# =================================================================
# GOLDEN OPTIMIZATION SCRIPT (v5) - Windows 11 24H2
# =================================================================
& {
if (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(544)) { Start-Process PowerShell "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs; exit }
$ErrorActionPreference = "Stop"
function Step-Check($Name, $Action) { try { $res = & $Action; if ($res -eq "NOT_FOUND") { Write-Host "$Name [ERROR]" -ForegroundColor Yellow; Write-Host "  >> Details: Target object not found." -ForegroundColor Yellow } elseif ($res -eq "SKIP") { Write-Host "$Name [ERROR]" -ForegroundColor Yellow; Write-Host "  >> Details: Object already in target state (no action needed)." -ForegroundColor Yellow } else { Write-Host "$Name [SUCCESS]" -ForegroundColor Green } } catch { Write-Host "$Name [ERROR]" -ForegroundColor Red; Write-Host "  >> Details: $($_.Exception.Message)" -ForegroundColor Red } }

# =================================================================
# BLOCK 1: KILL PROCESSES
# 
Write-Host "`n# --- BLOCK 1: KILL PROCESSES ---" -F Magenta; $proc = "WaaSMedicAgent","CompatTelRunner","MicrosoftEdgeUpdate","MoUsoCoreWorker","USOClient"; $j = 1; foreach ($n in $proc) { Step-Check "1.$j Kill process: $n" { $p = Get-Process $n -EA 0; if (!$p) { "SKIP" } else { try { $p | Stop-Process -Force -EA Stop } catch { throw "Failed to terminate $n. Access denied." } } }; $j++ }

# =================================================================
# BLOCK 2: FILES, PERMISSIONS & RECOVERY LOCKDOWN
# 
Write-Host "`n# --- BLOCK 2: FILES, PERMISSIONS & RECOVERY LOCKDOWN ---" -F Magenta; 

Step-Check "2.1 Neutralize Core Executables" { $t = @("C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe","C:\Windows\System32\WaaSMedicSvc.dll","C:\Windows\System32\usoclient.exe","C:\Windows\System32\MoUsoCoreWorker.exe","C:\Windows\System32\CompatTelRunner.exe","C:\Windows\System32\dmwappushservice.dll"); $b = "taskkill /f /im usoclient.exe /t >nul 2>&1`r`ntaskkill /f /im MoUsoCoreWorker.exe /t >nul 2>&1`r`n"; foreach ($f in $t) { $b += "if exist `"$f`" (takeown /f `"$f`" /a >nul && icacls `"$f`" /grant Administrators:F /q >nul && attrib -s -h -r `"$f`" >nul && (if not exist `"$f.bak`" (move /y `"$f`" `"$f.bak`" >nul) else (del /f /q `"$f`" >nul)) && echo. > `"$f`" && icacls `"$f`" /inheritance:r /deny Everyone:(F) /q >nul)`r`n" }; $p = "$env:TEMP\sb.bat"; $b | Out-File $p -Encoding OEM; try { $a = New-ScheduledTaskAction -Execute "cmd.exe" -Argument "/c $p"; $pr = New-ScheduledTaskPrincipal -UserId "NT AUTHORITY\SYSTEM" -RunLevel Highest; Register-ScheduledTask "SysBlocker" -Action $a -Principal $pr -Force >$null; Start-ScheduledTask "SysBlocker"; Start-Sleep -s 3; $ConfirmPreference = 'None'; Unregister-ScheduledTask "SysBlocker" -Confirm:$false -EA 0; if(Test-Path $p){rm $p -Force} } catch { throw "SYSTEM elevation failed" } }; 

Step-Check "2.2 Disable & Neutralize ContentDeliveryManager (System App Lockdown)" {try{$changed=$false;$ifeo="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options";$p="HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent";if(!(Test-Path $p)){ni $p -Force>$null};$rm="HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\ReserveManager";if(!(Test-Path $rm)){ni $rm -Force>$null};$pol=@{"DisableWindowsConsumerFeatures"=1;"DisableWindowsSpotlightFeatures"=1;"DisableCloudOptimizedContent"=1};foreach($k in $pol.Keys){if((gp $p -EA 0).$k -ne $pol[$k]){sp $p $k $pol[$k] -Force -Type DWord;$changed=$true}}if((gp $rm -EA 0).ShippedWithReserves -ne 0){sp $rm "ShippedWithReserves" 0 -Force -Type DWord;$changed=$true};$path="C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy";if(Test-Path $path){takeown /f "$path\*" /a /d y>$null;icacls "$path\*" /grant Administrators:F /q>$null;gci "$path\*.exe" -EA 0|%{if($_.Name -notlike "*.bak*"){Rename-Item $_.FullName "$($_.Name).bak" -Force;$changed=$true}}};@("ContentDeliveryManager.exe","ShellExperienceHost.exe","StartMenuExperienceHost.exe")|%{$k="$ifeo\$_";if(!(Test-Path $k)){ni $k -Force>$null};if((gp $k -EA 0).Debugger -ne "cmd.exe /c exit"){sp $k Debugger "cmd.exe /c exit" -Force;$changed=$true}};Get-ScheduledTask -TaskPath "\Microsoft\Windows\ContentDeliveryManager\" -EA 0|%{if($_.State -ne "Disabled"){Disable-ScheduledTask $_>$null;$changed=$true}};if($changed){"SUCCESS"}else{"SKIP"}}catch{throw "Lockdown failed: $($_.Exception.Message)"}
}

Step-Check "2.3 Create Admin Shortcuts" { try { $W = New-Object -ComObject WScript.Shell; $L = $W.CreateShortcut("$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Services.lnk"); $L.TargetPath = "mmc.exe"; $L.Arguments = "services.msc"; $L.Save() } catch { throw "Shortcut creation failed" } }

# =================================================================
# BLOCK 3: SERVICES (HARD LOCKDOWN & ACL LOCK)
# 
Write-Host "`n# --- BLOCK 3: SERVICES (HARD LOCKDOWN & ACL LOCK) ---" -F Magenta; $services = "wlidsvc","wersvc","InstallService","dmwappushservice","wuauserv","DiagTrack"; $i = 1; foreach ($s in $services) { Step-Check "3.$i disable & block service: $s" { $r = "HKLM:\SYSTEM\CurrentControlSet\Services\$s"; if (!(Test-Path $r)) { "NOT_FOUND" } else { $succ = $false; if ((gp $r -EA 0).Start -ne 4) { & sc.exe config $s start= disabled >$null 2>&1; if ($LASTEXITCODE -eq 0) { $succ = $true }; Stop-Service $s -Force -EA 0 } else { $succ = "SKIP" }; $e = switch($s){ "WaaSMedicSvc"{"WaaSMedicAgent.exe"} "DiagTrack"{"diagtrack.exe"} "wuauserv"{"UsoClient.exe"} "wersvc"{"WerFault.exe"} default{$null} }; if ($e) { $ip = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$e"; try { if (!(Test-Path $ip)) { ni $ip -Force >$null }; sp $ip "Debugger" "cmd.exe /c exit" -Type String -Force; if ($succ -eq "SKIP") { $succ = "SUCCESS_EXTRA" } else { $succ = $true } } catch {} }; if ($succ -eq "SUCCESS_EXTRA") { "SUCCESS" } elseif ($succ -eq "SKIP") { "SKIP" } elseif ($succ) { "SUCCESS" } else { "FAIL" } } }; $i++ }

# =================================================================
# BLOCK 4: TASK SCHEDULER (HARD LOCKDOWN)
# 
Write-Host "`n# --- BLOCK 4: TASK SCHEDULER (HARD LOCKDOWN) ---" -F Magenta

Step-Check "4.1 Disable Appraiser & Compatibility Triggers" { $p = "\Microsoft\Windows\Application Experience\"; @("Microsoft Compatibility Appraiser","Microsoft Compatibility Appraiser Exp","StartupAppTask","PcaPatchDbTask","SdbinstMergeDbTask","ProgramDataUpdater") | % { Disable-ScheduledTask -TaskName $_ -TaskPath $p -EA 0 >$null } }

Step-Check "4.2 Disable USoClient, CEIP & WAP Triggers" { $g = @{ "\Microsoft\Windows\UpdateOrchestrator\" = "Universal Orchestrator Idle Start","Schedule Scan","UUS Failover Task","USO_UxBroker","Start Oobe Expedite Work"; "\Microsoft\Windows\Customer Experience Improvement Program\" = "Consolidator","UsbCeip"; "\Microsoft\Windows\Feedback\Siuf\" = "DmClient","DmClientOnScenarioDownload" }; $g.Keys | % { $pt = $_; $g[$pt] | % { $n = $_; Disable-ScheduledTask $n $pt -EA 0 >$null; $a = New-ScheduledTaskAction -Execute "cmd.exe" -Argument "/c exit"; Set-ScheduledTask $n $pt -Action $a -EA 0 >$null; $f = "C:\Windows\System32\Tasks\Microsoft\Windows$pt$n"; if (Test-Path $f) { & takeown /f $f /a /d y >$null; & icacls $f /grant Administrators:F /c /l /q >$null; if ($f -notlike "*.bak") { Move-Item $f "$f.bak" -Force -EA 0; ni $f -Type Directory -Force >$null; & icacls $f /inheritance:r /deny "Everyone:(F)" /c /q >$null } } } } }

Step-Check "4.3 Neutralize Static Repair Trigger" { $n="Schedule Scan Static Task"; $p="\Microsoft\Windows\UpdateOrchestrator\"; $f="C:\Windows\System32\Tasks\Microsoft\Windows$p$n"; Disable-ScheduledTask $n $p -EA 0 >$null; sp "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\$n" "Enabled" 0 -Force -EA 0 >$null; if (Test-Path $f) { & takeown /f $f /a /d y >$null; & icacls $f /grant Administrators:F /c /l /q >$null; "" | Out-File $f -Force -EA 0 } }

Step-Check "4.4 Kill SdbinstMergeDbTask (File)" { $f = "C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\SdbinstMergeDbTask"; if (!(Test-Path $f)) { "NOT_FOUND" } elseif (Test-Path "$f.bak") { "SKIP" } else { try { & takeown /f $f /a >$null; & icacls $f /grant Administrators:F >$null; ren $f "SdbinstMergeDbTask.bak" -Force -EA Stop } catch { throw $_ } } }

Step-Check "4.5 Block WU Resurrection" { $b = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree"; @("\Microsoft\Windows\WindowsUpdate\ScanForUpdates","\Microsoft\Windows\SecureBoot\Secure-Boot-Update","\Microsoft\Windows\UpdateOrchestrator\Schedule Scan") | % { $r = "$b$_"; if (Test-Path $r) { sp $r "Enabled" 0 -Force -EA 0; $acl = Get-Acl $r; $acl.SetAccessRuleProtection($true, $false); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule("Everyone","SetValue","Deny"))); Set-Acl $r $acl -EA 0 >$null } } }

Step-Check "4.6 Create WeeklyCleanUp Task" { try { $A = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-Command `"rm 'C:\Windows\Temp\*', '$env:TEMP\*' -Recurse -Force -EA 0`""; Register-ScheduledTask -TaskName "WeeklyCleanUp" -Action $A -Trigger (New-ScheduledTaskTrigger -Weekly -DaysOfWeek Wednesday -At 3:00AM) -Force >$null } catch { throw "Task creation failed" } }

# =================================================================
# BLOCK 5: REGISTRY (SYSTEM POLICIES)
# 
Write-Host "`n# --- BLOCK 5: REGISTRY (SYSTEM POLICIES) ---" -F Magenta

Step-Check "5.1 Disable Error Reporting Registry" { $p = "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting"; if (!(Test-Path $p)) { ni $p -Force >$null }; sp $p "Disabled" 1 -Force }

Step-Check "5.2 Disable SIH (Hard Lockdown)" { try { $n = "SihClient.exe"; $r = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$n"; if (!(Test-Path $r)) { ni $r -Force >$null }; sp $r "Debugger" "systray.exe" -Force; $f = "C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Sih"; if (Test-Path $f) { & takeown /f $f /a >$null; & icacls $f /grant Administrators:F >$null; & icacls $f /inheritance:r /deny Everyone:(F) /q >$null }; "SUCCESS" } catch { throw "IFEO Lockdown failed" } }

Step-Check "5.3 Cloud Content (Deep Enforcement)" { try { $tn = "CloudFix"; $sc = "reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent' /v 'DisableWindowsConsumerFeatures' /t REG_DWORD /d 1 /f; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent' /v 'DisableSoftLanding' /t REG_DWORD /d 1 /f; reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' /v 'SettingsPageVisibility' /t REG_SZ /d 'hide:windowsupdate' /f"; $a = New-ScheduledTaskAction -Execute "cmd.exe" -Argument "/c powershell -Command `"$sc`""; Register-ScheduledTask $tn -Action $a -User "SYSTEM" -RunLevel Highest -Force >$null; Start-ScheduledTask $tn; Start-Sleep -s 1; schtasks.exe /delete /tn $tn /f >$null 2>&1 } catch { throw "Cloud lockdown failed" } }

Step-Check "5.4 Disable Telemetry Policy" { $p = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection"; if (!(Test-Path $p)) { ni $p -Force >$null }; sp $p "AllowTelemetry" 0 -Force; sp $p "MaxTelemetryAllowed" 0 -Force }

Step-Check "5.5 Silence Windows Update Notifications" { $p = "HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings"; if (!(Test-Path $p)) { ni $p -Force >$null }; sp $p "UxOption" 1 -Force }

Step-Check "5.6 Disable PowerShell Update & Discovery" { [Environment]::SetEnvironmentVariable("POWERSHELL_UPDATECHECK", "Off", "Machine"); [Environment]::SetEnvironmentVariable("POWERSHELL_TELEMETRY_OPTOUT", "1", "Machine"); $p = "HKLM:\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell"; if (!(Test-Path $p)) { ni $p -Force >$null }; sp $p "DisableModuleAutoDiscovery" 1 -Force }

Step-Check "5.7 Disable Shadow Updates (Nuclear)" { try { $tn = "ShadowFix"; $sc = "reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator' /v 'EnableUUPScan' /t REG_DWORD /d 0 /f; reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Remediation' /v 'Disabled' /t REG_DWORD /d 1 /f; reg add 'HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdateHealthTools' /v 'IsSelfUpdateEnabled' /t REG_DWORD /d 0 /f"; $a = New-ScheduledTaskAction -Execute "cmd.exe" -Argument "/c $sc"; Register-ScheduledTask $tn -Action $a -User "SYSTEM" -RunLevel Highest -Force >$null; Start-ScheduledTask $tn; Start-Sleep -s 1; schtasks.exe /delete /tn $tn /f >$null 2>&1 } catch { throw "Nuclear lockdown failed" } }

Step-Check "5.8 Disable Silent Features & Notifications" { $r = "HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager"; if (!(Test-Path $r)) { ni $r -Force >$null }; if ((gp $r -EA 0).SilentInstalledAppsEnabled -eq 0) { "SKIP" } else { sp $r "SilentInstalledAppsEnabled" 0 -Force; sp $r "SubscribedContent-338389Enabled" 0 -Force; sp $r "SubscribedContent-353694Enabled" 0 -Force; sp $r "SubscribedContent-353696Enabled" 0 -Force; sp $r "SystemPaneSuggestionsEnabled" 0 -Force } ; $p = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications"; if (!(Test-Path $p)) { ni $p -Force >$null }; sp $p "NoToastApplicationNotification" 1 -Force; $o = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE"; if (!(Test-Path $o)) { ni $o -Force >$null }; sp $o "DisablePrivacyExperience" 1 -Force }

# =================================================================
# BLOCK 6: REGISTRY (INTERFACE & UX)
# 
Write-Host "`n# --- BLOCK 6: REGISTRY (INTERFACE & UX) ---" -F Magenta

Step-Check "6.1 Enable Run History" { $p = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"; if (!(Test-Path $p)) { ni $p -Force >$null }; if ([string](gp $p -EA 0).Start_TrackProgs -eq "1") { "SKIP" } else { sp $p "Start_TrackProgs" 1 -Force } }

Step-Check "6.2 Enable Recommended Items" { $p = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"; if (!(Test-Path $p)) { ni $p -Force >$null }; if ([string](gp $p -EA 0).Start_TrackDocs -eq "1") { "SKIP" } else { sp $p "Start_TrackDocs" 1 -Force } }

Step-Check "6.3 Force User Consent (webcam)" { $u="HKCU:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam"; $m="HKLM:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam"; if(!(Test-Path $u)){ni $u -Force >$null}; if(!(Test-Path $m)){ni $m -Force >$null}; if((gp $u -EA 0).Value -eq "Deny" -and (gp $m -EA 0).Value -eq "Deny"){"SKIP"}else{sp $u "Value" "Deny" -Force; sp $m "Value" "Deny" -Force} }

Step-Check "6.4 Force User Consent (microphone)" { $u="HKCU:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone"; $m="HKLM:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone"; if(!(Test-Path $u)){ni $u -Force >$null}; if(!(Test-Path $m)){ni $m -Force >$null}; if((gp $u -EA 0).Value -eq "Deny" -and (gp $m -EA 0).Value -eq "Deny"){"SKIP"}else{sp $u "Value" "Deny" -Force; sp $m "Value" "Deny" -Force} }

Step-Check "6.5 Disable Widgets" { $p = "HKLM:\SOFTWARE\Policies\Microsoft\Dsh"; if (!(Test-Path $p)) { ni $p -Force >$null }; if ([string](gp $p -EA 0).AllowNewsAndInterests -eq "0") { "SKIP" } else { sp $p "AllowNewsAndInterests" 0 -Force } }

Step-Check "6.6 Disable Windows Spotlight" { $r = "HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager"; if (!(Test-Path $r)) { ni $r -Force >$null }; if ([string](gp $r -EA 0).RotatingLockScreenEnabled -eq "0") { "SKIP" } else { sp $r "RotatingLockScreenEnabled" 0 -Force; sp $r "RotatingLockScreenOverlayEnabled" 0 -Force } }

Step-Check "6.7 Disable Setup Notifications" { $p = "HKCU:\Software\Microsoft\Windows\CurrentVersion\UserProfileEngagement"; if (!(Test-Path $p)) { ni $p -Force >$null }; if ([string](gp $p -EA 0).ScoobeSystemSettingEnabled -eq "0") { "SKIP" } else { sp $p "ScoobeSystemSettingEnabled" 0 -Force } }

# =================================================================
# BLOCK 7: APPS REMOVAL (HARDCORE CLEANUP)
# 
Write-Host "`n# --- BLOCK 7: APPS REMOVAL ---" -F Magenta

Step-Check "7.1 Clean OneDrive Residuals" { ps OneDrive -EA 0 | stop-process -Force -EA 0; $d = @("$env:LocalAppData\Microsoft\OneDrive","$env:UserProfile\OneDrive","C:\OneDriveTemp"); $c = "HKCR:\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}"; $exists = $d | ? { Test-Path $_ }; $reg = (gp $c -EA 0)."System.IsPinnedToNameSpaceTree"; if (!$exists -and ([string]$reg -eq "0" -or !$reg)) { "SKIP" } else { $d | % { if (Test-Path $_) { rm $_ -Recurse -Force -EA 0 } }; if (Test-Path $c) { sp $c "System.IsPinnedToNameSpaceTree" 0 -Force } } }

Step-Check "7.2 Neutralize Microsoft Edge (Eradication)" { @("msedge","MicrosoftEdgeUpdate","MicrosoftEdgeElevationService","identity_helper") | % { ps $_ -EA 0 | stop-process -Force -EA 0 }; @("edgeupdate","edgeupdatem","MicrosoftEdgeElevationService") | % { Stop-Service $_ -Force -EA 0; & sc.exe delete $_ >$null 2>&1 }; $paths = @("${env:ProgramFiles(x86)}\Microsoft\Edge","${env:ProgramFiles(x86)}\Microsoft\EdgeUpdate","${env:ProgramFiles(x86)}\Microsoft\EdgeCore"); $rem = $paths | ? { Test-Path $_ }; if (!$rem) { "SKIP" } else { $rem | % { & takeown /f $_ /r /a /d y >$null; & icacls $_ /grant Administrators:F /t /c /l /q >$null; rm $_ -Recurse -Force -EA 0 } } }

Step-Check "7.3 Remove & Permanent Block Feedback Hub" { $n="Microsoft.WindowsFeedbackHub"; $e="FeedbackHub.exe"; $a=Get-AppxPackage $n -AllUsers -EA 0; $p=Get-AppxProvisionedPackage -Online -EA 0 | ?{$_.DisplayName -eq $n}; $ip="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$e"; if(!$a -and !$p -and (Test-Path $ip)){ "SKIP" } else { try { $ch=$false; if($a){$a|Remove-AppxPackage -AllUsers -EA 0; $ch=$true}; if($p){Remove-AppxProvisionedPackage -Online -PackageName $p.PackageName -EA 0|Out-Null; $ch=$true}; if(!(Test-Path $ip)){ni $ip -Force|Out-Null}; sp $ip "Debugger" "cmd.exe /c exit" -Type String -Force; $ch=$true; $cp="HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent"; if(!(Test-Path $cp)){ni $cp -Force|Out-Null}; sp $cp "DisableWindowsConsumerFeatures" 1 -Type DWord -Force; if($ch){"SUCCESS"}else{"SKIP"} } catch {"FAIL"} } }

# =================================================================
# BLOCK 8: EXTENDED TELEMETRY & MONITORING
# 
Write-Host "`n# --- BLOCK 8: EXTENDED TELEMETRY & MONITORING ---" -F Magenta

Step-Check "8.1 Disable Diagnostic Execution Service" { $s="diagsvc"; $r="HKLM:\SYSTEM\CurrentControlSet\Services\$s"; if(!(Test-Path $r)){"NOT_FOUND"} elseif([string](gp $r -EA 0).Start -eq "4"){"SKIP"} else { & taskkill /f /fi "SERVICES eq $s" /t 2>$null >$null; Stop-Service $s -Force -EA 0; sp $r "Start" 4 -Force } }

Step-Check "8.2 Disable Camera Frame Monitor" { $s="FrameServerMonitor"; $r="HKLM:\SYSTEM\CurrentControlSet\Services\$s"; if(!(Test-Path $r)){"NOT_FOUND"} elseif([string](gp $r -EA 0).Start -eq "4"){"SKIP"} else { & taskkill /f /fi "SERVICES eq $s" /t 2>$null >$null; Stop-Service $s -Force -EA 0; sp $r "Start" 4 -Force } }

Step-Check "8.3 Kill Telemetry Triggers (Device Info)" { $p="\Microsoft\Windows\Device Information\"; $tasks = @("Device","Device User"); $st = $tasks | % { if((Get-ScheduledTask $_ -TaskPath $p -EA 0).State -ne "Disabled") { Disable-ScheduledTask $_ -TaskPath $p -EA 0 >$null; $true } }; if ($st -contains $true) { "SUCCESS" } else { "SKIP" } }

Step-Check "8.4 Disable Location & Sensor Services" { $sList = @("lfsvc","SensorService","SensorDataService","SensorsHidSvc"); $changed = $false; foreach ($s in $sList) { $r="HKLM:\SYSTEM\CurrentControlSet\Services\$s"; if(Test-Path $r){ if([string](gp $r -EA 0).Start -ne "4"){ & taskkill /f /fi "SERVICES eq $s" /t 2>$null >$null; Stop-Service $s -Force -EA 0; sp $r "Start" 4 -Force; sp $r "FailureActions" ([byte[]]@(0)*16) -Force; $changed = $true } } }; if($changed){ "SUCCESS" } else { "SKIP" } }

# =================================================================
# BLOCK 9: SURGICAL NETWORK ISOLATION (WFP METHOD)
# 
Write-Host "`n# --- BLOCK 9: SURGICAL NETWORK ISOLATION ---" -F Magenta;

Step-Check "9.1 Apex network isolation (ultra-refined)" { $wr="HKLM:\SOFTWARE\Policies\Microsoft\Edge\WebView2\AdditionalPolicies\MicrosoftWindows.Client.CBS_cw5n1h2txyewy"; $ni="HKLM:\Software\Policies\Microsoft\Windows\NetworkIsolation"; if([string](gp $wr -EA 0).AllowNetworkRequests -eq "0" -and (Test-Path $ni)) { "SKIP" } else { try { $tn="ApexNuclear"; $bp="$env:TEMP\an.ps1"; $bc="`$ex=@('SearchHost.exe','StartMenuExperienceHost.exe','msedgewebview2.exe'); `$ni='Software\Policies\Microsoft\Windows\NetworkIsolation'; `$t=`"HKEY_LOCAL_MACHINE\`" + `$ni + `" [1 5 7 11 17] `"; `$t | Out-File `$env:TEMP\r.txt -Enc ascii; & regini.exe `$env:TEMP\r.txt; reg add ('HKLM\' + `$ni) /v 'EnterpriseIPRange' /t REG_DWORD /d 0 /f; foreach(`$e in `$ex){ reg add ('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\' + `$e) /v 'AppExecutionAliasRedirect' /t REG_SZ /d 'http_proxy=127.0.0.1:1;https_proxy=127.0.0.1:1' /f }; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Edge\WebView2\AdditionalPolicies\MicrosoftWindows.Client.CBS_cw5n1h2txyewy' /v 'AllowNetworkRequests' /t REG_DWORD /d 0 /f; & CheckNetIsolation.exe LoopbackExempt -c; rm `$env:TEMP\r.txt -EA 0"; $bc | Out-File $bp -Enc UTF8; $a=New-ScheduledTaskAction -Execute "powershell.exe" -Arg "-NoP -ExecutionPolicy Bypass -File `"$bp`""; Register-ScheduledTask $tn -Action $a -User "SYSTEM" -RunLevel Highest -Force >$null; Start-ScheduledTask $tn; Start-Sleep -s 4; schtasks.exe /delete /tn $tn /f >$null 2>&1; if(Test-Path $bp){rm $bp -Force} } catch { throw "Apex Isolation failed" } } }

# =================================================================
# BLOCK 10: ULTIMATE CHAMELEON & SIH LOCKDOWN (SAFE ISOLATION + STEALTH)
# 
Write-Host "`n# --- BLOCK 10: ULTIMATE CHAMELEON & SIH LOCKDOWN ---" -F Magenta; 

Step-Check "10.1 Ultimate Chameleon & SIH Lockdown" { $sc="HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\SIH"; $f="C:\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\sih"; if([string](gp $sc -EA 0).Url -eq "http://127.0.0.1" -and (Test-Path $f -PathType Container)) { "SKIP" } else { try { $tn="ChamFinal"; $bp="$env:TEMP\ch.bat"; $bc="@echo off`r`nreg add `"$sc`" /v `"Url`" /t REG_SZ /d `"http_proxy=127.0.0.1:1`" /f >nul 2>&1`r`n"; $bc+="takeown /f `"$f`" /a >nul 2>&1 && icacls `"$f`" /grant Administrators:F /q >nul 2>&1`r`n"; $bc+="del /f /q `"$f`" >nul 2>&1 && mkdir `"$f`" >nul 2>&1 && icacls `"$f`" /inheritance:r /deny Everyone:(F) /q >nul 2>&1"; $bc|Out-File $bp -Enc OEM; $a=New-ScheduledTaskAction -Execute "cmd.exe" -Arg "/c $bp"; Register-ScheduledTask $tn -Action $a -User "SYSTEM" -RunLevel Highest -Force >$null; Start-ScheduledTask $tn; Start-Sleep -s 4; schtasks.exe /delete /tn $tn /f >$null 2>&1; rm $bp -EA 0; if(!(Test-Path $f -PathType Container)){throw "FileLockFail"} } catch { throw $_ } } }

# --- BLOCK 11: EDGEUPDATE HARDENING & PROTECTION ---
Write-Host "`n# --- BLOCK 11: EDGEUPDATE HARDENING & PROTECTION ---" -F Magenta; Step-Check "11.1 EdgeUpdate - Total Annihilation" { $res="SUCCESS"; $det=$null; $changed=$false; try{ $ex=@('MicrosoftEdgeUpdate.exe','MicrosoftEdgeUpdateComRegisterShell.exe','MicrosoftEdgeUpdateCore.exe'); foreach($e in $ex){ $k="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$e"; if(!(Test-Path $k)){ni $k -Force|Out-Null; $changed=$true} else{ $dbg=(gp $k Debugger -EA 0).Debugger; if($dbg -ne "svchost.exe"){sp $k Debugger "svchost.exe" -Force -EA Stop; $changed=$true}} } $p="${env:ProgramFiles(x86)}\Microsoft\EdgeUpdate"; if(Test-Path $p){ Rename-Item $p "$p_blocked_$(Get-Date -Format yyyyMMdd-HHmmss)" -Force -EA Stop; $changed=$true } $sv=@('edgeupdate','edgeupdatem'); foreach($s in $sv){ $svc=Get-Service $s -EA 0; if($svc){ if($svc.StartType -ne "Disabled"){Set-Service $s -StartupType Disabled -EA 0; $changed=$true} if($svc.Status-eq'Running'){Stop-Service $s -Force -EA 0; $changed=$true} } } if(!$changed){$res="SKIP"} } catch{$res="FAIL";$det=$_.Exception.Message}; $res; if($det){Write-Host " >> Details: $det" -F Red} }

# =================================================================
# BLOCK 12: DOsvc FULL LOCKDOWN (FINAL 24H2)
# 
Write-Host "`n# --- BLOCK 12: DOsvc FULL LOCKDOWN ---" -F Magenta

Step-Check "12.1 DoSvc service, policy & tasks - Total Lockdown" { $sc="HKLM:\SYSTEM\CurrentControlSet\Services\DoSvc"; $p="HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization"; if((gp $sc -EA 0).Start -eq 4){ "SKIP" }else{ $tn="DoFinal"; $bp="$env:TEMP\do.bat"; $bc="@echo off`r`nsc stop DoSvc >nul 2>&1`r`nsc config DoSvc start= disabled >nul 2>&1`r`nreg add `"$sc`" /v Start /t REG_DWORD /d 4 /f >nul 2>&1`r`nreg add `"$sc`" /v FailureActions /t REG_BINARY /d 00000000000000000000000000000000 /f >nul 2>&1`r`nreg add `"$p`" /f >nul 2>&1`r`nreg add `"$p`" /v DODownloadMode /t REG_DWORD /d 0 /f >nul 2>&1`r`n"; @("\Microsoft\Windows\DeliveryOptimization\","\Microsoft\Windows\ContentDeliveryManager\") | % { $ts="C:\Windows\System32\Tasks\Microsoft\Windows$_"; $bc+="takeown /f `"$ts*`" /a >nul 2>&1 && icacls `"$ts*`" /grant Administrators:F /q >nul 2>&1`r`n"; $bc+="for /f `"delims=`" %%a in ('dir /b /a-d `"$ts*`"') do (if not `"%%~xa`"==`".bak`" (move /y `"$ts%%a`" `"$ts%%a.bak`" >nul 2>&1 && mkdir `"$ts%%a`" >nul 2>&1 && icacls `"$ts%%a`" /inheritance:r /deny Everyone:(F) /q >nul 2>&1))`r`n" }; $bc|Out-File $bp -Enc OEM; $a=New-ScheduledTaskAction -Execute "cmd.exe" -Arg "/c $bp"; Register-ScheduledTask $tn -Action $a -User "SYSTEM" -RunLevel Highest -Force >$null; Start-ScheduledTask $tn; Start-Sleep -s 6; schtasks.exe /delete /tn $tn /f >$null 2>&1; rm $bp -EA 0; "SUCCESS" } }

if ((gp "HKLM:\SYSTEM\CurrentControlSet\Services\DoSvc" -EA 0).Start -ne 4) { Write-Host "  >> DoSvc Start=4 not applied immediately (24H2 kernel protection)." -ForegroundColor Yellow; Write-Host "  >> Details: Change will take effect after reboot." -ForegroundColor Yellow }

Step-Check "12.2 Registry ACL Hardening" { $sc="HKLM:\SYSTEM\CurrentControlSet\Services\DoSvc"; try { $acl=Get-Acl $sc -EA Stop; $u="BUILTIN\Users"; $sy="NT AUTHORITY\SYSTEM"; $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($u,"SetValue","Deny"))); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($sy,"SetValue","Deny"))); Set-Acl $sc $acl -EA Stop; "SUCCESS" } catch { if($_.Exception.Message -like "*allowed*" -or $_.Exception.Message -like "*denied*") { "SKIP" } else { throw $_ } } }

# =================================================================
# BLOCK 13: OFFICE CLICK-TO-RUN - TOTAL ANNIHILATION (LTSC 2024)
# 
Write-Host "`n# --- BLOCK 13: OFFICE CLICK-TO-RUN ANNIHILATION ---" -F Magenta

Step-Check "13.1 Kill, Hard-Lock & Trap Office CTR" { $res="SKIP"; $det=$null; try { $ch=$false; $s="ClickToRunSvc"; $r="HKLM:\SYSTEM\CurrentControlSet\Services\$s"; $ex="OfficeClickToRun.exe"; $i="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$ex"; $t='[DllImport("advapi32.dll",SetLastError=true)]public static extern bool OpenProcessToken(IntPtr h,int a,ref IntPtr t);[DllImport("advapi32.dll",CharSet=CharSet.Auto,SetLastError=true)]public static extern bool LookupPrivilegeValue(string s,string n,ref long l);[DllImport("advapi32.dll",SetLastError=true)]public static extern bool AdjustTokenPrivileges(IntPtr t,bool d,ref long p,int b,IntPtr p2,IntPtr p3);'; $ad=Add-Type -MemberDefinition $t -Name "Priv$(Get-Random)" -PassThru; $tk=[IntPtr]::Zero; if($ad::OpenProcessToken([System.Diagnostics.Process]::GetCurrentProcess().Handle,0x0020,[ref]$tk)){$l=0L; if($ad::LookupPrivilegeValue($null,"SeTakeOwnershipPrivilege",[ref]$l)){$ad::AdjustTokenPrivileges($tk,$false,[ref]$l,0,[IntPtr]::Zero,[IntPtr]::Zero)}}; if((Get-ItemProperty $i -EA 0).Debugger -ne "svchost.exe"){ if(!(Test-Path $i)){New-Item $i -Force | Out-Null}; Set-ItemProperty $i "Debugger" "svchost.exe" -Force; $ch=$true }; @("\Microsoft\Office\Office ClickToRun Service Monitor","\Microsoft\Office\Office Automatic Updates 2.0","\Microsoft\Office\Office Feature Updates") | ForEach-Object { $tp="C:\Windows\System32\Tasks$_"; if(Test-Path $tp -PathType Leaf){ & takeown /f $tp /a | Out-Null; & icacls $tp /grant Administrators:F /q | Out-Null; Remove-Item $tp -Force; New-Item $tp -Type Directory -Force | Out-Null; & icacls $tp /inheritance:r /deny Everyone:(F) /q | Out-Null; $ch=$true } }; if(Test-Path $r){ if((Get-ItemProperty $r).Start -ne 4){ $svc=Get-Service $s -EA 0; if($svc -and $svc.Status -eq "Running"){Stop-Service $s -Force -EA 0}; & sc.exe config $s start= disabled | Out-Null; Set-ItemProperty $r "Start" 4 -Type DWord -Force; $acl=Get-Acl $r; $sy="S-1-5-18"; $ad_s="S-1-5-32-544"; $acl.SetOwner((New-Object System.Security.Principal.SecurityIdentifier($ad_s))); $acl.SetAccessRuleProtection($true,$false); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($sy,"FullControl","Deny"))); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($ad_s,"FullControl","Deny"))); Set-Acl $r $acl -EA Stop; $ch=$true } }; if($ch){$res="SUCCESS"} } catch { $res="FAIL"; $det=$_.Exception.Message }; if($det){Write-Host " >> Details: $det" -F Red}; $res }

Step-Check "13.2 Kill & Hard-Lock Office SDXHelper" { $res="SKIP"; $det=$null; try { $ch=$false; $ex="sdxhelper.exe"; $i="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$ex"; if((gp $i -EA 0).Debugger -ne "svchost.exe"){ if(!(Test-Path $i)){ni $i -Force | Out-Null}; sp $i "Debugger" "svchost.exe" -Force; $ch=$true }; $p=@("${env:ProgramFiles}\Common Files\microsoft shared\ClickToRun\$ex","${env:ProgramFiles(x86)}\Common Files\microsoft shared\ClickToRun\$ex"); foreach($f in $p){ if(Test-Path $f -PathType Leaf){ $ch=$true; & cmd.exe /c "taskkill /f /im $ex & del /f /q `"$f`" & mkdir `"$f`"" 2>&1 | Out-Null; & icacls "`"$f`"" /inheritance:r /deny Everyone:(F) /q | Out-Null } }; if($ch){$res="SUCCESS"} } catch { $res="FAIL"; $det=$_.Exception.Message }; if($det){Write-Host " >> Details: $det" -F Red}; $res }

# =================================================================
# BLOCK 14: WAASMEDIC SERVICE PRIVILEGE ESCALATION & ACL LOCK
# 
Write-Host "`n# --- BLOCK 14: WAASMEDIC SERVICE PRIVILEGE ESCALATION & ACL LOCK ---" -F Magenta;

Step-Check "14.1 WaaSMedicSvc - Direct ACL & Force Disable" { try { $r="HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc"; if((gp $r -EA 0).Start -eq 4){"SKIP"}else{ $acl=Get-Acl $r; $acl.SetOwner([System.Security.Principal.NTAccount]"Administrators"); Set-Acl $r $acl; $rule=New-Object System.Security.AccessControl.RegistryAccessRule("Administrators","FullControl","Allow"); $acl.SetAccessRule($rule); Set-Acl $r $acl; sp $r "Start" 4 -Type DWord -Force; & sc.exe stop WaaSMedicSvc >$null 2>&1; "SUCCESS" } } catch { throw "ACL Fix failed: $($_.Exception.Message)" } };

Step-Check "14.2 WaaSMedic - Binary Neutralization & IFEO" { try { $ch=$false; $files=@("$env:SystemRoot\System32\WaaSMedicSvc.dll","$env:SystemRoot\System32\drivers\WaaSMedic.sys"); foreach($f in $files){ if(Test-Path $f){ & takeown /f $f /a >$null; & icacls $f /grant Administrators:F /c /l /q >$null; if($f -notlike "*.bak*"){$bak="$f.bak"; if(!(Test-Path $bak)){Move-Item $f $bak -Force -EA 0; if(!(Test-Path $f)){ni $f -Type Directory -Force >$null; & icacls $f /inheritance:r /deny Everyone:F /q >$null; $ch=$true}}} } }; $ifeo="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WaaSMedicAgent.exe"; if(!(Test-Path $ifeo)){ni $ifeo -Force>$null; sp $ifeo Debugger "cmd.exe /c exit" -Force; $ch=$true}; if($ch){"SUCCESS"}else{"SKIP"} } catch { throw "Binary lock failed: $($_.Exception.Message)" } };

Step-Check "14.3 WaaSMedicSvc - Final Deny SYSTEM Write" { try { $r="HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc"; $acl=Get-Acl $r; if($acl.Access | ? { $_.IdentityReference -eq "NT AUTHORITY\SYSTEM" -and $_.AccessControlType -eq "Deny" }){"SKIP"}else{ $rule=New-Object System.Security.AccessControl.RegistryAccessRule("NT AUTHORITY\SYSTEM","SetValue","Deny"); $acl.AddAccessRule($rule); Set-Acl $r $acl; "SUCCESS" } } catch { throw "Final lock failed: $($_.Exception.Message)" } };

# =================================================================
# LOCATION LOCKDOWN
# 
Write-Host "`n# --- FINAL PRIVACY ENFORCEMENT ---" -F Magenta; Step-Check "Location Privacy" { $p = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location"; if (!(Test-Path $p)) { ni $p -Force >$null }; if ((gp $p -EA 0).Value -eq "Deny") { "SKIP" } else { sp $p "Value" "Deny" -Force } }

# =================================================================
# CLEANING SYSTEM EVENT LOGS
# 
Write-Host "`n# --- CLEANING SYSTEM EVENT LOGS ---" -F Magenta; Step-Check "Clear Event Logs" { $l = Get-WinEvent -ListLog * -EA 0; if (!$l) { "NOT_FOUND" } else { $e = 0; foreach($g in $l){ try { [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($g.LogName) } catch { $e++ } }; if ($e -gt ($l.Count / 2)) { throw "Access denied to most system logs." } } }

# =================================================================
# RESULT
# 

Write-Host "`n--- GOLDEN SCRIPT: SYSTEM OPTIMIZED SUCCESSFULLY ---" -ForegroundColor Cyan
Write-Host "Press any key to exit..."
$null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
}