Initial commit

scripts/powershell/verify-ai-removed.ps1

@@ -0,0 +1,111 @@
+[Console]::OutputEncoding = [Text.Encoding]::UTF8
+$ErrorActionPreference = 'SilentlyContinue'
+
+$pass = 0; $fail = 0
+function Check($label, [bool]$ok, $detail='') {
+    if ($ok) { $script:pass++; $mark = '[OK]  ' } else { $script:fail++; $mark = '[FAIL]' }
+    Write-Host ("{0} {1}" -f $mark, $label)
+    if ($detail) { Write-Host ("       {0}" -f $detail) }
+}
+
+Write-Host "===== Services (expect removed) ====="
+# Only actual AI services that RemoveWindowsAI targets.
+foreach ($s in @('WSAIFabricSvc','AarSvc')) {
+    $svc = Get-Service -Name $s -ErrorAction SilentlyContinue
+    $detail = if ($svc) { "still present (Status=$($svc.Status))" } else { "gone" }
+    Check "service '$s' removed" (-not $svc) $detail
+}
+
+Write-Host ""
+Write-Host "===== Appx packages (expect removed) ====="
+foreach ($pat in @('Microsoft.Copilot','Microsoft.MicrosoftCopilot','Microsoft.Windows.Copilot','MicrosoftWindows.Client.AIX','MicrosoftWindows.Client.CoreAI')) {
+    $pkg = Get-AppxPackage -AllUsers -Name "$pat*" -ErrorAction SilentlyContinue
+    $detail = if ($pkg) { "still present: $(($pkg | Select -Expand Name) -join ',')" } else { "not installed" }
+    Check "Appx '$pat*' removed" (-not $pkg) $detail
+}
+
+Write-Host ""
+Write-Host "===== Recall ====="
+$recall = Get-WindowsOptionalFeature -Online -FeatureName 'Recall' -ErrorAction SilentlyContinue
+if ($recall) {
+    Check "Recall optional feature disabled" ($recall.State -eq 'Disabled') "state=$($recall.State)"
+} else {
+    Check "Recall optional feature absent" $true "feature not found"
+}
+$rct = @(Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsAI\*' -ErrorAction SilentlyContinue)
+$detail = if ($rct.Count -gt 0) { "remaining: $(($rct | Select -Expand TaskName) -join ',')" } else { "none" }
+Check "WindowsAI scheduled tasks removed" ($rct.Count -eq 0) $detail
+
+Write-Host ""
+Write-Host "===== Policy registry ====="
+# Copilot's turn-off flag is under HKCU (tool writes to current user hive).
+# WindowsAI policy keys are machine-wide (HKLM).
+$policies = @(
+    @{ Path = 'HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot'; Name = 'TurnOffWindowsCopilot'; Expect = 1 },
+    @{ Path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI';      Name = 'DisableAIDataAnalysis'; Expect = 1 },
+    @{ Path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI';      Name = 'DisableClickToDo';      Expect = 1 },
+    @{ Path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI';      Name = 'AllowRecallEnablement';  Expect = 0 }
+)
+foreach ($p in $policies) {
+    $val = (Get-ItemProperty -Path $p.Path -Name $p.Name -ErrorAction SilentlyContinue).($p.Name)
+    $shortPath = $p.Path -replace '^HK..:\\SOFTWARE\\',''
+    Check "$shortPath : $($p.Name) == $($p.Expect)" ($val -eq $p.Expect) "actual=$val"
+}
+
+Write-Host ""
+Write-Host "===== Notepad Rewrite (per-user, populated on first Notepad launch) ====="
+# Key only appears after a user opens Notepad. Fail only if any user hive has RewriteEnabled=1.
+$bad = @()
+Get-ChildItem 'Registry::HKEY_USERS' -ErrorAction SilentlyContinue | ForEach-Object {
+    $np = "Registry::$($_.Name)\Software\Microsoft\Notepad"
+    $v = (Get-ItemProperty $np -Name RewriteEnabled -ErrorAction SilentlyContinue).RewriteEnabled
+    if ($v -eq 1) { $bad += "$($_.Name)=1" }
+}
+$d = if ($bad) { "enabled in: $($bad -join ',')" } else { "not enabled in any user hive" }
+Check "Notepad Rewrite not enabled anywhere" (-not $bad) $d
+
+Write-Host ""
+Write-Host "===== IntegratedServicesRegionPolicySet (Copilot entries) ====="
+$jsonPath = 'C:\Windows\System32\IntegratedServicesRegionPolicySet.json'
+if (Test-Path $jsonPath) {
+    $j = Get-Content $jsonPath -Raw | ConvertFrom-Json
+    $copilot = @($j.policies | Where-Object { ($_ | ConvertTo-Json -Depth 3) -match '[Cc]opilot' })
+    $disabled = @($copilot | Where-Object { $_.defaultState -eq 'disabled' })
+    $ok = ($copilot.Count -gt 0) -and ($disabled.Count -eq $copilot.Count)
+    Check "all Copilot policies disabled" $ok "disabled $($disabled.Count) of $($copilot.Count) Copilot entries"
+} else {
+    Check "IntegratedServicesRegionPolicySet.json present" $false "file missing"
+}
+
+Write-Host ""
+Write-Host "===== Update cleanup safety net ====="
+$uct = Get-ScheduledTask -TaskName '*RemoveAI*' -ErrorAction SilentlyContinue
+$uctDetail = if ($uct) { "found: $($uct.TaskName), state=$($uct.State)" } else { "missing" }
+Check "RemoveAI update-cleanup scheduled task exists" ([bool]$uct) $uctDetail
+
+Write-Host ""
+Write-Host "===== Leftover AI SystemApps (expect gone) ====="
+# Only check SystemApps dirs and WindowsApps — DLLs in System32 are protected and not
+# expected to be deleted; the services/executables are what matter.
+$paths = @(
+    'C:\Windows\SystemApps\MicrosoftWindows.Client.CoPilot_cw5n1h2txyewy',
+    'C:\Windows\SystemApps\MicrosoftWindows.Client.AIX_cw5n1h2txyewy'
+)
+foreach ($p in $paths) {
+    $hit = Get-Item -Path $p -ErrorAction SilentlyContinue
+    $d = if ($hit) { "still exists" } else { "gone" }
+    Check "path gone: $p" (-not $hit) $d
+}
+$wap = @(Get-ChildItem 'C:\Program Files\WindowsApps' -Filter 'Microsoft.Copilot_*' -ErrorAction SilentlyContinue)
+$d = if ($wap.Count -gt 0) { "$($wap.Count) dir(s)" } else { "none" }
+Check "WindowsApps Microsoft.Copilot_* gone" ($wap.Count -eq 0) $d
+
+Write-Host ""
+Write-Host "===== Restore point ====="
+$rps = Get-ComputerRestorePoint -ErrorAction SilentlyContinue | Where-Object { $_.Description -match 'RemoveWindowsAI' }
+$rpDetail = if ($rps) { "found: $(($rps | Select -Expand Description) -join ',')" } else { "none" }
+Check "RemoveWindowsAI restore point exists" ([bool]$rps) $rpDetail
+
+Write-Host ""
+Write-Host "===== Summary ====="
+Write-Host ("PASS: {0}   FAIL: {1}" -f $pass, $fail)