API tools faq
paste
Advertisement
TheRoboKitten

Windows 10 Security/Hardening Powershell Script 3.5

TheRoboKitten
Mar 13th, 2017
750
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PowerShell 72.17 KB | None | 0 0
raw download clone embed print report
  1. ##########
  2. # Win10 Initial Setup Script
  3. # Author: Disassembler <[email protected]>
  4. # Edited by Gr1D:
  5. # dasm's script: https://github.com/Disassembler0/Win10-Initial-Setup-Script/
  6.  
  7. # THIS IS A PERSONALIZED VERSION AND NEEDS SOME DEBUGGING
  8. # This script leaves more MS defaults on, including MSE and smartscreen,
  9. # but blocks a ton of domains and disables remote assistance secures java, sets up ipsec..
  10. # (please set your own key) and disables SSL. Even changes your mac.
  11.  
  12. # NOTE: READ THIS SCRIPT CAREFULLY BEFORE RUNNING IT. ADJUST COMMENTS AS APPROPRIATE.
  13. # This script will reboot your machine when completed.
  14. # Setting up a new machine? See http://ninite.com (for devs, http://chocolatey.org)
  15. ##########
  16.  
  17. # Ask for elevated permissions if required
  18. If (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")) {
  19.     Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs
  20.     Exit
  21. }
  22.  
  23.  
  24.  
  25. ##########
  26. # Privacy Settings
  27. ##########
  28.  
  29. # Disable Telemetry
  30. # Disable Telemetry
  31. Write-Host "Disabling Telemetry..."
  32. Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 0
  33. Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 0
  34. Set-ItemProperty -Path "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 0
  35.  
  36. # Enable Telemetry
  37. # Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 3
  38. # Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 3
  39. # Set-ItemProperty -Path "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 3
  40.  
  41. # Disable Wi-Fi Sense
  42. Write-Host "Disabling Wi-Fi Sense..."
  43. If (!(Test-Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting")) {
  44.     New-Item -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" -Force | Out-Null
  45. }
  46. Set-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" -Name "Value" -Type DWord -Value 0
  47. Set-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotspots" -Name "Value" -Type DWord -Value 0
  48.  
  49. # Enable Wi-Fi Sense
  50. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" -Name "Value" -Type DWord -Value 1
  51. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotspots" -Name "Value" -Type DWord -Value 1
  52.  
  53. # Disable SmartScreen Filter
  54. # Write-Host "Disabling SmartScreen Filter..."
  55. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer" -Name "SmartScreenEnabled" -Type String -Value "Off"
  56. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AppHost" -Name "EnableWebContentEvaluation" -Type DWord -Value 0
  57.  
  58. # Enable SmartScreen Filter
  59. Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer" -Name "SmartScreenEnabled" -Type String -Value "RequireAdmin"
  60. Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AppHost" -Name "EnableWebContentEvaluation"
  61.  
  62. # Disable Bing Search in Start Menu
  63. Write-Host "Disabling Bing Search in Start Menu..."
  64. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "BingSearchEnabled" -Type DWord -Value 0
  65.  
  66. # Enable Bing Search in Start Menu
  67. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "BingSearchEnabled"
  68.  
  69. # Disable Start Menu suggestions
  70. Write-Host "Disabling Start Menu suggestions..."
  71. Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" -Name "SystemPaneSuggestionsEnabled" -Type DWord -Value 0
  72.  
  73. # Enable Start Menu suggestions
  74. # Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" -Name "SystemPaneSuggestionsEnabled" -Type DWord -Value 1
  75.  
  76. # Disable Location Tracking
  77. Write-Host "Disabling Location Tracking..."
  78. Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Sensor\Overrides\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}" -Name "SensorPermissionState" -Type DWord -Value 0
  79. Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\lfsvc\Service\Configuration" -Name "Status" -Type DWord -Value 0
  80.  
  81. # Enable Location Tracking
  82. # Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Sensor\Overrides\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}" -Name "SensorPermissionState" -Type DWord -Value 1
  83. # Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\lfsvc\Service\Configuration" -Name "Status" -Type DWord -Value 1
  84.  
  85. # Disable Feedback
  86. Write-Host "Disabling Feedback..."
  87. If (!(Test-Path "HKCU:\Software\Microsoft\Siuf\Rules")) {
  88.     New-Item -Path "HKCU:\Software\Microsoft\Siuf\Rules" -Force | Out-Null
  89. }
  90. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Siuf\Rules" -Name "NumberOfSIUFInPeriod" -Type DWord -Value 0
  91.  
  92. # Enable Feedback
  93. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Siuf\Rules" -Name "NumberOfSIUFInPeriod"
  94.  
  95. # Disable Advertising ID
  96. Write-Host "Disabling Advertising ID..."
  97. If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo")) {
  98.     New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" | Out-Null
  99. }
  100. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" -Name "Enabled" -Type DWord -Value 0
  101.  
  102. # Enable Advertising ID
  103. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" -Name "Enabled"
  104.  
  105. # Disable Cortana
  106. Write-Host "Disabling Cortana..."
  107. If (!(Test-Path "HKCU:\Software\Microsoft\Personalization\Settings")) {
  108.     New-Item -Path "HKCU:\Software\Microsoft\Personalization\Settings" -Force | Out-Null
  109. }
  110. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Personalization\Settings" -Name "AcceptedPrivacyPolicy" -Type DWord -Value 0
  111. If (!(Test-Path "HKCU:\Software\Microsoft\InputPersonalization")) {
  112.     New-Item -Path "HKCU:\Software\Microsoft\InputPersonalization" -Force | Out-Null
  113. }
  114. Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization" -Name "RestrictImplicitTextCollection" -Type DWord -Value 1
  115. Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization" -Name "RestrictImplicitInkCollection" -Type DWord -Value 1
  116. If (!(Test-Path "HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore")) {
  117.     New-Item -Path "HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore" -Force | Out-Null
  118. }
  119. Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore" -Name "HarvestContacts" -Type DWord -Value 0
  120.  
  121. # Enable Cortana
  122. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Personalization\Settings" -Name "AcceptedPrivacyPolicy"
  123. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization" -Name "RestrictImplicitTextCollection" -Type DWord -Value 0
  124. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization" -Name "RestrictImplicitInkCollection" -Type DWord -Value 0
  125. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore" -Name "HarvestContacts"
  126.  
  127. # Restrict Windows Update P2P only to local network
  128. Write-Host "Restricting Windows Update P2P only to local network..."
  129. Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" -Name "DODownloadMode" -Type DWord -Value 1
  130. If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization")) {
  131.     New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization" | Out-Null
  132. }
  133. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization" -Name "SystemSettingsDownloadMode" -Type DWord -Value 3
  134.  
  135. # Unrestrict Windows Update P2P
  136. # Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" -Name "DODownloadMode"
  137. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization" -Name "SystemSettingsDownloadMode"
  138.  
  139. # Remove AutoLogger file and restrict directory
  140. Write-Host "Removing AutoLogger file and restricting directory..."
  141. $autoLoggerDir = "$env:PROGRAMDATA\Microsoft\Diagnosis\ETLLogs\AutoLogger"
  142. If (Test-Path "$autoLoggerDir\AutoLogger-Diagtrack-Listener.etl") {
  143.     Remove-Item "$autoLoggerDir\AutoLogger-Diagtrack-Listener.etl"
  144. }
  145. icacls $autoLoggerDir /deny SYSTEM:`(OI`)`(CI`)F | Out-Null
  146.  
  147. # Unrestrict AutoLogger directory
  148. # $autoLoggerDir = "$env:PROGRAMDATA\Microsoft\Diagnosis\ETLLogs\AutoLogger"
  149. # icacls $autoLoggerDir /grant:r SYSTEM:`(OI`)`(CI`)F | Out-Null
  150.  
  151. # Stop and disable Diagnostics Tracking Service
  152. Write-Host "Stopping and disabling Diagnostics Tracking Service..."
  153. Stop-Service "DiagTrack"
  154. Set-Service "DiagTrack" -StartupType Disabled
  155.  
  156. # Enable and start Diagnostics Tracking Service
  157. # Set-Service "DiagTrack" -StartupType Automatic
  158. # Start-Service "DiagTrack"
  159.  
  160. # Stop and disable WAP Push Service
  161. Write-Host "Stopping and disabling WAP Push Service..."
  162. Stop-Service "dmwappushservice"
  163. Set-Service "dmwappushservice" -StartupType Disabled
  164.  
  165. # Enable and start WAP Push Service
  166. # Set-Service "dmwappushservice" -StartupType Automatic
  167. # Start-Service "dmwappushservice"
  168. # Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\dmwappushservice" -Name "DelayedAutoStart" -Type DWord -Value 1
  169.  
  170.  
  171.  
  172. ##########
  173. # Service Tweaks
  174. ##########
  175.  
  176. # Lower UAC level
  177. # Write-Host "Lowering UAC level..."
  178. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Type DWord -Value 0
  179. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "PromptOnSecureDesktop" -Type DWord -Value 0
  180.  
  181. # Raise UAC level
  182. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Type DWord -Value 5
  183. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "PromptOnSecureDesktop" -Type DWord -Value 1
  184.  
  185. # Enable sharing mapped drives between users
  186. # Write-Host "Enabling sharing mapped drives between users..."
  187. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLinkedConnections" -Type DWord -Value 1
  188.  
  189. # Disable sharing mapped drives between users
  190. Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLinkedConnections"
  191.  
  192. # Disable Firewall
  193. # Write-Host "Disabling Firewall..."
  194. # Set-NetFirewallProfile -Profile * -Enabled False
  195.  
  196. # Enable Firewall
  197. Set-NetFirewallProfile -Profile * -Enabled True
  198.  
  199. # Disable Windows Defender
  200. # Write-Host "Disabling Windows Defender..."
  201. # Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Type DWord -Value 1
  202.  
  203. # Enable Windows Defender
  204. Remove-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware"
  205.  
  206. # Disable Windows Update automatic restart
  207. Write-Host "Disabling Windows Update automatic restart..."
  208. Set-ItemProperty -Path "HKLM:\Software\Microsoft\WindowsUpdate\UX\Settings" -Name "UxOption" -Type DWord -Value 1
  209.  
  210. # Enable Windows Update automatic restart
  211. # Set-ItemProperty -Path "HKLM:\Software\Microsoft\WindowsUpdate\UX\Settings" -Name "UxOption" -Type DWord -Value 0
  212.  
  213. # Stop and disable Home Groups services
  214. Write-Host "Stopping and disabling Home Groups services..."
  215. Stop-Service "HomeGroupListener"
  216. Set-Service "HomeGroupListener" -StartupType Disabled
  217. Stop-Service "HomeGroupProvider"
  218. Set-Service "HomeGroupProvider" -StartupType Disabled
  219.  
  220. # Enable and start Home Groups services
  221. # Set-Service "HomeGroupListener" -StartupType Manual
  222. # Set-Service "HomeGroupProvider" -StartupType Manual
  223. # Start-Service "HomeGroupProvider"
  224.  
  225. # Disable Remote Assistance
  226. Write-Host "Disabling Remote Assistance..."
  227. Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Remote Assistance" -Name "fAllowToGetHelp" -Type DWord -Value 0
  228.  
  229. # Enable Remote Assistance
  230. # Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Remote Assistance" -Name "fAllowToGetHelp" -Type DWord -Value 1
  231.  
  232. # Enable Remote Desktop w/o Network Level Authentication
  233. # Write-Host "Enabling Remote Desktop w/o Network Level Authentication..."
  234. # Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Type DWord -Value 0
  235. # Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication" -Type DWord -Value 0
  236.  
  237. # Disable Remote Desktop
  238. Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Type DWord -Value 1
  239. Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication" -Type DWord -Value 1
  240.  
  241.  
  242.  
  243. ##########
  244. # UI Tweaks
  245. ##########
  246.  
  247. # Disable Action Center
  248. Write-Host "Disabling Action Center..."
  249. If (!(Test-Path "HKCU:\Software\Policies\Microsoft\Windows\Explorer")) {
  250.   New-Item -Path "HKCU:\Software\Policies\Microsoft\Windows\Explorer" | Out-Null
  251. }
  252. Set-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Windows\Explorer" -Name "DisableNotificationCenter" -Type DWord -Value 1
  253. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\PushNotifications" -Name "ToastEnabled" -Type DWord -Value 0
  254.  
  255. # Enable Action Center
  256. # Remove-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Windows\Explorer" -Name "DisableNotificationCenter"
  257. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\PushNotifications" -Name "ToastEnabled"
  258.  
  259. # Disable Lock screen
  260. # Write-Host "Disabling Lock screen..."
  261. # If (!(Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization")) {
  262. #   New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" | Out-Null
  263. # }
  264. # Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" -Name "NoLockScreen" -Type DWord -Value 1
  265.  
  266. # Enable Lock screen
  267. Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" -Name "NoLockScreen"
  268.  
  269. # Disable Lock screen (Anniversary Update workaround)
  270. #If ([System.Environment]::OSVersion.Version.Build -gt 14392) { # Apply only for Redstone 1 or newer
  271. #   $service = New-Object -com Schedule.Service
  272. #   $service.Connect()
  273. #   $task = $service.NewTask(0)
  274. #   $task.Settings.DisallowStartIfOnBatteries = $false
  275. #   $trigger = $task.Triggers.Create(9)
  276. #   $trigger = $task.Triggers.Create(11)
  277. #   $trigger.StateChange = 8
  278. #   $action = $task.Actions.Create(0)
  279. #   $action.Path = "reg.exe"
  280. #   $action.Arguments = "add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData /t REG_DWORD /v AllowLockScreen /d 0 /f"
  281. #   $service.GetFolder("\").RegisterTaskDefinition("Disable LockScreen", $task, 6, "NT AUTHORITY\SYSTEM", $null, 4) | Out-Null
  282. #}
  283.  
  284. # Enable Lock screen (Anniversary Update workaround)
  285. #If ([System.Environment]::OSVersion.Version.Build -gt 14392) { # Apply only for Redstone 1 or newer
  286. #   Unregister-ScheduledTask -TaskName "Disable LockScreen" -Confirm:$false -ErrorAction SilentlyContinue
  287. #}
  288.  
  289. # Disable Autoplay
  290. Write-Host "Disabling Autoplay..."
  291. Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers" -Name "DisableAutoplay" -Type DWord -Value 1
  292.  
  293. # Enable Autoplay
  294. # Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers" -Name "DisableAutoplay" -Type DWord -Value 0
  295.  
  296. # Disable Autorun for all drives
  297. Write-Host "Disabling Autorun for all drives..."
  298. If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer")) {
  299.   New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" | Out-Null
  300. }
  301. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoDriveTypeAutoRun" -Type DWord -Value 255
  302.  
  303. # Enable Autorun
  304. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoDriveTypeAutoRun"
  305.  
  306. #Disable Sticky keys prompt
  307. Write-Host "Disabling Sticky keys prompt..."
  308. Set-ItemProperty -Path "HKCU:\Control Panel\Accessibility\StickyKeys" -Name "Flags" -Type String -Value "506"
  309.  
  310. # Enable Sticky keys prompt
  311. # Set-ItemProperty -Path "HKCU:\Control Panel\Accessibility\StickyKeys" -Name "Flags" -Type String -Value "510"
  312.  
  313. # Hide Search button / box
  314. Write-Host "Hiding Search Box / Button..."
  315. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "SearchboxTaskbarMode" -Type DWord -Value 0
  316.  
  317. # Show Search button / box
  318. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "SearchboxTaskbarMode"
  319.  
  320. # Hide Task View button
  321. # Write-Host "Hiding Task View button..."
  322. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "ShowTaskViewButton" -Type DWord -Value 0
  323.  
  324. # Show Task View button
  325. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "ShowTaskViewButton"
  326.  
  327. # Show small icons in taskbar
  328. # Write-Host "Showing small icons in taskbar..."
  329. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarSmallIcons" -Type DWord -Value 1
  330.  
  331. # Show large icons in taskbar
  332. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarSmallIcons"
  333.  
  334. # Show titles in taskbar
  335. # Write-Host "Showing titles in taskbar..."
  336. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarGlomLevel" -Type DWord -Value 1
  337.  
  338. # Hide titles in taskbar
  339. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarGlomLevel"
  340.  
  341. # Show all tray icons
  342. # write-Host "Showing all tray icons..."
  343. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer" -Name "EnableAutoTray" -Type DWord -Value 0
  344.  
  345. # Hide tray icons as needed
  346. Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer" -Name "EnableAutoTray"
  347.  
  348. # Show known file extensions
  349. Write-Host "Showing known file extensions..."
  350. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "HideFileExt" -Type DWord -Value 0
  351.  
  352. # Hide known file extensions
  353. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "HideFileExt" -Type DWord -Value 1
  354.  
  355. # Show hidden files
  356. Write-Host "Showing hidden files..."
  357. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "Hidden" -Type DWord -Value 1
  358.  
  359. # Hide hidden files
  360. # Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "Hidden" -Type DWord -Value 2
  361.  
  362. # Change default Explorer view to "Computer"
  363. Write-Host "Changing default Explorer view to `"Computer`"..."
  364. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "LaunchTo" -Type DWord -Value 1
  365.  
  366. # Change default Explorer view to "Quick Access"
  367. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "LaunchTo"
  368.  
  369. # Show Computer shortcut on desktop
  370. Write-Host "Showing Computer shortcut on desktop..."
  371. If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu")) {
  372.   New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" | Out-Null
  373. }
  374. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" -Type DWord -Value 0
  375. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" -Type DWord -Value 0
  376.  
  377. # Hide Computer shortcut from desktop
  378. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"
  379. # Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"
  380.  
  381. # Remove Desktop icon from computer namespace
  382. # Write-Host "Removing Desktop icon from computer namespace..."
  383. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}" -Recurse -ErrorAction SilentlyContinue
  384.  
  385. # Add Desktop icon to computer namespace
  386. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"
  387.  
  388. # Remove Documents icon from computer namespace
  389. # Write-Host "Removing Documents icon from computer namespace..."
  390. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{d3162b92-9365-467a-956b-92703aca08af}" -Recurse -ErrorAction SilentlyContinue
  391. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}" -Recurse -ErrorAction SilentlyContinue
  392.  
  393. # Add Documents icon to computer namespace
  394. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{d3162b92-9365-467a-956b-92703aca08af}"
  395. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}"
  396.  
  397. # Remove Downloads icon from computer namespace
  398. # Write-Host "Removing Downloads icon from computer namespace..."
  399. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{088e3905-0323-4b02-9826-5d99428e115f}" -Recurse -ErrorAction SilentlyContinue
  400. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{374DE290-123F-4565-9164-39C4925E467B}" -Recurse -ErrorAction SilentlyContinue
  401.  
  402. # Add Downloads icon to computer namespace
  403. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{088e3905-0323-4b02-9826-5d99428e115f}"
  404. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{374DE290-123F-4565-9164-39C4925E467B}"
  405.  
  406. # Remove Music icon from computer namespace
  407. # Write-Host "Removing Music icon from computer namespace..."
  408. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}" -Recurse -ErrorAction SilentlyContinue
  409. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}" -Recurse -ErrorAction SilentlyContinue
  410.  
  411. # Add Music icon to computer namespace
  412. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}"
  413. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}"
  414.  
  415. # Remove Pictures icon from computer namespace
  416. # Write-Host "Removing Pictures icon from computer namespace..."
  417. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}" -Recurse -ErrorAction SilentlyContinue
  418. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}" -Recurse -ErrorAction SilentlyContinue
  419.  
  420. # Add Pictures icon to computer namespace
  421. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}"
  422. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}"
  423.  
  424. # Remove Videos icon from computer namespace
  425. # Write-Host "Removing Videos icon from computer namespace..."
  426. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}" -Recurse -ErrorAction SilentlyContinue
  427. # Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A0953C92-50DC-43bf-BE83-3742FED03C9C}" -Recurse -ErrorAction SilentlyContinue
  428.  
  429. # Add Videos icon to computer namespace
  430. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}"
  431. # New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A0953C92-50DC-43bf-BE83-3742FED03C9C}"
  432.  
  433. ## Add secondary en-US keyboard
  434. #Write-Host "Adding secondary en-US keyboard..."
  435. #$langs = Get-WinUserLanguageList
  436. #$langs.Add("en-US")
  437. #Set-WinUserLanguageList $langs -Force
  438.  
  439. # Remove secondary en-US keyboard
  440. Set-WinUserLanguageList En-US -Force
  441.  
  442.  
  443.  
  444. ##########
  445. # Remove unwanted applications
  446. ##########
  447.  
  448. # Disable OneDrive
  449. Write-Host "Disabling OneDrive..."
  450. If (!(Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive")) {
  451.     New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" | Out-Null
  452. }
  453. Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" -Name "DisableFileSyncNGSC" -Type DWord -Value 1
  454.  
  455. # Enable OneDrive
  456. # Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" -Name "DisableFileSyncNGSC"
  457.  
  458. # Uninstall OneDrive
  459. Write-Host "Uninstalling OneDrive..."
  460. Stop-Process -Name OneDrive -ErrorAction SilentlyContinue
  461. Start-Sleep -s 3
  462. $onedrive = "$env:SYSTEMROOT\SysWOW64\OneDriveSetup.exe"
  463. If (!(Test-Path $onedrive)) {
  464.     $onedrive = "$env:SYSTEMROOT\System32\OneDriveSetup.exe"
  465. }
  466. Start-Process $onedrive "/uninstall" -NoNewWindow -Wait
  467. Start-Sleep -s 3
  468. Stop-Process -Name explorer -ErrorAction SilentlyContinue
  469. Start-Sleep -s 3
  470. Remove-Item "$env:USERPROFILE\OneDrive" -Force -Recurse -ErrorAction SilentlyContinue
  471. Remove-Item "$env:LOCALAPPDATA\Microsoft\OneDrive" -Force -Recurse -ErrorAction SilentlyContinue
  472. Remove-Item "$env:PROGRAMDATA\Microsoft OneDrive" -Force -Recurse -ErrorAction SilentlyContinue
  473. If (Test-Path "$env:SYSTEMDRIVE\OneDriveTemp") {
  474.     Remove-Item "$env:SYSTEMDRIVE\OneDriveTemp" -Force -Recurse -ErrorAction SilentlyContinue
  475. }
  476. If (!(Test-Path "HKCR:")) {
  477.     New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
  478. }
  479. Remove-Item -Path "HKCR:\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" -Recurse -ErrorAction SilentlyContinue
  480. Remove-Item -Path "HKCR:\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" -Recurse -ErrorAction SilentlyContinue
  481.  
  482. # Install OneDrive
  483. # $onedrive = "$env:SYSTEMROOT\SysWOW64\OneDriveSetup.exe"
  484. # If (!(Test-Path $onedrive)) {
  485. #   $onedrive = "$env:SYSTEMROOT\System32\OneDriveSetup.exe"
  486. # }
  487. # Start-Process $onedrive -NoNewWindow
  488.  
  489. # Uninstall default bloatware
  490. Write-Host "Uninstalling default bloatware..."
  491. Get-AppxPackage "Microsoft.3DBuilder" | Remove-AppxPackage
  492. Get-AppxPackage "Microsoft.Advertising.Xaml" | Remove-AppxPackage
  493. # Get-AppxPackage "Microsoft.Windows.Cortana" | Remove-AppxPackage (Remove through features)
  494. # Get-AppxPackage "Microsoft.MicrosoftEdge" | Remove-AppxPackage (Remove through features)
  495. Get-AppxPackage "Microsoft.Services.Store.Engagement" | Remove-AppxPackage
  496. Get-AppxPackage "51518DarkProjekt.DarkNote" | Remove-AppxPackage
  497. Get-AppxPackage "AFF540DC.CurrencyConverter" | Remove-AppxPackage
  498. Get-AppxPackage "Microsoft.XboxIdentityProvider" | Remove-AppxPackage
  499. Get-AppxPackage "Microsoft.StorePurchaseApp" | Remove-AppxPackage
  500. # Get-AppxPackage "Microsoft.WindowsStore" | Remove-AppxPackage
  501. # Get-AppxPackage "Windows.MiracastView" | Remove-AppxPackage (Remove through features)
  502. # Get-AppxPackage "Windows.ContactSupport" | Remove-AppxPackage (Remove through features)
  503. # Get-AppxPackage "Microsoft.XboxGameCallableUI" | Remove-AppxPackage (Remove through features)
  504. # Get-AppxPackage "Microsoft.Windows.SecondaryTileExperience" | Remove-AppxPackage
  505. # Get-AppxPackage "Microsoft.Windows.ParentalControls" | Remove-AppxPackage (Remove through features)
  506. Get-AppxPackage "Microsoft.BingFinance" | Remove-AppxPackage
  507. # Get-AppxPackage "Microsoft.BingNews" | Remove-AppxPackage
  508. Get-AppxPackage "Microsoft.BingSports" | Remove-AppxPackage
  509. Get-AppxPackage "Microsoft.BingWeather" | Remove-AppxPackage
  510. Get-AppxPackage "Microsoft.Getstarted" | Remove-AppxPackage
  511. Get-AppxPackage "Microsoft.MicrosoftOfficeHub" | Remove-AppxPackage
  512. Get-AppxPackage "Microsoft.MicrosoftSolitaireCollection" | Remove-AppxPackage
  513. Get-AppxPackage "Microsoft.Office.OneNote" | Remove-AppxPackage
  514. Get-AppxPackage "Microsoft.People" | Remove-AppxPackage
  515. Get-AppxPackage "Microsoft.SkypeApp" | Remove-AppxPackage
  516. Get-AppxPackage "Microsoft.Windows.Photos" | Remove-AppxPackage
  517. Get-AppxPackage "Microsoft.WindowsAlarms" | Remove-AppxPackage
  518. Get-AppxPackage "Microsoft.WindowsCamera" | Remove-AppxPackage
  519. Get-AppxPackage "microsoft.windowscommunicationsapps" | Remove-AppxPackage
  520. Get-AppxPackage "Microsoft.WindowsMaps" | Remove-AppxPackage
  521. Get-AppxPackage "Microsoft.WindowsPhone" | Remove-AppxPackage
  522. Get-AppxPackage "Microsoft.WindowsSoundRecorder" | Remove-AppxPackage
  523. Get-AppxPackage "Microsoft.XboxApp" | Remove-AppxPackage
  524. Get-AppxPackage "Microsoft.ZuneMusic" | Remove-AppxPackage
  525. Get-AppxPackage "Microsoft.ZuneVideo" | Remove-AppxPackage
  526. Get-AppxPackage "Microsoft.AppConnector" | Remove-AppxPackage
  527. Get-AppxPackage "Microsoft.ConnectivityStore" | Remove-AppxPackage
  528. Get-AppxPackage "Microsoft.Office.Sway" | Remove-AppxPackage
  529. Get-AppxPackage "Microsoft.Messaging" | Remove-AppxPackage
  530. Get-AppxPackage "Microsoft.CommsPhone" | Remove-AppxPackage
  531. Get-AppxPackage "9E2F88E3.Twitter" | Remove-AppxPackage
  532. Get-AppxPackage "king.com.CandyCrushSodaSaga" | Remove-AppxPackage
  533. Get-AppxPackage "4DF9E0F8.Netflix" | Remove-AppxPackage
  534. Get-AppxPackage "Drawboard.DrawboardPDF" | Remove-AppxPackage
  535. # Get-AppxPackage "Microsoft.MicrosoftStickyNotes" | Remove-AppxPackage
  536. Get-AppxPackage "Microsoft.OneConnect" | Remove-AppxPackage
  537. Get-AppxPackage "D52A8D61.FarmVille2CountryEscape" | Remove-AppxPackage
  538. Get-AppxPackage "GAMELOFTSA.Asphalt8Airborne" | Remove-AppxPackage
  539. Get-AppxPackage "Microsoft.WindowsFeedbackHub" | Remove-AppxPackage
  540.  
  541. # Install default Microsoft applications
  542. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.3DBuilder").InstallLocation)\AppXManifest.xml"
  543. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.BingFinance").InstallLocation)\AppXManifest.xml"
  544. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.BingNews").InstallLocation)\AppXManifest.xml"
  545. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.BingSports").InstallLocation)\AppXManifest.xml"
  546. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.BingWeather").InstallLocation)\AppXManifest.xml"
  547. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Getstarted").InstallLocation)\AppXManifest.xml"
  548. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.MicrosoftOfficeHub").InstallLocation)\AppXManifest.xml"
  549. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.MicrosoftSolitaireCollection").InstallLocation)\AppXManifest.xml"
  550. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Office.OneNote").InstallLocation)\AppXManifest.xml"
  551. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.People").InstallLocation)\AppXManifest.xml"
  552. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.SkypeApp").InstallLocation)\AppXManifest.xml"
  553. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Windows.Photos").InstallLocation)\AppXManifest.xml"
  554. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsAlarms").InstallLocation)\AppXManifest.xml"
  555. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsCamera").InstallLocation)\AppXManifest.xml"
  556. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.windowscommunicationsapps").InstallLocation)\AppXManifest.xml"
  557. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsMaps").InstallLocation)\AppXManifest.xml"
  558. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsPhone").InstallLocation)\AppXManifest.xml"
  559. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsSoundRecorder").InstallLocation)\AppXManifest.xml"
  560. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.XboxApp").InstallLocation)\AppXManifest.xml"
  561. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.ZuneMusic").InstallLocation)\AppXManifest.xml"
  562. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.ZuneVideo").InstallLocation)\AppXManifest.xml"
  563. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.AppConnector").InstallLocation)\AppXManifest.xml"
  564. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.ConnectivityStore").InstallLocation)\AppXManifest.xml"
  565. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Office.Sway").InstallLocation)\AppXManifest.xml"
  566. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Messaging").InstallLocation)\AppXManifest.xml"
  567. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.CommsPhone").InstallLocation)\AppXManifest.xml"
  568. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "9E2F88E3.Twitter").InstallLocation)\AppXManifest.xml"
  569. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "king.com.CandyCrushSodaSaga").InstallLocation)\AppXManifest.xml"
  570. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "4DF9E0F8.Netflix").InstallLocation)\AppXManifest.xml"
  571. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Drawboard.DrawboardPDF").InstallLocation)\AppXManifest.xml"
  572. Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.MicrosoftStickyNotes").InstallLocation)\AppXManifest.xml"
  573. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.OneConnect").InstallLocation)\AppXManifest.xml"
  574. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "D52A8D61.FarmVille2CountryEscape").InstallLocation)\AppXManifest.xml"
  575. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "GAMELOFTSA.Asphalt8Airborne").InstallLocation)\AppXManifest.xml"
  576. # Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsFeedbackHub").InstallLocation)\AppXManifest.xml"
  577. # In case you have removed them for good, you can try to restore the files using installation medium as follows
  578. # New-Item C:\Mnt -Type Directory | Out-Null
  579. # dism /Mount-Image /ImageFile:D:\sources\install.wim /index:1 /ReadOnly /MountDir:C:\Mnt
  580. # robocopy /S /SEC /R:0 "C:\Mnt\Program Files\WindowsApps" "C:\Program Files\WindowsApps"
  581. # dism /Unmount-Image /Discard /MountDir:C:\Mnt
  582. # Remove-Item -Path C:\Mnt -Recurse
  583.  
  584. # Disable Xbox DVR
  585. # If (!(Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR")) {
  586. #     New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" | Out-Null
  587. # }
  588. Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Name "AllowGameDVR" -Type DWord -Value 0
  589.  
  590. # Enable Xbox DVR
  591. # Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Name "AllowGameDVR" -ErrorAction SilentlyContinue
  592.  
  593. # Uninstall Windows Media Player
  594. # Write-Host "Uninstalling Windows Media Player..."
  595. # dism /online /Disable-Feature /FeatureName:MediaPlayback /Quiet /NoRestart
  596.  
  597. # Install Windows Media Player
  598. # dism /online /Enable-Feature /FeatureName:MediaPlayback /Quiet /NoRestart
  599.  
  600. # Uninstall Work Folders Client
  601. Write-Host "Uninstalling Work Folders Client..."
  602. dism /online /Disable-Feature /FeatureName:WorkFolders-Client /Quiet /NoRestart
  603.  
  604. # Install Work Folders Client
  605. # dism /online /Enable-Feature /FeatureName:WorkFolders-Client /Quiet /NoRestart
  606.  
  607. # Set Photo Viewer as default for bmp, gif, jpg and png
  608. Write-Host "Setting Photo Viewer as default for bmp, gif, jpg, png and tif..."
  609. If (!(Test-Path "HKCR:")) {
  610.     New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
  611. }
  612. ForEach ($type in @("Paint.Picture", "giffile", "jpegfile", "pngfile")) {
  613.     New-Item -Path $("HKCR:\$type\shell\open") -Force | Out-Null
  614.     New-Item -Path $("HKCR:\$type\shell\open\command") | Out-Null
  615.     Set-ItemProperty -Path $("HKCR:\$type\shell\open") -Name "MuiVerb" -Type ExpandString -Value "@%ProgramFiles%\Windows Photo Viewer\photoviewer.dll,-3043"
  616.     Set-ItemProperty -Path $("HKCR:\$type\shell\open\command") -Name "(Default)" -Type ExpandString -Value "%SystemRoot%\System32\rundll32.exe `"%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll`", ImageView_Fullscreen %1"
  617. }
  618.  
  619. # Remove or reset default open action for bmp, gif, jpg and png
  620. If (!(Test-Path "HKCR:")) {
  621.   New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
  622. }
  623. Remove-Item -Path "HKCR:\Paint.Picture\shell\open" -Recurse
  624. Remove-ItemProperty -Path "HKCR:\giffile\shell\open" -Name "MuiVerb"
  625. Set-ItemProperty -Path "HKCR:\giffile\shell\open" -Name "CommandId" -Type String -Value "IE.File"
  626. Set-ItemProperty -Path "HKCR:\giffile\shell\open\command" -Name "(Default)" -Type String -Value "`"$env:SystemDrive\Program Files\Internet Explorer\iexplore.exe`" %1"
  627. Set-ItemProperty -Path "HKCR:\giffile\shell\open\command" -Name "DelegateExecute" -Type String -Value "{17FE9752-0B5A-4665-84CD-569794602F5C}"
  628. Remove-Item -Path "HKCR:\jpegfile\shell\open" -Recurse
  629. Remove-Item -Path "HKCR:\pngfile\shell\open" -Recurse
  630.  
  631. # Show Photo Viewer in "Open with..."
  632. Write-Host "Showing Photo Viewer in `"Open with...`""
  633. If (!(Test-Path "HKCR:")) {
  634.     New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
  635. }
  636. New-Item -Path "HKCR:\Applications\photoviewer.dll\shell\open\command" -Force | Out-Null
  637. New-Item -Path "HKCR:\Applications\photoviewer.dll\shell\open\DropTarget" -Force | Out-Null
  638. Set-ItemProperty -Path "HKCR:\Applications\photoviewer.dll\shell\open" -Name "MuiVerb" -Type String -Value "@photoviewer.dll,-3043"
  639. Set-ItemProperty -Path "HKCR:\Applications\photoviewer.dll\shell\open\command" -Name "(Default)" -Type ExpandString -Value "%SystemRoot%\System32\rundll32.exe `"%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll`", ImageView_Fullscreen %1"
  640. Set-ItemProperty -Path "HKCR:\Applications\photoviewer.dll\shell\open\DropTarget" -Name "Clsid" -Type String -Value "{FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}"
  641.  
  642. # Remove Photo Viewer from "Open with..."
  643. # If (!(Test-Path "HKCR:")) {
  644. #   New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
  645. # }
  646. # Remove-Item -Path "HKCR:\Applications\photoviewer.dll\shell\open" -Recurse
  647.  
  648. # Enable F8 boot menu options
  649. # Write-Host "Enabling F8 boot menu options..."
  650. # bcdedit /set `{current`} bootmenupolicy Legacy | Out-Null
  651.  
  652. # Disable F8 boot menu options
  653. # bcdedit /set `{current`} bootmenupolicy Standard | Out-Null
  654.  
  655. # Install Powershell man pages locally (low priority, uses bandwidth)
  656. # Update-Help
  657.  
  658. # Install Packages to edit Hosts file.
  659. Write-Host "Installing PsHosts CMDlet to edit hosts file. Please be Patient. This may be slow sometimes buggy"
  660. install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
  661.  
  662. Write-Host "Seting up Repository"
  663. Set-PSRepository -Name "PSGallery" -InstallationPolicy Trusted
  664.  
  665. Write-Host "Installing Module"
  666. install-module PsHosts
  667.  
  668. # Hosts to block are below
  669. Write-Host "Editing Hosts File..."
  670. Add-HostEntry vortex.data.microsoft.com 127.0.0.1
  671. Add-HostEntry vortex-win.data.microsoft.com 127.0.0.1
  672. Add-HostEntry telecommand.telemetry.microsoft.com 127.0.0.1
  673. Add-HostEntry telecommand.telemetry.microsoft.com.nsatc.net 127.0.0.1
  674. Add-HostEntry oca.telemetry.microsoft.com 127.0.0.1
  675. Add-HostEntry oca.telemetry.microsoft.com.nsatc.net 127.0.0.1
  676. Add-HostEntry sqm.telemetry.microsoft.com 127.0.0.1
  677. Add-HostEntry sqm.telemetry.microsoft.com.nsatc.net 127.0.0.1
  678. Add-HostEntry watson.telemetry.microsoft.com 127.0.0.1
  679. Add-HostEntry watson.telemetry.microsoft.com.nsatc.net 127.0.0.1
  680. Add-HostEntry redir.metaservices.microsoft.com 127.0.0.1
  681. Add-HostEntry choice.microsoft.com 127.0.0.1
  682. Add-HostEntry choice.microsoft.com.nsatc.net 127.0.0.1
  683. Add-HostEntry df.telemetry.microsoft.com 127.0.0.1
  684. Add-HostEntry reports.wes.df.telemetry.microsoft.com 127.0.0.1
  685. Add-HostEntry wes.df.telemetry.microsoft.com 127.0.0.1
  686. Add-HostEntry services.wes.df.telemetry.microsoft.com 127.0.0.1
  687. Add-HostEntry sqm.df.telemetry.microsoft.com 127.0.0.1
  688. Add-HostEntry telemetry.microsoft.com 127.0.0.1
  689. Add-HostEntry watson.ppe.telemetry.microsoft.com 127.0.0.1
  690. Add-HostEntry telemetry.appex.bing.net 127.0.0.1
  691. Add-HostEntry telemetry.urs.microsoft.com 127.0.0.1
  692. Add-HostEntry telemetry.appex.bing.net:443 127.0.0.1
  693. Add-HostEntry settings-sandbox.data.microsoft.com 127.0.0.1
  694. Add-HostEntry vortex-sandbox.data.microsoft.com 127.0.0.1
  695. Add-HostEntry survey.watson.microsoft.com 127.0.0.1
  696. Add-HostEntry watson.live.com 127.0.0.1
  697. Add-HostEntry watson.microsoft.com 127.0.0.1
  698. Add-HostEntry statsfe2.ws.microsoft.com 127.0.0.1
  699. Add-HostEntry corpext.msitadfs.glbdns2.microsoft.com 127.0.0.1
  700. Add-HostEntry compatexchange.buttapp.net 127.0.0.1
  701. Add-HostEntry cs1.wpc.v0cdn.net 127.0.0.1
  702. Add-HostEntry a-0001.a-msedge.net 127.0.0.1
  703. Add-HostEntry statsfe2.update.microsoft.com.akadns.net 127.0.0.1
  704. Add-HostEntry sls.update.microsoft.com.akadns.net 127.0.0.1
  705. Add-HostEntry fe2.update.microsoft.com.akadns.net 127.0.0.1
  706. Add-HostEntry diagnostics.support.microsoft.com 127.0.0.1
  707. Add-HostEntry corp.sts.microsoft.com 127.0.0.1
  708. Add-HostEntry statsfe1.ws.microsoft.com 127.0.0.1
  709. Add-HostEntry pre.footprintpredict.com 127.0.0.1
  710. Add-HostEntry i1.services.social.microsoft.com 127.0.0.1
  711. Add-HostEntry i1.services.social.microsoft.com.nsatc.net 127.0.0.1
  712. Add-HostEntry feedback.windows.com 127.0.0.1
  713. Add-HostEntry feedback.microsoft-hohm.com 127.0.0.1
  714. Add-HostEntry feedback.search.microsoft.com 127.0.0.1
  715. Add-HostEntry rad.msn.com 127.0.0.1
  716. Add-HostEntry preview.msn.com 127.0.0.1
  717. Add-HostEntry ad.doubleclick.net 127.0.0.1
  718. Add-HostEntry ads.msn.com 127.0.0.1
  719. Add-HostEntry ads1.msads.net 127.0.0.1
  720. Add-HostEntry ads1.msn.com 127.0.0.1
  721. Add-HostEntry a.ads1.msn.com 127.0.0.1
  722. Add-HostEntry a.ads2.msn.com 127.0.0.1
  723. Add-HostEntry adnexus.net 127.0.0.1
  724. Add-HostEntry adnxs.com 127.0.0.1
  725. Add-HostEntry aidps.atdmt.com 127.0.0.1
  726. Add-HostEntry apps.skype.com 127.0.0.1
  727. Add-HostEntry az361816.vo.msecnd.net 127.0.0.1
  728. Add-HostEntry az512334.vo.msecnd.net 127.0.0.1
  729. Add-HostEntry a.rad.msn.com 127.0.0.1
  730. Add-HostEntry a.ads2.msads.net 127.0.0.1
  731. Add-HostEntry ac3.msn.com 127.0.0.1
  732. Add-HostEntry aka-cdn-ns.adtech.de 127.0.0.1
  733. Add-HostEntry b.rad.msn.com 127.0.0.1
  734. Add-HostEntry b.ads2.msads.net 127.0.0.1
  735. Add-HostEntry b.ads1.msn.com 127.0.0.1
  736. Add-HostEntry bs.serving-sys.com 127.0.0.1
  737. Add-HostEntry c.msn.com 127.0.0.1
  738. Add-HostEntry cdn.atdmt.com 127.0.0.1
  739. Add-HostEntry cds26.ams9.msecn.net 127.0.0.1
  740. Add-HostEntry c.atdmt.com 127.0.0.1
  741. Add-HostEntry db3aqu.atdmt.com 127.0.0.1
  742. Add-HostEntry ec.atdmt.com 127.0.0.1
  743. Add-HostEntry flex.msn.com 127.0.0.1
  744. Add-HostEntry g.msn.com 127.0.0.1
  745. Add-HostEntry h2.msn.com 127.0.0.1
  746. Add-HostEntry h1.msn.com 127.0.0.1
  747. Add-HostEntry live.rads.msn.com 127.0.0.1
  748. Add-HostEntry msntest.serving-sys.com 127.0.0.1
  749. Add-HostEntry m.adnxs.com 127.0.0.1
  750. Add-HostEntry m.hotmail.com 127.0.0.1
  751. Add-HostEntry preview.msn.com 127.0.0.1
  752. Add-HostEntry pricelist.skype.com 127.0.0.1
  753. Add-HostEntry rad.msn.com 127.0.0.1
  754. Add-HostEntry rad.live.com 127.0.0.1
  755. Add-HostEntry secure.flashtalking.com 127.0.0.1
  756. Add-HostEntry static.2mdn.net 127.0.0.1
  757. Add-HostEntry s.gateway.messenger.live.com 127.0.0.1
  758. Add-HostEntry secure.adnxs.com 127.0.0.1
  759. Add-HostEntry sO.2mdn.net 127.0.0.1
  760. Add-HostEntry ui.skype.com 127.0.0.1
  761. Add-HostEntry view.atdmt.com 127.0.0.1
  762. # The Below two domains may impact your network connectivity detection.
  763. Add-HostEntry www.msftncsi.com 127.0.0.1
  764. Add-HostEntry msftncsi.com 127.0.0.1
  765.  
  766. # Force DEP to always on for every application (available options are: AlwaysOff, AlwaysOn, OptIn, OptOut)
  767. Write-Host "Turning on DEP for all applications."
  768. bcdedit /set nx AlwaysON
  769.  
  770. # Enable SEHOP (Exception write-protection function of DEP.)
  771. Write-Host "Enable Exception Write-Protection SEHOP"
  772. reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v DisableExceptionChainValidation /t REG_DWORD /d 0 /f
  773.  
  774. # Check Cryptography Protection
  775. Write-Host "Checking Cryptography Protection."
  776.  
  777. # If the following query shows that MasterKeyLegacyCompliance is set to a non-zero number,
  778. # then it is bad sign that hackers or malware have set this value deliberately to weaken
  779. # the security of DPAPI-protected secrets like cached passwords or private keys.
  780. reg query HKLM\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb /v MasterKeyLegacyCompliance
  781.  
  782. # Run the following command to delete the MasterKeyLegacyCompliance value, which
  783. # is the default on Windows XP and later, and is best for security.
  784. reg delete HKLM\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb /v MasterKeyLegacyCompliance /f
  785.  
  786. # Disable NetBios (Forces File Sharing over port 445 DirectSMB/stops various worms.)
  787. Write-Host "Disabling Outdated NetBIOS Protocol..."
  788. sc.exe config netbt start= disabled
  789.  
  790. # Reset NerBios Configuration to Default.
  791. # sc.exe config netbt start= system
  792.  
  793. # Set LAN connection to DHCP and renew.
  794. # netsh.exe int ip set address "Local Area Connection" dhcp
  795. # netsh.exe int ip set dns "Local Area Connection" dhcp
  796. # ipconfig /renew
  797.  
  798. # Set LAN connection to static and release.
  799. # ipconfig /release
  800. # netsh.exe int ip set dns "Local Area Connection" static 10.4.1.1
  801. # netsh.exe int ip set address "Local Area Connection" static 10.4.1.1 255.255.0.0
  802.  
  803. # Enable IPsec NAT
  804. Write-Host "Enabling IPSec NAT..."
  805. reg add "HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent" /v AssumeUDPEncapsulationContextOnSendRule /t REG_DWORD /d 00000002 /f
  806.  
  807. # Use these commands to audit logging policies.
  808. # auditpol.exe /get /category:*
  809. # auditpol.exe /get /subcategory:"MPSSVC rule-level Policy Change,Filtering Platform policy change,IPsec Main Mode,IPsec Quick Mode,IPsec Extended Mode,IPsec Driver,Other System Events,Filtering Platform Packet Drop,Filtering Platform Connection"
  810.  
  811. # Disable a lot of security logging (See end of command)
  812. # auditpol.exe /set /subcategory:"MPSSVC rule-level Policy Change,Filtering Platform policy change,IPsec Main Mode,IPsec Quick Mode,IPsec Extended Mode,IPsec Driver,Other System Events,Filtering Platform Packet Drop,Filtering Platform Connection" /success:Disable /failure:Disable
  813.  
  814. # Enable a lot of security logging (See end of command)
  815. auditpol.exe /set /subcategory:"MPSSVC rule-level Policy Change,Filtering Platform policy change,IPsec Main Mode,IPsec Quick Mode,IPsec Extended Mode,IPsec Driver,Other System Events,Filtering Platform Packet Drop,Filtering Platform Connection" /success:Enable /failure:Enable
  816.  
  817. # Enable oakley IPSec Diagnostics logging.
  818. reg add "HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent\Oakley" /v EnableLogging /t REG_DWORD /d 00000001 /f
  819.  
  820. # Enable Local IPSec Connections for ports 3389,135,139,445,21,20,23
  821. Write-Host "Enabling Local Network IPSEC on this machine if supported. Please change the value (ThePreSharedKey) on the below line for added security."
  822. netsh.exe advfirewall consec add rule name=Testing-IPSec-NETSH endpoint1=any port1=any endpoint2=localsubnet port2=3389,135,139,445,21,20,23 protocol=tcp profile=any action=requireinrequestout interfacetype=any auth1=computerpsk auth1psk=ThePreSharedKey enable=yes
  823.  
  824. # Disable Local IPSec Connections for ports 3389,135,139,445,21,20,23
  825. # Write-Host "Disabling Local Network IPSEC on this machine if supported."
  826. # netsh.exe advfirewall consec add rule name=Testing-IPSec-NETSH endpoint1=any port1=any endpoint2=localsubnet port2=3389,135,139,445,21,20,23 protocol=tcp profile=any action=requireinrequestout interfacetype=any auth1=computerpsk auth1psk=ThePreSharedKey enable=no
  827.  
  828. #
  829. #
  830. # The Two Lines Below Enable Superfectch and Prefetch
  831. Write-Host "Enabling Superfetch and Prefetch..."
  832. reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnableSuperfetch /t REG_DWORD /d 00000003 /f
  833. reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnablePrefetcher /t REG_DWORD /d 00000003 /f
  834.  
  835. # The Lines Below Disable SSL!!!
  836. Write-Host "Disabling SSL..."
  837. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client"
  838. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client" /v DisabledByDefault /t REG_DWORD /d 00000001 /f
  839. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client" /v Enabled /t REG_DWORD /d 00000000 /f
  840. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server"
  841. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" /v DisabledByDefault /t REG_DWORD /d 00000001 /f
  842. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" /v Enabled /t REG_DWORD /d 00000000 /f
  843. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client"
  844. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" /v DisabledByDefault /t REG_DWORD /d 00000001 /f
  845. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" /v Enabled /t REG_DWORD /d 00000000 /f
  846. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server"
  847. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" /v DisabledByDefault /t REG_DWORD /d 00000001 /f
  848. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" /v Enabled /t REG_DWORD /d 00000000 /f
  849.  
  850. # The Lines Below Force And Enable TLS!!!
  851. Write-Host "Forcing and Enabling TLS!!!"
  852. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client"
  853. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  854. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /v Enabled /t REG_DWORD /d 0xffffffff /f
  855. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server"
  856. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  857. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /v Enabled /t REG_DWORD /d 0xffffffff /f
  858. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client"
  859. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  860. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /v Enabled /t REG_DWORD /d 0xffffffff /f
  861. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server"
  862. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  863. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /v Enabled /t REG_DWORD /d 0xffffffff /f
  864. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client"
  865. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  866. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v Enabled /t REG_DWORD /d 0xffffffff /f
  867. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server"
  868. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v DisabledByDefault /t REG_DWORD /d 00000000 /f
  869. reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v Enabled /t REG_DWORD /d 0xffffffff /f
  870.  
  871. # The Registry Parameters Below are for TCP Security, I'm not sure what some of them do.
  872. Write-Host "Upgrading TCP Security..."
  873. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v IPEnableRouter /t REG_DWORD /d 00000000 /f
  874. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect /t REG_DWORD /d 00000000 /f
  875. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v SynAttackProtect /t REG_DWORD /d 00000002 /f
  876. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxHalfOpen /t REG_DWORD /d 00000064 /f
  877. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxHalfOpenRetried /t REG_DWORD /d 00000050 /f
  878. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v DisableIPSourceRouting /t REG_DWORD /d 00000002 /f
  879. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v NoNameReleaseOnDemand /t REG_DWORD /d 00000001 /f
  880. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableDeadGWDetect /t REG_DWORD /d 00000000 /f
  881. reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v KeepAliveTime /t REG_DWORD /d 0x000493E0 /f
  882.  
  883. # Disable NTFS Last-Access Timestamp
  884. # Write-Host "Disabling NTFS Last-Access Timestamps..."
  885. # reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v NtfsDisableLastAccessUpdate /t REG_DWORD /d 00000001 /f
  886.  
  887. # Enable NTFS Last-Access Timestamp
  888. Write-Host "Enabling NTFS Last-Access Timestamps..."
  889. reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v NtfsDisableLastAccessUpdate /t REG_DWORD /d 00000000 /f
  890.  
  891. # Disable IPV6
  892. Write-Host "Disabling IPV6..."
  893. reg add "HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters" /v DisabledComponents /t REG_DWORD /d 0xffffffff /f
  894.  
  895. # Enable IPV6
  896. # Write-Host "EnTabling IPV6..."
  897. # reg add "HKLM\SYSEM\CurrentControlSet\services\TCPIP6\Parameters" /v DisabledComponents /t REG_DWORD /d 0 /f
  898.  
  899. # Force High Level of Remote Desktop Encryption and TLS Authentication.
  900. Write-Host "Requiring Strong Remote Desktop Encryption if enabled... And forcing TLS Authentication"
  901. reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MinEncryptionLevel /t REG_DWORD /d 00000003 /f
  902. reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer /t REG_DWORD /d 00000002 /f
  903.  
  904. # Disabling TCP/IP AutoTuning (see http://technet.microsoft.com/en-us/magazine/2007.01.cableguy.aspx)
  905. Write-Host "Disabling TCP/IP Auto-Tuning..."
  906. netsh.exe interface tcp set global autotuninglevel= disabled
  907.  
  908. # Enabling TCP/IP AutoTuning
  909. # netsh.exe interface tcp set global autotuninglevel= normal
  910.  
  911. # Reset Firewall To factory Defaults!!!
  912. # netsh.exe firewall reset
  913. #
  914.  
  915.  
  916.  
  917. # Begin Java Security Setting Script
  918. #
  919. #
  920.  
  921. Write-host "The next bit of code will either enable or disable java system-wide."
  922.  
  923. # Construct the strings for the deployment.properties file.
  924. # Be mindful of the below property, setting webjava to false will unisntall java and you will need to manually re-enable in IE.
  925.  
  926. $propertiesfile = "deployment.webjava.enabled=true "
  927.  
  928. # Default to locking the security level and browser plug-in state, i.e., they are visible but greyed out in Java Control Panel.
  929. $propertiesfile += "`ndeployment.webjava.enabled.locked `ndeployment.security.level.locked "
  930.  
  931. # Default to security level being set to VERY_HIGH (see Security tab of Java Control Panel).
  932. $propertiesfile += "`ndeployment.security.level=VERY_HIGH"
  933.  
  934.  
  935. # Possibly delete the configuration files and exit, but leave the folder alone though.
  936. write-host "Deleting system-wide Java configuration files, if they exist..."
  937. remove-item $env:WinDir\Sun\Java\Deployment\deployment.config -Force
  938. remove-item $env:WinDir\Sun\Java\Deployment\deployment.properties -Force
  939.        
  940.  
  941.  
  942. # Create the $env:WinDir\Sun\Java\Deployment folder for the system-wide Java configuration files.
  943. New-Item -Path $env:WinDir\Sun\Java\Deployment -ItemType Directory -Force | Out-Null
  944.  
  945. # Create the deployment.config file.
  946. "deployment.system.config=$env:WinDir\Sun\Java\Deployment\deployment.properties" |
  947.     Out-File -FilePath $env:WinDir\Sun\Java\Deployment\deployment.config -Force -Encoding ASCII
  948. if (-not $? -or -not $(Test-Path $env:WinDir\Sun\Java\Deployment\deployment.config))
  949.    { "`nCould not create the deployment.config file, exiting.`n" ; exit -1 }
  950.  
  951.  
  952. # Create the deployment.properties file.
  953. $propertiesfile | Out-File -FilePath $env:WinDir\Sun\Java\Deployment\deployment.properties -Force -Encoding ASCII
  954. if (-not $? -or -not $(Test-Path $env:WinDir\Sun\Java\Deployment\deployment.properties))
  955.    { "`nCould not create the deployment.properties file, exiting.`n" ; exit -1 }
  956.  
  957.  
  958. # Show system-wide deployment.properties file contents FYI.
  959. "`nCurrent contents of the deployment.properties file:`n"
  960. get-content $env:WinDir\Sun\Java\Deployment\deployment.properties ; "`n"
  961.  
  962.  
  963.  
  964. # Run latest ssvagent.exe for both x86 and x64, but not on Java Platform 6 or earlier, and
  965. # hope future Javas support these switches (man, what a mess, doomed to rewrites...):
  966. if ($propertiesfile -like '*deployment.webjava.enabled=false*')
  967. {
  968.     # Try the x64 version, if any:
  969.     $ssvagent = $null
  970.     if (Test-Path -Path "$env:ProgramFiles\Java\")
  971.     {
  972.         $ssvagent = dir "$env:ProgramFiles\Java\*.exe" -Recurse |
  973.                 where { $_.name -eq 'ssvagent.exe' -and $_.fullname -notmatch '\\jre[1-6]\\'} |
  974.                 sort LastWriteTimeUtc -desc | select -first 1
  975.     }
  976.  
  977.     if ($ssvagent -ne $null)
  978.     {
  979.         $expression = $ssvagent.FullName.Replace("Program Files","'Program Files'") + " -disablewebjava"
  980.         "Executing: $expression `n"
  981.         invoke-expression -command $expression
  982.     }
  983.  
  984.  
  985.     # Now for the x86 version second, because this is the Oracle-preferred:
  986.     $ssvagent = $null
  987.     if (Test-Path -Path "${env:ProgramFiles(x86)}\Java\")
  988.     {
  989.         $ssvagent = dir "${env:ProgramFiles(x86)}\Java\*.exe" -Recurse |
  990.                 where { $_.name -eq 'ssvagent.exe' -and $_.fullname -notmatch '\\jre[1-6]\\'} |
  991.                 sort LastWriteTimeUtc -desc | select -first 1
  992.     }
  993.  
  994.     if ($ssvagent -ne $null)
  995.     {
  996.         $expression = $ssvagent.FullName.Replace("Program Files (x86)","'Program Files (x86)'") + " -disablewebjava"
  997.         "Executing: $expression `n"
  998.         invoke-expression -command $expression
  999.     }
  1000. }
  1001. elseif ($propertiesfile -like '*deployment.webjava.enabled=true*')
  1002. {
  1003.     # Try the x64 version, if any:
  1004.     $ssvagent = $null
  1005.     $ssvagent = dir "$env:ProgramFiles\Java\*.exe" -Recurse |
  1006.                 where { $_.name -eq 'ssvagent.exe' -and $_.fullname -notmatch '\\jre[1-6]\\'} |
  1007.                 sort LastWriteTimeUtc -desc | select -first 1
  1008.     if ($ssvagent -ne $null)
  1009.     {
  1010.         $expression = $ssvagent.FullName.Replace("Program Files","'Program Files'") + " -forceinstall -register -new -high"  #Only -high exists?
  1011.         "Executing: $expression `n"
  1012.         invoke-expression -command $expression
  1013.     }
  1014.  
  1015.     # Now for the x86 version second, to let it possibly overwrite x64 settings, since x86 is Oracle-preferred:
  1016.     $ssvagent = $null
  1017.     $ssvagent = dir "${env:ProgramFiles(x86)}\Java\*.exe" -Recurse |
  1018.                 where { $_.name -eq 'ssvagent.exe' -and $_.fullname -notmatch '\\jre[1-6]\\'} |
  1019.                 sort LastWriteTimeUtc -desc | select -first 1
  1020.     if ($ssvagent -ne $null)
  1021.     {
  1022.         $expression = $ssvagent.FullName.Replace("Program Files (x86)","'Program Files (x86)'") + " -forceinstall -register -new -high"  #Only -high exists?
  1023.         "Executing: $expression `n"
  1024.         invoke-expression -command $expression
  1025.     }
  1026. }
  1027.  
  1028. # End Java Security Settings Script
  1029. #
  1030. #
  1031.  
  1032.  
  1033.  
  1034. #
  1035. #
  1036. # Change Mac Menu
  1037.  
  1038. $Title = "Welcome"
  1039. $Info = "To Change Or Not Change Your Mac (May not support Hyper-V)"
  1040.  
  1041. $options = [System.Management.Automation.Host.ChoiceDescription[]] @("&Yes", "&No", "&Quit")
  1042. [int]$defaultchoice = 1
  1043. $opt =  $host.UI.PromptForChoice($Title , $Info , $Options,$defaultchoice)
  1044. switch($opt)
  1045. {
  1046. 0 {
  1047. #
  1048. #
  1049. # The Below Script Enable a random mac on wifi. This may not work on all computers!!! (Especially HYPER-V)
  1050.  
  1051. Write-Host "Enabling Random MAC address on WIFI!!! Please be patient... This may not work on all computers!!! (Especially HYPER-V)"
  1052. function random-mac ($ManufacturerName, $ManufacturerID, $Delimiter, [Switch] $TotallyRandom, [Switch] $LocallyAdministered, [Switch] $Multicast)
  1053. {  
  1054.     # $mac will be padded with random hex later, but add a random vendor ID by default.
  1055.     if ($TotallyRandom) { $mac = "" }  
  1056.     else
  1057.     {
  1058.         # First three bytes will come from the manufacturer ID number.
  1059.         # Some input checking of the manufacturer selection...
  1060.         if ($ManufacturerName -and $ManufacturerName.StartsWith("3")) { $ManufacturerName = "ThreeCom" }
  1061.         if ($ManufacturerName -and $ManufacturerName.ToUpper().StartsWith("D-")) { $ManufacturerName = "DLink" }
  1062.         if ($ManufacturerID -and $ManufacturerID.ToString().length -gt 12) { $ManufacturerID = $ManufacturerID.ToString().SubString(0,12) }
  1063.        
  1064.         # Manufacturer identifiers last updated on 5.Feb.2011:
  1065.         $vendor = @{
  1066.             "Netgear" = "0024B2 0026F2 30469A A021B7 C03F0E C43DC7 E0469A E091F5 000FB5 00146C 00184D 001B2F 001E2A 001F33 00223F 00095B" ;
  1067.             "DLink" = "00055D 000D88 000F3D 001195 001346 0015E9 00179A 00195B 001B11 001CF0 001E58 002191 0022B0 002401 00265A 0050BA 0080C8 14D64D 1CAFF7 1CBDB9 340804 5CD998 F07D68" ;
  1068.             "ThreeCom" = "000102 000103 00029C 00040B 00051A 00068C 000A04 000A5E 000BAC 000D54 000E6A 000FCB 00104B 00105A 0012A9 00147C 0016E0 00186E 001AC1 001CC5 001EC1 0020AF 002257 002473 002654 00301E 005004 005099 0050DA 006008 00608C 006097 009004 00A024 00D096 00D0D8 02608C 02C08C 08004E 20FDF1 4001C6" ;
  1069.             "Intel" = "0002B3 000347 000423 0007E9 000CF1 000E0C 000E35 001111 0012F0 001302 001320 0013CE 0013E8 001500 001517 00166F 001676 0016EA 0016EB 0018DE 0019D1 0019D2 001B21 001B77 001CBF 001CC0 001DE0 001DE1 001E64 001E65 001E67 001F3B 001F3C 00207B 00215C 00215D 00216A 00216B 0022FA 0022FB 002314 002315 0024D6 0024D7 0026C6 0026C7 00270E 002710 0050F1 009027 00A0C9 00AA00 00AA01 00AA02 00D0B7 081196 0CD292 100BA9 183DA2 247703 4025C2 448500 4C8093 502DA2 58946B 648099 64D4DA 685D43 74E50B 78929C 809B20 88532E 8CA982 A088B4 AC7289 BC7737 DCA971" ;
  1070.             "HP" = "0001E6 0001E7 0002A5 0004EA 000802 000883 0008C7 000A57 000BCD 000D9D 000E7F 000EB3 000F20 000F61 001083 0010E3 00110A 001185 001279 001321 001438 0014C2 001560 001635 001708 0017A4 001871 0018FE 0019BB 001A4B 001B78 001CC4 001E0B 001F29 00215A 002264 00237D 002481 0025B3 002655 00306E 0030C1 00508B 0060B0 00805F 0080A0 080009 18A905 1CC1DE 2C27D7 3C4A92 643150 68B599 78ACC0 78E3B5 78E7D1 984BE1 B499BA B8AF67 D48564 D8D385 F4CE46" ;
  1071.             "Apple" = "000393 000502 000A27 000A95 000D93 0010FA 001124 001451 0016CB 0017F2 0019E3 001B63 001CB3 001D4F 001E52 001EC2 001F5B 001FF3 0021E9 002241 002312 002332 00236C 0023DF 002436 002500 00254B 0025BC 002608 00264A 0026B0 0026BB 003065 0050E4 00A040 041E64 080007 1093E9 109ADD 18E7F4 24AB81 28E7CF 34159E 3C0754 40A6D9 40D32D 442A60 581FAA 5855CA 58B035 5C5948 60334B 60FB42 64B9E8 70CD60 78CA39 7C6D62 7CC537 7CF05F 88C663 8C5877 8C7B9D 9027E4 90840D 9803D8 A46706 A4B197 B8FF61 C42C03 C82A14 C8BCC8 CC08E0 D49A20 D83062 D89E3F D8A25E DC2B61 E0F847 E4CE8F E80688 F0B479 F81EDF" ;
  1072.             "AlliedTelesis" = "0000CD 0000F4 000941 000A79 000DDA 001130 001577 001AEB 002687 009099 00A0D2 ECCD6D" ;
  1073.             "QLogic" = "000E1E 001B32 0024FF 00C0DD 00E08B"
  1074.         }
  1075.  
  1076.         # Check that $ManufacturerName actually matches one of the valid $vendors here.
  1077.         if ($ManufacturerName -and ($vendor.keys -notcontains $ManufacturerName))
  1078.         { throw "`nYou must choose a vendor from this list:`n" + $vendor.keys }
  1079.        
  1080.         # Generate the first three bytes of the MAC or use the $ManufacturerID instead.
  1081.         if ($ManufacturerID) { $mac = $ManufacturerID.ToString().ToUpper() -replace '[^A-F0-9]',"" }
  1082.         elseif ($ManufacturerName) { $mac = get-random -input @($vendor.$ManufacturerName -split " ") }
  1083.         else { $mac = get-random -input @($vendor.$(get-random -input @($vendor.keys)) -split " ") }
  1084.     }
  1085.    
  1086.     # Now padright with random hex characters until we have twelve chars.
  1087.     while ($mac.length -lt 12)
  1088.     {
  1089.         $mac += "{0:X}" -f $(get-random -min 0 -max 16)
  1090.     }
  1091.    
  1092.     # Now set the unicast/multicast flag bit.
  1093.     # First low-order bit (right-most bit): 0 = unicast, 1 = multicast
  1094.     # For the bit flags, see http://en.wikipedia.org/wiki/MAC_address  
  1095.     [Byte] $firstbyte = "0x" + $mac.substring(0,2)      # Convert first two hex chars to a byte.
  1096.  
  1097.     if ($multicast)
  1098.     {
  1099.         $firstbyte = [Byte] $firstbyte -bor [Byte] 1     # Set low-order bit to 1: multicast
  1100.         $mac = ("{0:X}" -f $firstbyte).padleft(2,"0") + $mac.substring(2)
  1101.     }
  1102.     else
  1103.     {
  1104.         $firstbyte = [Byte] $firstbyte -band [Byte] 254  # Set low-order bit to 0: unicast
  1105.         $mac = ("{0:X}" -f $firstbyte).padleft(2,"0") + $mac.substring(2)
  1106.     }
  1107.    
  1108.    
  1109.     # Now set the vendor-unique/locally-administered flag.
  1110.     # Next-to-low-order bit (second from right): 0 = unique vendor, 1 = locally administered
  1111.     if ($locallyadministered)
  1112.     {
  1113.         $firstbyte = [Byte] $firstbyte -bor [Byte] 2     # Set second low-order bit to 1: locally
  1114.         $mac = ("{0:X}" -f $firstbyte).padleft(2,"0") + $mac.substring(2)
  1115.     }
  1116.     else
  1117.     {
  1118.         $firstbyte = [Byte] $firstbyte -band [Byte] 253  # Set second low-order bit to 0: vendor unique
  1119.         $mac = ("{0:X}" -f $firstbyte).padleft(2,"0") + $mac.substring(2)
  1120.     }
  1121.    
  1122.        
  1123.     # Add delimiter, if any, and return the $mac.
  1124.     if ($Delimiter)
  1125.     {
  1126.         for ($i = 0 ; $i -le 10 ; $i += 2)
  1127.         { $newmac += $mac.substring($i,2) + $Delimiter }
  1128.         $newmac.substring(0,$($newmac.length - $Delimiter.length))
  1129.     }
  1130.     else
  1131.     { $mac }
  1132. }
  1133.  
  1134.  
  1135. # Get the NICs which are not tunnels, not for virtual machines, and not for bluetooth.
  1136. $nics = @(Get-WmiObject -Query "select * from win32_networkadapter where adaptertype != 'Tunnel' and adaptertype is not null" | `
  1137. where { $_.description -notmatch 'VMware|Virtual|WAN Miniport|ISATAP|RAS Async|Teredo|Windows Mobile Remote|6to4|Bluetooth' } )
  1138.  
  1139. # If more than one physical NIC, prompt the user to select one, if the index number was not given.
  1140. if ($nics.count -eq 0) { "`nCannot identify a valid network interface device, quitting...`n" ; exit }
  1141. elseif ($nics.count -eq 1 -and -not $InterfaceIndexNumber) { $index = $nics[0].index }
  1142. else
  1143. {
  1144.     if ($InterfaceIndexNumber) { $index = $InterfaceIndexNumber }
  1145.     else
  1146.     {
  1147.         # Print a list of interfaces and prompt user to choose one.
  1148.         "`n"; $nics | format-table index,macaddress,netconnectionid,description -autosize
  1149.         $index = read-host -prompt "`nEnter the index number of the desired interface"
  1150.     }
  1151. }
  1152.  
  1153. # Check that a valid index number was actually entered.
  1154. $good = $false; switch ($nics | foreach {$_.index}) { $index { $good = $true } }
  1155. if (-not $good) { "`n$index is not a valid index number, quitting...`n" ; exit }
  1156.  
  1157. # Confirm that you can get the NIC by the index number, so that it can be disabled/enabled later too.
  1158. $thenic = Get-WmiObject -Query "select * from win32_networkadapter where deviceid = $index"
  1159. if (-not $?) { "`nThere was a problem getting the interface, quitting...`n" ; exit }
  1160.  
  1161. # The registry key for the nic always has four digits, so padleft, then get the key.
  1162. $index = $index.tostring().padleft(4,"0")
  1163. $regkey = get-item "hklm:\system\CurrentControlSet\control\class\{4D36E972-E325-11CE-BFC1-08002BE10318}\$index"
  1164. if (-not $?) { "`nThere was a problem getting the registry key, quitting...`n" ; exit }
  1165.  
  1166. # Show how WMI sees the current MAC address.
  1167. ("`nWMI reports the current MAC address for interface $index as " + $thenic.macaddress + ".").replace(":","")
  1168.  
  1169. # Show current registry value for MAC address, if any.
  1170. $macaddress = $regkey.getvalue("NetworkAddress")
  1171. if ($macaddress -eq $null) {"Custom MAC address registry value does not exist for interface index $index."}
  1172. else {"Current registry MAC value for interface $index is $macaddress."}
  1173.  
  1174. # If requested, delete the registry value for a custom MAC, which resets to the default burnt-in
  1175. # MAC; otherwise, set the registry value for a custom MAC address.
  1176. if ($resetdefault)
  1177. {
  1178.     if ($macaddress -ne $null)
  1179.     {
  1180.         "Deleting registry value for a custom MAC, which resets to the default MAC address."
  1181.         $regpath = "hklm:\system\CurrentControlSet\control\class\{4D36E972-E325-11CE-BFC1-08002BE10318}\$index"
  1182.         remove-itemproperty -path $regpath -name "NetworkAddress"
  1183.         if (-not $?) { "`nFAILED to delete the registry value for the MAC address!`n" ; exit }
  1184.     }
  1185. }
  1186. else
  1187. {
  1188.     # Set new value for MAC address.
  1189.     $regpath = "hklm:\system\CurrentControlSet\control\class\{4D36E972-E325-11CE-BFC1-08002BE10318}\$index"
  1190.     if ($wireless)
  1191.     {
  1192.         set-itemproperty -path $regpath -name "NetworkAddress" -value $(random-mac -locallyadministered)
  1193.     }
  1194.     else
  1195.     {
  1196.         set-itemproperty -path $regpath -name "NetworkAddress" -value $(random-mac)
  1197.     }
  1198.     if (-not $?) { "`nFAILED to set the registry value for the MAC address!`n" ; exit }
  1199.  
  1200.     # Show new registry value for MAC address.
  1201.     $macaddress = $regkey.getvalue("NetworkAddress")
  1202.     if ($macaddress -eq $null) { "`nFAILED to change the registry value for a custom MAC address`n" ; exit }
  1203.     else {"The new registry MAC value for interface $index is $macaddress."}
  1204. }
  1205.  
  1206. # Release DHCP leases, disable the interface, re-enable, renew DHCP.
  1207. if ($DoNotResetInterface)
  1208. {   "Changes will not take effect until after the interface has been disabled and enabled.`n" }
  1209. else
  1210. {
  1211.     "Refreshing the interface, this may take a few seconds..."
  1212.     ipconfig.exe /release """$($thenic.netconnectionid)"""   | out-null
  1213.     ipconfig.exe /release6 """$($thenic.netconnectionid)"""  | out-null
  1214.     $thenic.disable() | out-null
  1215.     if (-not $?) { "FAILED to disable the interface!" }
  1216.     $thenic.enable() | out-null
  1217.     if (-not $?) { "FAILED to enable the interface!" }
  1218.     ipconfig.exe /renew """$($thenic.netconnectionid)"""  | out-null
  1219.     ipconfig.exe /renew6 """$($thenic.netconnectionid)""" | out-null
  1220.     "...done refreshing the interface."
  1221.  
  1222.     # Confirm through WMI again that the change actually took effect.
  1223.     $thenic = Get-WmiObject -Query "select * from win32_networkadapter where deviceid = $index"
  1224.     ("WMI reports the current MAC address for interface $index as " + $thenic.macaddress + ".`n").replace(":","")
  1225. }
  1226.  
  1227. # END-MAC-SCRIPT
  1228.  
  1229. ##########
  1230. # Restart
  1231. ##########
  1232. Write-Host
  1233. Write-Host "Press any key to restart your system..." -ForegroundColor Black -BackgroundColor White
  1234. $key = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
  1235. Write-Host "Restarting..."
  1236. Restart-Computer
  1237. }
  1238.  
  1239. 1 {
  1240. Write-Host
  1241. Write-Host "Press any key to restart your system..." -ForegroundColor Black -BackgroundColor White
  1242. $key = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
  1243. Write-Host "Restarting..."
  1244. Restart-Computer
  1245. }
  1246. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!