107 lines
5.7 KiB
PowerShell
107 lines
5.7 KiB
PowerShell
[Console]::OutputEncoding = [Text.Encoding]::UTF8
|
|
$ErrorActionPreference = 'SilentlyContinue'
|
|
|
|
$pass = 0; $fail = 0
|
|
function Check($label, [bool]$ok, $detail='') {
|
|
if ($ok) { $script:pass++; $mark = '[OK] ' } else { $script:fail++; $mark = '[FAIL]' }
|
|
Write-Host ("{0} {1}" -f $mark, $label)
|
|
if ($detail) { Write-Host (" {0}" -f $detail) }
|
|
}
|
|
|
|
$userHives = Get-ChildItem 'Registry::HKEY_USERS' |
|
|
Where-Object { $_.Name -match 'S-1-5-21-' -and $_.Name -notmatch '_Classes$' } |
|
|
ForEach-Object { $_.Name }
|
|
|
|
function Get-UserRegValue {
|
|
param([string]$SubPath, [string]$Name)
|
|
$hits = @()
|
|
foreach ($h in $userHives) {
|
|
$p = "Registry::$h\$SubPath"
|
|
$v = (Get-ItemProperty -Path $p -Name $Name -ErrorAction SilentlyContinue).$Name
|
|
if ($null -ne $v) { $hits += [pscustomobject]@{ Hive=$h; Value=$v } }
|
|
}
|
|
return $hits
|
|
}
|
|
|
|
Write-Host "===== Appx packages removed ====="
|
|
foreach ($name in @('Microsoft.GamingApp','Microsoft.XboxGameOverlay','Microsoft.XboxGamingOverlay','Microsoft.windowscommunicationsapps','Microsoft.People','Microsoft.OutlookForWindows','Microsoft.BingSearch','Microsoft.Copilot','Microsoft.StartExperiencesApp')) {
|
|
$pkg = Get-AppxPackage -AllUsers -Name $name -ErrorAction SilentlyContinue
|
|
$detail = if ($pkg) { "still present" } else { "gone" }
|
|
Check "Appx '$name' removed" (-not $pkg) $detail
|
|
}
|
|
|
|
Write-Host ""
|
|
Write-Host "===== Telemetry (HKLM) ====="
|
|
$val = (Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection' -Name AllowTelemetry).AllowTelemetry
|
|
Check "Policies\DataCollection\AllowTelemetry == 0" ($val -eq 0) "actual=$val"
|
|
|
|
Write-Host ""
|
|
Write-Host "===== Widgets / News & Interests (HKLM) ====="
|
|
$val = (Get-ItemProperty 'HKLM:\Software\Policies\Microsoft\Dsh' -Name AllowNewsAndInterests).AllowNewsAndInterests
|
|
Check "Dsh\AllowNewsAndInterests == 0" ($val -eq 0) "actual=$val"
|
|
|
|
Write-Host ""
|
|
Write-Host "===== GameDVR (HKLM policy + per-user) ====="
|
|
$val = (Get-ItemProperty 'HKLM:\Software\Policies\Microsoft\Windows\GameDVR' -Name AllowGameDVR).AllowGameDVR
|
|
Check "GameDVR policy AllowGameDVR == 0" ($val -eq 0) "actual=$val"
|
|
$userDVR = Get-UserRegValue -SubPath 'System\GameConfigStore' -Name 'GameDVR_Enabled'
|
|
$match = @($userDVR | Where-Object { $_.Value -eq 0 })
|
|
Check "per-user GameDVR_Enabled == 0" ($match.Count -gt 0) "disabled in $($match.Count)/$($userDVR.Count) user hives"
|
|
|
|
Write-Host ""
|
|
Write-Host "===== Update behavior ====="
|
|
$val = (Get-ItemProperty 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name NoAutoRebootWithLoggedOnUsers).NoAutoRebootWithLoggedOnUsers
|
|
Check "WindowsUpdate\AU\NoAutoRebootWithLoggedOnUsers == 1" ($val -eq 1) "actual=$val"
|
|
|
|
Write-Host ""
|
|
Write-Host "===== Edge ads / Settings ads ====="
|
|
foreach ($c in @(
|
|
@{ Path='HKLM:\Software\Policies\Microsoft\Edge'; Name='ShowRecommendationsEnabled'; Expect=0 },
|
|
@{ Path='HKLM:\Software\Policies\Microsoft\Edge'; Name='HubsSidebarEnabled'; Expect=0 }
|
|
)) {
|
|
$val = (Get-ItemProperty -Path $c.Path -Name $c.Name -ErrorAction SilentlyContinue).($c.Name)
|
|
$short = $c.Path -replace '^HKLM:\\',''
|
|
Check "$short : $($c.Name) == $($c.Expect)" ($val -eq $c.Expect) "actual=$val"
|
|
}
|
|
|
|
Write-Host ""
|
|
Write-Host "===== Bing / Search suggestions (per-user) ====="
|
|
foreach ($c in @(
|
|
@{ Sub='Software\Policies\Microsoft\Windows\Explorer'; Name='DisableSearchBoxSuggestions'; Expect=1; Desc='Bing web search blocked in Start/Search' },
|
|
@{ Sub='Software\Microsoft\Windows\CurrentVersion\SearchSettings'; Name='IsDynamicSearchBoxEnabled'; Expect=0; Desc='Search highlights disabled' }
|
|
)) {
|
|
$hits = Get-UserRegValue -SubPath $c.Sub -Name $c.Name
|
|
$match = @($hits | Where-Object { $_.Value -eq $c.Expect })
|
|
Check $c.Desc ($match.Count -gt 0) "$($match.Count) of $($hits.Count) user hives match"
|
|
}
|
|
|
|
Write-Host ""
|
|
Write-Host "===== Spotlight (per-user) ====="
|
|
$hits = Get-UserRegValue -SubPath 'Software\Policies\Microsoft\Windows\CloudContent' -Name 'DisableSpotlightCollectionOnDesktop'
|
|
$match = @($hits | Where-Object { $_.Value -eq 1 })
|
|
Check 'Desktop Spotlight disabled' ($match.Count -gt 0) "$($match.Count) of $($hits.Count) user hives match"
|
|
|
|
Write-Host ""
|
|
Write-Host "===== Explorer / UI (per-user) ====="
|
|
$uiChecks = @(
|
|
@{ Sub='Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced'; Name='HideFileExt'; Expect=0; Desc='Show known file extensions' },
|
|
@{ Sub='Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced'; Name='Hidden'; Expect=1; Desc='Show hidden items' },
|
|
@{ Sub='Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced'; Name='TaskbarAl'; Expect=0; Desc='Taskbar aligned left' },
|
|
@{ Sub='Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced'; Name='ShowTaskViewButton'; Expect=0; Desc='Taskview button hidden' },
|
|
@{ Sub='Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced'; Name='LaunchTo'; Expect=1; Desc='Explorer opens to This PC' },
|
|
@{ Sub='Software\Microsoft\Windows\CurrentVersion\Themes\Personalize'; Name='AppsUseLightTheme'; Expect=0; Desc='Dark mode for apps' },
|
|
@{ Sub='Software\Microsoft\Windows\CurrentVersion\Themes\Personalize'; Name='SystemUsesLightTheme'; Expect=0; Desc='Dark mode for system' }
|
|
)
|
|
foreach ($r in $uiChecks) {
|
|
$hits = Get-UserRegValue -SubPath $r.Sub -Name $r.Name
|
|
$match = @($hits | Where-Object { $_.Value -eq $r.Expect })
|
|
$ok = $match.Count -gt 0
|
|
$detail = if ($hits.Count -eq 0) { "not set in any user hive" }
|
|
else { ($hits | ForEach-Object { "$(Split-Path $_.Hive -Leaf)=$($_.Value)" }) -join ', ' }
|
|
Check $r.Desc $ok $detail
|
|
}
|
|
|
|
Write-Host ""
|
|
Write-Host "===== Summary ====="
|
|
Write-Host ("PASS: {0} FAIL: {1}" -f $pass, $fail)
|