# =================================================================
# JIU LONG GOLDEN HYBRID (ДЕВЯТЬ ПОВЕЛИТЕЛЕЙ ДРАКОНОВ + GOLDEN OPTIMIZATION) - Windows 11 24H2
# =================================================================
& {
if (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(544)) { Start-Process PowerShell "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs; exit }
$ErrorActionPreference = "Stop"
function Step-Check($Name, $Action) { try { $res = & $Action; switch ($res) { "NOT_FOUND" { Write-Host "$Name [FAIL]" -F Yellow } "SKIP" { Write-Host "$Name [SKIP]" -F Blue } "SUCCESS" { Write-Host "$Name [OK]" -F Green } default { Write-Host "$Name [FAIL]" -F Red } } } catch { Write-Host "$Name [FAIL]" -F Red; Write-Host "  >> Details: $($_.Exception.Message)" -F Red } }
Write-Host "`n=== Jiu Long Golden Hybrid (Девять Повелителей Драконов + Golden) ===`n" -F Cyan
$script:nsudoPath = "NSudoLG.exe"

# =================================================================
# BLOCK 1: PERMANENT WSUS LOCKDOWN (без сервера, чисто реестр + услуги + SIH хардлок)
# 
Write-Host "`n# --- BLOCK 1: PERMANENT WSUS LOCKDOWN (без сервера) ---" -F Magenta

Step-Check "1.2 Set core WSUS registry policies" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate';if((gp $k WUServer -EA 0).WUServer -eq "http://127.0.0.1:8531" -and (gp $k DisableWindowsUpdateAccess -EA 0).DisableWindowsUpdateAccess -eq 1){"SKIP"}else{. $n -U:T reg add $k /v WUServer /t REG_SZ /d "http://127.0.0.1:8531" /f 2>$null;. $n -U:T reg add $k /v WUStatusServer /t REG_SZ /d "http://127.0.0.1:8531" /f 2>$null;. $n -U:T reg add $k /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f 2>$null;. $n -U:T reg add $k /v UseWUServer /t REG_DWORD /d 1 /f 2>$null;. $n -U:T reg add $k /v DisableDualScan /t REG_DWORD /d 1 /f 2>$null;"SUCCESS"} }

Step-Check "1.3 Set AU registry policies" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU';if((gp $k NoAutoUpdate -EA 0).NoAutoUpdate -eq 1 -and (gp $k AUOptions -EA 0).AUOptions -eq 1){"SKIP"}else{. $n -U:T reg add $k /v NoAutoUpdate /t REG_DWORD /d 1 /f 2>$null;. $n -U:T reg add $k /v AUOptions /t REG_DWORD /d 1 /f 2>$null;"SUCCESS"} }

Step-Check "1.4 Restore UserInit & IdentSvc" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path "X:\PortableApps\NSudo_9.0_Preview1_9.0.2676.0\NSudoLG.exe"){"X:\PortableApps\NSudo_9.0_Preview1_9.0.2676.0\NSudoLG.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return}; . $n -U:T reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v UserInit /t REG_SZ /d "C:\Windows\system32\userinit.exe" /f >$null; . $n -U:T reg add "HKLM\SYSTEM\CurrentControlSet\Services\IdentSvc\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\identsvc.dll" /f >$null; . $n -U:T sc config IdentSvc start= demand >$null; "SUCCESS" }

Step-Check "1.5 Disable update services" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$s=@('wuauserv','UsoSvc','WaaSMedicSvc');$all=$true;$s|%{$svc=Get-Service $_ -EA 0;if($svc-and$svc.StartType-ne'Disabled'){$all=$false}};if($all){"SKIP"}else{$s|%{. $n -U:T sc config $_ start=disabled 2>$null;. $n -U:T sc stop $_ /force 2>$null};if($LASTEXITCODE-eq0){"SUCCESS"}else{"FAIL"}} }

# =================================================================
# BLOCK 3: BING & SEARCH NETWORK ISOLATION (усилено из Golden: Apex isolation)
# 
Write-Host "`n# --- BLOCK 3: BING SEARCH ANNIHILATION & NETWORK ISOLATION ---" -F Magenta

Step-Check "3.1 Disable Cloud Search Registry" { $c=$false; @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Search","HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search")|%{$p=$_;if(!(Test-Path $p)){ni $p -Force >$null;$c=$true};@("BingSearchEnabled","AllowSearchToUseLocation","ConnectedSearchUseWeb","AllowCortana")|%{$v=(gp $p $_ -EA 0).$_;if($v -ne 0){sp $p $_ 0 -Type DWord -Force;$c=$true}};if((gp $p "DisableWebSearch" -EA 0).DisableWebSearch -ne 1){sp $p "DisableWebSearch" 1 -Type DWord -Force;$c=$true}};if($c){"SUCCESS"}else{"SKIP"} }

Step-Check "3.4 Remove Bing & Cortana AppX" { $r=$false; @("*Bing*","*Cortana*")|%{Get-AppxPackage -AllUsers $_ -EA 0|%{try{Remove-AppxPackage $_ -AllUsers -EA 0;$r=$true}catch{}}}; if($r){"SUCCESS"}else{"SKIP"} }

Step-Check "3.5 Search Policies Current+Default"{$c=$false;$search='HKCU:\Software\Microsoft\Windows\CurrentVersion\Search';if(!(Test-Path $search)){ni $search -Force >$null;$c=$true};@("BingSearchEnabled","DisableWebSearch","ConnectedSearchUseWeb","AllowCortana")|%{if((gp $search $_ -EA 0).$_ -ne 0){sp $search $_ 0 -Type DWord -Force;$c=$true}};sp $search "DisableWebSearch" 1 -Type DWord -Force;$c=$true;$exp='HKCU:\Software\Policies\Microsoft\Windows\Explorer';if(!(Test-Path $exp)){ni $exp -Force >$null;$c=$true};sp $exp "DisableSearchBoxSuggestions" 1 -Type DWord -Force;$c=$true;$defPath="Registry::HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Search";if(!(Test-Path $defPath)){ni $defPath -Force >$null;$c=$true};@("BingSearchEnabled","DisableWebSearch","ConnectedSearchUseWeb","AllowCortana")|%{sp $defPath $_ 0 -Type DWord -Force;$c=$true};sp $defPath "DisableWebSearch" 1 -Type DWord -Force;$c=$true;$defExpPath="Registry::HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Windows\Explorer";if(!(Test-Path $defExpPath)){ni $defExpPath -Force >$null;$c=$true};sp $defExpPath "DisableSearchBoxSuggestions" 1 -Type DWord -Force;$c=$true;if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "3.6 Global Policies+CBS Core"{$n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=$false;$ws='HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search';if(!(Test-Path $ws)){. $n -U:T reg add $ws /f >$null;$c=$true};@("DisableWebSearch","ConnectedSearchUseWeb","ConnectedSearchUseWebOverMeteredConnections","AllowCloudSearch","AllowCortana")|%{if((gp $ws $_ -EA 0).$_ -ne 0){. $n -U:T reg add $ws /v $_ /t REG_DWORD /d 0 /f >$null;$c=$true}};$exp='HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer';if(!(Test-Path $exp)){. $n -U:T reg add $exp /f >$null;$c=$true};if((gp $exp "DisableSearchBoxSuggestions" -EA 0).DisableSearchBoxSuggestions -ne 1){. $n -U:T reg add $exp /v DisableSearchBoxSuggestions /t REG_DWORD /d 1 /f >$null;$c=$true};$cbs='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CBS';if(!(Test-Path $cbs)){. $n -U:T reg add $cbs /f >$null;$c=$true};@("EnableWebContent","BingSearchEnabled","AllowCloudSearch")|%{if((gp $cbs $_ -EA 0).$_ -ne 0){. $n -U:T reg add $cbs /v $_ /t REG_DWORD /d 0 /f >$null;$c=$true}};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "3.7 UI Cache & AppX Reset" { &taskkill /F /IM StartMenuExperienceHost.exe /T >$null 2>&1; &taskkill /F /IM SearchHost.exe /T >$null 2>&1; @("Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy","Microsoft.Windows.Client.CBS_cw5n1h2txyewy")|%{ $l="$env:LOCALAPPDATA\Packages\$_\LocalState"; if(Test-Path $l){&takeown /f $l /r /a >$null; &icacls $l /grant "Administrators:(OI)(CI)F" /q >$null; rm "$l\*" -Recurse -Force -EA 0 >$null} }; "SUCCESS" }

# =================================================================
# BLOCK 4: TELEMETRY & DATA COLLECTION (усилено из Golden: diagsvc, FrameServer, location)
# 
Write-Host "`n# --- BLOCK 4: TELEMETRY & DATA COLLECTION ANNIHILATION ---" -F Magenta

Step-Check "4.9 Disable PowerShell Update & Discovery (из Golden)" { $p = "HKLM:\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell"; if (([Environment]::GetEnvironmentVariable("POWERSHELL_UPDATECHECK","Machine") -eq "Off") -and (Test-Path $p) -and ([string](gp $p -EA 0).DisableModuleAutoDiscovery -eq "1")) { "SKIP" } else { [Environment]::SetEnvironmentVariable("POWERSHELL_UPDATECHECK", "Off", "Machine"); [Environment]::SetEnvironmentVariable("POWERSHELL_TELEMETRY_OPTOUT", "1", "Machine"); if (!(Test-Path $p)) { ni $p -Force >$null }; sp $p "DisableModuleAutoDiscovery" 1 -Force; "SUCCESS" } }

# =================================================================
# BLOCK 5: COMPATTELRUNNER & COMPATIBILITY TELEMETRY NEUTRALIZATION
# 
Write-Host "`n# --- BLOCK 5: COMPATTELRUNNER & COMPATIBILITY TELEMETRY NEUTRALIZATION ---" -F Magenta

Step-Check "5.1 Disable CompatTel Tasks & Telemetry Policies"{$n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=$false;@("\Microsoft\Windows\Application Experience\","\Microsoft\Windows\Customer Experience Improvement Program\","\Microsoft\Windows\Device Metadata\")|%{$tp=$_;Get-ScheduledTask -TaskPath $_ -EA 0|?{$_.TaskName -match "Microsoft Compatibility Appraiser|Consolidator|KernelCeipTask|UsbCeip|DeviceCensus"}|%{Disable-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -EA 0 >$null;$tf="C:\Windows\System32\Tasks$($_.TaskPath)$($_.TaskName)";if(Test-Path $tf){&takeown /f $tf /a >$null 2>&1;&icacls $tf /grant Administrators:F /q >$null 2>&1;rm $tf -Force -EA 0;mkdir $tf -Force >$null;&icacls $tf /inheritance:r /deny "Everyone:(F)" /q >$null 2>&1;attrib +s +h +r $tf >$null 2>&1;$c=$true}}};$diag='HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection';if(!(Test-Path $diag)){. $n -U:T reg add $diag /f >$null;$c=$true};@("AllowTelemetry","MaxTelemetryAllowed")|%{if((gp $diag $_ -EA 0).$_ -ne 0){. $n -U:T reg add $diag /v $_ /t REG_DWORD /d 0 /f >$null;$c=$true}};$compat='HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags';if(!(Test-Path $compat)){. $n -U:T reg add $compat /f >$null;$c=$true};@("DisableInventory","DisableUCA","DisablePCA")|%{. $n -U:T reg add "$compat\InstalledSDB" /v $_ /t REG_DWORD /d 1 /f >$null;$c=$true};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "5.2 Apply Telemetry Policies to Default Profile"{$c=$false;$defdiag='Registry::HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Windows\DataCollection';if(!(Test-Path $defdiag)){ni $defdiag -Force >$null;$c=$true};sp $defdiag "AllowTelemetry" 0 -Type DWord -Force;$c=$true;if($c){"SUCCESS"}else{"SKIP"}}

# =================================================================
# BLOCK 7: MICROSOFT ACCOUNT SIGN-IN ASSISTANT (wlidsvc) NEUTRALIZATION
# =================================================================
Write-Host "`n# --- BLOCK 7: MICROSOFT ACCOUNT SIGN-IN ASSISTANT (wlidsvc) NEUTRALIZATION ---" -F Magenta

Step-Check "7.1 Disable wlidsvc & MSA Policies"{$n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=$false;$svc="wlidsvc";if((Get-Service $svc -EA 0).StartType -ne "Disabled"){. $n -U:T sc config $svc start=disabled >$null 2>&1;. $n -U:T sc stop $svc >$null 2>&1;$c=$true};$sysPol='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System';if(!(Test-Path $sysPol)){. $n -U:T reg add $sysPol /f >$null;$c=$true};@("NoConnectedUser","NoMicrosoftAccount")|%{if((gp $sysPol $_ -EA 0).$_ -ne 1){. $n -U:T reg add $sysPol /v $_ /t REG_DWORD /d 1 /f >$null;$c=$true}};$wam='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WebAccountManager';if(!(Test-Path $wam)){. $n -U:T reg add $wam /f >$null;$c=$true};if((gp $wam "AllowWAM" -EA 0).AllowWAM -ne 0){. $n -U:T reg add $wam /v AllowWAM /t REG_DWORD /d 0 /f >$null;$c=$true};$acc='HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Accounts';if(!(Test-Path $acc)){. $n -U:T reg add $acc /f >$null;$c=$true};if((gp $acc "AllowMicrosoftAccountConnection" -EA 0).AllowMicrosoftAccountConnection -ne 0){. $n -U:T reg add $acc /v AllowMicrosoftAccountConnection /t REG_DWORD /d 0 /f >$null;$c=$true};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "7.2 MSA Policies Default Profile"{$c=$false;$defPath="Registry::HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Windows\System";if(!(Test-Path $defPath)){ni $defPath -Force >$null;$c=$true};sp $defPath "NoConnectedUser" 1 -Type DWord -Force;$c=$true;if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "7.3 Purge Identity Cache"{$c=$false;@("$env:LOCALAPPDATA\Microsoft\IdentityCRL","$env:PROGRAMDATA\Microsoft\IdentityCRL","$env:LOCALAPPDATA\Microsoft\IdentityCache","$env:LOCALAPPDATA\Microsoft\Credentials","$env:LOCALAPPDATA\Microsoft\OneAuth","C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC")|%{if(Test-Path $_){&takeown /f $_ /r /a >$null 2>&1;&icacls $_ /grant Administrators:F /t /q >$null 2>&1;rm $_ -Recurse -Force -EA 0;mkdir $_ -Force >$null;&icacls $_ /inheritance:r /deny "Everyone:(F)" /q >$null 2>&1;attrib +s +h +r $_ >$null 2>&1;$c=$true}};if($c){"SUCCESS"}else{"SKIP"}}

# =================================================================
# BLOCK 8: WINDOWS ERROR REPORTING (WATSON) ANNIHILATION
#
Write-Host "`n# --- BLOCK 8: WINDOWS ERROR REPORTING (WATSON) ANNIHILATION ---" -F Magenta

Step-Check "8.3 Purge WER Cache"{$c=$false;@("$env:LOCALAPPDATA\Microsoft\Windows\WER","C:\ProgramData\Microsoft\Windows\WER","C:\Windows\Temp\WER*")|%{if(Test-Path $_){&takeown /f $_ /r /a >$null 2>&1;&icacls $_ /grant Administrators:F /t /q >$null 2>&1;rm $_ -Recurse -Force -EA 0;mkdir $_ -Force >$null;&icacls $_ /inheritance:r /deny "Everyone:(W)" /q >$null 2>&1;attrib +s +h +r $_ >$null 2>&1;$c=$true}};if($c){"SUCCESS"}else{"SKIP"}}

# =================================================================
# BLOCK 9: DEFENDER PASSIVE + SMARTSCREEN / SAC FINAL SILENCE
# =================================================================
Write-Host "`n# --- BLOCK 9: DEFENDER PASSIVE + SMARTSCREEN / SAC FINAL SILENCE ---" -F Magenta

Step-Check "9.4 Net Flush & Final Silence" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path "X:\PortableApps\NSudo_9.0_Preview1_9.0.2676.0\NSudoLG.exe"){"X:\PortableApps\NSudo_9.0_Preview1_9.0.2676.0\NSudoLG.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return}; . $n -U:T reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\System' /v EnableSmartScreen /t REG_DWORD /d 0 /f >$null; ipconfig /flushdns >$null; netsh winsock reset >$null; "SUCCESS" }

Step-Check "9.5 Disable Security & Telemetry Tasks" {$c=$false;@("\Microsoft\Windows\Windows Defender\","\Microsoft\Windows\SmartScreen\","\Microsoft\Windows\Application Experience\","\Microsoft\Windows\Customer Experience Improvement Program\")|%{Get-ScheduledTask -TaskPath $_ -EA 0|?{$_.TaskName -match "SmartScreen|Reputation|Appraiser|Telemetry|Cache|Cleanup|Scan|Verification|Update"}|%{if($_.State -ne "Disabled"){Disable-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -EA 0 >$null;$c=$true}}};if($c){"SUCCESS"}else{"SKIP"}}

# =================================================================
# BLOCK 10: ONEDRIVE & FEEDBACK HUB REMOVAL (из Golden)
# 
Write-Host "`n# --- BLOCK 10: ONEDRIVE & FEEDBACK HUB REMOVAL ---" -F Magenta

Step-Check "10.1 Clean OneDrive Residuals (из Golden)" { ps OneDrive -EA 0 | stop-process -Force -EA 0; $d = @("$env:LocalAppData\Microsoft\OneDrive","$env:UserProfile\OneDrive","C:\OneDriveTemp"); $c = "HKCR:\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}"; $exists = $d | ? { Test-Path $_ }; $reg = (gp $c -EA 0)."System.IsPinnedToNameSpaceTree"; if (!$exists -and ([string]$reg -eq "0" -or !$reg)) { "SKIP" } else { $d | % { if (Test-Path $_) { rm $_ -Recurse -Force -EA 0 } }; if (Test-Path $c) { sp $c "System.IsPinnedToNameSpaceTree" 0 -Force } } }

Step-Check "10.2 Remove Feedback Hub & Cloud Content" {try{$c=$false;$n="Microsoft.WindowsFeedbackHub";$a=Get-AppxPackage $n -AllUsers -EA 0;$p=Get-AppxProvisionedPackage -Online -EA 0|?{$_.DisplayName -eq $n};if($a){$a|Remove-AppxPackage -AllUsers -EA 0;$c=$true};if($p){Remove-AppxProvisionedPackage -Online -PackageName $p.PackageName -EA 0>$null;$c=$true};$cp="HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent";if(!(Test-Path $cp)){ni $cp -Force>$null};if((gp $cp -EA 0).DisableWindowsConsumerFeatures -ne 1){sp $cp "DisableWindowsConsumerFeatures" 1 -T DWord -F;$c=$true};if($c){"SUCCESS"}else{"SKIP"}}catch{"FAIL"}}

# =================================================================
# BLOCK 11: OFFICE CLICK-TO-RUN ANNIHILATION (из Golden: LTSC 2024)
# 
Write-Host "`n# --- BLOCK 11: OFFICE CLICK-TO-RUN ANNIHILATION ---" -F Magenta

Step-Check "11.1 Kill, Hard-Lock & Trap Office CTR" {$c=$false;$s="ClickToRunSvc";Stop-Service $s -Force -EA 0;Set-Service $s -StartupType Disabled -EA 0;$r="HKLM:\SYSTEM\CurrentControlSet\Services\$s";if((gp $r Start -EA 0).Start -ne 4){sp $r Start 4 -Type DWord -Force;$c=$true};if($c){"SUCCESS"}else{"SKIP"}}

# =================================================================
# BLOCK 12: INTERFACE & UX OPTIMIZATION (из Golden: без ломания Пуска)
# 
Write-Host "`n# --- BLOCK 12: INTERFACE & UX OPTIMIZATION ---" -F Magenta

Step-Check "12.1 Enable Run History (из Golden)" { $p = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"; if (!(Test-Path $p)) { ni $p -Force >$null }; if ([string](gp $p -EA 0).Start_TrackProgs -eq "1") { "SKIP" } else { sp $p "Start_TrackProgs" 1 -Force } }

Step-Check "12.2 Enable Recommended Items (из Golden)" { $p = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"; if (!(Test-Path $p)) { ni $p -Force >$null }; if ([string](gp $p -EA 0).Start_TrackDocs -eq "1") { "SKIP" } else { sp $p "Start_TrackDocs" 1 -Force } }

Step-Check "12.3 Force User Consent (webcam) (из Golden)" { $u="HKCU:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam"; $m="HKLM:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam"; if(!(Test-Path $u)){ni $u -Force >$null}; if(!(Test-Path $m)){ni $m -Force >$null}; if((gp $u -EA 0).Value -eq "Deny" -and (gp $m -EA 0).Value -eq "Deny"){"SKIP"}else{sp $u "Value" "Deny" -Force; sp $m "Value" "Deny" -Force} }

Step-Check "12.4 Force User Consent (microphone) (из Golden)" { $u="HKCU:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone"; $m="HKLM:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone"; if(!(Test-Path $u)){ni $u -Force >$null}; if(!(Test-Path $m)){ni $m -Force >$null}; if((gp $u -EA 0).Value -eq "Deny" -and (gp $m -EA 0).Value -eq "Deny"){"SKIP"}else{sp $u "Value" "Deny" -Force; sp $m "Value" "Deny" -Force} }

# =================================================================
# BLOCK 13: DISABLE SETTINGS CONSUMER FEATURES
#
Write-Host "`n# --- CLEANING SYSTEM EVENT LOGS ---" -F Magenta

Step-Check "13.1 Disable Settings consumer features & suggestions (Registry)" { $c=$false;$k1='HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent';if(!(Test-Path $k1)){ni $k1 -Force>$null;$c=$true};@("DisableWindowsConsumerFeatures","DisableConsumerFeatures")|%{if((gp $k1 $_ -EA 0).$_ -ne 1){& $n -U:T reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v $_ /t REG_DWORD /d 1 /f >$null 2>&1;$c=$true}};$k2='HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager';if(!(Test-Path $k2)){ni $k2 -Force>$null;$c=$true};@("SubscribedContent-338387Enabled","SubscribedContent-338388Enabled","SubscribedContent-338389Enabled")|%{if((gp $k2 $_ -EA 0).$_ -ne 0){sp $k2 $_ 0 -Type DWord -Force;$c=$true}};$k3='HKCU:\Software\Microsoft\Windows\CurrentVersion\SearchSettings';if(!(Test-Path $k3)){ni $k3 -Force>$null;$c=$true};@("IsMSACloudSearchEnabled","IsAADCloudSearchEnabled")|%{sp $k3 $_ 0 -Type DWord -Force;$c=$true};if($c){"SUCCESS"}else{"SKIP"} }

Step-Check "13.2 Disable Shell Cloud Experience Task (GUID 222A245B)" { $t="\Microsoft\Windows\Shell\CreateObjectTask"; if((Get-ScheduledTask -TaskName $t -EA 0).State -ne 'Disabled'){Disable-ScheduledTask -TaskName $t -EA 0|Out-Null;"SUCCESS"}else{"SKIP"} }

# =================================================================
# DISABLE BITS & TELEMETRY TASKS
# 
Write-Host "`n# --- DISABLE BITS & TELEMETRY TASKS ---" -F Magenta
Step-Check "Disable BITS & Live Tasks" { $ts="UsageDataReceiver","UsageDataReporting","ScanForUpdates","Office Automatic Updates 2.0","Office ClickToRun Service Monitor","SpeechModelDownloadTask"; sc.exe config BITS start= disabled >$null; sc.exe stop BITS >$null; Get-ScheduledTask -TaskName $ts -EA 0 | Disable-ScheduledTask -EA 0 >$null; "SUCCESS" }

# =================================================================
# CLEANING SYSTEM EVENT LOGS
#
Write-Host "`n# --- CLEANING SYSTEM EVENT LOGS ---" -F Magenta
Step-Check "Clear Telemetry & Update Logs" { $e=0; "Setup","System","Application","Microsoft-Windows-WindowsUpdateClient/Operational","Microsoft-Windows-Shell-Core/Operational"|% { wevtutil.exe cl $_ 2>$null; if($LASTEXITCODE-ne0){$e++} }; if($e-lt 3){"SUCCESS"}else{"FAIL"} }

# =================================================================
# RESULT
#
Write-Host "`n=== JIU LONG GOLDEN HYBRID: SYSTEM FORTIFIED AS QUIET LTSC ===" -F Cyan
Write-Host "Press any key to exit..."
$null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
}