# =================================================================
# GOLDEN OPTIMIZATION SCRIPT (v1.44 PRE) - Windows 11 24H2
# Logic: 1.Kill -> 2.Files -> 3.Services -> 4.Scheduler -> 5.System Reg -> 6.Interface Reg -> 7.Apps Removal -> 8.Extended
# ============== ===================================================
& {
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Start-Process PowerShell -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs
    exit
}
$ErrorActionPreference = "Stop"
function Step-Check($Name, $Action) { try { & $Action; Write-Host "$Name [SUCCESS]" -ForegroundColor Green } catch { Write-Host "[ERROR] $Name" -ForegroundColor Red } }

# =================================================================
# BLOCK 1: KILL PROCESSES
# =================================================================

Write-Host "`n# --- BLOCK 1: KILL PROCESSES ---" -ForegroundColor Magenta

Step-Check "1.1 Kill active processes" {
    # Terminate background processes to prevent file locking during modification
    $pList = @("OfficeClickToRun", "WaaSMedicAgent", "CompatTelRunner", "MicrosoftEdgeUpdate", "MoUsoCoreWorker", "USOClient")
    foreach ($p in $pList) { 
        Get-Process $p -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue 
    }
}

# =================================================================
# BLOCK 2: FILES, PERMISSIONS & RECOVERY LOCKDOWN
# =================================================================

Write-Host "`n# --- BLOCK 2: FILES, PERMISSIONS & RECOVERY LOCKDOWN ---" -ForegroundColor Magenta

Step-Check "2.1 Neutralize Core Executables (Hard Lockdown)" {
    # Take ownership, grant permissions, and rename critical update/telemetry files to .bak
    $targets = @(
        "C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe",
        "C:\Windows\System32\WaaSMedicSvc.dll",
        "C:\Windows\System32\usoclient.exe",
        "C:\Windows\System32\MoUsoCoreWorker.exe",
        "C:\Windows\System32\CompatTelRunner.exe",
        "C:\Windows\System32\dmwappushservice.dll"
    )

    foreach ($f in $targets) {
        if (Test-Path $f) {
            & takeown /f $f /a *>$null
            & icacls $f /grant Administrators:F /c /l /q *>$null
            Set-ItemProperty -Path $f -Name Attributes -Value "Normal" -ErrorAction SilentlyContinue
            if ($f -notlike "*.bak") { Rename-Item $f "$($f).bak" -Force }
            & icacls $f /inheritance:r /deny "Everyone:(X)" *>$null
        }
    }
}

Step-Check "2.2 Disable ContentDeliveryManager (Registry)" {
    # Disable background tasks, consumer features, and silent app installation via registry
    $App = Get-AppxPackage -Name "Microsoft.Windows.ContentDeliveryManager"
    if ($App) {
        $cap = "HKCU:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\backgroundTasks\$($App.PackageFamilyName)"
        if (-not(Test-Path $cap)) { New-Item $cap -Force | Out-Null }
        Set-ItemProperty $cap "Value" "Deny" -Force
    }
    
    $reg = "HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager"
    if (-not(Test-Path $reg)) { New-Item $reg -Force | Out-Null }
    Set-ItemProperty $reg "ContentDeliveryAllowed" 0 -Force
    Set-ItemProperty $reg "OemPreInstalledAppsEnabled" 0 -Force
    Set-ItemProperty $reg "SubscribedContent-338387Enabled" 0 -Force
}

Step-Check "2.3 Create Admin Shortcuts" {
    # Create management shortcuts in the Start Menu for quick system access
    $WshShell = New-Object -ComObject WScript.Shell
    $Start = "$env:ProgramData\Microsoft\Windows\Start Menu\Programs"
    $LnkPath = "$Start\Services.lnk"
    
    $Shortcut = $WshShell.CreateShortcut($LnkPath)
    $Shortcut.TargetPath = "mmc.exe"
    $Shortcut.Arguments = "services.msc"
    $Shortcut.Save()
}

# =================================================================
# BLOCK 3: SERVICES (HARD LOCKDOWN)
# =================================================================
Write-Host "`n# --- BLOCK 3: SERVICES (HARD LOCKDOWN) ---" -ForegroundColor Magenta

$SvcList = @("DiagTrack","wlidsvc","wuauserv","wersvc","InstallService","WSearch","WaaSMedicSvc","dmwappushservice")
$i = 1

foreach ($s in $SvcList) {
    Step-Check "3.$i Disable Service: $s" {
        # Forcefully terminate the service process tree and apply registry lockdown to prevent restart
        & taskkill /f /fi "SERVICES eq $s" /t 2>$null
        Stop-Service $s -Force -ErrorAction SilentlyContinue
        
        $r = "HKLM:\SYSTEM\CurrentControlSet\Services\$s"
        if (Test-Path $r) {
            # Set startup type to Disabled (4) and wipe recovery actions (FailureActions)
            Set-ItemProperty $r "Start" 4 -Force
            Set-ItemProperty $r "FailureActions" ([byte[]]@(0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)) -Force
        }
    }
    $i++
}

# =================================================================
# BLOCK 4: TASK SCHEDULER (HARD LOCKDOWN)
# =================================================================

Write-Host "`n# --- BLOCK 4: TASK SCHEDULER (HARD LOCKDOWN) ---" -ForegroundColor Magenta

Step-Check "4.1 Disable Appraiser & Compatibility Triggers" {
    # Block Microsoft Compatibility Appraiser and telemetry-related startup tasks
    $p = "\Microsoft\Windows\Application Experience\"
    foreach ($n in @("Microsoft Compatibility Appraiser", "Microsoft Compatibility Appraiser Exp", "StartupAppTask", "PcaPatchDbTask", "SdbinstMergeDbTask", "ProgramDataUpdater")) {
        Disable-ScheduledTask -TaskName $n -TaskPath $p -ErrorAction SilentlyContinue | Out-Null
    }
}

Step-Check "4.2 Disable USoClient, CEIP & WAP Triggers" {
    # 1. Block automated update scans (UpdateOrchestrator)
    $pOrch = "\Microsoft\Windows\UpdateOrchestrator\"
    foreach ($n in @("Universal Orchestrator Idle Start","Schedule Scan Static")) { 
        Disable-ScheduledTask -TaskName $n -TaskPath $pOrch -ErrorAction SilentlyContinue | Out-Null 
    }
    
    # 2. Block hardware inventory reporting (CEIP)
    $pCeip = "\Microsoft\Windows\Customer Experience Improvement Program\"
    foreach ($n in @("Consolidator", "UsbCeip")) { 
        Disable-ScheduledTask -TaskName $n -TaskPath $pCeip -ErrorAction SilentlyContinue | Out-Null 
    }

    # 3. Disable WAP Push service triggers (Feedback/Siuf)
    $pFeed = 

"\Microsoft\Windows\Feedback\Siuf\"
    foreach ($n in @("DmClient", "DmClientOnScenarioDownload")) { 
        Disable-ScheduledTask -TaskName $n -TaskPath $pFeed -ErrorAction SilentlyContinue | Out-Null 
    }
}

Step-Check "4.3 Kill SdbinstMergeDbTask (File Level)" {
    # Physically rename the task file to prevent Task Scheduler from loading the trigger
    $taskFile = "C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\SdbinstMergeDbTask"
    if (Test-Path $taskFile) {
        & takeown /f $taskFile /a *>$null
        & icacls $taskFile /grant Administrators:F *>$null
        if ($taskFile -notlike "*.bak") { Rename-Item $taskFile "SdbinstMergeDbTask.bak" -Force }
    }
}

Step-Check "4.4 Block WU Resurrection (Registry Deadlock)" {
    # Break inheritance and remove SYSTEM access to prevent Windows from re-enabling Update tasks
    $p1 = "\Microsoft\Windows\WindowsUpdate\"
    $p2 = "\Microsoft\Windows\SecureBoot\"
    
    $r = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree"
    foreach ($t in @("$p1\ScanForUpdates", "$p2\Secure-Boot-Update")) {
        $fullPath = "$r$t"
        if (Test-Path $fullPath) {
            $acl = Get-Acl $fullPath
            $acl.SetAccessRuleProtection($true, $false) # Break inheritance
            # Grant FullControl to Admins only, removing SYSTEM/Everyone effectively
            $rule = New-Object System.Security.AccessControl.RegistryAccessRule("Administrators","FullControl","Allow")
            $acl.SetAccessRule($rule)
            Set-Acl $fullPath $acl
        }
    }
}

Step-Check "4.5 Create WeeklyCleanUp Task" {
    # Register a new task to perform weekly temporary file cleanup
    $A = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-Command `"Remove-Item 'C:\Windows\Temp\*', '$env:TEMP\*' -Recurse -Force -ErrorAction SilentlyContinue`""
    Register-ScheduledTask -TaskName "WeeklyCleanUp" -Action $A -Trigger (New-ScheduledTaskTrigger -Weekly -DaysOfWeek Wednesday -At 3:00AM) -Force | Out-Null
}

# =================================================================
# BLOCK 5: REGISTRY (SYSTEM POLICIES)
# =================================================================

Write-Host "`n# --- BLOCK 5: REGISTRY (SYSTEM POLICIES) ---" -ForegroundColor Magenta

Step-Check "5.1 Disable Error Reporting Registry" {
    # Completely disable Windows Error Reporting (WER) globally
    $p = "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting"
    if (-not(Test-Path $p)) { New-Item $p -Force | Out-Null }
    Set-ItemProperty $p "Disabled" 1 -Force
}

Step-Check "5.2 Disable SIH (Hard Lockdown)" {
    $path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator"
    $sihTree = "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Sih"
    
    # Force Value via External Process
    Start-Process powershell -ArgumentList "-NoProfile -Command `"Set-ItemProperty -Path 'HKLM:\$path' -Name 'SihDisabled' -Value 1 -Force`"" -Verb RunAs -Wait -ErrorAction SilentlyContinue

    # Apply Hard Registry Lockdown (Deny SetValue)
    if (Test-Path $path) {
        $acl = Get-Acl $path
        $rule = New-Object System.Security.AccessControl.RegistryAccessRule("Everyone","SetValue","Deny")
        $acl.AddAccessRule($rule)
        Set-Acl $path $acl
    }

    # Use Direct Registry API to paralyze the task tree
    try {
        $key = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey($sihTree, [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree, [System.Security.AccessControl.RegistryRights]::ChangePermissions)
        $emptyAcl = New-Object System.Security.AccessControl.RegistrySecurity
        $emptyAcl.SetAccessRuleProtection($true, $false)
        $key.SetAccessControl($emptyAcl)
        $key.Close()
    } catch {}
}

Step-Check "5.3 Disable Cloud & Soft Landing" {
    # Opt-out of consumer features, tips, and soft-landing prompts
    $p = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent"
    if (-not(Test-Path $p)) { New-Item $p -Force | Out-Null }
    Set-ItemProperty $p "DisableWindowsConsumerFeatures" 1 -Force
    Set-ItemProperty $p "DisableSoftLanding" 1 -Force
}

Step-Check "5.4 Disable Telemetry Policy" {
    # Set the global AllowTelemetry policy to 0 (Security level) and lock it
    $p = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection"
    if (-not(Test-Path $p)) { New-Item $p -Force | Out-Null }
    Set-ItemProperty $p "AllowTelemetry" 0 -Force
}

Step-Check "5.5 Silence Windows Update Notifications" {
    # Suppress all update-related popups and notifications in the UI
    $p = "HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings"
    if (-not(Test-Path $p)) { New-Item $p -Force | Out-Null }
    Set-ItemProperty $p "UxOption" 1 -Force
}

Step-Check "5.6 Disable PowerShell Update & Network Discovery" {
    # Disable PowerShell 7+ update checks and background module discovery
    [Environment]::SetEnvironmentVariable("POWERSHELL_UPDATECHECK", "Off", "Machine")
    [Environment]::SetEnvironmentVariable("POWERSHELL_TELEMETRY_OPTOUT", "1", "Machine")
    
    $p = "HKLM:\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell"
    if (-not(Test-Path $p)) { New-Item $p -Parent -Force | Out-Null }
    Set-ItemProperty $p "DisableModuleAutoDiscovery" 1 -Force
}

# =================================================================
# BLOCK 6: REGISTRY (INTERFACE & UX)
# =================================================================

Write-Host "`n# --- BLOCK 6: REGISTRY (INTERFACE & UX) ---" -ForegroundColor Magenta

Step-Check "6.1 Enable Run History" {
    # Ensure the "Run" dialog history is preserved in the Start Menu
    $p = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
    if (-not(Test-Path $p)) { New-Item $p -Force | Out-Null }
    Set-ItemProperty $p "Start_TrackProgs" 1 -Force
}

Step-Check "6.2 Enable Recommended Items" {
    # Keep the "Recommended" section in Start Menu functional for recent files
    $p = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
    if (-not(Test-Path $p)) { New-Item $p -Force | Out-Null }
    Set-ItemProperty $p "Start_TrackDocs" 1 -Force
}

Step-Check "6.3 Force User Consent (Sensors)" {
    # Globally deny webcam and microphone access by default to enforce privacy
    $p = "HKCU:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore"
    foreach ($s in @("webcam","microphone")) { 
        $fullPath = "$p\$s"
        if (-not(Test-Path $fullPath)) { New-Item $fullPath -Force | Out-Null }
        Set-ItemProperty $fullPath "Value" "Deny" -Force 
    }
}

Step-Check "6.4 Disable Widgets" {
    # Disable Windows Widgets and News and Interests from the Taskbar
    $p = "HKLM:\SOFTWARE\Policies\Microsoft\Dsh"
    if (-not(Test-Path $p)) { New-Item $p -Force | Out-Null }
    Set-ItemProperty $p "AllowNewsAndInterests" 0 -Force
}

Step-Check "6.5 Disable Windows Spotlight" {
    # Switch Lock Screen to static image and disable background Spotlight suggestions
    $reg = "HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager"
    if (-not(Test-Path $reg)) { New-Item $reg -Force | Out-Null }
    Set-ItemProperty $reg "RotatingLockScreenEnabled" 0 -Force
    Set-ItemProperty $reg "RotatingLockScreenOverlayEnabled" 0 -Force
}

Step-Check "6.6 Disable Setup Notifications" {
    # Disable "Let's finish setting up your device" (SCOOBE) prompts
    $p = "HKCU:\Software\Microsoft\Windows\CurrentVersion\UserProfileEngagement"
    if (-not(Test-Path $p)) { New-Item $p -Force | Out-Null }
    Set-ItemProperty $p "ScoobeSystemSettingEnabled" 0 -Force
}

# =================================================================
# BLOCK 7: APPS REMOVAL (HARDCORE CLEANUP)
# =================================================================
Write-Host "`n# --- BLOCK 7: APPS REMOVAL ---" -ForegroundColor Magenta

Step-Check "7.1 Clean OneDrive Residuals" {
    # Terminate and wipe OneDrive since no updates will ever restore it
    Get-Process OneDrive -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
    $TargetFolders = @("$env:LocalAppData\Microsoft\OneDrive", "$env:UserProfile\OneDrive", "C:\OneDriveTemp")
    foreach ($Folder in $TargetFolders) { if (Test-Path $Folder) { Remove-Item $Folder -Recurse -Force -ErrorAction SilentlyContinue } }
    $clsid = "HKCR:\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}"
    if (Test-Path $clsid) { Set-ItemProperty $clsid "System.IsPinnedToNameSpaceTree" 0 -Force }
}

Step-Check "7.2 Neutralize Microsoft Edge (Final Eradication)" {
    # Since updates are disabled, we focus on killing processes, services, and core files
    # 1. Terminate any active Edge processes
    $EdgeProcs = @("msedge", "MicrosoftEdgeUpdate", "MicrosoftEdgeElevationService", "identity_helper")
    foreach ($p in $EdgeProcs) { Get-Process $p -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue }

    # 2. Delete Edge services to prevent background activity
    foreach ($s in @("edgeupdate", "edgeupdatem", "MicrosoftEdgeElevationService")) { 
        Stop-Service $s -Force -ErrorAction SilentlyContinue
        & sc.exe delete $s *>$null 
    }

    # 3. Physical Removal: Wipe core directories using recursive takeover
    $EdgePaths = @(
        "${env:ProgramFiles(x86)}\Microsoft\Edge",
        "${env:ProgramFiles(x86)}\Microsoft\EdgeUpdate",
        "${env:ProgramFiles(x86)}\Microsoft\EdgeCore"
    )
    foreach ($f in $EdgePaths) { 
        if (Test-Path $f) { 
            & takeown /f $f /r /a /d y *>$null
            & icacls $f /grant Administrators:F /t /c /l /q *>$null
            Remove-Item $f -Recurse -Force -ErrorAction SilentlyContinue 
        } 
    }
}

Step-Check "7.3 Remove Feedback Hub (Deep Clean)" {
    # Final app removal from current user and system image
    $Name = "Microsoft.WindowsFeedbackHub"
    $App = Get-AppxPackage -Name $Name -AllUsers
    if ($App) { $App | Remove-AppxPackage -AllUsers -ErrorAction SilentlyContinue }
    $ProvApp = Get-AppxProvisionedPackage -Online | Where-Object { $_.DisplayName -eq $Name }
    if ($ProvApp) { Remove-AppxProvisionedPackage -Online -PackageName $ProvApp.PackageName -ErrorAction SilentlyContinue | Out-Null }
}

# =================================================================
# BLOCK 8: EXTENDED TELEMETRY & MONITORING
# =================================================================
Write-Host "`n# --- BLOCK 8: EXTENDED TELEMETRY & MONITORING ---" -ForegroundColor Magenta

Step-Check "8.1 Disable Diagnostic Execution Service" {
    # Stop and disable the service that orchestrates diagnostic data execution
    $s = "diagsvc"
    & taskkill /f /fi "SERVICES eq $s" /t 2>$null
    Stop-Service $s -Force -ErrorAction SilentlyContinue
    $r = "HKLM:\SYSTEM\CurrentControlSet\Services\$s"
    if (Test-Path $r) { Set-ItemProperty $r "Start" 4 -Force }
}

Step-Check "8.2 Disable Camera Frame Monitor" {
    # Disable the FrameServerMonitor service used for camera frame analytics
    $s = "FrameServerMonitor"
    & taskkill /f /fi "SERVICES eq $s" /t 2>$null
    Stop-Service $s -Force -ErrorAction SilentlyContinue
    $r = "HKLM:\SYSTEM\CurrentControlSet\Services\$s"
    if (Test-Path $r) { Set-ItemProperty $r "Start" 4 -Force }
}

Step-Check "8.3 Kill Telemetry Triggers (Device Info)" {
    # Disable device inventory tasks that trigger background system wake-ups in 24H2
    $p = "\Microsoft\Windows\Device Information\"
    foreach ($n in @("Device", "Device User")) {
        Disable-ScheduledTask -TaskName $n -TaskPath $p -ErrorAction SilentlyContinue | Out-Null
    }
}

Step-Check "8.4 Disable Location & Sensor Services" {
    # Force kill and disable location-tracking and sensor-data services
    $Sensors = @("lfsvc", "SensorService", "SensorDataService", "SensorsHidSvc")
    foreach ($s in $Sensors) {
        & taskkill /f /fi "SERVICES eq $s" /t 2>$null
        Stop-Service $s -Force -ErrorAction SilentlyContinue
        $r = "HKLM:\SYSTEM\CurrentControlSet\Services\$s"
        if (Test-Path $r) {
            Set-ItemProperty $r "Start" 4 -Force
            # Wipe recovery actions to ensure the service stays dead
            Set-ItemProperty $r "FailureActions" ([byte[]]@(0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)) -Force
        }
    }
}

# =================================================================
# FINALIZATION (Standalone Steps)
# =================================================================

# --- PRIVACY ENFORCEMENT ---
# Enforce global location privacy by overriding the ConsentStore value
Write-Host "`n# --- FINAL PRIVACY ENFORCEMENT ---" -ForegroundColor Magenta
$loc = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location"
if (-not(Test-Path $loc)) { New-Item $loc -Force | Out-Null }
Set-ItemProperty $loc "Value" "Deny" -Force
Write-Host "Location access globally set to DENY [SUCCESS]" -ForegroundColor Green

# --- SYSTEM HYGIENE ---
# Wiping all Windows Event Logs to clear traces of optimization
Write-Host "`n# --- CLEANING SYSTEM EVENT LOGS ---" -ForegroundColor Magenta
$logs = Get-WinEvent -ListLog * -ErrorAction SilentlyContinue
foreach ($log in $logs) {
    try { [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($log.LogName) } catch {}
}
Write-Host "All system event logs have been cleared [SUCCESS]" -ForegroundColor Green

Write-Host "`n--- GOLDEN SCRIPT: SYSTEM OPTIMIZED SUCCESSFULLY ---" -ForegroundColor Cyan
Write-Host "Press any key to exit..."
$null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")

}