API tools faq
paste
Advertisement
TheRoboKitten

Windows 10 Security/Hardening Powershell Script 4.0

TheRoboKitten
Mar 23rd, 2017
2,497
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PowerShell 83.37 KB | None | 0 0
raw download clone embed print report
  1. ##########
  2. # Win10 Initial Setup Script
  3. # Author: Disassembler <[email protected]>
  4. # Edited by Gr1D:
  5. # dasm's script: https://github.com/Disassembler0/Win10-Initial-Setup-Script/
  6.  
  7. # THIS IS VERSION 4.0, error suppression is turned on. Debugging needs to be completed in add-appxpackage and Onedrive uninstall sections.
  8. # This script leaves more MS defaults on, including MSE and smart-screen,
  9. # but blocks a ton of domains and disables remote assistance secures java, sets up ipsec..
  10. # (please set your own key - SEE BELOW A FEW LINES) and disables SSL. Even changes your mac. To disable skynet turn off smartscreen and antivirus.
  11.  
  12. # NOTE: READ THIS SCRIPT CAREFULLY BEFORE RUNNING IT. ADJUST COMMENTS AS APPROPRIATE.
  13. # This script will reboot your machine when completed.
  14. # Setting up a new machine? See http://ninite.com (for devs, http://chocolatey.org)
  15. ##########
  16.  
  17. # Ask for elevated permissions if required
  18.  
  19. $ErrorActionPreference= 'silentlycontinue'
  20.  
  21. If (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")) {
  22.     Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs
  23.     Exit
  24. }
  25.  
  26.  
  27. #
  28. # PLEASE EDIT THE BELOW LINE TO SET YOUR IPSEC PASSWORD (This may be randomly generated in the future)
  29. $ThePreSharedKey = 'PasswordCHANGEME'
  30.  
  31. ##########
  32. # Privacy Settings
  33. ##########
  34.  
  35. # Disable Telemetry
  36. # Disable Telemetry
  37. Write-Host "Disabling Telemetry..."
  38. Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 0
  39. Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 0
  40. Set-ItemProperty -Path "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 0
  41.  
  42. # Enable Telemetry
  43. # Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 3
  44. # Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 3
  45. # Set-ItemProperty -Path "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 3
  46.  
  47. # Disable Wi-Fi Sense
  48. Write-Host "Disabling Wi-Fi Sense..."
  49. If (!(Test-Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting")) {
  50.     New-Item -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" -Force | Out-Null
  51. }
  52. Set-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" -Name "Value" -Type DWord -Value 0
  53. Set-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotspots" -Name "Value" -Type DWord -Value 0
  54.  
  55. # Enable Wi-Fi Sense
  56. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" -Name "Value" -Type DWord -Value 1
  57. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotspots" -Name "Value" -Type DWord -Value 1
  58.  
  59. # Disable SmartScreen Filter
  60. # Write-Host "Disabling SmartScreen Filter..."
  61. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer" -Name "SmartScreenEnabled" -Type String -Value "Off"
  62. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AppHost" -Name "EnableWebContentEvaluation" -Type DWord -Value 0
  63.  
  64. # Enable SmartScreen Filter
  65. Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer" -Name "SmartScreenEnabled" -Type String -Value "RequireAdmin"
  66. Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AppHost" -Name "EnableWebContentEvaluation"
  67.  
  68. # Disable Bing Search in Start Menu
  69. Write-Host "Disabling Bing Search in Start Menu..."
  70. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "BingSearchEnabled" -Type DWord -Value 0
  71.  
  72. # Enable Bing Search in Start Menu
  73. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "BingSearchEnabled"
  74.  
  75. # Disable Start Menu suggestions
  76. Write-Host "Disabling Start Menu suggestions..."
  77. Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" -Name "SystemPaneSuggestionsEnabled" -Type DWord -Value 0
  78.  
  79. # Enable Start Menu suggestions
  80. # Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" -Name "SystemPaneSuggestionsEnabled" -Type DWord -Value 1
  81.  
  82. # Disable Location Tracking
  83. Write-Host "Disabling Location Tracking..."
  84. Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Sensor\Overrides\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}" -Name "SensorPermissionState" -Type DWord -Value 0
  85. Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\lfsvc\Service\Configuration" -Name "Status" -Type DWord -Value 0
  86.  
  87. # Enable Location Tracking
  88. # Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Sensor\Overrides\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}" -Name "SensorPermissionState" -Type DWord -Value 1
  89. # Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\lfsvc\Service\Configuration" -Name "Status" -Type DWord -Value 1
  90.  
  91. # Disable Feedback
  92. Write-Host "Disabling Feedback..."
  93. If (!(Test-Path "HKCU:\Software\Microsoft\Siuf\Rules")) {
  94.     New-Item -Path "HKCU:\Software\Microsoft\Siuf\Rules" -Force | Out-Null
  95. }
  96. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Siuf\Rules" -Name "NumberOfSIUFInPeriod" -Type DWord -Value 0
  97.  
  98. # Enable Feedback
  99. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Siuf\Rules" -Name "NumberOfSIUFInPeriod"
  100.  
  101. # Disable Advertising ID
  102. Write-Host "Disabling Advertising ID..."
  103. If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo")) {
  104.     New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" | Out-Null
  105. }
  106. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" -Name "Enabled" -Type DWord -Value 0
  107.  
  108. # Enable Advertising ID
  109. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" -Name "Enabled"
  110.  
  111. # Disable Cortana
  112. Write-Host "Disabling Cortana..."
  113. If (!(Test-Path "HKCU:\Software\Microsoft\Personalization\Settings")) {
  114.     New-Item -Path "HKCU:\Software\Microsoft\Personalization\Settings" -Force | Out-Null
  115. }
  116. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Personalization\Settings" -Name "AcceptedPrivacyPolicy" -Type DWord -Value 0
  117. If (!(Test-Path "HKCU:\Software\Microsoft\InputPersonalization")) {
  118.     New-Item -Path "HKCU:\Software\Microsoft\InputPersonalization" -Force | Out-Null
  119. }
  120. Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization" -Name "RestrictImplicitTextCollection" -Type DWord -Value 1
  121. Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization" -Name "RestrictImplicitInkCollection" -Type DWord -Value 1
  122. If (!(Test-Path "HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore")) {
  123.     New-Item -Path "HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore" -Force | Out-Null
  124. }
  125. Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore" -Name "HarvestContacts" -Type DWord -Value 0
  126.  
  127. # Enable Cortana
  128. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Personalization\Settings" -Name "AcceptedPrivacyPolicy"
  129. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization" -Name "RestrictImplicitTextCollection" -Type DWord -Value 0
  130. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization" -Name "RestrictImplicitInkCollection" -Type DWord -Value 0
  131. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore" -Name "HarvestContacts"
  132.  
  133. # Restrict Windows Update P2P only to local network
  134. Write-Host "Restricting Windows Update P2P only to local network..."
  135. Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" -Name "DODownloadMode" -Type DWord -Value 1
  136. If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization")) {
  137.     New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization" | Out-Null
  138. }
  139. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization" -Name "SystemSettingsDownloadMode" -Type DWord -Value 3
  140.  
  141. # Unrestrict Windows Update P2P
  142. # Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" -Name "DODownloadMode"
  143. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization" -Name "SystemSettingsDownloadMode"
  144.  
  145. # Remove AutoLogger file and restrict directory
  146. Write-Host "Removing AutoLogger file and restricting directory..."
  147. $autoLoggerDir = "$env:PROGRAMDATA\Microsoft\Diagnosis\ETLLogs\AutoLogger"
  148. If (Test-Path "$autoLoggerDir\AutoLogger-Diagtrack-Listener.etl") {
  149.     Remove-Item "$autoLoggerDir\AutoLogger-Diagtrack-Listener.etl"
  150. }
  151. icacls $autoLoggerDir /deny SYSTEM:`(OI`)`(CI`)F | Out-Null
  152.  
  153. # Unrestrict AutoLogger directory
  154. # $autoLoggerDir = "$env:PROGRAMDATA\Microsoft\Diagnosis\ETLLogs\AutoLogger"
  155. # icacls $autoLoggerDir /grant:r SYSTEM:`(OI`)`(CI`)F | Out-Null
  156.  
  157. # Stop and disable Diagnostics Tracking Service
  158. Write-Host "Stopping and disabling Diagnostics Tracking Service..."
  159. Stop-Service "DiagTrack"
  160. Set-Service "DiagTrack" -StartupType Disabled
  161.  
  162. # Enable and start Diagnostics Tracking Service
  163. # Set-Service "DiagTrack" -StartupType Automatic
  164. # Start-Service "DiagTrack"
  165.  
  166. # Stop and disable WAP Push Service
  167. Write-Host "Stopping and disabling WAP Push Service..."
  168. Stop-Service "dmwappushservice"
  169. Set-Service "dmwappushservice" -StartupType Disabled
  170.  
  171. # Enable and start WAP Push Service
  172. # Set-Service "dmwappushservice" -StartupType Automatic
  173. # Start-Service "dmwappushservice"
  174. # Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\dmwappushservice" -Name "DelayedAutoStart" -Type DWord -Value 1
  175.  
  176.  
  177.  
  178. ##########
  179. # Service Tweaks
  180. ##########
  181.  
  182. # Lower UAC level
  183. # Write-Host "Lowering UAC level..."
  184. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Type DWord -Value 0
  185. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "PromptOnSecureDesktop" -Type DWord -Value 0
  186.  
  187. # Raise UAC level
  188. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Type DWord -Value 5
  189. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "PromptOnSecureDesktop" -Type DWord -Value 1
  190.  
  191. # Enable sharing mapped drives between users
  192. # Write-Host "Enabling sharing mapped drives between users..."
  193. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLinkedConnections" -Type DWord -Value 1
  194.  
  195. # Disable sharing mapped drives between users
  196. Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLinkedConnections"
  197.  
  198. # Disable Firewall
  199. # Write-Host "Disabling Firewall..."
  200. # Set-NetFirewallProfile -Profile * -Enabled False
  201.  
  202. # Enable Firewall
  203. Set-NetFirewallProfile -Profile * -Enabled True
  204.  
  205. # Disable Windows Defender
  206. # Write-Host "Disabling Windows Defender..."
  207. # Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Type DWord -Value 1
  208.  
  209. # Enable Windows Defender
  210. Remove-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware"
  211.  
  212. # Disable Windows Update automatic restart
  213. Write-Host "Disabling Windows Update automatic restart..."
  214. Set-ItemProperty -Path "HKLM:\Software\Microsoft\WindowsUpdate\UX\Settings" -Name "UxOption" -Type DWord -Value 1
  215.  
  216. # Enable Windows Update automatic restart
  217. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\WindowsUpdate\UX\Settings" -Name "UxOption" -Type DWord -Value 0
  218.  
  219. # Stop and disable Home Groups services
  220. Write-Host "Stopping and disabling Home Groups services..."
  221. Stop-Service "HomeGroupListener"
  222. Set-Service "HomeGroupListener" -StartupType Disabled
  223. Stop-Service "HomeGroupProvider"
  224. Set-Service "HomeGroupProvider" -StartupType Disabled
  225.  
  226. # Enable and start Home Groups services
  227. # Set-Service "HomeGroupListener" -StartupType Manual
  228. # Set-Service "HomeGroupProvider" -StartupType Manual
  229. # Start-Service "HomeGroupProvider"
  230.  
  231. # Disable Remote Assistance
  232. Write-Host "Disabling Remote Assistance..."
  233. Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Remote Assistance" -Name "fAllowToGetHelp" -Type DWord -Value 0
  234.  
  235. # Enable Remote Assistance
  236. # Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Remote Assistance" -Name "fAllowToGetHelp" -Type DWord -Value 1
  237.  
  238. # Enable Remote Desktop w/o Network Level Authentication
  239. # Write-Host "Enabling Remote Desktop w/o Network Level Authentication..."
  240. # Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Type DWord -Value 0
  241. # Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication" -Type DWord -Value 0
  242.  
  243. # Disable Remote Desktop
  244. Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Type DWord -Value 1
  245. Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication" -Type DWord -Value 1
  246.  
  247.  
  248.  
  249. ##########
  250. # UI Tweaks
  251. ##########
  252.  
  253. # Disable Action Center
  254. Write-Host "Disabling Action Center..."
  255. If (!(Test-Path "HKCU:\Software\Policies\Microsoft\Windows\Explorer")) {
  256.   New-Item -Path "HKCU:\Software\Policies\Microsoft\Windows\Explorer" | Out-Null
  257. }
  258. Set-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Windows\Explorer" -Name "DisableNotificationCenter" -Type DWord -Value 1
  259. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\PushNotifications" -Name "ToastEnabled" -Type DWord -Value 0
  260.  
  261. # Enable Action Center
  262. # Remove-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Windows\Explorer" -Name "DisableNotificationCenter"
  263. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\PushNotifications" -Name "ToastEnabled"
  264.  
  265. # Disable Lock screen
  266. # Write-Host "Disabling Lock screen..."
  267. # If (!(Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization")) {
  268. #   New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" | Out-Null
  269. # }
  270. # Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" -Name "NoLockScreen" -Type DWord -Value 1
  271.  
  272. # Enable Lock screen
  273. Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" -Name "NoLockScreen"
  274.  
  275. # Disable Lock screen (Anniversary Update workaround)
  276. #If ([System.Environment]::OSVersion.Version.Build -gt 14392) { # Apply only for Redstone 1 or newer
  277. #   $service = New-Object -com Schedule.Service
  278. #   $service.Connect()
  279. #   $task = $service.NewTask(0)
  280. #   $task.Settings.DisallowStartIfOnBatteries = $false
  281. #   $trigger = $task.Triggers.Create(9)
  282. #   $trigger = $task.Triggers.Create(11)
  283. #   $trigger.StateChange = 8
  284. #   $action = $task.Actions.Create(0)
  285. #   $action.Path = "reg.exe"
  286. #   $action.Arguments = "add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData /t REG_DWORD /v AllowLockScreen /d 0 /f"
  287. #   $service.GetFolder("\").RegisterTaskDefinition("Disable LockScreen", $task, 6, "NT AUTHORITY\SYSTEM", $null, 4) | Out-Null
  288. #}
  289.  
  290. # Enable Lock screen (Anniversary Update workaround)
  291. #If ([System.Environment]::OSVersion.Version.Build -gt 14392) { # Apply only for Redstone 1 or newer
  292. #   Unregister-ScheduledTask -TaskName "Disable LockScreen" -Confirm:$false -ErrorAction SilentlyContinue
  293. #}
  294.  
  295. # Disable Autoplay
  296. Write-Host "Disabling Autoplay..."
  297. Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers" -Name "DisableAutoplay" -Type DWord -Value 1
  298.  
  299. # Enable Autoplay
  300. # Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers" -Name "DisableAutoplay" -Type DWord -Value 0
  301.  
  302. # Disable Autorun for all drives
  303. Write-Host "Disabling Autorun for all drives..."
  304. If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer")) {
  305.   New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" | Out-Null
  306. }
  307. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoDriveTypeAutoRun" -Type DWord -Value 255
  308.  
  309. # Enable Autorun
  310. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoDriveTypeAutoRun"
  311.  
  312. #Disable Sticky keys prompt
  313. Write-Host "Disabling Sticky keys prompt..."
  314. Set-ItemProperty -Path "HKCU:\Control Panel\Accessibility\StickyKeys" -Name "Flags" -Type String -Value "506"
  315.  
  316. # Enable Sticky keys prompt
  317. # Set-ItemProperty -Path "HKCU:\Control Panel\Accessibility\StickyKeys" -Name "Flags" -Type String -Value "510"
  318.  
  319. # Hide Search button / box
  320. Write-Host "Hiding Search Box / Button..."
  321. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "SearchboxTaskbarMode" -Type DWord -Value 0
  322.  
  323. # Show Search button / box
  324. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "SearchboxTaskbarMode"
  325.  
  326. # Hide Task View button
  327. # Write-Host "Hiding Task View button..."
  328. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "ShowTaskViewButton" -Type DWord -Value 0
  329.  
  330. # Show Task View button
  331. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "ShowTaskViewButton"
  332.  
  333. # Show small icons in taskbar
  334. # Write-Host "Showing small icons in taskbar..."
  335. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarSmallIcons" -Type DWord -Value 1
  336.  
  337. # Show large icons in taskbar
  338. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarSmallIcons"
  339.  
  340. # Show titles in taskbar
  341. # Write-Host "Showing titles in taskbar..."
  342. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarGlomLevel" -Type DWord -Value 1
  343.  
  344. # Hide titles in taskbar
  345. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarGlomLevel"
  346.  
  347. # Show all tray icons
  348. # write-Host "Showing all tray icons..."
  349. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer" -Name "EnableAutoTray" -Type DWord -Value 0
  350.  
  351. # Hide tray icons as needed
  352. Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer" -Name "EnableAutoTray"
  353.  
  354. # Show known file extensions
  355. Write-Host "Showing known file extensions..."
  356. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "HideFileExt" -Type DWord -Value 0
  357.  
  358. # Hide known file extensions
  359. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "HideFileExt" -Type DWord -Value 1
  360.  
  361. # Show hidden files
  362. Write-Host "Showing hidden files..."
  363. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "Hidden" -Type DWord -Value 1
  364.  
  365. # Hide hidden files
  366. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "Hidden" -Type DWord -Value 2
  367.  
  368. # Change default Explorer view to "Computer"
  369. Write-Host "Changing default Explorer view to `"Computer`"..."
  370. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "LaunchTo" -Type DWord -Value 1
  371.  
  372. # Change default Explorer view to "Quick Access"
  373. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "LaunchTo"
  374.  
  375. # Show Computer shortcut on desktop
  376. Write-Host "Showing Computer shortcut on desktop..."
  377. If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu")) {
  378.   New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" | Out-Null
  379. }
  380. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" -Type DWord -Value 0
  381. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" -Type DWord -Value 0
  382.  
  383. # Hide Computer shortcut from desktop
  384. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"
  385. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"
  386.  
  387. # Remove Desktop icon from computer namespace
  388. # Write-Host "Removing Desktop icon from computer namespace..."
  389. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}" -Recurse -ErrorAction SilentlyContinue
  390.  
  391. # Add Desktop icon to computer namespace
  392. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"
  393.  
  394. # Remove Documents icon from computer namespace
  395. # Write-Host "Removing Documents icon from computer namespace..."
  396. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{d3162b92-9365-467a-956b-92703aca08af}" -Recurse -ErrorAction SilentlyContinue
  397. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}" -Recurse -ErrorAction SilentlyContinue
  398.  
  399. # Add Documents icon to computer namespace
  400. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{d3162b92-9365-467a-956b-92703aca08af}"
  401. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}"
  402.  
  403. # Remove Downloads icon from computer namespace
  404. # Write-Host "Removing Downloads icon from computer namespace..."
  405. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{088e3905-0323-4b02-9826-5d99428e115f}" -Recurse -ErrorAction SilentlyContinue
  406. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{374DE290-123F-4565-9164-39C4925E467B}" -Recurse -ErrorAction SilentlyContinue
  407.  
  408. # Add Downloads icon to computer namespace
  409. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{088e3905-0323-4b02-9826-5d99428e115f}"
  410. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{374DE290-123F-4565-9164-39C4925E467B}"
  411.  
  412. # Remove Music icon from computer namespace
  413. # Write-Host "Removing Music icon from computer namespace..."
  414. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}" -Recurse -ErrorAction SilentlyContinue
  415. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}" -Recurse -ErrorAction SilentlyContinue
  416.  
  417. # Add Music icon to computer namespace
  418. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}"
  419. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}"
  420.  
  421. # Remove Pictures icon from computer namespace
  422. # Write-Host "Removing Pictures icon from computer namespace..."
  423. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}" -Recurse -ErrorAction SilentlyContinue
  424. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}" -Recurse -ErrorAction SilentlyContinue
  425.  
  426. # Add Pictures icon to computer namespace
  427. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}"
  428. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}"
  429.  
  430. # Remove Videos icon from computer namespace
  431. # Write-Host "Removing Videos icon from computer namespace..."
  432. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}" -Recurse -ErrorAction SilentlyContinue
  433. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A0953C92-50DC-43bf-BE83-3742FED03C9C}" -Recurse -ErrorAction SilentlyContinue
  434.  
  435. # Add Videos icon to computer namespace
  436. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}"
  437. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A0953C92-50DC-43bf-BE83-3742FED03C9C}"
  438.  
  439. ## Add secondary en-US keyboard
  440. #Write-Host "Adding secondary en-US keyboard..."
  441. #$langs = Get-WinUserLanguageList
  442. #$langs.Add("en-US")
  443. #Set-WinUserLanguageList $langs -Force
  444.  
  445. # Remove secondary en-US keyboard
  446. Set-WinUserLanguageList En-US -Force
  447.  
  448.  
  449.  
  450. ##########
  451. # Remove unwanted applications
  452. ##########
  453.  
  454. # Disable OneDrive
  455. Write-Host "Disabling OneDrive..."
  456. If (!(Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive")) {
  457.     New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" | Out-Null
  458. }
  459. Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" -Name "DisableFileSyncNGSC" -Type DWord -Value 1
  460.  
  461. # Enable OneDrive
  462. # Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" -Name "DisableFileSyncNGSC"
  463.  
  464. # Uninstall OneDrive
  465. Write-Host "Uninstalling OneDrive... May sometimes hang"
  466. Stop-Process -Name OneDrive -ErrorAction SilentlyContinue
  467. Start-Sleep -s 3
  468. $onedrive = "$env:SYSTEMROOT\SysWOW64\OneDriveSetup.exe"
  469. If (!(Test-Path $onedrive)) {
  470.     $onedrive = "$env:SYSTEMROOT\System32\OneDriveSetup.exe"
  471. }
  472. Start-Process $onedrive "/uninstall" -NoNewWindow -Wait
  473. Start-Sleep -s 3
  474. Stop-Process -Name explorer -ErrorAction SilentlyContinue
  475. Start-Sleep -s 3
  476. Remove-Item "$env:USERPROFILE\OneDrive" -Force -Recurse -ErrorAction SilentlyContinue
  477. Remove-Item "$env:LOCALAPPDATA\Microsoft\OneDrive" -Force -Recurse -ErrorAction SilentlyContinue
  478. Remove-Item "$env:PROGRAMDATA\Microsoft OneDrive" -Force -Recurse -ErrorAction SilentlyContinue
  479. If (Test-Path "$env:SYSTEMDRIVE\OneDriveTemp") {
  480.     Remove-Item "$env:SYSTEMDRIVE\OneDriveTemp" -Force -Recurse -ErrorAction SilentlyContinue
  481. }
  482. If (!(Test-Path "HKCR:")) {
  483.     New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
  484. }
  485. Remove-Item -Path "HKCR:\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" -Recurse -ErrorAction SilentlyContinue
  486. Remove-Item -Path "HKCR:\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" -Recurse -ErrorAction SilentlyContinue
  487.  
  488. # Install OneDrive
  489. # $onedrive = "$env:SYSTEMROOT\SysWOW64\OneDriveSetup.exe"
  490. # If (!(Test-Path $onedrive)) {
  491. #   $onedrive = "$env:SYSTEMROOT\System32\OneDriveSetup.exe"
  492. # }
  493. # Start-Process $onedrive -NoNewWindow
  494.  
  495. # Uninstall default bloatware... Needs to be checked
  496. Write-Host "Uninstalling default bloatware..."
  497. Get-AppxPackage "Microsoft.3DBuilder" | Remove-AppxPackage
  498. Get-AppxPackage "Microsoft.Advertising.Xaml" | Remove-AppxPackage
  499. # Get-AppxPackage "Microsoft.Windows.Cortana" | Remove-AppxPackage (Remove through features)
  500. # Get-AppxPackage "Microsoft.MicrosoftEdge" | Remove-AppxPackage (Remove through features)
  501. Get-AppxPackage "Microsoft.Services.Store.Engagement" | Remove-AppxPackage
  502. Get-AppxPackage "51518DarkProjekt.DarkNote" | Remove-AppxPackage
  503. Get-AppxPackage "AFF540DC.CurrencyConverter" | Remove-AppxPackage
  504. # Get-AppxPackage "Microsoft.XboxIdentityProvider" | Remove-AppxPackag (Cant be removed for some reason now?)
  505. Get-AppxPackage "Microsoft.StorePurchaseApp" | Remove-AppxPackage
  506. # Get-AppxPackage "Microsoft.WindowsStore" | Remove-AppxPackage
  507. # Get-AppxPackage "Windows.MiracastView" | Remove-AppxPackage (Remove through features)
  508. # Get-AppxPackage "Windows.ContactSupport" | Remove-AppxPackage (Remove through features)
  509. # Get-AppxPackage "Microsoft.XboxGameCallableUI" | Remove-AppxPackage (Remove through features)
  510. # Get-AppxPackage "Microsoft.Windows.SecondaryTileExperience" | Remove-AppxPackage
  511. # Get-AppxPackage "Microsoft.Windows.ParentalControls" | Remove-AppxPackage (Remove through features)
  512. Get-AppxPackage "Microsoft.BingFinance" | Remove-AppxPackage
  513. # Get-AppxPackage "Microsoft.BingNews" | Remove-AppxPackage
  514. Get-AppxPackage "Microsoft.BingSports" | Remove-AppxPackage
  515. Get-AppxPackage "Microsoft.BingWeather" | Remove-AppxPackage
  516. Get-AppxPackage "Microsoft.Getstarted" | Remove-AppxPackage
  517. Get-AppxPackage "Microsoft.MicrosoftOfficeHub" | Remove-AppxPackage
  518. Get-AppxPackage "Microsoft.MicrosoftSolitaireCollection" | Remove-AppxPackage
  519. Get-AppxPackage "Microsoft.Office.OneNote" | Remove-AppxPackage
  520. Get-AppxPackage "Microsoft.People" | Remove-AppxPackage
  521. Get-AppxPackage "Microsoft.SkypeApp" | Remove-AppxPackage
  522. # Get-AppxPackage "Microsoft.Windows.Photos" | Remove-AppxPackage
  523. Get-AppxPackage "Microsoft.WindowsAlarms" | Remove-AppxPackage
  524. Get-AppxPackage "Microsoft.WindowsCamera" | Remove-AppxPackage
  525. # Get-AppxPackage "microsoft.windowscommunicationsapps" | Remove-AppxPackage (This is windows Mail)
  526. Get-AppxPackage "Microsoft.WindowsMaps" | Remove-AppxPackage
  527. Get-AppxPackage "Microsoft.WindowsPhone" | Remove-AppxPackage
  528. Get-AppxPackage "Microsoft.WindowsSoundRecorder" | Remove-AppxPackage
  529. Get-AppxPackage "Microsoft.XboxApp" | Remove-AppxPackage
  530. Get-AppxPackage "Microsoft.ZuneMusic" | Remove-AppxPackage
  531. Get-AppxPackage "Microsoft.ZuneVideo" | Remove-AppxPackage
  532. Get-AppxPackage "Microsoft.AppConnector" | Remove-AppxPackage
  533. Get-AppxPackage "Microsoft.ConnectivityStore" | Remove-AppxPackage
  534. Get-AppxPackage "Microsoft.Office.Sway" | Remove-AppxPackage
  535. Get-AppxPackage "Microsoft.Messaging" | Remove-AppxPackage
  536. Get-AppxPackage "Microsoft.CommsPhone" | Remove-AppxPackage
  537. Get-AppxPackage "9E2F88E3.Twitter" | Remove-AppxPackage
  538. Get-AppxPackage "king.com.CandyCrushSodaSaga" | Remove-AppxPackage
  539. Get-AppxPackage "4DF9E0F8.Netflix" | Remove-AppxPackage
  540. Get-AppxPackage "Drawboard.DrawboardPDF" | Remove-AppxPackage
  541. # Get-AppxPackage "Microsoft.MicrosoftStickyNotes" | Remove-AppxPackage
  542. Get-AppxPackage "Microsoft.OneConnect" | Remove-AppxPackage
  543. Get-AppxPackage "D52A8D61.FarmVille2CountryEscape" | Remove-AppxPackage
  544. Get-AppxPackage "GAMELOFTSA.Asphalt8Airborne" | Remove-AppxPackage
  545. Get-AppxPackage "Microsoft.WindowsFeedbackHub" | Remove-AppxPackage
  546.  
  547. # Install default Microsoft applications..
  548. Write-Host "Needs to be checked... Installing packages"
  549. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.3DBuilder").InstallLocation)\AppXManifest.xml"
  550. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.BingFinance").InstallLocation)\AppXManifest.xml"
  551. Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.BingNews").InstallLocation)\AppXManifest.xml"
  552. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.BingSports").InstallLocation)\AppXManifest.xml"
  553. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.BingWeather").InstallLocation)\AppXManifest.xml"
  554. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Getstarted").InstallLocation)\AppXManifest.xml"
  555. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.MicrosoftOfficeHub").InstallLocation)\AppXManifest.xml"
  556. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.MicrosoftSolitaireCollection").InstallLocation)\AppXManifest.xml"
  557. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Office.OneNote").InstallLocation)\AppXManifest.xml"
  558. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.People").InstallLocation)\AppXManifest.xml"
  559. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.SkypeApp").InstallLocation)\AppXManifest.xml"
  560. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Windows.Photos").InstallLocation)\AppXManifest.xml"
  561. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsAlarms").InstallLocation)\AppXManifest.xml"
  562. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsCamera").InstallLocation)\AppXManifest.xml"
  563. Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.windowscommunicationsapps").InstallLocation)\AppXManifest.xml"
  564. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsMaps").InstallLocation)\AppXManifest.xml"
  565. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsPhone").InstallLocation)\AppXManifest.xml"
  566. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsSoundRecorder").InstallLocation)\AppXManifest.xml"
  567. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.XboxApp").InstallLocation)\AppXManifest.xml"
  568. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.ZuneMusic").InstallLocation)\AppXManifest.xml"
  569. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.ZuneVideo").InstallLocation)\AppXManifest.xml"
  570. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.AppConnector").InstallLocation)\AppXManifest.xml"
  571. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.ConnectivityStore").InstallLocation)\AppXManifest.xml"
  572. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Office.Sway").InstallLocation)\AppXManifest.xml"
  573. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Messaging").InstallLocation)\AppXManifest.xml"
  574. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.CommsPhone").InstallLocation)\AppXManifest.xml"
  575. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "9E2F88E3.Twitter").InstallLocation)\AppXManifest.xml"
  576. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "king.com.CandyCrushSodaSaga").InstallLocation)\AppXManifest.xml"
  577. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "4DF9E0F8.Netflix").InstallLocation)\AppXManifest.xml"
  578. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Drawboard.DrawboardPDF").InstallLocation)\AppXManifest.xml"
  579. Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.MicrosoftStickyNotes").InstallLocation)\AppXManifest.xml"
  580. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.OneConnect").InstallLocation)\AppXManifest.xml"
  581. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "D52A8D61.FarmVille2CountryEscape").InstallLocation)\AppXManifest.xml"
  582. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "GAMELOFTSA.Asphalt8Airborne").InstallLocation)\AppXManifest.xml"
  583. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsFeedbackHub").InstallLocation)\AppXManifest.xml"
  584. # In case you have removed them for good, you can try to restore the files using installation medium as follows
  585. # New-Item C:\Mnt -Type Directory | Out-Null
  586. # dism /Mount-Image /ImageFile:D:\sources\install.wim /index:1 /ReadOnly /MountDir:C:\Mnt
  587. # robocopy /S /SEC /R:0 "C:\Mnt\Program Files\WindowsApps" "C:\Program Files\WindowsApps"
  588. # dism /Unmount-Image /Discard /MountDir:C:\Mnt
  589. # Remove-Item -Path C:\Mnt -Recurse
  590.  
  591. # Disable Xbox DVR
  592. # New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" | Out-Null (fix this)
  593. Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Name "AllowGameDVR" -Type DWord -Value 0
  594.  
  595. # Enable Xbox DVR
  596. # New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" | Out-Null
  597. # Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Name "AllowGameDVR" -ErrorAction SilentlyContinue
  598.  
  599. # Uninstall Windows Media Player
  600. # Write-Host "Uninstalling Windows Media Player..."
  601. # dism /online /Disable-Feature /FeatureName:MediaPlayback /Quiet /NoRestart
  602.  
  603. # Install Windows Media Player
  604. # dism /online /Enable-Feature /FeatureName:MediaPlayback /Quiet /NoRestart
  605.  
  606. # Uninstall Work Folders Client
  607. Write-Host "Uninstalling Work Folders Client..."
  608. dism /online /Disable-Feature /FeatureName:WorkFolders-Client /Quiet /NoRestart
  609.  
  610. # Install Work Folders Client
  611. # dism /online /Enable-Feature /FeatureName:WorkFolders-Client /Quiet /NoRestart
  612.  
  613. # Set Photo Viewer as default for bmp, gif, jpg and png
  614. Write-Host "Setting Photo Viewer as default for bmp, gif, jpg, png and tif..."
  615. If (!(Test-Path "HKCR:")) {
  616.     New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
  617. }
  618. ForEach ($type in @("Paint.Picture", "giffile", "jpegfile", "pngfile")) {
  619.     New-Item -Path $("HKCR:\$type\shell\open") -Force | Out-Null
  620.     New-Item -Path $("HKCR:\$type\shell\open\command") | Out-Null
  621.     Set-ItemProperty -Path $("HKCR:\$type\shell\open") -Name "MuiVerb" -Type ExpandString -Value "@%ProgramFiles%\Windows Photo Viewer\photoviewer.dll,-3043"
  622.     Set-ItemProperty -Path $("HKCR:\$type\shell\open\command") -Name "(Default)" -Type ExpandString -Value "%SystemRoot%\System32\rundll32.exe `"%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll`", ImageView_Fullscreen %1"
  623. }
  624.  
  625. # Remove or reset default open action for bmp, gif, jpg and png
  626. If (!(Test-Path "HKCR:")) {
  627.   New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
  628. }
  629. Remove-Item -Path "HKCR:\Paint.Picture\shell\open" -Recurse
  630. Remove-ItemProperty -Path "HKCR:\giffile\shell\open" -Name "MuiVerb"
  631. Set-ItemProperty -Path "HKCR:\giffile\shell\open" -Name "CommandId" -Type String -Value "IE.File"
  632. Set-ItemProperty -Path "HKCR:\giffile\shell\open\command" -Name "(Default)" -Type String -Value "`"$env:SystemDrive\Program Files\Internet Explorer\iexplore.exe`" %1"
  633. Set-ItemProperty -Path "HKCR:\giffile\shell\open\command" -Name "DelegateExecute" -Type String -Value "{17FE9752-0B5A-4665-84CD-569794602F5C}"
  634. Remove-Item -Path "HKCR:\jpegfile\shell\open" -Recurse
  635. Remove-Item -Path "HKCR:\pngfile\shell\open" -Recurse
  636.  
  637. # Show Photo Viewer in "Open with..."
  638. Write-Host "Showing Photo Viewer in `"Open with...`""
  639. If (!(Test-Path "HKCR:")) {
  640.     New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
  641. }
  642. New-Item -Path "HKCR:\Applications\photoviewer.dll\shell\open\command" -Force | Out-Null
  643. New-Item -Path "HKCR:\Applications\photoviewer.dll\shell\open\DropTarget" -Force | Out-Null
  644. Set-ItemProperty -Path "HKCR:\Applications\photoviewer.dll\shell\open" -Name "MuiVerb" -Type String -Value "@photoviewer.dll,-3043"
  645. Set-ItemProperty -Path "HKCR:\Applications\photoviewer.dll\shell\open\command" -Name "(Default)" -Type ExpandString -Value "%SystemRoot%\System32\rundll32.exe `"%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll`", ImageView_Fullscreen %1"
  646. Set-ItemProperty -Path "HKCR:\Applications\photoviewer.dll\shell\open\DropTarget" -Name "Clsid" -Type String -Value "{FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}"
  647.  
  648. # Remove Photo Viewer from "Open with..."
  649. # If (!(Test-Path "HKCR:")) {
  650. #   New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
  651. # }
  652. # Remove-Item -Path "HKCR:\Applications\photoviewer.dll\shell\open" -Recurse
  653.  
  654. # Enable F8 boot menu options
  655. # Write-Host "Enabling F8 boot menu options..."
  656. # bcdedit /set `{current`} bootmenupolicy Legacy | Out-Null
  657.  
  658. # Disable F8 boot menu options
  659. # bcdedit /set `{current`} bootmenupolicy Standard | Out-Null
  660.  
  661. # Install Powershell man pages locally (low priority, uses bandwidth)
  662. # Update-Help
  663.  
  664. # Install Packages to edit Hosts file.
  665. Write-Host "Installing PsHosts CMDlet to edit hosts file. Please be Patient. This may be slow sometimes buggy"
  666. install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
  667.  
  668. Write-Host "Seting up Repository"
  669. Set-PSRepository -Name "PSGallery" -InstallationPolicy Trusted
  670.  
  671. Write-Host "Installing PSHosts Module"
  672. install-module PsHosts
  673.  
  674. Write-Host "Importing PSHosts Module"
  675. import-module PsHosts
  676.  
  677. # Hosts to block are below
  678. Write-Host "Editing Hosts File..."
  679.  
  680. # Clean old Hosts file
  681. Remove-HostEntry *
  682.  
  683. # Add Hosts Entries
  684. Add-HostEntry vortex.data.microsoft.com 127.0.0.1
  685. Add-HostEntry vortex-win.data.microsoft.com 127.0.0.1
  686. Add-HostEntry telecommand.telemetry.microsoft.com 127.0.0.1
  687. Add-HostEntry telecommand.telemetry.microsoft.com.nsatc.net 127.0.0.1
  688. Add-HostEntry oca.telemetry.microsoft.com 127.0.0.1
  689. Add-HostEntry oca.telemetry.microsoft.com.nsatc.net 127.0.0.1
  690. Add-HostEntry sqm.telemetry.microsoft.com 127.0.0.1
  691. Add-HostEntry sqm.telemetry.microsoft.com.nsatc.net 127.0.0.1
  692. Add-HostEntry watson.telemetry.microsoft.com 127.0.0.1
  693. Add-HostEntry watson.telemetry.microsoft.com.nsatc.net 127.0.0.1
  694. Add-HostEntry redir.metaservices.microsoft.com 127.0.0.1
  695. Add-HostEntry choice.microsoft.com 127.0.0.1
  696. Add-HostEntry choice.microsoft.com.nsatc.net 127.0.0.1
  697. Add-HostEntry df.telemetry.microsoft.com 127.0.0.1
  698. Add-HostEntry reports.wes.df.telemetry.microsoft.com 127.0.0.1
  699. Add-HostEntry wes.df.telemetry.microsoft.com 127.0.0.1
  700. Add-HostEntry services.wes.df.telemetry.microsoft.com 127.0.0.1
  701. Add-HostEntry sqm.df.telemetry.microsoft.com 127.0.0.1
  702. Add-HostEntry telemetry.microsoft.com 127.0.0.1
  703. Add-HostEntry watson.ppe.telemetry.microsoft.com 127.0.0.1
  704. Add-HostEntry telemetry.appex.bing.net 127.0.0.1
  705. Add-HostEntry telemetry.urs.microsoft.com 127.0.0.1
  706. Add-HostEntry telemetry.appex.bing.net:443 127.0.0.1
  707. Add-HostEntry settings-sandbox.data.microsoft.com 127.0.0.1
  708. Add-HostEntry vortex-sandbox.data.microsoft.com 127.0.0.1
  709. Add-HostEntry survey.watson.microsoft.com 127.0.0.1
  710. Add-HostEntry watson.live.com 127.0.0.1
  711. Add-HostEntry watson.microsoft.com 127.0.0.1
  712. Add-HostEntry statsfe2.ws.microsoft.com 127.0.0.1
  713. Add-HostEntry corpext.msitadfs.glbdns2.microsoft.com 127.0.0.1
  714. Add-HostEntry compatexchange.buttapp.net 127.0.0.1
  715. Add-HostEntry cs1.wpc.v0cdn.net 127.0.0.1
  716. Add-HostEntry a-0001.a-msedge.net 127.0.0.1
  717. Add-HostEntry statsfe2.update.microsoft.com.akadns.net 127.0.0.1
  718. Add-HostEntry sls.update.microsoft.com.akadns.net 127.0.0.1
  719. Add-HostEntry fe2.update.microsoft.com.akadns.net 127.0.0.1
  720. Add-HostEntry diagnostics.support.microsoft.com 127.0.0.1
  721. Add-HostEntry corp.sts.microsoft.com 127.0.0.1
  722. Add-HostEntry statsfe1.ws.microsoft.com 127.0.0.1
  723. Add-HostEntry pre.footprintpredict.com 127.0.0.1
  724. Add-HostEntry i1.services.social.microsoft.com 127.0.0.1
  725. Add-HostEntry i1.services.social.microsoft.com.nsatc.net 127.0.0.1
  726. Add-HostEntry feedback.windows.com 127.0.0.1
  727. Add-HostEntry feedback.microsoft-hohm.com 127.0.0.1
  728. Add-HostEntry feedback.search.microsoft.com 127.0.0.1
  729. Add-HostEntry ad.doubleclick.net 127.0.0.1
  730. Add-HostEntry ads.msn.com 127.0.0.1
  731. Add-HostEntry ads1.msads.net 127.0.0.1
  732. Add-HostEntry ads1.msn.com 127.0.0.1
  733. Add-HostEntry a.ads1.msn.com 127.0.0.1
  734. Add-HostEntry a.ads2.msn.com 127.0.0.1
  735. Add-HostEntry adnexus.net 127.0.0.1
  736. Add-HostEntry adnxs.com 127.0.0.1
  737. Add-HostEntry aidps.atdmt.com 127.0.0.1
  738. Add-HostEntry apps.skype.com 127.0.0.1
  739. Add-HostEntry az361816.vo.msecnd.net 127.0.0.1
  740. Add-HostEntry az512334.vo.msecnd.net 127.0.0.1
  741. Add-HostEntry a.rad.msn.com 127.0.0.1
  742. Add-HostEntry a.ads2.msads.net 127.0.0.1
  743. Add-HostEntry ac3.msn.com 127.0.0.1
  744. Add-HostEntry aka-cdn-ns.adtech.de 127.0.0.1
  745. Add-HostEntry b.rad.msn.com 127.0.0.1
  746. Add-HostEntry b.ads2.msads.net 127.0.0.1
  747. Add-HostEntry b.ads1.msn.com 127.0.0.1
  748. Add-HostEntry bs.serving-sys.com 127.0.0.1
  749. Add-HostEntry c.msn.com 127.0.0.1
  750. Add-HostEntry cdn.atdmt.com 127.0.0.1
  751. Add-HostEntry cds26.ams9.msecn.net 127.0.0.1
  752. Add-HostEntry c.atdmt.com 127.0.0.1
  753. Add-HostEntry db3aqu.atdmt.com 127.0.0.1
  754. Add-HostEntry ec.atdmt.com 127.0.0.1
  755. Add-HostEntry flex.msn.com 127.0.0.1
  756. Add-HostEntry g.msn.com 127.0.0.1
  757. Add-HostEntry h2.msn.com 127.0.0.1
  758. Add-HostEntry h1.msn.com 127.0.0.1
  759. Add-HostEntry live.rads.msn.com 127.0.0.1
  760. Add-HostEntry msntest.serving-sys.com 127.0.0.1
  761. Add-HostEntry m.adnxs.com 127.0.0.1
  762. Add-HostEntry m.hotmail.com 127.0.0.1
  763. Add-HostEntry preview.msn.com 127.0.0.1
  764. Add-HostEntry pricelist.skype.com 127.0.0.1
  765. Add-HostEntry rad.msn.com 127.0.0.1
  766. Add-HostEntry rad.live.com 127.0.0.1
  767. Add-HostEntry secure.flashtalking.com 127.0.0.1
  768. Add-HostEntry static.2mdn.net 127.0.0.1
  769. Add-HostEntry s.gateway.messenger.live.com 127.0.0.1
  770. Add-HostEntry secure.adnxs.com 127.0.0.1
  771. Add-HostEntry sO.2mdn.net 127.0.0.1
  772. Add-HostEntry ui.skype.com 127.0.0.1
  773. Add-HostEntry view.atdmt.com 127.0.0.1
  774. # The Below two domains may impact your network connectivity detection.
  775. Add-HostEntry www.msftncsi.com 127.0.0.1
  776. Add-HostEntry msftncsi.com 127.0.0.1
  777.  
  778.  
  779. # Edit Group Policy to set Chrome settings that cannot be set through registry.
  780. # Refer to https://www.powershellgallery.com/packages/PolicyFileEditor/2.0.2
  781. Write-Host "Installing PolicyFileEditor Module"
  782. Install-Module -Name PolicyFileEditor
  783.  
  784. Write-Host "Importing PolicyFileEditor Module"
  785. import-module -Name PolicyFileEditor
  786.  
  787. Write-Host "Setting Chrome Settings.. The Below is experimental still."
  788.  
  789. $MachineDir = "$env:windir\system32\GroupPolicy\Machine\registry.pol"
  790. $RegPath = 'Software\Policies\Google\Chrome'
  791. $RegName = 'AutoFillEnabled'
  792. $RegData = '0'
  793. $RegType = 'DWord'
  794. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  795.  
  796. $RegPath = 'Software\Policies\Google\Chrome'
  797. $RegName = 'HomepageLocation'
  798. $RegData = 'https://www.google.com'
  799. $RegType = 'String'
  800. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  801.  
  802. $RegPath = 'Software\Policies\Google\Chrome'
  803. $RegName = 'ProxyServerMode'
  804. $RegData = '0'
  805. $RegType = 'DWord'
  806. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  807.  
  808. $RegPath = 'Software\Policies\Google\Chrome'
  809. $RegName = 'SafeBrowsingEnabled'
  810. $RegData = '1'
  811. $RegType = 'DWord'
  812. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  813.  
  814. $RegPath = 'Software\Policies\Google\Chrome'
  815. $RegName = 'SavingBrowserHistoryDisabled'
  816. $RegData = '0'
  817. $RegType = 'DWord'
  818. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  819.  
  820. $RegPath = 'Software\Policies\Google\Chrome'
  821. $RegName = 'SearchSuggestEnabled'
  822. $RegData = '0'
  823. $RegType = 'DWord'
  824. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  825.  
  826. $RegPath = 'Software\Policies\Google\Chrome'
  827. $RegName = 'SyncDisabled'
  828. $RegData = '1'
  829. $RegType = 'DWord'
  830. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  831.  
  832. $RegPath = 'Software\Policies\Google\Chrome'
  833. $RegName = 'MetricsReportingEnabled'
  834. $RegData = '0'
  835. $RegType = 'DWord'
  836. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  837.  
  838. # Use * to disable all plugins in place of DISABLEDPLUGINID
  839. # To add more than one disabled plugin, copy the 5 lines below and mark the regname as 2..3..4..5 and so on after re-pasting.
  840. $RegPath = 'Software\Policies\Google\Chrome\DisabledPlugins'
  841. $RegName = '1'
  842. $RegData = 'DISABLEDPLUGINID'
  843. $RegType = 'String'
  844. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  845.  
  846. # Use * to disable all extensions in place of DISABLEDEXTENSIONID
  847. # To add more than one disabled extension, copy the 5 lines below and mark the regname as 2..3..4..5 and so on after re-pasting.
  848. $RegPath = 'Software\Policies\Google\Chrome\ExtensionInstallBlacklist'
  849. $RegName = '1'
  850. $RegData = 'DISABLEDEXTENSIONID'
  851. $RegType = 'String'
  852. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  853.  
  854. # Use * to ENABLE all extensions in place of ENABLEDEXTENSIONID
  855. # To add more than one enabled extension, copy the 5 lines below and mark the regname as 2..3..4..5 and so on after re-pasting.
  856. $RegPath = 'Software\Policies\Google\Chrome\ExtensionInstallWhitelist'
  857. $RegName = '1'
  858. $RegData = 'ENABLEDEXTENSIONID'
  859. $RegType = 'String'
  860. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  861.  
  862. # Use the below to blacklist URLs in chrome. You could probably use * to blacklist everything.
  863. # To add more than one URL, copy the 5 lines below and append regname with the next number in the list.. 2..3..4..5 and so on.
  864. $RegPath = 'Software\Policies\Google\Chrome\URLBlacklist'
  865. $RegName = '1'
  866. $RegData = 'www.tacos.com'
  867. $RegType = 'String'
  868. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  869.  
  870. # Use the below to whitelist URLs in chrome.
  871. # To add more than one URL, copy the 5 lines below and append regname with the next number in the list.. 2..3..4..5 and so on.
  872. $RegPath = 'Software\Policies\Google\Chrome\URLWhitelist'
  873. $RegName = '1'
  874. $RegData = '*'
  875. $RegType = 'String'
  876. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  877.  
  878. # Use the below to make a list of forced installed extensions, This will also delete any values to remove any rogue extensions as a security feature if they are within the
  879. # list of 1-10 in the policy.
  880. # To add more than one force installed extension, copy the 5 lines below and mark the regname as 2..3..4..5 and so on after re-pasting.
  881. $RegPath = 'Software\Policies\Google\Chrome\ExtensionInstallForcelist'
  882. $RegName = '1'
  883. $RegData = 'EXTENSIONID'
  884. $RegType = 'String'
  885. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 1
  886. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 2
  887. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 3
  888. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 4
  889. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 5
  890. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 6
  891. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 7
  892. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 8
  893. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 9
  894. Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 10
  895. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  896.  
  897.  
  898. $RegPath = 'Software\Policies\Google\Chrome'
  899. $RegName = '0'
  900. $RegData = 'AllowOutdatedPlugins'
  901. $RegType = 'DWord'
  902. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  903.  
  904. $RegPath = 'Software\Policies\Google\Chrome'
  905. $RegName = '0'
  906. $RegData = 'BackgroundModeEnabled'
  907. $RegType = 'DWord'
  908. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  909.  
  910. $RegPath = 'Software\Policies\Google\Chrome'
  911. $RegName = '1'
  912. $RegData = 'BookmarkBarEnabled'
  913. $RegType = 'DWord'
  914. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  915.  
  916. $RegPath = 'Software\Policies\Google\Chrome'
  917. $RegName = '1'
  918. $RegData = 'DefaultBrowserSettingEnabled'
  919. $RegType = 'DWord'
  920. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  921.  
  922. $RegPath = 'Software\Policies\Google\Chrome'
  923. $RegName = '1'
  924. $RegData = 'DeveloperToolsDisabled'
  925. $RegType = 'DWord'
  926. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  927.  
  928. $RegPath = 'Software\Policies\Google\Chrome'
  929. $RegName = '1'
  930. $RegData = 'EnableMediaRouter'
  931. $RegType = 'DWord'
  932. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  933.  
  934. $RegPath = 'Software\Policies\Google\Chrome'
  935. $RegName = '1'
  936. $RegData = 'ForceGoogleSafeSearch'
  937. $RegType = 'DWord'
  938. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  939.  
  940. $RegPath = 'Software\Policies\Google\Chrome'
  941. $RegName = '0'
  942. $RegData = 'FullscreenAllowed'
  943. $RegType = 'DWord'
  944. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  945.  
  946. $RegPath = 'Software\Policies\Google\Chrome'
  947. $RegName = '2'
  948. $RegData = 'NetworkPredictionOptions'
  949. $RegType = 'DWord'
  950. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  951.  
  952. $RegPath = 'Software\Policies\Google\Chrome'
  953. $RegName = '1'
  954. $RegData = 'SafeBrowsingEnabled'
  955. $RegType = 'DWord'
  956. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  957.  
  958. $RegPath = 'Software\Policies\Google\Chrome'
  959. $RegName = '0'
  960. $RegData = 'SafeBrowsingExtendedReportingOptInAllowed'
  961. $RegType = 'DWord'
  962. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  963.  
  964. $RegPath = 'Software\Policies\Google\Chrome'
  965. $RegName = '0'
  966. $RegData = 'SearchSuggestEnabled'
  967. $RegType = 'DWord'
  968. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  969.  
  970. $RegPath = 'Software\Policies\Google\Chrome'
  971. $RegName = '0'
  972. $RegData = 'SpellCheckServiceEnabled'
  973. $RegType = 'DWord'
  974. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  975.  
  976. $RegPath = 'Software\Policies\Google\Chrome'
  977. $RegName = 'tls1'
  978. $RegData = 'SSLVersionMin'
  979. $RegType = 'String'
  980. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  981.  
  982. $RegPath = 'Software\Policies\Google\Chrome'
  983. $RegName = '0'
  984. $RegData = 'WelcomePageOnOSUpgradeEnabled'
  985. $RegType = 'DWord'
  986. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  987.  
  988. # End Chrome GP Settings
  989. #
  990. # Begin Adobe Acrobat/Reader DC Settings
  991.  
  992. $RegPath = 'Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockdown'
  993. $RegName = '1'
  994. $RegData = 'bProtectedMode'
  995. $RegType = 'DWord'
  996. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  997.  
  998. $RegPath = 'Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockdown'
  999. $RegName = '1'
  1000. $RegData = 'bUsageMeasurement'
  1001. $RegType = 'DWord'
  1002. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1003.  
  1004. $RegPath = 'Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockdown\cIPM'
  1005. $RegName = '1'
  1006. $RegData = 'bDontShowMsgWhenViewingDoc'
  1007. $RegType = 'DWord'
  1008. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1009.  
  1010. $RegPath = 'Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockdown\cIPM'
  1011. $RegName = '0'
  1012. $RegData = 'bShowMsgAtLaunch'
  1013. $RegType = 'DWord'
  1014. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1015.  
  1016. $RegPath = 'Software\Policies\Adobe\Adobe Acrobat\2015\FeatureLockdown'
  1017. $RegName = '1'
  1018. $RegData = 'bUsageMeasurement'
  1019. $RegType = 'DWord'
  1020. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1021.  
  1022. $RegPath = 'Software\Policies\Adobe\Adobe Acrobat\2015\FeatureLockdown'
  1023. $RegName = '2'
  1024. $RegData = 'iProtectedView'
  1025. $RegType = 'DWord'
  1026. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1027.  
  1028. $RegPath = 'Software\Policies\Adobe\Adobe Acrobat\2015\FeatureLockdown\cIPM'
  1029. $RegName = '0'
  1030. $RegData = 'bShowMsgAtLaunch'
  1031. $RegType = 'DWord'
  1032. Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType
  1033.  
  1034. # End Adobe Acrobat and Reader DC Settings
  1035. #
  1036.  
  1037. # Force DEP to always on for every application (available options are: AlwaysOff, AlwaysOn, OptIn, OptOut)
  1038. Write-Host "Turning on DEP for all applications."
  1039. bcdedit /set nx AlwaysON
  1040.  
  1041. # Enable SEHOP (Exception write-protection function of DEP.)
  1042. Write-Host "Enable Exception Write-Protection SEHOP"
  1043. reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v DisableExceptionChainValidation /t REG_DWORD /d 0 /f
  1044.  
  1045. # Check Cryptography Protection
  1046. Write-Host "Checking Cryptography Protection."
  1047.  
  1048. # If the following query shows that MasterKeyLegacyCompliance is set to a non-zero number,
  1049. # then it is bad sign that hackers or malware have set this value deliberately to weaken
  1050. # the security of DPAPI-protected secrets like cached passwords or private keys.
  1051. reg query HKLM\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb /v MasterKeyLegacyCompliance
  1052.  
  1053. # Run the following command to delete the MasterKeyLegacyCompliance value, which
  1054. # is the default on Windows XP and later, and is best for security.
  1055. reg delete HKLM\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb /v MasterKeyLegacyCompliance /f
  1056.  
  1057. # Disable NetBios (Forces File Sharing over port 445 DirectSMB/stops various worms.)
  1058. Write-Host "Disabling Outdated NetBIOS Protocol..."
  1059. sc.exe config netbt start= disabled
  1060.  
  1061. # Reset NerBios Configuration to Default.
  1062. # sc.exe config netbt start= system
  1063.  
  1064. # Set LAN connection to DHCP and renew.
  1065. # netsh.exe int ip set address "Local Area Connection" dhcp
  1066. # netsh.exe int ip set dns "Local Area Connection" dhcp
  1067. # ipconfig /renew
  1068.  
  1069. # Set LAN connection to static and release.
  1070. # ipconfig /release
  1071. # netsh.exe int ip set dns "Local Area Connection" static 10.4.1.1
  1072. # netsh.exe int ip set address "Local Area Connection" static 10.4.1.1 255.255.0.0
  1073.  
  1074. # Enable IPsec NAT
  1075. Write-Host "Enabling IPSec NAT..."
  1076. reg add "HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent" /v AssumeUDPEncapsulationContextOnSendRule /t REG_DWORD /d 00000002 /f
  1077.  
  1078. # Use these commands to audit logging policies.
  1079. # auditpol.exe /get /category:*
  1080. # auditpol.exe /get /subcategory:"MPSSVC rule-level Policy Change,Filtering Platform policy change,IPsec Main Mode,IPsec Quick Mode,IPsec Extended Mode,IPsec Driver,Other System Events,Filtering Platform Packet Drop,Filtering Platform Connection"
  1081.  
  1082. # Disable a lot of security logging (See end of command)
  1083. # auditpol.exe /set /subcategory:"MPSSVC rule-level Policy Change,Filtering Platform policy change,IPsec Main Mode,IPsec Quick Mode,IPsec Extended Mode,IPsec Driver,Other System Events,Filtering Platform Packet Drop,Filtering Platform Connection" /success:Disable /failure:Disable
  1084.  
  1085. # Enable a lot of security logging (See end of command)
  1086. auditpol.exe /set /subcategory:"MPSSVC rule-level Policy Change,Filtering Platform policy change,IPsec Main Mode,IPsec Quick Mode,IPsec Extended Mode,IPsec Driver,Other System Events,Filtering Platform Packet Drop,Filtering Platform Connection" /success:Enable /failure:Enable
  1087.  
  1088. # Enable oakley IPSec Diagnostics logging.
  1089. reg add "HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent\Oakley" /v EnableLogging /t REG_DWORD /d 00000001 /f
  1090.  
  1091. # Enable Local IPSec Connections for ports 3389,135,139,445,21,20,23
  1092. Write-Host "Enabling Local Network IPSEC on this machine if supported."
  1093. netsh.exe advfirewall consec add rule name=Testing-IPSec-NETSH endpoint1=any port1=any endpoint2=localsubnet port2=3389,135,139,445,21,20,23 protocol=tcp profile=any action=requireinrequestout interfacetype=any auth1=computerpsk auth1psk=$ThePreSharedKey enable=yes
  1094.  
  1095. # Disable Local IPSec Connections for ports 3389,135,139,445,21,20,23
  1096. # Write-Host "Disabling Local Network IPSEC on this machine if supported."
  1097. # netsh.exe advfirewall consec add rule name=Testing-IPSec-NETSH endpoint1=any port1=any endpoint2=localsubnet port2=3389,135,139,445,21,20,23 protocol=tcp profile=any action=requireinrequestout interfacetype=any auth1=computerpsk auth1psk=$ThePreSharedKey enable=no
  1098.  
  1099. #
  1100. #
  1101. # The Two Lines Below Enable Superfectch and Prefetch
  1102. Write-Host "Enabling Superfetch and Prefetch..."
  1103. reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnableSuperfetch /t REG_DWORD /d 00000003 /f
  1104. reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnablePrefetcher /t REG_DWORD /d 00000003 /f
  1105.  
  1106. # The Lines Below Disable SSL!!!
  1107. Write-Host "Disabling SSL..."
  1108. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client" /f
  1109. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client" /v DisabledByDefault /t REG_DWORD /d 00000001 /f
  1110. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client" /v Enabled /t REG_DWORD /d 00000000 /f
  1111. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" /f
  1112. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" /v DisabledByDefault /t REG_DWORD /d 00000001 /f
  1113. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" /v Enabled /t REG_DWORD /d 00000000 /f
  1114. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" /f
  1115. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" /v DisabledByDefault /t REG_DWORD /d 00000001 /f
  1116. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" /v Enabled /t REG_DWORD /d 00000000 /f
  1117. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" /f
  1118. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" /v DisabledByDefault /t REG_DWORD /d 00000001 /f
  1119. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" /v Enabled /t REG_DWORD /d 00000000 /f
  1120.  
  1121. # The Lines Below Force And Enable TLS!!!
  1122. Write-Host "Forcing and Enabling TLS!!!"
  1123. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /f
  1124. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  1125. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /v Enabled /t REG_DWORD /d 0xffffffff /f
  1126. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /f
  1127. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  1128. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /v Enabled /t REG_DWORD /d 0xffffffff /f
  1129. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /f
  1130. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  1131. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /v Enabled /t REG_DWORD /d 0xffffffff /f
  1132. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /f
  1133. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  1134. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /v Enabled /t REG_DWORD /d 0xffffffff /f
  1135. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /f
  1136. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  1137. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v Enabled /t REG_DWORD /d 0xffffffff /f
  1138. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /f
  1139. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  1140. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v Enabled /t REG_DWORD /d 0xffffffff /f
  1141.  
  1142. # The Registry Parameters Below are for TCP Security, I'm not sure what some of them do.
  1143. Write-Host "Upgrading TCP Security..."
  1144. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v IPEnableRouter /t REG_DWORD /d 00000000 /f
  1145. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect /t REG_DWORD /d 00000000 /f
  1146. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v SynAttackProtect /t REG_DWORD /d 00000002 /f
  1147. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxHalfOpen /t REG_DWORD /d 00000064 /f
  1148. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxHalfOpenRetried /t REG_DWORD /d 00000050 /f
  1149. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v DisableIPSourceRouting /t REG_DWORD /d 00000002 /f
  1150. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v NoNameReleaseOnDemand /t REG_DWORD /d 00000001 /f
  1151. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableDeadGWDetect /t REG_DWORD /d 00000000 /f
  1152. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v KeepAliveTime /t REG_DWORD /d 0x000493E0 /f
  1153.  
  1154. # Disable NTFS Last-Access Timestamp
  1155. # Write-Host "Disabling NTFS Last-Access Timestamps..."
  1156. # reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v NtfsDisableLastAccessUpdate /t REG_DWORD /d 00000001 /f
  1157.  
  1158. # Enable NTFS Last-Access Timestamp
  1159. Write-Host "Enabling NTFS Last-Access Timestamps..."
  1160. reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v NtfsDisableLastAccessUpdate /t REG_DWORD /d 00000000 /f
  1161.  
  1162. # Disable IPV6
  1163. Write-Host "Disabling IPV6..."
  1164. reg add "HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters" /v DisabledComponents /t REG_DWORD /d 0xffffffff /f
  1165.  
  1166. # Enable IPV6
  1167. # Write-Host "EnTabling IPV6..."
  1168. # reg add "HKLM\SYSEM\CurrentControlSet\services\TCPIP6\Parameters" /v DisabledComponents /t REG_DWORD /d 0 /f
  1169.  
  1170. # Force High Level of Remote Desktop Encryption and TLS Authentication.
  1171. Write-Host "Requiring Strong Remote Desktop Encryption if enabled... And forcing TLS Authentication"
  1172. reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MinEncryptionLevel /t REG_DWORD /d 00000003 /f
  1173. reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer /t REG_DWORD /d 00000002 /f
  1174.  
  1175. # Disabling TCP/IP AutoTuning (see http://technet.microsoft.com/en-us/magazine/2007.01.cableguy.aspx)
  1176. Write-Host "Disabling TCP/IP Auto-Tuning..."
  1177. netsh.exe interface tcp set global autotuninglevel= disabled
  1178.  
  1179. # Enabling TCP/IP AutoTuning
  1180. # netsh.exe interface tcp set global autotuninglevel= normal
  1181.  
  1182. # Reset Firewall To factory Defaults!!!
  1183. # netsh.exe firewall reset
  1184. #
  1185.  
  1186.  
  1187.  
  1188. # Begin Java Security Setting Script
  1189. #
  1190. #
  1191.  
  1192. Write-host "The next bit of code will either enable or disable java system-wide."
  1193.  
  1194. # Construct the strings for the deployment.properties file.
  1195. # Be mindful of the below property, setting webjava to false will unisntall java and you will need to manually re-enable in IE.
  1196.  
  1197. $propertiesfile = "deployment.webjava.enabled=true "
  1198.  
  1199. # Default to locking the security level and browser plug-in state, i.e., they are visible but greyed out in Java Control Panel.
  1200. $propertiesfile += "`ndeployment.webjava.enabled.locked `ndeployment.security.level.locked "
  1201.  
  1202. # Default to security level being set to VERY_HIGH (see Security tab of Java Control Panel).
  1203. $propertiesfile += "`ndeployment.security.level=VERY_HIGH"
  1204.  
  1205.  
  1206. # Possibly delete the configuration files and exit, but leave the folder alone though.
  1207. write-host "Deleting system-wide Java configuration files, if they exist..."
  1208. remove-item $env:WinDir\Sun\Java\Deployment\deployment.config -Force
  1209. remove-item $env:WinDir\Sun\Java\Deployment\deployment.properties -Force
  1210.        
  1211.  
  1212.  
  1213. # Create the $env:WinDir\Sun\Java\Deployment folder for the system-wide Java configuration files.
  1214. New-Item -Path $env:WinDir\Sun\Java\Deployment -ItemType Directory -Force | Out-Null
  1215.  
  1216. # Create the deployment.config file.
  1217. "deployment.system.config=$env:WinDir\Sun\Java\Deployment\deployment.properties" |
  1218.     Out-File -FilePath $env:WinDir\Sun\Java\Deployment\deployment.config -Force -Encoding ASCII
  1219. if (-not $? -or -not $(Test-Path $env:WinDir\Sun\Java\Deployment\deployment.config))
  1220.    { "`nCould not create the deployment.config file, exiting.`n" ; exit -1 }
  1221.  
  1222.  
  1223. # Create the deployment.properties file.
  1224. $propertiesfile | Out-File -FilePath $env:WinDir\Sun\Java\Deployment\deployment.properties -Force -Encoding ASCII
  1225. if (-not $? -or -not $(Test-Path $env:WinDir\Sun\Java\Deployment\deployment.properties))
  1226.    { "`nCould not create the deployment.properties file, exiting.`n" ; exit -1 }
  1227.  
  1228.  
  1229. # Show system-wide deployment.properties file contents FYI.
  1230. "`nCurrent contents of the deployment.properties file:`n"
  1231. get-content $env:WinDir\Sun\Java\Deployment\deployment.properties ; "`n"
  1232.  
  1233.  
  1234.  
  1235. # Run latest ssvagent.exe for both x86 and x64, but not on Java Platform 6 or earlier, and
  1236. # hope future Javas support these switches (man, what a mess, doomed to rewrites...):
  1237. if ($propertiesfile -like '*deployment.webjava.enabled=false*')
  1238. {
  1239.     # Try the x64 version, if any:
  1240.     $ssvagent = $null
  1241.     if (Test-Path -Path "$env:ProgramFiles\Java\")
  1242.     {
  1243.         $ssvagent = dir "$env:ProgramFiles\Java\*.exe" -Recurse |
  1244.                 where { $_.name -eq 'ssvagent.exe' -and $_.fullname -notmatch '\\jre[1-6]\\'} |
  1245.                 sort LastWriteTimeUtc -desc | select -first 1
  1246.     }
  1247.  
  1248.     if ($ssvagent -ne $null)
  1249.     {
  1250.         $expression = $ssvagent.FullName.Replace("Program Files","'Program Files'") + " -disablewebjava"
  1251.         "Executing: $expression `n"
  1252.         invoke-expression -command $expression
  1253.     }
  1254.  
  1255.  
  1256.     # Now for the x86 version second, because this is the Oracle-preferred:
  1257.     $ssvagent = $null
  1258.     if (Test-Path -Path "${env:ProgramFiles(x86)}\Java\")
  1259.     {
  1260.         $ssvagent = dir "${env:ProgramFiles(x86)}\Java\*.exe" -Recurse |
  1261.                 where { $_.name -eq 'ssvagent.exe' -and $_.fullname -notmatch '\\jre[1-6]\\'} |
  1262.                 sort LastWriteTimeUtc -desc | select -first 1
  1263.     }
  1264.  
  1265.     if ($ssvagent -ne $null)
  1266.     {
  1267.         $expression = $ssvagent.FullName.Replace("Program Files (x86)","'Program Files (x86)'") + " -disablewebjava"
  1268.         "Executing: $expression `n"
  1269.         invoke-expression -command $expression
  1270.     }
  1271. }
  1272. elseif ($propertiesfile -like '*deployment.webjava.enabled=true*')
  1273. {
  1274.     # Try the x64 version, if any:
  1275.     $ssvagent = $null
  1276.     $ssvagent = dir "$env:ProgramFiles\Java\*.exe" -Recurse |
  1277.                 where { $_.name -eq 'ssvagent.exe' -and $_.fullname -notmatch '\\jre[1-6]\\'} |
  1278.                 sort LastWriteTimeUtc -desc | select -first 1
  1279.     if ($ssvagent -ne $null)
  1280.     {
  1281.         $expression = $ssvagent.FullName.Replace("Program Files","'Program Files'") + " -forceinstall -register -new -high"  #Only -high exists?
  1282.         "Executing: $expression `n"
  1283.         invoke-expression -command $expression
  1284.     }
  1285.  
  1286.     # Now for the x86 version second, to let it possibly overwrite x64 settings, since x86 is Oracle-preferred:
  1287.     $ssvagent = $null
  1288.     $ssvagent = dir "${env:ProgramFiles(x86)}\Java\*.exe" -Recurse |
  1289.                 where { $_.name -eq 'ssvagent.exe' -and $_.fullname -notmatch '\\jre[1-6]\\'} |
  1290.                 sort LastWriteTimeUtc -desc | select -first 1
  1291.     if ($ssvagent -ne $null)
  1292.     {
  1293.         $expression = $ssvagent.FullName.Replace("Program Files (x86)","'Program Files (x86)'") + " -forceinstall -register -new -high"  #Only -high exists?
  1294.         "Executing: $expression `n"
  1295.         invoke-expression -command $expression
  1296.     }
  1297. }
  1298.  
  1299. # End Java Security Settings Script
  1300. #
  1301. #
  1302.  
  1303.  
  1304.  
  1305. #
  1306. #
  1307. # Change Mac Menu
  1308.  
  1309. $Title = "Welcome"
  1310. $Info = "To Change Or Not Change Your Mac (May not support Hyper-V)"
  1311.  
  1312. $options = [System.Management.Automation.Host.ChoiceDescription[]] @("&Yes", "&No", "&Quit")
  1313. [int]$defaultchoice = 1
  1314. $opt =  $host.UI.PromptForChoice($Title , $Info , $Options,$defaultchoice)
  1315. switch($opt)
  1316. {
  1317. 0 {
  1318. #
  1319. #
  1320. # The Below Script Enable a random mac on wifi. This may not work on all computers!!! (Especially HYPER-V)
  1321.  
  1322. Write-Host "Enabling Random MAC address on WIFI!!! Please be patient... This may not work on all computers!!! (Especially HYPER-V)"
  1323. function random-mac ($ManufacturerName, $ManufacturerID, $Delimiter, [Switch] $TotallyRandom, [Switch] $LocallyAdministered, [Switch] $Multicast)
  1324. {  
  1325.     # $mac will be padded with random hex later, but add a random vendor ID by default.
  1326.     if ($TotallyRandom) { $mac = "" }  
  1327.     else
  1328.     {
  1329.         # First three bytes will come from the manufacturer ID number.
  1330.         # Some input checking of the manufacturer selection...
  1331.         if ($ManufacturerName -and $ManufacturerName.StartsWith("3")) { $ManufacturerName = "ThreeCom" }
  1332.         if ($ManufacturerName -and $ManufacturerName.ToUpper().StartsWith("D-")) { $ManufacturerName = "DLink" }
  1333.         if ($ManufacturerID -and $ManufacturerID.ToString().length -gt 12) { $ManufacturerID = $ManufacturerID.ToString().SubString(0,12) }
  1334.        
  1335.         # Manufacturer identifiers last updated on 5.Feb.2011:
  1336.         $vendor = @{
  1337.             "Netgear" = "0024B2 0026F2 30469A A021B7 C03F0E C43DC7 E0469A E091F5 000FB5 00146C 00184D 001B2F 001E2A 001F33 00223F 00095B" ;
  1338.             "DLink" = "00055D 000D88 000F3D 001195 001346 0015E9 00179A 00195B 001B11 001CF0 001E58 002191 0022B0 002401 00265A 0050BA 0080C8 14D64D 1CAFF7 1CBDB9 340804 5CD998 F07D68" ;
  1339.             "ThreeCom" = "000102 000103 00029C 00040B 00051A 00068C 000A04 000A5E 000BAC 000D54 000E6A 000FCB 00104B 00105A 0012A9 00147C 0016E0 00186E 001AC1 001CC5 001EC1 0020AF 002257 002473 002654 00301E 005004 005099 0050DA 006008 00608C 006097 009004 00A024 00D096 00D0D8 02608C 02C08C 08004E 20FDF1 4001C6" ;
  1340.             "Intel" = "0002B3 000347 000423 0007E9 000CF1 000E0C 000E35 001111 0012F0 001302 001320 0013CE 0013E8 001500 001517 00166F 001676 0016EA 0016EB 0018DE 0019D1 0019D2 001B21 001B77 001CBF 001CC0 001DE0 001DE1 001E64 001E65 001E67 001F3B 001F3C 00207B 00215C 00215D 00216A 00216B 0022FA 0022FB 002314 002315 0024D6 0024D7 0026C6 0026C7 00270E 002710 0050F1 009027 00A0C9 00AA00 00AA01 00AA02 00D0B7 081196 0CD292 100BA9 183DA2 247703 4025C2 448500 4C8093 502DA2 58946B 648099 64D4DA 685D43 74E50B 78929C 809B20 88532E 8CA982 A088B4 AC7289 BC7737 DCA971" ;
  1341.             "HP" = "0001E6 0001E7 0002A5 0004EA 000802 000883 0008C7 000A57 000BCD 000D9D 000E7F 000EB3 000F20 000F61 001083 0010E3 00110A 001185 001279 001321 001438 0014C2 001560 001635 001708 0017A4 001871 0018FE 0019BB 001A4B 001B78 001CC4 001E0B 001F29 00215A 002264 00237D 002481 0025B3 002655 00306E 0030C1 00508B 0060B0 00805F 0080A0 080009 18A905 1CC1DE 2C27D7 3C4A92 643150 68B599 78ACC0 78E3B5 78E7D1 984BE1 B499BA B8AF67 D48564 D8D385 F4CE46" ;
  1342.             "Apple" = "000393 000502 000A27 000A95 000D93 0010FA 001124 001451 0016CB 0017F2 0019E3 001B63 001CB3 001D4F 001E52 001EC2 001F5B 001FF3 0021E9 002241 002312 002332 00236C 0023DF 002436 002500 00254B 0025BC 002608 00264A 0026B0 0026BB 003065 0050E4 00A040 041E64 080007 1093E9 109ADD 18E7F4 24AB81 28E7CF 34159E 3C0754 40A6D9 40D32D 442A60 581FAA 5855CA 58B035 5C5948 60334B 60FB42 64B9E8 70CD60 78CA39 7C6D62 7CC537 7CF05F 88C663 8C5877 8C7B9D 9027E4 90840D 9803D8 A46706 A4B197 B8FF61 C42C03 C82A14 C8BCC8 CC08E0 D49A20 D83062 D89E3F D8A25E DC2B61 E0F847 E4CE8F E80688 F0B479 F81EDF" ;
  1343.             "AlliedTelesis" = "0000CD 0000F4 000941 000A79 000DDA 001130 001577 001AEB 002687 009099 00A0D2 ECCD6D" ;
  1344.             "QLogic" = "000E1E 001B32 0024FF 00C0DD 00E08B"
  1345.         }
  1346.  
  1347.         # Check that $ManufacturerName actually matches one of the valid $vendors here.
  1348.         if ($ManufacturerName -and ($vendor.keys -notcontains $ManufacturerName))
  1349.         { throw "`nYou must choose a vendor from this list:`n" + $vendor.keys }
  1350.        
  1351.         # Generate the first three bytes of the MAC or use the $ManufacturerID instead.
  1352.         if ($ManufacturerID) { $mac = $ManufacturerID.ToString().ToUpper() -replace '[^A-F0-9]',"" }
  1353.         elseif ($ManufacturerName) { $mac = get-random -input @($vendor.$ManufacturerName -split " ") }
  1354.         else { $mac = get-random -input @($vendor.$(get-random -input @($vendor.keys)) -split " ") }
  1355.     }
  1356.    
  1357.     # Now padright with random hex characters until we have twelve chars.
  1358.     while ($mac.length -lt 12)
  1359.     {
  1360.         $mac += "{0:X}" -f $(get-random -min 0 -max 16)
  1361.     }
  1362.    
  1363.     # Now set the unicast/multicast flag bit.
  1364.     # First low-order bit (right-most bit): 0 = unicast, 1 = multicast
  1365.     # For the bit flags, see http://en.wikipedia.org/wiki/MAC_address  
  1366.     [Byte] $firstbyte = "0x" + $mac.substring(0,2)      # Convert first two hex chars to a byte.
  1367.  
  1368.     if ($multicast)
  1369.     {
  1370.         $firstbyte = [Byte] $firstbyte -bor [Byte] 1     # Set low-order bit to 1: multicast
  1371.         $mac = ("{0:X}" -f $firstbyte).padleft(2,"0") + $mac.substring(2)
  1372.     }
  1373.     else
  1374.     {
  1375.         $firstbyte = [Byte] $firstbyte -band [Byte] 254  # Set low-order bit to 0: unicast
  1376.         $mac = ("{0:X}" -f $firstbyte).padleft(2,"0") + $mac.substring(2)
  1377.     }
  1378.    
  1379.    
  1380.     # Now set the vendor-unique/locally-administered flag.
  1381.     # Next-to-low-order bit (second from right): 0 = unique vendor, 1 = locally administered
  1382.     if ($locallyadministered)
  1383.     {
  1384.         $firstbyte = [Byte] $firstbyte -bor [Byte] 2     # Set second low-order bit to 1: locally
  1385.         $mac = ("{0:X}" -f $firstbyte).padleft(2,"0") + $mac.substring(2)
  1386.     }
  1387.     else
  1388.     {
  1389.         $firstbyte = [Byte] $firstbyte -band [Byte] 253  # Set second low-order bit to 0: vendor unique
  1390.         $mac = ("{0:X}" -f $firstbyte).padleft(2,"0") + $mac.substring(2)
  1391.     }
  1392.    
  1393.        
  1394.     # Add delimiter, if any, and return the $mac.
  1395.     if ($Delimiter)
  1396.     {
  1397.         for ($i = 0 ; $i -le 10 ; $i += 2)
  1398.         { $newmac += $mac.substring($i,2) + $Delimiter }
  1399.         $newmac.substring(0,$($newmac.length - $Delimiter.length))
  1400.     }
  1401.     else
  1402.     { $mac }
  1403. }
  1404.  
  1405.  
  1406. # Get the NICs which are not tunnels, not for virtual machines, and not for bluetooth.
  1407. $nics = @(Get-WmiObject -Query "select * from win32_networkadapter where adaptertype != 'Tunnel' and adaptertype is not null" | `
  1408. where { $_.description -notmatch 'VMware|Virtual|WAN Miniport|ISATAP|RAS Async|Teredo|Windows Mobile Remote|6to4|Bluetooth' } )
  1409.  
  1410. # If more than one physical NIC, prompt the user to select one, if the index number was not given.
  1411. if ($nics.count -eq 0) { "`nCannot identify a valid network interface device, quitting...`n" ; exit }
  1412. elseif ($nics.count -eq 1 -and -not $InterfaceIndexNumber) { $index = $nics[0].index }
  1413. else
  1414. {
  1415.     if ($InterfaceIndexNumber) { $index = $InterfaceIndexNumber }
  1416.     else
  1417.     {
  1418.         # Print a list of interfaces and prompt user to choose one.
  1419.         "`n"; $nics | format-table index,macaddress,netconnectionid,description -autosize
  1420.         $index = read-host -prompt "`nEnter the index number of the desired interface"
  1421.     }
  1422. }
  1423.  
  1424. # Check that a valid index number was actually entered.
  1425. $good = $false; switch ($nics | foreach {$_.index}) { $index { $good = $true } }
  1426. if (-not $good) { "`n$index is not a valid index number, quitting...`n" ; exit }
  1427.  
  1428. # Confirm that you can get the NIC by the index number, so that it can be disabled/enabled later too.
  1429. $thenic = Get-WmiObject -Query "select * from win32_networkadapter where deviceid = $index"
  1430. if (-not $?) { "`nThere was a problem getting the interface, quitting...`n" ; exit }
  1431.  
  1432. # The registry key for the nic always has four digits, so padleft, then get the key.
  1433. $index = $index.tostring().padleft(4,"0")
  1434. $regkey = get-item "hklm:\system\CurrentControlSet\control\class\{4D36E972-E325-11CE-BFC1-08002BE10318}\$index"
  1435. if (-not $?) { "`nThere was a problem getting the registry key, quitting...`n" ; exit }
  1436.  
  1437. # Show how WMI sees the current MAC address.
  1438. ("`nWMI reports the current MAC address for interface $index as " + $thenic.macaddress + ".").replace(":","")
  1439.  
  1440. # Show current registry value for MAC address, if any.
  1441. $macaddress = $regkey.getvalue("NetworkAddress")
  1442. if ($macaddress -eq $null) {"Custom MAC address registry value does not exist for interface index $index."}
  1443. else {"Current registry MAC value for interface $index is $macaddress."}
  1444.  
  1445. # If requested, delete the registry value for a custom MAC, which resets to the default burnt-in
  1446. # MAC; otherwise, set the registry value for a custom MAC address.
  1447. if ($resetdefault)
  1448. {
  1449.     if ($macaddress -ne $null)
  1450.     {
  1451.         "Deleting registry value for a custom MAC, which resets to the default MAC address."
  1452.         $regpath = "hklm:\system\CurrentControlSet\control\class\{4D36E972-E325-11CE-BFC1-08002BE10318}\$index"
  1453.         remove-itemproperty -path $regpath -name "NetworkAddress"
  1454.         if (-not $?) { "`nFAILED to delete the registry value for the MAC address!`n" ; exit }
  1455.     }
  1456. }
  1457. else
  1458. {
  1459.     # Set new value for MAC address.
  1460.     $regpath = "hklm:\system\CurrentControlSet\control\class\{4D36E972-E325-11CE-BFC1-08002BE10318}\$index"
  1461.     if ($wireless)
  1462.     {
  1463.         set-itemproperty -path $regpath -name "NetworkAddress" -value $(random-mac -locallyadministered)
  1464.     }
  1465.     else
  1466.     {
  1467.         set-itemproperty -path $regpath -name "NetworkAddress" -value $(random-mac)
  1468.     }
  1469.     if (-not $?) { "`nFAILED to set the registry value for the MAC address!`n" ; exit }
  1470.  
  1471.     # Show new registry value for MAC address.
  1472.     $macaddress = $regkey.getvalue("NetworkAddress")
  1473.     if ($macaddress -eq $null) { "`nFAILED to change the registry value for a custom MAC address`n" ; exit }
  1474.     else {"The new registry MAC value for interface $index is $macaddress."}
  1475. }
  1476.  
  1477. # Release DHCP leases, disable the interface, re-enable, renew DHCP.
  1478. if ($DoNotResetInterface)
  1479. {   "Changes will not take effect until after the interface has been disabled and enabled.`n" }
  1480. else
  1481. {
  1482.     "Refreshing the interface, this may take a few seconds..."
  1483.     ipconfig.exe /release """$($thenic.netconnectionid)"""   | out-null
  1484.     ipconfig.exe /release6 """$($thenic.netconnectionid)"""  | out-null
  1485.     $thenic.disable() | out-null
  1486.     if (-not $?) { "FAILED to disable the interface!" }
  1487.     $thenic.enable() | out-null
  1488.     if (-not $?) { "FAILED to enable the interface!" }
  1489.     ipconfig.exe /renew """$($thenic.netconnectionid)"""  | out-null
  1490.     ipconfig.exe /renew6 """$($thenic.netconnectionid)""" | out-null
  1491.     "...done refreshing the interface."
  1492.  
  1493.     # Confirm through WMI again that the change actually took effect.
  1494.     $thenic = Get-WmiObject -Query "select * from win32_networkadapter where deviceid = $index"
  1495.     ("WMI reports the current MAC address for interface $index as " + $thenic.macaddress + ".`n").replace(":","")
  1496. }
  1497.  
  1498. # END-MAC-SCRIPT
  1499.  
  1500. ##########
  1501. # Restart
  1502. ##########
  1503. Write-Host
  1504. Write-Host "Press any key to restart your system..." -ForegroundColor Black -BackgroundColor White
  1505. $key = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
  1506. Write-Host "Restarting..."
  1507. Restart-Computer
  1508. }
  1509.  
  1510. 1 {
  1511. Write-Host
  1512. Write-Host "Press any key to restart your system..." -ForegroundColor Black -BackgroundColor White
  1513. $key = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
  1514. Write-Host "Restarting..."
  1515. Restart-Computer
  1516. }
  1517. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!