API tools faq
paste
View difference between Paste ID: cQWxva86 and VP1CcQ8p
SHOW: | | - or go back to the newest paste.
1
##########
2
# Win10 Initial Setup Script
3
# Author: Disassembler, Gr1d:, TheRoc
4
# Edited by Gr1D:
5
# dasm's script: https://github.com/Disassembler0/Win10-Initial-Setup-Script/
6
# Gr1D:'s Script: https://gist.github.com/TheRoboKitten/98b5b25345105a5e79f56d61eec4bc65
7
# TheROC's E.T. Disable script: https://gist.github.com/thoroc/86d354d029dda303598a
8
9
# THIS IS VERSION 5.5, error suppression is turned on. PLEASE be patient and PLEASE restart after running the script.

10
# This script leaves more MS defaults on, including MSE and smart-screen, 

11
# but blocks a ton of domains and disables remote assistance secures java, sets up ipsec..

12
# (please set your own key - SEE BELOW A FEW LINES) and disables SSL. Even changes your mac and takes steps to secure Google Chrome,

13
# Adobe Acrobat and Adobe Reader DC. To disable skynet turn off smartscreen and antivirus.

14
15
# NOTE: READ THIS SCRIPT CAREFULLY BEFORE RUNNING IT. ADJUST COMMENTS AS APPROPRIATE.

16
# This script will reboot your machine when completed.

17
# Setting up a new machine? See http://ninite.com (for devs, http://chocolatey.org)

18
##########

19
 

20
# Ask for elevated permissions if required

21
22
$ErrorActionPreference= 'silentlycontinue'

23
24
If (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")) {

25
    Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs

26
    Exit

27
}

28
29
30
#

31
# PLEASE EDIT THE BELOW LINE TO SET YOUR IPSEC PASSWORD (This may be randomly generated in the future)

32
$ThePreSharedKey = 'PasswordCHANGEME'

33
34
35
Write-Progress -Activity "Backing up registry. This may take awhile..." -Status "Progress:" -PercentComplete 1

36
del C:\registry-backup-hklm.reg

37
del C:\registry-backup-hkcu.reg

38
del C:\registry-backup-hkcr.reg

39
40
reg export HKLM C:\registry-backup-hklm.reg | Out-Null

41
reg export HKCU C:\registry-backup-hkcu.reg | Out-Null

42
reg export HKCR C:\registry-backup-hkcr.reg | Out-Null

43
Write-Progress -Activity "Backing up registry. This may take awhile..." -Status "Progress:" -PercentComplete 100

44
##########

45
# Privacy Settings

46
##########

47
Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 1

48
# Disable Telemetry

49
# Disable Telemetry

50
Write-Host "Disabling Telemetry..."

51
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 0

52
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 0

53
Set-ItemProperty -Path "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 0

54
55
# Enable Telemetry

56
# Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 3

57
# Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 3

58
# Set-ItemProperty -Path "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 3

59
60
# Disable Wi-Fi Sense

61
Write-Host "Disabling Wi-Fi Sense..."

62
If (!(Test-Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting")) {

63
    New-Item -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" -Force | Out-Null

64
}

65
Set-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" -Name "Value" -Type DWord -Value 0

66
Set-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotspots" -Name "Value" -Type DWord -Value 0

67
Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 15

68
# Enable Wi-Fi Sense

69
# Set-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" -Name "Value" -Type DWord -Value 1

70
# Set-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotspots" -Name "Value" -Type DWord -Value 1

71
 

72
# Disable SmartScreen Filter

73
# Write-Host "Disabling SmartScreen Filter..."

74
# Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer" -Name "SmartScreenEnabled" -Type String -Value "Off"

75
# Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AppHost" -Name "EnableWebContentEvaluation" -Type DWord -Value 0

76
 

77
# Enable SmartScreen Filter

78
Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer" -Name "SmartScreenEnabled" -Type String -Value "RequireAdmin"

79
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AppHost" -Name "EnableWebContentEvaluation"

80
 

81
# Disable Bing Search in Start Menu

82
Write-Host "Disabling Bing Search in Start Menu..."

83
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "BingSearchEnabled" -Type DWord -Value 0

84
 

85
# Enable Bing Search in Start Menu

86
# Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "BingSearchEnabled"

87
88
Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 30

89
# Disable Start Menu suggestions

90
# Write-Host "Disabling Start Menu suggestions..."

91
# Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" -Name "SystemPaneSuggestionsEnabled" -Type DWord -Value 0

92
93
# Enable Start Menu suggestions

94
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" -Name "SystemPaneSuggestionsEnabled" -Type DWord -Value 1

95
96
# Disable Location Tracking

97
Write-Host "Disabling Location Tracking..."

98
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Sensor\Overrides\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}" -Name "SensorPermissionState" -Type DWord -Value 0

99
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\lfsvc\Service\Configuration" -Name "Status" -Type DWord -Value 0

100
 

101
# Enable Location Tracking

102
# Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Sensor\Overrides\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}" -Name "SensorPermissionState" -Type DWord -Value 1

103
# Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\lfsvc\Service\Configuration" -Name "Status" -Type DWord -Value 1

104
Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 45

105
# Disable Feedback

106
Write-Host "Disabling Feedback..."

107
If (!(Test-Path "HKCU:\Software\Microsoft\Siuf\Rules")) {

108
    New-Item -Path "HKCU:\Software\Microsoft\Siuf\Rules" -Force | Out-Null

109
}

110
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Siuf\Rules" -Name "NumberOfSIUFInPeriod" -Type DWord -Value 0

111
 

112
# Enable Feedback

113
# Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Siuf\Rules" -Name "NumberOfSIUFInPeriod"

114
 

115
# Disable Advertising ID

116
Write-Host "Disabling Advertising ID..."

117
If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo")) {

118
    New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" | Out-Null

119
}

120
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" -Name "Enabled" -Type DWord -Value 0

121
 

122
# Enable Advertising ID

123
# Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" -Name "Enabled"

124
Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 60

125
# Disable Cortana

126
Write-Host "Disabling Cortana..."

127
If (!(Test-Path "HKCU:\Software\Microsoft\Personalization\Settings")) {

128
    New-Item -Path "HKCU:\Software\Microsoft\Personalization\Settings" -Force | Out-Null

129
}

130
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Personalization\Settings" -Name "AcceptedPrivacyPolicy" -Type DWord -Value 0

131
If (!(Test-Path "HKCU:\Software\Microsoft\InputPersonalization")) {

132
    New-Item -Path "HKCU:\Software\Microsoft\InputPersonalization" -Force | Out-Null

133
}

134
Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization" -Name "RestrictImplicitTextCollection" -Type DWord -Value 1

135
Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization" -Name "RestrictImplicitInkCollection" -Type DWord -Value 1

136
If (!(Test-Path "HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore")) {

137
    New-Item -Path "HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore" -Force | Out-Null

138
}

139
Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore" -Name "HarvestContacts" -Type DWord -Value 0

140
 

141
# Enable Cortana

142
# Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Personalization\Settings" -Name "AcceptedPrivacyPolicy"

143
# Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization" -Name "RestrictImplicitTextCollection" -Type DWord -Value 0

144
# Set-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization" -Name "RestrictImplicitInkCollection" -Type DWord -Value 0

145
# Remove-ItemProperty -Path "HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore" -Name "HarvestContacts"

146
 

147
# Restrict Windows Update P2P only to local network

148
Write-Host "Restricting Windows Update P2P only to local network..."

149
Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" -Name "DODownloadMode" -Type DWord -Value 1

150
If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization")) {

151
    New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization" | Out-Null

152
}

153
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization" -Name "SystemSettingsDownloadMode" -Type DWord -Value 3

154
 Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 75

155
# Unrestrict Windows Update P2P

156
# Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" -Name "DODownloadMode"

157
# Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization" -Name "SystemSettingsDownloadMode"

158
 

159
# Remove AutoLogger file and restrict directory

160
Write-Host "Removing AutoLogger file and restricting directory..."

161
$autoLoggerDir = "$env:PROGRAMDATA\Microsoft\Diagnosis\ETLLogs\AutoLogger"

162
If (Test-Path "$autoLoggerDir\AutoLogger-Diagtrack-Listener.etl") {

163
    Remove-Item "$autoLoggerDir\AutoLogger-Diagtrack-Listener.etl"

164
}

165
icacls $autoLoggerDir /deny SYSTEM:`(OI`)`(CI`)F | Out-Null

166
 

167
# Unrestrict AutoLogger directory

168
# $autoLoggerDir = "$env:PROGRAMDATA\Microsoft\Diagnosis\ETLLogs\AutoLogger"

169
# icacls $autoLoggerDir /grant:r SYSTEM:`(OI`)`(CI`)F | Out-Null

170
 

171
# Stop and disable Diagnostics Tracking Service

172
Write-Host "Stopping and disabling Diagnostics Tracking Service..."

173
Stop-Service "DiagTrack"

174
Set-Service "DiagTrack" -StartupType Disabled

175
 

176
# Enable and start Diagnostics Tracking Service

177
# Set-Service "DiagTrack" -StartupType Automatic

178
# Start-Service "DiagTrack"

179
Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 90

180
# Stop and disable WAP Push Service

181
Write-Host "Stopping and disabling WAP Push Service..."

182
Stop-Service "dmwappushservice"

183
Set-Service "dmwappushservice" -StartupType Disabled

184
 

185
# Enable and start WAP Push Service

186
# Set-Service "dmwappushservice" -StartupType Automatic

187
# Start-Service "dmwappushservice"

188
# Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\dmwappushservice" -Name "DelayedAutoStart" -Type DWord -Value 1

189
 

190
Write-Progress -Activity "Setting some privacy settings..." -Status "Progress:" -PercentComplete 100

191
 

192
##########

193
# Service Tweaks

194
##########

195
Write-Progress -Activity "Setting some service tweaks..." -Status "Progress:" -PercentComplete 1

196
# Lower UAC level

197
# Write-Host "Lowering UAC level..."

198
# Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Type DWord -Value 0

199
# Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "PromptOnSecureDesktop" -Type DWord -Value 0

200
 

201
# Raise UAC level

202
Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Type DWord -Value 5

203
Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "PromptOnSecureDesktop" -Type DWord -Value 1

204
 

205
# Enable sharing mapped drives between users

206
# Write-Host "Enabling sharing mapped drives between users..."

207
# Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLinkedConnections" -Type DWord -Value 1

208
 

209
# Disable sharing mapped drives between users

210
Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLinkedConnections"

211
 

212
# Disable Firewall

213
# Write-Host "Disabling Firewall..."

214
# Set-NetFirewallProfile -Profile * -Enabled False

215
 

216
# Enable Firewall

217
Set-NetFirewallProfile -Profile * -Enabled True

218
 

219
# Disable Windows Defender

220
# Write-Host "Disabling Windows Defender..."

221
# Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Type DWord -Value 1

222
223
#### Configure the two below options when NOT running windows defender. (These sound pretty shady.. SKYNET!)

224
225
# Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" -ValueName **del.SpynetReporting -Type String -Data ""

226
# Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" -ValueName SubmitSamplesConsent -Type DWord -Data 2

227
228
# Enable Windows Defender

229
Remove-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware"

230
Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Type DWord -Value 0

231
Write-Progress -Activity "Setting some service tweaks..." -Status "Progress:" -PercentComplete 45

232
233
# Disable Windows Update automatic restart

234
Write-Host "Disabling Windows Update automatic restart..def."

235
Set-ItemProperty -Path "HKLM:\Software\Microsoft\WindowsUpdate\UX\Settings" -Name "UxOption" -Type DWord -Value 1

236
 

237
# Enable Windows Update automatic restart

238
# Set-ItemProperty -Path "HKLM:\Software\Microsoft\WindowsUpdate\UX\Settings" -Name "UxOption" -Type DWord -Value 0

239
 

240
# Stop and disable Home Groups services

241
Write-Host "Stopping and disabling Home Groups services..."

242
Stop-Service "HomeGroupListener"

243
Set-Service "HomeGroupListener" -StartupType Disabled

244
Write-Progress -Activity "Setting some service tweaks..." -Status "Progress:" -PercentComplete 80

245
Stop-Service "HomeGroupProvider"

246
Set-Service "HomeGroupProvider" -StartupType Disabled

247
 

248
# Enable and start Home Groups services

249
# Set-Service "HomeGroupListener" -StartupType Manual

250
# Set-Service "HomeGroupProvider" -StartupType Manual

251
# Start-Service "HomeGroupProvider"

252
253
# Disable Remote Assistance

254
Write-Host "Disabling Remote Assistance..."

255
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Remote Assistance" -Name "fAllowToGetHelp" -Type DWord -Value 0

256
Write-Progress -Activity "Setting some service tweaks..." -Status "Progress:" -PercentComplete 80

257
# Enable Remote Assistance

258
# Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Remote Assistance" -Name "fAllowToGetHelp" -Type DWord -Value 1

259
 

260
# Enable Remote Desktop w/o Network Level Authentication

261
# Write-Host "Enabling Remote Desktop w/o Network Level Authentication..."

262
# Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Type DWord -Value 0

263
# Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication" -Type DWord -Value 0

264
 

265
# Disable Remote Desktop

266
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Type DWord -Value 1

267
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication" -Type DWord -Value 1

268
Write-Progress -Activity "Setting some service tweaks..." -Status "Progress:" -PercentComplete 100

269
 

270
 

271
##########

272
# UI Tweaks

273
##########

274
Write-Progress -Activity "Setting some UI tweaks..." -Status "Progress:" -PercentComplete 1

275
# Disable Action Center

276
Write-Host "Disabling Action Center..."

277
If (!(Test-Path "HKCU:\Software\Policies\Microsoft\Windows\Explorer")) {

278
  New-Item -Path "HKCU:\Software\Policies\Microsoft\Windows\Explorer" | Out-Null

279
}

280
Set-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Windows\Explorer" -Name "DisableNotificationCenter" -Type DWord -Value 1

281
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\PushNotifications" -Name "ToastEnabled" -Type DWord -Value 0

282
 

283
# Enable Action Center

284
# Remove-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Windows\Explorer" -Name "DisableNotificationCenter"

285
# Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\PushNotifications" -Name "ToastEnabled"

286
 

287
# Disable Lock screen

288
# Write-Host "Disabling Lock screen..."

289
# If (!(Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization")) {

290
# 	New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" | Out-Null

291
# }

292
# Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" -Name "NoLockScreen" -Type DWord -Value 1

293
294
# Enable Lock screen

295
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization" -Name "NoLockScreen"

296
297
# Disable Lock screen (Anniversary Update workaround)

298
#If ([System.Environment]::OSVersion.Version.Build -gt 14392) { # Apply only for Redstone 1 or newer

299
#	$service = New-Object -com Schedule.Service

300
#	$service.Connect()

301
#	$task = $service.NewTask(0)

302
#	$task.Settings.DisallowStartIfOnBatteries = $false

303
#	$trigger = $task.Triggers.Create(9)

304
#	$trigger = $task.Triggers.Create(11)

305
#	$trigger.StateChange = 8

306
#	$action = $task.Actions.Create(0)

307
#	$action.Path = "reg.exe"

308
#	$action.Arguments = "add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData /t REG_DWORD /v AllowLockScreen /d 0 /f"

309
#	$service.GetFolder("\").RegisterTaskDefinition("Disable LockScreen", $task, 6, "NT AUTHORITY\SYSTEM", $null, 4) | Out-Null

310
#}

311
312
# Enable Lock screen (Anniversary Update workaround)

313
#If ([System.Environment]::OSVersion.Version.Build -gt 14392) { # Apply only for Redstone 1 or newer

314
#	Unregister-ScheduledTask -TaskName "Disable LockScreen" -Confirm:$false -ErrorAction SilentlyContinue

315
#}

316
Write-Progress -Activity "Setting some UI tweaks..." -Status "Progress:" -PercentComplete 15

317
# Disable Autoplay

318
Write-Host "Disabling Autoplay..."

319
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers" -Name "DisableAutoplay" -Type DWord -Value 1

320
321
# Enable Autoplay

322
# Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers" -Name "DisableAutoplay" -Type DWord -Value 0

323
324
# Disable Autorun for all drives

325
Write-Host "Disabling Autorun for all drives..."

326
If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer")) {

327
  New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" | Out-Null

328
}

329
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoDriveTypeAutoRun" -Type DWord -Value 255

330
 

331
# Enable Autorun

332
# Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoDriveTypeAutoRun"

333
Write-Progress -Activity "Setting some UI tweaks..." -Status "Progress:" -PercentComplete 30

334
#Disable Sticky keys prompt

335
Write-Host "Disabling Sticky keys prompt..." 

336
Set-ItemProperty -Path "HKCU:\Control Panel\Accessibility\StickyKeys" -Name "Flags" -Type String -Value "506"

337
 

338
# Enable Sticky keys prompt

339
# Set-ItemProperty -Path "HKCU:\Control Panel\Accessibility\StickyKeys" -Name "Flags" -Type String -Value "510"

340
 

341
# Hide Search button / box I THINK THIS BREAKS OR THE DEVICEACCESS KEYS

342
# Write-Host "Hiding Search Box / Button..."

343
# Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "SearchboxTaskbarMode" -Type DWord -Value 0

344
 

345
# Show Search button / box

346
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "SearchboxTaskbarMode"

347
 

348
# Hide Task View button

349
# Write-Host "Hiding Task View button..."

350
# Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "ShowTaskViewButton" -Type DWord -Value 0

351
 

352
# Show Task View button

353
# Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "ShowTaskViewButton"

354
 

355
# Show small icons in taskbar

356
# Write-Host "Showing small icons in taskbar..."

357
# Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarSmallIcons" -Type DWord -Value 1

358
 

359
# Show large icons in taskbar

360
# Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarSmallIcons"

361
 

362
# Show titles in taskbar

363
# Write-Host "Showing titles in taskbar..."

364
# Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarGlomLevel" -Type DWord -Value 1

365
 

366
# Hide titles in taskbar

367
# Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarGlomLevel"

368
 

369
# Show all tray icons

370
# write-Host "Showing all tray icons..."

371
# Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer" -Name "EnableAutoTray" -Type DWord -Value 0

372
 

373
# Hide tray icons as needed

374
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer" -Name "EnableAutoTray"

375
Write-Progress -Activity "Setting some UI tweaks..." -Status "Progress:" -PercentComplete 45

376
# Show known file extensions

377
Write-Host "Showing known file extensions..."

378
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "HideFileExt" -Type DWord -Value 0

379
 

380
# Hide known file extensions

381
# Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "HideFileExt" -Type DWord -Value 1

382
 

383
# Show hidden files

384
Write-Host "Showing hidden files..."

385
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "Hidden" -Type DWord -Value 1

386
 

387
# Hide hidden files

388
# Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "Hidden" -Type DWord -Value 2

389
 

390
# Change default Explorer view to "Computer"

391
Write-Host "Changing default Explorer view to `"Computer`"..."

392
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "LaunchTo" -Type DWord -Value 1

393
Write-Progress -Activity "Setting some UI tweaks..." -Status "Progress:" -PercentComplete 75

394
# Change default Explorer view to "Quick Access"

395
# Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "LaunchTo"

396
 

397
# Show Computer shortcut on desktop

398
Write-Host "Showing Computer shortcut on desktop..."

399
If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu")) {

400
  New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" | Out-Null

401
}

402
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" -Type DWord -Value 0

403
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" -Type DWord -Value 0

404
Write-Progress -Activity "Setting some UI tweaks..." -Status "Progress:" -PercentComplete 100

405
# Hide Computer shortcut from desktop

406
# Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"

407
# Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"

408
 

409
# Remove Desktop icon from computer namespace

410
# Write-Host "Removing Desktop icon from computer namespace..."

411
# Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}" -Recurse -ErrorAction SilentlyContinue

412
 

413
# Add Desktop icon to computer namespace

414
# New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}"

415
 

416
# Remove Documents icon from computer namespace

417
# Write-Host "Removing Documents icon from computer namespace..."

418
# Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{d3162b92-9365-467a-956b-92703aca08af}" -Recurse -ErrorAction SilentlyContinue

419
# Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}" -Recurse -ErrorAction SilentlyContinue

420
 

421
# Add Documents icon to computer namespace

422
# New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{d3162b92-9365-467a-956b-92703aca08af}"

423
# New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}"

424
 

425
# Remove Downloads icon from computer namespace

426
# Write-Host "Removing Downloads icon from computer namespace..."

427
# Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{088e3905-0323-4b02-9826-5d99428e115f}" -Recurse -ErrorAction SilentlyContinue

428
# Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{374DE290-123F-4565-9164-39C4925E467B}" -Recurse -ErrorAction SilentlyContinue

429
 

430
# Add Downloads icon to computer namespace

431
# New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{088e3905-0323-4b02-9826-5d99428e115f}"

432
# New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{374DE290-123F-4565-9164-39C4925E467B}"

433
 

434
# Remove Music icon from computer namespace

435
# Write-Host "Removing Music icon from computer namespace..."

436
# Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}" -Recurse -ErrorAction SilentlyContinue

437
# Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}" -Recurse -ErrorAction SilentlyContinue

438
 

439
# Add Music icon to computer namespace

440
# New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}"

441
# New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}"

442
 

443
# Remove Pictures icon from computer namespace

444
# Write-Host "Removing Pictures icon from computer namespace..."

445
# Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}" -Recurse -ErrorAction SilentlyContinue

446
# Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}" -Recurse -ErrorAction SilentlyContinue

447
 

448
# Add Pictures icon to computer namespace

449
# New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}"

450
# New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}"

451
 

452
# Remove Videos icon from computer namespace

453
# Write-Host "Removing Videos icon from computer namespace..."

454
# Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}" -Recurse -ErrorAction SilentlyContinue

455
# Remove-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A0953C92-50DC-43bf-BE83-3742FED03C9C}" -Recurse -ErrorAction SilentlyContinue

456
 

457
# Add Videos icon to computer namespace

458
# New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}"

459
# New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A0953C92-50DC-43bf-BE83-3742FED03C9C}"

460
 

461
## Add secondary en-US keyboard

462
#Write-Host "Adding secondary en-US keyboard..."

463
#$langs = Get-WinUserLanguageList

464
#$langs.Add("en-US")

465
#Set-WinUserLanguageList $langs -Force

466
 

467
# Remove secondary en-US keyboard

468
Set-WinUserLanguageList En-US -Force

469
 

470
 

471
 

472
##########

473
# Remove unwanted applications

474
##########

475
Write-Progress -Activity "Removing Unwanted Apps" -Status "Progress:" -PercentComplete 1

476
# Disable OneDrive

477
Write-Host "Disabling OneDrive..."

478
If (!(Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive")) {

479
    New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" | Out-Null

480
}

481
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" -Name "DisableFileSyncNGSC" -Type DWord -Value 1

482
 

483
# Enable OneDrive

484
# Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" -Name "DisableFileSyncNGSC"

485
 

486
# Uninstall OneDrive

487
Write-Host "Uninstalling OneDrive... May sometimes hang"

488
Stop-Process -Name OneDrive -ErrorAction SilentlyContinue

489
Start-Sleep -s 3

490
$onedrive = "$env:SYSTEMROOT\SysWOW64\OneDriveSetup.exe"

491
If (!(Test-Path $onedrive)) {

492
    $onedrive = "$env:SYSTEMROOT\System32\OneDriveSetup.exe"

493
}

494
Start-Process $onedrive "/uninstall" -NoNewWindow -Wait

495
Start-Sleep -s 3

496
Stop-Process -Name explorer -ErrorAction SilentlyContinue

497
Start-Sleep -s 3

498
Remove-Item "$env:USERPROFILE\OneDrive" -Force -Recurse -ErrorAction SilentlyContinue

499
Remove-Item "$env:LOCALAPPDATA\Microsoft\OneDrive" -Force -Recurse -ErrorAction SilentlyContinue

500
Remove-Item "$env:PROGRAMDATA\Microsoft OneDrive" -Force -Recurse -ErrorAction SilentlyContinue

501
If (Test-Path "$env:SYSTEMDRIVE\OneDriveTemp") {

502
    Remove-Item "$env:SYSTEMDRIVE\OneDriveTemp" -Force -Recurse -ErrorAction SilentlyContinue

503
}

504
If (!(Test-Path "HKCR:")) {

505
    New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null

506
}

507
Remove-Item -Path "HKCR:\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" -Recurse -ErrorAction SilentlyContinue

508
Remove-Item -Path "HKCR:\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" -Recurse -ErrorAction SilentlyContinue

509
 

510
# Install OneDrive

511
# $onedrive = "$env:SYSTEMROOT\SysWOW64\OneDriveSetup.exe"

512
# If (!(Test-Path $onedrive)) {

513
#   $onedrive = "$env:SYSTEMROOT\System32\OneDriveSetup.exe"

514
# }

515
# Start-Process $onedrive -NoNewWindow

516
 

517
# Uninstall Almost Everything.

518
519-
# Get a list of all apps

519+
Write-Progress -Activity "Removing Unwanted Apps" -Status "Progress:" -PercentComplete 50

520-
$AppArrayList = Get-AppxPackage -PackageTypeFilter Bundle | Select-Object -Property Name, PackageFullName | Sort-Object -Property Name

520+
Get-AppxPackage -AllUsers | Remove-AppxPackage Get-AppxProvisionedPackage -online | where-object {$.packagename -notlike "Microsoft.WindowsStore"} | where-object {$.packagename -notlike "Microsoft.WindowsCalculator"} | Remove-AppxProvisionedPackage -online

521
Write-Progress -Activity "Removing Unwanted Apps" -Status "Progress:" -PercentComplete 75

522-
# Start a log file for apps removed successfully from OS.

522+
Get-AppxPackage -allusers | Remove-AppxPackage

523-
$Location = "C:\Windows\Logs\Software"

523+
Write-Progress -Activity "Removing Unwanted Apps" -Status "Progress:" -PercentComplete 90

524-
If((Test-Path $Location) -eq $False) {

524+
Get-AppXProvisionedPackage -online | Remove-AppxProvisionedPackage -online

525-
new-item -path C:\Windows\Logs\Software -ItemType Directory

525+
Write-Progress -Activity "Removing Unwanted Apps" -Status "Progress:" -PercentComplete 100

526
527-
get-date | Out-File -append C:\Windows\Logs\Software\OSDRemovedApps.txt

527+
528
# Install default Microsoft applications..

529-
# Loop through the list of apps

529+
530-
foreach ($App in $AppArrayList) {

530+
531-
# Exclude essential Windows apps

531+
532-
if (($App.Name -in "Microsoft.WindowsCalculator","Microsoft.WindowsStore","Microsoft.Appconnector","Microsoft.WindowsSoundRecorder","Microsoft.WindowsAlarms","Microsoft.MicrosoftStickyNotes")) {

532+
533-
Write-Output -InputObject "Skipping essential Windows app: $($App.Name)"

533+
534
Write-Progress -Activity "Installing Wanted Apps" -Status "Progress:" -PercentComplete 15

535-
# Remove AppxPackage and AppxProvisioningPackage

535+
536-
else {

536+
537-
# Gather package names

537+
538-
$AppPackageFullName = Get-AppxPackage -Name $App.Name | Select-Object -ExpandProperty PackageFullName

538+
539-
$AppProvisioningPackageName = Get-AppxProvisionedPackage -Online | Where-Object { $_.DisplayName -like $App.Name } | Select-Object -ExpandProperty PackageName

539+
540-
# Attempt to remove AppxPackage

540+
541-
try {

541+
542-
Write-Output -InputObject "Removing AppxPackage: $AppPackageFullName"

542+
543-
# Write the name of the removed apps to a logfile

543+
544-
$AppProvisioningPackageName | Out-File -append C:\Windows\Logs\Software\OSDRemovedApps.txt

544+
545-
Remove-AppxPackage -Package $AppPackageFullName -ErrorAction Stop

545+
546
Write-Progress -Activity "Installing Wanted Apps" -Status "Progress:" -PercentComplete 30

547-
catch [System.Exception] {

547+
548-
Write-Warning -Message $_.Exception.Message

548+
549
# Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsMaps").InstallLocation)\AppXManifest.xml"

550-
# Attempt to remove AppxProvisioningPackage

550+
551-
try {

551+
552-
Write-Output -InputObject "Removing AppxProvisioningPackage: $AppProvisioningPackageName"

552+
553-
Remove-AppxProvisionedPackage -PackageName $AppProvisioningPackageName -Online -ErrorAction Stop

553+
554
# Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.ZuneVideo").InstallLocation)\AppXManifest.xml"

555-
catch [System.Exception] {

555+
556-
Write-Warning -Message $_.Exception.Message

556+
557
# Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Office.Sway").InstallLocation)\AppXManifest.xml"

558
# Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.Messaging").InstallLocation)\AppXManifest.xml"

559
# Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.CommsPhone").InstallLocation)\AppXManifest.xml"

560
Write-Progress -Activity "Installing Wanted Apps" -Status "Progress:" -PercentComplete 45

561
# Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "9E2F88E3.Twitter").InstallLocation)\AppXManifest.xml"

562
# Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "king.com.CandyCrushSodaSaga").InstallLocation)\AppXManifest.xml"

563
# Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "4DF9E0F8.Netflix").InstallLocation)\AppXManifest.xml"

564
# Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Drawboard.DrawboardPDF").InstallLocation)\AppXManifest.xml"

565
Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.MicrosoftStickyNotes").InstallLocation)\AppXManifest.xml"

566
# Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.OneConnect").InstallLocation)\AppXManifest.xml"

567
Write-Progress -Activity "Installing Wanted Apps" -Status "Progress:" -PercentComplete 60

568
# Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "D52A8D61.FarmVille2CountryEscape").InstallLocation)\AppXManifest.xml"

569
# Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "GAMELOFTSA.Asphalt8Airborne").InstallLocation)\AppXManifest.xml"

570
# Add-AppxPackage -DisableDevelopmentMode -Register "$($(Get-AppXPackage -AllUsers "Microsoft.WindowsFeedbackHub").InstallLocation)\AppXManifest.xml"

571
# In case you have removed them for good, you can try to restore the files using installation medium as follows

572
# New-Item C:\Mnt -Type Directory | Out-Null

573
# dism /Mount-Image /ImageFile:D:\sources\install.wim /index:1 /ReadOnly /MountDir:C:\Mnt

574
# robocopy /S /SEC /R:0 "C:\Mnt\Program Files\WindowsApps" "C:\Program Files\WindowsApps"

575
# dism /Unmount-Image /Discard /MountDir:C:\Mnt

576
# Remove-Item -Path C:\Mnt -Recurse

577
Write-Progress -Activity "Installing Wanted Apps" -Status "Progress:" -PercentComplete 75

578
579
#Install .net

580
Dism /online /Enable-feature /featurename:NetFx3 /All

581
Get-AppxPackage -allusers Microsoft.NET.* | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register “$($_.InstallLocation)\AppXManifest.xml”}

582
583
584
# Disable Xbox DVR

585
# New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" | Out-Null (fix this)

586
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Name "AllowGameDVR" -Type DWord -Value 0

587
588
# Enable Xbox DVR

589
# New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" | Out-Null

590
# Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Name "AllowGameDVR" -ErrorAction SilentlyContinue

591
592
# Uninstall Windows Media Player

593
# Write-Host "Uninstalling Windows Media Player..."

594
# dism /online /Disable-Feature /FeatureName:MediaPlayback /Quiet /NoRestart

595
 

596
# Install Windows Media Player

597
# dism /online /Enable-Feature /FeatureName:MediaPlayback /Quiet /NoRestart

598
 

599
# Uninstall Work Folders Client

600
Write-Host "Uninstalling Work Folders Client..."

601
dism /online /Disable-Feature /FeatureName:WorkFolders-Client /Quiet /NoRestart

602
 

603
# Install Work Folders Client

604
# dism /online /Enable-Feature /FeatureName:WorkFolders-Client /Quiet /NoRestart

605
Write-Progress -Activity "Installing Wanted Apps" -Status "Progress:" -PercentComplete 100

606
607
# Set Photo Viewer as default for bmp, gif, jpg and png

608
Write-Host "Setting Photo Viewer as default for bmp, gif, jpg, png and tif..."

609
If (!(Test-Path "HKCR:")) {

610
    New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null

611
}

612
ForEach ($type in @("Paint.Picture", "giffile", "jpegfile", "pngfile")) {

613
    New-Item -Path $("HKCR:\$type\shell\open") -Force | Out-Null

614
    New-Item -Path $("HKCR:\$type\shell\open\command") | Out-Null

615
    Set-ItemProperty -Path $("HKCR:\$type\shell\open") -Name "MuiVerb" -Type ExpandString -Value "@%ProgramFiles%\Windows Photo Viewer\photoviewer.dll,-3043"

616
    Set-ItemProperty -Path $("HKCR:\$type\shell\open\command") -Name "(Default)" -Type ExpandString -Value "%SystemRoot%\System32\rundll32.exe `"%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll`", ImageView_Fullscreen %1"

617
}

618
 

619
# Remove or reset default open action for bmp, gif, jpg and png

620
If (!(Test-Path "HKCR:")) {

621
  New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null

622
}

623
Remove-Item -Path "HKCR:\Paint.Picture\shell\open" -Recurse

624
Remove-ItemProperty -Path "HKCR:\giffile\shell\open" -Name "MuiVerb"

625
Set-ItemProperty -Path "HKCR:\giffile\shell\open" -Name "CommandId" -Type String -Value "IE.File"

626
Set-ItemProperty -Path "HKCR:\giffile\shell\open\command" -Name "(Default)" -Type String -Value "`"$env:SystemDrive\Program Files\Internet Explorer\iexplore.exe`" %1"

627
Set-ItemProperty -Path "HKCR:\giffile\shell\open\command" -Name "DelegateExecute" -Type String -Value "{17FE9752-0B5A-4665-84CD-569794602F5C}"

628
Remove-Item -Path "HKCR:\jpegfile\shell\open" -Recurse

629
Remove-Item -Path "HKCR:\pngfile\shell\open" -Recurse

630
631
# Show Photo Viewer in "Open with..."

632
Write-Host "Showing Photo Viewer in `"Open with...`""

633
If (!(Test-Path "HKCR:")) {

634
    New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null

635
}

636
New-Item -Path "HKCR:\Applications\photoviewer.dll\shell\open\command" -Force | Out-Null

637
New-Item -Path "HKCR:\Applications\photoviewer.dll\shell\open\DropTarget" -Force | Out-Null

638
Set-ItemProperty -Path "HKCR:\Applications\photoviewer.dll\shell\open" -Name "MuiVerb" -Type String -Value "@photoviewer.dll,-3043"

639
Set-ItemProperty -Path "HKCR:\Applications\photoviewer.dll\shell\open\command" -Name "(Default)" -Type ExpandString -Value "%SystemRoot%\System32\rundll32.exe `"%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll`", ImageView_Fullscreen %1"

640
Set-ItemProperty -Path "HKCR:\Applications\photoviewer.dll\shell\open\DropTarget" -Name "Clsid" -Type String -Value "{FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}"

641
 

642
# Remove Photo Viewer from "Open with..."

643
# If (!(Test-Path "HKCR:")) {

644
#   New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null

645
# }

646
# Remove-Item -Path "HKCR:\Applications\photoviewer.dll\shell\open" -Recurse

647
 

648
# Enable F8 boot menu options

649
# Write-Host "Enabling F8 boot menu options..."

650
# bcdedit /set `{current`} bootmenupolicy Legacy | Out-Null

651
652
# Disable F8 boot menu options

653
# bcdedit /set `{current`} bootmenupolicy Standard | Out-Null

654
655
# Install Powershell man pages locally (low priority, uses bandwidth)

656
# Update-Help

657
658
Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 1

659
# Install Packages to edit Hosts file.

660
Write-Host "Installing PsHosts CMDlet to edit hosts file. Please be Patient. This may be slow sometimes buggy"

661
install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force

662
Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 10

663
Write-Host "Seting up Repository"

664
Set-PSRepository -Name "PSGallery" -InstallationPolicy Trusted

665
Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 20

666
Write-Host "Installing PSHosts Module"

667
install-module PsHosts

668
Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 30

669
Write-Host "Importing PSHosts Module"

670
import-module PsHosts

671
Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 40

672
# Hosts to block are below

673
Write-Host "Editing Hosts File..."

674
Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 50

675
# Clean old Hosts file

676
Remove-HostEntry *

677
678
# Add Hosts Entries

679
Add-HostEntry vortex.data.microsoft.com 127.0.0.1

680
Add-HostEntry vortex-win.data.microsoft.com 127.0.0.1

681
Add-HostEntry telecommand.telemetry.microsoft.com 127.0.0.1

682
Add-HostEntry telecommand.telemetry.microsoft.com.nsatc.net 127.0.0.1

683
Add-HostEntry oca.telemetry.microsoft.com 127.0.0.1

684
Add-HostEntry oca.telemetry.microsoft.com.nsatc.net 127.0.0.1

685
Add-HostEntry sqm.telemetry.microsoft.com 127.0.0.1

686
Add-HostEntry sqm.telemetry.microsoft.com.nsatc.net 127.0.0.1

687
Add-HostEntry watson.telemetry.microsoft.com 127.0.0.1

688
Add-HostEntry watson.telemetry.microsoft.com.nsatc.net 127.0.0.1

689
Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 60

690
Add-HostEntry redir.metaservices.microsoft.com 127.0.0.1

691
Add-HostEntry choice.microsoft.com 127.0.0.1

692
Add-HostEntry choice.microsoft.com.nsatc.net 127.0.0.1

693
Add-HostEntry df.telemetry.microsoft.com 127.0.0.1

694
Add-HostEntry reports.wes.df.telemetry.microsoft.com 127.0.0.1

695
Add-HostEntry wes.df.telemetry.microsoft.com 127.0.0.1

696
Add-HostEntry services.wes.df.telemetry.microsoft.com 127.0.0.1

697
Add-HostEntry sqm.df.telemetry.microsoft.com 127.0.0.1

698
Add-HostEntry telemetry.microsoft.com 127.0.0.1

699
Add-HostEntry watson.ppe.telemetry.microsoft.com 127.0.0.1

700
Add-HostEntry telemetry.appex.bing.net 127.0.0.1

701
Add-HostEntry telemetry.urs.microsoft.com 127.0.0.1

702
Add-HostEntry telemetry.appex.bing.net:443 127.0.0.1

703
Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 70

704
Add-HostEntry settings-sandbox.data.microsoft.com 127.0.0.1

705
Add-HostEntry vortex-sandbox.data.microsoft.com 127.0.0.1

706
Add-HostEntry survey.watson.microsoft.com 127.0.0.1

707
Add-HostEntry watson.live.com 127.0.0.1

708
Add-HostEntry watson.microsoft.com 127.0.0.1

709
Add-HostEntry statsfe2.ws.microsoft.com 127.0.0.1

710
Add-HostEntry corpext.msitadfs.glbdns2.microsoft.com 127.0.0.1

711
Add-HostEntry compatexchange.buttapp.net 127.0.0.1

712
Add-HostEntry cs1.wpc.v0cdn.net 127.0.0.1

713
Add-HostEntry a-0001.a-msedge.net 127.0.0.1

714
Add-HostEntry statsfe2.update.microsoft.com.akadns.net 127.0.0.1

715
Add-HostEntry sls.update.microsoft.com.akadns.net 127.0.0.1

716
Add-HostEntry fe2.update.microsoft.com.akadns.net 127.0.0.1

717
Add-HostEntry diagnostics.support.microsoft.com 127.0.0.1

718
Add-HostEntry corp.sts.microsoft.com 127.0.0.1

719
Add-HostEntry statsfe1.ws.microsoft.com 127.0.0.1

720
Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 75

721
Add-HostEntry pre.footprintpredict.com 127.0.0.1

722
Add-HostEntry i1.services.social.microsoft.com 127.0.0.1

723
Add-HostEntry i1.services.social.microsoft.com.nsatc.net 127.0.0.1

724
Add-HostEntry feedback.windows.com 127.0.0.1

725
Add-HostEntry feedback.microsoft-hohm.com 127.0.0.1

726
Add-HostEntry feedback.search.microsoft.com 127.0.0.1

727
Add-HostEntry ad.doubleclick.net 127.0.0.1

728
Add-HostEntry ads.msn.com 127.0.0.1

729
Add-HostEntry ads1.msads.net 127.0.0.1

730
Add-HostEntry ads1.msn.com 127.0.0.1

731
Add-HostEntry a.ads1.msn.com 127.0.0.1

732
Add-HostEntry a.ads2.msn.com 127.0.0.1

733
Add-HostEntry adnexus.net 127.0.0.1

734
Add-HostEntry adnxs.com 127.0.0.1

735
Add-HostEntry aidps.atdmt.com 127.0.0.1

736
Add-HostEntry apps.skype.com 127.0.0.1

737
Add-HostEntry az361816.vo.msecnd.net 127.0.0.1

738
Add-HostEntry az512334.vo.msecnd.net 127.0.0.1

739
Add-HostEntry a.rad.msn.com 127.0.0.1

740
Add-HostEntry a.ads2.msads.net 127.0.0.1

741
Add-HostEntry ac3.msn.com 127.0.0.1

742
Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 80

743
Add-HostEntry aka-cdn-ns.adtech.de 127.0.0.1

744
Add-HostEntry b.rad.msn.com 127.0.0.1

745
Add-HostEntry b.ads2.msads.net 127.0.0.1

746
Add-HostEntry b.ads1.msn.com 127.0.0.1

747
Add-HostEntry bs.serving-sys.com 127.0.0.1

748
Add-HostEntry c.msn.com 127.0.0.1

749
Add-HostEntry cdn.atdmt.com 127.0.0.1

750
Add-HostEntry cds26.ams9.msecn.net 127.0.0.1

751
Add-HostEntry c.atdmt.com 127.0.0.1

752
Add-HostEntry db3aqu.atdmt.com 127.0.0.1

753
Add-HostEntry ec.atdmt.com 127.0.0.1

754
Add-HostEntry flex.msn.com 127.0.0.1

755
Add-HostEntry g.msn.com 127.0.0.1

756
Add-HostEntry h2.msn.com 127.0.0.1

757
Add-HostEntry h1.msn.com 127.0.0.1

758
Add-HostEntry live.rads.msn.com 127.0.0.1

759
Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 85

760
Add-HostEntry msntest.serving-sys.com 127.0.0.1

761
Add-HostEntry m.adnxs.com 127.0.0.1

762
Add-HostEntry m.hotmail.com 127.0.0.1

763
Add-HostEntry preview.msn.com 127.0.0.1

764
Add-HostEntry pricelist.skype.com 127.0.0.1

765
Add-HostEntry rad.msn.com 127.0.0.1

766
Add-HostEntry rad.live.com 127.0.0.1

767
Add-HostEntry secure.flashtalking.com 127.0.0.1

768
Add-HostEntry static.2mdn.net 127.0.0.1

769
Add-HostEntry s.gateway.messenger.live.com 127.0.0.1

770
Add-HostEntry secure.adnxs.com 127.0.0.1

771
Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 90

772
Add-HostEntry sO.2mdn.net 127.0.0.1

773
Add-HostEntry ui.skype.com 127.0.0.1

774
Add-HostEntry view.atdmt.com 127.0.0.1

775
# The Below two domains may impact your network connectivity detection.

776
Add-HostEntry www.msftncsi.com 127.0.0.1

777
Add-HostEntry msftncsi.com 127.0.0.1

778
779
Write-Progress -Activity "Editing Hosts File" -Status "Progress:" -PercentComplete 100

780
781
# Edit Group Policy to set Chrome settings that cannot be set through registry.

782
# Refer to https://www.powershellgallery.com/packages/PolicyFileEditor/2.0.2

783
Write-Host "Installing PolicyFileEditor Module"

784
Install-Module -Name PolicyFileEditor

785
786
Write-Host "Importing PolicyFileEditor Module"

787
import-module -Name PolicyFileEditor

788
789
If (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")) {

790
    Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs

791
    Exit

792
}

793
794
Write-Host "Setting Chrome Settings..."

795
796
$MachineDir = "$env:systemroot\system32\GroupPolicy\Machine\registry.pol"

797
$RegPath = 'Software\Policies\Google\Chrome'

798
$RegName = 'AutoFillEnabled'

799
$RegData = '0'

800
$RegType = 'DWord'

801
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

802
803
$RegPath = 'Software\Policies\Google\Chrome'

804
$RegName = 'HomepageLocation'

805
$RegData = 'https://www.google.com'

806
$RegType = 'String'

807
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

808
809
$RegPath = 'Software\Policies\Google\Chrome'

810
$RegName = 'ProxyServerMode'

811
$RegData = '0'

812
$RegType = 'DWord'

813
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

814
815
$RegPath = 'Software\Policies\Google\Chrome'

816
$RegName = 'SafeBrowsingEnabled'

817
$RegData = '1'

818
$RegType = 'DWord'

819
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

820
821
$RegPath = 'Software\Policies\Google\Chrome'

822
$RegName = 'SavingBrowserHistoryDisabled'

823
$RegData = '0'

824
$RegType = 'DWord'

825
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

826
827
$RegPath = 'Software\Policies\Google\Chrome'

828
$RegName = 'SearchSuggestEnabled'

829
$RegData = '0'

830
$RegType = 'DWord'

831
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

832
833
$RegPath = 'Software\Policies\Google\Chrome'

834
$RegName = 'SyncDisabled'

835
$RegData = '1'

836
$RegType = 'DWord'

837
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

838
839
$RegPath = 'Software\Policies\Google\Chrome'

840
$RegName = 'MetricsReportingEnabled'

841
$RegData = '0'

842
$RegType = 'DWord'

843
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

844
845
# Use * to disable all plugins in place of DISABLEDPLUGINID

846
# To add more than one disabled plugin, copy the 5 lines below and mark the regname as 2..3..4..5 and so on after re-pasting.

847
$RegPath = 'Software\Policies\Google\Chrome\DisabledPlugins'

848
$RegName = '1'

849
$RegData = 'DISABLEDPLUGINID'

850
$RegType = 'String'

851
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

852
853
# Use * to disable all extensions in place of DISABLEDEXTENSIONID

854
# To add more than one disabled extension, copy the 5 lines below and mark the regname as 2..3..4..5 and so on after re-pasting.

855
$RegPath = 'Software\Policies\Google\Chrome\ExtensionInstallBlacklist'

856
$RegName = '1'

857
$RegData = 'DISABLEDEXTENSIONID'

858
$RegType = 'String'

859
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

860
861
# Use * to ENABLE all extensions in place of ENABLEDEXTENSIONID

862
# To add more than one enabled extension, copy the 5 lines below and mark the regname as 2..3..4..5 and so on after re-pasting.

863
$RegPath = 'Software\Policies\Google\Chrome\ExtensionInstallWhitelist'

864
$RegName = '1'

865
$RegData = 'ENABLEDEXTENSIONID'

866
$RegType = 'String'

867
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

868
869
# Use the below to blacklist URLs in chrome. You could probably use * to blacklist everything.

870
# To add more than one URL, copy the 5 lines below and append regname with the next number in the list.. 2..3..4..5 and so on.

871
$RegPath = 'Software\Policies\Google\Chrome\URLBlacklist'

872
$RegName = '1'

873
$RegData = 'www.tacos.com'

874
$RegType = 'String'

875
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

876
877
# Use the below to whitelist URLs in chrome.

878
# To add more than one URL, copy the 5 lines below and append regname with the next number in the list.. 2..3..4..5 and so on.

879
$RegPath = 'Software\Policies\Google\Chrome\URLWhitelist'

880
$RegName = '1'

881
$RegData = '*'

882
$RegType = 'String'

883
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

884
885
# Use the below to make a list of forced installed extensions, This will also delete any values to remove any rogue extensions as a security feature if they are within the

886
# list of 1-10 in the policy.

887
# To add more than one force installed extension, copy the 5 lines below and mark the regname as 2..3..4..5 and so on after re-pasting.

888
$RegPath = 'Software\Policies\Google\Chrome\ExtensionInstallForcelist'

889
$RegName = '1'

890
$RegData = 'EXTENSIONID'

891
$RegType = 'String'

892
Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 1

893
Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 2

894
Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 3

895
Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 4

896
Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 5

897
Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 6

898
Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 7

899
Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 8

900
Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 9

901
Remove-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName 10

902
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

903
904
$RegPath = 'Software\Policies\Google\Chrome'

905
$RegName = 'AllowOutdatedPlugins'

906
$RegData = '0'

907
$RegType = 'DWord'

908
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

909
910
$RegPath = 'Software\Policies\Google\Chrome'

911
$RegName = 'BackgroundModeEnabled'

912
$RegData = '0'

913
$RegType = 'DWord'

914
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

915
916
$RegPath = 'Software\Policies\Google\Chrome'

917
$RegName = 'BookmarkBarEnabled'

918
$RegData = '1'

919
$RegType = 'DWord'

920
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

921
922
$RegPath = 'Software\Policies\Google\Chrome'

923
$RegName = 'DefaultBrowserSettingEnabled'

924
$RegData = '1'

925
$RegType = 'DWord'

926
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

927
928
$RegPath = 'Software\Policies\Google\Chrome'

929
$RegName = 'DeveloperToolsDisabled'

930
$RegData = '1'

931
$RegType = 'DWord'

932
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

933
934
$RegPath = 'Software\Policies\Google\Chrome'

935
$RegName = 'EnableMediaRouter'

936
$RegData = '1'

937
$RegType = 'DWord'

938
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

939
940
$RegPath = 'Software\Policies\Google\Chrome'

941
$RegName = 'ForceGoogleSafeSearch'

942
$RegData = '1'

943
$RegType = 'DWord'

944
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

945
946
$RegPath = 'Software\Policies\Google\Chrome'

947
$RegName = 'FullscreenAllowed'

948
$RegData = '0'

949
$RegType = 'DWord'

950
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

951
952
$RegPath = 'Software\Policies\Google\Chrome'

953
$RegName = 'NetworkPredictionOptions'

954
$RegData = '2'

955
$RegType = 'DWord'

956
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

957
958
$RegPath = 'Software\Policies\Google\Chrome'

959
$RegName = 'SafeBrowsingEnabled'

960
$RegData = '1'

961
$RegType = 'DWord'

962
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

963
964
$RegPath = 'Software\Policies\Google\Chrome'

965
$RegName = 'SafeBrowsingExtendedReportingOptInAllowed'

966
$RegData = '0'

967
$RegType = 'DWord'

968
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

969
970
$RegPath = 'Software\Policies\Google\Chrome'

971
$RegName = 'SearchSuggestEnabled'

972
$RegData = '0'

973
$RegType = 'DWord'

974
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

975
976
$RegPath = 'Software\Policies\Google\Chrome'

977
$RegName = 'SpellCheckServiceEnabled'

978
$RegData = '0'

979
$RegType = 'DWord'

980
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

981
982
$RegPath = 'Software\Policies\Google\Chrome'

983
$RegName = 'SSLVersionMin'

984
$RegData = 'tls1'

985
$RegType = 'String'

986
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

987
988
$RegPath = 'Software\Policies\Google\Chrome'

989
$RegName = 'WelcomePageOnOSUpgradeEnabled'

990
$RegData = '0'

991
$RegType = 'DWord'

992
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

993
994
# End Chrome GP Settings

995
#

996
# Begin Adobe Acrobat/Reader DC Settings

997
$RegPath = 'Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockdown'

998
$RegName = 'bProtectedMode'

999
$RegData = '1'

1000
$RegType = 'DWord'

1001
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

1002
1003
$RegPath = 'Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockdown'

1004
$RegName = 'bUsageMeasurement'

1005
$RegData = '1'

1006
$RegType = 'DWord'

1007
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

1008
1009
$RegPath = 'Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockdown\cIPM'

1010
$RegName = 'bDontShowMsgWhenViewingDoc'

1011
$RegData = '1'

1012
$RegType = 'DWord'

1013
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

1014
1015
$RegPath = 'Software\Policies\Adobe\Acrobat Reader\DC\FeatureLockdown\cIPM'

1016
$RegName = 'bShowMsgAtLaunch'

1017
$RegData = '0'

1018
$RegType = 'DWord'

1019
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

1020
1021
$RegPath = 'Software\Policies\Adobe\Adobe Acrobat\2015\FeatureLockdown'

1022
$RegName = 'bUsageMeasurement'

1023
$RegData = '1'

1024
$RegType = 'DWord'

1025
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

1026
1027
$RegPath = 'Software\Policies\Adobe\Adobe Acrobat\2015\FeatureLockdown'

1028
$RegName = 'iProtectedView'

1029
$RegData = '2'

1030
$RegType = 'DWord'

1031
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

1032
1033
$RegPath = 'Software\Policies\Adobe\Adobe Acrobat\2015\FeatureLockdown\cIPM'

1034
$RegName = 'bShowMsgAtLaunch'

1035
$RegData = '0'

1036
$RegType = 'DWord'

1037
Set-PolicyFileEntry -Path $MachineDir -Key $RegPath -ValueName $RegName -Data $RegData -Type $RegType

1038
1039
# End Adobe Acrobat and Reader DC Settings

1040
#

1041
1042
# Force DEP to always on for every application (available options are: AlwaysOff, AlwaysOn, OptIn, OptOut)

1043
Write-Host "Turning on DEP for all applications."

1044
bcdedit /set nx AlwaysON

1045
1046
# Enable SEHOP (Exception write-protection function of DEP.)

1047
Write-Host "Enable Exception Write-Protection SEHOP"

1048
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v DisableExceptionChainValidation /t REG_DWORD /d 0 /f

1049
1050
# Check Cryptography Protection

1051
Write-Host "Checking Cryptography Protection."

1052
1053
# If the following query shows that MasterKeyLegacyCompliance is set to a non-zero number,

1054
# then it is bad sign that hackers or malware have set this value deliberately to weaken

1055
# the security of DPAPI-protected secrets like cached passwords or private keys.

1056
reg query HKLM\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb /v MasterKeyLegacyCompliance

1057
1058
# Run the following command to delete the MasterKeyLegacyCompliance value, which

1059
# is the default on Windows XP and later, and is best for security.

1060
reg delete HKLM\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb /v MasterKeyLegacyCompliance /f

1061
1062
# Disable NetBios (Forces File Sharing over port 445 DirectSMB/stops various worms.)

1063
Write-Host "Disabling Outdated NetBIOS Protocol..."

1064
sc.exe config netbt start= disabled 

1065
1066
# Reset NerBios Configuration to Default.

1067
# sc.exe config netbt start= system

1068
1069
# Set LAN connection to DHCP and renew.

1070
# netsh.exe int ip set address "Local Area Connection" dhcp

1071
# netsh.exe int ip set dns "Local Area Connection" dhcp

1072
# ipconfig /renew

1073
1074
# Set LAN connection to static and release.

1075
# ipconfig /release

1076
# netsh.exe int ip set dns "Local Area Connection" static 10.4.1.1 

1077
# netsh.exe int ip set address "Local Area Connection" static 10.4.1.1 255.255.0.0 

1078
1079
# Enable IPsec NAT

1080
Write-Host "Enabling IPSec NAT..."

1081
reg add "HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent" /v AssumeUDPEncapsulationContextOnSendRule /t REG_DWORD /d 00000002 /f

1082
1083
# Use these commands to audit logging policies.

1084
# auditpol.exe /get /category:*

1085
# auditpol.exe /get /subcategory:"MPSSVC rule-level Policy Change,Filtering Platform policy change,IPsec Main Mode,IPsec Quick Mode,IPsec Extended Mode,IPsec Driver,Other System Events,Filtering Platform Packet Drop,Filtering Platform Connection"

1086
1087
# Disable a lot of security logging (See end of command)

1088
# auditpol.exe /set /subcategory:"MPSSVC rule-level Policy Change,Filtering Platform policy change,IPsec Main Mode,IPsec Quick Mode,IPsec Extended Mode,IPsec Driver,Other System Events,Filtering Platform Packet Drop,Filtering Platform Connection" /success:Disable /failure:Disable

1089
1090
# Enable a lot of security logging (See end of command)

1091
auditpol.exe /set /subcategory:"MPSSVC rule-level Policy Change,Filtering Platform policy change,IPsec Main Mode,IPsec Quick Mode,IPsec Extended Mode,IPsec Driver,Other System Events,Filtering Platform Packet Drop,Filtering Platform Connection" /success:Enable /failure:Enable

1092
1093
# Enable oakley IPSec Diagnostics logging.

1094
reg add "HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent\Oakley" /v EnableLogging /t REG_DWORD /d 00000001 /f

1095
1096
# Enable Local IPSec Connections for ports 3389,135,139,445,21,20,23

1097
Write-Host "Enabling Local Network IPSEC on this machine if supported."

1098
netsh.exe advfirewall consec add rule name=Testing-IPSec-NETSH endpoint1=any port1=any endpoint2=localsubnet port2=3389,135,139,445,21,20,23 protocol=tcp profile=any action=requireinrequestout interfacetype=any auth1=computerpsk auth1psk=$ThePreSharedKey enable=yes

1099
1100
# Disable Local IPSec Connections for ports 3389,135,139,445,21,20,23

1101
# Write-Host "Disabling Local Network IPSEC on this machine if supported."

1102
# netsh.exe advfirewall consec add rule name=Testing-IPSec-NETSH endpoint1=any port1=any endpoint2=localsubnet port2=3389,135,139,445,21,20,23 protocol=tcp profile=any action=requireinrequestout interfacetype=any auth1=computerpsk auth1psk=$ThePreSharedKey enable=no

1103
1104
Write-Progress -Activity "Configuring SSL/TLS" -Status "Progress:" -PercentComplete 1

1105
#

1106
# 

1107
# The Two Lines Below Enable Superfectch and Prefetch

1108
Write-Host "Enabling Superfetch and Prefetch..."

1109
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnableSuperfetch /t REG_DWORD /d 00000003 /f

1110
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnablePrefetcher /t REG_DWORD /d 00000003 /f

1111
1112
# The Lines Below Disable SSL!!!

1113
Write-Host "Disabling SSL..."

1114
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client" /f

1115
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client" /v DisabledByDefault /t REG_DWORD /d 00000001 /f

1116
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client" /v Enabled /t REG_DWORD /d 00000000 /f

1117
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" /f

1118
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" /v DisabledByDefault /t REG_DWORD /d 00000001 /f

1119
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" /v Enabled /t REG_DWORD /d 00000000 /f

1120
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" /f

1121
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" /v DisabledByDefault /t REG_DWORD /d 00000001 /f

1122
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" /v Enabled /t REG_DWORD /d 00000000 /f

1123
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" /f

1124
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" /v DisabledByDefault /t REG_DWORD /d 00000001 /f

1125
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" /v Enabled /t REG_DWORD /d 00000000 /f

1126
Write-Progress -Activity "Configuring SSL/TLS" -Status "Progress:" -PercentComplete 25

1127
# The Lines Below Force And Enable TLS!!!

1128
Write-Host "Forcing and Enabling TLS!!!"

1129
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /f

1130
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /v DisabledByDefault /t REG_DWORD /d 00000000 /f

1131
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /v Enabled /t REG_DWORD /d 0xffffffff /f

1132
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /f

1133
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /v DisabledByDefault /t REG_DWORD /d 00000000 /f

1134
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /v Enabled /t REG_DWORD /d 0xffffffff /f

1135
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /f

1136
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /v DisabledByDefault /t REG_DWORD /d 00000000 /f

1137
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /v Enabled /t REG_DWORD /d 0xffffffff /f

1138
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /f

1139
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /v DisabledByDefault /t REG_DWORD /d 00000000 /f

1140
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /v Enabled /t REG_DWORD /d 0xffffffff /f

1141
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /f

1142
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v DisabledByDefault /t REG_DWORD /d 00000000 /f

1143
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v Enabled /t REG_DWORD /d 0xffffffff /f

1144
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /f

1145
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v DisabledByDefault /t REG_DWORD /d 00000000 /f

1146
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v Enabled /t REG_DWORD /d 0xffffffff /f

1147
Write-Progress -Activity "Configuring SSL/TLS" -Status "Progress:" -PercentComplete 70

1148
# The Registry Parameters Below are for TCP Security, I'm not sure what some of them do.

1149
Write-Host "Upgrading TCP Security..."

1150
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v IPEnableRouter /t REG_DWORD /d 00000000 /f

1151
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect /t REG_DWORD /d 00000000 /f

1152
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v SynAttackProtect /t REG_DWORD /d 00000002 /f

1153
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxHalfOpen /t REG_DWORD /d 00000064 /f

1154
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxHalfOpenRetried /t REG_DWORD /d 00000050 /f

1155
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v DisableIPSourceRouting /t REG_DWORD /d 00000002 /f

1156
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v NoNameReleaseOnDemand /t REG_DWORD /d 00000001 /f

1157
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableDeadGWDetect /t REG_DWORD /d 00000000 /f

1158
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v KeepAliveTime /t REG_DWORD /d 0x000493E0 /f

1159
Write-Progress -Activity "Configuring SSL/TLS" -Status "Progress:" -PercentComplete 100

1160
# Disable NTFS Last-Access Timestamp

1161
# Write-Host "Disabling NTFS Last-Access Timestamps..."

1162
# reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v NtfsDisableLastAccessUpdate /t REG_DWORD /d 00000001 /f

1163
1164
# Enable NTFS Last-Access Timestamp

1165
Write-Host "Enabling NTFS Last-Access Timestamps..."

1166
reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v NtfsDisableLastAccessUpdate /t REG_DWORD /d 00000000 /f

1167
1168
# Disable IPV6

1169
Write-Host "Disabling IPV6..."

1170
reg add "HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters" /v DisabledComponents /t REG_DWORD /d 0xffffffff /f

1171
1172
# Enable IPV6

1173
# Write-Host "EnTabling IPV6..."

1174
# reg add "HKLM\SYSEM\CurrentControlSet\services\TCPIP6\Parameters" /v DisabledComponents /t REG_DWORD /d 0 /f

1175
1176
# Force High Level of Remote Desktop Encryption and TLS Authentication.

1177
Write-Host "Requiring Strong Remote Desktop Encryption if enabled... And forcing TLS Authentication"

1178
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MinEncryptionLevel /t REG_DWORD /d 00000003 /f

1179
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer /t REG_DWORD /d 00000002 /f

1180
1181
# Disabling TCP/IP AutoTuning (see http://technet.microsoft.com/en-us/magazine/2007.01.cableguy.aspx)

1182
Write-Host "Disabling TCP/IP Auto-Tuning..."

1183
netsh.exe interface tcp set global autotuninglevel= disabled

1184
1185
# Enabling TCP/IP AutoTuning

1186
# netsh.exe interface tcp set global autotuninglevel= normal

1187
1188
# Reset Firewall To factory Defaults!!!

1189
# netsh.exe firewall reset

1190
#

1191
1192
1193
1194
# Begin Java Security Setting Script

1195
#

1196
#

1197
1198
Write-host "The next bit of code will either enable or disable java system-wide."

1199
1200
# Construct the strings for the deployment.properties file.

1201
# Be mindful of the below property, setting webjava to false will unisntall java and you will need to manually re-enable in IE.

1202
1203
$propertiesfile = "deployment.webjava.enabled=true "

1204
1205
# Default to locking the security level and browser plug-in state, i.e., they are visible but greyed out in Java Control Panel.

1206
$propertiesfile += "`ndeployment.webjava.enabled.locked `ndeployment.security.level.locked "

1207
1208
# Default to security level being set to VERY_HIGH (see Security tab of Java Control Panel).

1209
$propertiesfile += "`ndeployment.security.level=VERY_HIGH" 

1210
1211
1212
# Possibly delete the configuration files and exit, but leave the folder alone though.

1213
write-host "Deleting system-wide Java configuration files, if they exist..."

1214
remove-item $env:WinDir\Sun\Java\Deployment\deployment.config -Force

1215
remove-item $env:WinDir\Sun\Java\Deployment\deployment.properties -Force

1216
        

1217
1218
1219
# Create the $env:WinDir\Sun\Java\Deployment folder for the system-wide Java configuration files.

1220
New-Item -Path $env:WinDir\Sun\Java\Deployment -ItemType Directory -Force | Out-Null

1221
1222
# Create the deployment.config file.

1223
"deployment.system.config=$env:WinDir\Sun\Java\Deployment\deployment.properties" | 

1224
    Out-File -FilePath $env:WinDir\Sun\Java\Deployment\deployment.config -Force -Encoding ASCII

1225
if (-not $? -or -not $(Test-Path $env:WinDir\Sun\Java\Deployment\deployment.config))

1226
   { "`nCould not create the deployment.config file, exiting.`n" ; exit -1 } 

1227
1228
1229
# Create the deployment.properties file.

1230
$propertiesfile | Out-File -FilePath $env:WinDir\Sun\Java\Deployment\deployment.properties -Force -Encoding ASCII

1231
if (-not $? -or -not $(Test-Path $env:WinDir\Sun\Java\Deployment\deployment.properties))

1232
   { "`nCould not create the deployment.properties file, exiting.`n" ; exit -1 } 

1233
1234
1235
# Show system-wide deployment.properties file contents FYI.

1236
"`nCurrent contents of the deployment.properties file:`n"

1237
get-content $env:WinDir\Sun\Java\Deployment\deployment.properties ; "`n"

1238
1239
1240
1241
# Run latest ssvagent.exe for both x86 and x64, but not on Java Platform 6 or earlier, and 

1242
# hope future Javas support these switches (man, what a mess, doomed to rewrites...):

1243
if ($propertiesfile -like '*deployment.webjava.enabled=false*')

1244
{

1245
    # Try the x64 version, if any:

1246
    $ssvagent = $null

1247
    if (Test-Path -Path "$env:ProgramFiles\Java\")

1248
    {

1249
        $ssvagent = dir "$env:ProgramFiles\Java\*.exe" -Recurse | 

1250
                where { $_.name -eq 'ssvagent.exe' -and $_.fullname -notmatch '\\jre[1-6]\\'} | 

1251
                sort LastWriteTimeUtc -desc | select -first 1 

1252
    }

1253
1254
    if ($ssvagent -ne $null) 

1255
    { 

1256
        $expression = $ssvagent.FullName.Replace("Program Files","'Program Files'") + " -disablewebjava"

1257
        "Executing: $expression `n"

1258
        invoke-expression -command $expression

1259
    }

1260
1261
1262
    # Now for the x86 version second, because this is the Oracle-preferred:

1263
    $ssvagent = $null

1264
    if (Test-Path -Path "${env:ProgramFiles(x86)}\Java\")

1265
    {

1266
        $ssvagent = dir "${env:ProgramFiles(x86)}\Java\*.exe" -Recurse | 

1267
                where { $_.name -eq 'ssvagent.exe' -and $_.fullname -notmatch '\\jre[1-6]\\'} | 

1268
                sort LastWriteTimeUtc -desc | select -first 1 

1269
    }

1270
1271
    if ($ssvagent -ne $null) 

1272
    { 

1273
        $expression = $ssvagent.FullName.Replace("Program Files (x86)","'Program Files (x86)'") + " -disablewebjava"

1274
        "Executing: $expression `n"

1275
        invoke-expression -command $expression

1276
    }

1277
}

1278
elseif ($propertiesfile -like '*deployment.webjava.enabled=true*')

1279
{

1280
    # Try the x64 version, if any:

1281
    $ssvagent = $null

1282
    $ssvagent = dir "$env:ProgramFiles\Java\*.exe" -Recurse | 

1283
                where { $_.name -eq 'ssvagent.exe' -and $_.fullname -notmatch '\\jre[1-6]\\'} | 

1284
                sort LastWriteTimeUtc -desc | select -first 1 

1285
    if ($ssvagent -ne $null) 

1286
    { 

1287
        $expression = $ssvagent.FullName.Replace("Program Files","'Program Files'") + " -forceinstall -register -new -high"  #Only -high exists?

1288
        "Executing: $expression `n"

1289
        invoke-expression -command $expression

1290
    }

1291
1292
    # Now for the x86 version second, to let it possibly overwrite x64 settings, since x86 is Oracle-preferred:

1293
    $ssvagent = $null

1294
    $ssvagent = dir "${env:ProgramFiles(x86)}\Java\*.exe" -Recurse | 

1295
                where { $_.name -eq 'ssvagent.exe' -and $_.fullname -notmatch '\\jre[1-6]\\'} | 

1296
                sort LastWriteTimeUtc -desc | select -first 1 

1297
    if ($ssvagent -ne $null) 

1298
    { 

1299
        $expression = $ssvagent.FullName.Replace("Program Files (x86)","'Program Files (x86)'") + " -forceinstall -register -new -high"  #Only -high exists?

1300
        "Executing: $expression `n"

1301
        invoke-expression -command $expression

1302
    }

1303
}

1304
1305
# End Java Security Settings Script

1306
#

1307
#

1308
1309
# Disable scheduled tasks

1310
1311
Write-Progress -Activity "Disabling scheduled tasks" -Status "Progress:" -PercentComplete 0

1312
schtasks /Change /TN "Microsoft\Office\Office 15 Subscription Heartbeat" /Disable

1313
schtasks /Change /TN "Microsoft\Office\OfficeTelemetryAgentFallBack" /Disable

1314
schtasks /Change /TN "Microsoft\Office\OfficeTelemetryAgentLogOn" /Disable

1315
schtasks /Change /TN "Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /Disable

1316
schtasks /Change /TN "Microsoft\Windows\Application Experience\ProgramDataUpdater" /Disable

1317
schtasks /Change /TN "Microsoft\Windows\Autochk\Proxy" /Disable

1318
schtasks /Change /TN "Microsoft\Windows\CloudExperienceHost\CreateObjectTask" /Disable

1319
schtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /Disable

1320
schtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /Disable

1321
schtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\Uploader" /Disable

1322
Write-Progress -Activity "Disabling scheduled tasks" -Status "Progress:" -PercentComplete 25

1323
schtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /Disable

1324
schtasks /Change /TN "Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /Disable

1325
schtasks /Change /TN "Microsoft\Windows\Feedback\Siuf\DmClient" /Disable

1326
schtasks /Change /TN "Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser" /Disable

1327
schtasks /Change /TN "Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 Critical" /Disable

1328
schtasks /Change /TN "Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64" /Disable

1329
schtasks /Change /TN "Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 Critical" /Disable

1330
schtasks /Change /TN "Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319" /Disable

1331
schtasks /Change /TN "Microsoft\Windows\Windows Error Reporting\QueueReporting" /Disable

1332
Write-Progress -Activity "Disabling scheduled tasks" -Status "Progress:" -PercentComplete 50

1333
# Network stuff

1334
schtasks /Change /TN "Microsoft\Windows\NetCfg\BindingWorkItemQueueHandler" /Disable

1335
schtasks /Change /TN "Microsoft\Windows\NetTrace\GatherNetworkInfo" /Disable

1336
schtasks /Change /TN "Microsoft\Windows\Ras\MobilityManager" /Disable

1337
schtasks /Change /TN "Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask" /Disable

1338
schtasks /Change /TN "Microsoft\Windows\Shell\FamilySafetyMonitor" /Disable

1339
schtasks /Change /TN "Microsoft\Windows\Shell\FamilySafetyRefresh" /Disable

1340
schtasks /Change /TN "Microsoft\Windows\Shell\FamilySafetyUpload" /Disable

1341
schtasks /Change /TN "Microsoft\Windows\SpacePort\SpaceAgentTask" /Disable

1342
Write-Progress -Activity "Disabling scheduled tasks" -Status "Progress:" -PercentComplete 75

1343
schtasks /Change /TN "Microsoft\Windows\TextServicesFramework\MsCtfMonitor" /Disable

1344
schtasks /Change /TN "Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange" /Disable

1345
schtasks /Change /TN "Microsoft\Windows\Windows Media Sharing\UpdateLibrary" /Disable

1346
schtasks /Change /TN "Microsoft\Windows\Workplace Join\Automatic-Device-Join" /Disable

1347
# Maintenanace Tasks

1348
# schtasks /Change /TN "Microsoft\Windows\Application Experience\StartupAppTask" /Disable

1349
# schtasks /Change /TN "Microsoft\Windows\Defrag\ScheduledDefrag" /Disable

1350
# schtasks /Change /TN "Microsoft\Windows\DiskCleanup\SilentCleanup" /Disable

1351
# schtasks /Change /TN "Microsoft\Windows\DiskFootprint\Diagnostics" /Disable

1352
# schtasks /Change /TN "Microsoft\Windows\FileHistory\File History (maintenance mode)" /Disable

1353
# schtasks /Change /TN "Microsoft\Windows\Maintenance\WinSAT" /Disable

1354
schtasks /Change /TN "Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem" /Disable

1355
# schtasks /Change /TN "Microsoft\Windows\TPM\Tpm-HASCertRetr" /Disable

1356
# schtasks /Change /TN "Microsoft\Windows\TPM\Tpm-Maintenance" /Disable

1357
# schtasks /Change /TN "Microsoft\Windows\Shell\IndexerAutomaticMaintenance" /Disable

1358
Write-Progress -Activity "Disabling scheduled tasks" -Status "Progress:" -PercentComplete 80

1359
# Smartscreen

1360
# schtasks /Change /TN "Microsoft\Windows\AppID\SmartScreenSpecific" /Disable

1361
# Defender

1362
# schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

1363
# schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

1364
# schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

1365
# schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

1366
1367
# Some random scheduled task that is alittle fishy but halts the script

1368
# Unregister-ScheduledTask -TaskName BackgroundUploadTask -Confirm:$false

1369
1370
Write-Progress -Activity "Disabling scheduled tasks" -Status "Progress:" -PercentComplete 100

1371
1372
1373
Write-Progress -Activity "Disabling services" -Status "Progress:" -PercentComplete 0

1374
cmd /c sc config DiagTrack start= disabled | out-null

1375
cmd /c sc config dmwappushservice start= disabled | out-null

1376
cmd /c sc config diagnosticshub.standardcollector.service start= disabled | out-null

1377
cmd /c sc config TrkWks start= disabled | out-null

1378
cmd /c sc config WMPNetworkSvc start= disabled | out-null # Shouldn't exist but just making sure ...

1379
# Making sure the DiagTrack log is empty (tinfoil)

1380
Set-Content C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl -Value "" -Force

1381
Write-Progress -Activity "Disabling services" -Status "Progress:" -PercentComplete 100

1382
1383
# Tweak settings app

1384
Write-Progress -Activity "Tweaking settings app" -Status "Progress:" -PercentComplete 0

1385
# Privacy -> General -> let websites provide locally relevant content by accessing my language list

1386
Remove-ItemProperty -Path "HKCU:SOFTWARE\Microsoft\Internet Explorer\International" -Name "AcceptLanguage" -Force

1387
Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:Control Panel\International\User Profile" -Name HttpAcceptLanguageOptOut -Value 1 | Out-Null

1388
# Privacy -> General -> turn on smartscreen filter to check web content that windows store apps use

1389
Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost\" -Name EnableWebContentEvaluation -Value 0 -Force | Out-Null

1390
# Privacy -> Camera -> let apps use my camera

1391
Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{E5323777-F976-4f5b-9B55-B94699C46E44}" -Name "Value" -Type String -Value "Deny" | Out-Null

1392
# Privacy -> Microphone -> let apps use my microphone

1393
Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{2EEF81BE-33FA-4800-9670-1CD474972C3F}\" -Name "Value" -Type String -Value "Deny" | Out-Null

1394
# Privacy -> Account info -> let apps access my name, picture and other account info

1395
Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{C1D23ACC-752B-43E5-8448-8D0E519CD6D6}\" -Name "Value" -Type String -Value "Deny" | Out-Null

1396
# Privacy -> Calendar -> let apps access my calendar

1397
Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{D89823BA-7180-4B81-B50C-7E471E6121A3}\" -Name "Value" -Type String -Value "Deny" | Out-Null

1398
# Privacy -> Messaging -> let apps read or send sms and text messages

1399
Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{992AFA70-6F47-4148-B3E9-3003349C1548}\" -Name "Value" -Type String -Value "Deny" | Out-Null

1400
# Privacy -> Radio -> let apps control radios

1401
Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{A8804298-2D5F-42E3-9531-9C8C39EB29CE}\" -Name "Value" -Type String -Value "Deny" | Out-Null

1402
# Privacy -> Other devices -> sync with devices

1403
Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\LooselyCoupled\" -Name "Value" -Type String -Value "Deny" | Out-Null

1404
# Privacy -> Feedback & Diagnostics -> feedback frequency

1405
New-Item -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Siuf\Rules" -Force | Out-Null

1406
Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:SOFTWARE\Microsoft\Siuf\Rules" -Name NumberOfSIUFInPeriod -Value 0 -Force | Out-Null

1407
Remove-ItemProperty -Path "HKCU:SOFTWARE\Microsoft\Siuf\Rules" -Name PeriodInNanoSeconds

1408
# Ease of Access -> Other options -> Visual options -> play animations

1409
Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:Control Panel\Desktop\WindowMetrics" -Name MinAnimate -Value 0 | Out-Null

1410
# Update & Security -> Windows Update -> Advanced -> Choose how updates are delviered -> Updates from more than one place (this is a GUI bug, registry is set properly even though it may show 'ON')

1411
New-ItemProperty -ErrorAction SilentlyContinue -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" -Name "DownloadMode" -PropertyType DWORD -Value 0 | Out-Null

1412
Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" -Name "DODownloadMode" -Value 0 | Out-Null

1413
Set-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\" -Name "SystemSettingsDownloadMode" -Value 0 | Out-Null

1414
Write-Progress -Activity "Tweaking settings app" -Status "Progress:" -PercentComplete 100

1415
1416
#

1417
#

1418
# More Group Policy Tweaks

1419
1420
Write-Progress -Activity "Securing local group policy for privacy (this might take a minute or two)" -Status "Progress:" -PercentComplete 1

1421
# The reason I'm waiting 1s after each edit is to let the filesystem make necessary edits in the background, without the delay this will break local policies

1422
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\DataCollection" -ValueName AllowTelemetry -Type DWord -Data 0

1423
Start-Sleep 1

1424
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" -ValueName TurnOffSidebar -Type DWord -Data 1

1425
Start-Sleep 1

1426
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Assistance\Client\1.0" -ValueName NoActiveHelp -Type DWord -Data 1

1427
Start-Sleep 1

1428
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Biometrics" -ValueName Enabled -Type DWord -Data 1

1429
Start-Sleep 1

1430
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Conferencing" -ValueName NoRDS -Type DWord -Data 1

1431
Start-Sleep 1

1432
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\InputPersonalization" -ValueName AllowInputPersonalization -Type DWord -Data 0

1433
Start-Sleep 1

1434
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Internet Explorer\Geolocation" -ValueName PolicyDisableGeolocation -Type DWord -Data 1

1435
Start-Sleep 1

1436
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions" -ValueName NoUpdateCheck -Type DWord -Data 1

1437
Start-Sleep 1

1438
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Internet Explorer\Main" -ValueName DoNotTrack -Type DWord -Data 1

1439
Start-Sleep 1

1440
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Internet Explorer\Privacy" -ValueName EnableInPrivateBrowsing -Type DWord -Data 0

1441
Start-Sleep 1

1442
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Internet Explorer\SQM" -ValueName DisableCustomerImprovementProgram -Type DWord -Data 0

1443
Start-Sleep 1

1444
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Messenger\Client" -ValueName CEIP -Type DWord -Data 2

1445
Start-Sleep 1

1446
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Messenger\Client" -ValueName PreventAutoRun -Type DWord -Data 1

1447
Start-Sleep 1

1448
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main" -ValueName Cookies -Type DWord -Data 2

1449
Start-Sleep 1

1450
Write-Progress -Activity "Securing local group policy for privacy (this might take a minute or two)" -Status "Progress:" -PercentComplete 10

1451
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting" -ValueName DoReport -Type DWord -Data 0

1452
Start-Sleep 1

1453
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting" -ValueName ForceQueueMode -Type DWord -Data 0

1454
Start-Sleep 1

1455
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW" -ValueName DWFileTreeRoot -Type String -Data ""

1456
Start-Sleep 1

1457
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW" -ValueName DWNoExternalURL -Type DWord -Data 1

1458
Start-Sleep 1

1459
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW" -ValueName DWNoFileCollection -Type DWord -Data 1

1460
Start-Sleep 1

1461
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW" -ValueName DWNoSecondLevelCollection -Type DWord -Data 1

1462
Start-Sleep 1

1463
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW" -ValueName DWReporteeName -Type String -Data ""

1464
Start-Sleep 1

1465
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\SearchCompanion" -ValueName DisableContentFileUpdates -Type DWord -Data 1

1466
Start-Sleep 1

1467
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\SQMClient\Windows" -ValueName CEIPEnable -Type DWord -Data 0

1468
Start-Sleep 1

1469
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\010103000F0000F0080000000F0000F0D0B4EB5D3C24F17D10AE531C7DCEF4A94F4A085AD0D4C88B75082573E36F857A" -ValueName Category -Type DWord -Data 1

1470
Start-Sleep 1

1471
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\010103000F0000F0080000000F0000F0D0B4EB5D3C24F17D10AE531C7DCEF4A94F4A085AD0D4C88B75082573E36F857A" -ValueName CategoryReadOnly -Type DWord -Data 0

1472
Start-Sleep 1

1473
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" -ValueName NoGenTicket -Type DWord -Data 1

1474
Start-Sleep 1

1475
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows NT\IIS" -ValueName PreventIISInstall -Type DWord -Data 1

1476
Start-Sleep 1

1477
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows NT\Printers" -ValueName PhysicalLocation -Type String -Data anonymous

1478
Start-Sleep 1

1479
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo" -ValueName DisabledByGroupPolicy -Type DWord -Data 1

1480
Start-Sleep 1

1481
Write-Progress -Activity "Securing local group policy for privacy (this might take a minute or two)" -Status "Progress:" -PercentComplete 20

1482
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\AppCompat" -ValueName AITEnable -Type DWord -Data 0

1483
Start-Sleep 1

1484
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\AppCompat" -ValueName DisableInventory -Type DWord -Data 1

1485
Start-Sleep 1

1486
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\AppCompat" -ValueName DisableUAR -Type DWord -Data 1

1487
Start-Sleep 1

1488
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Device Metadata" -ValueName PreventDeviceMetadataFromNetwork -Type DWord -Data 1

1489
Start-Sleep 1

1490
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Settings" -ValueName DisableSendGenericDriverNotFoundToWER -Type DWord -Data 1

1491
Start-Sleep 1

1492
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Settings" -ValueName DisableSendRequestAdditionalSoftwareToWER -Type DWord -Data 1

1493
Start-Sleep 1

1494
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Explorer" -ValueName NoUseStoreOpenWith -Type DWord -Data 1

1495
Start-Sleep 1

1496
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\GameUX" -ValueName DownloadGameInfo -Type DWord -Data 0

1497
Start-Sleep 1

1498
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\GameUX" -ValueName GameUpdateOptions -Type DWord -Data 0

1499
Start-Sleep 1

1500
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\GameUX" -ValueName ListRecentlyPlayed -Type DWord -Data 0

1501
Start-Sleep 1

1502
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard" -ValueName ExitOnMSICW -Type DWord -Data 1

1503
Start-Sleep 1

1504
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors" -ValueName DisableLocation -Type DWord -Data 1

1505
Start-Sleep 1

1506
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\OneDrive" -ValueName DisableFileSyncNGSC -Type DWord -Data 1

1507
Start-Sleep 1

1508
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\PowerShell" -ValueName EnableScripts -Type DWord -Data 1

1509
Start-Sleep 1

1510
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\PowerShell" -ValueName ExecutionPolicy -Type String -Data "RemoteSigned"

1511
Start-Sleep 1

1512
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" -ValueName **del.EnableExperimentation -Type String -Data ""

1513
Start-Sleep 1

1514
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" -ValueName AllowBuildPreview -Type DWord -Data 0

1515
Start-Sleep 1

1516
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" -ValueName EnableConfigFlighting -Type DWord -Data 0

1517
Start-Sleep 1

1518
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\System" -ValueName AsyncScriptDelay -Type DWord -Data 1

1519
Start-Sleep 1

1520
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\System" -ValueName EnableLogonScriptDelay -Type DWord -Data 1

1521
Start-Sleep 1

1522
Write-Progress -Activity "Securing local group policy for privacy (this might take a minute or two)" -Status "Progress:" -PercentComplete 50

1523
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{186f47ef-626c-4670-800a-4a30756babad}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0

1524
Start-Sleep 1

1525
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{2698178D-FDAD-40AE-9D3C-1371703ADC5B}" -ValueName **del.EnabledScenarioExecutionLevel -Type String -Data ""

1526
Start-Sleep 1

1527
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{2698178D-FDAD-40AE-9D3C-1371703ADC5B}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0

1528
Start-Sleep 1

1529
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{67144949-5132-4859-8036-a737b43825d8}" -ValueName **del.EnabledScenarioExecutionLevel -Type String -Data ""

1530
Start-Sleep 1

1531
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{67144949-5132-4859-8036-a737b43825d8}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0

1532
Start-Sleep 1

1533
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0

1534
Start-Sleep 1

1535
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0

1536
Start-Sleep 1

1537
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}" -ValueName **del.EnabledScenarioExecutionLevel -Type String -Data ""

1538
Start-Sleep 1

1539
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0

1540
Start-Sleep 1

1541
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{C295FBBA-FD47-46ac-8BEE-B1715EC634E5}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0

1542
Start-Sleep 1

1543
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{dc42ff48-e40d-4a60-8675-e71f7e64aa9a}" -ValueName EnabledScenarioExecutionLevel -Type DWord -Data 1

1544
Start-Sleep 1

1545
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{dc42ff48-e40d-4a60-8675-e71f7e64aa9a}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0

1546
Start-Sleep 1

1547
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{ecfb03d1-58ee-4cc7-a1b5-9bc6febcb915}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0

1548
Start-Sleep 1

1549
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}" -ValueName **del.EnabledScenarioExecutionLevel -Type String -Data ""

1550
Start-Sleep 1

1551
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}" -ValueName ScenarioExecutionEnabled -Type DWord -Data 0

1552
Start-Sleep 1

1553
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" -ValueName Disabled -Type DWord -Data 1

1554
Start-Sleep 1

1555
Write-Progress -Activity "Securing local group policy for privacy (this might take a minute or two)" -Status "Progress:" -PercentComplete 60

1556
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" -ValueName DontSendAdditionalData -Type DWord -Data 1

1557
Start-Sleep 1

1558
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName AllowCortana -Type DWord -Data 0

1559
Start-Sleep 1

1560
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName AllowSearchToUseLocation -Type DWord -Data 0

1561
Start-Sleep 1

1562
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName ConnectedSearchPrivacy -Type DWord -Data 3

1563
Start-Sleep 1

1564
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName ConnectedSearchSafeSearch -Type DWord -Data 3

1565
Start-Sleep 1

1566
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName ConnectedSearchUseWeb -Type DWord -Data 0

1567
Start-Sleep 1

1568
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName ConnectedSearchUseWebOverMeteredConnections -Type DWord -Data 0

1569
Start-Sleep 1

1570
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\Windows Search" -ValueName DisableWebSearch -Type DWord -Data 1

1571
Start-Sleep 1

1572
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -ValueName DeferUpgrade -Type DWord -Data 1

1573
Start-Sleep 1

1574
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -ValueName DoNotConnectToWindowsUpdateInternetLocations -Type DWord -Data 1

1575
Start-Sleep 1

1576
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName **del.AutomaticMaintenanceEnabled -Type String -Data ""

1577
Start-Sleep 1

1578
Write-Progress -Activity "Securing local group policy for privacy (this might take a minute or two)" -Status "Progress:" -PercentComplete 75

1579
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName **del.DetectionFrequency -Type String -Data ""

1580
Start-Sleep 1

1581
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName AUOptions -Type DWord -Data 2

1582
Start-Sleep 1

1583
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName DetectionFrequencyEnabled -Type DWord -Data 0

1584
Start-Sleep 1

1585
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName EnableFeaturedSoftware -Type DWord -Data 1

1586
Start-Sleep 1

1587
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName NoAutoUpdate -Type DWord -Data 0

1588
Start-Sleep 1

1589
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName ScheduledInstallDay -Type DWord -Data 0

1590
Start-Sleep 1

1591
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName ScheduledInstallTime -Type DWord -Data 3

1592
Start-Sleep 1

1593
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\Machine\registry.pol -Key "SOFTWARE\Policies\Microsoft\WMDRM" -ValueName DisableOnline -Type DWord -Data 1

1594
Start-Sleep 1

1595
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\User\registry.pol -Key "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -ValueName NoInstrumentation -Type DWord -Data 1

1596
Start-Sleep 1

1597
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\User\registry.pol -Key "Software\Policies\Microsoft\Internet Explorer\Privacy" -ValueName EnableInPrivateBrowsing -Type DWord -Data 0

1598
Start-Sleep 1

1599
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\User\registry.pol -Key "Software\Policies\Microsoft\Internet Explorer\Safety\PrivacIE" -ValueName DisableLogging -Type DWord -Data 1

1600
Start-Sleep 1

1601
Set-PolicyFileEntry -Path $env:systemroot\system32\GroupPolicy\User\registry.pol -Key "Software\Policies\Microsoft\Windows\EdgeUI" -ValueName DisableMFUTracking -Type DWord -Data 1

1602
gpupdate /force

1603
Write-Progress -Activity "Securing local group policy for privacy (this might take a minute or two)" -Status "Progress:" -PercentComplete 100

1604
1605
# More Registry Tweaks

1606
# Fix DPI scaling blurry/fuzzy display at 125% (Might get reset by reboot/windows update)

1607
Write-Progress -Activity "More Registry Tweaks!" -Status "Progress:" -PercentComplete 5

1608
1609
New-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:\Control Panel\Desktop" -Name "DpiScalingVer" -Value "0x00001018" -PropertyType DWORD -Force

1610
New-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:\Control Panel\Desktop" -Name "Win8DpiScaling" -Value "0x00000001" -PropertyType DWORD -Force

1611
# This sets it to 125% DPI scaling, un-comment if you do need it (you use 125% dpi scaling)

1612
# New-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:\Control Panel\Desktop" -Name "LogPixels" -Value "0x00000078" -PropertyType DWORD -Force

1613
1614
# Add a 'Take Owner' option in your right-click menu (Powershell has problems with '*', using reg.exe)

1615
1616
echo Y | reg add "HKEY_CLASSES_ROOT\*\shell\runas" /ve /t REG_SZ /d "Take Ownership" /f

1617
echo Y | reg add "HKEY_CLASSES_ROOT\*\shell\runas" /v NoWorkingDirectory /t REG_SZ /d "" /f

1618
echo Y | reg add "HKEY_CLASSES_ROOT\*\shell\runas\command" /ve /t REG_SZ /d "cmd.exe /c takeown /f \`"%1\`" && icacls \`"%1\`" /grant administrators:F" /f

1619
echo Y | reg add "HKEY_CLASSES_ROOT\*\shell\runas\command" /v IsolatedCommand /t REG_SZ /d "cmd.exe /c takeown /f \`"%1\`" && icacls \`"%1\`" /grant administrators:F" /f

1620
Write-Progress -Activity "More Registry Tweaks!" -Status "Progress:" -PercentComplete 25

1621
New-Item -ErrorAction SilentlyContinue -Force -Path "HKCR:\Directory\shell\runas"

1622
New-Item -ErrorAction SilentlyContinue -Force -Path "HKCR:\Directory\shell\runas\command"

1623
New-ItemProperty -ErrorAction SilentlyContinue -Force -Path "HKCR:\Directory\shell\runas" -Name '(Default)' -Value "Take Ownership"

1624
New-ItemProperty -ErrorAction SilentlyContinue -Force -Path "HKCR:\Directory\shell\runas" -Name NoWorkingDirectory -Value ""

1625
Write-Progress -Activity "More Registry Tweaks!" -Status "Progress:" -PercentComplete 50

1626
New-ItemProperty -ErrorAction SilentlyContinue -Force -Path "HKCR:\Directory\shell\runas\command" -Name '(Default)' -Value "cmd.exe /c takeown /f `"%1`" /r /d y && icacls `"%1`" /grant administrators:F /t"

1627
New-ItemProperty -ErrorAction SilentlyContinue -Force -Path "HKCR:\Directory\shell\runas\command" -Name IsolatedCommand -Value "cmd.exe /c takeown /f `"%1`" /r /d y && icacls `"%1`" /grant administrators:F /t"

1628
1629
# Show file extensions

1630
New-ItemProperty -ErrorAction SilentlyContinue -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name HideFileExt -PropertyType DWORD -Value 0 -Force

1631
Write-Progress -Activity "More Registry Tweaks!" -Status "Progress:" -PercentComplete 75

1632
1633
1634
1635
# Enabling .NET 3.5 framework because a lot of programs still use it

1636
Dism /online /Enable-Feature /FeatureName:NetFx3 /quiet /norestart

1637
Write-Progress -Activity "More Registry Tweaks!" -Status "Progress:" -PercentComplete 100

1638
1639
#

1640
#

1641
# Change Mac Menu

1642
1643
1644
1645
1646
$Title = "Welcome"

1647
$Info = "To Change Or Not Change Your Mac (May not support Hyper-V)"

1648
 

1649
$options = [System.Management.Automation.Host.ChoiceDescription[]] @("&Yes", "&No", "&Quit")

1650
[int]$defaultchoice = 1

1651
$opt =  $host.UI.PromptForChoice($Title , $Info , $Options,$defaultchoice)

1652
switch($opt)

1653
{

1654
0 {

1655
#

1656
#

1657
# The Below Script Enable a random mac on wifi. This may not work on all computers!!! (Especially HYPER-V)

1658
1659
Write-Host "Enabling Random MAC address on WIFI!!! Please be patient... This may not work on all computers!!! (Especially HYPER-V)"

1660
function random-mac ($ManufacturerName, $ManufacturerID, $Delimiter, [Switch] $TotallyRandom, [Switch] $LocallyAdministered, [Switch] $Multicast)

1661
{   

1662
	# $mac will be padded with random hex later, but add a random vendor ID by default.

1663
    if ($TotallyRandom) { $mac = "" }  

1664
	else

1665
	{

1666
		# First three bytes will come from the manufacturer ID number.

1667
		# Some input checking of the manufacturer selection...

1668
		if ($ManufacturerName -and $ManufacturerName.StartsWith("3")) { $ManufacturerName = "ThreeCom" } 

1669
		if ($ManufacturerName -and $ManufacturerName.ToUpper().StartsWith("D-")) { $ManufacturerName = "DLink" }

1670
		if ($ManufacturerID -and $ManufacturerID.ToString().length -gt 12) { $ManufacturerID = $ManufacturerID.ToString().SubString(0,12) } 

1671
		

1672
		# Manufacturer identifiers last updated on 5.Feb.2011:

1673
		$vendor = @{

1674
			"Netgear" = "0024B2 0026F2 30469A A021B7 C03F0E C43DC7 E0469A E091F5 000FB5 00146C 00184D 001B2F 001E2A 001F33 00223F 00095B" ;

1675
			"DLink" = "00055D 000D88 000F3D 001195 001346 0015E9 00179A 00195B 001B11 001CF0 001E58 002191 0022B0 002401 00265A 0050BA 0080C8 14D64D 1CAFF7 1CBDB9 340804 5CD998 F07D68" ;

1676
			"ThreeCom" = "000102 000103 00029C 00040B 00051A 00068C 000A04 000A5E 000BAC 000D54 000E6A 000FCB 00104B 00105A 0012A9 00147C 0016E0 00186E 001AC1 001CC5 001EC1 0020AF 002257 002473 002654 00301E 005004 005099 0050DA 006008 00608C 006097 009004 00A024 00D096 00D0D8 02608C 02C08C 08004E 20FDF1 4001C6" ;

1677
			"Intel" = "0002B3 000347 000423 0007E9 000CF1 000E0C 000E35 001111 0012F0 001302 001320 0013CE 0013E8 001500 001517 00166F 001676 0016EA 0016EB 0018DE 0019D1 0019D2 001B21 001B77 001CBF 001CC0 001DE0 001DE1 001E64 001E65 001E67 001F3B 001F3C 00207B 00215C 00215D 00216A 00216B 0022FA 0022FB 002314 002315 0024D6 0024D7 0026C6 0026C7 00270E 002710 0050F1 009027 00A0C9 00AA00 00AA01 00AA02 00D0B7 081196 0CD292 100BA9 183DA2 247703 4025C2 448500 4C8093 502DA2 58946B 648099 64D4DA 685D43 74E50B 78929C 809B20 88532E 8CA982 A088B4 AC7289 BC7737 DCA971" ;

1678
			"HP" = "0001E6 0001E7 0002A5 0004EA 000802 000883 0008C7 000A57 000BCD 000D9D 000E7F 000EB3 000F20 000F61 001083 0010E3 00110A 001185 001279 001321 001438 0014C2 001560 001635 001708 0017A4 001871 0018FE 0019BB 001A4B 001B78 001CC4 001E0B 001F29 00215A 002264 00237D 002481 0025B3 002655 00306E 0030C1 00508B 0060B0 00805F 0080A0 080009 18A905 1CC1DE 2C27D7 3C4A92 643150 68B599 78ACC0 78E3B5 78E7D1 984BE1 B499BA B8AF67 D48564 D8D385 F4CE46" ;

1679
			"Apple" = "000393 000502 000A27 000A95 000D93 0010FA 001124 001451 0016CB 0017F2 0019E3 001B63 001CB3 001D4F 001E52 001EC2 001F5B 001FF3 0021E9 002241 002312 002332 00236C 0023DF 002436 002500 00254B 0025BC 002608 00264A 0026B0 0026BB 003065 0050E4 00A040 041E64 080007 1093E9 109ADD 18E7F4 24AB81 28E7CF 34159E 3C0754 40A6D9 40D32D 442A60 581FAA 5855CA 58B035 5C5948 60334B 60FB42 64B9E8 70CD60 78CA39 7C6D62 7CC537 7CF05F 88C663 8C5877 8C7B9D 9027E4 90840D 9803D8 A46706 A4B197 B8FF61 C42C03 C82A14 C8BCC8 CC08E0 D49A20 D83062 D89E3F D8A25E DC2B61 E0F847 E4CE8F E80688 F0B479 F81EDF" ;

1680
			"AlliedTelesis" = "0000CD 0000F4 000941 000A79 000DDA 001130 001577 001AEB 002687 009099 00A0D2 ECCD6D" ;

1681
			"QLogic" = "000E1E 001B32 0024FF 00C0DD 00E08B"

1682
		}

1683
1684
		# Check that $ManufacturerName actually matches one of the valid $vendors here.

1685
		if ($ManufacturerName -and ($vendor.keys -notcontains $ManufacturerName)) 

1686
		{ throw "`nYou must choose a vendor from this list:`n" + $vendor.keys } 

1687
		

1688
		# Generate the first three bytes of the MAC or use the $ManufacturerID instead.

1689
		if ($ManufacturerID) { $mac = $ManufacturerID.ToString().ToUpper() -replace '[^A-F0-9]',"" }

1690
		elseif ($ManufacturerName) { $mac = get-random -input @($vendor.$ManufacturerName -split " ") } 

1691
		else { $mac = get-random -input @($vendor.$(get-random -input @($vendor.keys)) -split " ") } 

1692
    }

1693
    

1694
    # Now padright with random hex characters until we have twelve chars.

1695
    while ($mac.length -lt 12) 

1696
	{ 

1697
		$mac += "{0:X}" -f $(get-random -min 0 -max 16) 

1698
	} 

1699
    

1700
	# Now set the unicast/multicast flag bit.

1701
	# First low-order bit (right-most bit): 0 = unicast, 1 = multicast

1702
    # For the bit flags, see http://en.wikipedia.org/wiki/MAC_address	

1703
	[Byte] $firstbyte = "0x" + $mac.substring(0,2)      # Convert first two hex chars to a byte.

1704
1705
	if ($multicast)

1706
	{

1707
		$firstbyte = [Byte] $firstbyte -bor [Byte] 1     # Set low-order bit to 1: multicast

1708
		$mac = ("{0:X}" -f $firstbyte).padleft(2,"0") + $mac.substring(2) 

1709
	}

1710
	else

1711
	{

1712
		$firstbyte = [Byte] $firstbyte -band [Byte] 254  # Set low-order bit to 0: unicast

1713
		$mac = ("{0:X}" -f $firstbyte).padleft(2,"0") + $mac.substring(2) 

1714
	}

1715
	

1716
	

1717
	# Now set the vendor-unique/locally-administered flag.

1718
	# Next-to-low-order bit (second from right): 0 = unique vendor, 1 = locally administered

1719
	if ($locallyadministered)

1720
	{

1721
		$firstbyte = [Byte] $firstbyte -bor [Byte] 2     # Set second low-order bit to 1: locally

1722
		$mac = ("{0:X}" -f $firstbyte).padleft(2,"0") + $mac.substring(2) 

1723
	}

1724
	else

1725
	{

1726
		$firstbyte = [Byte] $firstbyte -band [Byte] 253  # Set second low-order bit to 0: vendor unique

1727
		$mac = ("{0:X}" -f $firstbyte).padleft(2,"0") + $mac.substring(2) 

1728
	}

1729
	

1730
		

1731
    # Add delimiter, if any, and return the $mac.

1732
    if ($Delimiter) 

1733
    { 

1734
		for ($i = 0 ; $i -le 10 ; $i += 2) 

1735
		{ $newmac += $mac.substring($i,2) + $Delimiter }

1736
		$newmac.substring(0,$($newmac.length - $Delimiter.length)) 

1737
	} 

1738
    else

1739
    { $mac } 

1740
}

1741
1742
1743
# Get the NICs which are not tunnels, not for virtual machines, and not for bluetooth.

1744
$nics = @(Get-WmiObject -Query "select * from win32_networkadapter where adaptertype != 'Tunnel' and adaptertype is not null" | `

1745
where { $_.description -notmatch 'VMware|Virtual|WAN Miniport|ISATAP|RAS Async|Teredo|Windows Mobile Remote|6to4|Bluetooth' } )

1746
1747
# If more than one physical NIC, prompt the user to select one, if the index number was not given.

1748
if ($nics.count -eq 0) { "`nCannot identify a valid network interface device, quitting...`n" ; exit }

1749
elseif ($nics.count -eq 1 -and -not $InterfaceIndexNumber) { $index = $nics[0].index } 

1750
else 

1751
{

1752
    if ($InterfaceIndexNumber) { $index = $InterfaceIndexNumber } 

1753
    else

1754
    {

1755
        # Print a list of interfaces and prompt user to choose one.

1756
        "`n"; $nics | format-table index,macaddress,netconnectionid,description -autosize

1757
        $index = read-host -prompt "`nEnter the index number of the desired interface" 

1758
    }

1759
} 

1760
1761
# Check that a valid index number was actually entered.

1762
$good = $false; switch ($nics | foreach {$_.index}) { $index { $good = $true } } 

1763
if (-not $good) { "`n$index is not a valid index number, quitting...`n" ; exit } 

1764
1765
# Confirm that you can get the NIC by the index number, so that it can be disabled/enabled later too.

1766
$thenic = Get-WmiObject -Query "select * from win32_networkadapter where deviceid = $index"

1767
if (-not $?) { "`nThere was a problem getting the interface, quitting...`n" ; exit } 

1768
1769
# The registry key for the nic always has four digits, so padleft, then get the key.

1770
$index = $index.tostring().padleft(4,"0")

1771
$regkey = get-item "hklm:\system\CurrentControlSet\control\class\{4D36E972-E325-11CE-BFC1-08002BE10318}\$index" 

1772
if (-not $?) { "`nThere was a problem getting the registry key, quitting...`n" ; exit } 

1773
1774
# Show how WMI sees the current MAC address.

1775
("`nWMI reports the current MAC address for interface $index as " + $thenic.macaddress + ".").replace(":","")

1776
1777
# Show current registry value for MAC address, if any.

1778
$macaddress = $regkey.getvalue("NetworkAddress")

1779
if ($macaddress -eq $null) {"Custom MAC address registry value does not exist for interface index $index."} 

1780
else {"Current registry MAC value for interface $index is $macaddress."}

1781
1782
# If requested, delete the registry value for a custom MAC, which resets to the default burnt-in 

1783
# MAC; otherwise, set the registry value for a custom MAC address.

1784
if ($resetdefault)

1785
{

1786
	if ($macaddress -ne $null)

1787
	{

1788
		"Deleting registry value for a custom MAC, which resets to the default MAC address."

1789
		$regpath = "hklm:\system\CurrentControlSet\control\class\{4D36E972-E325-11CE-BFC1-08002BE10318}\$index"

1790
		remove-itemproperty -path $regpath -name "NetworkAddress"

1791
		if (-not $?) { "`nFAILED to delete the registry value for the MAC address!`n" ; exit } 

1792
	}

1793
}

1794
else

1795
{

1796
	# Set new value for MAC address.

1797
	$regpath = "hklm:\system\CurrentControlSet\control\class\{4D36E972-E325-11CE-BFC1-08002BE10318}\$index"

1798
	if ($wireless)

1799
	{

1800
		set-itemproperty -path $regpath -name "NetworkAddress" -value $(random-mac -locallyadministered) 

1801
	}

1802
	else

1803
	{

1804
		set-itemproperty -path $regpath -name "NetworkAddress" -value $(random-mac) 

1805
	}

1806
	if (-not $?) { "`nFAILED to set the registry value for the MAC address!`n" ; exit } 

1807
1808
	# Show new registry value for MAC address.

1809
	$macaddress = $regkey.getvalue("NetworkAddress")

1810
	if ($macaddress -eq $null) { "`nFAILED to change the registry value for a custom MAC address`n" ; exit } 

1811
	else {"The new registry MAC value for interface $index is $macaddress."}

1812
}

1813
1814
# Release DHCP leases, disable the interface, re-enable, renew DHCP.

1815
if ($DoNotResetInterface)

1816
{   "Changes will not take effect until after the interface has been disabled and enabled.`n" } 

1817
else

1818
{

1819
    "Refreshing the interface, this may take a few seconds..."

1820
    ipconfig.exe /release """$($thenic.netconnectionid)"""   | out-null

1821
    ipconfig.exe /release6 """$($thenic.netconnectionid)"""  | out-null

1822
    $thenic.disable() | out-null

1823
    if (-not $?) { "FAILED to disable the interface!" } 

1824
    $thenic.enable() | out-null

1825
    if (-not $?) { "FAILED to enable the interface!" } 

1826
    ipconfig.exe /renew """$($thenic.netconnectionid)"""  | out-null

1827
    ipconfig.exe /renew6 """$($thenic.netconnectionid)""" | out-null

1828
    "...done refreshing the interface."

1829
1830
    # Confirm through WMI again that the change actually took effect.

1831
    $thenic = Get-WmiObject -Query "select * from win32_networkadapter where deviceid = $index"

1832
    ("WMI reports the current MAC address for interface $index as " + $thenic.macaddress + ".`n").replace(":","")

1833
}

1834
1835
# END-MAC-SCRIPT

1836
1837
##########

1838
# Restart

1839
##########

1840
Write-Host

1841
Write-Host "Press any key to restart your system..." -ForegroundColor Black -BackgroundColor White

1842
$key = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")

1843
Write-Host "Restarting..."

1844
Restart-Computer

1845
}

1846
1847
1 {

1848
Write-Host

1849
Write-Host "Press any key to restart your system..." -ForegroundColor Black -BackgroundColor White

1850
$key = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")

1851
Write-Host "Restarting..."

1852
Restart-Computer

1853
}

1854
}
        

    


            


                                


        

            



                
    

        Public Pastes
    

    
            

    

                    

        

    





    


    
    
    
    
    
    
    
    




    


    



                

            We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.             OK, I Understand
        

    
                

            

                
                    
                
            

            

                Not a member of Pastebin yet?

                Sign Up, it unlocks many cool features!