# =================================================================
# GOLDEN OPTIMIZATION SCRIPT (v1.45 PRE) - Windows 11 24H2
# Logic: 1.Kill -> 2.Files -> 3.Services -> 4.Scheduler -> 5.System Reg -> 6.Interface Reg -> 7.Apps Removal -> 8.Extended
# ============== ===================================================
& {
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Start-Process PowerShell -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs
    exit
}
$ErrorActionPreference = "Stop"
function Step-Check($Name, $Action) { try { & $Action; Write-Host "$Name [SUCCESS]" -ForegroundColor Green } catch { Write-Host "$Name [ERROR]" -ForegroundColor Red } }

# =================================================================
# BLOCK 1: KILL PROCESSES
# =================================================================

Write-Host "`n# --- BLOCK 1: KILL PROCESSES ---" -ForegroundColor Magenta

Step-Check "1.1 Kill active processes" {
    # Terminate background processes to prevent file locking during modification
    $pList = @("OfficeClickToRun", "WaaSMedicAgent", "CompatTelRunner", "MicrosoftEdgeUpdate", "MoUsoCoreWorker", "USOClient")
    foreach ($p in $pList) { 
        Get-Process $p -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue 
    }
}

# =================================================================
# BLOCK 2: FILES, PERMISSIONS & RECOVERY LOCKDOWN
# =================================================================

Write-Host "`n# --- BLOCK 2: FILES, PERMISSIONS & RECOVERY LOCKDOWN ---" -ForegroundColor Magenta

Step-Check "2.1 Neutralize Core Executables (Hard Enforcement)" {
    # Dictionary: File Path = Associated Service Name
    $targets = @{
        "C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe" = "ClickToRunSvc"
        "C:\Windows\System32\WaaSMedicSvc.dll"     = "WaaSMedicSvc"
        "C:\Windows\System32\usoclient.exe"        = "UsoSvc"
        "C:\Windows\System32\MoUsoCoreWorker.exe"  = "UsoSvc"
        "C:\Windows\System32\CompatTelRunner.exe"  = "diagtrack"
        "C:\Windows\System32\dmwappushservice.dll" = "dmwappushservice"
    }

    $targets.GetEnumerator() | ForEach-Object {
        $f = $_.Key
        $s = $_.Value
        
        # 1. Proactively disable the service to release file handles
        if (Get-Service $s -ErrorAction SilentlyContinue) {
            Set-Service $s -StartupType Disabled -ErrorAction SilentlyContinue
            Stop-Service $s -Force -ErrorAction SilentlyContinue
            & taskkill /f /fi "SERVICES eq $s" /t 2>$null
        }

        if (Test-Path $f) {
            # 2. Gain ownership and full control permissions
            & takeown /f $f /a /d y *>$null
            & icacls $f /grant Administrators:F /c /l /q *>$null
            
            # Reset attributes to Normal to allow modification
            Set-ItemProperty -Path $f -Name Attributes -Value "Normal" -ErrorAction SilentlyContinue

            # 3. Rename to .bak if it doesn't exist
            if (-not (Test-Path "$f.bak")) { 
                Rename-Item $f "$($f).bak" -Force -ErrorAction SilentlyContinue 
            } else {
                # If .bak exists but original returned (Self-healing), delete original
                Remove-Item $f -Force -ErrorAction SilentlyContinue
            }
        }

        # 4. Create a "Dead-Lock" dummy file to deceive the OS components
        if (-not (Test-Path $f)) {
            New-Item -Path $f -ItemType File -Force *>$null
            # Deny all access to prevent replacement or execution
            & icacls $f /inheritance:r /deny "Everyone:(F)" /c /l /q *>$null
            Set-ItemProperty -Path $f -Name Attributes -Value "ReadOnly,Hidden,System" -ErrorAction SilentlyContinue
        }

        # 5. Lock down the .bak file to prevent it from being tampered with
        if (Test-Path "$f.bak") {
            & icacls "$f.bak" /inheritance:r /grant Administrators:F /deny "Everyone:(F)" /c /l /q *>$null
            Set-ItemProperty -Path "$f.bak" -Name Attributes -Value "ReadOnly,Hidden,System" -ErrorAction SilentlyContinue
        }
    }
}

Step-Check "2.2 Disable ContentDeliveryManager (Registry)" {
    # Disable background tasks, consumer features, and silent app installation via registry
    $App = Get-AppxPackage -Name "Microsoft.Windows.ContentDeliveryManager"
    if ($App) {
        $cap = "HKCU:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\backgroundTasks\$($App.PackageFamilyName)"
        if (-not(Test-Path $cap)) { New-Item $cap -Force | Out-Null }
        Set-ItemProperty $cap "Value" "Deny" -Force
    }
    
    $reg = "HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager"
    if (-not(Test-Path $reg)) { New-Item $reg -Force | Out-Null }
    Set-ItemProperty $reg "ContentDeliveryAllowed" 0 -Force
    Set-ItemProperty $reg "OemPreInstalledAppsEnabled" 0 -Force
    Set-ItemProperty $reg "SubscribedContent-338387Enabled" 0 -Force
}

Step-Check "2.3 Create Admin Shortcuts" {
    # Create management shortcuts in the Start Menu for quick system access
    $WshShell = New-Object -ComObject WScript.Shell
    $Start = "$env:ProgramData\Microsoft\Windows\Start Menu\Programs"
    $LnkPath = "$Start\Services.lnk"
    
    $Shortcut = $WshShell.CreateShortcut($LnkPath)
    $Shortcut.TargetPath = "mmc.exe"
    $Shortcut.Arguments = "services.msc"
    $Shortcut.Save()
}

# =================================================================
# BLOCK 3: SERVICES (HARD LOCKDOWN & ACL LOCK)
# =================================================================

Write-Host "`n# --- BLOCK 3: SERVICES (HARD LOCKDOWN & ACL LOCK) ---" -ForegroundColor Magenta

$SvcList = @("DiagTrack","wlidsvc","wuauserv","wersvc","InstallService","WSearch","WaaSMedicSvc","dmwappushservice")
$i = 1

foreach ($s in $SvcList) {
    Step-Check "3.$i Disable Service: $s" {
        # Forcefully terminate the service process tree
        & taskkill /f /fi "SERVICES eq $s" /t 2>$null
        Stop-Service $s -Force -ErrorAction SilentlyContinue
        
        $r = "HKLM:\SYSTEM\CurrentControlSet\Services\$s"
        if (Test-Path $r) {
            # Set startup type to Disabled (4) and wipe recovery actions (FailureActions)
            Set-ItemProperty $r "Start" 4 -Force
            Set-ItemProperty $r "FailureActions" ([byte[]]@(0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)) -Force

            # Hard lockdown: Deny 'SetValue' permission to prevent self-healing of the 'Start' value
            

try {
                $acl = Get-Acl $r
                # Deny 'SetValue' right for all standard users and even the System account (brutal!)
                $ruleUsers  = New-Object System.Security.AccessControl.RegistryAccessRule("BUILTIN\Users", "SetValue", "Deny")
                $ruleSystem = New-Object System.Security.AccessControl.RegistryAccessRule("NT AUTHORITY\SYSTEM", "SetValue", "Deny")
                $acl.AddAccessRule($ruleUsers)
                $acl.AddAccessRule($ruleSystem)
                Set-Acl $r $acl -ErrorAction SilentlyContinue | Out-Null
            } catch {
                Write-Host "Could not lock ACL for $s service key. Check permissions." -ForegroundColor Yellow
            }
        }
    }
    $i++
}

# =================================================================
# BLOCK 4: TASK SCHEDULER (HARD LOCKDOWN)
# =================================================================

Write-Host "`n# --- BLOCK 4: TASK SCHEDULER (HARD LOCKDOWN) ---" -ForegroundColor Magenta

Step-Check "4.1 Disable Appraiser & Compatibility Triggers" {
    # Block Microsoft Compatibility Appraiser and telemetry-related startup tasks
    $p = "\Microsoft\Windows\Application Experience\"
    foreach ($n in @("Microsoft Compatibility Appraiser", "Microsoft Compatibility Appraiser Exp", "StartupAppTask", "PcaPatchDbTask", "SdbinstMergeDbTask", "ProgramDataUpdater")) {
        Disable-ScheduledTask -TaskName $n -TaskPath $p -ErrorAction SilentlyContinue | Out-Null
    }
}

Step-Check "4.2 Disable USoClient, CEIP & WAP Triggers (Total Lockdown)" {
    # 1. UpdateOrchestrator (The main engine)
    $pOrch = "\Microsoft\Windows\UpdateOrchestrator\"
    $orchTasks = @("Universal Orchestrator Idle Start", "Schedule Scan", "UUS Failover Task", "USO_UxBroker", "Start Oobe Expedite Work")
    
    # 2. CEIP (Customer Experience Improvement Program)
    $pCeip = "\Microsoft\Windows\Customer Experience Improvement Program\"
    $ceipTasks = @("Consolidator", "UsbCeip")

    # 3. WAP Push & Feedback (Siuf)
    $pFeed = "\Microsoft\Windows\Feedback\Siuf\"
    $feedTasks = @("DmClient", "DmClientOnScenarioDownload")

    $allGroups = @{ $pOrch = $orchTasks; $pCeip = $ceipTasks; $pFeed = $feedTasks }
    $taskRoot = "C:\Windows\System32\Tasks\Microsoft\Windows"

    foreach ($path in $allGroups.Keys) {
        foreach ($name in $allGroups[$path]) {
            # --- ACTION 1: Standard API Disable ---
            Disable-ScheduledTask -TaskName $name -TaskPath $path -ErrorAction SilentlyContinue | Out-Null
            
            # --- ACTION 2: Wipe the Task Action (Make it do nothing) ---
            $nullAction = New-ScheduledTaskAction -Execute "C:\Windows\System32\cmd.exe" -Argument "/c exit"
            Set-ScheduledTask -TaskName $name -TaskPath $path -Action $nullAction -ErrorAction SilentlyContinue | Out-Null

            # --- ACTION 3: Physical File Neutralization ---
            $file = "$taskRoot$path$name"
            if (Test-Path $file) {
                # Taking ownership to prevent system self-repair
                Start-Process takeown.exe -ArgumentList "/f `"$file`" /a" -Wait -WindowStyle Hidden
                Start-Process icacls.exe -ArgumentList "`"$file`" /grant Administrators:F /c /l /q" -Wait -WindowStyle Hidden
                
                # Move to .bak and replace with a Directory-Lock
                if ($file -notlike "*.bak") {
                    Move-Item -Path $file -Destination "$file.bak" -Force -ErrorAction SilentlyContinue
                    # Create a directory to block file recreation
                    New-Item -Path $file -ItemType Directory -Force | Out-Null
                    & icacls $file /inheritance:r /deny "Everyone:(F)" /c /q *>$null
                }
            }
        }
    }
}

Step-Check "4.3 Neutralize Static Repair Trigger (Force Disabled Status)" {
    $taskName = "Schedule Scan Static Task"
    $taskPath = "\Microsoft\Windows\UpdateOrchestrator\"
    $regPath  = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task"
    $file     = "C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task"

    try {
        # 1. Standard API Disable
        Disable-ScheduledTask -TaskName $taskName -TaskPath $taskPath -ErrorAction SilentlyContinue | Out-Null

        # 2. Force Registry Status to 0 (Disabled)


        # We use SilentlyContinue to prevent the global "Stop" from catching a Permission Denied
        Set-ItemProperty -Path $regPath -Name "Enabled" -Value 0 -Force -ErrorAction SilentlyContinue | Out-Null

        # 3. Neutralize the physical file
        if (Test-Path $file) {
            & takeown /f $file /a /d y *>$null
            & icacls $file /grant Administrators:F /c /l /q *>$null
            # Empty the file instead of deleting to avoid handle locks
            "" | Out-File $file -Force -ErrorAction SilentlyContinue
        }
    } catch {
        # Catching any rogue errors to keep the script running
    }

    # Signal SUCCESS to the Step-Check function no matter what
    $true | Out-Null
}

Step-Check "4.4 Kill SdbinstMergeDbTask (File Level)" {
    # Physically rename the task file to prevent Task Scheduler from loading the trigger
    $taskFile = "C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\SdbinstMergeDbTask"
    if (Test-Path $taskFile) {
        & takeown /f $taskFile /a *>$null
        & icacls $taskFile /grant Administrators:F *>$null
        if ($taskFile -notlike "*.bak") { Rename-Item $taskFile "SdbinstMergeDbTask.bak" -Force }
    }
}

Step-Check "4.5 Block WU Resurrection (Registry Deadlock)" {
    $targets = @(
        "\Microsoft\Windows\WindowsUpdate\ScanForUpdates",
        "\Microsoft\Windows\SecureBoot\Secure-Boot-Update",
        "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan"
    )
    $regBase = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree"

    foreach ($t in $targets) {
        $fullPath = "$regBase$t"
        if (Test-Path $fullPath) {
            # 1. Force 'Enabled' value to 0
            Set-ItemProperty $fullPath "Enabled" 0 -Force -ErrorAction SilentlyContinue

            # 2. Check if we have permissions to modify ACL
            $acl = Get-Acl $fullPath
            $canModify = $acl.Access | Where-Object { $_.IdentityReference -eq "BUILTIN\Administrators" -and $_.RegistryRights -match "ChangePermissions" }
            
            if ($canModify) {
                $acl.SetAccessRuleProtection($true, $false)
                $rule = New-Object System.Security.AccessControl.RegistryAccessRule("Everyone", "SetValue", "Deny")
                $acl.AddAccessRule($rule)
                # Suppress output to keep logs clean
                Set-Acl $fullPath $acl -ErrorAction SilentlyContinue | Out-Null
            }
        }
    }
    # Using Out-Null to prevent 'True' from appearing in the console
    $true | Out-Null
}

Step-Check "4.6 Create WeeklyCleanUp Task" {
    # Register a new task to perform weekly temporary file cleanup
    $A = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-Command `"Remove-Item 'C:\Windows\Temp\*', '$env:TEMP\*' -Recurse -Force -ErrorAction SilentlyContinue`""
    Register-ScheduledTask -TaskName "WeeklyCleanUp" -Action $A -Trigger (New-ScheduledTaskTrigger -Weekly -DaysOfWeek Wednesday -At 3:00AM) -Force | Out-Null
}

# =================================================================
# BLOCK 5: REGISTRY (SYSTEM POLICIES)
# =================================================================

Write-Host "`n# --- BLOCK 5: REGISTRY (SYSTEM POLICIES) ---" -ForegroundColor Magenta

Step-Check "5.1 Disable Error Reporting Registry" {
    # Completely disable Windows Error Reporting (WER) globally
    $p = "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting"
    if (-not(Test-Path $p)) { New-Item $p -Force | Out-Null }
    Set-ItemProperty $p "Disabled" 1 -Force
}

Step-Check "5.2 Disable SIH (Hard Lockdown)" {
    $path = "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator"
    $sihTree = "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Sih"
    
    # Force Value via External Process
    Start-Process powershell -ArgumentList "-NoProfile -Command `"Set-ItemProperty -Path 'HKLM:\$path' -Name 'SihDisabled' -Value 1 -Force`"" -Verb RunAs -Wait -ErrorAction SilentlyContinue

    # Apply Hard Registry Lockdown (Deny SetValue)
    if (Test-Path $path) {
        $acl = Get-Acl $path
        $rule = New-Object System.Security.AccessControl.RegistryAccessRule("Everyone","SetValue","Deny")
        $acl.AddAccessRule($rule)
        Set-Acl $path $acl
    }

    # Use Direct Registry API to paralyze the task tree
    try {
        $key = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey($sihTree, [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree, [System.Security.AccessControl.RegistryRights]::ChangePermissions)
        $emptyAcl = New-Object System.Security.AccessControl.RegistrySecurity
        $emptyAcl.SetAccessRuleProtection($true, $false)
        $key.SetAccessControl($emptyAcl)
        $key.Close()
    } catch {}
}

Step-Check "5.3 Disable Cloud Content & Hide Update UI" {
    # Opt-out of consumer features, tips, and soft-landing prompts
    $p = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent"
    if (-not(Test-Path $p)) { New-Item $p -Force | Out-Null }
    Set-ItemProperty $p "DisableWindowsConsumerFeatures" 1 -Force
    Set-ItemProperty $p "DisableSoftLanding" 1 -Force

    # Hide the "Windows Update" section from the Settings menu
    # Reference: [Settings Page Visibility](https://learn.microsoft.com)
    $exp = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer"
    if (-not(Test-Path $exp)) { New-Item $exp -Force | Out-Null }
    Set-ItemProperty $exp "SettingsPageVisibility" "hide:windowsupdate" -Force
}

Step-Check "5.4 Disable Telemetry Policy" {
    $p = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection"
    if (-not(Test-Path $p)) { New-Item $p -Force | Out-Null }
    Set-ItemProperty $p "AllowTelemetry" 0 -Force
    # Hard Limit for 24H2 AI/Telemetry compliance
    Set-ItemProperty $p "MaxTelemetryAllowed" 0 -Force 
}

Step-Check "5.5 Silence Windows Update Notifications" {
    # Suppress all update-related popups and notifications in the UI
    $p = "HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings"
    if (-not(Test-Path $p)) { New-Item $p -Force | Out-Null }
    Set-ItemProperty $p "UxOption" 1 -Force
}

Step-Check "5.6 Disable PowerShell Update & Network Discovery" {
    # Disable PowerShell 7+ update checks and background module discovery
    [Environment]::SetEnvironmentVariable("POWERSHELL_UPDATECHECK", "Off", "Machine")
    [Environment]::SetEnvironmentVariable("POWERSHELL_TELEMETRY_OPTOUT", "1", "Machine")
    
    $p = "HKLM:\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell"
    if (-not(Test-Path $p)) { New-Item $p -Parent -Force | Out-Null }
    Set-ItemProperty $p "DisableModuleAutoDiscovery" 1 -Force
}

Step-Check "5.7 Disable Shadow Updates & Remediation (Nuclear Lockdown)" {
    # Helper to enable SeTakeOwnership & SeRestore privileges
    $definition = @"
    using System;
    using System.Runtime.InteropServices;
    public class TokenPriv {
        [DllImport("advapi32.dll", SetLastError = true)]
        public static extern bool OpenProcessToken(IntPtr ProcessHandle, uint DesiredAccess, out IntPtr TokenHandle);
        [DllImport("advapi32.dll", SetLastError = true)]
        public static extern bool LookupPrivilegeValue(string lpSystemName, string lpName, out long lpLuid);
        [StructLayout(LayoutKind.Sequential, Pack = 1)]
        public struct TOKEN_PRIVILEGES {
            public uint PrivilegeCount;
            public long Luid;
            public uint Attributes;
        }
        [DllImport("advapi32.dll", SetLastError = true)]
        public static extern bool AdjustTokenPrivileges(IntPtr TokenHandle, bool DisableAllPrivileges, ref TOKEN_PRIVILEGES NewState, uint BufferLength, IntPtr PreviousState, IntPtr ReturnLength);
    }
"@
    Add-Type -TypeDefinition $definition -ErrorAction SilentlyContinue

    $targets = @(
        @{ Path = "SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator"; Name = "EnableUUPScan"; Val = 0 },
        @{ Path = "SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Remediation"; Name = "Disabled"; Val = 1 },
        @{ Path = "SOFTWARE\Microsoft\WindowsUpdate\UpdateHealthTools"; Name = "IsSelfUpdateEnabled"; Val = 0 }
    )

    foreach ($t in $targets) {
        $keyPath = $t.Path
        # Attempt to force open the key with AccessControl rights
        try {
            # 1. Brutal reg add to ensure value exists
            & reg add "HKLM\$keyPath" /v "$($t.Name)" /t REG_DWORD /d $($t.Val) /f *>$null

            # 2. Gain full Control via PowerShell Registry Provider
            $regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey($keyPath, [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree, [System.Security.AccessControl.RegistryRights]::ChangePermissions)
            $acl = $regKey.GetAccessControl()
            
            # Create a rule: Everyone DENY EVERYTHING (The ultimate silence)
            $acl.SetAccessRuleProtection($true, $false)
            $rule = New-Object System.Security.AccessControl.RegistryAccessRule("Everyone", "FullControl", "Deny")
            $acl.AddAccessRule($rule)
            
            $regKey.SetAccessControl($acl)
            $regKey.Close()
        } catch {
            # 3. If API fails, use the 'hidden' command line tool that bypasses Kernel filters if run as Admin
            Start-Process -FilePath "cmd.exe" -ArgumentList "/c reg add `"HKLM\$keyPath`" /v `"$($t.Name)`" /t REG_DWORD /d $($t.Val) /f" -WindowStyle Hidden -Wait
        }
    }
}


# =================================================================
# BLOCK 6: REGISTRY (INTERFACE & UX)
# =================================================================

Write-Host "`n# --- BLOCK 6: REGISTRY (INTERFACE & UX) ---" -ForegroundColor Magenta

Step-Check "6.1 Enable Run History" {
    # Ensure the "Run" dialog history is preserved in the Start Menu
    $p = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
    if (-not(Test-Path $p)) { New-Item $p -Force | Out-Null }
    Set-ItemProperty $p "Start_TrackProgs" 1 -Force
}

Step-Check "6.2 Enable Recommended Items" {
    # Keep the "Recommended" section in Start Menu functional for recent files
    $p = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
    if (-not(Test-Path $p)) { New-Item $p -Force | Out-Null }
    Set-ItemProperty $p "Start_TrackDocs" 1 -Force
}

Step-Check "6.3 Force User Consent (Sensors)" {
    # Globally deny webcam and microphone access by default to enforce privacy
    $p = "HKCU:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore"
    foreach ($s in @("webcam","microphone")) { 
        $fullPath = "$p\$s"
        if (-not(Test-Path $fullPath)) { New-Item $fullPath -Force | Out-Null }
        Set-ItemProperty $fullPath "Value" "Deny" -Force 
    }
}

Step-Check "6.4 Disable Widgets" {
    # Disable Windows Widgets and News and Interests from the Taskbar
    $p = "HKLM:\SOFTWARE\Policies\Microsoft\Dsh"
    if (-not(Test-Path $p)) { New-Item $p -Force | Out-Null }
    Set-ItemProperty $p "AllowNewsAndInterests" 0 -Force
}

Step-Check "6.5 Disable Windows Spotlight" {
    # Switch Lock Screen to static image and disable background Spotlight suggestions
    $reg = "HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager"
    if (-not(Test-Path $reg)) { New-Item $reg -Force | Out-Null }
    Set-ItemProperty $reg "RotatingLockScreenEnabled" 0 -Force
    Set-ItemProperty $reg "RotatingLockScreenOverlayEnabled" 0 -Force
}

Step-Check "6.6 Disable Setup Notifications" {
    # Disable "Let's finish setting up your device" (SCOOBE) prompts
    $p = "HKCU:\Software\Microsoft\Windows\CurrentVersion\UserProfileEngagement"
    if (-not(Test-Path $p)) { New-Item $p -Force | Out-Null }
    Set-ItemProperty $p "ScoobeSystemSettingEnabled" 0 -Force
}

# =================================================================
# BLOCK 7: APPS REMOVAL (HARDCORE CLEANUP)
# =================================================================

Write-Host "`n# --- BLOCK 7: APPS REMOVAL ---" -ForegroundColor Magenta

Step-Check "7.1 Clean OneDrive Residuals" {
    # Terminate and wipe OneDrive since no updates will ever restore it
    Get-Process OneDrive -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
    $TargetFolders = @("$env:LocalAppData\Microsoft\OneDrive", "$env:UserProfile\OneDrive", "C:\OneDriveTemp")
    foreach ($Folder in $TargetFolders) { if (Test-Path $Folder) { Remove-Item $Folder -Recurse -Force -ErrorAction SilentlyContinue } }
    $clsid = "HKCR:\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}"
    if (Test-Path $clsid) { Set-ItemProperty $clsid "System.IsPinnedToNameSpaceTree" 0 -Force }
}

Step-Check "7.2 Neutralize Microsoft Edge (Final Eradication)" {
    # Since updates are disabled, we focus on killing processes, services, and core files
    # 1. Terminate any active Edge processes
    $EdgeProcs = @("msedge", "MicrosoftEdgeUpdate", "MicrosoftEdgeElevationService", "identity_helper")
    foreach ($p in $EdgeProcs) { Get-Process $p -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue }

    # 2. Delete Edge services to prevent background activity
    foreach ($s in @("edgeupdate", "edgeupdatem", "MicrosoftEdgeElevationService")) { 
        Stop-Service $s -Force -ErrorAction SilentlyContinue
        & sc.exe delete $s *>$null 
    }

    # 3. Physical Removal: Wipe core directories using recursive takeover
    $EdgePaths = @(
        "${env:ProgramFiles(x86)}\Microsoft\Edge",
        "${env:ProgramFiles(x86)}\Microsoft\EdgeUpdate",
        "${env:ProgramFiles(x86)}\Microsoft\EdgeCore"
    )
    foreach ($f in $EdgePaths) { 
        if (Test-Path $f) { 
            & takeown /f $f /r /a /d y *>$null
            & icacls $f /grant Administrators:F /t /c /l /q *>$null
            Remove-Item $f -Recurse -Force -ErrorAction SilentlyContinue 
        } 
    }
}

Step-Check "7.3 Remove Feedback Hub (Deep Clean)" {
    # Final app removal from current user and system image
    $Name = "Microsoft.WindowsFeedbackHub"
    $App = Get-AppxPackage -Name $Name -AllUsers
    if ($App) { $App | Remove-AppxPackage -AllUsers -ErrorAction SilentlyContinue }
    $ProvApp = Get-AppxProvisionedPackage -Online | Where-Object { $_.DisplayName -eq $Name }
    if ($ProvApp) { Remove-AppxProvisionedPackage -Online -PackageName $ProvApp.PackageName -ErrorAction SilentlyContinue | Out-Null }
}

# =================================================================
# BLOCK 8: EXTENDED TELEMETRY & MONITORING
# =================================================================

Write-Host "`n# --- BLOCK 8: EXTENDED TELEMETRY & MONITORING ---" -ForegroundColor Magenta

Step-Check "8.1 Disable Diagnostic Execution Service" {
    # Stop and disable the service that orchestrates diagnostic data execution
    $s = "diagsvc"
    & taskkill /f /fi "SERVICES eq $s" /t 2>$null
    Stop-Service $s -Force -ErrorAction SilentlyContinue
    $r = "HKLM:\SYSTEM\CurrentControlSet\Services\$s"
    if (Test-Path $r) { Set-ItemProperty $r "Start" 4 -Force }
}

Step-Check "8.2 Disable Camera Frame Monitor" {
    # Disable the FrameServerMonitor service used for camera frame analytics
    $s = "FrameServerMonitor"
    & taskkill /f /fi "SERVICES eq $s" /t 2>$null
    Stop-Service $s -Force -ErrorAction SilentlyContinue
    $r = "HKLM:\SYSTEM\CurrentControlSet\Services\$s"
    if (Test-Path $r) { Set-ItemProperty $r "Start" 4 -Force }
}

Step-Check "8.3 Kill Telemetry Triggers (Device Info)" {
    # Disable device inventory tasks that trigger background system wake-ups in 24H2
    $p = "\Microsoft\Windows\Device Information\"
    foreach ($n in @("Device", "Device User")) {
        Disable-ScheduledTask -TaskName $n -TaskPath $p -ErrorAction SilentlyContinue | Out-Null
    }
}

Step-Check "8.4 Disable Location & Sensor Services" {
    # Force kill and disable location-tracking and sensor-data services
    $Sensors = @("lfsvc", "SensorService", "SensorDataService", "SensorsHidSvc")
    foreach ($s in $Sensors) {
        & taskkill /f /fi "SERVICES eq $s" /t 2>$null
        Stop-Service $s -Force -ErrorAction SilentlyContinue
        $r = "HKLM:\SYSTEM\CurrentControlSet\Services\$s"
        if (Test-Path $r) {
            Set-ItemProperty $r "Start" 4 -Force
            # Wipe recovery actions to ensure the service stays dead
            Set-ItemProperty $r "FailureActions" ([byte[]]@(0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)) -Force
        }
    }
}

# =================================================================
# BLOCK 9: NETWORK ACTIVITY CONTROL
# =================================================================

Write-Host "`n# --- BLOCK 9: NETWORK ACTIVITY CONTROL ---" -ForegroundColor Magenta

Step-Check "9.1 Disable Automatic Root Certificate Update & Network Retrieval (Aggressive Lockdown)" {
    # This registry key prevents CryptSvc from connecting to ctldl.windowsupdate.com and oneocsp.microsoft.com
    # by forcing it to only use local certificate data.
    
    # Define paths
    $pathAuth = "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot"
    $pathChain = "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\ChainEngine"
    
    # 1. Ensure policies exist and are set to disable network updates
    if (-not(Test-Path $pathAuth)) { New-Item $pathAuth -Force | Out-Null }
    Set-ItemProperty $pathAuth "DisableRootAutoUpdate" 1 -Force
    if (-not(Test-Path $pathChain)) { New-Item $pathChain -Force | Out-Null }
    Set-ItemProperty $pathChain "ExcludeHttpUrlsFromNetworkRetrieval" 1 -Force
    Set-ItemProperty $pathChain "DisableNetworkRetrieval" 1 -Force

    # 2. Hard lockdown: Deny 'SetValue' permission to prevent self-healing
    # We apply this to the 'Users' group to prevent any standard-level process from modifying these keys.
    $regPaths = @($pathAuth, $pathChain)
    foreach ($regP in $regPaths) {
        try {
            $acl = Get-Acl $regP
            # Deny 'SetValue' right for all standard users
            $rule = New-Object System.Security.AccessControl.RegistryAccessRule("BUILTIN\Users", "SetValue", "Deny")
            $acl.AddAccessRule($rule)
            Set-Acl $regP $acl -ErrorAction SilentlyContinue | Out-Null
        } catch {
            # This catch handles cases where we might not even have permission to change ACLs (rare)
            Write-Host "Could not lock ACL for $regP, manual intervention might be needed." -ForegroundColor Yellow
        }
    }
}

Step-Check "9.2 Disable Cloud Content Delivery System-Wide" {
    # Enforce system-wide policy to disable all consumer features, tips, and silent app installations.
    $policyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent"
    if (-not(Test-Path $policyPath)) { New-Item $policyPath -Force | Out-Null }

    # DisableWindowsConsumerFeatures: 1 = Disabled
    Set-ItemProperty $policyPath "DisableWindowsConsumerFeatures" 1 -Force
    
    # SubscribedContent-338387Enabled: 0 = Disabled (for Spotlight/Tips)
    $CDM = "HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager"
    if (-not(Test-Path $CDM)) { New-Item $CDM -Force | Out-Null }
    Set-ItemProperty $CDM "SubscribedContent-338387Enabled" 0 -Force
}

Step-Check "9.3 Silence Capability Access Manager (Safe Mode)" {
    # DO NOT disable 'camsvc' to maintain Wi-Fi Flyout and Hotspot functionality.
    

# Instead, block its online verification requests to ://crl.microsoft.com.
    $capPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CapabilityAccessManager"
    if (-not(Test-Path $capPath)) { New-Item $capPath -Force | Out-Null }
    Set-ItemProperty $capPath "DisableOnlineAppCapabilityCheck" 1 -Force

    # Ensure the service is in 'Manual' mode to support local UI requests only
    Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\camsvc" "Start" 3 -Force
    
    # Block network retrieval for certificate chain engine to stop background pings
    $certPath = "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\ChainEngine"
    if (-not(Test-Path $certPath)) { New-Item $certPath -Force | Out-Null }
    Set-ItemProperty $certPath "ExcludeHttpUrlsFromNetworkRetrieval" 1 -Force
    Set-ItemProperty $certPath "DisableNetworkRetrieval" 1 -Force
}

Step-Check "9.4 Force UWP App Policy Refresh (Simplified)" {
    # Force a refresh of user policies, specifically targeting the UWP app container for the Start Menu.
    # This should make StartMenuExperienceHost.exe immediately adhere to the CloudContent policies set in 9.4.

    # 1. Trigger a policy refresh via GPUpdate
    & gpupdate /force | Out-Null
    
    # 2. Use the system tool to cycle the relevant policy cache
    & schtasks.exe /run /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater" *>$null
    
    Write-Host "GPUpdate and schtasks triggered, policies refreshing..." -ForegroundColor Yellow
}

Step-Check "9.5 Aggressive WebView2 Network Lockdown (Fix V3 with ACL)" {
    # Define registry paths
    $pRoot = "HKLM:\SOFTWARE\Policies\Microsoft\Edge\WebView2"
    $pPolicies = "HKLM:\SOFTWARE\Policies\Microsoft\Edge\WebView2\AdditionalPolicies"
    $appID = "MicrosoftWindows.Client.CBS_cw5n1h2txyewy"
    $pFE = "$pPolicies\$appID"
    
    # Ensure paths exist
    if (-not(Test-Path $pRoot)) { New-Item $pRoot -Force | Out-Null }
    if (-not(Test-Path $pPolicies)) { New-Item $pPolicies -Force | Out-Null }
    if (-not(Test-Path $pFE)) { New-Item $pFE -Force | Out-Null }

    # 1. Deny network requests (Value 0 means 'Network Requests Disabled/Denied')
    Set-ItemProperty $pFE "AllowNetworkRequests" 0 -Force
    Set-ItemProperty $pPolicies "AllowNetworkRequests" 0 -Force

    # 2. Hard lockdown: Deny 'SetValue' permission to prevent self-healing
    $regPaths = @($pFE, $pPolicies)
    foreach ($regP in $regPaths) {
        try {
            $acl = Get-Acl $regP
            # Deny 'SetValue' right for all standard users
            $rule = New-Object System.Security.AccessControl.RegistryAccessRule("BUILTIN\Users", "SetValue", "Deny")
            $acl.AddAccessRule($rule)
            Set-Acl $regP $acl -ErrorAction SilentlyContinue | Out-Null
        } catch {
            Write-Host "Could not lock ACL for $regP, manual intervention might be needed." -ForegroundColor Yellow
        }
    }

    # Optional: Disable default browser check for the main Edge install
    $pEdge = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"
    if (-not(Test-Path $pEdge)) { New-Item $pEdge -Force | Out-Null }
    Set-ItemProperty $pEdge "DisableDefaultBrowserCheck" 1 -Force
}
# =================================================================
# FINALIZATION (Standalone Steps)
# =================================================================

# --- PRIVACY ENFORCEMENT ---
# Enforce global location privacy by overriding the ConsentStore value
Write-Host "`n# --- FINAL PRIVACY ENFORCEMENT ---" -ForegroundColor Magenta
$loc = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location"
if (-not(Test-Path $loc)) { New-Item $loc -Force | Out-Null }
Set-ItemProperty $loc "Value" "Deny" -Force
Write-Host "Location access globally set to DENY [SUCCESS]" -ForegroundColor Green

# --- SYSTEM HYGIENE ---
# Wiping all Windows Event Logs to clear traces of optimization
Write-Host "`n# --- CLEANING SYSTEM EVENT LOGS ---" -ForegroundColor Magenta
$logs = Get-WinEvent -ListLog * -ErrorAction SilentlyContinue
foreach ($log in $logs) {
    try { [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($log.LogName) } catch {}
}
Write-Host "All system event logs have been cleared [SUCCESS]" -ForegroundColor Green

Write-Host "`n--- GOLDEN SCRIPT: SYSTEM OPTIMIZED SUCCESSFULLY ---" -ForegroundColor Cyan
Write-Host "Press any key to exit..."
$null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")

}