183 lines
10 KiB
PowerShell
183 lines
10 KiB
PowerShell
If (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]'Administrator')) {
|
|
Start-Process PowerShell.exe -ArgumentList ("-NoProfile -ExecutionPolicy Bypass -File `"{0}`"" -f $PSCommandPath) -Verb RunAs
|
|
Exit
|
|
}
|
|
|
|
#run powershell as trusted installer credit : https://github.com/AveYo/LeanAndMean
|
|
#added -wait to prevent script from continuing too fast
|
|
function RunAsTI($cmd, $arg) {
|
|
$id = 'RunAsTI'; $key = "Registry::HKU\$(((whoami /user)-split' ')[-1])\Volatile Environment"; $code = @'
|
|
$I=[int32]; $M=$I.module.gettype("System.Runtime.Interop`Services.Mar`shal"); $P=$I.module.gettype("System.Int`Ptr"); $S=[string]
|
|
$D=@(); $T=@(); $DM=[AppDomain]::CurrentDomain."DefineDynami`cAssembly"(1,1)."DefineDynami`cModule"(1); $Z=[uintptr]::size
|
|
0..5|% {$D += $DM."Defin`eType"("AveYo_$_",1179913,[ValueType])}; $D += [uintptr]; 4..6|% {$D += $D[$_]."MakeByR`efType"()}
|
|
$F='kernel','advapi','advapi', ($S,$S,$I,$I,$I,$I,$I,$S,$D[7],$D[8]), ([uintptr],$S,$I,$I,$D[9]),([uintptr],$S,$I,$I,[byte[]],$I)
|
|
0..2|% {$9=$D[0]."DefinePInvok`eMethod"(('CreateProcess','RegOpenKeyEx','RegSetValueEx')[$_],$F[$_]+'32',8214,1,$S,$F[$_+3],1,4)}
|
|
$DF=($P,$I,$P),($I,$I,$I,$I,$P,$D[1]),($I,$S,$S,$S,$I,$I,$I,$I,$I,$I,$I,$I,[int16],[int16],$P,$P,$P,$P),($D[3],$P),($P,$P,$I,$I)
|
|
1..5|% {$k=$_; $n=1; $DF[$_-1]|% {$9=$D[$k]."Defin`eField"('f' + $n++, $_, 6)}}; 0..5|% {$T += $D[$_]."Creat`eType"()}
|
|
0..5|% {nv "A$_" ([Activator]::CreateInstance($T[$_])) -fo}; function F ($1,$2) {$T[0]."G`etMethod"($1).invoke(0,$2)}
|
|
$TI=(whoami /groups)-like'*1-16-16384*'; $As=0; if(!$cmd) {$cmd='control';$arg='admintools'}; if ($cmd-eq'This PC'){$cmd='file:'}
|
|
if (!$TI) {'TrustedInstaller','lsass','winlogon'|% {if (!$As) {$9=sc.exe start $_; $As=@(get-process -name $_ -ea 0|% {$_})[0]}}
|
|
function M ($1,$2,$3) {$M."G`etMethod"($1,[type[]]$2).invoke(0,$3)}; $H=@(); $Z,(4*$Z+16)|% {$H += M "AllocHG`lobal" $I $_}
|
|
M "WriteInt`Ptr" ($P,$P) ($H[0],$As.Handle); $A1.f1=131072; $A1.f2=$Z; $A1.f3=$H[0]; $A2.f1=1; $A2.f2=1; $A2.f3=1; $A2.f4=1
|
|
$A2.f6=$A1; $A3.f1=10*$Z+32; $A4.f1=$A3; $A4.f2=$H[1]; M "StructureTo`Ptr" ($D[2],$P,[boolean]) (($A2 -as $D[2]),$A4.f2,$false)
|
|
$Run=@($null, "powershell -win 1 -nop -c iex `$env:R; # $id", 0, 0, 0, 0x0E080600, 0, $null, ($A4 -as $T[4]), ($A5 -as $T[5]))
|
|
F 'CreateProcess' $Run; return}; $env:R=''; rp $key $id -force; $priv=[diagnostics.process]."GetM`ember"('SetPrivilege',42)[0]
|
|
'SeSecurityPrivilege','SeTakeOwnershipPrivilege','SeBackupPrivilege','SeRestorePrivilege' |% {$priv.Invoke($null, @("$_",2))}
|
|
$HKU=[uintptr][uint32]2147483651; $NT='S-1-5-18'; $reg=($HKU,$NT,8,2,($HKU -as $D[9])); F 'RegOpenKeyEx' $reg; $LNK=$reg[4]
|
|
function L ($1,$2,$3) {sp 'HKLM:\Software\Classes\AppID\{CDCBCFCA-3CDC-436f-A4E2-0E02075250C2}' 'RunAs' $3 -force -ea 0
|
|
$b=[Text.Encoding]::Unicode.GetBytes("\Registry\User\$1"); F 'RegSetValueEx' @($2,'SymbolicLinkValue',0,6,[byte[]]$b,$b.Length)}
|
|
function Q {[int](gwmi win32_process -filter 'name="explorer.exe"'|?{$_.getownersid().sid-eq$NT}|select -last 1).ProcessId}
|
|
$11bug=($((gwmi Win32_OperatingSystem).BuildNumber)-eq'22000')-AND(($cmd-eq'file:')-OR(test-path -lit $cmd -PathType Container))
|
|
if ($11bug) {'System.Windows.Forms','Microsoft.VisualBasic' |% {[Reflection.Assembly]::LoadWithPartialName("'$_")}}
|
|
if ($11bug) {$path='^(l)'+$($cmd -replace '([\+\^\%\~\(\)\[\]])','{$1}')+'{ENTER}'; $cmd='control.exe'; $arg='admintools'}
|
|
L ($key-split'\\')[1] $LNK ''; $R=[diagnostics.process]::start($cmd,$arg); if ($R) {$R.PriorityClass='High'; $R.WaitForExit()}
|
|
if ($11bug) {$w=0; do {if($w-gt40){break}; sleep -mi 250;$w++} until (Q); [Microsoft.VisualBasic.Interaction]::AppActivate($(Q))}
|
|
if ($11bug) {[Windows.Forms.SendKeys]::SendWait($path)}; do {sleep 7} while(Q); L '.Default' $LNK 'Interactive User'
|
|
'@; $V = ''; 'cmd', 'arg', 'id', 'key' | ForEach-Object { $V += "`n`$$_='$($(Get-Variable $_ -val)-replace"'","''")';" }; Set-ItemProperty $key $id $($V, $code) -type 7 -force -ea 0
|
|
Start-Process powershell -args "-win 1 -nop -c `n$V `$env:R=(gi `$key -ea 0).getvalue(`$id)-join''; iex `$env:R" -verb runas -Wait
|
|
} # lean & mean snippet by AveYo, 2022.01.28
|
|
|
|
|
|
#disable ai registry keys
|
|
Write-Host 'Applying Registry Keys...'
|
|
#set for local machine and current user to be sure
|
|
$hives = @('HKLM', 'HKCU')
|
|
foreach ($hive in $hives) {
|
|
Reg.exe add "$hive\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot" /v 'TurnOffWindowsCopilot' /t REG_DWORD /d '1' /f *>$null
|
|
Reg.exe add "$hive\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" /v 'DisableAIDataAnalysis' /t REG_DWORD /d '1' /f *>$null
|
|
}
|
|
Reg.exe add 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' /v 'ShowCopilotButton' /t REG_DWORD /d '0' /f *>$null
|
|
Reg.exe add 'HKCU\Software\Microsoft\input\Settings' /v 'InsightsEnabled' /t REG_DWORD /d '0' /f *>$null
|
|
#disable copilot in edge
|
|
Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\Edge' /v 'CopilotCDPPageContext' /t REG_DWORD /d '0' /f *>$null
|
|
Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\Edge' /v 'CopilotPageContext' /t REG_DWORD /d '0' /f *>$null
|
|
Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\Edge' /v 'DiscoverPageContextEnabled' /t REG_DWORD /d '0' /f *>$null
|
|
Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\Edge' /v 'HubsSidebarEnabled' /t REG_DWORD /d '0' /f *>$null
|
|
#force policy changes
|
|
gpupdate /force >$null
|
|
|
|
|
|
$aipackages = @(
|
|
'MicrosoftWindows.Client.Photon'
|
|
'MicrosoftWindows.Client.AIX'
|
|
'MicrosoftWindows.Client.CoPilot'
|
|
'Microsoft.Windows.Ai.Copilot.Provider'
|
|
'Microsoft.Copilot'
|
|
)
|
|
|
|
$provisioned = get-appxprovisionedpackage -online
|
|
$appxpackage = get-appxpackage -allusers
|
|
$eol = @()
|
|
$store = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore'
|
|
$users = @('S-1-5-18'); if (test-path $store) { $users += $((Get-ChildItem $store -ea 0 | Where-Object { $_ -like '*S-1-5-21*' }).PSChildName) }
|
|
|
|
#uninstall packages
|
|
|
|
#use eol trick to uninstall some locked packages
|
|
foreach ($choice in $aipackages) {
|
|
Write-Host "Removing $choice"
|
|
if ('' -eq $choice.Trim()) { continue }
|
|
foreach ($appx in $($provisioned | Where-Object { $_.PackageName -like "*$choice*" })) {
|
|
$next = !1; foreach ($no in $skip) { if ($appx.PackageName -like "*$no*") { $next = !0 } } ; if ($next) { continue }
|
|
$PackageName = $appx.PackageName; $PackageFamilyName = ($appxpackage | Where-Object { $_.Name -eq $appx.DisplayName }).PackageFamilyName
|
|
New-Item "$store\Deprovisioned\$PackageFamilyName" -force >'';
|
|
foreach ($sid in $users) { New-Item "$store\EndOfLife\$sid\$PackageName" -force >'' } ; $eol += $PackageName
|
|
dism /online /set-nonremovableapppolicy /packagefamily:$PackageFamilyName /nonremovable:0 >''
|
|
remove-appxprovisionedpackage -packagename $PackageName -online -allusers >''
|
|
}
|
|
foreach ($appx in $($appxpackage | Where-Object { $_.PackageFullName -like "*$choice*" })) {
|
|
$next = !1; foreach ($no in $skip) { if ($appx.PackageFullName -like "*$no*") { $next = !0 } } ; if ($next) { continue }
|
|
$PackageFullName = $appx.PackageFullName;
|
|
New-Item "$store\Deprovisioned\$appx.PackageFamilyName" -force >'';
|
|
foreach ($sid in $users) { New-Item "$store\EndOfLife\$sid\$PackageFullName" -force >'' } ; $eol += $PackageFullName
|
|
dism /online /set-nonremovableapppolicy /packagefamily:$PackageFamilyName /nonremovable:0 >''
|
|
remove-appxpackage -package $PackageFullName -allusers >''
|
|
}
|
|
}
|
|
|
|
## undo eol unblock trick to prevent latest cumulative update (LCU) failing
|
|
foreach ($sid in $users) { foreach ($PackageName in $eol) { Remove-Item "$store\EndOfLife\$sid\$PackageName" -force -ErrorAction SilentlyContinue >'' } }
|
|
|
|
|
|
|
|
Write-Host 'Removing Package Files...'
|
|
#-----------------------------------------------------------------------remove files
|
|
$appsPath = 'C:\Windows\SystemApps'
|
|
$appsPath2 = 'C:\Program Files\WindowsApps'
|
|
$pathsSystemApps = (Get-ChildItem -Path $appsPath -Directory -Force).FullName
|
|
$pathsWindowsApps = (Get-ChildItem -Path $appsPath2 -Directory -Force).FullName
|
|
|
|
$packagesPath = @()
|
|
#get full path
|
|
foreach ($package in $aipackages) {
|
|
|
|
foreach ($path in $pathsSystemApps) {
|
|
if ($path -like "*$package*") {
|
|
$packagesPath += $path
|
|
}
|
|
}
|
|
|
|
foreach ($path in $pathsWindowsApps) {
|
|
if ($path -like "*$package*") {
|
|
$packagesPath += $path
|
|
}
|
|
}
|
|
|
|
}
|
|
#import module to remove locked files
|
|
<#
|
|
try {
|
|
Get-InstalledModule -Name RemoveFileZ -ErrorAction Stop | Out-Null
|
|
|
|
}
|
|
catch {
|
|
$policy = Get-ExecutionPolicy
|
|
if ($policy.value__ -ne 4) {
|
|
Set-ExecutionPolicy Unrestricted -Force
|
|
}
|
|
Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force | Out-Null
|
|
Install-Module -Name RemoveFileZ -Force
|
|
Import-Module -Name RemoveFileZ
|
|
}
|
|
#>
|
|
|
|
foreach ($Path in $packagesPath) {
|
|
#only remove dlls from photon to prevent startmenu from breaking
|
|
if ($path -like '*Photon*') {
|
|
$command = "`$dlls = (Get-ChildItem -Path $Path -Filter *.dll).FullName; foreach(`$dll in `$dlls){Remove-item ""`$dll"" -force}"
|
|
RunAsTI powershell "-noprofile -nologo -windowstyle hidden -command $command"
|
|
}
|
|
else {
|
|
$command = "Remove-item ""$Path"" -force -recurse"
|
|
RunAsTI powershell "-noprofile -nologo -windowstyle hidden -command $command"
|
|
}
|
|
Start-Sleep 2
|
|
}
|
|
|
|
#remove package installers in edge dir
|
|
#installs Microsoft.Windows.Ai.Copilot.Provider
|
|
$dir = "${env:ProgramFiles(x86)}\Microsoft"
|
|
$folders = @(
|
|
'Edge',
|
|
'EdgeCore',
|
|
'EdgeWebView'
|
|
)
|
|
foreach ($folder in $folders) {
|
|
if ($folder -eq 'EdgeCore') {
|
|
#edge core doesnt have application folder
|
|
$fullPath = (Get-ChildItem -Path "$dir\$folder\*.*.*.*\copilot_provider_msix" -ErrorAction SilentlyContinue).FullName
|
|
|
|
}
|
|
else {
|
|
$fullPath = (Get-ChildItem -Path "$dir\$folder\Application\*.*.*.*\copilot_provider_msix" -ErrorAction SilentlyContinue).FullName
|
|
}
|
|
if ($fullPath -ne $null) { Remove-Item -Path $fullPath -Recurse -Force -ErrorAction SilentlyContinue }
|
|
}
|
|
|
|
#remove any screenshots from recall
|
|
Write-Host 'Removing Any Screenshots...'
|
|
Remove-Item -Path "$env:LOCALAPPDATA\CoreAIPlatform*" -Force -Recurse -ErrorAction SilentlyContinue
|
|
|
|
|
|
$input = Read-Host 'Done! Press Any Key to Exit'
|
|
if ($input) { exit } |