# =================================================================
# JIU LONG GOLDEN HYBRID (ДЕВЯТЬ ПОВЕЛИТЕЛЕЙ ДРАКОНОВ + GOLDEN OPTIMIZATION) - Windows 11 24H2
# =================================================================
& {
if (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(544)) { Start-Process PowerShell "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs; exit }
$ErrorActionPreference = "Stop"
function Step-Check($Name, $Action) { try { $res = & $Action; switch ($res) { "NOT_FOUND" { Write-Host "$Name [FAIL]" -F Yellow } "SKIP" { Write-Host "$Name [SKIP]" -F Blue } "SUCCESS" { Write-Host "$Name [OK]" -F Green } default { Write-Host "$Name [FAIL]" -F Red } } } catch { Write-Host "$Name [FAIL]" -F Red; Write-Host "  >> Details: $($_.Exception.Message)" -F Red } }
Write-Host "`n=== Jiu Long Golden Hybrid (Девять Повелителей Драконов + Golden) ===`n" -F Cyan
$script:nsudoPath = "NSudoLG.exe"

# =================================================================
# BLOCK 1: PERMANENT WSUS LOCKDOWN (без сервера, чисто реестр + услуги + SIH хардлок)
# 
Write-Host "`n# --- BLOCK 1: PERMANENT WSUS LOCKDOWN (без сервера) ---" -F Magenta

Step-Check "1.1 Kill WSUS-related processes (из Golden)" { $proc = "WaaSMedicAgent","CompatTelRunner","MoUsoCoreWorker","USOClient","UsoClient"; $j = 1; foreach ($n in $proc) { $p = Get-Process $n -EA 0; if ($p) { $p | Stop-Process -Force -EA 0 } }; "SUCCESS" }

Step-Check "1.2 Set core WSUS registry policies" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate';if((gp $k WUServer -EA 0).WUServer -eq "http://127.0.0.1:8531" -and (gp $k DisableWindowsUpdateAccess -EA 0).DisableWindowsUpdateAccess -eq 1){"SKIP"}else{. $n -U:T reg add $k /v WUServer /t REG_SZ /d "http://127.0.0.1:8531" /f 2>$null;. $n -U:T reg add $k /v WUStatusServer /t REG_SZ /d "http://127.0.0.1:8531" /f 2>$null;. $n -U:T reg add $k /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f 2>$null;. $n -U:T reg add $k /v UseWUServer /t REG_DWORD /d 1 /f 2>$null;. $n -U:T reg add $k /v DisableDualScan /t REG_DWORD /d 1 /f 2>$null;"SUCCESS"} }

Step-Check "1.3 Set AU registry policies" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU';if((gp $k NoAutoUpdate -EA 0).NoAutoUpdate -eq 1 -and (gp $k AUOptions -EA 0).AUOptions -eq 1){"SKIP"}else{. $n -U:T reg add $k /v NoAutoUpdate /t REG_DWORD /d 1 /f 2>$null;. $n -U:T reg add $k /v AUOptions /t REG_DWORD /d 1 /f 2>$null;"SUCCESS"} }

Step-Check "1.4 Restore UserInit & IdentSvc" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path "X:\PortableApps\NSudo_9.0_Preview1_9.0.2676.0\NSudoLG.exe"){"X:\PortableApps\NSudo_9.0_Preview1_9.0.2676.0\NSudoLG.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return}; . $n -U:T reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v UserInit /t REG_SZ /d "C:\Windows\system32\userinit.exe" /f >$null; . $n -U:T reg add "HKLM\SYSTEM\CurrentControlSet\Services\IdentSvc\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\identsvc.dll" /f >$null; . $n -U:T sc config IdentSvc start= demand >$null; "SUCCESS" }

Step-Check "1.5 Disable update services" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$s=@('wuauserv','UsoSvc','WaaSMedicSvc');$all=$true;$s|%{$svc=Get-Service $_ -EA 0;if($svc-and$svc.StartType-ne'Disabled'){$all=$false}};if($all){"SKIP"}else{$s|%{. $n -U:T sc config $_ start=disabled 2>$null;. $n -U:T sc stop $_ /force 2>$null};if($LASTEXITCODE-eq0){"SUCCESS"}else{"FAIL"}} }

Step-Check "1.6 SIH Hard Lockdown (усилено из Golden: IFEO + ACL)" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=0;@("\Microsoft\Windows\UpdateOrchestrator\Sih","\Microsoft\Windows\WindowsUpdate\sih","\Microsoft\Windows\WindowsUpdate\sihboot")|%{$tp=($_-split'\\')[0..-2]-join'\';$tn=($_-split'\\')[-1];Disable-ScheduledTask -TaskPath $tp -TaskName $tn -EA 0 >$null;$tf="C:\Windows\System32\Tasks$_";if(Test-Path $tf){& takeown /f $tf /a >$null 2>&1;if($LASTEXITCODE-eq0){& icacls $tf /grant Administrators:F /q >$null 2>&1;if($LASTEXITCODE-eq0){rm $tf -Recurse -Force -EA 0 2>&1;Start-Sleep -Milliseconds 500;mkdir $tf -Force -EA 0 >$null 2>&1;Start-Sleep -Milliseconds 500;& icacls $tf /inheritance:r /deny Everyone:F /q >$null 2>&1;if($LASTEXITCODE-eq0-and(Test-Path $tf -PathType Container)){attrib +s +h +r $tf >$null 2>&1;$c++}}}}};. $n -U:T reg add 'HKLM\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator' /v DisableSIH /t REG_DWORD /d 1 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++};$r="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SihClient.exe";if(!(Test-Path $r)){ni $r -Force >$null;$c++};sp $r "Debugger" "systray.exe" -Force -EA 0;$r2="HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\SIH";. $n -U:T reg add $r2 /v "Url" /t REG_SZ /d "http://127.0.0.1:8531" /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++};cmd /c "$n -U:T icacls `"$r2`" /inheritance:r /deny Everyone:F /q" >$null 2>&1;if($LASTEXITCODE-eq0){$c++};if($c-gt0){"SUCCESS"}else{"SKIP"} }

Step-Check "1.7 Targeted wuauserv Leak Block (усилено из Golden: tasks + ACL)" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=0;$exe="UsoClient.exe";$ip="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$exe";if(!(Test-Path $ip)){ni $ip -Force >$null;$c++};sp $ip "Debugger" "systray.exe" -Force -EA 0;if($?){$c++};$path="\Microsoft\Windows\UpdateOrchestrator\";@("USO_UxBroker","Schedule Scan","Schedule Scan Static Task","UpdateModelTask","ScanForUpdatesAsUser")|%{$tn=$_;Disable-ScheduledTask -TaskPath $path -TaskName $tn -EA 0 >$null;$tf="C:\Windows\System32\Tasks$path$tn";if(Test-Path $tf){& takeown /f $tf /a >$null 2>&1;if($LASTEXITCODE-eq0){& icacls $tf /grant Administrators:F /q >$null 2>&1;if($LASTEXITCODE-eq0){rm $tf -Recurse -Force -EA 0 2>&1;Start-Sleep -Milliseconds 500;mkdir $tf -Force -EA 0 >$null 2>&1;Start-Sleep -Milliseconds 500;& icacls $tf /inheritance:r /deny Everyone:F /q >$null 2>&1;if($LASTEXITCODE-eq0 -and (Test-Path $tf -PathType Container)){attrib +s +h +r $tf >$null 2>&1;$c++}}}}};$auKey='HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate';. $n -U:T reg add $auKey /v DoNotConnectToWindowsUpdateInternetLocations /t REG_DWORD /d 1 /f >$null 2>&1;if($LASTEXITCODE-eq0){$c++};try{$acl=Get-Acl $auKey -EA Stop;$rule=New-Object System.Security.AccessControl.RegistryAccessRule("Everyone","FullControl","Deny");$acl.SetAccessRule($rule);Set-Acl $auKey $acl -EA Stop;$c++}catch{};if($c-gt0){"SUCCESS"}else{"SKIP"} }

Step-Check "1.8 CryptSvc & Cert Neutralization" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path "X:\PortableApps\NSudo_9.0_Preview1_9.0.2676.0\NSudoLG.exe"){"X:\PortableApps\NSudo_9.0_Preview1_9.0.2676.0\NSudoLG.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return}; . $n -U:T reg add "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot" /v "DisableRootAutoUpdate" /t REG_DWORD /d 1 /f >$null; . $n -U:T reg add "HKLM\SOFTWARE\Policies\Microsoft\Cryptography" /v "EnableCertRevocationCheck" /t REG_DWORD /d 0 /f >$null; . $n -U:T reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Certificates" /v "ChainRevocationTimeout" /t REG_DWORD /d 1 /f >$null; "SUCCESS" }

Step-Check "1.9 Neutralize Core Executables (из Golden: .bak + ACL)" { $t = @("C:\Windows\System32\WaaSMedicSvc.dll","C:\Windows\System32\usoclient.exe","C:\Windows\System32\MoUsoCoreWorker.exe","C:\Windows\System32\CompatTelRunner.exe","C:\Windows\System32\dmwappushservice.dll"); $b = "taskkill /f /im usoclient.exe /t >nul 2>&1`r`ntaskkill /f /im MoUsoCoreWorker.exe /t >nul 2>&1`r`n"; foreach ($f in $t) { $b += "if exist `"$f`" (takeown /f `"$f`" /a >nul && icacls `"$f`" /grant Administrators:F /q >nul && attrib -s -h -r `"$f`" >nul && (if not exist `"$f.bak`" (move /y `"$f`" `"$f.bak`" >nul) else (del /f /q `"$f`" >nul)) && mkdir `"$f`" && icacls `"$f`" /inheritance:r /deny Everyone:(F) /q >nul)`r`n" }; $p = "$env:TEMP\sb.bat"; $b | Out-File $p -Encoding OEM; try { $a = New-ScheduledTaskAction -Execute "cmd.exe" -Argument "/c $p"; $pr = New-ScheduledTaskPrincipal -UserId "NT AUTHORITY\SYSTEM" -RunLevel Highest; Register-ScheduledTask "SysBlocker" -Action $a -Principal $pr -Force >$null; Start-ScheduledTask "SysBlocker"; Start-Sleep -s 3; $ConfirmPreference = 'None'; Unregister-ScheduledTask "SysBlocker" -Confirm:$false -EA 0; if(Test-Path $p){rm $p -Force} } catch { throw "SYSTEM elevation failed" } }

Step-Check "1.10 WaaSMedicSvc - Privilege Escalation & ACL Lock" {$r="HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc";if((gp $r -EA 0).Start -eq 4 -or !(Test-Path $r)){"SKIP"}else{try{Stop-Service WaaSMedicSvc -Force -EA 0;sp $r Start 4 -Type DWord -Force;"SUCCESS"}catch{"SKIP"}}}

Step-Check "1.11 WaaSMedic - Binary Neutralization & IFEO (из Golden)" { try { $ch=$false; $files=@("$env:SystemRoot\System32\WaaSMedicSvc.dll","$env:SystemRoot\System32\drivers\WaaSMedic.sys"); foreach($f in $files){ if(Test-Path $f){ & takeown /f $f /a >$null; & icacls $f /grant Administrators:F /c /l /q >$null; if($f -notlike "*.bak*"){$bak="$f.bak"; if(!(Test-Path $bak)){Move-Item $f $bak -Force -EA 0; if(!(Test-Path $f)){ni $f -Type Directory -Force >$null; & icacls $f /inheritance:r /deny Everyone:F /q >$null; $ch=$true}}} } }; $ifeo="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WaaSMedicAgent.exe"; if(!(Test-Path $ifeo)){ni $ifeo -Force>$null; sp $ifeo Debugger "cmd.exe /c exit" -Force; $ch=$true}; if($ch){"SUCCESS"}else{"SKIP"} } catch { throw "Binary lock failed: $($_.Exception.Message)" } }

Step-Check "1.12 Ultimate BITS Hard Lock (IFEO + ACL + Binary Neutralization)" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=0;. $n -U:T sc config BITS start=disabled 2>$null;. $n -U:T sc stop BITS 2>$null;$ifeo="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options";@("bitsadmin.exe","qmgr.exe")|%{$p="$ifeo\$_";if(!(Test-Path $p)){ni $p -Force | Out-Null;$c++};sp $p Debugger "cmd.exe /c exit" -Force -EA 0;$c++};$bf=@("C:\Windows\System32\qmgr.dll","C:\Windows\System32\qmgrprxy.dll","C:\Windows\System32\bitsadmin.exe");foreach($f in $bf){if(Test-Path $f){& takeown /f $f /a >$null 2>&1;& icacls $f /grant Administrators:F /q >$null 2>&1;attrib -s -h -r $f >$null 2>&1;$bak="$f.bak";if(!(Test-Path $bak)){move $f $bak -Force -EA 0 >$null}ni $f -Type Directory -Force | Out-Null;& icacls $f /inheritance:r /deny Everyone:F /q >$null 2>&1;$c++}};if($c-gt0){"SUCCESS"}else{"SKIP"} }

Step-Check "1.13 Create & Enforce WindowsUpdate\AU Policies (NoAutoUpdate + AUOptions)" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU';$changed=$false;if(!(Test-Path $k)){. $n -U:T reg add $k /f 2>$null;$changed=$true};if((gp $k NoAutoUpdate -EA 0).NoAutoUpdate -ne 1){. $n -U:T reg add $k /v NoAutoUpdate /t REG_DWORD /d 1 /f 2>$null;$changed=$true};if((gp $k AUOptions -EA 0).AUOptions -ne 1){. $n -U:T reg add $k /v AUOptions /t REG_DWORD /d 1 /f 2>$null;$changed=$true};gpupdate /force >$null 2>&1;if($changed){"SUCCESS"}else{"SKIP"} }

Step-Check "1.14 Disable Critical UpdateOrchestrator & InstallService Tasks" { $tasks=@("\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker","\Microsoft\Windows\InstallService\ScanForUpdatesAsUser","\Microsoft\Windows\InstallService\WakeUpAndContinueUpdates","\Microsoft\Windows\InstallService\WakeUpAndScanForUpdates","\Microsoft\Windows\UpdateOrchestrator\StartOobeAppsScanAfterUpdate");$c=0;foreach($t in $tasks){$tp=($t-split'\\')[0..-2]-join'\';$tn=($t-split'\\')[-1];$st=Get-ScheduledTask -TaskPath $tp -TaskName $tn -EA 0;if($st -and $st.State -ne "Disabled"){Disable-ScheduledTask -TaskPath $tp -TaskName $tn -EA 0 >$null;$c++}};if($c-gt0){"SUCCESS"}else{"SKIP"} }

Step-Check "1.15 Purge SoftwareDistribution & catroot2 (Safe Rename + ACL Lock)" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=0;$sd="C:\Windows\SoftwareDistribution";$cr="C:\Windows\System32\catroot2";$crOld="$cr.old";if(Test-Path $sd){. $n -U:T sc stop wuauserv 2>$null;. $n -U:T sc stop BITS 2>$null;rm $sd -Recurse -Force -EA 0 >$null;ni $sd -Force | Out-Null;. $n -U:T icacls $sd /inheritance:r /deny Everyone:F /q >$null 2>&1;attrib +s +h +r $sd >$null 2>&1;$c++};if(Test-Path $cr){. $n -U:T sc stop cryptsvc 2>$null;Start-Sleep -s 2;if(Test-Path $crOld){rm $crOld -Recurse -Force -EA 0 >$null};. $n -U:T ren $cr catroot2.old 2>$null;Start-Sleep -s 1;. $n -U:T sc start cryptsvc 2>$null;Start-Sleep -s 3;if(Test-Path $cr){. $n -U:T icacls $cr /inheritance:r /deny Everyone:F /q >$null 2>&1;attrib +s +h +r $cr >$null 2>&1;$c++}};if($c-gt0){"SUCCESS"}else{"SKIP"} }

Step-Check "1.16 IFEO Lock on Remaining Update Leakers (UsoClient, MoUsoCoreWorker)" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=0;@("UsoClient.exe","MoUsoCoreWorker.exe","WaaSMedicAgent.exe")|%{$p="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$_";if(!(Test-Path $p)){ni $p -Force | Out-Null;$c++};sp $p Debugger "cmd.exe /c exit" -Force -EA 0;$c++};if($c-gt0){"SUCCESS"}else{"SKIP"} }

Step-Check "1.17 Disable Web Search & Network in Start/Search (24H2 Safe Fix)" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=0;$keys=@("HKCU:\Software\Policies\Microsoft\Windows\Explorer","HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search","HKCU:\Software\Microsoft\Windows\CurrentVersion\Search","HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager","HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent");foreach($k in $keys){if(!(Test-Path $k)){. $n -U:T reg add $k /f 2>$null;$c++}};$vals=@("DisableSearchBoxSuggestions","ConnectedSearchUseWeb","ConnectedSearchUseWebOverMeteredConnections","BingSearchEnabled","AllowCortana","DisableWebSearch","SubscribedContent-338389Enabled","SubscribedContent-353694Enabled","SubscribedContent-353696Enabled","SystemPaneSuggestionsEnabled","RotatingLockScreenEnabled","RotatingLockScreenOverlayEnabled","DisableWindowsConsumerFeatures","DisableSoftLanding","DisableCloudOptimizedContent","DisableWindowsSpotlightFeatures");foreach($k in $keys){foreach($v in $vals){if((gp $k $v -EA 0).$v -ne 0){. $n -U:T reg add $k /v $v /t REG_DWORD /d 0 /f 2>$null;$c++}}};. $n -U:T reg add "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v AllowCloudSearch /t REG_DWORD /d 0 /f 2>$null;$c++;. $n -U:T reg add "HKCU:\Software\Policies\Microsoft\Windows\Explorer" /v DisableSearchBoxSuggestions /t REG_DWORD /d 1 /f 2>$null;$c++;Get-ScheduledTask|?{$_.TaskName -match "Search|StartMenu|ContentDelivery|Spotlight|CloudContent|DispatchPremiumContent|IndexDeclaration"}|%{if($_.State -ne "Disabled"){Disable-ScheduledTask $_ -EA 0 >$null;$c++}};gpupdate /force >$null 2>&1;if($c-gt0){"SUCCESS"}else{"SKIP"} }

Step-Check "1.18 Block CBS & SearchHost Network (Firewall)" { $exe="C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"; if(!(Test-Path $exe)){"NOT_FOUND";return}; netsh advfirewall firewall add rule name="Block CBS SearchHost Out" dir=out action=block program="$exe" enable=yes >$null 2>&1; if($LASTEXITCODE -eq 0){"SUCCESS"}else{"FAIL"} }


# =================================================================
# BLOCK 2: EDGE TOTAL ANNIHILATION (усилено из Golden: force-uninstall + services delete)
# 
Write-Host "`n# --- BLOCK 2: EDGE TOTAL ANNIHILATION (HARDENED) ---" -F Magenta

Step-Check "2.1 CompatTelRunner & Store Kill" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path "X:\PortableApps\NSudo_9.0_Preview1_9.0.2676.0\NSudoLG.exe"){"X:\PortableApps\NSudo_9.0_Preview1_9.0.2676.0\NSudoLG.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return}; . $n -U:T reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe" /v "Debugger" /t REG_SZ /d "cmd.exe /c exit" /f >$null; . $n -U:T sc config InstallService start= disabled >$null; . $n -U:T sc stop InstallService >$null 2>&1; "SUCCESS" }

Step-Check "2.2 Path Eradication (усилено из Golden)" { $f=$false; @("${env:ProgramFiles}\Microsoft\Edge","${env:ProgramFiles(x86)}\Microsoft\Edge","${env:LocalAppData}\Microsoft\Edge","${env:ProgramData}\Microsoft\Edge","$env:SystemRoot\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe","${env:ProgramFiles(x86)}\Microsoft\EdgeUpdate","${env:ProgramFiles(x86)}\Microsoft\EdgeCore")|%{if(Test-Path $_){&takeown /f $_ /r /a /d y >$null;&icacls $_ /grant Administrators:F /t /c /l /q >$null;rm $_ -Recurse -Force -EA 0;$f=$true}};if($f){"SUCCESS"}else{"SKIP"} }

Step-Check "2.3 Services & PPL Stubs (усилено из Golden: sc delete)" { $c=$false; @("edgeupdate","edgeupdatem","MicrosoftEdgeElevationService")|%{ $k="HKLM:\SYSTEM\CurrentControlSet\Services\$_"; if(Test-Path $k){ sp $k Start 4 -Force -EA 0; sp $k ImagePath "C:\Windows\System32\svchost.exe -k netsvcs" -Force -EA 0; Stop-Service $_ -Force -EA 0; & sc.exe delete $_ >$null 2>&1; $c=$true } }; if($c){"SUCCESS"}else{"SKIP"} }

Step-Check "2.4 Registry Block" { $b=$false; $i="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"; @("MicrosoftEdgeUpdate.exe","MicrosoftEdgeUpdateCore.exe","msedge.exe")|%{$p=Join-Path $i $_;if(!(Test-Path $p)){ni $p -Force >$null;$b=$true};sp $p Debugger "cmd.exe /c exit" -Force -EA 0}; @("HKLM:\SOFTWARE\Microsoft\EdgeUpdate","HKLM:\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate")|%{if(!(Test-Path $_)){ni $_ -Force >$null;$b=$true};sp $_ "DoNotUpdate" 1 -Type DWord -Force -EA 0}; @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge","HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge")|%{if(!(Test-Path $_)){ni $_ -Force >$null;$b=$true};sp $_ "DoNotUpdateToEdge" 1 -Type DWord -Force -EA 0};if($b){"SUCCESS"}else{"SKIP"} }

Step-Check "2.5 Physical Task Deletion" { $t=$false; Get-ScheduledTask *Edge* -EA 0 | % { $n=$_.TaskName; Disable-ScheduledTask -TaskName $n -EA 0 >$null; gci 'C:\Windows\System32\Tasks' -Recurse -Filter $n -EA 0 | % { $f=$_.FullName; &takeown /f $f /a >$null; &icacls $f /grant Administrators:F /q >$null; rm $f -Force -EA 0; $t=$true } }; if($t){"SUCCESS"}else{"SKIP"} }

Step-Check "2.6 Purge Start Icons" { $c=$false; @("$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk","$env:AppData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk","$env:AppData\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk") | % { if(Test-Path $_){ rm $_ -Force; $c=$true } }; Get-AppxPackage -AllUsers *MicrosoftEdge* | ? { $_.PackageFullName -notlike "*DevToolsClient*" } | % { Remove-AppxPackage -AllUsers $_ -EA 0; $c=$true }; if($c){"SUCCESS"}else{"SKIP"} }

Step-Check "2.7 Reset Associations" { $a=$false; $k="HKLM:\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\Capabilities"; @(".html",".htm",".pdf",".svg") | % { $v="HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\$_"; if(Test-Path $v){ sp $v "NoOpenWith" "" -Force; $a=$true } }; @("microsoft-edge","https","http") | % { $p="HKLM:\SOFTWARE\Classes\$_"; if(Test-Path $p){ sp $p "URL Protocol" "" -Force; $a=$true } }; if($a){"SUCCESS"}else{"SKIP"} }

Step-Check "2.8 Force Uninstall Microsoft Edge" { try{$u=[Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge',$true);if(!$u){"SKIP"}else{$s=$u.GetValue('UninstallString')+' --force-uninstall';Start-Process "cmd.exe" "/c $s" -Wait -WindowStyle Hidden;"SUCCESS"}}catch{"SKIP"} }

# =================================================================
# BLOCK 3: BING & SEARCH NETWORK ISOLATION (усилено из Golden: Apex isolation)
# 
Write-Host "`n# --- BLOCK 3: BING SEARCH ANNIHILATION & NETWORK ISOLATION ---" -F Magenta

Step-Check "3.1 Disable Cloud Search Registry" { $c=$false; @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Search","HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search")|%{$p=$_;if(!(Test-Path $p)){ni $p -Force >$null;$c=$true};@("BingSearchEnabled","AllowSearchToUseLocation","ConnectedSearchUseWeb","AllowCortana")|%{$v=(gp $p $_ -EA 0).$_;if($v -ne 0){sp $p $_ 0 -Type DWord -Force;$c=$true}};if((gp $p "DisableWebSearch" -EA 0).DisableWebSearch -ne 1){sp $p "DisableWebSearch" 1 -Type DWord -Force;$c=$true}};if($c){"SUCCESS"}else{"SKIP"} }

Step-Check "3.2 Eradicate Search Network Tasks" { $t=$false; Get-ScheduledTask -EA 0 | ? { $_.TaskName -match "FamilySafetyUpload|IndexDeclaration|BthSQM|CortanaReminders|SearchData|Bing" } | % { $tn=$_.TaskName; $tp=$_.TaskPath; Disable-ScheduledTask -TaskPath $tp -TaskName $tn -EA 0 >$null; $f="C:\Windows\System32\Tasks$tp$tn"; if(Test-Path $f){ &takeown /f $f /a >$null 2>&1; &icacls $f /grant Administrators:F /q >$null 2>&1; rm $f -Force -EA 0; $t=$true } }; if($t){"SUCCESS"}else{"SKIP"} }

Step-Check "3.3 Network Isolation & Settings (усилено из Golden: Apex WFP)" { $b=$false;$r="HKCU:\Software\Microsoft\Windows\CurrentVersion\SearchSettings";if(!(Test-Path $r)){ni $r -Force >$null;$b=$true};@("IsDynamicSearchBoxEnabled","IsDeviceSearchHistoryEnabled","IsMSACloudSearchEnabled")|%{$v=(gp $r $_ -EA 0).$_;if($v -ne 0){sp $r $_ 0 -Type DWord -Force;$b=$true}};$ni="HKLM:\SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation";if(!(Test-Path $ni)){ni $ni -Force >$null;$b=$true};if((gp $ni "EnterpriseIPRange" -EA 0).EnterpriseIPRange -ne 0){sp $ni "EnterpriseIPRange" 0 -Type DWord -Force;$b=$true};if($b){"SUCCESS"}else{"SKIP"}; try { $tn="ApexNuclear"; $bp="$env:TEMP\an.ps1"; $bc="`$ex=@('SearchHost.exe','StartMenuExperienceHost.exe','msedgewebview2.exe'); `$ni='Software\Policies\Microsoft\Windows\NetworkIsolation'; `$t=`"HKEY_LOCAL_MACHINE\`" + `$ni + `" [1 5 7 11 17] `"; `$t | Out-File `$env:TEMP\r.txt -Enc ascii; & regini.exe `$env:TEMP\r.txt; reg add ('HKLM\' + `$ni) /v 'EnterpriseIPRange' /t REG_DWORD /d 0 /f; foreach(`$e in `$ex){ reg add ('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\' + `$e) /v 'AppExecutionAliasRedirect' /t REG_SZ /d 'http_proxy=127.0.0.1:1;https_proxy=127.0.0.1:1' /f }; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Edge\WebView2\AdditionalPolicies\MicrosoftWindows.Client.CBS_cw5n1h2txyewy' /v 'AllowNetworkRequests' /t REG_DWORD /d 0 /f; & CheckNetIsolation.exe LoopbackExempt -c; rm `$env:TEMP\r.txt -EA 0"; $bc | Out-File $bp -Enc UTF8; $a=New-ScheduledTaskAction -Execute "powershell.exe" -Arg "-NoP -ExecutionPolicy Bypass -File `"$bp`""; Register-ScheduledTask $tn -Action $a -User "SYSTEM" -RunLevel Highest -Force >$null; Start-ScheduledTask $tn; Start-Sleep -s 4; schtasks.exe /delete /tn $tn /f >$null 2>&1; if(Test-Path $bp){rm $bp -Force} } catch { throw "Apex Isolation failed" } }

Step-Check "3.4 Remove Bing & Cortana AppX" { $r=$false; @("*Bing*","*Cortana*")|%{Get-AppxPackage -AllUsers $_ -EA 0|%{try{Remove-AppxPackage $_ -AllUsers -EA 0;$r=$true}catch{}}}; if($r){"SUCCESS"}else{"SKIP"} }

Step-Check "3.5 Search Policies Current+Default"{$c=$false;$search='HKCU:\Software\Microsoft\Windows\CurrentVersion\Search';if(!(Test-Path $search)){ni $search -Force >$null;$c=$true};@("BingSearchEnabled","DisableWebSearch","ConnectedSearchUseWeb","AllowCortana")|%{if((gp $search $_ -EA 0).$_ -ne 0){sp $search $_ 0 -Type DWord -Force;$c=$true}};sp $search "DisableWebSearch" 1 -Type DWord -Force;$c=$true;$exp='HKCU:\Software\Policies\Microsoft\Windows\Explorer';if(!(Test-Path $exp)){ni $exp -Force >$null;$c=$true};sp $exp "DisableSearchBoxSuggestions" 1 -Type DWord -Force;$c=$true;$defPath="Registry::HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Search";if(!(Test-Path $defPath)){ni $defPath -Force >$null;$c=$true};@("BingSearchEnabled","DisableWebSearch","ConnectedSearchUseWeb","AllowCortana")|%{sp $defPath $_ 0 -Type DWord -Force;$c=$true};sp $defPath "DisableWebSearch" 1 -Type DWord -Force;$c=$true;$defExpPath="Registry::HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Windows\Explorer";if(!(Test-Path $defExpPath)){ni $defExpPath -Force >$null;$c=$true};sp $defExpPath "DisableSearchBoxSuggestions" 1 -Type DWord -Force;$c=$true;if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "3.6 Global Policies+CBS Core"{$n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=$false;$ws='HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search';if(!(Test-Path $ws)){. $n -U:T reg add $ws /f >$null;$c=$true};@("DisableWebSearch","ConnectedSearchUseWeb","ConnectedSearchUseWebOverMeteredConnections","AllowCloudSearch","AllowCortana")|%{if((gp $ws $_ -EA 0).$_ -ne 0){. $n -U:T reg add $ws /v $_ /t REG_DWORD /d 0 /f >$null;$c=$true}};$exp='HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer';if(!(Test-Path $exp)){. $n -U:T reg add $exp /f >$null;$c=$true};if((gp $exp "DisableSearchBoxSuggestions" -EA 0).DisableSearchBoxSuggestions -ne 1){. $n -U:T reg add $exp /v DisableSearchBoxSuggestions /t REG_DWORD /d 1 /f >$null;$c=$true};$cbs='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CBS';if(!(Test-Path $cbs)){. $n -U:T reg add $cbs /f >$null;$c=$true};@("EnableWebContent","BingSearchEnabled","AllowCloudSearch")|%{if((gp $cbs $_ -EA 0).$_ -ne 0){. $n -U:T reg add $cbs /v $_ /t REG_DWORD /d 0 /f >$null;$c=$true}};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "3.7 UI Cache & AppX Reset" { &taskkill /F /IM StartMenuExperienceHost.exe /T >$null 2>&1; &taskkill /F /IM SearchHost.exe /T >$null 2>&1; @("Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy","Microsoft.Windows.Client.CBS_cw5n1h2txyewy")|%{ $l="$env:LOCALAPPDATA\Packages\$_\LocalState"; if(Test-Path $l){&takeown /f $l /r /a >$null; &icacls $l /grant "Administrators:(OI)(CI)F" /q >$null; rm "$l\*" -Recurse -Force -EA 0 >$null} }; "SUCCESS" }

Step-Check "3.8 Sterilize Tasks (Final Passive)" { @("\Microsoft\Windows\UpdateOrchestrator\Sih","\Microsoft\Windows\WindowsUpdate\sih","\Microsoft\Windows\Search\IndexDeclaration","\Microsoft\Windows\CloudContent\DispatchPremiumContent")|%{ $tf="C:\Windows\System32\Tasks$_"; if(Test-Path $tf){&takeown /f $tf /a >$null; &icacls $tf /grant Administrators:F /q >$null; rm $tf -Recurse -Force -EA 0 >$null}; ni $tf -ItemType File -Force >$null; attrib +s +h $tf >$null }; "SUCCESS" }

# =================================================================
# BLOCK 4: TELEMETRY & DATA COLLECTION (усилено из Golden: diagsvc, FrameServer, location)
# 
Write-Host "`n# --- BLOCK 4: TELEMETRY & DATA COLLECTION ANNIHILATION ---" -F Magenta

Step-Check "4.1 Disable Diagnostic Execution Service (из Golden)" { $s="diagsvc"; $r="HKLM:\SYSTEM\CurrentControlSet\Services\$s"; if(!(Test-Path $r)){"NOT_FOUND"} elseif([string](gp $r -EA 0).Start -eq "4"){"SKIP"} else { & taskkill /f /fi "SERVICES eq $s" /t 2>$null >$null; Stop-Service $s -Force -EA 0; sp $r "Start" 4 -Force } }

Step-Check "4.2 Disable Camera Frame Monitor (из Golden)" { $s="FrameServerMonitor"; $r="HKLM:\SYSTEM\CurrentControlSet\Services\$s"; if(!(Test-Path $r)){"NOT_FOUND"} elseif([string](gp $r -EA 0).Start -eq "4"){"SKIP"} else { & taskkill /f /fi "SERVICES eq $s" /t 2>$null >$null; Stop-Service $s -Force -EA 0; sp $r "Start" 4 -Force } }

Step-Check "4.3 Kill Telemetry Triggers (Device Info) (из Golden)" { $p="\Microsoft\Windows\Device Information\"; $tasks = @("Device","Device User"); $st = $tasks | % { if((Get-ScheduledTask $_ -TaskPath $p -EA 0).State -ne "Disabled") { Disable-ScheduledTask $_ -TaskPath $p -EA 0 >$null; $true } }; if ($st -contains $true) { "SUCCESS" } else { "SKIP" } }

Step-Check "4.4 Disable Location & Sensor Services (из Golden)" { $sList = @("lfsvc","SensorService","SensorDataService","SensorsHidSvc"); $changed = $false; foreach ($s in $sList) { $r="HKLM:\SYSTEM\CurrentControlSet\Services\$s"; if(Test-Path $r){ if([string](gp $r -EA 0).Start -ne "4"){ & taskkill /f /fi "SERVICES eq $s" /t 2>$null >$null; Stop-Service $s -Force -EA 0; sp $r "Start" 4 -Force; sp $r "FailureActions" ([byte[]]@(0)*16) -Force; $changed = $true } } }; if($changed){ "SUCCESS" } else { "SKIP" } }

Step-Check "4.5 Location Privacy Enforcement (из Golden)" { $p = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location"; if (!(Test-Path $p)) { ni $p -Force >$null }; if ((gp $p -EA 0).Value -eq "Deny") { "SKIP" } else { sp $p "Value" "Deny" -Force } }

Step-Check "4.6 Disable Error Reporting Registry" { $p = "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting"; if (!(Test-Path $p)) { ni $p -Force >$null }; sp $p "Disabled" 1 -Force }

Step-Check "4.7 Disable Telemetry Policy (из Golden)" { $p = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection"; if (!(Test-Path $p)) { ni $p -Force >$null }; sp $p "AllowTelemetry" 0 -Force; sp $p "MaxTelemetryAllowed" 0 -Force }

Step-Check "4.8 Silence Windows Update Notifications (из Golden)" { $p = "HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings"; if (!(Test-Path $p)) { ni $p -Force >$null }; sp $p "UxOption" 1 -Force }

Step-Check "4.9 Disable PowerShell Update & Discovery (из Golden)" { [Environment]::SetEnvironmentVariable("POWERSHELL_UPDATECHECK", "Off", "Machine"); [Environment]::SetEnvironmentVariable("POWERSHELL_TELEMETRY_OPTOUT", "1", "Machine"); $p = "HKLM:\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell"; if (!(Test-Path $p)) { ni $p -Force >$null }; sp $p "DisableModuleAutoDiscovery" 1 -Force }

Step-Check "4.10 Disable Silent Features & Notifications (из Golden)" { $r = "HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager"; if (!(Test-Path $r)) { ni $r -Force >$null }; if ((gp $r -EA 0).SilentInstalledAppsEnabled -eq 0) { "SKIP" } else { sp $r "SilentInstalledAppsEnabled" 0 -Force; sp $r "SubscribedContent-338389Enabled" 0 -Force; sp $r "SubscribedContent-353694Enabled" 0 -Force; sp $r "SubscribedContent-353696Enabled" 0 -Force; sp $r "SystemPaneSuggestionsEnabled" 0 -Force } ; $p = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications"; if (!(Test-Path $p)) { ni $p -Force >$null }; sp $p "NoToastApplicationNotification" 1 -Force; $o = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE"; if (!(Test-Path $o)) { ni $o -Force >$null }; sp $o "DisablePrivacyExperience" 1 -Force }

# =================================================================
# BLOCK 5: COMPATTELRUNNER & COMPATIBILITY TELEMETRY NEUTRALIZATION
# 
Write-Host "`n# --- BLOCK 5: COMPATTELRUNNER & COMPATIBILITY TELEMETRY NEUTRALIZATION ---" -F Magenta

Step-Check "5.1 Disable CompatTel Tasks & Telemetry Policies"{$n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=$false;@("\Microsoft\Windows\Application Experience\","\Microsoft\Windows\Customer Experience Improvement Program\","\Microsoft\Windows\Device Metadata\")|%{$tp=$_;Get-ScheduledTask -TaskPath $_ -EA 0|?{$_.TaskName -match "Microsoft Compatibility Appraiser|Consolidator|KernelCeipTask|UsbCeip|DeviceCensus"}|%{Disable-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -EA 0 >$null;$tf="C:\Windows\System32\Tasks$($_.TaskPath)$($_.TaskName)";if(Test-Path $tf){&takeown /f $tf /a >$null 2>&1;&icacls $tf /grant Administrators:F /q >$null 2>&1;rm $tf -Force -EA 0;mkdir $tf -Force >$null;&icacls $tf /inheritance:r /deny "Everyone:(F)" /q >$null 2>&1;attrib +s +h +r $tf >$null 2>&1;$c=$true}}};$diag='HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection';if(!(Test-Path $diag)){. $n -U:T reg add $diag /f >$null;$c=$true};@("AllowTelemetry","MaxTelemetryAllowed")|%{if((gp $diag $_ -EA 0).$_ -ne 0){. $n -U:T reg add $diag /v $_ /t REG_DWORD /d 0 /f >$null;$c=$true}};$compat='HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags';if(!(Test-Path $compat)){. $n -U:T reg add $compat /f >$null;$c=$true};@("DisableInventory","DisableUCA","DisablePCA")|%{. $n -U:T reg add "$compat\InstalledSDB" /v $_ /t REG_DWORD /d 1 /f >$null;$c=$true};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "5.2 Apply Telemetry Policies to Default Profile"{$c=$false;$defdiag='Registry::HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Windows\DataCollection';if(!(Test-Path $defdiag)){ni $defdiag -Force >$null;$c=$true};sp $defdiag "AllowTelemetry" 0 -Type DWord -Force;$c=$true;if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "5.3 IFEO Lock & Cache Purge"{$n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=$false;@("C:\Windows\System32\CompatTelRunner.exe","C:\Windows\SysWOW64\CompatTelRunner.exe","C:\Windows\System32\DeviceCensus.exe")|%{if(Test-Path $_){$ifeo="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$(Split-Path $_ -Leaf)";if(!(Test-Path $ifeo)){. $n -U:T reg add $ifeo /f >$null};. $n -U:T reg add $ifeo /v Debugger /t REG_SZ /d "cmd.exe /c exit" /f >$null 2>&1;$c=$true}};cmd /c "taskkill /F /IM CompatTelRunner.exe /T 2>nul" | Out-Null;cmd /c "taskkill /F /IM DeviceCensus.exe /T 2>nul" | Out-Null;@("C:\ProgramData\Microsoft\Diagnosis","C:\Windows\System32\CompatTel","$env:LOCALAPPDATA\Microsoft\Windows\CompatTel")|%{if(Test-Path $_){rm $_ -Recurse -Force -EA 0;mkdir $_ -Force >$null;&icacls $_ /inheritance:r /deny "Everyone:(F)" /q >$null 2>&1;$c=$true}};if($c){"SUCCESS"}else{"SKIP"}}

# =================================================================
# BLOCK 6: CONTENT DELIVERY & CLOUD LOCKDOWN (усилено из Golden: ContentDeliveryManager lockdown)
# 
Write-Host "`n# --- BLOCK 6: CONTENT DELIVERY & CLOUD LOCKDOWN ---" -F Magenta

Step-Check "6.1 Disable & Neutralize ContentDeliveryManager" {$c=$false;$p="HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent";if(!(Test-Path $p)){ni $p -Force>$null;$c=$true};@{"DisableWindowsConsumerFeatures"=1;"DisableWindowsSpotlightFeatures"=1;"DisableCloudOptimizedContent"=1}.GetEnumerator()|%{if((gp $p $_.Key -EA 0).$($_.Key)-ne $_.Value){sp $p $_.Key $_.Value -Type DWord -Force;$c=$true}};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "6.2 Cloud Content (Deep Enforcement) (из Golden)" { try { $tn = "CloudFix"; $sc = "reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent' /v 'DisableWindowsConsumerFeatures' /t REG_DWORD /d 1 /f; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent' /v 'DisableSoftLanding' /t REG_DWORD /d 1 /f; reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' /v 'SettingsPageVisibility' /t REG_SZ /d 'hide:windowsupdate' /f"; $a = New-ScheduledTaskAction -Execute "cmd.exe" -Argument "/c powershell -Command `"$sc`""; Register-ScheduledTask $tn -Action $a -User "SYSTEM" -RunLevel Highest -Force >$null; Start-ScheduledTask $tn; Start-Sleep -s 1; schtasks.exe /delete /tn $tn /f >$null 2>&1 } catch { throw "Cloud lockdown failed" } }

Step-Check "6.3 DoSvc Disable & Cache Lockdown" {$do="HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization";if(!(Test-Path $do)){ni $do -Force|Out-Null};sp $do DODownloadMode 0 -Type DWord -Force;"SUCCESS"}

Step-Check "6.4 Neutralize Cloud+Sync Tasks"{$c=$false;@("\Microsoft\Windows\CloudContent\","\Microsoft\Windows\Subscription\","\Microsoft\Windows\CloudExperienceHost\","\Microsoft\Windows\SettingSync\","\Microsoft\Windows\WindowsUpdate\Automatic App Update","\Microsoft\Windows\DeliveryOptimization\")|%{$tp=$_;Get-ScheduledTask -TaskPath $_ -EA 0|?{$_.TaskName -match "Content|Delivery|Spotlight|Update|Sync|License|CloudExperience|SettingSync"}|%{Disable-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -EA 0 >$null;$tf="C:\Windows\System32\Tasks$($_.TaskPath)$($_.TaskName)";if(Test-Path $tf){&takeown /f $tf /a >$null 2>&1;&icacls $tf /grant Administrators:F /q >$null 2>&1;rm $tf -Force -EA 0;mkdir $tf -Force >$null;&icacls $tf /inheritance:r /deny "Everyone:(F)" /q >$null 2>&1;attrib +s +h +r $tf >$null 2>&1;$c=$true}}};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "6.5 Block ContentDeliveryManager leaks" {$c=$false;$ifeo="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BackgroundTaskHost.exe";if(!(Test-Path $ifeo)){ni $ifeo -Force|Out-Null;$c=$true};sp $ifeo Debugger "cmd.exe /c exit" -Force;$c=$true;$cdm="HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent";if(!(Test-Path $cdm)){ni $cdm -Force|Out-Null;$c=$true};@{"DisableWindowsConsumerFeatures"=1;"DisableSoftLanding"=1;"DisableCloudOptimizedContent"=1;"DisableWindowsSpotlightFeatures"=1}.GetEnumerator()|%{sp $cdm $_.Key $_.Value -Type DWord -Force;$c=$true};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "6.6 Extra ContentManager kill" {$c=$false;$ifeo="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BackgroundTaskHost.exe";if(!(Test-Path $ifeo)){ni $ifeo -Force|Out-Null;$c=$true};sp $ifeo Debugger "cmd.exe /c exit" -Force;$c=$true;$cdm="HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent";if(!(Test-Path $cdm)){ni $cdm -Force|Out-Null;$c=$true};@{"DisableWindowsConsumerFeatures"=1;"DisableSoftLanding"=1;"DisableCloudOptimizedContent"=1;"DisableWindowsSpotlightFeatures"=1}.GetEnumerator()|%{sp $cdm $_.Key $_.Value -Type DWord -Force;$c=$true};if($c){"SUCCESS"}else{"SKIP"}}

# =================================================================
# BLOCK 7: MICROSOFT ACCOUNT SIGN-IN ASSISTANT (wlidsvc) NEUTRALIZATION
# =================================================================
Write-Host "`n# --- BLOCK 7: MICROSOFT ACCOUNT SIGN-IN ASSISTANT (wlidsvc) NEUTRALIZATION ---" -F Magenta

Step-Check "7.1 Disable wlidsvc & MSA Policies"{$n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=$false;$svc="wlidsvc";if((Get-Service $svc -EA 0).StartType -ne "Disabled"){. $n -U:T sc config $svc start=disabled >$null 2>&1;. $n -U:T sc stop $svc >$null 2>&1;$c=$true};$sysPol='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System';if(!(Test-Path $sysPol)){. $n -U:T reg add $sysPol /f >$null;$c=$true};@("NoConnectedUser","NoMicrosoftAccount")|%{if((gp $sysPol $_ -EA 0).$_ -ne 1){. $n -U:T reg add $sysPol /v $_ /t REG_DWORD /d 1 /f >$null;$c=$true}};$wam='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WebAccountManager';if(!(Test-Path $wam)){. $n -U:T reg add $wam /f >$null;$c=$true};if((gp $wam "AllowWAM" -EA 0).AllowWAM -ne 0){. $n -U:T reg add $wam /v AllowWAM /t REG_DWORD /d 0 /f >$null;$c=$true};$acc='HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Accounts';if(!(Test-Path $acc)){. $n -U:T reg add $acc /f >$null;$c=$true};if((gp $acc "AllowMicrosoftAccountConnection" -EA 0).AllowMicrosoftAccountConnection -ne 0){. $n -U:T reg add $acc /v AllowMicrosoftAccountConnection /t REG_DWORD /d 0 /f >$null;$c=$true};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "7.2 MSA Policies Default Profile"{$c=$false;$defPath="Registry::HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Windows\System";if(!(Test-Path $defPath)){ni $defPath -Force >$null;$c=$true};sp $defPath "NoConnectedUser" 1 -Type DWord -Force;$c=$true;if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "7.3 Purge Identity Cache"{$c=$false;@("$env:LOCALAPPDATA\Microsoft\IdentityCRL","$env:PROGRAMDATA\Microsoft\IdentityCRL","$env:LOCALAPPDATA\Microsoft\IdentityCache","$env:LOCALAPPDATA\Microsoft\Credentials","$env:LOCALAPPDATA\Microsoft\OneAuth","C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC")|%{if(Test-Path $_){&takeown /f $_ /r /a >$null 2>&1;&icacls $_ /grant Administrators:F /t /q >$null 2>&1;rm $_ -Recurse -Force -EA 0;mkdir $_ -Force >$null;&icacls $_ /inheritance:r /deny "Everyone:(F)" /q >$null 2>&1;attrib +s +h +r $_ >$null 2>&1;$c=$true}};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "7.4 Sterilize Identity Tasks"{$c=$false;@("\Microsoft\Windows\SettingSync\","\Microsoft\Windows\Work Folders\","\Microsoft\Windows\CertificateServicesClient\","\Microsoft\Windows\Authentication\")|%{$tp=$_;Get-ScheduledTask -TaskPath $_ -EA 0|?{$_.TaskName -match "Sync|SignIn|Credential|Identity|Token|Account"}|%{Disable-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -EA 0 >$null;$tf="C:\Windows\System32\Tasks$($_.TaskPath)$($_.TaskName)";if(Test-Path $tf){&takeown /f $tf /a >$null 2>&1;&icacls $tf /grant Administrators:F /q >$null 2>&1;rm $tf -Force -EA 0;mkdir $tf -Force >$null;&icacls $tf /inheritance:r /deny "Everyone:(F)" /q >$null 2>&1;attrib +s +h +r $tf >$null 2>&1;$c=$true}}};if($c){"SUCCESS"}else{"SKIP"}}

# =================================================================
# BLOCK 8: WINDOWS ERROR REPORTING (WATSON) ANNIHILATION
#
Write-Host "`n# --- BLOCK 8: WINDOWS ERROR REPORTING (WATSON) ANNIHILATION ---" -F Magenta

Step-Check "8.1 Disable WerSvc & Policies"{$n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=$false;$svc="WerSvc";if((Get-Service $svc -EA 0).StartType -ne "Disabled"){. $n -U:T sc config $svc start=disabled >$null 2>&1;. $n -U:T sc stop $svc >$null 2>&1;$c=$true};$pol='HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting';if(!(Test-Path $pol)){. $n -U:T reg add $pol /f >$null;$c=$true};@("Disabled","DontSendAdditionalData","DontShowUI","LoggingDisabled")|%{if((gp $pol $_ -EA 0).$_ -ne 1){. $n -U:T reg add $pol /v $_ /t REG_DWORD /d 1 /f >$null;$c=$true}};$consent="$pol\Consent";if(!(Test-Path $consent)){. $n -U:T reg add $consent /f >$null;$c=$true};if((gp $consent "DefaultConsent" -EA 0).DefaultConsent -ne 0){. $n -U:T reg add $consent /v DefaultConsent /t REG_DWORD /d 0 /f >$null;$c=$true};$wer='HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting';if(!(Test-Path $wer)){. $n -U:T reg add $wer /f >$null;$c=$true};if((gp $wer "Disabled" -EA 0).Disabled -ne 1){. $n -U:T reg add $wer /v Disabled /t REG_DWORD /d 1 /f >$null;$c=$true};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "8.2 WER Disabled Default Profile"{$c=$false;$defPath="Registry::HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting";if(!(Test-Path $defPath)){ni $defPath -Force >$null;$c=$true};sp $defPath "Disabled" 1 -Type DWord -Force;$c=$true;if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "8.3 Purge WER Cache"{$c=$false;@("$env:LOCALAPPDATA\Microsoft\Windows\WER","C:\ProgramData\Microsoft\Windows\WER","C:\Windows\Temp\WER*")|%{if(Test-Path $_){&takeown /f $_ /r /a >$null 2>&1;&icacls $_ /grant Administrators:F /t /q >$null 2>&1;rm $_ -Recurse -Force -EA 0;mkdir $_ -Force >$null;&icacls $_ /inheritance:r /deny "Everyone:(W)" /q >$null 2>&1;attrib +s +h +r $_ >$null 2>&1;$c=$true}};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "8.4 Sterilize WER Tasks"{$c=$false;@("\Microsoft\Windows\Windows Error Reporting\","\Microsoft\Windows\WDI\")|%{$tp=$_;Get-ScheduledTask -TaskPath $_ -EA 0|%{Disable-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -EA 0 >$null;$tf="C:\Windows\System32\Tasks$($_.TaskPath)$($_.TaskName)";if(Test-Path $tf){&takeown /f $tf /a >$null 2>&1;&icacls $tf /grant Administrators:F /q >$null 2>&1;rm $tf -Force -EA 0;mkdir $tf -Force >$null;&icacls $tf /inheritance:r /deny "Everyone:(F)" /q >$null 2>&1;attrib +s +h +r $tf >$null 2>&1;$c=$true}}};if($c){"SUCCESS"}else{"SKIP"}}

# =================================================================
# BLOCK 9: DEFENDER PASSIVE + SMARTSCREEN / SAC FINAL SILENCE
# =================================================================
Write-Host "`n# --- BLOCK 9: DEFENDER PASSIVE + SMARTSCREEN / SAC FINAL SILENCE ---" -F Magenta

Step-Check "9.1 Defender Cloud & Reporting Policies" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=$false;$wd='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender';if(!(Test-Path $wd)){. $n -U:T reg add $wd /f >$null;$c=$true};if((gp $wd "DisableAntiSpyware" -EA 0).DisableAntiSpyware -ne 1){. $n -U:T reg add $wd /v DisableAntiSpyware /t REG_DWORD /d 1 /f >$null;$c=$true};$spynet="$wd\Spynet";if(!(Test-Path $spynet)){. $n -U:T reg add $spynet /f >$null;$c=$true};if((gp $spynet "SpyNetReporting" -EA 0).SpyNetReporting -ne 0){. $n -U:T reg add $spynet /v SpyNetReporting /t REG_DWORD /d 0 /f >$null;$c=$true};if((gp $spynet "SubmitSamplesConsent" -EA 0).SubmitSamplesConsent -ne 0){. $n -U:T reg add $spynet /v SubmitSamplesConsent /t REG_DWORD /d 0 /f >$null;$c=$true};$maps="$wd\MAPS";if(!(Test-Path $maps)){. $n -U:T reg add $maps /f >$null;$c=$true};if((gp $maps "MapsReporting" -EA 0).MapsReporting -ne 0){. $n -U:T reg add $maps /v MapsReporting /t REG_DWORD /d 0 /f >$null;$c=$true};$sig="$wd\Signature Updates";if(!(Test-Path $sig)){. $n -U:T reg add $sig /f >$null;$c=$true};if((gp $sig "DisableUpdateOnStart" -EA 0).DisableUpdateOnStart -ne 1){. $n -U:T reg add $sig /v DisableUpdateOnStart /t REG_DWORD /d 1 /f >$null;$c=$true};if($c){"SUCCESS"}else{"SKIP"} }

Step-Check "9.2 Smart App Control & SmartScreen Policies" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path ".\NSudo.exe"){".\NSudo.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return};$c=$false;$sac='HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppControl';if(!(Test-Path $sac)){. $n -U:T reg add $sac /f >$null;$c=$true};if((gp $sac "ConfigureSAC" -EA 0).ConfigureSAC -ne 0){. $n -U:T reg add $sac /v ConfigureSAC /t REG_DWORD /d 0 /f >$null;$c=$true};$ss='HKLM:\SOFTWARE\Policies\Microsoft\Windows\System';if(!(Test-Path $ss)){. $n -U:T reg add $ss /f >$null;$c=$true};if((gp $ss "EnableSmartScreen" -EA 0).EnableSmartScreen -ne 0){. $n -U:T reg add $ss /v EnableSmartScreen /t REG_DWORD /d 0 /f >$null;$c=$true};if((gp $ss "ShellSmartScreenLevel" -EA 0).ShellSmartScreenLevel -ne "Off"){. $n -U:T reg add $ss /v ShellSmartScreenLevel /t REG_SZ /d Off /f >$null;$c=$true};if($c){"SUCCESS"}else{"SKIP"} }

Step-Check "9.3 Policies to Default Profile" { $c=$false;$defdiag='Registry::HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Windows\DataCollection';if(!(Test-Path $defdiag)){ni $defdiag -Force>$null;$c=$true};if((gp $defdiag "AllowTelemetry" -EA 0).AllowTelemetry -ne 0){sp $defdiag AllowTelemetry 0 -Type DWord -Force;$c=$true};$defss='Registry::HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Windows\System';if(!(Test-Path $defss)){ni $defss -Force>$null;$c=$true};if((gp $defss "EnableSmartScreen" -EA 0).EnableSmartScreen -ne 0){sp $defss EnableSmartScreen 0 -Type DWord -Force;$c=$true};if($c){"SUCCESS"}else{"SKIP"} }

Step-Check "9.4 Net Flush & Final Silence" { $n=if(Test-Path ".\NSudoLG.exe"){".\NSudoLG.exe"}elseif(Test-Path "X:\PortableApps\NSudo_9.0_Preview1_9.0.2676.0\NSudoLG.exe"){"X:\PortableApps\NSudo_9.0_Preview1_9.0.2676.0\NSudoLG.exe"}else{(gcm NSudoLG.exe -EA 0).Source};if(!$n){"NOT_FOUND";return}; . $n -U:T reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\System' /v EnableSmartScreen /t REG_DWORD /d 0 /f >$null; ipconfig /flushdns >$null; netsh winsock reset >$null; "SUCCESS" }

Step-Check "9.5 Sterilize Related Tasks" { $c=$false;@("\Microsoft\Windows\Windows Defender\","\Microsoft\Windows\SmartScreen\","\Microsoft\Windows\Application Experience\","\Microsoft\Windows\Customer Experience Improvement Program\")|%{Get-ScheduledTask -TaskPath $_ -EA 0|?{$_.TaskName -match "SmartScreen|Reputation|Appraiser|Telemetry|Cache Maintenance|Cleanup|Scheduled Scan|Verification|Signature Update"}|%{Disable-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -EA 0 >$null;$tf="C:\Windows\System32\Tasks$($_.TaskPath)$($_.TaskName)";if(Test-Path $tf){& takeown /f $tf /a >$null 2>&1;& icacls $tf /grant Administrators:F /q >$null 2>&1;rm $tf -Force -EA 0;mkdir $tf -Force >$null;& icacls $tf /inheritance:r /deny "Everyone:(F)" /q >$null 2>&1;attrib +s +h +r $tf >$null 2>&1;$c=$true}}};if($c){"SUCCESS"}else{"SKIP"} }

# =================================================================
# BLOCK 10: ONEDRIVE & FEEDBACK HUB REMOVAL (из Golden)
# 
Write-Host "`n# --- BLOCK 10: ONEDRIVE & FEEDBACK HUB REMOVAL ---" -F Magenta

Step-Check "10.1 Clean OneDrive Residuals (из Golden)" { ps OneDrive -EA 0 | stop-process -Force -EA 0; $d = @("$env:LocalAppData\Microsoft\OneDrive","$env:UserProfile\OneDrive","C:\OneDriveTemp"); $c = "HKCR:\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}"; $exists = $d | ? { Test-Path $_ }; $reg = (gp $c -EA 0)."System.IsPinnedToNameSpaceTree"; if (!$exists -and ([string]$reg -eq "0" -or !$reg)) { "SKIP" } else { $d | % { if (Test-Path $_) { rm $_ -Recurse -Force -EA 0 } }; if (Test-Path $c) { sp $c "System.IsPinnedToNameSpaceTree" 0 -Force } } }

Step-Check "10.2 Remove & Permanent Block Feedback Hub (из Golden)" { $n="Microsoft.WindowsFeedbackHub"; $e="FeedbackHub.exe"; $a=Get-AppxPackage $n -AllUsers -EA 0; $p=Get-AppxProvisionedPackage -Online -EA 0 | ?{$_.DisplayName -eq $n}; $ip="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$e"; if(!$a -and !$p -and (Test-Path $ip)){ "SKIP" } else { try { $ch=$false; if($a){$a|Remove-AppxPackage -AllUsers -EA 0; $ch=$true}; if($p){Remove-AppxProvisionedPackage -Online -PackageName $p.PackageName -EA 0|Out-Null; $ch=$true}; if(!(Test-Path $ip)){ni $ip -Force|Out-Null}; sp $ip "Debugger" "cmd.exe /c exit" -Type String -Force; $ch=$true; $cp="HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent"; if(!(Test-Path $cp)){ni $cp -Force|Out-Null}; sp $cp "DisableWindowsConsumerFeatures" 1 -Type DWord -Force; if($ch){"SUCCESS"}else{"SKIP"} } catch {"FAIL"} } }

# =================================================================
# BLOCK 11: OFFICE CLICK-TO-RUN ANNIHILATION (из Golden: LTSC 2024)
# 
Write-Host "`n# --- BLOCK 11: OFFICE CLICK-TO-RUN ANNIHILATION ---" -F Magenta

Step-Check "11.1 Kill, Hard-Lock & Trap Office CTR" {$c=$false;$s="ClickToRunSvc";Stop-Service $s -Force -EA 0;Set-Service $s -StartupType Disabled -EA 0;$r="HKLM:\SYSTEM\CurrentControlSet\Services\$s";if((gp $r Start -EA 0).Start -ne 4){sp $r Start 4 -Type DWord -Force;$c=$true};if($c){"SUCCESS"}else{"SKIP"}}

Step-Check "11.2 Kill & Hard-Lock Office SDXHelper" { $res="SKIP"; $det=$null; try { $ch=$false; $ex="sdxhelper.exe"; $i="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$ex"; if((gp $i -EA 0).Debugger -ne "svchost.exe"){ if(!(Test-Path $i)){ni $i -Force | Out-Null}; sp $i "Debugger" "svchost.exe" -Force; $ch=$true }; $p=@("${env:ProgramFiles}\Common Files\microsoft shared\ClickToRun\$ex","${env:ProgramFiles(x86)}\Common Files\microsoft shared\ClickToRun\$ex"); foreach($f in $p){ if(Test-Path $f -PathType Leaf){ $ch=$true; & cmd.exe /c "taskkill /f /im $ex & del /f /q `"$f`" & mkdir `"$f`"" 2>&1 | Out-Null; & icacls "`"$f`"" /inheritance:r /deny Everyone:(F) /q | Out-Null } }; if($ch){$res="SUCCESS"} } catch { $res="FAIL"; $det=$_.Exception.Message }; if($det){Write-Host " >> Details: $det" -F Red}; $res }

# =================================================================
# BLOCK 12: INTERFACE & UX OPTIMIZATION (из Golden: без ломания Пуска)
# 
Write-Host "`n# --- BLOCK 12: INTERFACE & UX OPTIMIZATION ---" -F Magenta

Step-Check "12.1 Enable Run History (из Golden)" { $p = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"; if (!(Test-Path $p)) { ni $p -Force >$null }; if ([string](gp $p -EA 0).Start_TrackProgs -eq "1") { "SKIP" } else { sp $p "Start_TrackProgs" 1 -Force } }

Step-Check "12.2 Enable Recommended Items (из Golden)" { $p = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"; if (!(Test-Path $p)) { ni $p -Force >$null }; if ([string](gp $p -EA 0).Start_TrackDocs -eq "1") { "SKIP" } else { sp $p "Start_TrackDocs" 1 -Force } }

Step-Check "12.3 Force User Consent (webcam) (из Golden)" { $u="HKCU:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam"; $m="HKLM:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam"; if(!(Test-Path $u)){ni $u -Force >$null}; if(!(Test-Path $m)){ni $m -Force >$null}; if((gp $u -EA 0).Value -eq "Deny" -and (gp $m -EA 0).Value -eq "Deny"){"SKIP"}else{sp $u "Value" "Deny" -Force; sp $m "Value" "Deny" -Force} }

Step-Check "12.4 Force User Consent (microphone) (из Golden)" { $u="HKCU:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone"; $m="HKLM:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone"; if(!(Test-Path $u)){ni $u -Force >$null}; if(!(Test-Path $m)){ni $m -Force >$null}; if((gp $u -EA 0).Value -eq "Deny" -and (gp $m -EA 0).Value -eq "Deny"){"SKIP"}else{sp $u "Value" "Deny" -Force; sp $m "Value" "Deny" -Force} }

Step-Check "12.5 Disable Widgets (из Golden)" { $p = "HKLM:\SOFTWARE\Policies\Microsoft\Dsh"; if (!(Test-Path $p)) { ni $p -Force >$null }; if ([string](gp $p -EA 0).AllowNewsAndInterests -eq "0") { "SKIP" } else { sp $p "AllowNewsAndInterests" 0 -Force } }

Step-Check "12.6 Disable Windows Spotlight (из Golden)" { $r = "HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager"; if (!(Test-Path $r)) { ni $r -Force >$null }; if ([string](gp $r -EA 0).RotatingLockScreenEnabled -eq "0") { "SKIP" } else { sp $r "RotatingLockScreenEnabled" 0 -Force; sp $r "RotatingLockScreenOverlayEnabled" 0 -Force } }

Step-Check "12.7 Disable Setup Notifications (из Golden)" { $p = "HKCU:\Software\Microsoft\Windows\CurrentVersion\UserProfileEngagement"; if (!(Test-Path $p)) { ni $p -Force >$null }; if ([string](gp $p -EA 0).ScoobeSystemSettingEnabled -eq "0") { "SKIP" } else { sp $p "ScoobeSystemSettingEnabled" 0 -Force } }

# =================================================================
# DISABLE BITS & TELEMETRY TASKS
# 
Write-Host "`n# --- DISABLE BITS & TELEMETRY TASKS ---" -F Magenta
Step-Check "Disable BITS & Live Tasks" { $ts="UsageDataReceiver","UsageDataReporting","ScanForUpdates","Office Automatic Updates 2.0","Office ClickToRun Service Monitor","SpeechModelDownloadTask"; sc.exe config BITS start= disabled >$null; sc.exe stop BITS >$null; Get-ScheduledTask -TaskName $ts -EA 0 | Disable-ScheduledTask -EA 0 >$null; "SUCCESS" }

# =================================================================
# CLEANING SYSTEM EVENT LOGS
#
Write-Host "`n# --- CLEANING SYSTEM EVENT LOGS ---" -F Magenta
Step-Check "Clear Telemetry & Update Logs" { $e=0; "Setup","System","Application","Microsoft-Windows-WindowsUpdateClient/Operational","Microsoft-Windows-Shell-Core/Operational"|% { wevtutil.exe cl $_ 2>$null; if($LASTEXITCODE-ne0){$e++} }; if($e-lt 3){"SUCCESS"}else{"FAIL"} }

# =================================================================
# RESULT
#
Write-Host "`n=== JIU LONG GOLDEN HYBRID: SYSTEM FORTIFIED AS QUIET LTSC ===" -F Cyan
Write-Host "Press any key to exit..."
$null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
}