# =================================================================
# JIU LONG (ДЕВЯТЬ ПОВЕЛИТЕЛЕЙ ДРАКОНОВ) - Windows 11 24H2
# =================================================================
& {
if (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(544)) { Start-Process PowerShell "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs; exit }
$ErrorActionPreference = "Stop"
function Step-Check($Name, $Action) { try { $res = & $Action; switch ($res) { "NOT_FOUND" { Write-Host "$Name [FAIL]" -F Yellow } "SKIP" { Write-Host "$Name [SKIP]" -F Blue } "SUCCESS" { Write-Host "$Name [OK]" -F Green } default { Write-Host "$Name [FAIL]" -F Red } } } catch { Write-Host "$Name [FAIL]" -F Red; Write-Host "  >> Details: $($_.Exception.Message)" -F Red } }
Write-Host "`n=== Jiu Long (Девять Повелителей Драконов) ===`n" -F Cyan
$script:nsudoPath=(gcm NSudoLG.exe -EA 0).Source;if(!$script:nsudoPath){$script:nsudoPath='NSudoLG.exe'}

# =================================================================
# BLOCK 1: PERMANENT WSUS LOCKDOWN & FAKE SERVER
# 
Write-Host "`n# --- BLOCK 1: PERMANENT WSUS LOCKDOWN & FAKE SERVER ---" -F Magenta

Step-Check "1.2 Set core WSUS registry policies" { $p='8531';$n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate';$w=(gp $k -EA 0).WUServer;$d=(gp $k -EA 0).DisableWindowsUpdateAccess;if($w-eq"http://127.0.0.1:$p"-and$d-eq1){"SKIP"}else{. $n -U:T reg add $k /v WUServer /t REG_SZ /d "http://127.0.0.1:$p" /f 2>$null;. $n -U:T reg add $k /v WUStatusServer /t REG_SZ /d "http://127.0.0.1:$p" /f 2>$null;. $n -U:T reg add $k /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f 2>$null;. $n -U:T reg add $k /v UseWUServer /t REG_DWORD /d 1 /f 2>$null;. $n -U:T reg add $k /v DisableDualScan /t REG_DWORD /d 1 /f 2>$null;if($LASTEXITCODE-eq0){"SUCCESS"}else{"FAIL"}} }

Step-Check "1.3 Set AU registry policies" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU';$a=(gp $k -EA 0).NoAutoUpdate;$b=(gp $k -EA 0).AUOptions;if($a-eq1-and$b-eq1){"SKIP"}else{. $n -U:T reg add $k /v NoAutoUpdate /t REG_DWORD /d 1 /f 2>$null;. $n -U:T reg add $k /v AUOptions /t REG_DWORD /d 1 /f 2>$null;if($LASTEXITCODE-eq0){"SUCCESS"}else{"FAIL"}} }

Step-Check "1.4 Set TargetGroup and UserInit" { $w='Workstation_Production';$f='E:\wsus.ps1';$n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$tg=(gp 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate' -EA 0).TargetGroup;$ui=(gp 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' -EA 0).UserInit;if($tg-eq$w-and$ui-like"*$f*"){"SKIP"}else{. $n -U:T reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate' /v TargetGroup /t REG_SZ /d $w /f 2>$null;. $n -U:T reg add 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' /v UserInit /t REG_SZ /d `"C:\Windows\system32\userinit.exe,powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File $f`" /f 2>$null;if($LASTEXITCODE-eq0){"SUCCESS"}else{"FAIL"}} }

Step-Check "1.5 Disable update services" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$s=@('wuauserv','UsoSvc','WaaSMedicSvc');$all=$true;$s|%{$svc=Get-Service $_ -EA 0;if($svc-and$svc.StartType-ne'Disabled'){$all=$false}};if($all){"SKIP"}else{$s|%{. $n -U:T sc config $_ start=disabled 2>$null;. $n -U:T sc stop $_ /force 2>$null};if($LASTEXITCODE-eq0){"SUCCESS"}else{"FAIL"}} }

Step-Check "1.6 Configure HTTP URL ACL for fake server"{$r=netsh http add urlacl url=http://127.0.0.1:8531/ user=Everyone 2>&1;if($LASTEXITCODE-eq0-or$r-match"already exists|уже существует"){"SKIP"}else{"SUCCESS"}}

Step-Check "1.7 Start fake WSUS server job" { if(!(Get-Job "wsus_fake" -EA 0)){Start-Job -Name "wsus_fake" -ScriptBlock {$l=New-Object Net.HttpListener;$l.Prefixes.Add('http://127.0.0.1:8531/');$l.Start();while(1){$c=$l.GetContext();[byte[]]$b=[Text.Encoding]::UTF8.GetBytes('<ok/>');$c.Response.ContentType='text/xml';$c.Response.ContentLength64=$b.Length;$c.Response.OutputStream.Write($b,0,$b.Length);$c.Response.Close()}};Start-Sleep 2};$check=Test-NetConnection 127.0.0.1 -Port 8531 -EA SilentlyContinue;if($check.TcpTestSucceeded){"SUCCESS"}else{"NOT_FOUND"} }

Step-Check "1.8 SIH Hard Lockdown" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=0;@("\Microsoft\Windows\UpdateOrchestrator\Sih","\Microsoft\Windows\WindowsUpdate\sih","\Microsoft\Windows\WindowsUpdate\sihboot")|%{$tp=($_-split'\\')[0..-2]-join'\';$tn=($_-split'\\')[-1];Disable-ScheduledTask -TaskPath $tp -TaskName $tn -EA 0 >$null;$tf="C:\Windows\System32\Tasks$_";if(Test-Path $tf){& takeown /f $tf /a >$null 2>&1;if($LASTEXITCODE-eq0){& icacls $tf /grant Administrators:F /q >$null 2>&1;if($LASTEXITCODE-eq0){rm $tf -Recurse -Force -EA 0 2>&1;Start-Sleep -Milliseconds 500;mkdir $tf -Force -EA 0 >$null 2>&1;Start-Sleep -Milliseconds 500;& icacls $tf /inheritance:r /deny Everyone:F /q >$null 2>&1;if($LASTEXITCODE-eq0-and(Test-Path $tf -PathType Container)){attrib +s +h +r $tf >$null 2>&1;$c++}}}}};. $n -U:T reg add 'HKLM\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator' /v DisableSIH /t REG_DWORD /d 1 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++};$r="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SihClient.exe";if(!(Test-Path $r)){ni $r -Force >$null;$c++};sp $r "Debugger" "systray.exe" -Force -EA 0;$chk=Test-NetConnection 127.0.0.1 -Port 8531 -EA SilentlyContinue;if($chk.TcpTestSucceeded){. $n -U:T reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SIH' /v "Url" /t REG_SZ /d "http://127.0.0.1:8531" /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++};cmd /c "$n -U:T icacls `"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SIH`" /inheritance:r /deny Everyone:F /q" >$null 2>&1;if($LASTEXITCODE-eq0){$c++}};if($c-gt0){"SUCCESS"}else{"SKIP"} }

Step-Check "1.9 Targeted wuauserv Leak Block" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=0;$exe="UsoClient.exe";$ip="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$exe";if(!(Test-Path $ip)){ni $ip -Force >$null;$c++};sp $ip "Debugger" "systray.exe" -Force -EA 0;if($?){$c++};$path="\Microsoft\Windows\UpdateOrchestrator\";@("USO_UxBroker","Schedule Scan","Schedule Scan Static Task","UpdateModelTask","ScanForUpdatesAsUser")|%{$tn=$_;Disable-ScheduledTask -TaskPath $path -TaskName $tn -EA 0 >$null;$tf="C:\Windows\System32\Tasks$path$tn";if(Test-Path $tf){& takeown /f $tf /a >$null 2>&1;if($LASTEXITCODE-eq0){& icacls $tf /grant Administrators:F /q >$null 2>&1;if($LASTEXITCODE-eq0){rm $tf -Recurse -Force -EA 0 2>&1;Start-Sleep -Milliseconds 500;mkdir $tf -Force -EA 0 >$null 2>&1;Start-Sleep -Milliseconds 500;& icacls $tf /inheritance:r /deny Everyone:F /q >$null 2>&1;if($LASTEXITCODE-eq0 -and (Test-Path $tf -PathType Container)){attrib +s +h +r $tf >$null 2>&1;$c++}}}}};$auKey='HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate';. $n -U:T reg add $auKey /v DoNotConnectToWindowsUpdateInternetLocations /t REG_DWORD /d 1 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++};try{$acl=Get-Acl $auKey -EA Stop;$rule=New-Object System.Security.AccessControl.RegistryAccessRule("Everyone","FullControl","Deny");$acl.SetAccessRule($rule);Set-Acl $auKey $acl -EA Stop;$c++}catch{};if($c-gt0){"SUCCESS"}else{"SKIP"} }

Step-Check "1.10 CryptSvc & CTL/CRL Neutralization" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=0;$ar='HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot';$cr='HKLM:\SOFTWARE\Policies\Microsoft\Cryptography';$wt='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing';@($ar,$cr,$wt,($ar-replace'HKLM:\\SOFTWARE\\','HKLM:\SOFTWARE\WOW6432Node\\'),($cr-replace'HKLM:\\SOFTWARE\\','HKLM:\SOFTWARE\WOW6432Node\\'),($wt-replace'HKLM:\\SOFTWARE\\','HKLM:\SOFTWARE\WOW6432Node\\'))|%{if(!(Test-Path $_)){. $n -U:T reg add $_ /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++}}};@($ar,($ar-replace'HKLM:\\SOFTWARE\\','HKLM:\SOFTWARE\WOW6432Node\\'))|%{. $n -U:T reg add $_ /v DisableRootAutoUpdate /t REG_DWORD /d 1 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++}};@($cr,($cr-replace'HKLM:\\SOFTWARE\\','HKLM:\SOFTWARE\WOW6432Node\\'))|%{. $n -U:T reg add $_ /v EnableCertRevocationCheck /t REG_DWORD /d 0 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++};. $n -U:T reg add $_ /v ChainRevocationCheck /t REG_DWORD /d 0 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++}};@($wt,($wt-replace'HKLM:\\SOFTWARE\\','HKLM:\SOFTWARE\WOW6432Node\\'))|%{. $n -U:T reg add $_ /v State /t REG_DWORD /d 146944 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++}};@($ar,$cr,($ar-replace'HKLM:\\SOFTWARE\\','HKLM:\SOFTWARE\WOW6432Node\\'),($cr-replace'HKLM:\\SOFTWARE\\','HKLM:\SOFTWARE\WOW6432Node\\'))|%{if(Test-Path $_){try{$acl=Get-Acl $_ -EA Stop;$rule=New-Object System.Security.AccessControl.RegistryAccessRule("Everyone","FullControl","Deny");$acl.SetAccessRule($rule);Set-Acl $_ $acl -EA Stop;$c++}catch{}}};$cp="$env:windir\ServiceProfiles\LocalService\AppData\LocalLow\Microsoft\CryptnetUrlCache";if(Test-Path $cp){try{gci $cp -Recurse -Force -EA 0|ri -Recurse -Force -EA 0}catch{};"Content","MetaData"|%{$p=Join-Path $cp $_;if(Test-Path $p){try{ri $p -Force -Recurse -EA 0}catch{}};Start-Sleep -Milliseconds 600;ni $p -ItemType Directory -Force >$null;Start-Sleep -Milliseconds 600;& icacls $p /inheritance:r /deny "LOCAL SERVICE:WD" /q >$null 2>&1;if($LASTEXITCODE-eq0){attrib +s +h +r $p >$null 2>&1;$c++}}};@("\Microsoft\Windows\CertificateServicesClient\","\Microsoft\Windows\Crypto\")|%{$tp=$_;Get-ScheduledTask -TaskPath $tp -EA 0|%{Disable-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -EA 0 >$null;$tf="C:\Windows\System32\Tasks$($_.TaskPath)$($_.TaskName)";if(Test-Path $tf){& takeown /f $tf /a >$null 2>&1;if($LASTEXITCODE-eq0){& icacls $tf /grant Administrators:F /q >$null 2>&1;if($LASTEXITCODE-eq0){ri $tf -Force -EA 0;Start-Sleep -Milliseconds 600;ni $tf -ItemType Directory -Force >$null;Start-Sleep -Milliseconds 600;& icacls $tf /inheritance:r /deny Everyone:F /q >$null 2>&1;if($LASTEXITCODE-eq0){attrib +s +h +r $tf >$null 2>&1;$c++}}}}}};if($c-gt0){"SUCCESS"}else{"SKIP"} }

# =================================================================
# BLOCK 2: EDGE TOTAL ANNIHILATION
# 
Write-Host "`n# --- BLOCK 2: EDGE TOTAL ANNIHILATION (HARDENED) ---" -F Magenta

Step-Check "2.1 PPL Neutralization & AppX" { @("msedge","MicrosoftEdgeUpdate","MicrosoftEdgeElevationService","identity_helper")|%{&cmd.exe /c "taskkill /F /IM $_.exe /T >nul 2>&1"}; try{Get-AppxPackage -AllUsers *MicrosoftEdge* -EA 0|Remove-AppxPackage -AllUsers -EA 0}catch{}; "SUCCESS" }

Step-Check "2.2 Path Eradication" { $f=$false; @("${env:ProgramFiles}\Microsoft\Edge","${env:ProgramFiles(x86)}\Microsoft\Edge","${env:LocalAppData}\Microsoft\Edge","${env:ProgramData}\Microsoft\Edge","$env:SystemRoot\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe")|%{if(Test-Path $_){&takeown /f $_ /r /a /d y >$null;&icacls $_ /grant Administrators:F /t /c /l /q >$null;rm $_ -Recurse -Force -EA 0;$f=$true}};if($f){"SUCCESS"}else{"SKIP"} }

Step-Check "2.3 Services & PPL Stubs" { $c=$false; @("edgeupdate","edgeupdatem","MicrosoftEdgeElevationService")|%{ $k="HKLM:\SYSTEM\CurrentControlSet\Services\$_"; if(Test-Path $k){ sp $k Start 4 -Force -EA 0; sp $k ImagePath "C:\Windows\System32\svchost.exe -k netsvcs" -Force -EA 0; $c=$true } }; if($c){"SUCCESS"}else{"SKIP"} }

Step-Check "2.4 Registry Block" { $b=$false; $i="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"; @("MicrosoftEdgeUpdate.exe","MicrosoftEdgeUpdateCore.exe","msedge.exe")|%{$p=Join-Path $i $_;if(!(Test-Path $p)){ni $p -Force >$null;$b=$true};sp $p Debugger "cmd.exe /c exit" -Force -EA 0}; @("HKLM:\SOFTWARE\Microsoft\EdgeUpdate","HKLM:\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate")|%{if(!(Test-Path $_)){ni $_ -Force >$null;$b=$true};sp $_ "DoNotUpdate" 1 -Type DWord -Force -EA 0}; @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge","HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge")|%{if(!(Test-Path $_)){ni $_ -Force >$null;$b=$true};sp $_ "DoNotUpdateToEdge" 1 -Type DWord -Force -EA 0};if($b){"SUCCESS"}else{"SKIP"} }

Step-Check "2.5 Physical Task Deletion" { $t=$false; Get-ScheduledTask *Edge* -EA 0 | % { $n=$_.TaskName; Disable-ScheduledTask -TaskName $n -EA 0 >$null; gci 'C:\Windows\System32\Tasks' -Recurse -Filter $n -EA 0 | % { $f=$_.FullName; &takeown /f $f /a >$null; &icacls $f /grant Administrators:F /q >$null; rm $f -Force -EA 0; $t=$true } }; if($t){"SUCCESS"}else{"SKIP"} }

Step-Check "2.6 Purge Start Icons" { $c=$false; @("$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk","$env:AppData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk","$env:AppData\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk") | % { if(Test-Path $_){ rm $_ -Force; $c=$true } }; Get-AppxPackage -AllUsers *MicrosoftEdge* | ? { $_.PackageFullName -notlike "*DevToolsClient*" } | % { Remove-AppxPackage -AllUsers $_ -EA 0; $c=$true }; if($c){"SUCCESS"}else{"SKIP"} }

Step-Check "2.7 Reset Associations" { $a=$false; $k="HKLM:\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\Capabilities"; @(".html",".htm",".pdf",".svg") | % { $v="HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\$_"; if(Test-Path $v){ sp $v "NoOpenWith" "" -Force; $a=$true } }; @("microsoft-edge","https","http") | % { $p="HKLM:\SOFTWARE\Classes\$_"; if(Test-Path $p){ sp $p "URL Protocol" "" -Force; $a=$true } }; if($a){"SUCCESS"}else{"SKIP"} }

# =================================================================
# BLOCK 3: BING & SEARCH NETWORK ISOLATION (FINAL REINFORCED)
#
Write-Host "`n# --- BLOCK 3: BING SEARCH ANNIHILATION ---" -F Magenta

Step-Check "3.1 Disable Cloud Search Registry" { $c=$false; @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Search","HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search")|%{$p=$_;if(!(Test-Path $p)){ni $p -Force >$null;$c=$true};@("BingSearchEnabled","AllowSearchToUseLocation","ConnectedSearchUseWeb","AllowCortana")|%{$v=(gp $p $_ -EA 0).$_;if($v -ne 0){sp $p $_ 0 -Type DWord -Force;$c=$true}};if((gp $p "DisableWebSearch" -EA 0).DisableWebSearch -ne 1){sp $p "DisableWebSearch" 1 -Type DWord -Force;$c=$true}};if($c){"SUCCESS"}else{"SKIP"} }

Step-Check "3.2 Eradicate Search Network Tasks" { $t=$false; Get-ScheduledTask -EA 0 | ? { $_.TaskName -match "FamilySafetyUpload|IndexDeclaration|BthSQM|CortanaReminders|SearchData|Bing" } | % { $tn=$_.TaskName; $tp=$_.TaskPath; Disable-ScheduledTask -TaskPath $tp -TaskName $tn -EA 0 >$null; $f="C:\Windows\System32\Tasks$tp$tn"; if(Test-Path $f){ &takeown /f $f /a >$null 2>&1; &icacls $f /grant Administrators:F /q >$null 2>&1; rm $f -Force -EA 0; $t=$true } }; if($t){"SUCCESS"}else{"SKIP"} }

Step-Check "3.3 Network Isolation & Settings" { $b=$false;$r="HKCU:\Software\Microsoft\Windows\CurrentVersion\SearchSettings";if(!(Test-Path $r)){ni $r -Force >$null;$b=$true};@("IsDynamicSearchBoxEnabled","IsDeviceSearchHistoryEnabled","IsMSACloudSearchEnabled")|%{$v=(gp $r $_ -EA 0).$_;if($v -ne 0){sp $r $_ 0 -Type DWord -Force;$b=$true}};$ni="HKLM:\SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation";if(!(Test-Path $ni)){ni $ni -Force >$null;$b=$true};if((gp $ni "EnterpriseIPRange" -EA 0).EnterpriseIPRange -ne 0){sp $ni "EnterpriseIPRange" 0 -Type DWord -Force;$b=$true};if($b){"SUCCESS"}else{"SKIP"} }

Step-Check "3.4 Remove Bing & Cortana AppX" { $r=$false; @("*Bing*","*Cortana*")|%{Get-AppxPackage -AllUsers $_ -EA 0|%{try{Remove-AppxPackage $_ -AllUsers -EA 0;$r=$true}catch{}}}; if($r){"SUCCESS"}else{"SKIP"} }

Step-Check "3.5 Search Policies Current+Default"{$c=$false;$search='HKCU:\Software\Microsoft\Windows\CurrentVersion\Search';if(!(Test-Path $search)){ni $search -Force >$null;$c=$true};@("BingSearchEnabled","DisableWebSearch","ConnectedSearchUseWeb","AllowCortana")|%{if((gp $search $_ -EA 0).$_ -ne 0){sp $search $_ 0 -Type DWord -Force;$c=$true}};sp $search "DisableWebSearch" 1 -Type DWord -Force;$c=$true;$exp='HKCU:\Software\Policies\Microsoft\Windows\Explorer';if(!(Test-Path $exp)){ni $exp -Force >$null;$c=$true};sp $exp "DisableSearchBoxSuggestions" 1 -Type DWord -Force;$c=$true;$defPath="Registry::HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Search";if(!(Test-Path $defPath)){ni $defPath -Force >$null;$c=$true};@("BingSearchEnabled","DisableWebSearch","ConnectedSearchUseWeb","AllowCortana")|%{sp $defPath $_ 0 -Type DWord -Force;$c=$true};sp $defPath "DisableWebSearch" 1 -Type DWord -Force;$c=$true;$defExpPath="Registry::HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Windows\Explorer";if(!(Test-Path $defExpPath)){ni $defExpPath -Force >$null;$c=$true};sp $defExpPath "DisableSearchBoxSuggestions" 1 -Type DWord -Force;$c=$true;if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "3.6 Global Policies+CBS Core"{$n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=$false;$ws='HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search';if(!(Test-Path $ws)){. $n -U:T reg add $ws /f >$null;$c=$true};@("DisableWebSearch","ConnectedSearchUseWeb","ConnectedSearchUseWebOverMeteredConnections","AllowCloudSearch","AllowCortana")|%{if((gp $ws $_ -EA 0).$_ -ne 0){. $n -U:T reg add $ws /v $_ /t REG_DWORD /d 0 /f >$null;$c=$true}};$exp='HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer';if(!(Test-Path $exp)){. $n -U:T reg add $exp /f >$null;$c=$true};if((gp $exp "DisableSearchBoxSuggestions" -EA 0).DisableSearchBoxSuggestions -ne 1){. $n -U:T reg add $exp /v DisableSearchBoxSuggestions /t REG_DWORD /d 1 /f >$null;$c=$true};$cbs='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CBS';if(!(Test-Path $cbs)){. $n -U:T reg add $cbs /f >$null;$c=$true};@("EnableWebContent","BingSearchEnabled","AllowCloudSearch")|%{if((gp $cbs $_ -EA 0).$_ -ne 0){. $n -U:T reg add $cbs /v $_ /t REG_DWORD /d 0 /f >$null;$c=$true}};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "3.7 Purge Cache & Safe Reset"{$c=$false;&taskkill /F /IM SearchHost.exe /T >$null 2>&1;$local="$env:LOCALAPPDATA\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState";if(Test-Path $local){rm $local -Recurse -Force -EA 0;mkdir $local -Force >$null;&icacls $local /inheritance:r /deny "Everyone:(W)" /q >$null 2>&1;$c=$true};Stop-Service WSearch -Force -EA 0;Start-Sleep -Seconds 3;if((Get-Service WSearch -EA 0).Status -eq "Stopped"){$p="C:\ProgramData\Microsoft\Search\Data\Applications\Windows";if(Test-Path $p){gci $p -Recurse -Include *.db,*.gthr,*.edb -EA 0|ri -Force -EA 0;$c=$true};Start-Service WSearch -EA 0;Start-Sleep -Seconds 3;if((Get-Service WSearch -EA 0).Status -eq "Running"){$c=$true}};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "3.8 Sterilize Search Tasks"{$c=$false;@("\Microsoft\Windows\Search\","\Microsoft\Windows\Bing\","\Microsoft\Windows\CloudExperienceHost\","\Microsoft\Windows\SettingSync\")|%{$tp=$_;Get-ScheduledTask -TaskPath $_ -EA 0|?{$_.TaskName -match "Search|Index|Web|Bing|Sync|Cloud|Background|Crawl"}|%{Disable-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -EA 0 >$null;$tf="C:\Windows\System32\Tasks$($_.TaskPath)$($_.TaskName)";if(Test-Path $tf){&takeown /f $tf /a >$null 2>&1;&icacls $tf /grant Administrators:F /q >$null 2>&1;rm $tf -Force -EA 0;mkdir $tf -Force >$null;&icacls $tf /inheritance:r /deny "Everyone:(F)" /q >$null 2>&1;attrib +s +h +r $tf >$null 2>&1;$c=$true}}};if($c){"SUCCESS"}else{"SKIP"}}

# =================================================================
# BLOCK 4: TELEMETRY & DATA COLLECTION (SURGICAL HYBRID)
#
Write-Host "`n# --- BLOCK 4: TELEMETRY & DATA COLLECTION ---" -F Magenta

Step-Check "4.1 Kill Services & Policies" { $b=$false;"DiagTrack","dmwappushservice","lfsvc","CDPSvc","WpnService","DPS"|%{$svc=gsv $_ -EA 0;if($svc -and $svc.StartType-ne"Disabled"){$b=$true;Stop-Service $_ -Force -EA 0;Set-Service $_ -StartupType Disabled -EA 0}};@("HKLM:\SYSTEM\CurrentControlSet\Services\DiagTrack","HKLM:\SYSTEM\CurrentControlSet\Services\dmwappushservice")|%{$k=$_;$old=(gp $k -EA 0).Start;if($old-ne4){$b=$true};sp $k "Start" 4 -Type DWord -Force -EA 0;sp $k "ImagePath" "C:\Windows\System32\svchost.exe -k netsvcs" -Type ExpandString -Force -EA 0};@("HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection","HKLM:\SOFTWARE\Policies\Microsoft\SQMClient\Windows")|%{$p=$_;if(!(Test-Path $p)){ni $p -Force;$b=$true};$old=(gp $p -EA 0).AllowTelemetry;if($old-ne0){$b=$true};sp $p "AllowTelemetry" 0 -Type DWord -Force -EA 0;sp $p "CEIPEnable" 0 -Type DWord -Force -EA 0};if($b){"SUCCESS"}else{"SKIP"} }

Step-Check "4.2 Eradicate Diagnostic Tasks" { $t=$false; @("\Microsoft\Windows\Customer Experience Improvement Program\","\Microsoft\Windows\Diagnosis\","\Microsoft\Windows\Feedback\")|%{$tp=$_;Get-ScheduledTask -TaskPath $tp -EA 0|%{$tn=$_.TaskName;Disable-ScheduledTask -TaskPath $tp -TaskName $tn -EA 0 >$null;$tf="C:\Windows\System32\Tasks$tp$tn";if(Test-Path $tf -PathType Leaf){&takeown /f $tf /a >$null 2>&1;&icacls $tf /grant Administrators:F /q >$null 2>&1;rm $tf -Force -EA 0;$t=$true}}}; if($t){"SUCCESS"}else{"SKIP"} }

Step-Check "4.3 Telemetry Tasks Sterilization" { $s=$false;$g=@{"\Microsoft\Windows\Customer Experience Improvement Program\"="Consolidator","UsbCeip","KernelCeipTask";"\Microsoft\Windows\Feedback\Siuf\"="DmClient";"\Microsoft\Windows\Diagnosis\"="Scheduled"};$g.Keys|%{$pt=$_;$g[$pt]|%{$n=$_;Disable-ScheduledTask -TaskPath $pt -TaskName $n -EA 0 >$null;$f=gci "C:\Windows\System32\Tasks$pt" -Filter $n -EA 0|select -Expand FullName;if($f -and -not(Test-Path $f -PathType Container)){&takeown /f $f /a >$null 2>&1;&icacls $f /grant Administrators:F /q >$null 2>&1;if(Test-Path $f){mv $f "$f.bak" -Force -EA 0;ni $f -Type Directory -Force >$null;&icacls $f /inheritance:r /deny "Everyone:(F)" /q >$null 2>&1;$s=$true}}}};if($s){"SUCCESS"}else{"SKIP"} }

Step-Check "4.4 Registry Network Block" { $r=$false; $p="HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection";if(!(Test-Path $p)){ni $p -Force;$r=$true};sp $p "DoNotShowFeedbackNotifications" 1 -Type DWord -Force -EA 0;sp $p "DisableEnterpriseAuthProxy" 1 -Type DWord -Force -EA 0;$e="HKLM:\SOFTWARE\Policies\Microsoft\Edge";if(!(Test-Path $e)){ni $e -Force;$r=$true};sp $e "MetricsReportingEnabled" 0 -Type DWord -Force -EA 0;sp $e "SendSiteInfoToImproveServices" 0 -Type DWord -Force -EA 0; if($r){"SUCCESS"}else{"SKIP"} }

Step-Check "4.5 Nuke All Telemetry Apps" { $r=$false;@("Microsoft.WindowsFeedbackHub","Microsoft.GetHelp","Microsoft.Windows.CBSPreview","Microsoft.BingWeather","Microsoft.BingNews")|%{$n=$_;Get-AppxPackage -AllUsers $n -EA 0|%{try{Remove-AppxPackage $_ -AllUsers -EA 0}catch{};$r=$true};dism /online /get-provisionedappxpackages|findstr $n|%{$p=($_ -split":")[1].Trim();dism /online /remove-provisionedappxpackage /packagename:$p >$null 2>&1;$r=$true};if($n-eq"Microsoft.Windows.CBSPreview"){$p="C:\Windows\SystemApps\Microsoft.Windows.CBSPreview_cw5n1h2txyewy";if(Test-Path $p){&takeown /f $p /r /a /d y >$null 2>&1;&icacls $p /grant Administrators:F /t /q >$null 2>&1;&icacls $p /inheritance:r /deny "Everyone:(F)" /q >$null 2>&1;$r=$true};$ifeo="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CBSPreview.exe";if(!(Test-Path $ifeo)){ni $ifeo -Force >$null;sp $ifeo Debugger "cmd.exe /c exit" -Force;$r=$true}}};if($r){"SUCCESS"}else{"SKIP"} }

Step-Check "4.6 File Lockdown" { $l=$false; "C:\Windows\System32\diagtrack.dll","C:\Windows\System32\utc.app.json"|%{if(Test-Path $_){&takeown /f $_ /a >$null 2>&1;&icacls $_ /deny "SYSTEM:RX" /deny "ALL APPLICATION PACKAGES:RX" /q >$null 2>&1;$l=$true}}; if($l){"SUCCESS"}else{"SKIP"} }

Step-Check "4.7 Lockdown Verification" { $f="C:\Windows\System32\diagtrack.dll";if(Test-Path $f){try{$acl=(Get-Acl $f -EA 0).Access|?{$_.IdentityReference-match"SYSTEM"-and$_.AccessControlType-eq"Deny"};if($acl){"SUCCESS"}else{"SKIP"}}catch{"SKIP"}}else{"SKIP"} }

Step-Check "4.8 StartMenuExperienceHost Office & Cloud Isolation" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=0;$polKeys=@('HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager','HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent','HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager','HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced','HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer');foreach($k in $polKeys){if(!(Test-Path $k)){. $n -U:T reg add $k /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++}}};. $n -U:T reg add 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent' /v DisableCloudOptimizedContent /t REG_DWORD /d 1 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++};. $n -U:T reg add 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent' /v DisableAccountScheduledContent /t REG_DWORD /d 1 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++};. $n -U:T reg add 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer' /v HideRecommendedSection /t REG_DWORD /d 1 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++};. $n -U:T reg add 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer' /v DisableContextualSearch /t REG_DWORD /d 1 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++};. $n -U:T reg add 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' /v ContentDeliveryAllowed /t REG_DWORD /d 0 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++};. $n -U:T reg add 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' /v SystemPaneSuggestionsEnabled /t REG_DWORD /d 0 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++};. $n -U:T reg add 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' /v SilentInstalledAppsEnabled /t REG_DWORD /d 0 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++};. $n -U:T reg add 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' /v SoftLandingEnabled /t REG_DWORD /d 0 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++};. $n -U:T reg add 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' /v SubscribedContentEnabled /t REG_DWORD /d 0 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++};. $n -U:T reg add 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' /v Start_ShowRecommended /t REG_DWORD /d 0 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++};$officeKeys=@();@("15.0","16.0","17.0")|%{$ver=$_;$bases=@("HKCU:\Software\Microsoft\Office\$ver\Common\General","HKLM:\SOFTWARE\Policies\Microsoft\Office\$ver\Common\General","HKLM:\SOFTWARE\Policies\Microsoft\Office\$ver\Common\Privacy","HKLM:\SOFTWARE\WOW6432Node\Policies\Microsoft\Office\$ver\Common\Privacy");$officeKeys+=$bases;foreach($k in $bases){if(!(Test-Path $k)){. $n -U:T reg add $k /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++}}};. $n -U:T reg add "HKLM:\SOFTWARE\Policies\Microsoft\Office\$ver\Common\Privacy" /v DisconnectedState /t REG_DWORD /d 1 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++};. $n -U:T reg add "HKCU:\Software\Microsoft\Office\$ver\Common\General" /v EnableOfficeOnlineFeatures /t REG_DWORD /d 0 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++};. $n -U:T reg add "HKCU:\Software\Microsoft\Office\$ver\Common\General" /v OfficeConnected /t REG_DWORD /d 0 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++};. $n -U:T reg add "HKLM:\SOFTWARE\WOW6432Node\Policies\Microsoft\Office\$ver\Common\Privacy" /v DisconnectedState /t REG_DWORD /d 1 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++}};$pkg="Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy";$root="$env:LOCALAPPDATA\Packages\$pkg";@("LocalState\SuggestedApps","LocalState\OfficeSuggestions","LocalCache","TempState","Settings\settings.dat")|%{$tp=Join-Path $root $_;if(Test-Path $tp){& takeown /f $tp /r /a >$null 2>&1;if($LASTEXITCODE-ne0){continue}& icacls $tp /grant Administrators:F /t /q >$null 2>&1;if($LASTEXITCODE-ne0){continue};ri $tp -Recurse -Force -EA 0 2>&1;Start-Sleep -Milliseconds 600;ni $tp -ItemType Directory -Force >$null;Start-Sleep -Milliseconds 600;& icacls $tp /inheritance:r /deny "NETWORK SERVICE:W" /deny "LOCAL SERVICE:W" /q >$null 2>&1;attrib +s +h +r $tp >$null 2>&1;if($LASTEXITCODE-eq0){$c++}}};@("\Microsoft\Windows\Shell\FamilySafetyUpload","\Microsoft\Windows\Shell\CreateObjectTask")|%{$tp=$_-replace'[^\\]+$','';$tn=$_-replace'.*\\';Disable-ScheduledTask -TaskPath $tp -TaskName $tn -EA 0 >$null;$tf="C:\Windows\System32\Tasks$_";if(Test-Path $tf){& takeown /f $tf /a >$null 2>&1;if($LASTEXITCODE-ne0){continue}& icacls $tf /grant Administrators:F /q >$null 2>&1;if($LASTEXITCODE-ne0){continue};ri $tf -Force -EA 0;Start-Sleep -Milliseconds 600;ni $tf -ItemType Directory -Force >$null;Start-Sleep -Milliseconds 600;& icacls $tf /inheritance:r /deny Everyone:F /q >$null 2>&1;attrib +s +h +r $tf >$null 2>&1;if($LASTEXITCODE-eq0){$c++}}};$protectKeys=$polKeys+$officeKeys;foreach($k in $protectKeys){if(Test-Path $k){try{$acl=Get-Acl $k -EA Stop;$rule=New-Object System.Security.AccessControl.RegistryAccessRule("Everyone","Write","Deny");$acl.SetAccessRule($rule);Set-Acl $k $acl -EA Stop;$c++}catch{}}};if($c-gt0){"SUCCESS"}else{"SKIP"} }

# =================================================================
# BLOCK 5: SEARCH INDEX & SHELL ISOLATION (NSudo PS5.1)
# =================================================================
Write-Host "`n# --- BLOCK 5: SEARCH INDEX & SHELL ISOLATION ---" -ForegroundColor Magenta

Step-Check "5.1 Reset Search Index Database" {
Stop-Service WSearch -Force -EA 0;$p="C:\ProgramData\Microsoft\Search\Data\Applications\Windows";if(Test-Path $p){gci "$p\*" -Include *.db,*.gthr,*.txt -EA 0|ri -Force -EA 0;Start-Service WSearch -EA 0;"SUCCESS"}else{Start-Service WSearch -EA 0;"SKIP"}}

Step-Check "5.2 Disable Cloud Indexing" {
$p="HKCU:\Software\Microsoft\Windows\CurrentVersion\Search";sp $p "SearchAppsInStore" 0 -Type DWord -Force;sp $p "BingSearchEnabled" 0 -Type DWord -Force;$ps="HKCU:\Software\Microsoft\Windows\CurrentVersion\SearchSettings";if(!(Test-Path $ps)){ni $ps -Force >$null};sp $ps "IsMSACloudSearchEnabled" 0 -Type DWord -Force;sp $ps "IsAADCloudSearchEnabled" 0 -Type DWord -Force;"SUCCESS"}

Step-Check "5.3 Clean Shell Experience Cache" {
$pkg="Microsoft.Windows.Search_cw5n1h2txyewy";$path="$env:LOCALAPPDATA\Packages\$pkg\LocalState\DeviceMetadata";if(Test-Path $path){ri "$path\*" -Recurse -Force -EA 0;"SUCCESS"}else{"SKIP"}}

Step-Check "5.4 Silence Identity Health (IdentSvc)" {
$c=$false;$s="IdentSvc";$p="HKLM:\SYSTEM\CurrentControlSet\Services\$s";$sd="$p\Parameters";if(!(Test-Path $sd)){ni $sd -Force >$null};$cur=(gp $sd -EA 0).ServiceDll;if($cur -ne "C:\Windows\System32\null.dll"){sp $sd "ServiceDll_Orig" $cur -Type ExpandString -Force;sp $sd "ServiceDll" "C:\Windows\System32\null.dll" -Type ExpandString -Force;$c=$true};$trig=sc.exe qtriggerinfo $s;if($trig -match "START SERVICE|NETWORK|DOMAIN"){sc.exe triggerinfo $s delete >$null 2>&1;$c=$true};if((gp $p -EA 0).Start -ne 4){sp $p "Start" 4 -Type DWord -Force;$c=$true};sc.exe failure $s reset= 0 actions= "" >$null 2>&1;$proc=Get-Process "IdentSvc" -EA 0;if($proc){Stop-Process -Id $proc.Id -Force -EA 0;$c=$true};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "5.5 Lockdown WAM & Cloud Content (24H2)" {
$c=$false;$wa="HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WebAccountManager";if(!(Test-Path $wa)){ni $wa -Force >$null;$c=$true};if((gp $wa -EA 0).AllowWAM -ne 0){sp $wa "AllowWAM" 0 -Type DWord -Force;$c=$true};$cc="HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent";if(!(Test-Path $cc)){ni $cc -Force >$null;$c=$true};if((gp $cc -EA 0).DisableCloudOptimizedContent -ne 1){sp $cc "DisableCloudOptimizedContent" 1 -Type DWord -Force;$c=$true};if($c){"SUCCESS"}else{"SKIP"}}

# =================================================================
# BLOCK 6: CONTENT DELIVERY & IRIS NEUTRALIZATION
# 
Write-Host "`n# --- BLOCK 6: CONTENT DELIVERY & IRIS NEUTRALIZATION ---" -F Magenta

Step-Check "6.1 Purge Store+CDM+Related AppX"{$c=0;@("*ContentDeliveryManager*","*WindowsStore*","*StorePurchaseApp*")|%{$p=$_;Get-AppxPackage -AllUsers $p -EA 0|%{try{Remove-AppxPackage $_ -AllUsers}catch{}};if($?){$c++};Get-AppxProvisionedPackage -Online|?{$_.DisplayName -like $p}|%{try{Remove-AppxProvisionedPackage -Online -PackageName:$_.PackageName}catch{}};if($?){$c++}};if($c-gt0){"SUCCESS"}else{"SKIP"}}

Step-Check "6.2 CloudContent+CDM+Iris+DO+Background Lock"{$n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=$false;$iris='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\IrisService';if(Test-Path $iris){ri $iris -Recurse -Force -EA 0;$c=$true};@("ContentDeliveryAllowed","FeatureManagementEnabled","OemPreInstalledAppsEnabled","PreInstalledAppsEnabled","SilentInstalledAppsEnabled","SoftLandingEnabled","SubscribedContentEnabled","SystemPaneSuggestionsEnabled","RotatingLockScreenEnabled","RotatingLockScreenOverlayEnabled","RotatingLockScreenDynamicEnabled")|%{. $n -U:T reg add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v $_ /t REG_DWORD /d 0 /f >$null 2>&1;$c=$true};$cc='HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent';. $n -U:T reg add $cc /f >$null 2>&1;$c=$true;@("DisableWindowsConsumerFeatures","DisableWindowsSpotlightFeatures","DisableSoftLanding","DisableCloudOptimizedContent")|%{. $n -U:T reg add $cc /v $_ /t REG_DWORD /d 1 /f >$null 2>&1;$c=$true};$do='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config';. $n -U:T reg add $do /f >$null 2>&1;$c=$true;. $n -U:T reg add $do /v DODownloadMode /t REG_DWORD /d 99 /f >$null 2>&1;$c=$true;$ba='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications';. $n -U:T reg add $ba /v GlobalUserDisabled /t REG_DWORD /d 1 /f >$null 2>&1;$c=$true;$ws='HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore';. $n -U:T reg add $ws /f >$null 2>&1;$c=$true;. $n -U:T reg add $ws /v RemoveWindowsStore /t REG_DWORD /d 1 /f >$null 2>&1;$c=$true;if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "6.3 DoSvc Disable & Cache Lockdown"{$n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=$false;. $n -U:T sc config DoSvc start=disabled >$null 2>&1;. $n -U:T sc stop DoSvc >$null 2>&1;$c=$true;$roots=@("$env:LOCALAPPDATA\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy","$env:LOCALAPPDATA\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe","$env:ProgramData\Microsoft\Windows\DeliveryOptimization");$subs=@("LocalState","LocalCache","AC\INetCache","TempState","Assets");foreach($r in $roots){if(Test-Path $r){&takeown /f $r /r /a >$null 2>&1;&icacls $r /grant Administrators:F /t /q >$null 2>&1;foreach($s in $subs){$tp=Join-Path $r $s;if(Test-Path $tp){rm $tp -Recurse -Force -EA 0;mkdir $tp -Force >$null;&icacls $tp /inheritance:r /deny "NETWORK SERVICE:(W)" /deny "Everyone:(W)" /q >$null 2>&1;attrib +s +h +r $tp >$null 2>&1;$c=$true}}}};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "6.4 Neutralize Cloud+Sync Tasks"{$c=$false;@("\Microsoft\Windows\CloudContent\","\Microsoft\Windows\Subscription\","\Microsoft\Windows\CloudExperienceHost\","\Microsoft\Windows\SettingSync\","\Microsoft\Windows\WindowsUpdate\Automatic App Update","\Microsoft\Windows\DeliveryOptimization\")|%{$tp=$_;Get-ScheduledTask -TaskPath $_ -EA 0|?{$_.TaskName -match "Content|Delivery|Spotlight|Update|Sync|License|CloudExperience|SettingSync"}|%{Disable-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -EA 0 >$null;$tf="C:\Windows\System32\Tasks$($_.TaskPath)$($_.TaskName)";if(Test-Path $tf){&takeown /f $tf /a >$null 2>&1;&icacls $tf /grant Administrators:F /q >$null 2>&1;rm $tf -Force -EA 0;mkdir $tf -Force >$null;&icacls $tf /inheritance:r /deny "Everyone:(F)" /q >$null 2>&1;attrib +s +h +r $tf >$null 2>&1;$c=$true}}};if($c){"SUCCESS"}else{"SKIP"}}

# =================================================================
# BLOCK 7: MICROSOFT ACCOUNT SIGN-IN ASSISTANT (wlidsvc) NEUTRALIZATION
# =================================================================
Write-Host "`n# --- BLOCK 7: MICROSOFT ACCOUNT SIGN-IN ASSISTANT (wlidsvc) NEUTRALIZATION ---" -F Magenta

Step-Check "7.1 Disable wlidsvc & MSA Policies"{$n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=$false;$svc="wlidsvc";if((Get-Service $svc -EA 0).StartType -ne "Disabled"){. $n -U:T sc config $svc start=disabled >$null 2>&1;. $n -U:T sc stop $svc >$null 2>&1;$c=$true};$sysPol='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System';if(!(Test-Path $sysPol)){. $n -U:T reg add $sysPol /f >$null;$c=$true};@("NoConnectedUser","NoMicrosoftAccount")|%{if((gp $sysPol $_ -EA 0).$_ -ne 1){. $n -U:T reg add $sysPol /v $_ /t REG_DWORD /d 1 /f >$null;$c=$true}};$wam='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WebAccountManager';if(!(Test-Path $wam)){. $n -U:T reg add $wam /f >$null;$c=$true};if((gp $wam "AllowWAM" -EA 0).AllowWAM -ne 0){. $n -U:T reg add $wam /v AllowWAM /t REG_DWORD /d 0 /f >$null;$c=$true};$acc='HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Accounts';if(!(Test-Path $acc)){. $n -U:T reg add $acc /f >$null;$c=$true};if((gp $acc "AllowMicrosoftAccountConnection" -EA 0).AllowMicrosoftAccountConnection -ne 0){. $n -U:T reg add $acc /v AllowMicrosoftAccountConnection /t REG_DWORD /d 0 /f >$null;$c=$true};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "7.2 MSA Policies Default Profile"{$c=$false;$defPath="Registry::HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Windows\System";if(!(Test-Path $defPath)){ni $defPath -Force >$null;$c=$true};sp $defPath "NoConnectedUser" 1 -Type DWord -Force;$c=$true;if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "7.3 Purge Identity Cache"{$c=$false;@("$env:LOCALAPPDATA\Microsoft\IdentityCRL","$env:PROGRAMDATA\Microsoft\IdentityCRL","$env:LOCALAPPDATA\Microsoft\IdentityCache","$env:LOCALAPPDATA\Microsoft\Credentials","$env:LOCALAPPDATA\Microsoft\OneAuth","C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC")|%{if(Test-Path $_){&takeown /f $_ /r /a >$null 2>&1;&icacls $_ /grant Administrators:F /t /q >$null 2>&1;rm $_ -Recurse -Force -EA 0;mkdir $_ -Force >$null;&icacls $_ /inheritance:r /deny "Everyone:(F)" /q >$null 2>&1;attrib +s +h +r $_ >$null 2>&1;$c=$true}};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "7.4 Sterilize Identity Tasks"{$c=$false;@("\Microsoft\Windows\SettingSync\","\Microsoft\Windows\Work Folders\","\Microsoft\Windows\CertificateServicesClient\","\Microsoft\Windows\Authentication\")|%{$tp=$_;Get-ScheduledTask -TaskPath $_ -EA 0|?{$_.TaskName -match "Sync|SignIn|Credential|Identity|Token|Account"}|%{Disable-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -EA 0 >$null;$tf="C:\Windows\System32\Tasks$($_.TaskPath)$($_.TaskName)";if(Test-Path $tf){&takeown /f $tf /a >$null 2>&1;&icacls $tf /grant Administrators:F /q >$null 2>&1;rm $tf -Force -EA 0;mkdir $tf -Force >$null;&icacls $tf /inheritance:r /deny "Everyone:(F)" /q >$null 2>&1;attrib +s +h +r $tf >$null 2>&1;$c=$true}}};if($c){"SUCCESS"}else{"SKIP"}}

# =================================================================
# BLOCK 8: WINDOWS ERROR REPORTING (WATSON) ANNIHILATION
#
Write-Host "`n# --- BLOCK 8: WINDOWS ERROR REPORTING (WATSON) ANNIHILATION ---" -F Magenta

Step-Check "8.1 Disable WerSvc & Policies"{$n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=$false;$svc="WerSvc";if((Get-Service $svc -EA 0).StartType -ne "Disabled"){. $n -U:T sc config $svc start=disabled >$null 2>&1;. $n -U:T sc stop $svc >$null 2>&1;$c=$true};$pol='HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting';if(!(Test-Path $pol)){. $n -U:T reg add $pol /f >$null;$c=$true};@("Disabled","DontSendAdditionalData","DontShowUI","LoggingDisabled")|%{if((gp $pol $_ -EA 0).$_ -ne 1){. $n -U:T reg add $pol /v $_ /t REG_DWORD /d 1 /f >$null;$c=$true}};$consent="$pol\Consent";if(!(Test-Path $consent)){. $n -U:T reg add $consent /f >$null;$c=$true};if((gp $consent "DefaultConsent" -EA 0).DefaultConsent -ne 0){. $n -U:T reg add $consent /v DefaultConsent /t REG_DWORD /d 0 /f >$null;$c=$true};$wer='HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting';if(!(Test-Path $wer)){. $n -U:T reg add $wer /f >$null;$c=$true};if((gp $wer "Disabled" -EA 0).Disabled -ne 1){. $n -U:T reg add $wer /v Disabled /t REG_DWORD /d 1 /f >$null;$c=$true};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "8.2 WER Disabled Default Profile"{$c=$false;$defPath="Registry::HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting";if(!(Test-Path $defPath)){ni $defPath -Force >$null;$c=$true};sp $defPath "Disabled" 1 -Type DWord -Force;$c=$true;if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "8.3 Purge WER Cache"{$c=$false;@("$env:LOCALAPPDATA\Microsoft\Windows\WER","C:\ProgramData\Microsoft\Windows\WER","C:\Windows\Temp\WER*")|%{if(Test-Path $_){&takeown /f $_ /r /a >$null 2>&1;&icacls $_ /grant Administrators:F /t /q >$null 2>&1;rm $_ -Recurse -Force -EA 0;mkdir $_ -Force >$null;&icacls $_ /inheritance:r /deny "Everyone:(W)" /q >$null 2>&1;attrib +s +h +r $_ >$null 2>&1;$c=$true}};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "8.4 Sterilize WER Tasks"{$c=$false;@("\Microsoft\Windows\Windows Error Reporting\","\Microsoft\Windows\WDI\")|%{$tp=$_;Get-ScheduledTask -TaskPath $_ -EA 0|%{Disable-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -EA 0 >$null;$tf="C:\Windows\System32\Tasks$($_.TaskPath)$($_.TaskName)";if(Test-Path $tf){&takeown /f $tf /a >$null 2>&1;&icacls $tf /grant Administrators:F /q >$null 2>&1;rm $tf -Force -EA 0;mkdir $tf -Force >$null;&icacls $tf /inheritance:r /deny "Everyone:(F)" /q >$null 2>&1;attrib +s +h +r $tf >$null 2>&1;$c=$true}}};if($c){"SUCCESS"}else{"SKIP"}}

# =================================================================
# BLOCK 9: COMPATTELRUNNER & COMPATIBILITY TELEMETRY NEUTRALIZATION
# 
Write-Host "`n# --- BLOCK 9: COMPATTELRUNNER & COMPATIBILITY TELEMETRY NEUTRALIZATION ---" -F Magenta

Step-Check "9.1 Disable CompatTel Tasks & Telemetry Policies"{$n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=$false;@("\Microsoft\Windows\Application Experience\","\Microsoft\Windows\Customer Experience Improvement Program\","\Microsoft\Windows\Device Metadata\")|%{$tp=$_;Get-ScheduledTask -TaskPath $_ -EA 0|?{$_.TaskName -match "Microsoft Compatibility Appraiser|Consolidator|KernelCeipTask|UsbCeip|DeviceCensus"}|%{Disable-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -EA 0 >$null;$tf="C:\Windows\System32\Tasks$($_.TaskPath)$($_.TaskName)";if(Test-Path $tf){&takeown /f $tf /a >$null 2>&1;&icacls $tf /grant Administrators:F /q >$null 2>&1;rm $tf -Force -EA 0;mkdir $tf -Force >$null;&icacls $tf /inheritance:r /deny "Everyone:(F)" /q >$null 2>&1;attrib +s +h +r $tf >$null 2>&1;$c=$true}}};$diag='HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection';if(!(Test-Path $diag)){. $n -U:T reg add $diag /f >$null;$c=$true};@("AllowTelemetry","MaxTelemetryAllowed")|%{if((gp $diag $_ -EA 0).$_ -ne 0){. $n -U:T reg add $diag /v $_ /t REG_DWORD /d 0 /f >$null;$c=$true}};$compat='HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags';if(!(Test-Path $compat)){. $n -U:T reg add $compat /f >$null;$c=$true};@("DisableInventory","DisableUCA","DisablePCA")|%{. $n -U:T reg add "$compat\InstalledSDB" /v $_ /t REG_DWORD /d 1 /f >$null;$c=$true};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "9.2 Apply Telemetry Policies to Default Profile"{$c=$false;$defdiag='Registry::HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Windows\DataCollection';if(!(Test-Path $defdiag)){ni $defdiag -Force >$null;$c=$true};sp $defdiag "AllowTelemetry" 0 -Type DWord -Force;$c=$true;if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "9.3 IFEO Lock & Cache Purge"{$n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=$false;@("C:\Windows\System32\CompatTelRunner.exe","C:\Windows\SysWOW64\CompatTelRunner.exe","C:\Windows\System32\DeviceCensus.exe")|%{if(Test-Path $_){$ifeo="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$(Split-Path $_ -Leaf)";if(!(Test-Path $ifeo)){. $n -U:T reg add $ifeo /f >$null};. $n -U:T reg add $ifeo /v Debugger /t REG_SZ /d "cmd.exe /c exit" /f >$null 2>&1;$c=$true}};cmd /c "taskkill /F /IM CompatTelRunner.exe /T 2>nul" | Out-Null;cmd /c "taskkill /F /IM DeviceCensus.exe /T 2>nul" | Out-Null;@("C:\ProgramData\Microsoft\Diagnosis","C:\Windows\System32\CompatTel","$env:LOCALAPPDATA\Microsoft\Windows\CompatTel")|%{if(Test-Path $_){rm $_ -Recurse -Force -EA 0;mkdir $_ -Force >$null;&icacls $_ /inheritance:r /deny "Everyone:(F)" /q >$null 2>&1;$c=$true}};if($c){"SUCCESS"}else{"SKIP"}}

# =================================================================
# CLEANING SYSTEM EVENT LOGS
#
Write-Host "`n# --- CLEANING SYSTEM EVENT LOGS ---" -F Magenta
Step-Check "Clear Telemetry & Update Logs" { $e=0; "Setup","System","Application","Microsoft-Windows-WindowsUpdateClient/Operational","Microsoft-Windows-Shell-Core/Operational"|% { wevtutil.exe cl $_ 2>$null; if($LASTEXITCODE-ne0){$e++} }; if($e-lt 3){"SUCCESS"}else{"FAIL"} }

# =================================================================
# RESULT
#
Write-Host "`n=== JIU LONG: SYSTEM FORTIFIED ===" -F Cyan
Write-Host "Press any key to exit..."
$null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
}