4504 lines
342 KiB
YAML
4504 lines
342 KiB
YAML
# Structure documented in "docs/collections.md"
|
|
os: windows
|
|
scripting:
|
|
language: batchfile
|
|
startCode: |-
|
|
@echo off
|
|
:: {{ $homepage }} — v{{ $version }} — {{ $date }}
|
|
:: Ensure admin privileges
|
|
fltmc >nul 2>&1 || (
|
|
echo Administrator privileges are required.
|
|
PowerShell Start -Verb RunAs '%0' 2> nul || (
|
|
echo Right-click on the script and select "Run as administrator".
|
|
pause & exit 1
|
|
)
|
|
exit 0
|
|
)
|
|
endCode: |-
|
|
pause
|
|
exit /b 0
|
|
actions:
|
|
-
|
|
category: Privacy cleanup
|
|
children:
|
|
-
|
|
category: Clear application history
|
|
children:
|
|
-
|
|
name: Clear Listary indexes
|
|
code: del /f /s /q %appdata%\Listary\UserData > nul
|
|
-
|
|
name: Clear Java cache
|
|
recommend: strict
|
|
code: rd /s /q "%APPDATA%\Sun\Java\Deployment\cache"
|
|
-
|
|
name: Clear Flash traces
|
|
recommend: standard
|
|
code: rd /s /q "%APPDATA%\Macromedia\Flash Player"
|
|
-
|
|
name: Clear Steam dumps, logs, and traces
|
|
recommend: standard
|
|
code: |-
|
|
del /f /q %ProgramFiles(x86)%\Steam\Dumps
|
|
del /f /q %ProgramFiles(x86)%\Steam\Traces
|
|
del /f /q %ProgramFiles(x86)%\Steam\appcache\*.log
|
|
-
|
|
name: Clear Visual Studio telemetry and feedback data
|
|
recommend: standard
|
|
code: |-
|
|
rmdir /s /q "%AppData%\vstelemetry" 2>nul
|
|
rmdir /s /q "%LocalAppData%\Microsoft\VSApplicationInsights" 2>nul
|
|
rmdir /s /q "%ProgramData%\Microsoft\VSApplicationInsights" 2>nul
|
|
rmdir /s /q "%Temp%\Microsoft\VSApplicationInsights" 2>nul
|
|
rmdir /s /q "%Temp%\VSFaultInfo" 2>nul
|
|
rmdir /s /q "%Temp%\VSFeedbackPerfWatsonData" 2>nul
|
|
rmdir /s /q "%Temp%\VSFeedbackVSRTCLogs" 2>nul
|
|
rmdir /s /q "%Temp%\VSRemoteControl" 2>nul
|
|
rmdir /s /q "%Temp%\VSTelem" 2>nul
|
|
rmdir /s /q "%Temp%\VSTelem.Out" 2>nul
|
|
-
|
|
category: Clear most recently used lists (MRU)
|
|
children:
|
|
-
|
|
category: Clear Quick Access (jump) lists
|
|
docs: https://cyberforensicator.com/wp-content/uploads/2017/01/1-s2.0-S1742287616300202-main.2-14.pdf
|
|
children:
|
|
-
|
|
name: Clear recently accessed files
|
|
recommend: standard
|
|
code: del /f /q "%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*"
|
|
-
|
|
name: Clear user pins
|
|
code: del /f /q "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\*"
|
|
-
|
|
name: Clear regedit last key
|
|
recommend: standard
|
|
code: |-
|
|
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit" /va /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Regedit" /va /f
|
|
-
|
|
name: Clear regedit favorites
|
|
recommend: standard
|
|
code: |-
|
|
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites" /va /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites" /va /f
|
|
-
|
|
name: Clear list of recent programs opened
|
|
recommend: standard
|
|
code: |-
|
|
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU" /va /f
|
|
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRULegacy" /va /f
|
|
-
|
|
name: Clear Adobe Media Browser MRU
|
|
recommend: standard
|
|
code: reg delete "HKCU\Software\Adobe\MediaBrowser\MRU" /va /f
|
|
-
|
|
name: Clear MSPaint MRU
|
|
recommend: standard
|
|
code: |-
|
|
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List" /va /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List" /va /f
|
|
-
|
|
name: Clear Wordpad MRU
|
|
recommend: standard
|
|
code: reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List" /va /f
|
|
-
|
|
name: Clear Map Network Drive MRU MRU
|
|
recommend: standard
|
|
code: |-
|
|
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU" /va /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU" /va /f
|
|
-
|
|
name: Clear Windows Search Assistant history
|
|
recommend: standard
|
|
code: reg delete "HKCU\Software\Microsoft\Search Assistant\ACMru" /va /f
|
|
-
|
|
name: Clear list of Recent Files Opened, by Filetype
|
|
recommend: standard
|
|
code: |-
|
|
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs" /va /f
|
|
reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs" /va /f
|
|
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU" /va /f
|
|
-
|
|
name: Clear windows media player recent files and URLs
|
|
recommend: standard
|
|
code: |-
|
|
reg delete "HKCU\Software\Microsoft\MediaPlayer\Player\RecentFileList" /va /f
|
|
reg delete "HKCU\Software\Microsoft\MediaPlayer\Player\RecentURLList" /va /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\MediaPlayer\Player\RecentFileList" /va /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\MediaPlayer\Player\RecentURLList" /va /f
|
|
-
|
|
name: Clear Most Recent Application's Use of DirectX
|
|
recommend: standard
|
|
code: |-
|
|
reg delete "HKCU\Software\Microsoft\Direct3D\MostRecentApplication" /va /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\Direct3D\MostRecentApplication" /va /f
|
|
-
|
|
name: Clear Windows Run MRU & typedpaths
|
|
recommend: standard
|
|
code: |-
|
|
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" /va /f
|
|
reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths" /va /f
|
|
-
|
|
name: Clear Dotnet CLI telemetry
|
|
recommend: standard
|
|
code: rmdir /s /q "%USERPROFILE%\.dotnet\TelemetryStorageService" 2>nul
|
|
-
|
|
category: Clear browser history
|
|
children:
|
|
-
|
|
name: Clear Internet Explorer traces
|
|
recommend: standard
|
|
code: |-
|
|
del /f /q "%localappdata%\Microsoft\Windows\INetCache\IE\*"
|
|
reg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\TypedURLs" /va /f
|
|
reg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime" /va /f
|
|
rd /s /q "%localappdata%\Microsoft\Internet Explorer"
|
|
rd /s /q "%APPDATA%\Microsoft\Windows\Cookies"
|
|
rd /s /q "%USERPROFILE%\Cookies"
|
|
rd /s /q "%USERPROFILE%\Local Settings\Traces"
|
|
rd /s /q "%localappdata%\Temporary Internet Files"
|
|
rd /s /q "%localappdata%\Microsoft\Windows\Temporary Internet Files"
|
|
rd /s /q "%localappdata%\Microsoft\Windows\INetCookies\PrivacIE"
|
|
rd /s /q "%localappdata%\Microsoft\Feeds Cache"
|
|
rd /s /q "%localappdata%\Microsoft\InternetExplorer\DOMStore"
|
|
-
|
|
name: Clear Google Chrome traces
|
|
recommend: standard
|
|
code: |-
|
|
del /f /q "%localappdata%\Google\Software Reporter Tool\*.log"
|
|
rd /s /q "%USERPROFILE%\Local Settings\Application Data\Google\Chrome\User Data"
|
|
rd /s /q "%localappdata%\Google\Chrome\User Data"
|
|
rd /s /q "%localappdata%\Google\CrashReports\""
|
|
rd /s /q "%localappdata%\Google\Chrome\User Data\Crashpad\reports\""
|
|
-
|
|
category: Clear Firefox traces
|
|
children:
|
|
-
|
|
name: Clear browsing history and caches
|
|
recommend: standard
|
|
code: |-
|
|
set ignoreFiles="content-prefs.sqlite" "permissions.sqlite" "favicons.sqlite"
|
|
for %%d in ("%APPDATA%\Mozilla\Firefox\Profiles\"
|
|
"%USERPROFILE%\Local Settings\Application Data\Mozilla\Firefox\Profiles\"
|
|
) do (
|
|
IF EXIST %%d (
|
|
FOR /d %%p IN (%%d*) DO (
|
|
for /f "delims=" %%f in ('dir /b /s "%%p\*.sqlite" 2^>nul') do (
|
|
set "continue="
|
|
for %%i in (%ignoreFiles%) do (
|
|
if %%i == "%%~nxf" (
|
|
set continue=1
|
|
)
|
|
)
|
|
if not defined continue (
|
|
del /q /s /f %%f
|
|
)
|
|
)
|
|
)
|
|
)
|
|
)
|
|
-
|
|
name: Clear all Firefox user profiles, settings, and data
|
|
code: |-
|
|
rd /s /q "%LOCALAPPDATA%\Mozilla\Firefox\Profiles"
|
|
rd /s /q "%APPDATA%\Mozilla\Firefox\Profiles"
|
|
-
|
|
name: Clear Opera traces
|
|
recommend: standard
|
|
code: |-
|
|
rd /s /q "%USERPROFILE%\AppData\Local\Opera\Opera"
|
|
rd /s /q "%APPDATA%\Opera\Opera"
|
|
rd /s /q "%USERPROFILE%\Local Settings\Application Data\Opera\Opera"
|
|
-
|
|
name: Clear Safari traces
|
|
recommend: standard
|
|
code: |-
|
|
rd /s /q "%USERPROFILE%\AppData\Local\Apple Computer\Safari\Traces"
|
|
rd /s /q "%APPDATA%\Apple Computer\Safari"
|
|
del /q /s /f "%USERPROFILE%\AppData\Local\Apple Computer\Safari\Cache.db"
|
|
del /q /s /f "%USERPROFILE%\AppData\Local\Apple Computer\Safari\WebpageIcons.db"
|
|
rd /s /q "%USERPROFILE%\Local Settings\Application Data\Apple Computer\Safari\Traces"
|
|
del /q /s /f "%USERPROFILE%\Local Settings\Application Data\Apple Computer\Safari\Cache.db"
|
|
del /q /s /f "%USERPROFILE%\Local Settings\Application Data\Safari\WebpageIcons.db"
|
|
-
|
|
category: Clear Windows logs & caches
|
|
children:
|
|
-
|
|
name: Clear thumbnail cache
|
|
code: del /f /s /q /a %LocalAppData%\Microsoft\Windows\Explorer\*.db
|
|
-
|
|
category: Clear Windows log files
|
|
children:
|
|
-
|
|
category: Clear Windows Update logs
|
|
children:
|
|
-
|
|
name: Clear Windows update and SFC scan logs
|
|
docs: https://answers.microsoft.com/en-us/windows/forum/all/cwindowslogscbs/fe4e359a-bcb9-4988-954d-563ef83bac1c
|
|
recommend: standard
|
|
code: del /f /q %SystemRoot%\Temp\CBS\*
|
|
-
|
|
name: Clear Windows Update Medic Service logs
|
|
recommend: standard
|
|
docs: https://answers.microsoft.com/en-us/windows/forum/all/what-is-this-waasmedic-and-why-it-required-to/e5e55a95-d5bb-4bf4-a7ce-4783df371de4
|
|
code: |-
|
|
takeown /f %SystemRoot%\Logs\waasmedic /r /d y
|
|
icacls %SystemRoot%\Logs\waasmedic /grant administrators:F /t
|
|
rd /s /q %SystemRoot%\Logs\waasmedic
|
|
-
|
|
name: Clear Cryptographic Services Traces
|
|
recommend: standard
|
|
docs: https://www.thewindowsclub.com/catroot-catroot2-folder-reset-windows
|
|
code: |-
|
|
del /f /q %SystemRoot%\System32\catroot2\dberr.txt
|
|
del /f /q %SystemRoot%\System32\catroot2.log
|
|
del /f /q %SystemRoot%\System32\catroot2.jrs
|
|
del /f /q %SystemRoot%\System32\catroot2.edb
|
|
del /f /q %SystemRoot%\System32\catroot2.chk
|
|
-
|
|
name: Windows Update Events Logs
|
|
code: del /f /q "%SystemRoot%\Logs\SIH\*"
|
|
-
|
|
name: Windows Update Logs
|
|
code: del /f /q "%SystemRoot%\Traces\WindowsUpdate\*"
|
|
-
|
|
name: Clear Optional Component Manager and COM+ components logs
|
|
recommend: standard
|
|
code: del /f /q %SystemRoot%\comsetup.log
|
|
-
|
|
name: Clear Distributed Transaction Coordinator logs
|
|
recommend: standard
|
|
code: del /f /q %SystemRoot%\DtcInstall.log
|
|
-
|
|
name: Clear Pending File Rename Operations logs
|
|
code: del /f /q %SystemRoot%\PFRO.log
|
|
-
|
|
name: Clear Windows Deployment Upgrade Process Logs
|
|
recommend: standard
|
|
code: |-
|
|
del /f /q %SystemRoot%\setupact.log
|
|
del /f /q %SystemRoot%\setuperr.log
|
|
-
|
|
name: Clear Windows Setup Logs
|
|
recommend: standard
|
|
docs: https://support.microsoft.com/en-gb/help/927521/windows-vista-windows-7-windows-server-2008-r2-windows-8-1-and-windows
|
|
code: |-
|
|
del /f /q %SystemRoot%\setupapi.log
|
|
del /f /q %SystemRoot%\Panther\*
|
|
del /f /q %SystemRoot%\inf\setupapi.app.log
|
|
del /f /q %SystemRoot%\inf\setupapi.dev.log
|
|
del /f /q %SystemRoot%\inf\setupapi.offline.log
|
|
-
|
|
name: Clear Windows System Assessment Tool logs
|
|
recommend: standard
|
|
docs: https://docs.microsoft.com/en-us/windows/win32/winsat/windows-system-assessment-tool-portal
|
|
code: del /f /q %SystemRoot%\Performance\WinSAT\winsat.log
|
|
-
|
|
name: Clear Password change events
|
|
recommend: standard
|
|
code: del /f /q %SystemRoot%\debug\PASSWD.LOG
|
|
-
|
|
name: Clear user web cache database
|
|
recommend: standard
|
|
docs: https://support.microsoft.com/en-gb/help/4056823/performance-issue-with-custom-default-user-profile
|
|
code: del /f /q %localappdata%\Microsoft\Windows\WebCache\*.*
|
|
-
|
|
name: Clear system temp folder when no one is logged in
|
|
recommend: standard
|
|
code: del /f /q %SystemRoot%\ServiceProfiles\LocalService\AppData\Local\Temp\*.*
|
|
-
|
|
name: Clear DISM (Deployment Image Servicing and Management) Logs
|
|
recommend: standard
|
|
docs: https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/deployment-troubleshooting-and-log-files
|
|
code: |-
|
|
del /f /q %SystemRoot%\Logs\CBS\CBS.log
|
|
del /f /q %SystemRoot%\Logs\DISM\DISM.log
|
|
-
|
|
name: Clear WUAgent (Windows Update History) logs
|
|
docs: https://social.technet.microsoft.com/Forums/ie/en-US/f5744a18-d4ca-4631-8324-878b9225251d/windowssoftwaredistribution-folder-cleanup-automation?forum=winserverwsus
|
|
code: |-
|
|
setlocal EnableDelayedExpansion
|
|
SET /A wuau_service_running=0
|
|
SC queryex "wuauserv"|Find "STATE"|Find /v "RUNNING">Nul||(
|
|
SET /A wuau_service_running=1
|
|
net stop wuauserv
|
|
)
|
|
del /q /s /f "%SystemRoot%\SoftwareDistribution"
|
|
IF !wuau_service_running! == 1 (
|
|
net start wuauserv
|
|
)
|
|
endlocal
|
|
-
|
|
name: Clear Server-initiated Healing Events Logs
|
|
code: del /f /q "%SystemRoot%\Logs\SIH\*"
|
|
-
|
|
name: Common Language Runtime Logs
|
|
recommend: standard
|
|
code: |-
|
|
del /f /q "%LocalAppData%\Microsoft\CLR_v4.0\UsageTraces\*"
|
|
del /f /q "%LocalAppData%\Microsoft\CLR_v4.0_32\UsageTraces\*"
|
|
-
|
|
name: Network Setup Service Events Logs
|
|
recommend: standard
|
|
code: del /f /q "%SystemRoot%\Logs\NetSetup\*"
|
|
-
|
|
name: Disk Cleanup tool (Cleanmgr.exe) Logs
|
|
code: del /f /q "%SystemRoot%\System32\LogFiles\setupcln\*"
|
|
-
|
|
name: Clear Windows temp files
|
|
recommend: standard
|
|
code: |-
|
|
del /f /q %localappdata%\Temp\*
|
|
rd /s /q "%WINDIR%\Temp"
|
|
rd /s /q "%TEMP%"
|
|
-
|
|
name: Clear main telemetry file
|
|
recommend: standard
|
|
code: |-
|
|
if exist "%ProgramData%\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl" (
|
|
takeown /f "%ProgramData%\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl" /r /d y
|
|
icacls "%ProgramData%\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl" /grant administrators:F /t
|
|
echo "" > "%ProgramData%\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl"
|
|
echo Clear successful: "%ProgramData%\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl"
|
|
) else (
|
|
echo "Main telemetry file does not exist. Good!"
|
|
)
|
|
-
|
|
name: Clear Event Logs in Event Viewer
|
|
docs: https://serverfault.com/questions/407838/do-windows-events-from-the-windows-event-log-have-sensitive-information
|
|
code: |-
|
|
REM https://social.technet.microsoft.com/Forums/en-US/f6788f7d-7d04-41f1-a64e-3af9f700e4bd/failed-to-clear-log-microsoftwindowsliveidoperational-access-is-denied?forum=win10itprogeneral
|
|
wevtutil sl Microsoft-Windows-LiveId/Operational /ca:O:BAG:SYD:(A;;0x1;;;SY)(A;;0x5;;;BA)(A;;0x1;;;LA)
|
|
for /f "tokens=*" %%i in ('wevtutil.exe el') DO (
|
|
echo Deleting event log: "%%i"
|
|
wevtutil.exe cl %1 "%%i"
|
|
)
|
|
-
|
|
name: Clear credentials from Windows Credential Manager
|
|
code: |-
|
|
cmdkey.exe /list > "%TEMP%\List.txt"
|
|
findstr.exe Target "%TEMP%\List.txt" > "%TEMP%\tokensonly.txt"
|
|
FOR /F "tokens=1,2 delims= " %%G IN (%TEMP%\tokensonly.txt) DO cmdkey.exe /delete:%%H
|
|
del "%TEMP%\List.txt" /s /f /q
|
|
del "%TEMP%\tokensonly.txt" /s /f /q
|
|
-
|
|
name: Delete controversial default0 user
|
|
docs: https://github.com/undergroundwires/privacy.sexy/issues/30
|
|
recommend: standard
|
|
code: net user defaultuser0 /delete 2>nul
|
|
-
|
|
name: Empty trash bin
|
|
code: Powershell -Command "$bin = (New-Object -ComObject Shell.Application).NameSpace(10);$bin.items() | ForEach { Write-Host "Deleting $($_.Name) from Recycle Bin"; Remove-Item $_.Path -Recurse -Force}"
|
|
-
|
|
name: Enable Reset Base in Dism Component Store
|
|
recommend: standard
|
|
code: reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\Configuration" /v "DisableResetbase" /t "REG_DWORD" /d "0" /f
|
|
-
|
|
name: Clear Windows Product Key from Registry
|
|
code: slmgr /cpky
|
|
docs: https://winaero.com/blog/remove-windows-10-product-key-from-registry-and-protect-it-from-being-stolen/
|
|
-
|
|
name: Clear volume backups (shadow copies)
|
|
docs:
|
|
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin-delete-shadows
|
|
- https://www.fortinet.com/blog/threat-research/stomping-shadow-copies-a-second-look-into-deletion-methods
|
|
code: vssadmin delete shadows /all /quiet
|
|
-
|
|
name: Remove Default Apps Associations
|
|
recommend: standard
|
|
code: dism /online /Remove-DefaultAppAssociations
|
|
-
|
|
name: Clear (Reset) Network Data Usage
|
|
recommend: standard
|
|
docs: https://www.windowslifestyle.com/reset-data-usage-tool-reset-network-data-usage-windows-10/
|
|
code: |-
|
|
setlocal EnableDelayedExpansion
|
|
SET /A dps_service_running=0
|
|
SC queryex "DPS"|Find "STATE"|Find /v "RUNNING">Nul||(
|
|
SET /A dps_service_running=1
|
|
net stop DPS
|
|
)
|
|
del /F /S /Q /A "%windir%\System32\sru*"
|
|
IF !dps_service_running! == 1 (
|
|
net start DPS
|
|
)
|
|
endlocal
|
|
-
|
|
name: Clear previous Windows installations
|
|
code: |-
|
|
if exist "%SystemDrive%\Windows.old" (
|
|
takeown /f "%SystemDrive%\Windows.old" /a /r /d y
|
|
icacls "%SystemDrive%\Windows.old" /grant administrators:F /t
|
|
rd /s /q "%SystemDrive%\Windows.old"
|
|
echo Deleted previous installation from "%SystemDrive%\Windows.old\"
|
|
) else (
|
|
echo No previous Windows installation has been found
|
|
)
|
|
-
|
|
category: Disable OS data collection
|
|
children:
|
|
-
|
|
category: Disable Windows telemetry and data collection
|
|
children:
|
|
-
|
|
name: Disable Customer Experience Improvement (CEIP/SQM)
|
|
docs: https://docs.microsoft.com/en-us/windows/win32/devnotes/ceipenable
|
|
recommend: standard
|
|
code: reg add "HKLM\Software\Policies\Microsoft\SQMClient\Windows" /v "CEIPEnable" /t REG_DWORD /d "0" /f
|
|
revertCode: reg add "HKLM\Software\Policies\Microsoft\SQMClient\Windows" /v "CEIPEnable" /t REG_DWORD /d "1" /f
|
|
-
|
|
name: Disable Application Impact Telemetry (AIT)
|
|
recommend: standard
|
|
code: reg add "HKLM\Software\Policies\Microsoft\Windows\AppCompat" /v "AITEnable" /t REG_DWORD /d "0" /f
|
|
revertCode: reg add "HKLM\Software\Policies\Microsoft\SQMClient\Windows" /v "CEIPEnable" /t REG_DWORD /d "1" /f
|
|
-
|
|
name: Disable diagnostics telemetry
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKLM\SYSTEM\ControlSet001\Services\DiagTrack" /v "Start" /t REG_DWORD /d 4 /f
|
|
reg add "HKLM\SYSTEM\ControlSet001\Services\dmwappushsvc" /v "Start" /t REG_DWORD /d 4 /f
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Services\dmwappushservice" /v "Start" /t REG_DWORD /d 4 /f
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Services\diagnosticshub.standardcollector.service" /v "Start" /t REG_DWORD /d 4 /f
|
|
sc stop "DiagTrack" & sc config "DiagTrack" start=disabled
|
|
sc stop "dmwappushservice" & sc config "dmwappushservice" start=disabled
|
|
sc stop "diagnosticshub.standardcollector.service" & sc config "diagnosticshub.standardcollector.service" start=disabled
|
|
sc stop "diagsvc" & sc config "diagsvc" start=disabled
|
|
-
|
|
name: Disable Customer Experience Improvement Program
|
|
recommend: standard
|
|
code: |-
|
|
schtasks /change /TN "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /DISABLE
|
|
schtasks /change /TN "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /DISABLE
|
|
schtasks /change /TN "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /DISABLE
|
|
revertCode: |-
|
|
schtasks /change /TN "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /ENABLE
|
|
schtasks /change /TN "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /ENABLE
|
|
schtasks /change /TN "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /ENABLE
|
|
-
|
|
category: Disable Webcam Telemetry (devicecensus.exe)
|
|
docs:
|
|
- https://www.ghacks.net/2019/09/23/what-is-devicecensus-exe-on-windows-10-and-why-does-it-need-internet-connectivity/
|
|
- https://answers.microsoft.com/en-us/windows/forum/windows_10-security/devicecensusexe-and-host-process-for-windows-task/520d42a2-45c1-402a-81de-e1116ecf2538
|
|
children:
|
|
-
|
|
name: Disable devicecensus.exe (telemetry) task
|
|
recommend: standard
|
|
code: schtasks /change /TN "Microsoft\Windows\Device Information\Device" /disable
|
|
revertCode: schtasks /change /TN "Microsoft\Windows\Device Information\Device" /enable
|
|
-
|
|
name: Disable devicecensus.exe (telemetry) process
|
|
recommend: standard
|
|
call:
|
|
function: KillProcessWhenItStarts
|
|
parameters:
|
|
processName: DeviceCensus.exe
|
|
-
|
|
category: Disable Compatibility Telemetry (Application Experience)
|
|
children:
|
|
-
|
|
category: Disable Microsoft Compatibility Appraiser
|
|
docs: https://www.ghacks.net/2016/10/26/turn-off-the-windows-customer-experience-program/
|
|
children:
|
|
-
|
|
name: Disable Microsoft Compatibility Appraiser task
|
|
recommend: standard
|
|
code: schtasks /change /TN "Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /disable
|
|
revertCode: schtasks /change /TN "Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /enable
|
|
-
|
|
name: Disable CompatTelRunner.exe (Microsoft Compatibility Appraiser) process
|
|
recommend: standard
|
|
call:
|
|
function: KillProcessWhenItStarts
|
|
parameters:
|
|
processName: CompatTelRunner.exe
|
|
-
|
|
name: Disable sending information to Customer Experience Improvement Program
|
|
recommend: standard
|
|
docs:
|
|
- https://www.ghacks.net/2016/10/26/turn-off-the-windows-customer-experience-program/
|
|
- https://answers.microsoft.com/en-us/windows/forum/windows_10-performance/permanently-disabling-windows-compatibility/6bf71583-81b0-4a74-ae2e-8fd73305aad1
|
|
code: schtasks /change /TN "Microsoft\Windows\Application Experience\ProgramDataUpdater" /disable
|
|
revertCode: schtasks /change /TN "Microsoft\Windows\Application Experience\ProgramDataUpdater" /enable
|
|
-
|
|
name: Disable Application Impact Telemetry Agent task
|
|
recommend: standard
|
|
docs: https://www.shouldiblockit.com/aitagent.exe-6181.aspx
|
|
code: schtasks /change /TN "Microsoft\Windows\Application Experience\AitAgent" /disable
|
|
revertCode: schtasks /change /TN "Microsoft\Windows\Application Experience\AitAgent" /enable
|
|
-
|
|
name: Disable "Disable apps to improve performance" reminder
|
|
recommend: strict
|
|
docs: https://www.ghacks.net/2016/10/26/turn-off-the-windows-customer-experience-program/
|
|
code: schtasks /change /TN "Microsoft\Windows\Application Experience\StartupAppTask" /disable
|
|
revertCode: schtasks /change /TN "Microsoft\Windows\Application Experience\StartupAppTask" /enable
|
|
-
|
|
name: Disable telemetry in data collection policy
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\DataCollection" /v "AllowTelemetry" /d 0 /t REG_DWORD /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v "LimitEnhancedDiagnosticDataWindowsAnalytics" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Disable license telemetry
|
|
recommend: standard
|
|
code: reg add "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v "NoGenTicket" /t "REG_DWORD" /d "1" /f
|
|
-
|
|
name: Disable error reporting
|
|
recommend: standard
|
|
docs:
|
|
- https://docs.microsoft.com/en-us/windows/win32/wer/wer-settings
|
|
- https://www.stigviewer.com/stig/windows_10/2016-06-24/finding/V-63493
|
|
code: |-
|
|
:: Disable Windows Error Reporting (WER)
|
|
reg add "HKLM\Software\Policies\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /d "1" /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t "REG_DWORD" /d "1" /f
|
|
:: DefaultConsent / 1 - Always ask (default) / 2 - Parameters only / 3 - Parameters and safe data / 4 - All data
|
|
reg add "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent" /v "DefaultConsent" /t REG_DWORD /d "0" /f
|
|
reg add "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent" /v "DefaultOverrideBehavior" /t REG_DWORD /d "1" /f
|
|
:: Disable WER sending second-level data
|
|
reg add "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v "DontSendAdditionalData" /t REG_DWORD /d "1" /f
|
|
:: Disable WER crash dialogs, popups
|
|
reg add "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v "LoggingDisabled" /t REG_DWORD /d "1" /f
|
|
schtasks /Change /TN "Microsoft\Windows\ErrorDetails\EnableErrorDetailsUpdate" /Disable
|
|
schtasks /Change /TN "Microsoft\Windows\Windows Error Reporting\QueueReporting" /Disable
|
|
:: Disable Windows Error Reporting Service
|
|
sc stop "WerSvc" & sc config "WerSvc" start=disabled
|
|
sc stop "wercplsupport" & sc config "wercplsupport" start=disabled
|
|
revertCode: |-
|
|
:: Enable Windows Error Reporting (WER)
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /f
|
|
:: DefaultConsent / 1 - Always ask (default) / 2 - Parameters only / 3 - Parameters and safe data / 4 - All data
|
|
reg add "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent" /v "DefaultConsent" /t REG_DWORD /d "1" /f
|
|
reg add "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent" /v "DefaultOverrideBehavior" /t REG_DWORD /d "0" /f
|
|
:: Enable WER sending second-level data
|
|
reg delete "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v "DontSendAdditionalData" /f
|
|
:: Enable WER crash dialogs, popups
|
|
reg add "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v "LoggingDisabled" /t REG_DWORD /d "0" /f
|
|
schtasks /Change /TN "Microsoft\Windows\ErrorDetails\EnableErrorDetailsUpdate" /Enable
|
|
schtasks /Change /TN "Microsoft\Windows\Windows Error Reporting\QueueReporting" /Enable
|
|
:: Enable Windows Error Reporting Service
|
|
sc config "WerSvc" start=demand
|
|
sc config "wercplsupport" start=demand
|
|
-
|
|
category: Disable automatic driver updates by Windows Update
|
|
children:
|
|
-
|
|
name: Disable device metadata retrieval (breaks auto updates)
|
|
recommend: strict
|
|
docs:
|
|
- https://www.stigviewer.com/stig/windows_server_2012_member_server/2014-01-07/finding/V-21964
|
|
- https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-preventdevicemetadatafromnetwork
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Metadata" /v "PreventDeviceMetadataFromNetwork" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Device Metadata" /v "PreventDeviceMetadataFromNetwork" /t REG_DWORD /d 1 /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Metadata" /v "PreventDeviceMetadataFromNetwork" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Device Metadata" /v "PreventDeviceMetadataFromNetwork" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Do not include drivers with Windows Updates
|
|
docs: https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsUpdate::ExcludeWUDriversInQualityUpdate
|
|
recommend: strict
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "ExcludeWUDriversInQualityUpdate" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "ExcludeWUDriversInQualityUpdate" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Prevent Windows Update for device driver search
|
|
docs: https://www.stigviewer.com/stig/windows_7/2018-02-12/finding/V-21965
|
|
recommend: strict
|
|
code: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching" /v "SearchOrderConfig" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching" /v "SearchOrderConfig" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable cloud speech recognition
|
|
recommend: standard
|
|
docs: https://www.tenforums.com/tutorials/101902-turn-off-online-speech-recognition-windows-10-a.html
|
|
code: reg add "HKCU\Software\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy" /v "HasAccepted" /t "REG_DWORD" /d 0 /f
|
|
revertCode: reg add "HKCU\Software\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy" /v "HasAccepted" /t "REG_DWORD" /d 1 /f
|
|
-
|
|
name: Disable active probing (pings to MSFT NCSI server)
|
|
recommend: strict
|
|
code: reg add "HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet" /v "EnableActiveProbing" /t REG_DWORD /d "0" /f
|
|
revertCode: reg add "HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet" /v "EnableActiveProbing" /t REG_DWORD /d "1" /f
|
|
-
|
|
name: Opt out from Windows privacy consent
|
|
recommend: standard
|
|
code: reg add "HKCU\SOFTWARE\Microsoft\Personalization\Settings" /v "AcceptedPrivacyPolicy" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKCU\SOFTWARE\Microsoft\Personalization\Settings" /v "AcceptedPrivacyPolicy" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable Windows feedback
|
|
recommend: standard
|
|
docs: https://www.tenforums.com/tutorials/2441-change-feedback-frequency-windows-10-a.html
|
|
code: |-
|
|
reg add "HKCU\SOFTWARE\Microsoft\Siuf\Rules" /v "NumberOfSIUFInPeriod" /t REG_DWORD /d 0 /f
|
|
reg delete "HKCU\SOFTWARE\Microsoft\Siuf\Rules" /v "PeriodInNanoSeconds" /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" /v "DoNotShowFeedbackNotifications" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v "DoNotShowFeedbackNotifications" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable text and handwriting collection
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKCU\Software\Policies\Microsoft\InputPersonalization" /v "RestrictImplicitInkCollection" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization" /v "RestrictImplicitInkCollection" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\Software\Policies\Microsoft\InputPersonalization" /v "RestrictImplicitTextCollection" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization" /v "RestrictImplicitTextCollection" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\Software\Policies\Microsoft\Windows\HandwritingErrorReports" /v "PreventHandwritingErrorReports" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\Software\Policies\Microsoft\Windows\HandwritingErrorReports" /v "PreventHandwritingErrorReports" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\Software\Policies\Microsoft\Windows\TabletPC" /v "PreventHandwritingDataSharing" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\TabletPC" /v "PreventHandwritingDataSharing" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization" /v "AllowInputPersonalization" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\InputPersonalization\TrainedDataStore" /v "HarvestContacts" /t REG_DWORD /d 0 /f
|
|
-
|
|
category: Deny app access to personal information
|
|
children:
|
|
-
|
|
name: Deny app access to location
|
|
recommend: standard
|
|
docs:
|
|
- https://r-pufky.github.io/docs/operating-systems/windows/10/securing-installation/privacy/location.html
|
|
- https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesslocation
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location" /v "Value" /d "Deny" /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Services\lfsvc\Service\Configuration" /v "Status" /d "0" /t REG_DWORD /f
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessLocation" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessLocation_UserInControlOfTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessLocation_ForceAllowTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessLocation_ForceDenyTheseApps" /t REG_MULTI_SZ /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location" /v "Value" /d "Allow" /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Services\lfsvc\Service\Configuration" /v "Status" /d "1" /t REG_DWORD /f
|
|
:: Using GPO
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessLocation" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessLocation_UserInControlOfTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessLocation_ForceAllowTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessLocation_ForceDenyTheseApps" /f
|
|
-
|
|
name: Deny app access to account info, name, and picture
|
|
recommend: standard
|
|
docs: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessaccountinfo
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userAccountInformation" /v "Value" /d "Deny" /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{C1D23ACC-752B-43E5-8448-8D0E519CD6D6}" /t REG_SZ /v "Value" /d "Deny" /f
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessAccountInfo" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessAccountInfo_UserInControlOfTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessAccountInfo_ForceAllowTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessAccountInfo_ForceDenyTheseApps" /t REG_MULTI_SZ /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userAccountInformation" /v "Value" /d "Allow" /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{C1D23ACC-752B-43E5-8448-8D0E519CD6D6}" /t REG_SZ /v "Value" /d "Allow" /f
|
|
:: GPO
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessAccountInfo" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessAccountInfo_UserInControlOfTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessAccountInfo_ForceAllowTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessAccountInfo_ForceDenyTheseApps" /f
|
|
-
|
|
name: Deny app access to motion data
|
|
recommend: standard
|
|
docs: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessmotion
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\activity" /v "Value" /d "Deny" /f
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMotion" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMotion_UserInControlOfTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMotion_ForceAllowTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMotion_ForceDenyTheseApps" /t REG_MULTI_SZ /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\activity" /v "Value" /d "Allow" /f
|
|
:: GPO
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMotion" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMotion_UserInControlOfTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMotion_ForceAllowTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMotion_ForceDenyTheseApps" /f
|
|
-
|
|
name: Deny app access to phone
|
|
recommend: standard
|
|
docs: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessphone
|
|
code: |-
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessPhone" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessPhone_UserInControlOfTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessPhone_ForceAllowTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessPhone_ForceDenyTheseApps" /t REG_MULTI_SZ /f
|
|
revertCode: |-
|
|
:: GPO
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessPhone" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessPhone_UserInControlOfTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessPhone_ForceAllowTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessPhone_ForceDenyTheseApps" /f
|
|
-
|
|
name: Deny app access to trusted devices
|
|
docs: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesstrusteddevices
|
|
recommend: standard
|
|
code: |-
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{C1D23ACC-752B-43E5-8448-8D0E519CD6D6}" /t REG_SZ /v "Value" /d "Deny" /f
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessTrustedDevices" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessTrustedDevices_UserInControlOfTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessTrustedDevices_ForceAllowTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessTrustedDevices_ForceDenyTheseApps" /t REG_MULTI_SZ /f
|
|
revertCode: |-
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{C1D23ACC-752B-43E5-8448-8D0E519CD6D6}" /t REG_SZ /v "Value" /d "Allow" /f
|
|
:: GPO
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessTrustedDevices" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessTrustedDevices_UserInControlOfTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessTrustedDevices_ForceAllowTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessTrustedDevices_ForceDenyTheseApps" /f
|
|
-
|
|
name: Deny app sync with devices (unpaired, beacons, TVs, etc.)
|
|
recommend: standard
|
|
docs: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#privacy-letappssyncwithdevices
|
|
code: |-
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsSyncWithDevices" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsSyncWithDevices_UserInControlOfTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsSyncWithDevices_ForceAllowTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsSyncWithDevices_ForceDenyTheseApps" /t REG_MULTI_SZ /f
|
|
revertCode: |-
|
|
:: GPO
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsSyncWithDevices" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsSyncWithDevices_UserInControlOfTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsSyncWithDevices_ForceAllowTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsSyncWithDevices_ForceDenyTheseApps" /f
|
|
-
|
|
name: Deny app access to camera
|
|
docs:
|
|
- https://docs.microsoft.com/en-us/windows-hardware/drivers/install/kscategory-video-camera
|
|
- https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesscamera
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam" /v "Value" /d "Deny" /t REG_SZ /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{E5323777-F976-4f5b-9B55-B94699C46E44}" /t REG_SZ /v "Value" /d "Deny" /f
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCamera" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCamera_UserInControlOfTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCamera_ForceAllowTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCamera_ForceDenyTheseApps" /t REG_MULTI_SZ /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam" /v "Value" /d "Allow" /t REG_SZ /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{E5323777-F976-4f5b-9B55-B94699C46E44}" /t REG_SZ /v "Value" /d "Allow" /f
|
|
:: GPO
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCamera" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCamera_UserInControlOfTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCamera_ForceAllowTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCamera_ForceDenyTheseApps" /f
|
|
-
|
|
name: Deny app access to microphone
|
|
docs: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessmicrophonee
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone" /v "Value" /d "Deny" /t REG_SZ /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{2EEF81BE-33FA-4800-9670-1CD474972C3F}" /v "Value" /t REG_SZ /d "Deny" /f
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMicrophone" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMicrophone_UserInControlOfTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMicrophone_ForceAllowTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMicrophone_ForceDenyTheseApps" /t REG_MULTI_SZ /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone" /v "Value" /d "Allow" /t REG_SZ /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{2EEF81BE-33FA-4800-9670-1CD474972C3F}" /t REG_SZ /v "Value" /d "Allow" /f
|
|
:: GPO
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMicrophone" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMicrophone_UserInControlOfTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMicrophone_ForceAllowTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMicrophone_ForceDenyTheseApps" /f
|
|
-
|
|
name: Deny apps share and sync non-explicitly paired wireless devices over uPnP
|
|
code: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\LooselyCoupled" /t REG_SZ /v "Value" /d "Deny" /f
|
|
revertCode: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\LooselyCoupled" /t REG_SZ /v "Value" /d "Allow" /f
|
|
-
|
|
name: Deny app access to diagnostics info about your other apps
|
|
recommend: standard
|
|
docs: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#privacy-letappsgetdiagnosticinfo
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\appDiagnostics" /v "Value" /d "Deny" /t REG_SZ /f
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsGetDiagnosticInfo" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsGetDiagnosticInfo_UserInControlOfTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsGetDiagnosticInfo_ForceAllowTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsGetDiagnosticInfo_ForceDenyTheseApps" /t REG_MULTI_SZ /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\appDiagnostics" /v "Value" /d "Allow" /t REG_SZ /f
|
|
:: GPO
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsGetDiagnosticInfo" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsGetDiagnosticInfo_UserInControlOfTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsGetDiagnosticInfo_ForceAllowTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsGetDiagnosticInfo_ForceDenyTheseApps" /f
|
|
-
|
|
category: Deny app access to your file system
|
|
children:
|
|
-
|
|
name: Deny app access to Document folder
|
|
recommend: standard
|
|
code: reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\documentsLibrary" /v "Value" /d "Deny" /t REG_SZ /f
|
|
revertCode: reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\documentsLibrary" /v "Value" /d "Allow" /t REG_SZ /f
|
|
-
|
|
name: Deny app access to Pictures folder
|
|
recommend: standard
|
|
code: reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\picturesLibrary" /v "Value" /d "Deny" /t REG_SZ /f
|
|
revertCode: reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\picturesLibrary" /v "Value" /d "Allow" /t REG_SZ /f
|
|
-
|
|
name: Deny app access to Videos folder
|
|
recommend: standard
|
|
code: reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\videosLibrary" /v "Value" /d "Deny" /t REG_SZ /f
|
|
revertCode: reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\videosLibrary" /v "Value" /d "Allow" /t REG_SZ /f
|
|
-
|
|
name: Deny app access to other filesystem
|
|
recommend: standard
|
|
code: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\broadFileSystemAccess" /v "Value" /d "Deny" /t REG_SZ /f
|
|
revertCode: reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\broadFileSystemAccess" /v "Value" /d "Allow" /t REG_SZ /f
|
|
-
|
|
name: Deny app access to your contacts
|
|
recommend: standard
|
|
docs: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesscontacts
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\contacts" /v "Value" /d "Deny" /t REG_SZ /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{7D7E8402-7C54-4821-A34E-AEEFD62DED93}" /t REG_SZ /v "Value" /d "Deny" /f
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessContacts" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessContacts_UserInControlOfTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessContacts_ForceAllowTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessContacts_ForceDenyTheseApps" /t REG_MULTI_SZ /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\contacts" /v "Value" /d "Allow" /t REG_SZ /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{7D7E8402-7C54-4821-A34E-AEEFD62DED93}" /t REG_SZ /v "Value" /d "Allow" /f
|
|
:: GPO
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessContacts" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessContacts_UserInControlOfTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessContacts_ForceAllowTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessContacts_ForceDenyTheseApps" /f
|
|
-
|
|
name: Deny app access to Notifications
|
|
recommend: standard
|
|
docs: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessnotifications
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userNotificationListener" /v "Value" /d "Deny" /t REG_SZ /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{52079E78-A92B-413F-B213-E8FE35712E72}" /t REG_SZ /v "Value" /d "Deny" /f
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessNotifications" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessNotifications_UserInControlOfTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessNotifications_ForceAllowTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessNotifications_ForceDenyTheseApps" /t REG_MULTI_SZ /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userNotificationListener" /v "Value" /d "Allow" /t REG_SZ /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{52079E78-A92B-413F-B213-E8FE35712E72}" /t REG_SZ /v "Value" /d "Allow" /f
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessNotifications" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessNotifications_UserInControlOfTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessNotifications_ForceAllowTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessNotifications_ForceDenyTheseApps" /f
|
|
-
|
|
name: Deny app access to Calendar
|
|
recommend: standard
|
|
docs: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesscalendar
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\appointments" /v "Value" /d "Deny" /t REG_SZ /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{D89823BA-7180-4B81-B50C-7E471E6121A3}" /t REG_SZ /v "Value" /d "Deny" /f
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCalendar" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCalendar_UserInControlOfTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCalendar_ForceAllowTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCalendar_ForceDenyTheseApps" /t REG_MULTI_SZ /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\appointments" /v "Value" /d "Allow" /t REG_SZ /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{D89823BA-7180-4B81-B50C-7E471E6121A3}" /t REG_SZ /v "Value" /d "Allow" /f
|
|
:: Using GPO
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCalendar" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCalendar_UserInControlOfTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCalendar_ForceAllowTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCalendar_ForceDenyTheseApps" /f
|
|
-
|
|
name: Deny app access to call history
|
|
recommend: standard
|
|
docs: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesscallhistory
|
|
code: |-
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\phoneCallHistory" /v "Value" /d "Deny" /t REG_SZ /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{8BC668CF-7728-45BD-93F8-CF2B3B41D7AB}" /t REG_SZ /v "Value" /d "Deny" /f
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCallHistory" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCallHistory_UserInControlOfTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCallHistory_ForceAllowTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCallHistory_ForceDenyTheseApps" /t REG_MULTI_SZ /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\phoneCallHistory" /v "Value" /d "Allow" /t REG_SZ /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{8BC668CF-7728-45BD-93F8-CF2B3B41D7AB}" /t REG_SZ /v "Value" /d "Allow" /f
|
|
:: Using GPO
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCallHistory" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCallHistory_UserInControlOfTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCallHistory_ForceAllowTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessCallHistory_ForceDenyTheseApps" /f
|
|
-
|
|
name: Deny app access to email
|
|
recommend: standard
|
|
docs: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessemail
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\email" /v "Value" /d "Deny" /t REG_SZ /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{9231CB4C-BF57-4AF3-8C55-FDA7BFCC04C5}" /t REG_SZ /v "Value" /d DENY /f
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessEmail" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessEmail_UserInControlOfTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessEmail_ForceAllowTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessEmail_ForceDenyTheseApps" /t REG_MULTI_SZ /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\email" /v "Value" /d "Allow" /t REG_SZ /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{9231CB4C-BF57-4AF3-8C55-FDA7BFCC04C5}" /t REG_SZ /v "Value" /d "Allow" /f
|
|
:: Using GPO
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessEmail" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessEmail_UserInControlOfTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessEmail_ForceAllowTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessEmail_ForceDenyTheseApps" /f
|
|
-
|
|
name: Deny app access to tasks
|
|
recommend: standard
|
|
docs: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesstasks
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userDataTasks" /v "Value" /d "Deny" /t REG_SZ /f
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessTasks" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessTasks_UserInControlOfTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessTasks_ForceAllowTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessTasks_ForceDenyTheseApps" /t REG_MULTI_SZ /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userDataTasks" /v "Value" /d "Allow" /t REG_SZ /f
|
|
:: Using GPO
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessTasks" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessTasks_UserInControlOfTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessTasks_ForceAllowTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessTasks_ForceDenyTheseApps" /f
|
|
-
|
|
name: Deny app access to messaging (SMS / MMS)
|
|
docs: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessmessaging
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\chat" /v "Value" /d "Deny" /t REG_SZ /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{992AFA70-6F47-4148-B3E9-3003349C1548}" /t REG_SZ /v "Value" /d "Deny" /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{21157C1F-2651-4CC1-90CA-1F28B02263F6}" /t REG_SZ /v "Value" /d "Deny" /f
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMessaging" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMessaging_UserInControlOfTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMessaging_ForceAllowTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMessaging_ForceDenyTheseApps" /t REG_MULTI_SZ /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\chat" /v "Value" /d "Allow" /t REG_SZ /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{992AFA70-6F47-4148-B3E9-3003349C1548}" /t REG_SZ /v "Value" /d "Allow" /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{21157C1F-2651-4CC1-90CA-1F28B02263F6}" /t REG_SZ /v "Value" /d "Allow" /f
|
|
:: Using GPO
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMessaging" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMessaging_UserInControlOfTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMessaging_ForceAllowTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessMessaging_ForceDenyTheseApps" /f
|
|
-
|
|
name: Deny app access to radios
|
|
recommend: standard
|
|
docs: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessradios
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\radios" /v "Value" /d "Deny" /t REG_SZ /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{A8804298-2D5F-42E3-9531-9C8C39EB29CE}" /t REG_SZ /v "Value" /d DENY /f
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessRadios" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessRadios_UserInControlOfTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessRadios_ForceAllowTheseApps" /t REG_MULTI_SZ /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessRadios_ForceDenyTheseApps" /t REG_MULTI_SZ /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\radios" /v "Value" /d "Allow" /t REG_SZ /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{A8804298-2D5F-42E3-9531-9C8C39EB29CE}" /t REG_SZ /v "Value" /d "Allow" /f
|
|
:: Using GPO
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessRadios" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessRadios_UserInControlOfTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessRadios_ForceAllowTheseApps" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsAccessRadios_ForceDenyTheseApps" /f
|
|
-
|
|
name: Deny app access to bluetooth devices
|
|
recommend: standard
|
|
code: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\bluetoothSync" /v "Value" /d "Deny" /t REG_SZ /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\bluetoothSync" /v "Value" /d "Allow" /t REG_SZ /f
|
|
-
|
|
category: Disable app access to voice activation
|
|
docs: https://www.tenforums.com/tutorials/130122-allow-deny-apps-access-use-voice-activation-windows-10-a.html
|
|
children:
|
|
-
|
|
name: Disable apps and Cortana to activate with voice
|
|
recommend: standard
|
|
docs: https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.AppPrivacy::LetAppsActivateWithVoice
|
|
code: |-
|
|
reg add "HKCU\Software\Microsoft\Speech_OneCore\Settings\VoiceActivation\UserPreferenceForAllApps" /v "AgentActivationEnabled" /t REG_DWORD /d 0 /f
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsActivateWithVoice" /t REG_DWORD /d 2 /f
|
|
revertCode: |-
|
|
reg add "HKCU\Software\Microsoft\Speech_OneCore\Settings\VoiceActivation\UserPreferenceForAllApps" /v "AgentActivationEnabled" /t REG_DWORD /d 1 /f
|
|
:: Using GPO
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsActivateWithVoice" /f
|
|
-
|
|
name: Disable apps and Cortana to activate with voice when sytem is locked
|
|
recommend: standard
|
|
docs: https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.AppPrivacy::LetAppsActivateWithVoiceAboveLock
|
|
code: |-
|
|
reg add "HKCU\Software\Microsoft\Speech_OneCore\Settings\VoiceActivation\UserPreferenceForAllApps" /v "AgentActivationOnLockScreenEnabled" /t REG_DWORD /d 0 /f
|
|
:: Using GPO (re-activation through GUI is not possible)
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsActivateWithVoiceAboveLock" /t REG_DWORD /d 2 /f
|
|
revertCode: |-
|
|
reg add "HKCU\Software\Microsoft\Speech_OneCore\Settings\VoiceActivation\UserPreferenceForAllApps" /v "AgentActivationOnLockScreenEnabled" /t REG_DWORD /d 1 /f
|
|
:: Using GPO
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsActivateWithVoiceAboveLock" /f
|
|
-
|
|
category: Disable location access
|
|
children:
|
|
-
|
|
name: Turn off Windows Location Provider
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors" /v "DisableWindowsLocationProvider" /t REG_DWORD /d "1" /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors" /v "DisableWindowsLocationProvider" /t REG_DWORD /d "0" /f
|
|
-
|
|
name: Turn off location scripting
|
|
recommend: standard
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors" /v "DisableLocationScripting" /t REG_DWORD /d "1" /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors" /v "DisableLocationScripting" /t REG_DWORD /d "0" /f
|
|
-
|
|
name: Turn off location
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors" /v "DisableLocation" /d "1" /t REG_DWORD /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Sensor\Overrides\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}" /v "SensorPermissionState" /d "0" /t REG_DWORD /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}" /v "Value" /t REG_SZ /d "Deny" /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors" /v "DisableLocation" /d "0" /t REG_DWORD /f
|
|
:: For older Windows (before 1903)
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Sensor\Overrides\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}" /v "SensorPermissionState" /d "1" /t REG_DWORD /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}" /v "Value" /t REG_SZ /d "Allow" /f
|
|
-
|
|
name: Turn off sensors
|
|
recommend: standard
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors" /v "DisableSensors" /t REG_DWORD /d "1" /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors" /v "DisableSensors" /t REG_DWORD /d "0" /f
|
|
-
|
|
category: Disable windows search data collection
|
|
children:
|
|
-
|
|
category: Disable cortana
|
|
children:
|
|
-
|
|
name: Do not allow Cortana
|
|
recommend: standard
|
|
docs:
|
|
- https://admx.help/?Category=Windows_10_2016&Policy=FullArmor.Policies.3B9EA2B5_A1D1_4CD5_9EDE_75B22990BC21::AllowCortana
|
|
- https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#21-cortana-and-search-group-policies
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowCortana" /t REG_DWORD /d 0 /f
|
|
revertCode: reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowCortana" /f
|
|
-
|
|
name: Do not allow Cortana experience
|
|
recommend: standard
|
|
code: reg add "HKLM\SOFTWARE\Microsoft\PolicyManager\default\Experience\AllowCortana" /v "value" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Microsoft\PolicyManager\default\Experience\AllowCortana" /v "value" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Do not allow search and Cortana to search cloud sources like OneDrive and SharePoint
|
|
recommend: standard
|
|
docs: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-search#search-allowcloudsearch
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowCloudSearch" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowCloudSearch" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable Cortana speech interaction while the system is locked
|
|
recommend: standard
|
|
docs: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-abovelock
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowCortanaAboveLock" /t REG_DWORD /d 0 /f
|
|
revertCode: reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowCortanaAboveLock" /f
|
|
-
|
|
name: Opt out from Cortana consent
|
|
recommend: standard
|
|
code: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "CortanaConsent" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "CortanaConsent" /t REG_DWORD /d 10 /f
|
|
-
|
|
name: Do not allow Cortana to be enabled
|
|
recommend: standard
|
|
code: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "CanCortanaBeEnabled" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "CanCortanaBeEnabled" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable Cortana (Internet search results in start menu)
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "CortanaEnabled" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "CortanaEnabled" /t REG_DWORD /d 0 /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "CortanaEnabled" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "CortanaEnabled" /t REG_DWORD /d 1 /f
|
|
-
|
|
category: Disable Cortana history
|
|
children:
|
|
-
|
|
name: Prevent Cortana from displaying history
|
|
recommend: standard
|
|
code: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "HistoryViewEnabled" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "HistoryViewEnabled" /f
|
|
-
|
|
name: Prevent Cortana from using device history
|
|
recommend: standard
|
|
code: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "DeviceHistoryEnabled" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "DeviceHistoryEnabled" /f
|
|
-
|
|
name: Remove the Cortana taskbar icon
|
|
recommend: standard
|
|
code: reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v "ShowCortanaButton" /t REG_DWORD /d 0 /f
|
|
revertCode: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v "ShowCortanaButton" /f
|
|
-
|
|
name: Disable Cortana in ambient mode
|
|
recommend: standard
|
|
code: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "CortanaInAmbientMode" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "CortanaInAmbientMode" /t REG_DWORD /d 1 /f
|
|
-
|
|
category: Disable Cortana voice listening
|
|
children:
|
|
-
|
|
name: Disable "Hey Cortana" voice activation
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKCU\Software\Microsoft\Speech_OneCore\Preferences" /v "VoiceActivationOn" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\Software\Microsoft\Speech_OneCore\Preferences" /v "VoiceActivationDefaultOn" /t REG_DWORD /d 0 /f
|
|
revertCode: |-
|
|
reg add "HKCU\Software\Microsoft\Speech_OneCore\Preferences" /v "VoiceActivationOn" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\Software\Microsoft\Speech_OneCore\Preferences" /v "VoiceActivationDefaultOn" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable Cortana listening to commands on Windows key + C
|
|
recommend: standard
|
|
code: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "VoiceShortcut" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "VoiceShortcut" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable using Cortana even when device is locked
|
|
recommend: standard
|
|
code: reg add "HKCU\Software\Microsoft\Speech_OneCore\Preferences" /v "VoiceActivationEnableAboveLockscreen" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKCU\Software\Microsoft\Speech_OneCore\Preferences" /v "VoiceActivationEnableAboveLockscreen" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable automatic update of Speech Data
|
|
recommend: standard
|
|
code: reg add "HKCU\Software\Microsoft\Speech_OneCore\Preferences" /v "ModelDownloadAllowed" /t REG_DWORD /d 0 /f
|
|
revertCode: reg delete "HKCU\Software\Microsoft\Speech_OneCore\Preferences" /v "ModelDownloadAllowed" /f
|
|
-
|
|
name: Disable Cortana voice support during Windows setup
|
|
recommend: standard
|
|
code: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v "DisableVoice" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v "DisableVoice" /f
|
|
-
|
|
category: Configure Windows search indexing
|
|
children:
|
|
-
|
|
name: Disable search indexing encrypted items / stores
|
|
recommend: standard
|
|
docs: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-search#search-allowindexingencryptedstoresoritems
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowIndexingEncryptedStoresOrItems" /t REG_DWORD /d 0 /f
|
|
revertCode: reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowIndexingEncryptedStoresOrItems" /f
|
|
-
|
|
name: Do not use automatic language detection when indexing
|
|
recommend: standard
|
|
docs: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-search#search-alwaysuseautolangdetection
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AlwaysUseAutoLangDetection" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AlwaysUseAutoLangDetection" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Do not allow search to use location
|
|
recommend: standard
|
|
docs:
|
|
- https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-search#search-allowsearchtouselocation
|
|
- https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#21-cortana-and-search-group-policies
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowSearchToUseLocation" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowSearchToUseLocation" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable web search in search bar
|
|
recommend: standard
|
|
docs:
|
|
- https://admx.help/?Category=Windows_10_2016&Policy=FullArmor.Policies.3B9EA2B5_A1D1_4CD5_9EDE_75B22990BC21::DisableWebSearch
|
|
- https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#21-cortana-and-search-group-policies
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "DisableWebSearch" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "DisableWebSearch" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Do not search the web or display web results in Search
|
|
docs: https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#21-cortana-and-search-group-policies
|
|
recomend: standard
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "ConnectedSearchUseWeb" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "ConnectedSearchUseWeb" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable Bing search
|
|
recommend: standard
|
|
code: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "BingSearchEnabled" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "BingSearchEnabled" /t REG_DWORD /d 1 /f
|
|
-
|
|
category: Disable targeted ads and marketing
|
|
children:
|
|
-
|
|
name: Disable ad customization with Advertising ID
|
|
recommend: standard
|
|
docs: https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#181-general
|
|
code: |-
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\AdvertisingInfo" /v "Enabled" /t REG_DWORD /d "0" /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo" /v "DisabledByGroupPolicy" /t REG_DWORD /d "1" /f
|
|
revertCode: |-
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\AdvertisingInfo" /v "Enabled" /t REG_DWORD /d "1" /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo" /v "DisabledByGroupPolicy" /t REG_DWORD /d "0" /f
|
|
-
|
|
category: Disable cloud-based tips and ads
|
|
children:
|
|
-
|
|
name: Disable Windows Tips
|
|
recommend: standard
|
|
docs: https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.CloudContent::DisableSoftLanding
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v "DisableSoftLanding" /t REG_DWORD /d "1" /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v "DisableSoftLanding" /t REG_DWORD /d "0" /f
|
|
-
|
|
name: Disable Windows Spotlight (random wallpaper on lock screen)
|
|
recommend: standard
|
|
docs:
|
|
- https://docs.microsoft.com/en-us/windows/configuration/windows-spotlight
|
|
- https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#25-windows-spotlight
|
|
code: reg add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsSpotlightFeatures" /t "REG_DWORD" /d "1" /f
|
|
revertCode: reg add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsSpotlightFeatures" /t "REG_DWORD" /d "0" /f
|
|
-
|
|
name: Disable Microsoft consumer experiences
|
|
recommend: standard
|
|
docs:
|
|
- https://www.stigviewer.com/stig/windows_10/2018-04-06/finding/V-71771
|
|
- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.CloudContent::DisableWindowsConsumerFeatures
|
|
- https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#1816-feedback--diagnostics
|
|
code: reg add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t "REG_DWORD" /d "1" /f
|
|
revertCode: reg add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t "REG_DWORD" /d "0" /f
|
|
-
|
|
name: Turn Off Suggested Content in Settings app
|
|
recommend: standard
|
|
docs: https://www.tenforums.com/tutorials/100541-turn-off-suggested-content-settings-app-windows-10-a.html
|
|
code: |-
|
|
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /d "0" /t REG_DWORD /f
|
|
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353694Enabled" /d "0" /t REG_DWORD /f
|
|
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353696Enabled" /d "0" /t REG_DWORD /f
|
|
revertCode: |-
|
|
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /d "1" /t REG_DWORD /f
|
|
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353694Enabled" /d "1" /t REG_DWORD /f
|
|
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353696Enabled" /d "1" /t REG_DWORD /f
|
|
-
|
|
category: Disable biometrics (breaks fingerprinting/facial login)
|
|
children:
|
|
-
|
|
name: Do not allow the use of biometrics
|
|
recommend: strict
|
|
docs: https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.Biometrics::Biometrics_EnableBio
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Biometrics" /v "Enabled" /t REG_DWORD /d "0" /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Biometrics" /v "Enabled" /t REG_DWORD /d "1" /f
|
|
-
|
|
name: Do not allow users to log on using biometrics
|
|
recommend: strict
|
|
docs: https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.Biometrics::Biometrics_EnableCredProv
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Biometrics\Credential Provider" /v "Enabled" /t "REG_DWORD" /d "0" /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Biometrics\Credential Provider" /v "Enabled" /t "REG_DWORD" /d "1" /f
|
|
-
|
|
name: Do not start Windows Biometric Service
|
|
recommend: strict
|
|
docs:
|
|
- http://batcmd.com/windows/10/services/wbiosrvc/
|
|
- http://revertservice.com/10/wbiosrvc/
|
|
code: |-
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Services\WbioSrvc" /v "Start" /t REG_DWORD /d 4 /f
|
|
sc stop "WbioSrvc" & sc config "WbioSrvc" start=disabled
|
|
revertCode: |-
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Services\WbioSrvc" /v "Start" /t REG_DWORD /d 2 /f
|
|
sc config "WbioSrvc" start=demand
|
|
-
|
|
name: Disable Wi-Fi sense
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" /v "value" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotspots" /v "value" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\WcmSvc\wifinetworkmanager\config" /v "AutoConnectAllowedOEM" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Hide most used apps (tracks app launch)
|
|
docs: https://www.thewindowsclub.com/enable-or-disable-app-launch-tracking-in-windows-10
|
|
recommend: strict
|
|
code: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Start_TrackProgs" /d 0 /t REG_DWORD /f
|
|
revertCode: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Start_TrackProgs" /d 1 /t REG_DWORD /f
|
|
-
|
|
name: Disable Inventory Collector
|
|
recommend: standard
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v "DisableInventory" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v "DisableInventory" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Disable Website Access of Language List
|
|
recommend: standard
|
|
docs: https://www.tenforums.com/tutorials/82980-turn-off-website-access-language-list-windows-10-a.html
|
|
code: reg add "HKCU\Control Panel\International\User Profile" /v "HttpAcceptLanguageOptOut" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKCU\Control Panel\International\User Profile" /v "HttpAcceptLanguageOptOut" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Disable Auto Downloading Maps
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Maps" /v "AllowUntriggeredNetworkTrafficOnSettingsPage" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Maps" /v "AutoDownloadAndUpdateMapData" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Disable steps recorder
|
|
recommend: standard
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v "DisableUAR" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable game screen recording
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKCU\System\GameConfigStore" /v "GameDVR_Enabled" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR" /v "AllowGameDVR" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Disable Windows DRM internet access
|
|
docs: https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.DigitalRights2::DisableOnline
|
|
recommend: standard
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\WMDRM" /v "DisableOnline" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable feedback on write (sending typing info)
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\Input\TIPC" /v "Enabled" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Input\TIPC" /v "Enabled" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Disable Activity Feed
|
|
recommend: standard
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableActivityFeed" /d "0" /t REG_DWORD /f
|
|
-
|
|
category: Disable Windows Insider Program
|
|
children:
|
|
-
|
|
name: Disable Windows Insider Service
|
|
docs: http://revertservice.com/10/wisvc/
|
|
recommend: standard
|
|
code: sc stop "wisvc" & sc config "wisvc" start=disabled
|
|
revertCode: sc config "wisvc" start=demand
|
|
-
|
|
name: Do not let Microsoft try features on this build
|
|
docs: https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.DataCollection::EnableExperimentation
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" /v "EnableExperimentation" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" /v "EnableConfigFlighting" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\PolicyManager\default\System\AllowExperimentation" /v "value" /t "REG_DWORD" /d 0 /f
|
|
revertCode: |-
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" /v "EnableExperimentation" /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" /v "EnableConfigFlighting" /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\PolicyManager\default\System\AllowExperimentation" /v "value" /f
|
|
-
|
|
name: Disable getting preview builds of Windows
|
|
docs: https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.AllowBuildPreview::AllowBuildPreview
|
|
recommend: standard
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" /v "AllowBuildPreview" /t REG_DWORD /d 0 /f
|
|
revertCode: reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" /v "AllowBuildPreview" /f
|
|
-
|
|
name: Remove "Windows Insider Program" from Settings
|
|
docs: https://www.askvg.com/windows-10-tip-remove-windows-insider-program-section-from-settings-page/
|
|
code: reg add "HKLM\SOFTWARE\Microsoft\WindowsSelfHost\UI\Visibility" /v "HideInsiderPage" /t "REG_DWORD" /d "1" /f
|
|
revertCode: reg delete "HKLM\SOFTWARE\Microsoft\WindowsSelfHost\UI\Visibility" /v "HideInsiderPage" /f
|
|
-
|
|
category: Disable cloud sync
|
|
docs: https://support.microsoft.com/en-us/help/4026102/windows-10-about-sync-settings
|
|
children:
|
|
-
|
|
name: Disable all settings sync
|
|
recommend: standard
|
|
enabler: all those bottom
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableSettingSync" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableSettingSyncUserOverride" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableSyncOnPaidNetwork" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync" /v "SyncPolicy" /t REG_DWORD /d 5 /f
|
|
-
|
|
name: Disable Application Setting Sync
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableApplicationSettingSync" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableApplicationSettingSyncUserOverride" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable App Sync Setting Sync
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableAppSyncSettingSync" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableAppSyncSettingSyncUserOverride" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable Credentials Setting Sync
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableCredentialsSettingSync" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableCredentialsSettingSyncUserOverride" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Credentials" /v "Enabled" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Disable Desktop Theme Setting Sync
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableDesktopThemeSettingSync" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableDesktopThemeSettingSyncUserOverride" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable Personalization Setting Sync
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisablePersonalizationSettingSync" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisablePersonalizationSettingSyncUserOverride" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable Start Layout Setting Sync
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableStartLayoutSettingSync" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableStartLayoutSettingSyncUserOverride" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable Web Browser Setting Sync
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableWebBrowserSettingSync" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableWebBrowserSettingSyncUserOverride" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable Windows Setting Sync
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableWindowsSettingSync" /t REG_DWORD /d 2 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableWindowsSettingSyncUserOverride" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable Language Setting Sync
|
|
recommend: standard
|
|
docs: https://www.tenforums.com/tutorials/4077-turn-off-sync-settings-microsoft-account-windows-10-a.html
|
|
code: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Language" /t REG_DWORD /v "Enabled" /d 0 /f
|
|
revertCode: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Language" /t REG_DWORD /v "Enabled" /d 1 /f
|
|
-
|
|
category: Configure programs
|
|
children:
|
|
-
|
|
category: Disable Visual Studio data collection
|
|
children:
|
|
-
|
|
category: Disable Experience Improvement Program (PerfWatson)
|
|
docs:
|
|
- https://docs.microsoft.com/en-us/visualstudio/ide/visual-studio-experience-improvement-program
|
|
- https://devblogs.microsoft.com/visualstudio/how-we-use-your-perfwatson-data-to-identify-unresponsive-areas/
|
|
children:
|
|
-
|
|
name: Disable SQM OS key
|
|
recommend: standard
|
|
code: |-
|
|
if %PROCESSOR_ARCHITECTURE%==x86 ( REM is 32 bit?
|
|
reg add "HKLM\SOFTWARE\Microsoft\VSCommon\14.0\SQM" /v "OptIn" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\VSCommon\15.0\SQM" /v "OptIn" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\VSCommon\16.0\SQM" /v "OptIn" /t REG_DWORD /d 0 /f
|
|
) else (
|
|
reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\VSCommon\14.0\SQM" /v "OptIn" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\VSCommon\15.0\SQM" /v "OptIn" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\VSCommon\16.0\SQM" /v "OptIn" /t REG_DWORD /d 0 /f
|
|
)
|
|
revertCode:
|
|
if %PROCESSOR_ARCHITECTURE%==x86 ( REM is 32 bit?
|
|
reg add "HKLM\SOFTWARE\Microsoft\VSCommon\14.0\SQM" /v "OptIn" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\VSCommon\15.0\SQM" /v "OptIn" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\VSCommon\16.0\SQM" /v "OptIn" /t REG_DWORD /d 1 /f
|
|
) else (
|
|
reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\VSCommon\14.0\SQM" /v "OptIn" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\VSCommon\15.0\SQM" /v "OptIn" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\VSCommon\16.0\SQM" /v "OptIn" /t REG_DWORD /d 1 /f
|
|
)
|
|
-
|
|
name: Disable SQM group policy
|
|
recommend: standard
|
|
code: reg add "HKLM\Software\Policies\Microsoft\VisualStudio\SQM" /v "OptIn" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKLM\Software\Policies\Microsoft\VisualStudio\SQM" /v "OptIn" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable visual studio telemetry
|
|
recommend: standard
|
|
code: reg add "HKCU\Software\Microsoft\VisualStudio\Telemetry" /v "TurnOffSwitch" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKCU\Software\Microsoft\VisualStudio\Telemetry" /v "TurnOffSwitch" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Disable Visual Studio feedback
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\VisualStudio\Feedback" /v "DisableFeedbackDialog" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\VisualStudio\Feedback" /v "DisableEmailInput" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\VisualStudio\Feedback" /v "DisableScreenshotCapture" /t REG_DWORD /d 1 /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\VisualStudio\Feedback" /v "DisableFeedbackDialog" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\VisualStudio\Feedback" /v "DisableEmailInput" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\VisualStudio\Feedback" /v "DisableScreenshotCapture" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Stop and disable Visual Studio Standard Collector Service
|
|
recommend: standard
|
|
code: sc stop "VSStandardCollectorService150" & sc config "VSStandardCollectorService150" start=disabled
|
|
revertCode: sc config "VSStandardCollectorService150" start=auto & sc start "VSStandardCollectorService150"
|
|
-
|
|
category: Configure Windows Defender
|
|
children:
|
|
-
|
|
name: Do not send Watson events
|
|
recommend: standard
|
|
docs: https://getadmx.com/?Category=SystemCenterEndpointProtection&Policy=Microsoft.Policies.Antimalware::reporting_disablegenericreports
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableGenericReports" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableGenericReports" /t REG_DWORD /d 0 /f
|
|
-
|
|
category: Disable Microsoft SpyNet (Windows Defender cloud export for analysis)
|
|
children:
|
|
-
|
|
name: Disable local setting override for reporting to Microsoft MAPS
|
|
recommend: standard
|
|
docs:
|
|
- https://www.stigviewer.com/stig/windows_defender_antivirus/2017-12-27/finding/V-75161
|
|
- https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsDefender::Spynet_LocalSettingOverrideSpynetReporting
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "LocalSettingOverrideSpynetReporting" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "LocalSettingOverrideSpynetReporting" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Turn off Windows Defender SpyNet reporting
|
|
recommend: standard
|
|
docs:
|
|
- https://www.stigviewer.com/stig/windows_7/2012-07-02/finding/V-15713
|
|
- https://getadmx.com/?Category=Windows_7_2008R2&Policy=Microsoft.Policies.WindowsDefender::SpyNetReporting
|
|
- https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-allowcloudprotection
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpynetReporting" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpynetReporting" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Do not send file samples for further analysis
|
|
recommend: standard
|
|
doc:
|
|
- https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-submitsamplesconsent
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable Malicious Software Reporting tool diagnostic data
|
|
recommend: standard
|
|
docs: https://getadmx.com/?Category=Windows10_Telemetry&Policy=Microsoft.Policies.Win10Privacy::DontReportInfection
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Disable NET Core CLI telemetry
|
|
recommend: standard
|
|
code: setx DOTNET_CLI_TELEMETRY_OPTOUT 1
|
|
revertCode: setx DOTNET_CLI_TELEMETRY_OPTOUT 0
|
|
-
|
|
name: Disable PowerShell 7+ telemetry
|
|
recommend: standard
|
|
docs: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_telemetry
|
|
code: setx POWERSHELL_TELEMETRY_OPTOUT 1
|
|
revertCode: setx POWERSHELL_TELEMETRY_OPTOUT 0
|
|
-
|
|
category: Disable NVIDIA telemetry
|
|
docs:
|
|
- https://github.com/CHEF-KOCH/nVidia-modded-Inf
|
|
- https://github.com/NateShoffner/Disable-Nvidia-Telemetry
|
|
- https://forum.palemoon.org/viewtopic.php?f=4&t=15686&sid=3d7982d3b9e89c713547f1a581ea44a2&start=20
|
|
children:
|
|
-
|
|
name: Uninstall NVIDIA telemetry tasks
|
|
recommend: standard
|
|
code: |-
|
|
if exist "%ProgramFiles%\NVIDIA Corporation\Installer2\InstallerCore\NVI2.DLL" (
|
|
rundll32 "%PROGRAMFILES%\NVIDIA Corporation\Installer2\InstallerCore\NVI2.DLL",UninstallPackage NvTelemetryContainer
|
|
rundll32 "%PROGRAMFILES%\NVIDIA Corporation\Installer2\InstallerCore\NVI2.DLL",UninstallPackage NvTelemetry
|
|
)
|
|
-
|
|
name: Delete NVIDIA residual telemetry files
|
|
recommend: standard
|
|
code: |-
|
|
del /s %SystemRoot%\System32\DriverStore\FileRepository\NvTelemetry*.dll
|
|
rmdir /s /q "%ProgramFiles(x86)%\NVIDIA Corporation\NvTelemetry" 2>nul
|
|
rmdir /s /q "%ProgramFiles%\NVIDIA Corporation\NvTelemetry" 2>nul
|
|
-
|
|
name: Opt out from NVIDIA telemetry
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\NVIDIA Corporation\NvControlPanel2\Client" /v "OptInOrOutPreference" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\NVIDIA Corporation\Global\FTS" /v "EnableRID44231" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\NVIDIA Corporation\Global\FTS" /v "EnableRID64640" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\NVIDIA Corporation\Global\FTS" /v "EnableRID66610" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\Startup" /v "SendTelemetryData" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\services\NvTelemetryContainer" /v "Start" /t REG_DWORD /d 4 /f
|
|
revertCode: |-
|
|
reg delete "HKLM\SOFTWARE\NVIDIA Corporation\NvControlPanel2\Client" /v "OptInOrOutPreference" /f
|
|
reg delete "HKLM\SOFTWARE\NVIDIA Corporation\Global\FTS" /v "EnableRID44231" /f
|
|
reg delete "HKLM\SOFTWARE\NVIDIA Corporation\Global\FTS" /v "EnableRID64640" /f
|
|
reg delete "HKLM\SOFTWARE\NVIDIA Corporation\Global\FTS" /v "EnableRID66610" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\Startup" /v "SendTelemetryData" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\services\NvTelemetryContainer" /f
|
|
-
|
|
name: Disable NVIDIA telemetry services
|
|
recommend: standard
|
|
code: |-
|
|
schtasks /change /TN NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /DISABLE
|
|
schtasks /change /TN NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /DISABLE
|
|
schtasks /change /TN NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /DISABLE
|
|
revertCode: |-
|
|
schtasks /change /TN NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /ENABLE
|
|
schtasks /change /TN NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /ENABLE
|
|
schtasks /change /TN NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /ENABLE
|
|
-
|
|
category: Disable Visual Studio Code data collection
|
|
docs:
|
|
- https://code.visualstudio.com/updates/v1_26#_offline-mode
|
|
- https://code.visualstudio.com/docs/getstarted/settings
|
|
children:
|
|
-
|
|
name: Disable Visual Studio Code telemetry
|
|
docs: https://code.visualstudio.com/docs/getstarted/telemetry
|
|
recommend: standard
|
|
call:
|
|
function: SetVsCodeSetting
|
|
parameters:
|
|
setting: telemetry.enableTelemetry
|
|
powerShellValue: $false
|
|
-
|
|
name: Disable Visual Studio Code crash reporting
|
|
docs: https://code.visualstudio.com/docs/getstarted/telemetry
|
|
recommend: standard
|
|
call:
|
|
function: SetVsCodeSetting
|
|
parameters:
|
|
setting: telemetry.enableCrashReporter
|
|
powerShellValue: $false
|
|
-
|
|
name: Do not run Microsoft online experiments
|
|
docs: https://github.com/Microsoft/vscode/blob/1aee0c194cff72d179b9f8ef324e47f34555a07d/src/vs/workbench/contrib/experiments/node/experimentService.ts#L173
|
|
recommend: standard
|
|
call:
|
|
function: SetVsCodeSetting
|
|
parameters:
|
|
setting: workbench.enableExperiments
|
|
powerShellValue: $false
|
|
-
|
|
name: Choose manual updates over automatic updates
|
|
call:
|
|
function: SetVsCodeSetting
|
|
parameters:
|
|
setting: update.mode
|
|
powerShellValue: >-
|
|
'manual'
|
|
-
|
|
name: Show Release Notes from Microsoft online service after an update
|
|
call:
|
|
function: SetVsCodeSetting
|
|
parameters:
|
|
setting: update.showReleaseNotes
|
|
powerShellValue: $false
|
|
-
|
|
name: Automatically check extensions from Microsoft online service
|
|
call:
|
|
function: SetVsCodeSetting
|
|
parameters:
|
|
setting: extensions.autoCheckUpdates
|
|
powerShellValue: $false
|
|
-
|
|
name: Fetch recommendations from Microsoft only on demand
|
|
call:
|
|
function: SetVsCodeSetting
|
|
parameters:
|
|
setting: extensions.showRecommendationsOnlyOnDemand
|
|
powerShellValue: $true
|
|
-
|
|
name: Automatically fetch git commits from remote repository
|
|
call:
|
|
function: SetVsCodeSetting
|
|
parameters:
|
|
setting: git.autofetch
|
|
powerShellValue: $false
|
|
-
|
|
name: Fetch package information from NPM and Bower
|
|
call:
|
|
function: SetVsCodeSetting
|
|
parameters:
|
|
setting: npm.fetchOnlinePackageInfo
|
|
powerShellValue: $false
|
|
-
|
|
category: Disable Microsoft Office telemetry
|
|
docs: https://docs.microsoft.com/en-us/deployoffice/compat/manage-the-privacy-of-data-monitored-by-telemetry-in-office
|
|
children:
|
|
-
|
|
name: Disable Microsoft Office logging
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Mail" /v "EnableLogging" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Mail" /v "EnableLogging" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Calendar" /v "EnableCalendarLogging" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Calendar" /v "EnableCalendarLogging" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Word\Options" /v "EnableLogging" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Word\Options" /v "EnableLogging" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\15.0\OSM" /v "EnableLogging" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\OSM" /v "EnableLogging" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\15.0\OSM" /v "EnableUpload" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\OSM" /v "EnableUpload" /t REG_DWORD /d 0 /f
|
|
revertCode: |-
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Mail" /v "EnableLogging" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Mail" /v "EnableLogging" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Word\Options" /v "EnableLogging" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Word\Options" /v "EnableLogging" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Calendar" /v "EnableCalendarLogging" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Calendar" /v "EnableCalendarLogging" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\15.0\OSM" /v "EnableLogging" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\OSM" /v "EnableLogging" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\15.0\OSM" /v "EnableUpload" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\OSM" /v "EnableUpload" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable client telemetry
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\Common\ClientTelemetry" /v "DisableTelemetry" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry" /v "DisableTelemetry" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\Common\ClientTelemetry" /v "VerboseLogging" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry" /v "VerboseLogging" /t REG_DWORD /d 0 /f
|
|
revertCode: |-
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\Common\ClientTelemetry" /v "DisableTelemetry" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry" /v "DisableTelemetry" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\Common\ClientTelemetry" /v "VerboseLogging" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry" /v "VerboseLogging" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Customer Experience Improvement Program
|
|
docs: https://www.stigviewer.com/stig/microsoft_office_system_2013/2014-12-23/finding/V-17612
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Common" /v "QMEnable" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common" /v "QMEnable" /t REG_DWORD /d 0 /f
|
|
revertCode: |-
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Common" /v "QMEnable" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common" /v "QMEnable" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable feedback
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Common\Feedback" /v "Enabled" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Feedback" /v "Enabled" /t REG_DWORD /d 0 /f
|
|
revertCode: |-
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Common\Feedback" /v "Enabled" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Feedback" /v "Enabled" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable telemetry agent
|
|
recommend: standard
|
|
code: |-
|
|
schtasks /change /TN "Microsoft\Office\OfficeTelemetryAgentFallBack" /DISABLE
|
|
schtasks /change /TN "Microsoft\Office\OfficeTelemetryAgentFallBack2016" /DISABLE
|
|
schtasks /change /TN "Microsoft\Office\OfficeTelemetryAgentLogOn" /DISABLE
|
|
schtasks /change /TN "Microsoft\Office\OfficeTelemetryAgentLogOn2016" /DISABLE
|
|
revertCode: |-
|
|
schtasks /change /TN "Microsoft\Office\OfficeTelemetryAgentFallBack" /ENABLE
|
|
schtasks /change /TN "Microsoft\Office\OfficeTelemetryAgentFallBack2016" /ENABLE
|
|
schtasks /change /TN "Microsoft\Office\OfficeTelemetryAgentLogOn" /ENABLE
|
|
schtasks /change /TN "Microsoft\Office\OfficeTelemetryAgentLogOn2016" /ENABLE
|
|
# - (breaks office, see https://answers.microsoft.com/en-us/office/forum/office_2016-officeapps/office-2016-click-to-run-service-is-it-necessary/07f87963-7193-488a-9885-d6339105824b)
|
|
# name: Disable ClickToRun Service Monitor
|
|
# code: |-
|
|
# schtasks /change /TN "Microsoft\Office\Office ClickToRun Service Monitor" /DISABLE
|
|
# sc stop "ClickToRunSvc" & sc config "ClickToRunSvc" start=disabled
|
|
# revertCode: |-
|
|
# schtasks /change /TN "Microsoft\Office\Office ClickToRun Service Monitor" /ENABLE
|
|
# sc config "ClickToRunSvc" start=auto & sc start "ClickToRunSvc"
|
|
-
|
|
name: Disable Subscription Heartbeat
|
|
code: |-
|
|
schtasks /change /TN "Microsoft\Office\Office 15 Subscription Heartbeat" /DISABLE
|
|
schtasks /change /TN "Microsoft\Office\Office 16 Subscription Heartbeat" /DISABLE
|
|
revertCode: |-
|
|
schtasks /change /TN "Microsoft\Office\Office 15 Subscription Heartbeat" /ENABLE
|
|
schtasks /change /TN "Microsoft\Office\Office 16 Subscription Heartbeat" /ENABLE
|
|
-
|
|
category: Configure browsers
|
|
children:
|
|
-
|
|
category: Configure Edge
|
|
children:
|
|
-
|
|
category: Chromium Edge settings
|
|
children:
|
|
-
|
|
name: Disable Edge usage and crash-related data reporting (shows "Your browser is managed") # Obselete since Microsoft Edge version 89
|
|
recommend: standard
|
|
docs:
|
|
- https://admx.help/?Category=EdgeChromium&Policy=Microsoft.Policies.Edge::MetricsReportingEnabled
|
|
- https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#metricsreportingenabled
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "MetricsReportingEnabled" /t REG_DWORD /d 0 /f
|
|
revertCode: reg delete "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "MetricsReportingEnabled" /f
|
|
-
|
|
name: Disable sending site information (shows "Your browser is managed") # Obselete since Microsoft Edge version 89
|
|
recommend: standard
|
|
docs:
|
|
- https://admx.help/?Category=EdgeChromium&Policy=Microsoft.Policies.Edge::SendSiteInfoToImproveServices
|
|
- https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#sendsiteinfotoimproveservices
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "SendSiteInfoToImproveServices" /t REG_DWORD /d 0 /f
|
|
revertCode: reg delete "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "SendSiteInfoToImproveServices" /f
|
|
-
|
|
name: Disable Automatic Installation of Microsoft Edge Chromium
|
|
docs: https://docs.microsoft.com/en-us/deployedge/microsoft-edge-blocker-toolkit
|
|
code: reg add "HKLM\SOFTWARE\Microsoft\EdgeUpdate" /v "DoNotUpdateToEdgeWithChromium" /t REG_DWORD /d 1 /f
|
|
revertCode: reg delete "HKLM\SOFTWARE\Microsoft\EdgeUpdate" /v "DoNotUpdateToEdgeWithChromium" /f
|
|
-
|
|
name: Disable live tile data collection
|
|
recommend: standard
|
|
docs:
|
|
- https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/telemetry-management-gp
|
|
- https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-preventlivetiledatacollection
|
|
code: reg add "HKCU\Software\Policies\Microsoft\MicrosoftEdge\Main" /v "PreventLiveTileDataCollection" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKCU\Software\Policies\Microsoft\MicrosoftEdge\Main" /v "PreventLiveTileDataCollection" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Disable MFU tracking
|
|
recommend: standard
|
|
docs: https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.EdgeUI::DisableMFUTracking
|
|
code: reg add "HKCU\Software\Policies\Microsoft\Windows\EdgeUI" /v "DisableMFUTracking" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKCU\Software\Policies\Microsoft\Windows\EdgeUI" /v "DisableMFUTracking" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Disable recent apps
|
|
recommend: standard
|
|
docs: https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.EdgeUI::DisableRecentApps
|
|
code: reg add "HKCU\Software\Policies\Microsoft\Windows\EdgeUI" /v "DisableRecentApps" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKCU\Software\Policies\Microsoft\Windows\EdgeUI" /v "DisableRecentApps" /t REG_DWORD /d 0/f
|
|
-
|
|
name: Turn off backtracking
|
|
recommend: standard
|
|
docs: https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.EdgeUI::TurnOffBackstack
|
|
code: reg add "HKCU\Software\Policies\Microsoft\Windows\EdgeUI" /v "TurnOffBackstack" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKCU\Software\Policies\Microsoft\Windows\EdgeUI" /v "TurnOffBackstack" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Disable Search Suggestions in Edge
|
|
docs:
|
|
- https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/address-bar-settings-gp
|
|
- https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.MicrosoftEdge::AllowSearchSuggestionsinAddressBar
|
|
recommend: standard
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\SearchScopes" /v "ShowSearchSuggestionsGlobal" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\SearchScopes" /v "ShowSearchSuggestionsGlobal" /t REG_DWORD /d 1 /f
|
|
-
|
|
category: Configure Internet Explorer
|
|
children:
|
|
-
|
|
name: Disable Geolocation in Internet Explorer
|
|
recommend: standard
|
|
code: reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Geolocation" /v "PolicyDisableGeolocation" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Geolocation" /v "PolicyDisableGeolocation" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Disable Internet Explorer InPrivate logging
|
|
recommend: standard
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Safety\PrivacIE" /v "DisableLogging" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Safety\PrivacIE" /v "DisableLogging" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Disable Internet Explorer CEIP
|
|
recommend: standard
|
|
docs: https://www.stigviewer.com/stig/internet_explorer_8/2014-07-03/finding/V-15492
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\SQM" /v "DisableCustomerImprovementProgram" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\SQM" /v "DisableCustomerImprovementProgram" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable calling legacy WCM policies
|
|
recommend: standard
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v "CallLegacyWCMPolicies" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v "CallLegacyWCMPolicies" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable SSLv3 fallback
|
|
recommend: standard
|
|
docs: https://www.stigviewer.com/stig/microsoft_internet_explorer_11/2018-04-02/finding/V-64729
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v "EnableSSL3Fallback" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v EnableSSL3Fallback /t REG_DWORD /d 3 /f
|
|
-
|
|
name: Disable ignoring cert errors
|
|
recommend: standard
|
|
docs: https://www.stigviewer.com/stig/microsoft_internet_explorer_11/2017-03-01/finding/V-64717
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v "PreventIgnoreCertErrors" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v "PreventIgnoreCertErrors" /t REG_DWORD /d 0 /f
|
|
-
|
|
category: Configure Google Chrome
|
|
children:
|
|
-
|
|
name: Disable Chrome Software Reporter Tool
|
|
recommend: standard
|
|
code: |-
|
|
icacls "%localappdata%\Google\Chrome\User Data\SwReporter" /inheritance:r /deny "*S-1-1-0:(OI)(CI)(F)" "*S-1-5-7:(OI)(CI)(F)"
|
|
cacls "%localappdata%\Google\Chrome\User Data\SwReporter" /e /c /d %username%
|
|
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "DisallowRun" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "1" /t REG_SZ /d "software_reporter_tool.exe" /f
|
|
revertCode: reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "1" /f
|
|
-
|
|
category: Chrome cleanup
|
|
children:
|
|
-
|
|
name: Do not share scanned software data to Google (shows "Your browser is managed")
|
|
recommend: standard
|
|
docs:
|
|
- https://www.chromium.org/administrators/policy-list-3#ChromeCleanupReportingEnabled
|
|
- https://www.stigviewer.com/stig/google_chrome_current_windows/2018-09-06/finding/V-81593
|
|
code: reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v "ChromeCleanupReportingEnabled" /t REG_DWORD /d 0 /f
|
|
revertCode: reg delete "HKLM\SOFTWARE\Policies\Google\Chrome" /v "ChromeCleanupReportingEnabled" /f
|
|
-
|
|
name: Prevent Chrome from scanning the system for cleanup (shows "Your browser is managed")
|
|
recommend: standard
|
|
docs:
|
|
- https://www.chromium.org/administrators/policy-list-3#ChromeCleanupEnabled
|
|
- https://www.stigviewer.com/stig/google_chrome_current_windows/2018-09-06/finding/V-81591
|
|
code: reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v "ChromeCleanupEnabled" /t REG_DWORD /d 0 /f
|
|
revertCode: reg delete "HKLM\SOFTWARE\Policies\Google\Chrome" /v "ChromeCleanupEnabled" /f
|
|
-
|
|
name: Disable Chrome metrics reporting (shows "Your browser is managed")
|
|
recommend: standard
|
|
docs: https://www.stigviewer.com/stig/google_chrome_v23_windows/2013-01-11/finding/V-35780
|
|
code: reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v "MetricsReportingEnabled" /t REG_DWORD /d 0 /f
|
|
revertCode: reg delete "HKLM\SOFTWARE\Policies\Google\Chrome" /v "MetricsReportingEnabled" /f
|
|
-
|
|
category: Configure Mozilla Firefox telemetry
|
|
children:
|
|
-
|
|
category: Disable default browser agent reporting
|
|
children:
|
|
-
|
|
name: Disable default browser agent reporting policy
|
|
recommend: standard
|
|
docs: https://www.bleepingcomputer.com/news/software/firefox-now-tells-mozilla-what-your-default-browser-is-every-day/
|
|
code: reg add HKLM\SOFTWARE\Policies\Mozilla\Firefox /v DisableDefaultBrowserAgent /t REG_DWORD /d 1 /f
|
|
revertCode: reg add HKLM\SOFTWARE\Policies\Mozilla\Firefox /v DisableDefaultBrowserAgent /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Disable default browser agent reporting services
|
|
recommend: standard
|
|
code: |-
|
|
schtasks.exe /change /disable /tn "\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB"
|
|
schtasks.exe /change /disable /tn "\Mozilla\Firefox Default Browser Agent D2CEEC440E2074BD"
|
|
revertCode: |-
|
|
schtasks.exe /change /enable /tn "\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB"
|
|
schtasks.exe /change /enable /tn "\Mozilla\Firefox Default Browser Agent D2CEEC440E2074BD"
|
|
-
|
|
name: Disable Firefox metrics reporting
|
|
recommend: standard
|
|
docs: https://github.com/mozilla/policy-templates#disabletelemetry
|
|
code: reg add HKLM\SOFTWARE\Policies\Mozilla\Firefox /v DisableTelemetry /t REG_DWORD /d 1 /f
|
|
revertCode: reg add HKLM\SOFTWARE\Policies\Mozilla\Firefox /v DisableTelemetry /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Disable Google update service
|
|
recommend: standard
|
|
code: |-
|
|
sc stop "gupdate" & sc config "gupdate" start=disabled
|
|
sc stop "gupdatem" & sc config "gupdatem" start=disabled
|
|
schtasks /change /disable /tn "GoogleUpdateTaskMachineCore"
|
|
schtasks /change /disable /tn "GoogleUpdateTaskMachineUA"
|
|
revertCode: |-
|
|
sc config "gupdate" start=auto & sc start "gupdate"
|
|
sc config "gupdatem" start=auto & sc start "gupdatem"
|
|
schtasks /Change /enable /tn "GoogleUpdateTaskMachineCore"
|
|
schtasks /change /enable /tn "GoogleUpdateTaskMachineUA"
|
|
-
|
|
name: Disable Adobe Acrobat update service
|
|
recommend: standard
|
|
code: |-
|
|
sc stop "AdobeARMservice" & sc config "AdobeARMservice" start=disabled
|
|
sc stop "adobeupdateservice" & sc config "adobeupdateservice" start=disabled
|
|
sc stop "adobeflashplayerupdatesvc" & sc config "adobeflashplayerupdatesvc" start=disabled
|
|
schtasks /change /tn "Adobe Acrobat Update Task" /disable
|
|
schtasks /change /tn "Adobe Flash Player Updater" /disable
|
|
revertCode: |-
|
|
sc config "AdobeARMservice" start=auto & sc start "AdobeARMservice"
|
|
sc config "adobeupdateservice" start=auto & sc start "adobeupdateservice"
|
|
sc config "adobeflashplayerupdatesvc" start=auto & sc start "adobeflashplayerupdatesvc"
|
|
schtasks /change /tn "Adobe Acrobat Update Task" /enable
|
|
schtasks /change /tn "Adobe Flash Player Updater" /enable
|
|
-
|
|
name: Disable Razer Game Scanner Service
|
|
recommend: standard
|
|
code: sc stop "Razer Game Scanner Service" & sc config "Razer Game Scanner Service" start=disabled
|
|
revertCode: sc config "Razer Game Scanner Service" start=demand
|
|
-
|
|
name: Disable Logitech Gaming Registry Service
|
|
recommend: standard
|
|
code: sc stop "LogiRegistryService" & sc config "LogiRegistryService" start=disabled
|
|
revertCode: sc config "LogiRegistryService" start=auto & sc start "LogiRegistryService"
|
|
-
|
|
name: Disable Dropbox auto update service
|
|
recommend: standard
|
|
code: |-
|
|
sc stop "dbupdate" & sc config "dbupdate" start=disabled
|
|
sc stop "dbupdatem" & sc config "dbupdatem" start=disabled
|
|
schtasks /Change /DISABLE /TN "DropboxUpdateTaskMachineCore"
|
|
schtasks /Change /DISABLE /TN "DropboxUpdateTaskMachineUA"
|
|
revertCode: |-
|
|
sc config "dbupdate" start=auto & sc start "dbupdate"
|
|
sc config "dbupdatem" start=auto & sc start "dbupdatem"
|
|
schtasks /Change /ENABLE /TN "DropboxUpdateTaskMachineCore"
|
|
schtasks /Change /ENABLE /TN "DropboxUpdateTaskMachineUA"
|
|
-
|
|
category: Disable Media Player data collection
|
|
children:
|
|
-
|
|
name: Do not send Windows Media Player statistics
|
|
recommend: standard
|
|
code: reg add "HKCU\SOFTWARE\Microsoft\MediaPlayer\Preferences" /v "UsageTracking" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Disable metadata retrieval
|
|
recommend: standard
|
|
code: |-
|
|
reg add "HKCU\Software\Policies\Microsoft\WindowsMediaPlayer" /v "PreventCDDVDMetadataRetrieval" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\Software\Policies\Microsoft\WindowsMediaPlayer" /v "PreventMusicFileMetadataRetrieval" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\Software\Policies\Microsoft\WindowsMediaPlayer" /v "PreventRadioPresetsRetrieval" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\WMDRM" /v "DisableOnline" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable Windows Media Player Network Sharing Service
|
|
recommend: standard
|
|
code: sc stop "WMPNetworkSvc" & sc config "WMPNetworkSvc" start=disabled
|
|
-
|
|
name: Disable CCleaner Monitoring
|
|
code: |-
|
|
reg add "HKCU\Software\Piriform\CCleaner" /v "Monitoring" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\Software\Piriform\CCleaner" /v "HelpImproveCCleaner" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\Software\Piriform\CCleaner" /v "SystemMonitoring" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\Software\Piriform\CCleaner" /v "UpdateAuto" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\Software\Piriform\CCleaner" /v "UpdateCheck" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\Software\Piriform\CCleaner" /v "CheckTrialOffer" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\Software\Piriform\CCleaner" /v "(Cfg)HealthCheck" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\Software\Piriform\CCleaner" /v "(Cfg)QuickClean" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\Software\Piriform\CCleaner" /v "(Cfg)QuickCleanIpm" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\Software\Piriform\CCleaner" /v "(Cfg)GetIpmForTrial" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\Software\Piriform\CCleaner" /v "(Cfg)SoftwareUpdater" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\Software\Piriform\CCleaner" /v "(Cfg)SoftwareUpdaterIpm" /t REG_DWORD /d 0 /f
|
|
revertCode: |-
|
|
reg add "HKCU\Software\Piriform\CCleaner" /v "Monitoring" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\Software\Piriform\CCleaner" /v "HelpImproveCCleaner" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\Software\Piriform\CCleaner" /v "SystemMonitoring" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\Software\Piriform\CCleaner" /v "UpdateAuto" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\Software\Piriform\CCleaner" /v "UpdateCheck" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\Software\Piriform\CCleaner" /v "CheckTrialOffer" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\Software\Piriform\CCleaner" /v "(Cfg)HealthCheck" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\Software\Piriform\CCleaner" /v "(Cfg)QuickClean" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\Software\Piriform\CCleaner" /v "(Cfg)QuickCleanIpm" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\Software\Piriform\CCleaner" /v "(Cfg)GetIpmForTrial" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\Software\Piriform\CCleaner" /v "(Cfg)SoftwareUpdater" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\Software\Piriform\CCleaner" /v "(Cfg)SoftwareUpdaterIpm" /t REG_DWORD /d 1 /f
|
|
-
|
|
category: Security improvements
|
|
children:
|
|
-
|
|
category: Meltdown and Spectre protection
|
|
docs: https://support.microsoft.com/en-us/help/4072698/windows-server-speculative-execution-side-channel-vulnerabilities-prot
|
|
children:
|
|
-
|
|
name: Spectre variant 2 and meltdown (own OS)
|
|
code: |-
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "FeatureSettingsOverrideMask" /t REG_DWORD /d 3 /f
|
|
wmic cpu get name | findstr "Intel" >nul && (
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "FeatureSettingsOverride" /t REG_DWORD /d 0 /f
|
|
)
|
|
wmic cpu get name | findstr "AMD" >nul && (
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "FeatureSettingsOverride" /t REG_DWORD /d 64 /f
|
|
)
|
|
revertCode: |-
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "FeatureSettingsOverrideMask" /t REG_DWORD /d 3 /f
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "FeatureSettingsOverride" /t REG_DWORD /d 3 /f
|
|
-
|
|
name: Spectre variant 2 and meltdown (HyperV)
|
|
code: reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization" /v MinVmVersionForCpuBasedMitigations /t REG_SZ /d "1.0" /f
|
|
revertCode: reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization" /v MinVmVersionForCpuBasedMitigations /f
|
|
-
|
|
name: Disable administrative shares
|
|
recommend: standard
|
|
code: reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "AutoShareWks" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "AutoShareWks" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Force enable data execution prevention (DEP)
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "NoDataExecutionPrevention" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "DisableHHDEP" /t REG_DWORD /d 0 /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "NoDataExecutionPrevention" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "DisableHHDEP" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable AutoPlay and AutoRun
|
|
docs:
|
|
- https://en.wikipedia.org/wiki/AutoRun
|
|
- https://www.stigviewer.com/stig/windows_10/2019-01-04/finding/V-63667
|
|
- https://www.stigviewer.com/stig/windows_10/2019-01-04/finding/V-63671
|
|
- https://www.stigviewer.com/stig/windows_10/2019-01-04/finding/V-63673
|
|
recommend: standard
|
|
code: |-
|
|
:: 255 (0xff) means all drives
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDriveTypeAutoRun" /t REG_DWORD /d 255 /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoAutorun" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "NoAutoplayfornonVolume" /t REG_DWORD /d 1 /f
|
|
revertCode: |-
|
|
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDriveTypeAutoRun" /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoAutorun" /t REG_DWORD /d 2 /f
|
|
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "NoAutoplayfornonVolume" /f
|
|
-
|
|
name: Disable remote Assistance
|
|
recommend: standard
|
|
docs: https://www.stigviewer.com/stig/windows_10/2019-01-04/finding/V-63651
|
|
code: |-
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v "fAllowToGetHelp" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v "fAllowFullControl" /t REG_DWORD /d 0 /f
|
|
revertCode: |-
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v "fAllowToGetHelp" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v "fAllowFullControl" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable lock screen camera
|
|
recommend: standard
|
|
docs: https://www.stigviewer.com/stig/windows_8_8.1/2014-06-27/finding/V-43237
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization" /v "NoLockScreenCamera" /t REG_DWORD /d 1 /f
|
|
revertCode: reg delete "HKLM\Software\Policies\Microsoft\Windows\Personalization" /v NoLockScreenCamera /f
|
|
-
|
|
name: Prevent the storage of the LAN Manager hash of passwords
|
|
recommend: standard
|
|
docs: https://www.stigviewer.com/stig/windows_10/2019-01-04/finding/V-63797
|
|
code: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "NoLMHash" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "NoLMHash" /t REG_DWORD /d 10 /f
|
|
-
|
|
name: Disable Windows Installer Always install with elevated privileges
|
|
recommend: standard
|
|
docs: https://www.stigviewer.com/stig/windows_8/2013-07-03/finding/V-34974
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer" /v "AlwaysInstallElevated" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer" /v "AlwaysInstallElevated" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Prevent WinRM from using Basic Authentication
|
|
recommend: standard
|
|
docs: https://www.stigviewer.com/stig/windows_10/2019-01-04/finding/V-63335
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client" /v "AllowBasic" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client" /v "AllowBasic" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Restrict anonymous enumeration of shares
|
|
recommend: standard
|
|
docs: https://www.stigviewer.com/stig/windows_10/2019-01-04/finding/V-63749
|
|
code: reg add "HKLM\SYSTEM\CurrentControlSet\Control\LSA" /v "RestrictAnonymous" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKLM\SYSTEM\CurrentControlSet\Control\LSA" /v "RestrictAnonymous" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Refuse less secure authentication
|
|
recommend: standard
|
|
docs:
|
|
- https://www.stigviewer.com/stig/windows_10/2019-01-04/finding/V-63801
|
|
- https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level
|
|
code: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "LmCompatibilityLevel" /t REG_DWORD /d 5 /f
|
|
revertCode: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "LmCompatibilityLevel" /t REG_DWORD /d 3 /f
|
|
-
|
|
name: Enable Structured Exception Handling Overwrite Protection (SEHOP)
|
|
recommend: standard
|
|
docs: https://www.stigviewer.com/stig/windows_10/2019-01-04/finding/V-68849
|
|
code: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "DisableExceptionChainValidation" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "DisableExceptionChainValidation" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Block Anonymous enumeration of SAM accounts
|
|
recommend: standard
|
|
docs: https://www.stigviewer.com/stig/windows_10/2019-01-04/finding/V-63745
|
|
code: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "RestrictAnonymousSAM" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "RestrictAnonymousSAM" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Restrict anonymous access to Named Pipes and Shares
|
|
recommend: standard
|
|
docs: https://www.stigviewer.com/stig/windows_10/2019-01-04/finding/V-63759
|
|
code: reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" /v "RestrictNullSessAccess" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" /v "RestrictNullSessAccess" /t REG_DWORD /d 0 /f
|
|
-
|
|
category: Disable unsafe features
|
|
children:
|
|
-
|
|
name: Disable unsafe SMBv1 protocol
|
|
recommend: standard
|
|
docs: https://techcommunity.microsoft.com/t5/storage-at-microsoft/stop-using-smb1/ba-p/425858
|
|
code: |-
|
|
dism /online /Disable-Feature /FeatureName:"SMB1Protocol" /NoRestart
|
|
dism /Online /Disable-Feature /FeatureName:"SMB1Protocol-Client" /NoRestart
|
|
dism /Online /Disable-Feature /FeatureName:"SMB1Protocol-Server" /NoRestart
|
|
revertCode: |-
|
|
dism /online /Enable-Feature /FeatureName:"SMB1Protocol" /NoRestart
|
|
dism /Online /Enable-Feature /FeatureName:"SMB1Protocol-Client" /NoRestart
|
|
dism /Online /Enable-Feature /FeatureName:"SMB1Protocol-Server" /NoRestart
|
|
-
|
|
name: Disable PowerShell 2.0 against downgrade attacks
|
|
recommend: standard
|
|
docs: https://www.stigviewer.com/stig/windows_10/2017-02-21/finding/V-70637
|
|
code: |-
|
|
dism /online /Disable-Feature /FeatureName:"MicrosoftWindowsPowerShellV2Root" /NoRestart
|
|
dism /online /Disable-Feature /FeatureName:"MicrosoftWindowsPowerShellV2" /NoRestart
|
|
revertCode: |-
|
|
dism /online /Enable-Feature /FeatureName:"MicrosoftWindowsPowerShellV2Root" /NoRestart
|
|
dism /online /Enable-Feature /FeatureName:"MicrosoftWindowsPowerShellV2" /NoRestart
|
|
-
|
|
name: Disable the Windows Connect Now wizard
|
|
recommend: standard
|
|
docs:
|
|
- https://docs.microsoft.com/en-us/windows/win32/wcn/about-windows-connect-now
|
|
- https://www.stigviewer.com/stig/windows_server_20122012_r2_domain_controller/2019-01-16/finding/V-15698
|
|
code: |-
|
|
reg add "HKLM\Software\Policies\Microsoft\Windows\WCN\UI" /v "DisableWcnUi" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars" /v "DisableFlashConfigRegistrar" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars" /v "DisableInBand802DOT11Registrar" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars" /v "DisableUPnPRegistrar" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars" /v "DisableWPDRegistrar" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars" /v "EnableRegistrars" /t REG_DWORD /d 0 /f
|
|
revertCode: |-
|
|
reg add "HKLM\Software\Policies\Microsoft\Windows\WCN\UI" /v "DisableWcnUi" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars" /v "DisableFlashConfigRegistrar" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars" /v "DisableInBand802DOT11Registrar" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars" /v "DisableUPnPRegistrar" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars" /v "DisableWPDRegistrar" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars" /v "EnableRegistrars" /t REG_DWORD /d 1 /f
|
|
-
|
|
category: Increase cryptography on ISS
|
|
children:
|
|
-
|
|
name: Increase Diffie-Hellman key (DHK) exchange to 4096-bit
|
|
code: |-
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman" /f /v ServerMinKeyBitLength /t REG_DWORD /d 0x00001000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman" /f /v ClientMinKeyBitLength /t REG_DWORD /d 0x00001000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman" /f /v Enabled /t REG_DWORD /d 0x00000001
|
|
revertCode: |-
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman" /v "ServerMinKeyBitLength" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman" /v "ClientMinKeyBitLength" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman" /v "Enabled" /f
|
|
-
|
|
name: Disable RC2 cipher
|
|
code: |-
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 128/128" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
revertCode: |-
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 128/128" /v "Enabled" /f
|
|
-
|
|
name: Disable RC4 cipher
|
|
code: |-
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
revertCode: |-
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128" /v "Enabled" /f
|
|
-
|
|
name: Disable DES cipher
|
|
code: |-
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
revertCode: |-
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56" /v "Enabled" /f
|
|
-
|
|
name: Disable 3DES (Triple DES) cipher
|
|
code: |-
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168/168" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
revertCode: |-
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168/168" /v "Enabled" /f
|
|
-
|
|
name: Disable MD5 hash function
|
|
code: reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
revertCode: reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5" /v "Enabled" /f
|
|
-
|
|
name: Disable SHA1
|
|
code: reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
revertCode: reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA" /v "Enabled" /f
|
|
-
|
|
name: Disable null cipher
|
|
code: reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
revertCode: reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL" /v "Enabled" /f
|
|
-
|
|
name: Force not to respond to renegotiation requests
|
|
code: |-
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL" /f /v AllowInsecureRenegoClients /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL" /f /v AllowInsecureRenegoServers /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL" /f /v DisableRenegoOnServer /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL" /f /v UseScsvForTls /t REG_DWORD /d 0x00000001
|
|
revertCode: |-
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL" /v "AllowInsecureRenegoClients" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL" /v "AllowInsecureRenegoServers" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL" /v "DisableRenegoOnServer" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL" /v "UseScsvForTls" /f
|
|
-
|
|
name: Disable DTLS 1.0
|
|
code: |-
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.0\Server" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.0\Server" /f /v DisabledByDefault /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.0\Client" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.0\Client" /f /v DisabledByDefault /t REG_DWORD /d 0x00000001
|
|
revertCode: |-
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.0\Server" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.0\Server" /v "DisabledByDefault" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.0\Client" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.0\Client" /v "DisabledByDefault" /f
|
|
-
|
|
name: Disable DTLS 1.1
|
|
code: |-
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.1\Server" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.1\Server" /f /v DisabledByDefault /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.1\Client" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.1\Client" /f /v DisabledByDefault /t REG_DWORD /d 0x00000001
|
|
revertCode: |-
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.1\Server" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.1\Server" /v "DisabledByDefault" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.1\Client" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.1\Client" /v "DisabledByDefault" /f
|
|
-
|
|
name: Enable DTLS 1.3 # Windows 10 and Windows 10 Server version 1903 and newer supports DTLS 1.3
|
|
code: |-
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.3\Server" /f /v Enabled /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.3\Server" /f /v DisabledByDefault /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.3\Client" /f /v Enabled /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.3\Client" /f /v DisabledByDefault /t REG_DWORD /d 0x00000000
|
|
revertCode: |-
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.3\Server" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.3\Server" /v "DisabledByDefault" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.3\Client" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.3\Client" /v "DisabledByDefault" /f
|
|
-
|
|
name: Disable TLS 1.0
|
|
docs: https://docs.microsoft.com/en-us/dotnet/framework/network-programming/tls # After disabling TLS 1.0 must be (will be) activated SchUseStrongCrypto for .NET apps
|
|
code: |-
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /f /v DisabledByDefault /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /f /v DisabledByDefault /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727" /f /v SchUseStrongCrypto /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727" /f /v SystemDefaultTlsVersions /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727" /f /v SchUseStrongCrypto /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727" /f /v SystemDefaultTlsVersions /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\Microsoft\.NETFramework\v3.0" /f /v SchUseStrongCrypto /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\Microsoft\.NETFramework\v3.0" /f /v SystemDefaultTlsVersions /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v3.0" /f /v SchUseStrongCrypto /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v3.0" /f /v SystemDefaultTlsVersions /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" /f /v SchUseStrongCrypto /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" /f /v SystemDefaultTlsVersions /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319" /f /v SchUseStrongCrypto /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319" /f /v SystemDefaultTlsVersions /t REG_DWORD /d 0x00000001
|
|
revertCode: |-
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /v "DisabledByDefault" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /v "DisabledByDefault" /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727" /v "SchUseStrongCrypto" /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727" /v "SystemDefaultTlsVersions" /f
|
|
reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727" /v "SchUseStrongCrypto" /f
|
|
reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727" /v "SystemDefaultTlsVersions" /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\.NETFramework\v3.0" /v "SchUseStrongCrypto" /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\.NETFramework\v3.0" /v "SystemDefaultTlsVersions" /f
|
|
reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v3.0" /v "SchUseStrongCrypto" /f
|
|
reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v3.0" /v "SystemDefaultTlsVersions" /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" /v "SchUseStrongCrypto" /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" /v "SystemDefaultTlsVersions" /f
|
|
reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319" /v "SchUseStrongCrypto" /f
|
|
reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319" /v "SystemDefaultTlsVersions" /f
|
|
-
|
|
name: Disable TLS 1.1
|
|
code: |-
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /f /v DisabledByDefault /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /f /v DisabledByDefault /t REG_DWORD /d 0x00000001
|
|
revertCode: |-
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /v "DisabledByDefault" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /v "DisabledByDefault" /f
|
|
-
|
|
name: Enable TLS 1.3
|
|
code: |-
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server" /f /v Enabled /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server" /f /v DisabledByDefault /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client" /f /v Enabled /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client" /f /v DisabledByDefault /t REG_DWORD /d 0x00000000
|
|
revertCode: |-
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server" /v "DisabledByDefault" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client" /v "DisabledByDefault" /f
|
|
-
|
|
name: Enabling Strong Authentication for .NET applications (TLS 1.2)
|
|
docs: https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/manage-ssl-protocols-in-ad-fs#enabling-strong-authentication-for-net-applications
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727" /f /v SchUseStrongCrypto /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727" /f /v SystemDefaultTlsVersions /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727" /f /v SchUseStrongCrypto /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727" /f /v SystemDefaultTlsVersions /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\Microsoft\.NETFramework\v3.0" /f /v SchUseStrongCrypto /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\Microsoft\.NETFramework\v3.0" /f /v SystemDefaultTlsVersions /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v3.0" /f /v SchUseStrongCrypto /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v3.0" /f /v SystemDefaultTlsVersions /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" /f /v SchUseStrongCrypto /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" /f /v SystemDefaultTlsVersions /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319" /f /v SchUseStrongCrypto /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319" /f /v SystemDefaultTlsVersions /t REG_DWORD /d 0x00000001
|
|
revertCode: |-
|
|
reg delete "HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727" /v "SchUseStrongCrypto" /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727" /v "SystemDefaultTlsVersions" /f
|
|
reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727" /v "SchUseStrongCrypto" /f
|
|
reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727" /v "SystemDefaultTlsVersions" /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\.NETFramework\v3.0" /v "SchUseStrongCrypto" /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\.NETFramework\v3.0" /v "SystemDefaultTlsVersions" /f
|
|
reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v3.0" /v "SchUseStrongCrypto" /f
|
|
reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v3.0" /v "SystemDefaultTlsVersions" /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" /v "SchUseStrongCrypto" /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" /v "SystemDefaultTlsVersions" /f
|
|
reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319" /v "SchUseStrongCrypto" /f
|
|
reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319" /v "SystemDefaultTlsVersions" /f
|
|
-
|
|
name: Disable SSLv2
|
|
code: |-
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" /f /v DisabledByDefault /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client" /f /v DisabledByDefault /t REG_DWORD /d 0x00000001
|
|
revertCode: |-
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" /v "DisabledByDefault" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client" /v "DisabledByDefault" /f
|
|
-
|
|
name: Disable SSLv3
|
|
code: |-
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" /f /v DisabledByDefault /t REG_DWORD /d 0x00000001
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" /f /v Enabled /t REG_DWORD /d 0x00000000
|
|
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" /f /v DisabledByDefault /t REG_DWORD /d 0x00000001
|
|
revertCode: |-
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" /v "DisabledByDefault" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" /v "Enabled" /f
|
|
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client" /v "DisabledByDefault" /f
|
|
-
|
|
category: Privacy over security
|
|
children:
|
|
-
|
|
category: Disable Windows Defender
|
|
children:
|
|
-
|
|
name: Turn off Windows Firewall
|
|
code: netsh advfirewall set allprofiles state off
|
|
revertCode: netsh advfirewall set allprofiles state on
|
|
-
|
|
name: Disable Microsoft Defender Antivirus
|
|
docs: https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
|
|
revertCode: reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /f
|
|
-
|
|
name: Disable the Potentially Unwanted Application (PUA) feature
|
|
docs: https://www.stigviewer.com/stig/ms_windows_defender_antivirus/2018-03-29/finding/V-75147
|
|
code: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
|
|
revertCode: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "1" /f
|
|
-
|
|
category: Disable Real-Time Protection
|
|
children:
|
|
-
|
|
name: Disable behavior monitoring
|
|
docs: https://www.stigviewer.com/stig/windows_defender_antivirus/2017-12-27/finding/V-75229
|
|
code: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
|
|
revertCode: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "0" /f
|
|
-
|
|
name: Disable scanning for all downloaded files and attachments
|
|
docs: https://www.stigviewer.com/stig/ms_windows_defender_antivirus/2018-03-29/finding/V-75225
|
|
code: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
|
|
revertCode: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "0" /f
|
|
-
|
|
name: Disable monitoring file and program activity
|
|
docs: https://www.stigviewer.com/stig/ms_windows_defender_antivirus/2018-03-29/finding/V-75223
|
|
code: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
|
|
revertCode: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "0" /f
|
|
-
|
|
name: Disable automatically taking action on all detected tasks
|
|
docs:
|
|
code: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "1" /f
|
|
revertCode: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "0" /f
|
|
-
|
|
name: Disable process scanning on real-time protection
|
|
docs: https://www.stigviewer.com/stig/ms_windows_defender_antivirus/2018-03-29/finding/V-75231
|
|
code: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
|
|
revertCode: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "0" /f
|
|
-
|
|
name: Turn off enhanced notifications
|
|
docs: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter#windowsdefendersecuritycenter-disableenhancednotifications
|
|
code: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
|
|
revertCode: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "0" /f
|
|
-
|
|
name: Disable Windows Defender logging
|
|
code: |-
|
|
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
|
|
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
|
|
revertCode: |-
|
|
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "1" /f
|
|
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "1" /f
|
|
-
|
|
name: Turn off block at first sight
|
|
docs: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus
|
|
code: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
|
|
revertCode: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "0" /f
|
|
-
|
|
category: Disable Windows Defender tasks
|
|
children:
|
|
-
|
|
name: Disable Windows Defender ExploitGuard task
|
|
code: schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
|
|
revertCode: schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Enable
|
|
-
|
|
name: Disable Windows Defender Cache Maintenance task
|
|
code: schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
|
|
revertCode: schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Enable
|
|
-
|
|
name: Disable Windows Defender Cleanup task
|
|
code: schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
|
|
revertCode: schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Enable
|
|
-
|
|
name: Disable Windows Defender Scheduled Scan task
|
|
code: schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
|
|
revertCode: schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Enable
|
|
-
|
|
name: Disable Windows Defender Verification task
|
|
code: schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
|
|
revertCode: schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Enable
|
|
-
|
|
category: Disable Windows Defender services
|
|
children:
|
|
-
|
|
name: Disable Windows Defender Firewall service
|
|
code: reg add "HKLM\SYSTEM\CurrentControlSet\Services\MpsSvc" /v "Start" /t REG_DWORD /d "4" /f
|
|
revertCode: reg add "HKLM\SYSTEM\CurrentControlSet\Services\MpsSvc" /v "Start" /t REG_DWORD /d "2" /f
|
|
-
|
|
name: Disable Windows Defender Antivirus service
|
|
code: reg add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
|
|
revertCode: reg add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "2" /f
|
|
-
|
|
name: Disable Microsoft Defender Antivirus Boot Driver service
|
|
code: reg add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
|
|
revertCode: reg add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "2" /f
|
|
-
|
|
name: Disable Microsoft Defender Antivirus Mini-Filter Driver service
|
|
code: reg add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
|
|
revertCode: reg add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "2" /f
|
|
-
|
|
name: Disable Microsoft Defender Antivirus Network Inspection System Driver service
|
|
code: reg add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
|
|
revertCode: reg add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "2" /f
|
|
-
|
|
name: Disable Microsoft Defender Antivirus Network Inspection service
|
|
code: reg add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
|
|
revertCode: reg add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "2" /f
|
|
-
|
|
name: Disable Windows Security service
|
|
code: reg add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
|
|
revertCode: reg add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "2" /f
|
|
-
|
|
name: Disable Smart Screen
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t REG_SZ /d "Off" /f
|
|
reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t REG_SZ /d "Off" /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t REG_DWORD /d 0 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t REG_DWORD /d 0 /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t REG_SZ /d "Warn" /f
|
|
reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t REG_SZ /d "Warn" /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t REG_DWORD /d 1 /f
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Disable scheduled On Demand anti malware scanner (MRT)
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Disable automatic updates
|
|
docs: https://docs.microsoft.com/fr-fr/security-updates/windowsupdateservices/18127152
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t "REG_DWORD" /d "0" /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "AUOptions" /t "REG_DWORD" /d "2" /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "ScheduledInstallDay" /t "REG_DWORD" /d "0" /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "ScheduledInstallTime" /t "REG_DWORD" /d "3" /f
|
|
sc stop "UsoSvc" & sc config "UsoSvc" start=disabled
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t "REG_DWORD" /d "1" /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "AUOptions" /t "REG_DWORD" /d "3" /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "ScheduledInstallDay" /t "REG_DWORD" /d "0" /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "ScheduledInstallTime" /t "REG_DWORD" /d "0" /f
|
|
sc config "UsoSvc" start=auto & sc start "UsoSvc"
|
|
-
|
|
category: UI for privacy
|
|
children:
|
|
-
|
|
name: Disable lock screen app notifications
|
|
recommend: standard
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "DisableLockScreenAppNotifications" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "DisableLockScreenAppNotifications" /t REG_DWORD /d 0 /f
|
|
docs: https://www.stigviewer.com/stig/windows_server_2012_member_server/2014-01-07/finding/V-36687
|
|
-
|
|
category: Disable online content in explorer
|
|
children:
|
|
-
|
|
name: Disable online tips
|
|
recommend: standard
|
|
docs: https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.ControlPanel::AllowOnlineTips
|
|
code: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "AllowOnlineTips" /t REG_DWORD /d 0 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "AllowOnlineTips" /t REG_DWORD /d 1 /f
|
|
-
|
|
name: Turn off Internet File Association service
|
|
recommend: standard
|
|
docs: https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetCommunicationManagement::ShellNoUseInternetOpenWith_2
|
|
code: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoInternetOpenWith" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoInternetOpenWith" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Turn off the "Order Prints" picture task
|
|
recommend: standard
|
|
docs:
|
|
- https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetCommunicationManagement::ShellRemoveOrderPrints_2
|
|
- https://www.stigviewer.com/stig/microsoft_windows_server_2012_member_server/2013-07-25/finding/WN12-CC-000042
|
|
code: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoOnlinePrintsWizard" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoOnlinePrintsWizard" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Disable the file and folder Publish to Web option
|
|
recommend: standard
|
|
docs: https://www.stigviewer.com/stig/windows_server_2012_member_server/2014-01-07/finding/V-14255
|
|
code: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoPublishingWizard" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoPublishingWizard" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Prevent downloading a list of providers for wizards
|
|
recommend: standard
|
|
docs: https://www.stigviewer.com/stig/windows_10/2017-12-01/finding/V-63621
|
|
code: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWebServices" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWebServices" /t REG_DWORD /d 0 /f
|
|
-
|
|
category: Recent documents
|
|
children:
|
|
-
|
|
name: Do not keep history of recently opened documents
|
|
recommend: strict
|
|
docs: https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.StartMenu::NoRecentDocsHistory
|
|
code: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRecentDocsHistory" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRecentDocsHistory" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Clear history of recently opened documents on exit
|
|
recommend: strict
|
|
docs: https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.StartMenu::ClearRecentDocsOnExit
|
|
code: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "ClearRecentDocsOnExit" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "ClearRecentDocsOnExit" /t REG_DWORD /d 01 /f
|
|
-
|
|
name: Disable Live Tiles push notifications
|
|
recommend: standard
|
|
docs: https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.Notifications::NoTileNotification
|
|
code: reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" /v "NoTileApplicationNotification" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" /v "NoTileApplicationNotification" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Turn off "Look For An App In The Store" option
|
|
recommend: standard
|
|
docs:
|
|
- https://www.stigviewer.com/stig/microsoft_windows_server_2012_member_server/2013-07-25/finding/WN12-CC-000030
|
|
- https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetCommunicationManagement::ShellNoUseStoreOpenWith_1
|
|
code: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "NoUseStoreOpenWith" /t REG_DWORD /d 1 /f
|
|
revertCode: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "NoUseStoreOpenWith" /t REG_DWORD /d 0 /f
|
|
-
|
|
name: Do not show recently used files in Quick Access
|
|
recommend: strict
|
|
docs: https://www.tenforums.com/tutorials/2713-add-remove-recent-files-quick-access-windows-10-a.html
|
|
code: |-
|
|
if %PROCESSOR_ARCHITECTURE%==x86 ( REM is 32 bit?
|
|
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "ShowRecent" /d 0 /t REG_DWORD /f
|
|
) else (
|
|
reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\HomeFolderDesktop\NameSpace\DelegateFolders\{3134ef9c-6b18-4996-ad04-ed5912e00eb5}" /f
|
|
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HomeFolderDesktop\NameSpace\DelegateFolders\{3134ef9c-6b18-4996-ad04-ed5912e00eb5}" /f
|
|
)
|
|
revertCode:
|
|
if %PROCESSOR_ARCHITECTURE%==x86 ( REM is 32 bit?
|
|
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "ShowRecent" /d 1 /t REG_DWORD /f
|
|
) else (
|
|
reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\HomeFolderDesktop\NameSpace\DelegateFolders\{3134ef9c-6b18-4996-ad04-ed5912e00eb5}" /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HomeFolderDesktop\NameSpace\DelegateFolders\{3134ef9c-6b18-4996-ad04-ed5912e00eb5}" /f
|
|
)
|
|
-
|
|
name: Disable Sync Provider Notifications
|
|
code: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSyncProviderNotifications" /d 0 /t REG_DWORD /f
|
|
revertCode: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSyncProviderNotifications" /d 1 /t REG_DWORD /f
|
|
-
|
|
name: Turn hibernate off to disable sleep for quick start
|
|
docs: http://www.windows10windows7.com/w10/win10zs/100102504.html
|
|
code: powercfg -h off
|
|
revertCode: powercfg -h on
|
|
-
|
|
name: Enable camera on/off OSD notifications
|
|
docs: https://www.tenforums.com/tutorials/166065-how-enable-disable-camera-off-osd-notifications-windows-10-a.html
|
|
code: reg add "HKLM\SOFTWARE\Microsoft\OEM\Device\Capture" /v "NoPhysicalCameraLED" /d 1 /t REG_DWORD /f
|
|
revertCode: reg delete "HKLM\Software\Microsoft\OEM\Device\Capture" /v "NoPhysicalCameraLED" /f
|
|
-
|
|
category: Hide from This PC and Browse in dialog boxes
|
|
children:
|
|
-
|
|
name: 3D Objects
|
|
code: |-
|
|
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Hide" /f
|
|
reg add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Hide" /f
|
|
revertCode: |-
|
|
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Show" /f
|
|
reg add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Show" /f
|
|
-
|
|
name: Desktop
|
|
code: |-
|
|
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Hide" /f
|
|
reg add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Hide" /f
|
|
revertCode: |-
|
|
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Show" /f
|
|
reg add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Show" /f
|
|
-
|
|
name: Documents
|
|
code: |-
|
|
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Hide" /f
|
|
reg add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Hide" /f
|
|
revertCode: |-
|
|
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Show" /f
|
|
reg add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Show" /f
|
|
-
|
|
name: Downloads
|
|
code: |-
|
|
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Hide" /f
|
|
reg add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Hide" /f
|
|
revertCode: |-
|
|
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Show" /f
|
|
reg add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Show" /f
|
|
-
|
|
name: Movies
|
|
code: |-
|
|
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Hide" /f
|
|
reg add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Hide" /f
|
|
revertCode: |-
|
|
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Show" /f
|
|
reg add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Show" /f
|
|
-
|
|
name: Music
|
|
code: |-
|
|
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Hide" /f
|
|
reg add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Hide" /f
|
|
revertCode: |-
|
|
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Show" /f
|
|
reg add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Show" /f
|
|
-
|
|
name: Pictures
|
|
code: |-
|
|
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Hide" /f
|
|
reg add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Hide" /f
|
|
revertCode: |-
|
|
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Show" /f
|
|
reg add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\PropertyBag" /v "ThisPCPolicy" /t REG_SZ /d "Show" /f
|
|
-
|
|
category: Disable OS services
|
|
children:
|
|
-
|
|
name: Delivery Optimization (P2P Windows Updates)
|
|
recommend: standard
|
|
code: sc stop "DoSvc" & sc config "DoSvc" start=disabled
|
|
revertCode: sc config "DoSvc" start=auto & sc start "DoSvc"
|
|
-
|
|
name: Microsoft Windows Live ID Service
|
|
recommend: standard
|
|
code: sc stop "wlidsvc" & sc config "wlidsvc" start=demand
|
|
revertCode: sc config "wlidsvc" start=demand
|
|
-
|
|
name: Program Compatibility Assistant Service
|
|
recommend: standard
|
|
code: sc stop "PcaSvc" & sc config "PcaSvc" start=disabled
|
|
revertCode: sc config "PcaSvc" start=demand
|
|
-
|
|
name: Downloaded Maps Manager
|
|
recommend: standard
|
|
code: sc stop "MapsBroker" & sc config "MapsBroker" start=disabled
|
|
revertCode: sc config "MapsBroker" start=auto & sc start "MapsBroker"
|
|
-
|
|
name: Microsoft Retail Demo experience
|
|
recommend: standard
|
|
code: sc stop "RetailDemo" & sc config "RetailDemo" start=disabled
|
|
revertCode: sc config "RetailDemo" start=demand
|
|
-
|
|
category: Mail, contact, calendar and user data synchronization
|
|
children:
|
|
-
|
|
name: User Data Storage (UnistoreSvc) Service
|
|
recommend: strict
|
|
code: sc stop "UnistoreSvc" & sc config "UnistoreSvc" start=disabled
|
|
revertCode: sc config "UnistoreSvc" start=demand
|
|
-
|
|
name: Sync Host (OneSyncSvc) Service Service
|
|
recommend: strict
|
|
code: sc stop "OneSyncSvc" & sc config "OneSyncSvc" start=disabled
|
|
revertCode: sc config "OneSyncSvc" start=auto & sc start "OneSyncSvc"
|
|
-
|
|
name: Contact data indexing
|
|
code: sc stop "PimIndexMaintenanceSvc" & sc config "PimIndexMaintenanceSvc" start=disabled
|
|
revertCode: sc config "PimIndexMaintenanceSvc" start=demand
|
|
-
|
|
name: App user data access
|
|
code: sc stop "UserDataSvc" & sc config "UserDataSvc" start=disabled
|
|
revertCode: sc config "UserDataSvc" start=demand
|
|
-
|
|
name: Text messaging
|
|
code: sc stop "MessagingService" & sc config "MessagingService" start=disabled
|
|
revertCode: sc config "MessagingService" start=demand
|
|
-
|
|
name: Windows Push Notification Service
|
|
recommend: standard
|
|
docs: https://en.wikipedia.org/wiki/Windows_Push_Notification_Service#Privacy_Issue
|
|
code: sc stop "WpnService" & sc config "WpnService" start=disabled
|
|
revertCode: sc config "WpnService" start=auto & sc start "WpnService"
|
|
-
|
|
category: Disable Xbox services
|
|
children:
|
|
-
|
|
name: Xbox Live Auth Manager
|
|
recommend: standard
|
|
code: sc stop "XblAuthManager" & sc config "XblAuthManager" start=disabled
|
|
revertCode: sc config "XblAuthManager" start=demand
|
|
-
|
|
name: Xbox Live Game Save
|
|
recommend: standard
|
|
code: sc stop "XblGameSave" & sc config "XblGameSave" start=disabled
|
|
revertCode: sc config "XblGameSave" start=demand
|
|
-
|
|
name: Xbox Live Networking Service
|
|
recommend: standard
|
|
code: sc stop "XboxNetApiSvc" & sc config "XboxNetApiSvc" start=disabled
|
|
revertCode: sc config "XboxNetApiSvc" start=demand
|
|
-
|
|
name: Disable Volume Shadow Copy Service (breaks System Restore and Windows Backup) # Also known as • Volume Snapshot Service • VSS • VSC
|
|
recommend: strict
|
|
docs:
|
|
- https://docs.microsoft.com/en-us/windows-server/storage/file-server/volume-shadow-copy-service
|
|
- https://www.schneier.com/blog/archives/2009/12/the_security_im.html
|
|
code: sc stop "VSS" & sc config "VSS" start=disabled
|
|
revertCode: sc config "VSS" start=demand
|
|
-
|
|
name: Disable NetBios for all interfaces
|
|
docs: https://10dsecurity.com/saying-goodbye-netbios/
|
|
call:
|
|
function: RunPowerShell
|
|
parameters:
|
|
code:
|
|
$key = 'HKLM:SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces';
|
|
Get-ChildItem $key | foreach {
|
|
Set-ItemProperty -Path \"$key\$($_.pschildname)\" -Name NetbiosOptions -Value 2 -Verbose
|
|
}
|
|
revertCode:
|
|
$key = 'HKLM:SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces';
|
|
Get-ChildItem $key | foreach {
|
|
Set-ItemProperty -Path \"$key\$($_.pschildname)\" -Name NetbiosOptions -Value 0 -Verbose
|
|
}
|
|
-
|
|
category: Remove bloatware
|
|
children:
|
|
-
|
|
category: Uninstall Windows store apps
|
|
docs: https://docs.microsoft.com/en-us/windows/application-management/apps-in-windows-10
|
|
children:
|
|
-
|
|
category: Uninstall provisioned Windows apps
|
|
docs: https://docs.microsoft.com/en-us/windows/application-management/apps-in-windows-10#provisioned-windows-apps
|
|
children:
|
|
-
|
|
name: App Connector app
|
|
recommend: strict
|
|
docs: https://superuser.com/a/1003226
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.Appconnector # Discontinued after Windows 10 1511
|
|
-
|
|
category: Uninstall 3D modeling apps
|
|
children:
|
|
-
|
|
name: Microsoft 3D Builder app
|
|
docs: https://www.microsoft.com/en-us/p/3d-builder/9wzdncrfj3t6
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.3DBuilder
|
|
-
|
|
name: 3D Viewer app
|
|
docs: https://www.microsoft.com/en-us/p/3d-viewer/9nblggh42ths
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.Microsoft3DViewer
|
|
-
|
|
category: Uninstall MSN (Bing) apps
|
|
children:
|
|
-
|
|
name: MSN Weather app
|
|
docs: https://www.microsoft.com/en-us/p/msn-weather/9wzdncrfj3q2
|
|
recommend: standard
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.BingWeather
|
|
-
|
|
name: MSN Sports app
|
|
recommend: standard
|
|
docs: https://www.microsoft.com/en-us/p/msn-sports/9wzdncrfhvh4
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.BingSports
|
|
-
|
|
name: MSN News app
|
|
recommend: standard
|
|
docs: https://www.microsoft.com/en-us/p/microsoft-news/9wzdncrfhvfw
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.BingNews
|
|
-
|
|
name: MSN Money app
|
|
recommend: standard
|
|
docs: https://www.microsoft.com/en-us/p/msn-money/9wzdncrfhv4v
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.BingFinance
|
|
-
|
|
name: Uninstall Cortana app
|
|
recommend: standard
|
|
docs: https://www.microsoft.com/en-us/p/msn-money/9wzdncrfhv4v
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.549981C3F5F10
|
|
-
|
|
name: App Installer app
|
|
docs: https://www.microsoft.com/en-us/p/app-installer/9nblggh4nns1
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.DesktopAppInstaller
|
|
-
|
|
name: Get Help app
|
|
docs: https://www.microsoft.com/en-us/p/get-help/9nblgggzhtbj
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.GetHelp
|
|
-
|
|
name: Microsoft Tips app
|
|
docs: https://www.microsoft.com/en-us/p/microsoft-tips/9wzdncrdtbjj
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.Getstarted
|
|
-
|
|
category: Extensions
|
|
children:
|
|
-
|
|
name: HEIF Image Extensions app
|
|
docs: https://www.microsoft.com/en-us/p/heif-image-extensions/9pmmsr1cgpwg
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.HEIFImageExtension
|
|
-
|
|
name: VP9 Video Extensions app
|
|
docs: https://www.microsoft.com/en-us/p/vp9-video-extensions/9n4d0msmp0pt
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.VP9VideoExtensions
|
|
-
|
|
name: Web Media Extensions app
|
|
docs: https://www.microsoft.com/en-us/p/web-media-extensions/9n5tdp8vcmhs
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.WebMediaExtensions
|
|
-
|
|
name: Webp Image Extensions app
|
|
docs: https://www.microsoft.com/en-us/p/webp-image-extensions/9pg2dk419drg
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.WebpImageExtension
|
|
-
|
|
name: Microsoft Messaging app
|
|
docs: https://www.microsoft.com/en-us/p/microsoft-messaging/9wzdncrfjbq6
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.Messaging
|
|
-
|
|
name: Mixed Reality Portal app
|
|
docs: https://www.microsoft.com/en-us/p/mixed-reality-portal/9ng1h8b3zc7m
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.MixedReality.Portal
|
|
-
|
|
category: Uninstall Microsoft Office apps
|
|
children:
|
|
-
|
|
name: My Office app
|
|
recommend: standard
|
|
docs: https://www.microsoft.com/en-us/p/my-office-app/9n8vd0f315mh
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.MicrosoftOfficeHub
|
|
-
|
|
name: OneNote app
|
|
docs: https://www.microsoft.com/en-us/p/onenote-for-windows-10/9wzdncrfhvjl
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.Office.OneNote
|
|
-
|
|
name: Sway app
|
|
docs: https://www.microsoft.com/en-us/p/sway/9wzdncrd2g0j
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.Office.Sway
|
|
-
|
|
name: Feedback Hub app
|
|
recommend: standard
|
|
docs: https://www.microsoft.com/en-us/p/feedback-hub/9nblggh4r32n
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.WindowsFeedbackHub
|
|
-
|
|
name: Windows Alarms and Clock app
|
|
docs: https://www.microsoft.com/en-us/p/windows-alarms-clock/9wzdncrfj3pr
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.WindowsAlarms
|
|
-
|
|
name: Windows Camera app
|
|
docs: https://www.microsoft.com/en-us/p/windows-camera/9wzdncrfjbbg
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.WindowsCamera
|
|
-
|
|
name: Paint 3D app
|
|
docs: https://www.microsoft.com/en-us/p/paint-3d/9nblggh5fv99
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.MSPaint
|
|
-
|
|
name: Windows Maps app
|
|
recommend: standard
|
|
docs: https://www.microsoft.com/en-us/p/windows-maps/9wzdncrdtbvb
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.WindowsMaps
|
|
-
|
|
name: Minecraft for Windows 10 app
|
|
docs: https://www.microsoft.com/en-us/p/minecraft-for-windows-10/9nblggh2jhxj
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.MinecraftUWP
|
|
-
|
|
name: Microsoft Store app
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.WindowsStore
|
|
-
|
|
name: Microsoft People app
|
|
docs: https://www.microsoft.com/en-us/p/microsoft-people/9nblggh10pg8
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.People
|
|
-
|
|
name: Microsoft Pay app
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.Wallet
|
|
-
|
|
name: Store Purchase app
|
|
docs: https://social.technet.microsoft.com/Forums/exchange/en-US/24b1088d-0fc5-4a82-8015-c9c964532603/store-purchase-app?forum=win10itproapps
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.StorePurchaseApp
|
|
-
|
|
name: Snip & Sketch app
|
|
docs: https://www.microsoft.com/en-us/p/snip-sketch/9mz95kl8mr0l
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.ScreenSketch
|
|
-
|
|
name: Print 3D app
|
|
docs: https://www.microsoft.com/en-us/p/print-3d/9pbpch085s3s
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.Print3D
|
|
-
|
|
name: Mobile Plans app
|
|
docs: https://www.microsoft.com/en-us/p/mobile-plans/9nblggh5pnb1
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.OneConnect
|
|
-
|
|
name: Microsoft Solitaire Collection app
|
|
docs: https://www.microsoft.com/en-us/p/microsoft-solitaire-collection/9wzdncrfhwd2
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.MicrosoftSolitaireCollection
|
|
-
|
|
name: Microsoft Sticky Notes app
|
|
docs: https://www.microsoft.com/en-us/p/microsoft-sticky-notes/9nblggh4qghw
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.MicrosoftStickyNotes
|
|
-
|
|
category: Xbox
|
|
children:
|
|
-
|
|
name: Xbox Console Companion app
|
|
docs: https://www.microsoft.com/en-us/p/xbox-console-companion/9wzdncrfjbd8
|
|
recommend: standard
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.XboxApp
|
|
-
|
|
name: Xbox Live in-game experience app
|
|
recommend: standard
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.Xbox.TCUI
|
|
-
|
|
name: Xbox Game Bar app
|
|
docs: https://www.microsoft.com/en-us/p/xbox-game-bar/9nzkpstsnw4p
|
|
recommend: standard
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.XboxGamingOverlay
|
|
-
|
|
name: Xbox Game Bar Plugin appcache
|
|
docs: https://www.microsoft.com/en-us/p/xbox-game-bar/9nzkpstsnw4p
|
|
recommend: standard
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.XboxGameOverlay
|
|
-
|
|
name: Xbox Identity Provider app
|
|
recommend: standard
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.XboxIdentityProvider
|
|
-
|
|
name: Xbox Speech To Text Overlay app
|
|
recommend: standard
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.XboxSpeechToTextOverlay
|
|
-
|
|
name: Mail and Calendar app
|
|
docs: https://www.microsoft.com/en-us/p/mail-and-calendar/9wzdncrfhvqm
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: microsoft.windowscommunicationsapps
|
|
-
|
|
category: Zune
|
|
children:
|
|
-
|
|
name: Groove Music app
|
|
docs: https://www.microsoft.com/en-us/p/groove-music/9wzdncrfj3pt
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.ZuneMusic
|
|
-
|
|
name: Movies and TV app
|
|
docs: https://www.microsoft.com/en-us/p/movies-tv/9wzdncrfj3p2
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.ZuneVideo
|
|
-
|
|
name: Windows Calculator app
|
|
docs: https://www.microsoft.com/en-us/p/windows-calculator/9wzdncrfhvn5
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.WindowsCalculator
|
|
-
|
|
name: Microsoft Photos app
|
|
docs: https://www.microsoft.com/en-us/p/microsoft-photos/9wzdncrfjbh4
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.Windows.Photos
|
|
-
|
|
name: Skype app
|
|
docs: https://www.microsoft.com/en-us/p/skype/9wzdncrfj364
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.SkypeApp
|
|
-
|
|
name: GroupMe app
|
|
docs: https://www.microsoft.com/en-us/p/groupme/9nblggh5z4f2
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.GroupMe10
|
|
-
|
|
name: Windows Voice Recorder app
|
|
docs: https://www.microsoft.com/en-us/p/windows-voice-recorder/9wzdncrfhwkn
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.WindowsSoundRecorder
|
|
-
|
|
category: Phone
|
|
children:
|
|
-
|
|
name: Your Phone Companion app # Depreciated in newer Windows 10
|
|
call:
|
|
-
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.WindowsPhone
|
|
-
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.Windows.Phone
|
|
-
|
|
name: Communications - Phone app # Depreciated in newer Windows 10
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.CommsPhone
|
|
-
|
|
name: Your Phone app
|
|
docs: https://www.microsoft.com/en-us/p/your-phone/9nmpj99vjbwv
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.YourPhone
|
|
-
|
|
category: Uninstall installed Windows apps
|
|
docs: https://docs.microsoft.com/en-us/windows/application-management/apps-in-windows-10#installed-windows-apps
|
|
children:
|
|
-
|
|
name: Microsoft Advertising app
|
|
recommend: standard
|
|
docs:
|
|
- https://docs.microsoft.com/en-us/windows/uwp/monetize/install-the-microsoft-advertising-libraries
|
|
- https://social.msdn.microsoft.com/Forums/windowsapps/en-US/db8d44cb-1381-47f7-94d3-c6ded3fea36f/microsoft-ad-monetization-platform-shut-down-as-of-june-1st?forum=aiamgr
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.Advertising.Xaml
|
|
-
|
|
name: Remote Desktop app
|
|
docs: https://www.microsoft.com/en-us/p/microsoft-remote-desktop/9wzdncrfj3ps?activetab=pivot:overviewtab
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.RemoteDesktop
|
|
-
|
|
name: Network Speed Test app
|
|
recommend: standard
|
|
docs: https://www.microsoft.com/en-us/p/network-speed-test/9wzdncrfhx52
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.NetworkSpeedTest
|
|
-
|
|
name: Microsoft To Do app
|
|
docs: https://www.microsoft.com/en-us/p/microsoft-to-do-lists-tasks-reminders/9nblggh5r558
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.Todos
|
|
-
|
|
category: Third party
|
|
children:
|
|
-
|
|
name: Shazam app # Discontinued https://www.windowscentral.com/shazam-pulls-plug-windows-apps
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: ShazamEntertainmentLtd.Shazam
|
|
-
|
|
name: Candy Crush Saga app
|
|
docs: https://www.microsoft.com/en-us/p/candy-crush-saga/9nblggh18846
|
|
call:
|
|
-
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: king.com.CandyCrushSaga
|
|
-
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: king.com.CandyCrushSodaSaga
|
|
-
|
|
name: Flipboard app
|
|
docs: https://www.microsoft.com/en-us/p/flipboard/9wzdncrfj32q
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Flipboard.Flipboard
|
|
-
|
|
name: Twitter app
|
|
docs: https://www.microsoft.com/en-us/p/twitter/9wzdncrfj140
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: 9E2F88E3.Twitter
|
|
-
|
|
name: iHeartRadio app
|
|
docs: https://www.microsoft.com/en-us/p/iheartradio/9wzdncrfj223
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: ClearChannelRadioDigital.iHeartRadio
|
|
-
|
|
name: Duolingo app
|
|
docs: https://www.microsoft.com/en-us/p/duolingo-learn-languages-for-free/9wzdncrcv5xn
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: D5EA27B7.Duolingo-LearnLanguagesforFree
|
|
-
|
|
name: Photoshop Express app
|
|
docs: https://www.microsoft.com/en-us/p/adobe-photoshop-express-image-editor-adjustments-filters-effects-borders/9wzdncrfj27n
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: AdobeSystemIncorporated.AdobePhotoshop
|
|
-
|
|
name: Pandora app
|
|
docs: https://www.microsoft.com/en-us/p/pandora/9wzdncrfj46v
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: PandoraMediaInc.29680B314EFC2
|
|
-
|
|
name: Eclipse Manager app
|
|
docs: https://www.microsoft.com/en-us/p/eclipse-manager/9wzdncrdjmh1
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: 46928bounde.EclipseManager
|
|
-
|
|
name: Code Writer app
|
|
docs: https://www.microsoft.com/en-us/p/code-writer/9wzdncrfhzdt
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: ActiproSoftwareLLC.562882FEEB491
|
|
-
|
|
name: Spotify app
|
|
docs: https://www.microsoft.com/en-us/p/spotify-music/9ncbcszsjrsb
|
|
call:
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: SpotifyAB.SpotifyMusic
|
|
-
|
|
category: Uninstall system apps
|
|
docs:
|
|
- https://docs.microsoft.com/en-us/windows/application-management/apps-in-windows-10#system-apps
|
|
- https://github.com/Sycnex/Windows10Debloater/blob/02963b6844cf7d13ed3fa64d75128f4e312689ca/Windows10Debloater.ps1#L43
|
|
children:
|
|
-
|
|
name: File Picker app
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: 1527c705-839a-4832-9118-54d4Bd6a0c89
|
|
-
|
|
name: File Explorer app
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: c5e2524a-ea46-4f67-841f-6a9465d9d515
|
|
-
|
|
name: App Resolver UX app
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: E2A4F912-2574-4A75-9BB0-0D023378592B
|
|
-
|
|
name: Add Suggested Folders To Library app
|
|
call:
|
|
-
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE
|
|
-
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: InputApp
|
|
-
|
|
name: Microsoft AAD Broker Plugin app (breaks Office app authentication)
|
|
recommend: strict
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.AAD.BrokerPlugin # Offical docs point to wrong "Microsoft.AAD.Broker.Plugin"
|
|
-
|
|
name: Microsoft Accounts Control app
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.AccountsControl
|
|
-
|
|
name: Microsoft Async Text Service app
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.AsyncTextService
|
|
-
|
|
category: Windows Hello setup UI
|
|
children:
|
|
-
|
|
name: Bio enrollment app (breaks biometric authentication)
|
|
docs: https://answers.microsoft.com/en-us/insider/forum/insider_wintp-insider_store-insiderplat_pc/what-is-bio-enrollment-app/53808b5a-8694-4128-a5bd-34e3b954434a
|
|
recommend: strict
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.BioEnrollment
|
|
-
|
|
name: Cred Dialog Host app
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.CredDialogHost
|
|
-
|
|
name: EC app
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.ECApp
|
|
-
|
|
name: Lock app (shows lock screen)
|
|
docs: https://www.dashtech.org/can-you-disable-lockapp-exe-on-windows-10/
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.LockApp
|
|
-
|
|
category: Microsoft Edge
|
|
children:
|
|
-
|
|
name: Microsoft Edge (Legacy) app
|
|
recommend: strict
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.MicrosoftEdge
|
|
-
|
|
name: Microsoft Edge (Legacy) Dev Tools Client app
|
|
docs: https://docs.microsoft.com/en-us/microsoft-edge/devtools-guide
|
|
recommend: strict
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.MicrosoftEdgeDevToolsClient
|
|
-
|
|
name: Win32 Web View Host app / Desktop App Web Viewer
|
|
recommend: strict
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.Win32WebViewHost
|
|
-
|
|
name: Microsoft PPI Projection app
|
|
docs: https://en.wikipedia.org/wiki/Perceptive_Pixel
|
|
recommend: strict
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.PPIProjection
|
|
-
|
|
name: ChxApp app
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.Windows.Apprep.ChxApp
|
|
-
|
|
name: Assigned Access Lock App app
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.Windows.AssignedAccessLockApp
|
|
-
|
|
name: Capture Picker app
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.Windows.CapturePicker
|
|
-
|
|
name: Cloud Experience Host app (breaks Microsoft cloud/corporate sign in) # Allows to connect to corporate domains or Microsoft cloud based services
|
|
recommend: strict
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.Windows.CloudExperienceHost
|
|
-
|
|
name: Content Delivery Manager app (automatically installs apps)
|
|
docs: https://www.ghacks.net/2019/12/23/how-to-block-the-automatic-installation-of-suggested-windows-10-apps/
|
|
recommend: strict
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.Windows.ContentDeliveryManager
|
|
-
|
|
category: Uninstall Cortana system apps
|
|
children:
|
|
-
|
|
name: Search app (breaks Windows search)
|
|
docs: https://thegeekpage.com/searchui-exe-suspended-error/
|
|
call:
|
|
-
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.Windows.Cortana # Removed since version 2004
|
|
-
|
|
function: UninstallStoreApp
|
|
parameters:
|
|
packageName: Microsoft.Windows.Search # Added in version 2004, it was called "Cortana" before now it's plain "Search"
|
|
-
|
|
name: Holographic First Run app
|
|
recommend: standard
|
|
docs: https://www.addictivetips.com/windows-tips/check-pc-windows-holographic-app-requirements/
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.Windows.Holographic.FirstRun
|
|
-
|
|
name: OOBE Network Captive Port app
|
|
docs: https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/oobe-screen-details#connect-users-to-the-network
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.Windows.OOBENetworkCaptivePortal # Offical docs point to wrong "Microsoft.Windows.OOBENetworkCaptivePort"
|
|
-
|
|
name: OOBE Network Connection Flow app
|
|
docs:
|
|
- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/oobe-screen-details
|
|
- https://www.windowscentral.com/windows-10-build-15019-pc-everything-you-need-know
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.Windows.OOBENetworkConnectionFlow
|
|
-
|
|
name: Windows 10 Family Safety / Parental Controls app
|
|
recommend: standard
|
|
docs: https://account.microsoft.com/family/about
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.Windows.ParentalControls
|
|
-
|
|
category: People Hub
|
|
children:
|
|
-
|
|
name: My People / People Bar App on taskbar (People Experience Host)
|
|
docs: https://winaero.com/pin-contacts-taskbar-windows-10/
|
|
recommend: strict
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.Windows.PeopleExperienceHost
|
|
-
|
|
name: Pinning Confirmation Dialog app
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.Windows.PinningConfirmationDialog
|
|
-
|
|
name: Windows Security GUI (Sec Health UI) app
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.Windows.SecHealthUI
|
|
-
|
|
name: Secondary Tile Experience app
|
|
docs: https://docs.microsoft.com/en-us/windows/uwp/design/shell/tiles-and-notifications/secondary-tiles
|
|
recommend: strict # Individual tiles may track e.g. like Firefox
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.Windows.SecondaryTileExperience
|
|
-
|
|
name: Secure Assessment Browser app (breaks Microsoft Intune/Graph)
|
|
recommend: strict
|
|
docs: https://docs.microsoft.com/en-us/graph/api/resources/intune-deviceconfig-windows10secureassessmentconfiguration?view=graph-rest-1.0
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.Windows.SecureAssessmentBrowser
|
|
# -
|
|
# # Not a bloatware, required for different setting windows such as WiFi and battery panes in action bar
|
|
# name: Start app
|
|
# call:
|
|
# function: UninstallSystemApp
|
|
# parameters:
|
|
# packageName: Microsoft.Windows.ShellExperienceHost
|
|
-
|
|
category: Windows Feedback
|
|
children:
|
|
-
|
|
name: Windows Feedback app
|
|
recommend: standard
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.WindowsFeedback
|
|
-
|
|
name: Xbox Game Callable UI app (breaks Xbox Live games)
|
|
docs: https://docs.microsoft.com/en-us/gaming/xbox-live/features/general/tcui/live-tcui-overview
|
|
recommend: strict
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Microsoft.XboxGameCallableUI
|
|
-
|
|
name: CBS Preview app
|
|
recommend: standard
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Windows.CBSPreview
|
|
-
|
|
name: Contact Support app
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Windows.ContactSupport
|
|
# -
|
|
# # Not a bloatware, required for core OS functinoality
|
|
# name: Settings app
|
|
# call:
|
|
# function: UninstallSystemApp
|
|
# parameters:
|
|
# packageName: Windows.immersivecontrolpanel
|
|
-
|
|
name: Windows Print 3D app
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Windows.Print3D
|
|
-
|
|
name: Print UI app
|
|
call:
|
|
function: UninstallSystemApp
|
|
parameters:
|
|
packageName: Windows.PrintDialog
|
|
-
|
|
category: Remove OneDrive
|
|
children:
|
|
-
|
|
name: Kill OneDrive process
|
|
recommend: strict
|
|
code: taskkill /f /im OneDrive.exe
|
|
revertCode: '"%LOCALAPPDATA%\Microsoft\OneDrive\OneDrive.exe"'
|
|
-
|
|
name: Uninstall OneDrive
|
|
recommend: strict
|
|
code: |-
|
|
if %PROCESSOR_ARCHITECTURE%==x86 (
|
|
%SystemRoot%\System32\OneDriveSetup.exe /uninstall 2>nul
|
|
) else (
|
|
%SystemRoot%\SysWOW64\OneDriveSetup.exe /uninstall 2>nul
|
|
)
|
|
revertCode: |-
|
|
if %PROCESSOR_ARCHITECTURE%==x86 (
|
|
%SystemRoot%\System32\OneDriveSetup.exe /silent
|
|
) else (
|
|
%SystemRoot%\SysWOW64\OneDriveSetup.exe /silent
|
|
)
|
|
-
|
|
name: Remove OneDrive leftovers
|
|
recommend: strict
|
|
code: |-
|
|
rd "%UserProfile%\OneDrive" /q /s
|
|
rd "%LocalAppData%\Microsoft\OneDrive" /q /s
|
|
rd "%ProgramData%\Microsoft OneDrive" /q /s
|
|
rd "%SystemDrive%\OneDriveTemp" /q /s
|
|
-
|
|
name: Delete OneDrive shortcuts
|
|
recommend: strict
|
|
docs: https://docs.microsoft.com/en-us/sharepoint/troubleshoot/installation-and-setup/how-to-block-onedrive.exe-from-being-advertised-after-install-office-2016
|
|
code: |-
|
|
del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk" /s /f /q
|
|
del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk" /s /f /q
|
|
del "%USERPROFILE%\Links\OneDrive.lnk" /s /f /q
|
|
-
|
|
name: Disable usage of OneDrive
|
|
recommend: strict
|
|
code: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive" /t REG_DWORD /v "DisableFileSyncNGSC" /d 1 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive" /t REG_DWORD /v "DisableFileSync" /d 1 /f
|
|
revertCode: |-
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive" /t REG_DWORD /v "DisableFileSyncNGSC" /d 0 /f
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive" /t REG_DWORD /v "DisableFileSync" /d 0 /f
|
|
-
|
|
name: Prevent automatic OneDrive install for current user
|
|
recommend: strict
|
|
code: reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OneDriveSetup" /f
|
|
revertCode: |-
|
|
if %PROCESSOR_ARCHITECTURE%==x86 (
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "OneDriveSetup" /t REG_SZ /d " %SystemRoot%\System32\OneDriveSetup.exe /silent" /f
|
|
) else (
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "OneDriveSetup" /t REG_SZ /d "%SystemRoot%\SysWOW64\OneDriveSetup.exe /silent" /f
|
|
)
|
|
-
|
|
name: Prevent automatic OneDrive install for new users
|
|
recommend: strict
|
|
code: |-
|
|
reg load "HKU\Default" "%SystemDrive%\Users\Default\NTUSER.DAT"
|
|
reg delete "HKU\Default\software\Microsoft\Windows\CurrentVersion\Run" /v "OneDriveSetup" /f
|
|
reg unload "HKU\Default"
|
|
revertCode: |-
|
|
reg load "HKU\Default" "%SystemDrive%\Users\Default\NTUSER.DAT"
|
|
if %PROCESSOR_ARCHITECTURE%==x86 (
|
|
reg add "HKU\Default\software\Microsoft\Windows\CurrentVersion\Run" /V "OneDriveSetup" /t REG_SZ /d " %SystemRoot%\System32\OneDriveSetup.exe /silent" /f
|
|
) else (
|
|
reg add "HKU\Default\software\Microsoft\Windows\CurrentVersion\Run" /V "OneDriveSetup" /t REG_SZ /d "%SystemRoot%\SysWOW64\OneDriveSetup.exe /silent" /f
|
|
)
|
|
reg unload "HKU\Default"
|
|
-
|
|
name: Remove OneDrive from explorer menu
|
|
recommend: strict
|
|
code: |-
|
|
reg delete "HKCR\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /f
|
|
reg delete "HKCR\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /f
|
|
reg add "HKCR\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /v System.IsPinnedToNameSpaceTree /d "0" /t REG_DWORD /f
|
|
reg add "HKCR\Wow6432Node\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /v System.IsPinnedToNameSpaceTree /d "0" /t REG_DWORD /f
|
|
revertCode: |-
|
|
reg add "HKCR\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /v System.IsPinnedToNameSpaceTree /d "1" /t REG_DWORD /f
|
|
reg add "HKCR\Wow6432Node\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /v System.IsPinnedToNameSpaceTree /d "1" /t REG_DWORD /f
|
|
-
|
|
name: Delete all OneDrive related Services
|
|
recommend: strict
|
|
code: for /f "tokens=1 delims=," %%x in ('schtasks /query /fo csv ^| find "OneDrive"') do schtasks /Delete /TN %%x /F
|
|
-
|
|
name: Delete OneDrive path from registry
|
|
recommend: strict
|
|
docs: https://stackoverflow.com/questions/46744840/export-registry-value-to-file-and-then-set-a-variable-in-batch
|
|
code: reg delete "HKCU\Environment" /v "OneDrive" /f
|
|
-
|
|
name: Uninstall Edge (chromium-based)
|
|
code:
|
|
PowerShell -ExecutionPolicy Unrestricted -Command "
|
|
$installer = (Get-ChildItem \"$env:ProgramFiles*\Microsoft\Edge\Application\*\Installer\setup.exe\");
|
|
if (!$installer) {
|
|
Write-Host Could not find the installer;
|
|
} else {
|
|
& $installer.FullName -uninstall -system-level -verbose-logging -force-uninstall
|
|
}; "
|
|
-
|
|
category: Disable built-in Windows features
|
|
children:
|
|
-
|
|
name: Direct Play feature
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: DirectPlay
|
|
-
|
|
name: Internet Explorer feature
|
|
call:
|
|
-
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: Internet-Explorer-Optional-x64
|
|
-
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: Internet-Explorer-Optional-x84
|
|
-
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: Internet-Explorer-Optional-amd64
|
|
-
|
|
name: Legacy Components feature
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: LegacyComponents
|
|
-
|
|
category: Server features for developers & administrators
|
|
children:
|
|
-
|
|
category: Hyper-V Virtualization
|
|
children:
|
|
-
|
|
name: Hyper-V feature
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: Microsoft-Hyper-V-All
|
|
-
|
|
name: Hyper-V GUI Management Tools feature
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: Microsoft-Hyper-V-Management-Clients
|
|
-
|
|
name: Hyper-V Management Tools feature
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: Microsoft-Hyper-V-Tools-All
|
|
-
|
|
name: Hyper-V Module for Windows PowerShell feature
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: Microsoft-Hyper-V-Management-PowerShell
|
|
-
|
|
name: Telnet Client feature
|
|
docs: https://social.technet.microsoft.com/wiki/contents/articles/38433.windows-10-enabling-telnet-client.aspx
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: TelnetClient
|
|
-
|
|
name: Net.TCP Port Sharing feature
|
|
docs: https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/net-tcp-port-sharing
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: WCF-TCP-PortSharing45
|
|
-
|
|
name: SMB Direct feature
|
|
docs: https://docs.microsoft.com/en-us/windows-server/storage/file-server/smb-direct
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: SmbDirect
|
|
-
|
|
name: TFTP Client feature
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: TFTP
|
|
-
|
|
category: Printing features
|
|
children:
|
|
-
|
|
category: Printer networking
|
|
children:
|
|
-
|
|
name: Internet Printing Client
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: Printing-Foundation-InternetPrinting-Client
|
|
-
|
|
name: LPD Print Service
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: LPDPrintService
|
|
-
|
|
name: LPR Port Monitor feature
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: Printing-Foundation-LPRPortMonitor
|
|
-
|
|
name: Microsoft Print to PDF feature
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: Printing-PrintToPDFServices-Features
|
|
-
|
|
name: Print and Document Services feature
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: Printing-Foundation-Features
|
|
-
|
|
name: Work Folders Client feature
|
|
docs: https://docs.microsoft.com/en-us/windows-server/storage/work-folders/work-folders-overview
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: WorkFolders-Client
|
|
-
|
|
category: XPS support
|
|
children:
|
|
-
|
|
name: XPS Services feature
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: Printing-XPSServices-Features
|
|
-
|
|
name: XPS Viewer feature
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: Xps-Foundation-Xps-Viewer
|
|
-
|
|
name: Media Features feature
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: MediaPlayback
|
|
-
|
|
name: Scan Management feature
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: ScanManagementConsole
|
|
-
|
|
name: Windows Fax and Scan feature
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: FaxServicesClientPackage
|
|
-
|
|
name: Windows Media Player feature
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: WindowsMediaPlayer
|
|
-
|
|
name: Windows Search feature
|
|
call:
|
|
function: DisableFeature
|
|
parameters:
|
|
featureName: SearchEngine-Client-Package
|
|
-
|
|
category: Uninstall capabilities & features on demand
|
|
docs: https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/features-on-demand-non-language-fod#fods-that-are-not-preinstalled-but-may-need-to-be-preinstalled
|
|
children:
|
|
-
|
|
category: Preinstalled
|
|
children:
|
|
-
|
|
name: DirectX Configuration Database capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: DirectX.Configuration.Database
|
|
-
|
|
name: Internet Explorer 11 capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Browser.InternetExplorer
|
|
-
|
|
name: Math Recognizer capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: MathRecognizer
|
|
-
|
|
name: OneSync capability (breaks Mail, People, and Calendar)
|
|
recommend: strict
|
|
docs: https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/features-on-demand-non-language-fod#onesync
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: OneCoreUAP.OneSync
|
|
-
|
|
name: OpenSSH client capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: OpenSSH.Client
|
|
-
|
|
name: PowerShell ISE capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Microsoft.Windows.PowerShell.ISE
|
|
-
|
|
name: Print Management Console capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Print.Management.Console
|
|
-
|
|
name: Quick Assist capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: App.Support.QuickAssist
|
|
-
|
|
name: Steps Recorder capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: App.StepsRecorder
|
|
-
|
|
name: Windows Fax and Scan capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Print.Fax.Scan
|
|
# Following are excluded because:
|
|
# 1. They are not widely considered as "bloatware" as the community
|
|
# 2. Do not have known privacy issues
|
|
# 3. Make Windows more functional when running all scripts
|
|
# -
|
|
# name: WordPad capability
|
|
# call:
|
|
# function: UninstallCapability
|
|
# parameters:
|
|
# capabilityName: Microsoft.Windows.WordPad
|
|
# -
|
|
# name: Paint capability
|
|
# call:
|
|
# function: UninstallCapability
|
|
# parameters:
|
|
# capabilityName: Microsoft.Windows.MSPaint
|
|
# -
|
|
# name: Notepad capability
|
|
# call:
|
|
# function: UninstallCapability
|
|
# parameters:
|
|
# capabilityName: Microsoft.Windows.Notepad
|
|
-
|
|
category: Not preinstalled
|
|
children:
|
|
-
|
|
name: .NET Framework capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: NetFX3
|
|
-
|
|
name: Mixed Reality capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Analog.Holographic.Desktop
|
|
-
|
|
name: Wireless Display capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: App.WirelessDisplay.Connect
|
|
-
|
|
name: Accessibility - Braille Support capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Accessibility.Braille
|
|
-
|
|
name: Developer Mode capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Tools.DeveloperMode.Core
|
|
-
|
|
name: Graphics Tools capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Tools.Graphics.DirectX
|
|
-
|
|
name: IrDA capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Network.Irda
|
|
-
|
|
name: Microsoft WebDriver capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Microsoft.WebDriver
|
|
-
|
|
name: MSIX Packaging Tool Driver capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Msix.PackagingTool.Driver
|
|
-
|
|
category: Networking tools
|
|
children:
|
|
-
|
|
name: RAS Connection Manager Administration Kit (CMAK) capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: RasCMAK.Client
|
|
-
|
|
name: RIP Listener capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: RIP.Listener
|
|
-
|
|
name: Simple Network Management Protocol (SNMP) capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: SNMP.Client
|
|
-
|
|
name: SNMP WMI Provider capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: WMI-SNMP-Provider.Client
|
|
-
|
|
name: OpenSSH Server capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: OpenSSH.Server
|
|
-
|
|
category: Printing
|
|
children:
|
|
-
|
|
name: Enterprise Cloud Print capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Print.EnterpriseCloudPrint
|
|
-
|
|
name: Mopria Cloud Service capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Print.MopriaCloudService
|
|
-
|
|
category: Remote server administration tools (RSAT)
|
|
children:
|
|
-
|
|
name: Active Directory Domain Services and Lightweight Directory Services Tools capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Rsat.ActiveDirectory.DS-LDS.Tools
|
|
-
|
|
name: BitLocker Drive Encryption Administration Utilities capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Rsat.BitLocker.Recovery.Tools
|
|
-
|
|
name: Active Directory Certificate Services Tools
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Rsat.CertificateServices.Tools
|
|
-
|
|
name: DHCP Server Tools capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Rsat.DHCP.Tools
|
|
-
|
|
name: DNS Server Tools capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Rsat.Dns.Tools
|
|
-
|
|
name: Failover Clustering Tools capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Rsat.FailoverCluster.Management.Tools
|
|
-
|
|
name: File Services Tools capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Rsat.FileServices.Tools
|
|
-
|
|
name: Group Policy Management Tools capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Rsat.GroupPolicy.Management.Tools
|
|
-
|
|
name: IP Address Management (IPAM) Client capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Rsat.IPAM.Client.Tools
|
|
-
|
|
name: Data Center Bridging LLDP Tools capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Rsat.LLDP.Tools
|
|
-
|
|
name: Network Controller Management Tools capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Rsat.NetworkController.Tools
|
|
-
|
|
name: Network Load Balancing Tools capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Rsat.NetworkLoadBalancing.Tools
|
|
-
|
|
name: Remote Access Management Tools capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Rsat.RemoteAccess.Management.Tools
|
|
-
|
|
name: Server Manager Tools
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Rsat.ServerManager.Tools
|
|
-
|
|
name: Shielded VM Tools capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Rsat.Shielded.VM.Tools
|
|
-
|
|
name: Storage Replica Module for Windows PowerShell capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Rsat.StorageReplica.Tools
|
|
-
|
|
name: Volume Activation Tools capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Rsat.VolumeActivation.Tools
|
|
-
|
|
name: Windows Server Update Services Tools capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Rsat.WSUS.Tools
|
|
-
|
|
name: Storage Migration Service Management Tools capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Rsat.StorageMigrationService.Management.Tools
|
|
-
|
|
name: Systems Insights Module for Windows PowerShell capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Rsat.SystemInsights.Management.Tools
|
|
-
|
|
category: Storage
|
|
children:
|
|
-
|
|
name: Windows Storage Management capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Microsoft.Windows.StorageManagement
|
|
-
|
|
name: OneCore Storage Management capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Microsoft.OneCore.StorageManagement
|
|
-
|
|
name: Windows Emergency Management Services and Serial Console capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: Windows.Desktop.EMS-SAC.Tools
|
|
-
|
|
name: XPS Viewer capability
|
|
call:
|
|
function: UninstallCapability
|
|
parameters:
|
|
capabilityName: XPS.Viewer
|
|
-
|
|
category: Advanced settings
|
|
children:
|
|
-
|
|
name: Change NTP (time) server to pool.ntp.org
|
|
docs: https://www.pool.ntp.org/en/use.html
|
|
recommend: strict
|
|
code: |-
|
|
:: Configure time source
|
|
w32tm /config /syncfromflags:manual /manualpeerlist:"0.pool.ntp.org 1.pool.ntp.org 2.pool.ntp.org 3.pool.ntp.org"
|
|
:: Restart time service if running
|
|
SC queryex "w32time"|Find "STATE"|Find /v "RUNNING">Nul||(
|
|
net stop w32time
|
|
net start w32time
|
|
)
|
|
:: Sync now
|
|
w32tm /config /update
|
|
w32tm /resync
|
|
revertCode: |-
|
|
:: Configure time source
|
|
w32tm /config /syncfromflags:manual /manualpeerlist:"time.windows.com"
|
|
:: Restart time service if running
|
|
SC queryex "w32time"|Find "STATE"|Find /v "RUNNING">Nul||(
|
|
net stop w32time
|
|
net start w32time
|
|
)
|
|
:: Sync now
|
|
w32tm /config /update
|
|
w32tm /resync
|
|
-
|
|
name: Disable Reserved Storage for updates
|
|
docs:
|
|
- https://techcommunity.microsoft.com/t5/storage-at-microsoft/windows-10-and-reserved-storage/ba-p/428327
|
|
- https://www.tenforums.com/tutorials/124858-enable-disable-reserved-storage-windows-10-a.html
|
|
code: |-
|
|
dism /online /Set-ReservedStorageState /State:Disabled /NoRestart
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ReserveManager" /v "MiscPolicyInfo" /t REG_DWORD /d "2" /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ReserveManager" /v "ShippedWithReserves" /t REG_DWORD /d "0" /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ReserveManager" /v "PassedPolicy" /t REG_DWORD /d "0" /f
|
|
revertCode: |-
|
|
DISM /Online /Set-ReservedStorageState /State:Enabled /NoRestart
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ReserveManager" /v "MiscPolicyInfo" /t REG_DWORD /d "1" /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ReserveManager" /v "ShippedWithReserves" /t REG_DWORD /d "1" /f
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ReserveManager" /v "PassedPolicy" /t REG_DWORD /d "1" /f
|
|
-
|
|
name: Run script on start-up [EXPERIMENTAL]
|
|
code: |-
|
|
del /f /q %AppData%\Microsoft\Windows\Start Menu\Programs\Startup\privacy-cleanup.bat
|
|
copy "%~dpnx0" "%AppData%\Microsoft\Windows\Start Menu\Programs\Startup\privacy-cleanup.bat"
|
|
revertCode: del /f /q %AppData%\Microsoft\Windows\Start Menu\Programs\Startup\privacy-cleanup.bat
|
|
functions:
|
|
-
|
|
name: KillProcessWhenItStarts
|
|
parameters: [ processName ]
|
|
# https://docs.microsoft.com/en-us/previous-versions/windows/desktop/xperf/image-file-execution-options
|
|
code: reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\'{{ $processName }}'" /v "Debugger" /t REG_SZ /d "%windir%\System32\taskkill.exe" /f
|
|
revertCode: reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\'{{ $processName }}'" /v "Debugger" /f
|
|
-
|
|
name: DisableFeature
|
|
parameters: [ featureName ]
|
|
code: dism /Online /Disable-Feature /FeatureName:"{{ $featureName }}" /NoRestart
|
|
revertCode: dism /Online /Enable-Feature /FeatureName:"{{ $featureName }}" /NoRestart
|
|
-
|
|
name: UninstallStoreApp
|
|
parameters: [ packageName ]
|
|
call:
|
|
function: RunPowerShell
|
|
parameters:
|
|
code: Get-AppxPackage '{{ $packageName }}' | Remove-AppxPackage
|
|
revertCode:
|
|
$package = Get-AppxPackage -AllUsers '{{ $packageName }}';
|
|
if (!$package) {
|
|
Write-Error \"Cannot reinstall '{{ $packageName }}'\" -ErrorAction Stop
|
|
}
|
|
$manifest = $package.InstallLocation + '\AppxManifest.xml';
|
|
Add-AppxPackage -DisableDevelopmentMode -Register \"$manifest\"
|
|
-
|
|
name: UninstallSystemApp
|
|
parameters: [ packageName ]
|
|
# It simply renames files
|
|
# Because system apps are non removable (check: (Get-AppxPackage -AllUsers 'Windows.CBSPreview').NonRemovable)
|
|
# Otherwise they throw 0x80070032 when trying to uninstall them
|
|
call:
|
|
function: RunPowerShell
|
|
parameters:
|
|
code:
|
|
$package = (Get-AppxPackage -AllUsers '{{ $packageName }}');
|
|
if (!$package) {
|
|
Write-Host 'Not installed';
|
|
exit 0;
|
|
}
|
|
$directories = @($package.InstallLocation, \"$env:LOCALAPPDATA\Packages\$($package.PackageFamilyName)\");
|
|
foreach($dir in $directories) {
|
|
if ( !$dir -Or !(Test-Path \"$dir\") ) { continue; }
|
|
cmd /c ('takeown /f \"' + $dir + '\" /r /d y 1> nul'); if($LASTEXITCODE) { throw 'Failed to take ownership'; }
|
|
cmd /c ('icacls \"' + $dir + '\" /grant administrators:F /t 1> nul'); if($LASTEXITCODE) { throw 'Failed to take ownership'; }
|
|
$files = Get-ChildItem -File -Path $dir -Recurse -Force;
|
|
foreach($file in $files) {
|
|
if($file.Name.EndsWith('.OLD')) { continue; }
|
|
$newName = $file.FullName + '.OLD';
|
|
Write-Host \"Rename '$($file.FullName)' to '$newName'\";
|
|
Move-Item -LiteralPath \"$($file.FullName)\" -Destination \"$newName\" -Force;
|
|
}
|
|
}
|
|
revertCode:
|
|
$package = (Get-AppxPackage -AllUsers '{{ $packageName }}');
|
|
if (!$package) {
|
|
Write-Error 'App could not be found' -ErrorAction Stop;
|
|
}
|
|
$directories = @($package.InstallLocation, \"$env:LOCALAPPDATA\Packages\$($package.PackageFamilyName)\");
|
|
foreach($dir in $directories) {
|
|
if ( !$dir -Or !(Test-Path \"$dir\") ) { continue; }
|
|
cmd /c ('takeown /f \"' + $dir + '\" /r /d y 1> nul'); if($LASTEXITCODE) { throw 'Failed to take ownership'; }
|
|
cmd /c ('icacls \"' + $dir + '\" /grant administrators:F /t 1> nul'); if($LASTEXITCODE) { throw 'Failed to take ownership'; }
|
|
$files = Get-ChildItem -File -Path \"$dir\*.OLD\" -Recurse -Force;
|
|
foreach($file in $files) {
|
|
$newName = $file.FullName.Substring(0, $file.FullName.Length - 4);
|
|
Write-Host \"Rename '$($file.FullName)' to '$newName'\";
|
|
Move-Item -LiteralPath \"$($file.FullName)\" -Destination \"$newName\" -Force;
|
|
}
|
|
}
|
|
-
|
|
name: UninstallCapability
|
|
parameters: [ capabilityName ]
|
|
call:
|
|
function: RunPowerShell
|
|
parameters:
|
|
code: Get-WindowsCapability -Online -Name '{{ $capabilityName }}*' | Remove-WindowsCapability -Online
|
|
revertCode:
|
|
$capability = Get-WindowsCapability -Online -Name '{{ $capabilityName }}*';
|
|
Add-WindowsCapability -Name \"$capability.Name\" -Online
|
|
-
|
|
name: RenameSystemFile
|
|
parameters: [ filePath ]
|
|
code: |-
|
|
if exist "{{ $filePath }}" (
|
|
takeown /f "{{ $filePath }}"
|
|
icacls "{{ $filePath }}" /grant administrators:F
|
|
move "{{ $filePath }}" "{{ $filePath }}.OLD"
|
|
echo Moved "{{ $filePath }}" to "{{ $filePath }}.OLD"
|
|
) else (
|
|
echo No action required: {{ $filePath }} is not found.
|
|
)
|
|
revertCode: |-
|
|
if exist "{{ $filePath }}.OLD" (
|
|
takeown /f "{{ $filePath }}.OLD"
|
|
icacls "{{ $filePath }}.OLD" /grant administrators:F
|
|
move "{{ $filePath }}.OLD" "{{ $filePath }}"
|
|
echo Moved "{{ $filePath }}.OLD" to "{{ $filePath }}"
|
|
) else (
|
|
echo Could not find backup file "{{ $filePath }}.OLD" 1>&2
|
|
)
|
|
-
|
|
name: SetVsCodeSetting
|
|
parameters: [ setting, powerShellValue ]
|
|
call:
|
|
function: RunPowerShell
|
|
parameters:
|
|
code:
|
|
$jsonfile = \"$env:APPDATA\Code\User\settings.json\";
|
|
if (!(Test-Path $jsonfile -PathType Leaf)) {
|
|
Write-Host \"No updates. Settings file was not at $jsonfile\";
|
|
exit 0;
|
|
}
|
|
$json = Get-Content $jsonfile | Out-String | ConvertFrom-Json;
|
|
$json | Add-Member -Type NoteProperty -Name '{{ $setting }}' -Value {{ $powerShellValue }} -Force;
|
|
$json | ConvertTo-Json | Set-Content $jsonfile;
|
|
revertCode:
|
|
$jsonfile = \"$env:APPDATA\Code\User\settings.json\";
|
|
if (!(Test-Path $jsonfile -PathType Leaf)) {
|
|
Write-Error \"Settings file could not be found at $jsonfile\" -ErrorAction Stop;
|
|
}
|
|
$json = Get-Content $jsonfile | ConvertFrom-Json;
|
|
$json.PSObject.Properties.Remove('{{ $setting }}');
|
|
$json | ConvertTo-Json | Set-Content $jsonfile;
|
|
-
|
|
name: RunPowerShell
|
|
parameters: [ code, revertCode ]
|
|
code: PowerShell -ExecutionPolicy Unrestricted -Command "{{ $code }}"
|
|
revertCode: PowerShell -ExecutionPolicy Unrestricted -Command "{{ $revertCode }}"
|