[Console]::OutputEncoding = [Text.Encoding]::UTF8
$ErrorActionPreference = 'SilentlyContinue'

$pass = 0; $fail = 0
function Check($label, [bool]$ok, $detail='') {
    if ($ok) { $script:pass++; $mark = '[OK]  ' } else { $script:fail++; $mark = '[FAIL]' }
    Write-Host ("{0} {1}" -f $mark, $label)
    if ($detail) { Write-Host ("       {0}" -f $detail) }
}

$userHives = Get-ChildItem 'Registry::HKEY_USERS' |
    Where-Object { $_.Name -match 'S-1-5-21-' -and $_.Name -notmatch '_Classes$' } |
    ForEach-Object { $_.Name }

function Get-UserRegValue {
    param([string]$SubPath, [string]$Name)
    $hits = @()
    foreach ($h in $userHives) {
        $p = "Registry::$h\$SubPath"
        $v = (Get-ItemProperty -Path $p -Name $Name -ErrorAction SilentlyContinue).$Name
        if ($null -ne $v) { $hits += [pscustomobject]@{ Hive=$h; Value=$v } }
    }
    return $hits
}

Write-Host "===== Appx packages removed ====="
foreach ($name in @('Microsoft.GamingApp','Microsoft.XboxGameOverlay','Microsoft.XboxGamingOverlay','Microsoft.windowscommunicationsapps','Microsoft.People','Microsoft.OutlookForWindows','Microsoft.BingSearch','Microsoft.Copilot','Microsoft.StartExperiencesApp')) {
    $pkg = Get-AppxPackage -AllUsers -Name $name -ErrorAction SilentlyContinue
    $detail = if ($pkg) { "still present" } else { "gone" }
    Check "Appx '$name' removed" (-not $pkg) $detail
}

Write-Host ""
Write-Host "===== Telemetry (HKLM) ====="
$val = (Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection' -Name AllowTelemetry).AllowTelemetry
Check "Policies\DataCollection\AllowTelemetry == 0" ($val -eq 0) "actual=$val"

Write-Host ""
Write-Host "===== Widgets / News & Interests (HKLM) ====="
$val = (Get-ItemProperty 'HKLM:\Software\Policies\Microsoft\Dsh' -Name AllowNewsAndInterests).AllowNewsAndInterests
Check "Dsh\AllowNewsAndInterests == 0" ($val -eq 0) "actual=$val"

Write-Host ""
Write-Host "===== GameDVR (HKLM policy + per-user) ====="
$val = (Get-ItemProperty 'HKLM:\Software\Policies\Microsoft\Windows\GameDVR' -Name AllowGameDVR).AllowGameDVR
Check "GameDVR policy AllowGameDVR == 0" ($val -eq 0) "actual=$val"
$userDVR = Get-UserRegValue -SubPath 'System\GameConfigStore' -Name 'GameDVR_Enabled'
$match = @($userDVR | Where-Object { $_.Value -eq 0 })
Check "per-user GameDVR_Enabled == 0" ($match.Count -gt 0) "disabled in $($match.Count)/$($userDVR.Count) user hives"

Write-Host ""
Write-Host "===== Update behavior ====="
$val = (Get-ItemProperty 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name NoAutoRebootWithLoggedOnUsers).NoAutoRebootWithLoggedOnUsers
Check "WindowsUpdate\AU\NoAutoRebootWithLoggedOnUsers == 1" ($val -eq 1) "actual=$val"

Write-Host ""
Write-Host "===== Edge ads / Settings ads ====="
foreach ($c in @(
    @{ Path='HKLM:\Software\Policies\Microsoft\Edge'; Name='ShowRecommendationsEnabled'; Expect=0 },
    @{ Path='HKLM:\Software\Policies\Microsoft\Edge'; Name='HubsSidebarEnabled';         Expect=0 }
)) {
    $val = (Get-ItemProperty -Path $c.Path -Name $c.Name -ErrorAction SilentlyContinue).($c.Name)
    $short = $c.Path -replace '^HKLM:\\',''
    Check "$short : $($c.Name) == $($c.Expect)" ($val -eq $c.Expect) "actual=$val"
}

Write-Host ""
Write-Host "===== Bing / Search suggestions (per-user) ====="
foreach ($c in @(
    @{ Sub='Software\Policies\Microsoft\Windows\Explorer';             Name='DisableSearchBoxSuggestions'; Expect=1; Desc='Bing web search blocked in Start/Search' },
    @{ Sub='Software\Microsoft\Windows\CurrentVersion\SearchSettings'; Name='IsDynamicSearchBoxEnabled';   Expect=0; Desc='Search highlights disabled' }
)) {
    $hits = Get-UserRegValue -SubPath $c.Sub -Name $c.Name
    $match = @($hits | Where-Object { $_.Value -eq $c.Expect })
    Check $c.Desc ($match.Count -gt 0) "$($match.Count) of $($hits.Count) user hives match"
}

Write-Host ""
Write-Host "===== Spotlight (per-user) ====="
$hits = Get-UserRegValue -SubPath 'Software\Policies\Microsoft\Windows\CloudContent' -Name 'DisableSpotlightCollectionOnDesktop'
$match = @($hits | Where-Object { $_.Value -eq 1 })
Check 'Desktop Spotlight disabled' ($match.Count -gt 0) "$($match.Count) of $($hits.Count) user hives match"

Write-Host ""
Write-Host "===== Explorer / UI (per-user) ====="
$uiChecks = @(
    @{ Sub='Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced';  Name='HideFileExt';           Expect=0; Desc='Show known file extensions' },
    @{ Sub='Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced';  Name='Hidden';                Expect=1; Desc='Show hidden items' },
    @{ Sub='Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced';  Name='TaskbarAl';             Expect=0; Desc='Taskbar aligned left' },
    @{ Sub='Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced';  Name='ShowTaskViewButton';    Expect=0; Desc='Taskview button hidden' },
    @{ Sub='Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced';  Name='LaunchTo';              Expect=1; Desc='Explorer opens to This PC' },
    @{ Sub='Software\Microsoft\Windows\CurrentVersion\Themes\Personalize'; Name='AppsUseLightTheme';     Expect=0; Desc='Dark mode for apps' },
    @{ Sub='Software\Microsoft\Windows\CurrentVersion\Themes\Personalize'; Name='SystemUsesLightTheme';  Expect=0; Desc='Dark mode for system' }
)
foreach ($r in $uiChecks) {
    $hits = Get-UserRegValue -SubPath $r.Sub -Name $r.Name
    $match = @($hits | Where-Object { $_.Value -eq $r.Expect })
    $ok = $match.Count -gt 0
    $detail = if ($hits.Count -eq 0) { "not set in any user hive" }
              else { ($hits | ForEach-Object { "$(Split-Path $_.Hive -Leaf)=$($_.Value)" }) -join ', ' }
    Check $r.Desc $ok $detail
}

Write-Host ""
Write-Host "===== Summary ====="
Write-Host ("PASS: {0}   FAIL: {1}" -f $pass, $fail)