Initial commit

scripts/powershell/verify-debloat.ps1

@@ -0,0 +1,106 @@
+[Console]::OutputEncoding = [Text.Encoding]::UTF8
+$ErrorActionPreference = 'SilentlyContinue'
+
+$pass = 0; $fail = 0
+function Check($label, [bool]$ok, $detail='') {
+    if ($ok) { $script:pass++; $mark = '[OK]  ' } else { $script:fail++; $mark = '[FAIL]' }
+    Write-Host ("{0} {1}" -f $mark, $label)
+    if ($detail) { Write-Host ("       {0}" -f $detail) }
+}
+
+$userHives = Get-ChildItem 'Registry::HKEY_USERS' |
+    Where-Object { $_.Name -match 'S-1-5-21-' -and $_.Name -notmatch '_Classes$' } |
+    ForEach-Object { $_.Name }
+
+function Get-UserRegValue {
+    param([string]$SubPath, [string]$Name)
+    $hits = @()
+    foreach ($h in $userHives) {
+        $p = "Registry::$h\$SubPath"
+        $v = (Get-ItemProperty -Path $p -Name $Name -ErrorAction SilentlyContinue).$Name
+        if ($null -ne $v) { $hits += [pscustomobject]@{ Hive=$h; Value=$v } }
+    }
+    return $hits
+}
+
+Write-Host "===== Appx packages removed ====="
+foreach ($name in @('Microsoft.GamingApp','Microsoft.XboxGameOverlay','Microsoft.XboxGamingOverlay','Microsoft.windowscommunicationsapps','Microsoft.People','Microsoft.OutlookForWindows','Microsoft.BingSearch','Microsoft.Copilot','Microsoft.StartExperiencesApp')) {
+    $pkg = Get-AppxPackage -AllUsers -Name $name -ErrorAction SilentlyContinue
+    $detail = if ($pkg) { "still present" } else { "gone" }
+    Check "Appx '$name' removed" (-not $pkg) $detail
+}
+
+Write-Host ""
+Write-Host "===== Telemetry (HKLM) ====="
+$val = (Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection' -Name AllowTelemetry).AllowTelemetry
+Check "Policies\DataCollection\AllowTelemetry == 0" ($val -eq 0) "actual=$val"
+
+Write-Host ""
+Write-Host "===== Widgets / News & Interests (HKLM) ====="
+$val = (Get-ItemProperty 'HKLM:\Software\Policies\Microsoft\Dsh' -Name AllowNewsAndInterests).AllowNewsAndInterests
+Check "Dsh\AllowNewsAndInterests == 0" ($val -eq 0) "actual=$val"
+
+Write-Host ""
+Write-Host "===== GameDVR (HKLM policy + per-user) ====="
+$val = (Get-ItemProperty 'HKLM:\Software\Policies\Microsoft\Windows\GameDVR' -Name AllowGameDVR).AllowGameDVR
+Check "GameDVR policy AllowGameDVR == 0" ($val -eq 0) "actual=$val"
+$userDVR = Get-UserRegValue -SubPath 'System\GameConfigStore' -Name 'GameDVR_Enabled'
+$match = @($userDVR | Where-Object { $_.Value -eq 0 })
+Check "per-user GameDVR_Enabled == 0" ($match.Count -gt 0) "disabled in $($match.Count)/$($userDVR.Count) user hives"
+
+Write-Host ""
+Write-Host "===== Update behavior ====="
+$val = (Get-ItemProperty 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name NoAutoRebootWithLoggedOnUsers).NoAutoRebootWithLoggedOnUsers
+Check "WindowsUpdate\AU\NoAutoRebootWithLoggedOnUsers == 1" ($val -eq 1) "actual=$val"
+
+Write-Host ""
+Write-Host "===== Edge ads / Settings ads ====="
+foreach ($c in @(
+    @{ Path='HKLM:\Software\Policies\Microsoft\Edge'; Name='ShowRecommendationsEnabled'; Expect=0 },
+    @{ Path='HKLM:\Software\Policies\Microsoft\Edge'; Name='HubsSidebarEnabled';         Expect=0 }
+)) {
+    $val = (Get-ItemProperty -Path $c.Path -Name $c.Name -ErrorAction SilentlyContinue).($c.Name)
+    $short = $c.Path -replace '^HKLM:\\',''
+    Check "$short : $($c.Name) == $($c.Expect)" ($val -eq $c.Expect) "actual=$val"
+}
+
+Write-Host ""
+Write-Host "===== Bing / Search suggestions (per-user) ====="
+foreach ($c in @(
+    @{ Sub='Software\Policies\Microsoft\Windows\Explorer';             Name='DisableSearchBoxSuggestions'; Expect=1; Desc='Bing web search blocked in Start/Search' },
+    @{ Sub='Software\Microsoft\Windows\CurrentVersion\SearchSettings'; Name='IsDynamicSearchBoxEnabled';   Expect=0; Desc='Search highlights disabled' }
+)) {
+    $hits = Get-UserRegValue -SubPath $c.Sub -Name $c.Name
+    $match = @($hits | Where-Object { $_.Value -eq $c.Expect })
+    Check $c.Desc ($match.Count -gt 0) "$($match.Count) of $($hits.Count) user hives match"
+}
+
+Write-Host ""
+Write-Host "===== Spotlight (per-user) ====="
+$hits = Get-UserRegValue -SubPath 'Software\Policies\Microsoft\Windows\CloudContent' -Name 'DisableSpotlightCollectionOnDesktop'
+$match = @($hits | Where-Object { $_.Value -eq 1 })
+Check 'Desktop Spotlight disabled' ($match.Count -gt 0) "$($match.Count) of $($hits.Count) user hives match"
+
+Write-Host ""
+Write-Host "===== Explorer / UI (per-user) ====="
+$uiChecks = @(
+    @{ Sub='Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced';  Name='HideFileExt';           Expect=0; Desc='Show known file extensions' },
+    @{ Sub='Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced';  Name='Hidden';                Expect=1; Desc='Show hidden items' },
+    @{ Sub='Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced';  Name='TaskbarAl';             Expect=0; Desc='Taskbar aligned left' },
+    @{ Sub='Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced';  Name='ShowTaskViewButton';    Expect=0; Desc='Taskview button hidden' },
+    @{ Sub='Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced';  Name='LaunchTo';              Expect=1; Desc='Explorer opens to This PC' },
+    @{ Sub='Software\Microsoft\Windows\CurrentVersion\Themes\Personalize'; Name='AppsUseLightTheme';     Expect=0; Desc='Dark mode for apps' },
+    @{ Sub='Software\Microsoft\Windows\CurrentVersion\Themes\Personalize'; Name='SystemUsesLightTheme';  Expect=0; Desc='Dark mode for system' }
+)
+foreach ($r in $uiChecks) {
+    $hits = Get-UserRegValue -SubPath $r.Sub -Name $r.Name
+    $match = @($hits | Where-Object { $_.Value -eq $r.Expect })
+    $ok = $match.Count -gt 0
+    $detail = if ($hits.Count -eq 0) { "not set in any user hive" }
+              else { ($hits | ForEach-Object { "$(Split-Path $_.Hive -Leaf)=$($_.Value)" }) -join ', ' }
+    Check $r.Desc $ok $detail
+}
+
+Write-Host ""
+Write-Host "===== Summary ====="
+Write-Host ("PASS: {0}   FAIL: {1}" -f $pass, $fail)