove-Item -Path "HKCR:\pngfile\shell\open" -Recurse
  666.  
  667. # Show Photo Viewer in "Open with..."
  668. Write-Host "Showing Photo Viewer in `"Open with...`""
  669. If (!(Test-Path "HKCR:")) {
  670.     New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
  671. }
  672. New-Item -Path "HKCR:\Applications\photoviewer.dll\shell\open\command" -Force | Out-Null
  673. New-Item -Path "HKCR:\Applications\photoviewer.dll\shell\open\DropTarget" -Force | Out-Null
  674. Set-ItemProperty -Path "HKCR:\Applications\photoviewer.dll\shell\open" -Name "MuiVerb" -Type String -Value "@photoviewer.dll,-3043"
  675. Set-ItemProperty -Path "HKCR:\Applications\photoviewer.dll\shell\open\command" -Name "(Default)" -Type ExpandString -Value "%SystemRoot%\System32\rundll32.exe `"%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll`", ImageView_Fullscreen %1"
  676. Set-ItemProperty -Path "HKCR:\Applications\photoviewer.dll\shell\open\DropTarget" -Name "Clsid" -Type String -Value "{FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}"
  677.  
  678. # Remove Photo Viewer from "Open with..."
  679. # If (!(Test-Path "HKCR:")) {
  680. #   New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
  681. # }
  682. # Remove-Item -Path "HKCR:\Applications\photoviewer.dll\shell\open" -Recurse
  683.  
  684. # Enable F8 boot menu options
  685. # Write-Host "Enabling F8 boot menu options..."
  686. # bcdedit /set `{current`} bootmenupolicy Legacy | Out-Null
  687.  
  688. # Disable F8 boot menu options
  689. # bcdedit /set `{current`} bootmenupolicy Standard | Out-Null
  690.  
  691. # Install Powershell man pages locally (low priority, uses bandwidth)
  692. # Update-Help
  693.  
  694. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 1
  695. # Install Packages to edit Hosts file.
  696. Write-Host "Installing PsHosts CMDlet to edit hosts file. Please be Patient. This may be slow sometimes buggy"
  697. install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
  698. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 10
  699. Write-Host "Seting up Repository"
  700. Set-PSRepository -Name "PSGallery" -InstallationPolicy Trusted
  701. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 20
  702. Write-Host "Installing PSHosts Module"
  703. install-module PsHosts
  704. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 30
  705. Write-Host "Importing PSHosts Module"
  706. import-module PsHosts
  707. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 40
  708. # Hosts to block are below
  709. Write-Host "Editing Hosts File..."
  710. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 50
  711. # Clean old Hosts file
  712. Remove-HostEntry *
  713.  
  714. # Add Hosts Entries
  715. Add-HostEntry vortex.data.microsoft.com 127.0.0.1
  716. Add-HostEntry vortex-win.data.microsoft.com 127.0.0.1
  717. Add-HostEntry telecommand.telemetry.microsoft.com 127.0.0.1
  718. Add-HostEntry telecommand.telemetry.microsoft.com.nsatc.net 127.0.0.1
  719. Add-HostEntry oca.telemetry.microsoft.com 127.0.0.1
  720. Add-HostEntry oca.telemetry.microsoft.com.nsatc.net 127.0.0.1
  721. Add-HostEntry sqm.telemetry.microsoft.com 127.0.0.1
  722. Add-HostEntry sqm.telemetry.microsoft.com.nsatc.net 127.0.0.1
  723. Add-HostEntry watson.telemetry.microsoft.com 127.0.0.1
  724. Add-HostEntry watson.telemetry.microsoft.com.nsatc.net 127.0.0.1
  725. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 60
  726. Add-HostEntry redir.metaservices.microsoft.com 127.0.0.1
  727. Add-HostEntry choice.microsoft.com 127.0.0.1
  728. Add-HostEntry choice.microsoft.com.nsatc.net 127.0.0.1
  729. Add-HostEntry df.telemetry.microsoft.com 127.0.0.1
  730. Add-HostEntry reports.wes.df.telemetry.microsoft.com 127.0.0.1
  731. Add-HostEntry wes.df.telemetry.microsoft.com 127.0.0.1
  732. Add-HostEntry services.wes.df.telemetry.microsoft.com 127.0.0.1
  733. Add-HostEntry sqm.df.telemetry.microsoft.com 127.0.0.1
  734. Add-HostEntry telemetry.microsoft.com 127.0.0.1
  735. Add-HostEntry watson.ppe.telemetry.microsoft.com 127.0.0.1
  736. Add-HostEntry telemetry.appex.bing.net 127.0.0.1
  737. Add-HostEntry telemetry.urs.microsoft.com 127.0.0.1
  738. Add-HostEntry telemetry.appex.bing.net:443 127.0.0.1
  739. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 70
  740. Add-HostEntry settings-sandbox.data.microsoft.com 127.0.0.1
  741. Add-HostEntry vortex-sandbox.data.microsoft.com 127.0.0.1
  742. Add-HostEntry survey.watson.microsoft.com 127.0.0.1
  743. Add-HostEntry watson.live.com 127.0.0.1
  744. Add-HostEntry watson.microsoft.com 127.0.0.1
  745. Add-HostEntry statsfe2.ws.microsoft.com 127.0.0.1
  746. Add-HostEntry corpext.msitadfs.glbdns2.microsoft.com 127.0.0.1
  747. Add-HostEntry compatexchange.buttapp.net 127.0.0.1
  748. Add-HostEntry cs1.wpc.v0cdn.net 127.0.0.1
  749. Add-HostEntry a-0001.a-msedge.net 127.0.0.1
  750. Add-HostEntry statsfe2.update.microsoft.com.akadns.net 127.0.0.1
  751. Add-HostEntry sls.update.microsoft.com.akadns.net 127.0.0.1
  752. Add-HostEntry fe2.update.microsoft.com.akadns.net 127.0.0.1
  753. Add-HostEntry diagnostics.support.microsoft.com 127.0.0.1
  754. Add-HostEntry corp.sts.microsoft.com 127.0.0.1
  755. Add-HostEntry statsfe1.ws.microsoft.com 127.0.0.1
  756. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 75
  757. Add-HostEntry pre.footprintpredict.com 127.0.0.1
  758. Add-HostEntry i1.services.social.microsoft.com 127.0.0.1
  759. Add-HostEntry i1.services.social.microsoft.com.nsatc.net 127.0.0.1
  760. Add-HostEntry feedback.windows.com 127.0.0.1
  761. Add-HostEntry feedback.microsoft-hohm.com 127.0.0.1
  762. Add-HostEntry feedback.search.microsoft.com 127.0.0.1
  763. Add-HostEntry ad.doubleclick.net 127.0.0.1
  764. Add-HostEntry ads.msn.com 127.0.0.1
  765. Add-HostEntry ads1.msads.net 127.0.0.1
  766. Add-HostEntry ads1.msn.com 127.0.0.1
  767. Add-HostEntry a.ads1.msn.com 127.0.0.1
  768. Add-HostEntry a.ads2.msn.com 127.0.0.1
  769. Add-HostEntry adnexus.net 127.0.0.1
  770. Add-HostEntry adnxs.com 127.0.0.1
  771. Add-HostEntry aidps.atdmt.com 127.0.0.1
  772. Add-HostEntry apps.skype.com 127.0.0.1
  773. Add-HostEntry az361816.vo.msecnd.net 127.0.0.1
  774. Add-HostEntry az512334.vo.msecnd.net 127.0.0.1
  775. Add-HostEntry a.rad.msn.com 127.0.0.1
  776. Add-HostEntry a.ads2.msads.net 127.0.0.1
  777. Add-HostEntry ac3.msn.com 127.0.0.1
  778. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 80
  779. Add-HostEntry aka-cdn-ns.adtech.de 127.0.0.1
  780. Add-HostEntry b.rad.msn.com 127.0.0.1
  781. Add-HostEntry b.ads2.msads.net 127.0.0.1
  782. Add-HostEntry b.ads1.msn.com 127.0.0.1
  783. Add-HostEntry bs.serving-sys.com 127.0.0.1
  784. Add-HostEntry c.msn.com 127.0.0.1
  785. Add-HostEntry cdn.atdmt.com 127.0.0.1
  786. Add-HostEntry cds26.ams9.msecn.net 127.0.0.1
  787. Add-HostEntry c.atdmt.com 127.0.0.1
  788. Add-HostEntry db3aqu.atdmt.com 127.0.0.1
  789. Add-HostEntry ec.atdmt.com 127.0.0.1
  790. Add-HostEntry flex.msn.com 127.0.0.1
  791. Add-HostEntry g.msn.com 127.0.0.1
  792. Add-HostEntry h2.msn.com 127.0.0.1
  793. Add-HostEntry h1.msn.com 127.0.0.1
  794. Add-HostEntry live.rads.msn.com 127.0.0.1
  795. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 85
  796. Add-HostEntry msntest.serving-sys.com 127.0.0.1
  797. Add-HostEntry m.adnxs.com 127.0.0.1
  798. Add-HostEntry m.hotmail.com 127.0.0.1
  799. Add-HostEntry preview.msn.com 127.0.0.1
  800. Add-HostEntry pricelist.skype.com 127.0.0.1
  801. Add-HostEntry rad.msn.com 127.0.0.1
  802. Add-HostEntry rad.live.com 127.0.0.1
  803. Add-HostEntry secure.flashtalking.com 127.0.0.1
  804. Add-HostEntry static.2mdn.net 127.0.0.1
  805. Add-HostEntry s.gateway.messenger.live.com 127.0.0.1
  806. Add-HostEntry secure.adnxs.com 127.0.0.1
  807. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 90
  808. Add-HostEntry sO.2mdn.net 127.0.0.1
  809. Add-HostEntry ui.skype.com 127.0.0.1
  810. Add-HostEntry view.atdmt.com 127.0.0.1
  811. # The Below two domains may impact your network connectivity detection.
  812. Add-HostEntry www.msftncsi.com 127.0.0.1
  813. Add-HostEntry msftncsi.com 127.0.0.1
  814.  
  815. Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 100
  816.  
  817. # Edit Group Policy to set Chrome settings that cannot be set through registry.
  818. # Refer to https://www.powershellgallery.com/packages/PolicyFileEditor/2.0.2
  819. Write-Host "Installing PolicyFileEditor Module"
  820. Install-Module -Name PolicyFileEditor
  821.  
  822. Write-Host "Importing PolicyFileEditor Module"
  823. import-module -Name PolicyFileEditor
  824.  
  825. If (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")) {
  826.     Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs
  827.     Exit
  828. }
  829.  
  830. Write-Host "Setting Chrome Settings..."
  831.  
  832. $MachineDir = "$env:systemroot\system32\GroupPolicy\Machine\registry.pol"
  833. $RegPath = 'Software\Policies\Google\Chrome'
  834. $RegName = 'AutoFillEnabled'
  835. $RegData = '0'
  836. $RegType = 'DWord'
  837. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  838.  
  839. $RegPath = 'Software\Policies\Google\Chrome'
  840. $RegName = 'HomepageLocation'
  841. $RegData = 'https://www.google.com'
  842. $RegType = 'String'
  843. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  844.  
  845. $RegPath = 'Software\Policies\Google\Chrome'
  846. $RegName = 'ProxyServerMode'
  847. $RegData = '0'
  848. $RegType = 'DWord'
  849. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  850.  
  851. $RegPath = 'Software\Policies\Google\Chrome'
  852. $RegName = 'SafeBrowsingEnabled'
  853. $RegData = '1'
  854. $RegType = 'DWord'
  855. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  856.  
  857. $RegPath = 'Software\Policies\Google\Chrome'
  858. $RegName = 'SavingBrowserHistoryDisabled'
  859. $RegData = '0'
  860. $RegType = 'DWord'
  861. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  862.  
  863. $RegPath = 'Software\Policies\Google\Chrome'
  864. $RegName = 'SearchSuggestEnabled'
  865. $RegData = '0'
  866. $RegType = 'DWord'
  867. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  868.  
  869. $RegPath = 'Software\Policies\Google\Chrome'
  870. $RegName = 'SyncDisabled'
  871. $RegData = '1'
  872. $RegType = 'DWord'
  873. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  874.  
  875. $RegPath = 'Software\Policies\Google\Chrome'
  876. $RegName = 'MetricsReportingEnabled'
  877. $RegData = '0'
  878. $RegType = 'DWord'
  879. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  880.  
  881. # Use * to disable all plugins in place of DISABLEDPLUGINID
  882. # To add more than one disabled plugin, copy the 5 lines below and mark the regname as 2..3..4..5 and so on after re-pasting.
  883. $RegPath = 'Software\Policies\Google\Chrome\DisabledPlugins'
  884. $RegName = '1'
  885. $RegData = 'DISABLEDPLUGINID'
  886. $RegType = 'String'
  887. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  888.  
  889. # Use * to disable all extensions in place of DISABLEDEXTENSIONID
  890. # To add more than one disabled extension, copy the 5 lines below and mark the regname as 2..3..4..5 and so on after re-pasting.
  891. $RegPath = 'Software\Policies\Google\Chrome\ExtensionInstallBlacklist'
  892. $RegName = '1'
  893. $RegData = 'DISABLEDEXTENSIONID'
  894. $RegType = 'String'
  895. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  896.  
  897. # Use * to ENABLE all extensions in place of ENABLEDEXTENSIONID
  898. # To add more than one enabled extension, copy the 5 lines below and mark the regname as 2..3..4..5 and so on after re-pasting.
  899. $RegPath = 'Software\Policies\Google\Chrome\ExtensionInstallWhitelist'
  900. $RegName = '1'
  901. $RegData = 'ENABLEDEXTENSIONID'
  902. $RegType = 'String'
  903. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  904.  
  905. # Use the below to blacklist URLs in chrome. You could probably use * to blacklist everything.
  906. # To add more than one URL, copy the 5 lines below and append regname with the next number in the list.. 2..3..4..5 and so on.
  907. $RegPath = 'Software\Policies\Google\Chrome\URLBlacklist'
  908. $RegName = '1'
  909. $RegData = 'www.tacos.com'
  910. $RegType = 'String'
  911. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  912.  
  913. # Use the below to whitelist URLs in chrome.
  914. # To add more than one URL, copy the 5 lines below and append regname with the next number in the list.. 2..3..4..5 and so on.
  915. $RegPath = 'Software\Policies\Google\Chrome\URLWhitelist'
  916. $RegName = '1'
  917. $RegData = '*'
  918. $RegType = 'String'
  919. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  920.  
  921. # Use the below to make a list of forced installed extensions, This will also delete any values to remove any rogue extensions as a security feature if they are within the
  922. # list of 1-10 in the policy.
  923. # To add more than one force installed extension, copy the 5 lines below and mark the regname as 2..3..4..5 and so on after re-pasting.
  924. $RegPath = 'Software\Policies\Google\Chrome\ExtensionInstallForcelist'
  925. $RegName = '1'
  926. $RegData = 'EXTENSIONID'
  927. $RegType = 'String'
  928. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 1
  929. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 2
  930. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 3
  931. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 4
  932. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 5
  933. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 6
  934. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 7
  935. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 8
  936. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 9
  937. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 10
  938. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  939.  
  940. $RegPath = 'Software\Policies\Google\Chrome'
  941. $RegName = 'AllowOutdatedPlugins'
  942. $RegData = '0'
  943. $RegType = 'DWord'
  944. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  945.  
  946. $RegPath = 'Software\Policies\Google\Chrome'
  947. $RegName = 'BackgroundModeEnabled'
  948. $RegData = '0'
  949. $RegType = 'DWord'
  950. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  951.  
  952. $RegPath = 'Software\Policies\Google\Chrome'
  953. $RegName = 'BookmarkBarEnabled'
  954. $RegData = '1'
  955. $RegType = 'DWord'
  956. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  957.  
  958. $RegPath = 'Software\Policies\Google\Chrome'
  959. $RegName = 'DefaultBrowserSettingEnabled'
  960. $RegData = '1'
  961. $RegType = 'DWord'
  962. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  963.  
  964. $RegPath = 'Software\Policies\Google\Chrome'
  965. $RegName = 'DeveloperToolsDisabled'
  966. $RegData = '1'
  967. $RegType = 'DWord'
  968. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  969.  
  970. $RegPath = 'Software\Policies\Google\Chrome'
  971. $RegName = 'EnableMediaRouter'
  972. $RegData = '1'
  973. $RegType = 'DWord'
  974. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  975.  
  976. $RegPath = 'Software\Policies\Google\Chrome'
  977. $RegName = 'ForceGoogleSafeSearch'
  978. $RegData = '1'
  979. $RegType = 'DWord'
  980. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  981.  
  982. $RegPath = 'Software\Policies\Google\Chrome'
  983. $RegName = 'FullscreenAllowed'
  984. $RegData = '0'
  985. $RegType = 'DWord'
  986. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  987.  
  988. $RegPath = 'Software\Policies\Google\Chrome'
  989. $RegName = 'NetworkPredictionOptions'
  990. $RegData = '2'
  991. $RegType = 'DWord'
  992. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  993.  
  994. $RegPath = 'Software\Policies\Google\Chrome'
  995. $RegName = 'SafeBrowsingEnabled'
  996. $RegData = '1'
  997. $RegType = 'DWord'
  998. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  999.  
  1000. $RegPath = 'Software\Policies\Google\Chrome'
  1001. $RegName = 'SafeBrowsingExtendedReportingOptInAllowed'
  1002. $RegData = '0'
  1003. $RegType = 'DWord'
  1004. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1005.  
  1006. $RegPath = 'Software\Policies\Google\Chrome'
  1007. $RegName = 'SearchSuggestEnabled'
  1008. $RegData = '0'
  1009. $RegType = 'DWord'
  1010. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1011.  
  1012. $RegPath = 'Software\Policies\Google\Chrome'
  1013. $RegName = 'SpellCheckServiceEnabled'
  1014. $RegData = '0'
  1015. $RegType = 'DWord'
  1016. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1017.  
  1018. $RegPath = 'Software\Policies\Google\Chrome'
  1019. $RegName = 'SSLVersionMin'
  1020. $RegData = 'tls1'
  1021. $RegType = 'String'
  1022. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1023.  
  1024. $RegPath = 'Software\Policies\Google\Chrome'
  1025. $RegName = 'WelcomePageOnOSUpgradeEnabled'
  1026. $RegData = '0'
  1027. $RegType = 'DWord'
  1028. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1029.  
  1030. # End Chrome GP Settings
  1031. #
  1032. # Begin Adobe Acrobat/Reader DC Settings
  1033. $RegPath = 'Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockdown'
  1034. $RegName = 'bProtectedMode'
  1035. $RegData = '1'
  1036. $RegType = 'DWord'
  1037. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1038.  
  1039. $RegPath = 'Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockdown'
  1040. $RegName = 'bUsageMeasurement'
  1041. $RegData = '1'
  1042. $RegType = 'DWord'
  1043. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1044.  
  1045. $RegPath = 'Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockdown\cIPM'
  1046. $RegName = 'bDontShowMsgWhenViewingDoc'
  1047. $RegData = '1'
  1048. $RegType = 'DWord'
  1049. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1050.  
  1051. $RegPath = 'Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockdown\cIPM'
  1052. $RegName = 'bShowMsgAtLaunch'
  1053. $RegData = '0'
  1054. $RegType = 'DWord'
  1055. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1056.  
  1057. $RegPath = 'Software\Policies\Adobe\Adobe Acrobat\2015\FeatureLockdown'
  1058. $RegName = 'bUsageMeasurement'
  1059. $RegData = '1'
  1060. $RegType = 'DWord'
  1061. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1062.  
  1063. $RegPath = 'Software\Policies\Adobe\Adobe Acrobat\2015\FeatureLockdown'
  1064. $RegName = 'iProtectedView'
  1065. $RegData = '2'
  1066. $RegType = 'DWord'
  1067. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1068.  
  1069. $RegPath = 'Software\Policies\Adobe\Adobe Acrobat\2015\FeatureLockdown\cIPM'
  1070. $RegName = 'bShowMsgAtLaunch'
  1071. $RegData = '0'
  1072. $RegType = 'DWord'
  1073. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1074.  
  1075. # End Adobe Acrobat and Reader DC Settings
  1076. #
  1077.  
  1078. # Force DEP to always on for every application (available options are: AlwaysOff, AlwaysOn, OptIn, OptOut)
  1079. Write-Host "Turning on DEP for all applications."
  1080. bcdedit /set nx AlwaysON
  1081.  
  1082. # Enable SEHOP (Exception write-protection function of DEP.)
  1083. Write-Host "Enable Exception Write-Protection SEHOP"
  1084. reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v DisableExceptionChainValidation /t REG_DWORD /d 0 /f
  1085.  
  1086. # Check Cryptography Protection
  1087. Write-Host "Checking Cryptography Protection."
  1088.  
  1089. # If the following query shows that MasterKeyLegacyCompliance is set to a non-zero number,
  1090. # then it is bad sign that hackers or malware have set this value deliberately to weaken
  1091. # the security of DPAPI-protected secrets like cached passwords or private keys.
  1092. reg query HKLM\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb /v MasterKeyLegacyCompliance
  1093.  
  1094. # Run the following command to delete the MasterKeyLegacyCompliance value, which
  1095. # is the default on Windows XP and later, and is best for security.
  1096. reg delete HKLM\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb /v MasterKeyLegacyCompliance /f
  1097.  
  1098. # Disable NetBios (Forces File Sharing over port 445 DirectSMB/stops various worms.)
  1099. Write-Host "Disabling Outdated NetBIOS Protocol..."
  1100. sc.exe config netbt start= disabled
  1101.  
  1102. # Reset NerBios Configuration to Default.
  1103. # sc.exe config netbt start= system
  1104.  
  1105. # Set LAN connection to DHCP and renew.
  1106. # netsh.exe int ip set address "Local Area Connection" dhcp
  1107. # netsh.exe int ip set dns "Local Area Connection" dhcp
  1108. # ipconfig /renew
  1109.  
  1110. # Set LAN connection to static and release.
  1111. # ipconfig /release
  1112. # netsh.exe int ip set dns "Local Area Connection" static 10.4.1.1
  1113. # netsh.exe int ip set address "Local Area Connection" static 10.4.1.1 255.255.0.0
  1114.  
  1115. # Enable IPsec NAT
  1116. Write-Host "Enabling IPSec NAT..."
  1117. reg add "HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent" /v AssumeUDPEncapsulationContextOnSendRule /t REG_DWORD /d 00000002 /f
  1118.  
  1119. # Use these commands to audit logging policies.
  1120. # auditpol.exe /get /category:*
  1121. # auditpol.exe /get /subcategory:"MPSSVC rule-level Policy Change,Filtering Platform policy change,IPsec Main Mode,IPsec Quick Mode,IPsec Extended Mode,IPsec Driver,Other System Events,Filtering Platform Packet Drop,Filtering Platform Connection"
  1122.  
  1123. # Disable a lot of security logging (See end of command)
  1124. # auditpol.exe /set /subcategory:"MPSSVC rule-level Policy Change,Filtering Platform policy change,IPsec Main Mode,IPsec Quick Mode,IPsec Extended Mode,IPsec Driver,Other System Events,Filtering Platform Packet Drop,Filtering Platform Connection" /success:Disable /failure:Disable
  1125.  
  1126. # Enable a lot of security logging (See end of command)
  1127. auditpol.exe /set /subcategory:"MPSSVC rule-level Policy Change,Filtering Platform policy change,IPsec Main Mode,IPsec Quick Mode,IPsec Extended Mode,IPsec Driver,Other System Events,Filtering Platform Packet Drop,Filtering Platform Connection" /success:Enable /failure:Enable
  1128.  
  1129. # Enable oakley IPSec Diagnostics logging.
  1130. reg add "HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent\Oakley" /v EnableLogging /t REG_DWORD /d 00000001 /f
  1131.  
  1132. # Enable Local IPSec Connections for ports 3389,135,139,445,21,20,23
  1133. Write-Host "Enabling Local Network IPSEC on this machine if supported."
  1134. netsh.exe advfirewall consec add rule name=Testing-IPSec-NETSH endpoint1=any port1=any endpoint2=localsubnet port2=3389,135,139,445,21,20,23 protocol=tcp profile=any action=requireinrequestout interfacetype=any auth1=computerpsk auth1psk=$ThePreSharedKey enable=yes
  1135.  
  1136. # Disable Local IPSec Connections for ports 3389,135,139,445,21,20,23
  1137. # Write-Host "Disabling Local Network IPSEC on this machine if supported."
  1138. # netsh.exe advfirewall consec add rule name=Testing-IPSec-NETSH endpoint1=any port1=any endpoint2=localsubnet port2=3389,135,139,445,21,20,23 protocol=tcp profile=any action=requireinrequestout interfacetype=any auth1=computerpsk auth1psk=$ThePreSharedKey enable=no
  1139.  
  1140. Write-Progress -Activity "Configuring SSL/TLS" -Status "Progress:" -PercentComplete 1
  1141. #
  1142. #
  1143. # The Two Lines Below Enable Superfectch and Prefetch
  1144. Write-Host "Enabling Superfetch and Prefetch..."
  1145. reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnableSuperfetch /t REG_DWORD /d 00000003 /f
  1146. reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnablePrefetcher /t REG_DWORD /d 00000003 /f
  1147.  
  1148. # The Lines Below Disable SSL!!!
  1149. Write-Host "Disabling SSL..."
  1150. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client" /f
  1151. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client" /v DisabledByDefault /t REG_DWORD /d 00000001 /f
  1152. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client" /v Enabled /t REG_DWORD /d 00000000 /f
  1153. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" /f
  1154. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" /v DisabledByDefault /t REG_DWORD /d 00000001 /f
  1155. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" /v Enabled /t REG_DWORD /d 00000000 /f
  1156. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" /f
  1157. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" /v DisabledByDefault /t REG_DWORD /d 00000001 /f
  1158. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" /v Enabled /t REG_DWORD /d 00000000 /f
  1159. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" /f
  1160. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" /v DisabledByDefault /t REG_DWORD /d 00000001 /f
  1161. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" /v Enabled /t REG_DWORD /d 00000000 /f
  1162. Write-Progress -Activity "Configuring SSL/TLS" -Status "Progress:" -PercentComplete 25
  1163. # The Lines Below Force And Enable TLS!!!
  1164. Write-Host "Forcing and Enabling TLS!!!"
  1165. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /f
  1166. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  1167. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /v Enabled /t REG_DWORD /d 0xffffffff /f
  1168. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /f
  1169. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  1170. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /v Enabled /t REG_DWORD /d 0xffffffff /f
  1171. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /f
  1172. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  1173. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /v Enabled /t REG_DWORD /d 0xffffffff /f
  1174. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /f
  1175. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  1176. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /v Enabled /t REG_DWORD /d 0xffffffff /f
  1177. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /f
  1178. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  1179. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v Enabled /t REG_DWORD /d 0xffffffff /f
  1180. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /f
  1181. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  1182. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v Enabled /t REG_DWORD /d 0xffffffff /f
  1183. Write-Progress -Activity "Configuring SSL/TLS" -Status "Progress:" -PercentComplete 70
  1184. # The Registry Parameters Below are for TCP Security, I'm not sure what some of them do.
  1185. Write-Host "Upgrading TCP Security..."
  1186. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v IPEnableRouter /t REG_DWORD /d 00000000 /f
  1187. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect /t REG_DWORD /d 00000000 /f
  1188. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v SynAttackProtect /t REG_DWORD /d 00000002 /f
  1189. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxHalfOpen /t REG_DWORD /d 00000064 /f
  1190. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxHalfOpenRetried /t REG_DWORD /d 00000050 /f
  1191. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v DisableIPSourceRouting /t REG_DWORD /d 00000002 /f
  1192. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v NoNameReleaseOnDemand /t REG_DWORD /d 00000001 /f
  1193. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableDeadGWDetect /t REG_DWORD /d 00000000 /f
  1194. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v KeepAliveTime /t REG_DWORD /d 0x000493E0 /f
  1195. Write-Progress -Activity "Configuring SSL/TLS" -Status "Progress:" -PercentComplete 100
  1196. # Disable NTFS Last-Access Timestamp
  1197. # Write-Host "Disabling NTFS Last-Access Timestamps..."
  1198. # reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v NtfsDisableLastAccessUpdate /t REG_DWORD /d 00000001 /f
  1199.  
  1200. # Enable NTFS Last-Access Timestamp
  1201. Write-Host "Enabling NTFS Last-Access Timestamps..."
  1202. reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v NtfsDisableLastAccessUpdate /t REG_DWORD /d 00000000 /f
  1203.  
  1204. # Disable IPV6
  1205. Write-Host "Disabling IPV6..."
  1206. reg add "HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters" /v DisabledComponents /t REG_DWORD /d 0xffffffff /f
  1207.  
  1208. # Enable IPV6
  1209. # Write-Host "EnTabling IPV6..."
  1210. # reg add "HKLM\SYSEM\CurrentControlSet\services\TCPIP6\Parameters" /v DisabledComponents /t REG_DWORD /d 0 /f
  1211.  
  1212. # Force High Level of Remote Desktop Encryption and TLS Authentication.
  1213. Write-Host "Requiring Strong Remote Desktop Encryption if enabled... And forcing TLS Authentication"
  1214. reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MinEncryptionLevel /t REG_DWORD /d 00000003 /f
  1215. reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer /t REG_DWORD /d 00000002 /f
  1216.  
  1217. # Disabling TCP/IP AutoTuning (see http://technet.microsoft.com/en-us/magazine/2007.01.cableguy.aspx)
  1218. Write-Host "Disabling TCP/IP Auto-Tuning..."
  1219. netsh.exe interface tcp set global autotuninglevel= disabled
  1220.  
  1221. # Enabling TCP/IP AutoTuning
  1222. # netsh.exe interface tcp set global autotuninglevel= normal
  1223.  
  1224. # Reset Firewall To factory Defaults!!!
  1225. # netsh.exe firewall reset
  1226. #
  1227.  
  1228.  
  1229.  
  1230. # Begin Java Security Setting Script
  1231. #
  1232. #
  1233.  
  1234. Write-host "The next bit of code will either enable or disable java system-wide."
  1235.  
  1236. # Construct the strings for the deployment.properties file.
  1237. # Be mindful of the below property, setting webjava to false will unisntall java and you will need to manually re-enable in IE.
  1238.  
  1239. $propertiesfile = "deployment.webjava.enabled=true "
  1240.  
  1241. # Default to locking the security level and browser plug-in state, i.e., they are visible but greyed out in Java Control Panel.
  1242. $propertiesfile += "`ndeployment.webjava.enabled.locked `ndeployment.security.level.locked "
  1243.  
  1244. # Default to security level being set to VERY_HIGH (see Security tab of Java Control Panel).
  1245. $propertiesfile += "`ndeployment.security.level=VERY_HIGH"
  1246.  
  1247.  
  1248. # Possibly delete the configuration files and exit, but leave the folder alone though.
  1249. write-host "Deleting system-wide Java configuration files, if they exist..."
  1250. remove-item $env:WinDir\Sun\Java\Deployment\deployment.config -Force
  1251. remove-item $env:WinDir\Sun\Java\Deployment\deployment.properties -Force
  1252.        
  1253.  
  1254.  
  1255. # Create the $env:WinDir\Sun\Java\Deployment folder for the system-wide Java configuration files.
  1256. New-Item -Path $env:WinDir\Sun\Java\Deployment -ItemType Directory -Force | Out-Null
  1257.  
  1258. # Create the deployment.config file.
  1259. "deployment.system.config=$env:WinDir\Sun\Java\Deployment\deployment.properties" |
  1260.     Out-File -FilePath $env:WinDir\Sun\Java\Deployment\deployment.config -Force -Encoding ASCII
  1261. if (-not $? -or -not $(Test-Path $env:WinDir\Sun\Java\Deployment\deployment.config))
  1262.    { "`nCould not create the deployment.config file, exiting.`n" ; exit -1 }
  1263.  
  1264.  
  1265. # Create the deployment.properties file.
  1266. $propertiesfile | Out-File -FilePath $env:WinDir\Sun\Java\Deployment\deployment.properties -Force -Encoding ASCII
  1267. if (-not $? -or -not $(Test-Path $env:WinDir\Sun\Java\Deployment\deployment.properties))
  1268.    { "`nCould not create the deployment.properties file, exiting.`n" ; exit -1 }
  1269.  
  1270.  
  1271. # Show system-wide deployment.properties file contents FYI.
  1272. "`nCurrent contents of the deployment.properties file:`n"
  1273. get-content $env:WinDir\Sun\Java\Deployment\deployment.properties ; "`n"
  1274.  
  1275.  
  1276.  
  1277. # Run latest ssvagent.exe for both x86 and x64, but not on Java Platform 6 or earlier, and
  1278. # hope future Javas support these switches (man, what a mess, doomed to rewrites...):
  1279. if ($propertiesfile -like '*deployment.webjava.enabled=false*')
  1280. {
  1281.     # Try the x64 version, if any:
  1282.     $ssvagent = $null
  1283.     if (Test-Path -Path "$env:ProgramFiles\Java\")
  1284.     {
  1285.         $ssvagent = dir "$env:ProgramFiles\Java\*.exe" -Recurse |
  1286.                 where { $_.name -eq 'ssvagent.exe' -and $_.fullname -notmatch '\\jre[1-6]\\'} |
  1287.                 sort LastWriteTimeUtc -desc | select -first 1
  1288.     }
  1289.  
  1290.     if ($ssvagent -ne $null)
  1291.     {
  1292.         $expression = $ssvagent.FullName.Replace("Program Files","'Program Files'") + " -disablewebjava"
  1293.         "Executing: $expression `n"
  1294.         invoke-expression -command $expression
  1295.     }
  1296.  
  1297.  
  1298.     # Now for the x86 version second, because this is the Oracle-preferred:
  1299.     $ssvagent = $null
  1300.     if (Test-Path -Path "${env:ProgramFiles(x86)}\Java\")
  1301.     {
  1302.         $ssvagent = dir "${env:ProgramFiles(x86)}\Java\*.exe" -Recurse |
  1303.                 where { $_.name -eq 'ssvagent.exe' -and $_.fullname -notmatch '\\jre[1-6]\\'} |
  1304.                 sort LastWriteTimeUtc -desc | select -first 1
  1305.     }
  1306.  
  1307.     if ($ssvagent -ne $null)
  1308.     {
  1309.         $expression = $ssvagent.FullName.Replace("Program Files (x86)","'Program Files (x86)'") + " -disablewebjava"
  1310.         "Executing: $expression `n"
  1311.         invoke-expression -command $expression
  1312.     }
  1313. }
  1314. elseif ($propertiesfile -like '*deployment.webjava.enabled=true*')
  1315. {
  1316.     # Try the x64 version, if any:
  1317.     $ssvagent = $null
  1318.     $ssvagent = dir "$env:ProgramFiles\Java\*.exe" -Recurse |
  1319.                 where { $_.name -eq 'ssvagent.exe' -and $_.fullname -notmatch '\\jre[1-6]\\'} |
  1320.                 sort LastWriteTimeUtc -desc | select -first 1
  1321.     if ($ssvagent -ne $null)
  1322.     {
  1323.         $expression = $ssvagent.FullName.Replace("Program Files","'Program Files'") + " -forceinstall -register -new -high"  #Only -high exists?
  1324.         "Executing: $expression `n"
  1325.         invoke-expression -command $expression
  1326.     }
  1327.  
  1328.     # Now for the x86 version second, to let it possibly overwrite x64 settings, since x86 is Oracle-preferred:
  1329.     $ssvagent = $null
  1330.     $ssvagent = dir "${env:ProgramFiles(x86)}\Java\*.exe" -Recurse |
  1331.                 where { $_.name -eq 'ssvagent.exe' -and $_.fullname -notmatch '\\jre[1-6]\\'} |
  1332.                 sort LastWriteTimeUtc -desc | select -first 1
  1333.     if ($ssvagent -ne $null)
  1334.     {
  1335.         $expression = $ssvagent.FullName.Replace("Program Files (x86)","'Program Files (x86)'") + " -forceinstall -register -new -high"  #Only -high exists?
  1336.         "Executing: $expression `n"
  1337.         invoke-expression -command $expression
  1338.     }
  1339. }
  1340.  
  1341. # End Java Security Settings Script
  1342. #
  1343. #
  1344.  
  1345. # Disable scheduled tasks
  1346.  
  1347. Write-Progress -Activity "Disabling scheduled tasks" -Status "Progress:" -PercentComplete 0
  1348. schtasks /Change /TN "Microsoft\Windows\Application Experience\ProgramDataUpdater" /Disable | out-null
  1349. schtasks /Change /TN "Microsoft\Windows\AppID\SmartScreenSpecific" /Disable | out-null
  1350. schtasks /Change /TN "Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /Disable | out-null
  1351. schtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /Disable | out-null
  1352. schtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /Disable | out-null
  1353. schtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /Disable | out-null
  1354. schtasks /Change /TN "Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /Disable | out-null
  1355. schtasks /Change /TN "Microsoft\Windows\NetTrace\GatherNetworkInfo" /Disable | out-null
  1356. schtasks /Change /TN "Microsoft\Windows\Windows Error Reporting\QueueReporting" /Disable | out-null
  1357. Write-Progress -Activity "Disabling scheduled tasks" -Status "Progress:" -PercentComplete 100
  1358.  
  1359. Write-Progress -Activity "Disabling services" -Status "Progress:" -PercentComplete 0
  1360. cmd /c sc config DiagTrack start= disabled | out-null
  1361. cmd /c sc config dmwappushservice start= disabled | out-null
  1362. cmd /c sc config diagnosticshub.standardcollector.service start= disabled | out-null
  1363. cmd /c sc config TrkWks start= disabled | out-null
  1364. cmd /c sc config WMPNetworkSvc start= disabled | out-null # Shouldn't exist but just making sure ...
  1365. # Making sure the DiagTrack log is empty (tinfoil)
  1366. Set-Content C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl -Value "" -Force
  1367. Write-Progress -Activity "Disabling services" -Status "Progress:" -PercentComplete 100
  1368.  
  1369. # Tweak settings app
  1370. Write-Progress -Activity "Tweaking settings app" -Status "Progress:" -PercentComplete 0
  1371. # Privacy -> General -> let websites provide locally relevant content by accessing my language list
  1372. Remove-ItemProperty -Path "HKCU:SOFTWARE\Microsoft\Internet Explorer\International" -Name "AcceptLanguage" -Force
  1373. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:Control Panel\International\User Profile" -Name HttpAcceptLanguageOptOut -Value 1 | Out-Null
  1374. # Privacy -> General -> turn on smartscreen filter to check web content that windows store apps use
  1375. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost\" -Name EnableWebContentEvaluation -Value 0 -Force | Out-Null
  1376. # Privacy -> Camera -> let apps use my camera
  1377. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{E5323777-F976-4f5b-9B55-B94699C46E44}" -Name "Value" -Type String -Value "Deny" | Out-Null
  1378. # Privacy -> Microphone -> let apps use my microphone
  1379. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{2EEF81BE-33FA-4800-9670-1CD474972C3F}\" -Name "Value" -Type String -Value "Deny" | Out-Null
  1380. # Privacy -> Account info -> let apps access my name, picture and other account info
  1381. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{C1D23ACC-752B-43E5-8448-8D0E519CD6D6}\" -Name "Value" -Type String -Value "Deny" | Out-Null
  1382. # Privacy -> Calendar -> let apps access my calendar
  1383. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{D89823BA-7180-4B81-B50C-7E471E6121A3}\" -Name "Value" -Type String -Value "Deny" | Out-Null
  1384. # Privacy -> Messaging -> let apps read or send sms and text messages
  1385. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{992AFA70-6F47-4148-B3E9-3003349C1548}\" -Name "Value" -Type String -Value "Deny" | Out-Null
  1386. # Privacy -> Radio -> let apps control radios
  1387. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{A8804298-2D5F-42E3-9531-9C8C39EB29CE}\" -Name "Value" -Type String -Value "Deny" | Out-Null
  1388. # Privacy -> Other devices -> sync with devices
  1389. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\LooselyCoupled\" -Name "Value" -Type String -Value "Deny" | Out-Null
  1390. # Privacy -> Feedback & Diagnostics -> feedback frequency
  1391. New-Item -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Siuf\Rules" -Force | Out-Null
  1392. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Siuf\Rules" -Name NumberOfSIUFInPeriod -Value 0 -Force | Out-Null
  1393. Remove-ItemProperty -Path "HKCU:SOFTWARE\Microsoft\Siuf\Rules" -Name PeriodInNanoSeconds
  1394. # Ease of Access -> Other options -> Visual options -> play animations
  1395. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:Control Panel\Desktop\WindowMetrics" -Name MinAnimate -Value 0 | Out-Null
  1396. # Update & Security -> Windows Update -> Advanced -> Choose how updates are delviered -> Updates from more than one place (this is a GUI bug, registry is set properly even though it may show 'ON')
  1397. New-ItemProperty -ErrorAction SilentlyContinue -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" -Name "DownloadMode" -PropertyType DWORD -Value 0 | Out-Null
  1398. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" -Name "DODownloadMode" -Value 0 | Out-Null
  1399. Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\" -Name "SystemSettingsDownloadMode" -Value 0 | Out-Null
  1400. Write-Progress -Activity "Tweaking settings app" -Status "Progress:" -PercentComplete 100
  1401.  
  1402. #
  1403. #
  1404. # More Group Policy Tweaks
  1405.  
  1406. Write-Progress -Activity "Securing local group policy for privacy" -Status "Progress:" -PercentComplete 1
  1407. # The reason I'm waiting 1s after each edit is to let the filesystem make necessary edits in the background, without the delay this will break local policies
  1408. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\DataCollection" -ValueName AllowTelemetry -Type DWord -Data 0
  1409. Start-Sleep 1
  1410. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" -ValueName TurnOffSidebar -Type DWord -Data 1
  1411. Start-Sleep 1
  1412. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Assistance\Client\1.0" -ValueName NoActiveHelp -Type DWord -Data 1
  1413. Start-Sleep 1
  1414. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Biometrics" -ValueName Enabled -Type DWord -Data 0
  1415. Start-Sleep 1
  1416. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Conferencing" -ValueName NoRDS -Type DWord -Data 1
  1417. Start-Sleep 1
  1418. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\InputPersonalization" -ValueName AllowInputPersonalization -Type DWord -Data 0
  1419. Start-Sleep 1
  1420. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Internet Explorer\Geolocation" -ValueName PolicyDisableGeolocation -Type DWord -Data 1
  1421. Start-Sleep 1
  1422. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions" -ValueName NoUpdateCheck -Type DWord -Data 1
  1423. Start-Sleep 1
  1424. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Internet Explorer\Main" -ValueName DoNotTrack -Type DWord -Data 1
  1425. Start-Sleep 1
  1426. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Internet Explorer\Privacy" -ValueName EnableInPrivateBrowsing -Type DWord -Data 0
  1427. Start-Sleep 1
  1428. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Internet Explorer\SQM" -ValueName DisableCustomerImprovementProgram -Type DWord -Data 0
  1429. Start-Sleep 1
  1430. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Messenger\Client" -ValueName CEIP -Type DWord -Data 2
  1431. Start-Sleep 1
  1432. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Messenger\Client" -ValueName PreventAutoRun -Type DWord -Data 1
  1433. Start-Sleep 1
  1434. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main" -ValueName Cookies -Type DWord -Data 2
  1435. Start-Sleep 1
  1436. Write-Progress -Activity "Securing local group policy for privacy (this might take a minute or two)" -Status "Progress:" -PercentComplete 10
  1437. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting" -ValueName DoReport -Type DWord -Data 0
  1438. Start-Sleep 1
  1439. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting" -ValueName ForceQueueMode -Type DWord -Data 0
  1440. Start-Sleep 1
  1441. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW" -ValueName DWFileTreeRoot -Type String -Data ""
  1442. Start-Sleep 1
  1443. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW" -ValueName DWNoExternalURL -Type DWord -Data 1
  1444. Start-Sleep 1
  1445. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW" -ValueName DWNoFileCollection -Type DWord -Data 1
  1446. Start-Sleep 1
  1447. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW" -ValueName DWNoSecondLevelCollection -Type DWord -Data 1
  1448. Start-Sleep 1
  1449. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW" -ValueName DWReporteeName -Type String -Data ""
  1450. Start-Sleep 1
  1451. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\SearchCompanion" -ValueName DisableContentFileUpdates -Type DWord -Data 1
  1452. Start-Sleep 1
  1453. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\SQMClient\Windows" -ValueName CEIPEnable -Type DWord -Data 0
  1454. Start-Sleep 1
  1455. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\010103000F0000F0080000000F0000F0D0B4EB5D3C24F17D10AE531C7DCEF4A94F4A085AD0D4C88B75082573E36F857A" -ValueName Category -Type DWord -Data 1
  1456. Start-Sleep 1
  1457. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\010103000F0000F0080000000F0000F0D0B4EB5D3C24F17D10AE531C7DCEF4A94F4A085AD0D4C88B75082573E36F857A" -ValueName CategoryReadOnly -Type DWord -Data 0
  1458. Start-Sleep 1
  1459. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" -ValueName NoGenTicket -Type DWord -Data 1
  1460. Start-Sleep 1
  1461. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows NT\IIS" -ValueName PreventIISInstall -Type DWord -Data 1
  1462. Start-Sleep 1
  1463. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows NT\Printers" -ValueName PhysicalLocation -Type String -Data anonymous
  1464. Start-Sleep 1
  1465. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo" -ValueName DisabledByGroupPolicy -Type DWord -Data 1
  1466. Start-Sleep 1
  1467. Write-Progress -Activity "Securing local group policy for privacy (this might take a minute or two)" -Status "Progress:" -PercentComplete 20
  1468. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\AppCompat" -ValueName AITEnable -Type DWord -Data 0
  1469. Start-Sleep 1
  1470. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\AppCompat" -ValueName DisableInventory -Type DWord -Data 1
  1471. Start-Sleep 1
  1472. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\AppCompat" -ValueName DisableUAR -Type DWord -Data 1
  1473. Start-Sleep 1
  1474. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Device Metadata" -ValueName PreventDeviceMetadataFromNetwork -Type DWord -Data 1
  1475. Start-Sleep 1
  1476. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Settings" -ValueName DisableSendGenericDriverNotFoundToWER -Type DWord -Data 1
  1477. Start-Sleep 1
  1478. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Settings" -ValueName DisableSendRequestAdditionalSoftwareToWER -Type DWord -Data 1
  1479. Start-Sleep 1
  1480. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Explorer" -ValueName NoUseStoreOpenWith -Type DWord -Data 1
  1481. Start-Sleep 1
  1482. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\GameUX" -ValueName DownloadGameInfo -Type DWord -Data 0
  1483. Start-Sleep 1
  1484. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\GameUX" -ValueName GameUpdateOptions -Type DWord -Data 0
  1485. Start-Sleep 1
  1486. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\GameUX" -ValueName ListRecentlyPlayed -Type DWord -Data 0
  1487. Start-Sleep 1
  1488. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard" -ValueName ExitOnMSICW -Type DWord -Data 1
  1489. Start-Sleep 1
  1490. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors" -ValueName DisableLocation -Type DWord -Data 1
  1491. Start-Sleep 1
  1492. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\OneDrive" -ValueName DisableFileSyncNGSC -Type DWord -Data 1
  1493. Start-Sleep 1
  1494. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\PowerShell" -ValueName EnableScripts -Type DWord -Data 1
  1495. Start-Sleep 1
  1496. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\PowerShell" -ValueName ExecutionPolicy -Type String -Data "RemoteSigned"
  1497. Start-Sleep 1
  1498. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" -ValueName **del.EnableExperimentation -Type String -Data ""
  1499. Start-Sleep 1
  1500. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" -ValueName AllowBuildPreview -Type DWord -Data 0
  1501. Start-Sleep 1
  1502. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" -ValueName EnableConfigFlighting -Type DWord -Data 0
  1503. Start-Sleep 1
  1504. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\System" -ValueName AsyncScriptDelay -Type DWord -Data 1
  1505. Start-Sleep 1
  1506. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\System" -ValueName EnableLogonScriptDelay -Type DWord -Data 1
  1507. Start-Sleep 1
  1508. Write-Progress -Activity "Securing local group policy for privacy (this might take a minute or two)" -Status "Progress:" -PercentComplete 50
  1509. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{186f47ef-626c-4670-800a-4a30756babad}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0
  1510. Start-Sleep 1
  1511. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{2698178D-FDAD-40AE-9D3C-1371703ADC5B}" -ValueName **del.EnabledScenarioExecutionLevel -Type String -Data ""
  1512. Start-Sleep 1
  1513. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{2698178D-FDAD-40AE-9D3C-1371703ADC5B}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0
  1514. Start-Sleep 1
  1515. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{67144949-5132-4859-8036-a737b43825d8}" -ValueName **del.EnabledScenarioExecutionLevel -Type String -Data ""
  1516. Start-Sleep 1
  1517. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{67144949-5132-4859-8036-a737b43825d8}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0
  1518. Start-Sleep 1
  1519. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0
  1520. Start-Sleep 1
  1521. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0
  1522. Start-Sleep 1
  1523. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}" -ValueName **del.EnabledScenarioExecutionLevel -Type String -Data ""
  1524. Start-Sleep 1
  1525. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0
  1526. Start-Sleep 1
  1527. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{C295FBBA-FD47-46ac-8BEE-B1715EC634E5}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0
  1528. Start-Sleep 1
  1529. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{dc42ff48-e40d-4a60-8675-e71f7e64aa9a}" -ValueName EnabledScenarioExecutionLevel -Type DWord -Data 1
  1530. Start-Sleep 1
  1531. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{dc42ff48-e40d-4a60-8675-e71f7e64aa9a}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0
  1532. Start-Sleep 1
  1533. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{ecfb03d1-58ee-4cc7-a1b5-9bc6febcb915}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0
  1534. Start-Sleep 1
  1535. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}" -ValueName **del.EnabledScenarioExecutionLevel -Type String -Data ""
  1536. Start-Sleep 1
  1537. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0
  1538. Start-Sleep 1
  1539. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" -ValueName Disabled -Type DWord -Data 1
  1540. Start-Sleep 1
  1541. Write-Progress -Activity "Securing local group policy for privacy (this might take a minute or two)" -Status "Progress:" -PercentComplete 60
  1542. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" -ValueName DontSendAdditionalData -Type DWord -Data 1
  1543. Start-Sleep 1
  1544. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName AllowCortana -Type DWord -Data 0
  1545. Start-Sleep 1
  1546. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName AllowSearchToUseLocation -Type DWord -Data 0
  1547. Start-Sleep 1
  1548. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName ConnectedSearchPrivacy -Type DWord -Data 3
  1549. Start-Sleep 1
  1550. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName ConnectedSearchSafeSearch -Type DWord -Data 3
  1551. Start-Sleep 1
  1552. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName ConnectedSearchUseWeb -Type DWord -Data 0
  1553. Start-Sleep 1
  1554. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName ConnectedSearchUseWebOverMeteredConnections -Type DWord -Data 0
  1555. Start-Sleep 1
  1556. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName DisableWebSearch -Type DWord -Data 1
  1557. Start-Sleep 1
  1558. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -ValueName DeferUpgrade -Type DWord -Data 1
  1559. Start-Sleep 1
  1560. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -ValueName DoNotConnectToWindowsUpdateInternetLocations -Type DWord -Data 1
  1561. Start-Sleep 1
  1562. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName **del.AutomaticMaintenanceEnabled -Type String -Data ""
  1563. Start-Sleep 1
  1564. Write-Progress -Activity "Securing local group policy for privacy (this might take a minute or two)" -Status "Progress:" -PercentComplete 75
  1565. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName **del.DetectionFrequency -Type String -Data ""
  1566. Start-Sleep 1
  1567. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName AUOptions -Type DWord -Data 2
  1568. Start-Sleep 1
  1569. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName DetectionFrequencyEnabled -Type DWord -Data 0
  1570. Start-Sleep 1
  1571. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName EnableFeaturedSoftware -Type DWord -Data 1
  1572. Start-Sleep 1
  1573. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName NoAutoUpdate -Type DWord -Data 0
  1574. Start-Sleep 1
  1575. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName ScheduledInstallDay -Type DWord -Data 0
  1576. Start-Sleep 1
  1577. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName ScheduledInstallTime -Type DWord -Data 3
  1578. Start-Sleep 1
  1579. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\WMDRM" -ValueName DisableOnline -Type DWord -Data 1
  1580. Start-Sleep 1
  1581. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\User\registry.pol -Key "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -ValueName NoInstrumentation -Type DWord -Data 1
  1582. Start-Sleep 1
  1583. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\User\registry.pol -Key "Software\Policies\Microsoft\Internet Explorer\Privacy" -ValueName EnableInPrivateBrowsing -Type DWord -Data 0
  1584. Start-Sleep 1
  1585. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\User\registry.pol -Key "Software\Policies\Microsoft\Internet Explorer\Safety\PrivacIE" -ValueName DisableLogging -Type DWord -Data 1
  1586. Start-Sleep 1
  1587. Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\User\registry.pol -Key "Software\Policies\Microsoft\Windows\EdgeUI" -ValueName DisableMFUTracking -Type DWord -Data 1
  1588. gpupdate /force
  1589. Write-Progress -Activity "Securing local group policy for privacy (this might take a minute or two)" -Status "Progress:" -PercentComplete 100
  1590.  
  1591. # More Registry Tweaks
  1592. # Fix DPI scaling blurry/fuzzy display at 125% (Might get reset by reboot/windows update)
  1593. Write-Progress -Activity "More Registry Tweaks!" -Status "Progress:" -PercentComplete 5
  1594.  
  1595. New-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:\Control Panel\Desktop" -Name "DpiScalingVer" -Value "0x00001018" -PropertyType DWORD -Force
  1596. New-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:\Control Panel\Desktop" -Name "Win8DpiScaling" -Value "0x00000001" -PropertyType DWORD -Force
  1597. # This sets it to 125% DPI scaling, un-comment if you do need it (you use 125% dpi scaling)
  1598. # New-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:\Control Panel\Desktop" -Name "LogPixels" -Value "0x00000078" -PropertyType DWORD -Force
  1599.  
  1600. # Add a 'Take Owner' option in your right-click menu (Powershell has problems with '*', using reg.exe)
  1601.  
  1602. echo Y | reg add "HKEY_CLASSES_ROOT\*\shell\runas" /ve /t REG_SZ /d "Take Ownership" /f
  1603. echo Y | reg add "HKEY_CLASSES_ROOT\*\shell\runas" /v NoWorkingDirectory /t REG_SZ /d "" /f
  1604. echo Y | reg add "HKEY_CLASSES_ROOT\*\shell\runas\command" /ve /t REG_SZ /d "cmd.exe /c takeown /f \`"%1\`" && icacls \`"%1\`" /grant administrators:F" /f
  1605. echo Y | reg add "HKEY_CLASSES_ROOT\*\shell\runas\command" /v IsolatedCommand /t REG_SZ /d "cmd.exe /c takeown /f \`"%1\`" && icacls \`"%1\`" /grant administrators:F" /f
  1606. Write-Progress -Activity "More Registry Tweaks!" -Status "Progress:" -PercentComplete 25
  1607. New-Item -ErrorAction SilentlyContinue -Force -Path "HKCR:\Directory\shell\runas"
  1608. New-Item -ErrorAction SilentlyContinue -Force -Path "HKCR:\Directory\shell\runas\command"
  1609. New-ItemProperty -ErrorAction SilentlyContinue -Force -Path "HKCR:\Directory\shell\runas" -Name '(Default)' -Value "Take Ownership"
  1610. New-ItemProperty -ErrorAction SilentlyContinue -Force -Path "HKCR:\Directory\shell\runas" -Name NoWorkingDirectory -Value ""
  1611. Write-Progress -Activity "More Registry Tweaks!" -Status "Progress:" -PercentComplete 50
  1612. New-ItemProperty -ErrorAction SilentlyContinue -Force -Path "HKCR:\Directory\shell\runas\command" -Name '(Default)' -Value "cmd.exe /c takeown /f `"%1`" /r /d y && icacls `"%1`" /grant administrators:F /t"
  1613. New-ItemProperty -ErrorAction SilentlyContinue -Force -Path "HKCR:\Directory\shell\runas\command" -Name IsolatedCommand -Value "cmd.exe /c takeown /f `"%1`" /r /d y && icacls `"%1`" /grant administrators:F /t"
  1614.  
  1615. # Show file extensions
  1616. New-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name HideFileExt -PropertyType DWORD -Value 0 -Force
  1617. Write-Progress -Activity "More Registry Tweaks!" -Status "Progress:" -PercentComplete 75
  1618.  
  1619.  
  1620.  
  1621. # Enabling .NET 3.5 framework because a lot of programs still use it
  1622. Dism /online /Enable-Feature /FeatureName:NetFx3 /quiet /norestart
  1623. Write-Progress -Activity "More Registry Tweaks!" -Status "Progress:" -PercentComplete 100
  1624.  
  1625. #
  1626. #
  1627. # Change Mac Menu
  1628.  
  1629.  
  1630.  
  1631.  
  1632. $Title = "Welcome"
  1633. $Info = "To Change Or Not Change Your Mac (May not support Hyper-V)"
  1634.  
  1635. $options = [System.Management.Automation.Host.ChoiceDescription[]] @("&Yes", "&No", "&Quit")
  1636. [int]$defaultchoice = 1
  1637. $opt =  $host.UI.PromptForChoice($Title , $Info , $Options,$defaultchoice)
  1638. switch($opt)
  1639. {
  1640. 0 {
  1641. #
  1642. #
  1643. # The Below Script Enable a random mac on wifi. This may not work on all computers!!! (Especially HYPER-V)
  1644.  
  1645. Write-Host "Enabling Random MAC address on WIFI!!! Please be patient... This may not work on all computers!!! (Especially HYPER-V)"
  1646. function random-mac ($ManufacturerName, $ManufacturerID, $Delimiter, [Switch] $TotallyRandom, [Switch] $LocallyAdministered, [Switch] $Multicast)
  1647. {  
  1648.     # $mac will be padded with random hex later, but add a random vendor ID by default.
  1649.     if ($TotallyRandom) { $mac = "" }  
  1650.     else
  1651.     {
  1652.         # First three bytes will come from the manufacturer ID number.
  1653.         # Some input checking of the manufacturer selection...
  1654.         if ($ManufacturerName -and $ManufacturerName.StartsWith("3")) { $ManufacturerName = "ThreeCom" }
  1655.         if ($ManufacturerName -and $ManufacturerName.ToUpper().StartsWith("D-")) { $ManufacturerName = "DLink" }
  1656.         if ($ManufacturerID -and $ManufacturerID.ToString().length -gt 12) { $ManufacturerID = $ManufacturerID.ToString().SubString(0,12) }
  1657.        
  1658.         # Manufacturer identifiers last updated on 5.Feb.2011:
  1659.         $vendor = @{
  1660.             "Netgear" = "0024B2 0026F2 30469A A021B7 C03F0E C43DC7 E0469A E091F5 000FB5 00146C 00184D 001B2F 001E2A 001F33 00223F 00095B" ;
  1661.             "DLink" = "00055D 000D88 000F3D 001195 001346 0015E9 00179A 00195B 001B11 001CF0 001E58 002191 0022B0 002401 00265A 0050BA 0080C8 14D64D 1CAFF7 1CBDB9 340804 5CD998 F07D68" ;
  1662.             "ThreeCom" = "000102 000103 00029C 00040B 00051A 00068C 000A04 000A5E 000BAC 000D54 000E6A 000FCB 00104B 00105A 0012A9 00147C 0016E0 00186E 001AC1 001CC5 001EC1 0020AF 002257 002473 002654 00301E 005004 005099 0050DA 006008 00608C 006097 009004 00A024 00D096 00D0D8 02608C 02C08C 08004E 20FDF1 4001C6" ;
  1663.             "Intel" = "0002B3 000347 000423 0007E9 000CF1 000E0C 000E35 001111 0012F0 001302 001320 0013CE 0013E8 001500 001517 00166F 001676 0016EA 0016EB 0018DE 0019D1 0019D2 001B21 001B77 001CBF 001CC0 001DE0 001DE1 001E64 001E65 001E67 001F3B 001F3C 00207B 00215C 00215D 00216A 00216B 0022FA 0022FB 002314 002315 0024D6 0024D7 0026C6 0026C7 00270E 002710 0050F1 009027 00A0C9 00AA00 00AA01 00AA02 00D0B7 081196 0CD292 100BA9 183DA2 247703 4025C2 448500 4C8093 502DA2 58946B 648099 64D4DA 685D43 74E50B 78929C 809B20 88532E 8CA982 A088B4 AC7289 BC7737 DCA971" ;
  1664.             "HP" = "0001E6 0001E7 0002A5 0004EA 000802 000883 0008C7 000A57 000BCD 000D9D 000E7F 000EB3 000F20 000F61 001083 0010E3 00110A 001185 001279 001321 001438 0014C2 001560 001635 001708 0017A4 001871 0018FE 0019BB 001A4B 001B78 001CC4 001E0B 001F29 00215A 002264 00237D 002481 0025B3 002655 00306E 0030C1 00508B 0060B0 00805F 0080A0 080009 18A905 1CC1DE 2C27D7 3C4A92 643150 68B599 78ACC0 78E3B5 78E7D1 984BE1 B499BA B8AF67 D48564 D8D385 F4CE46" ;
  1665.             "Apple" = "000393 000502 000A27 000A95 000D93 0010FA 001124 001451 0016CB 0017F2 0019E3 001B63 001CB3 001D4F 001E52 001EC2 001F5B 001FF3 0021E9 002241 002312 002332 00236C 0023DF 002436 002500 00254B 0025BC 002608 00264A 0026B0 0026BB 003065 0050E4 00A040 041E64 080007 1093E9 109ADD 18E7F4 24AB81 28E7CF 34159E 3C0754 40A6D9 40D32D 442A60 581FAA 5855CA 58B035 5C5948 60334B 60FB42 64B9E8 70CD60 78CA39 7C6D62 7CC537 7CF05F 88C663 8C5877 8C7B9D 9027E4 90840D 9803D8 A46706 A4B197 B8FF61 C42C03 C82A14 C8BCC8 CC08E0 D49A20 D83062 D89E3F D8A25E DC2B61 E0F847 E4CE8F E80688 F0B479 F81EDF" ;
  1666.             "AlliedTelesis" = "0000CD 0000F4 000941 000A79 000DDA 001130 001577 001AEB 002687 009099 00A0D2 ECCD6D" ;
  1667.             "QLogic" = "000E1E 001B32 0024FF 00C0DD 00E08B"
  1668.         }
  1669.  
  1670.         # Check that $ManufacturerName actually matches one of the valid $vendors here.
  1671.         if ($ManufacturerName -and ($vendor.keys -notcontains $ManufacturerName))
  1672.         { throw "`nYou must choose a vendor from this list:`n" + $vendor.keys }
  1673.        
  1674.         # Generate the first three bytes of the MAC or use the $ManufacturerID instead.
  1675.         if ($ManufacturerID) { $mac = $ManufacturerID.ToString().ToUpper() -replace '[^A-F0-9]',"" }
  1676.         elseif ($ManufacturerName) { $mac = get-random -input @($vendor.$ManufacturerName -split " ") }
  1677.         else { $mac = get-random -input @($vendor.$(get-random -input @($vendor.keys)) -split " ") }
  1678.     }
  1679.    
  1680.     # Now padright with random hex characters until we have twelve chars.
  1681.     while ($mac.length -lt 12)
  1682.     {
  1683.         $mac += "{0:X}" -f $(get-random -min 0 -max 16)
  1684.     }
  1685.    
  1686.     # Now set the unicast/multicast flag bit.
  1687.     # First low-order bit (right-most bit): 0 = unicast, 1 = multicast
  1688.     # For the bit flags, see http://en.wikipedia.org/wiki/MAC_address  
  1689.     [Byte] $firstbyte = "0x" + $mac.substring(0,2)      # Convert first two hex chars to a byte.
  1690.  
  1691.     if ($multicast)
  1692.     {
  1693.         $firstbyte = [Byte] $firstbyte -bor [Byte] 1     # Set low-order bit to 1: multicast
  1694.         $mac = ("{0:X}" -f $firstbyte).padleft(2,"0") + $mac.substring(2)
  1695.     }
  1696.     else
  1697.     {
  1698.         $firstbyte = [Byte] $firstbyte -band [Byte] 254  # Set low-order bit to 0: unicast
  1699.         $mac = ("{0:X}" -f $firstbyte).padleft(2,"0") + $mac.substring(2)
  1700.     }
  1701.    
  1702.    
  1703.     # Now set the vendor-unique/locally-administered flag.
  1704.     # Next-to-low-order bit (second from right): 0 = unique vendor, 1 = locally administered
  1705.     if ($locallyadministered)
  1706.     {
  1707.         $firstbyte = [Byte] $firstbyte -bor [Byte] 2     # Set second low-order bit to 1: locally
  1708.         $mac = ("{0:X}" -f $firstbyte).padleft(2,"0") + $mac.substring(2)
  1709.     }
  1710.     else
  1711.     {
  1712.         $firstbyte = [Byte] $firstbyte -band [Byte] 253  # Set second low-order bit to 0: vendor unique
  1713.         $mac = ("{0:X}" -f $firstbyte).padleft(2,"0") + $mac.substring(2)
  1714.     }
  1715.    
  1716.        
  1717.     # Add delimiter, if any, and return the $mac.
  1718.     if ($Delimiter)
  1719.     {
  1720.         for ($i = 0 ; $i -le 10 ; $i += 2)
  1721.         { $newmac += $mac.substring($i,2) + $Delimiter }
  1722.         $newmac.substring(0,$($newmac.length - $Delimiter.length))
  1723.     }
  1724.     else
  1725.     { $mac }
  1726. }
  1727.  
  1728.  
  1729. # Get the NICs which are not tunnels, not for virtual machines, and not for bluetooth.
  1730. $nics = @(Get-WmiObject -Query "select * from win32_networkadapter where adaptertype != 'Tunnel' and adaptertype is not null" | `
  1731. where { $_.description -notmatch 'VMware|Virtual|WAN Miniport|ISATAP|RAS Async|Teredo|Windows Mobile Remote|6to4|Bluetooth' } )
  1732.  
  1733. # If more than one physical NIC, prompt the user to select one, if the index number was not given.
  1734. if ($nics.count -eq 0) { "`nCannot identify a valid network interface device, quitting...`n" ; exit }
  1735. elseif ($nics.count -eq 1 -and -not $InterfaceIndexNumber) { $index = $nics[0].index }
  1736. else
  1737. {
  1738.     if ($InterfaceIndexNumber) { $index = $InterfaceIndexNumber }
  1739.     else
  1740.     {
  1741.         # Print a list of interfaces and prompt user to choose one.
  1742.         "`n"; $nics | format-table index,macaddress,netconnectionid,description -autosize
  1743.         $index = read-host -prompt "`nEnter the index number of the desired interface"
  1744.     }
  1745. }
  1746.  
  1747. # Check that a valid index number was actually entered.
  1748. $good = $false; switch ($nics | foreach {$_.index}) { $index { $good = $true } }
  1749. if (-not $good) { "`n$index is not a valid index number, quitting...`n" ; exit }
  1750.  
  1751. # Confirm that you can get the NIC by the index number, so that it can be disabled/enabled later too.
  1752. $thenic = Get-WmiObject -Query "select * from win32_networkadapter where deviceid = $index"
  1753. if (-not $?) { "`nThere was a problem getting the interface, quitting...`n" ; exit }
  1754.  
  1755. # The registry key for the nic always has four digits, so padleft, then get the key.
  1756. $index = $index.tostring().padleft(4,"0")
  1757. $regkey = get-item "hklm:\system\CurrentControlSet\control\class\{4D36E972-E325-11CE-BFC1-08002BE10318}\$index"
  1758. if (-not $?) { "`nThere was a problem getting the registry key, quitting...`n" ; exit }
  1759.  
  1760. # Show how WMI sees the current MAC address.
  1761. ("`nWMI reports the current MAC address for interface $index as " + $thenic.macaddress + ".").replace(":","")
  1762.  
  1763. # Show current registry value for MAC address, if any.
  1764. $macaddress = $regkey.getvalue("NetworkAddress")
  1765. if ($macaddress -eq $null) {"Custom MAC address registry value does not exist for interface index $index."}
  1766. else {"Current registry MAC value for interface $index is $macaddress."}
  1767.  
  1768. # If requested, delete the registry value for a custom MAC, which resets to the default burnt-in
  1769. # MAC; otherwise, set the registry value for a custom MAC address.
  1770. if ($resetdefault)
  1771. {
  1772.     if ($macaddress -ne $null)
  1773.     {
  1774.         "Deleting registry value for a custom MAC, which resets to the default MAC address."
  1775.         $regpath = "hklm:\system\CurrentControlSet\control\class\{4D36E972-E325-11CE-BFC1-08002BE10318}\$index"
  1776.         remove-itemproperty -path $regpath -name "NetworkAddress"
  1777.         if (-not $?) { "`nFAILED to delete the registry value for the MAC address!`n" ; exit }
  1778.     }
  1779. }
  1780. else
  1781. {
  1782.     # Set new value for MAC address.
  1783.     $regpath = "hklm:\system\CurrentControlSet\control\class\{4D36E972-E325-11CE-BFC1-08002BE10318}\$index"
  1784.     if ($wireless)
  1785.     {
  1786.         set-itemproperty -path $regpath -name "NetworkAddress" -value $(random-mac -locallyadministered)
  1787.     }
  1788.     else
  1789.     {
  1790.         set-itemproperty -path $regpath -name "NetworkAddress" -value $(random-mac)
  1791.     }
  1792.     if (-not $?) { "`nFAILED to set the registry value for the MAC address!`n" ; exit }
  1793.  
  1794.     # Show new registry value for MAC address.
  1795.     $macaddress = $regkey.getvalue("NetworkAddress")
  1796.     if ($macaddress -eq $null) { "`nFAILED to change the registry value for a custom MAC address`n" ; exit }
  1797.     else {"The new registry MAC value for interface $index is $macaddress."}
  1798. }
  1799.  
  1800. # Release DHCP leases, disable the interface, re-enable, renew DHCP.
  1801. if ($DoNotResetInterface)
  1802. {   "Changes will not take effect until after the interface has been disabled and enabled.`n" }
  1803. else
  1804. {
  1805.     "Refreshing the interface, this may take a few seconds..."
  1806.     ipconfig.exe /release """$($thenic.netconnectionid)"""   | out-null
  1807.     ipconfig.exe /release6 """$($thenic.netconnectionid)"""  | out-null
  1808.     $thenic.disable() | out-null
  1809.     if (-not $?) { "FAILED to disable the interface!" }
  1810.     $thenic.enable() | out-null
  1811.     if (-not $?) { "FAILED to enable the interface!" }
  1812.     ipconfig.exe /renew """$($thenic.netconnectionid)"""  | out-null
  1813.     ipconfig.exe /renew6 """$($thenic.netconnectionid)""" | out-null
  1814.     "...done refreshing the interface."
  1815.  
  1816.     # Confirm through WMI again that the change actually took effect.
  1817.     $thenic = Get-WmiObject -Query "select * from win32_networkadapter where deviceid = $index"
  1818.     ("WMI reports the current MAC address for interface $index as " + $thenic.macaddress + ".`n").replace(":","")
  1819. }
  1820.  
  1821. # END-MAC-SCRIPT
  1822.  
  1823. ##########
  1824. # Restart
  1825. ##########
  1826. Write-Host
  1827. Write-Host "Press any key to restart your system..." -ForegroundColor Black -BackgroundColor White
  1828. $key = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
  1829. Write-Host "Restarting..."
  1830. Restart-Computer
  1831. }
  1832.  
  1833. 1 {
  1834. Write-Host
  1835. Write-Host "Press any key to restart your system..." -ForegroundColor Black -BackgroundColor White
  1836. $key = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
  1837. Write-Host "Restarting..."
  1838. Restart-Computer
  1839. }
  1840. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!