diff --git a/README.md b/README.md index a8dd645..b1afd84 100644 --- a/README.md +++ b/README.md @@ -1,25 +1,18 @@ # win11-initial-SetupScript -Reverts Windows 11 design flaws, debloats, disables telemetry and adds useful tweaks +Minimum setup for Windows 11 - optimize design flaws, debloats system, disables telemetry and adds useful improvements. ## Usage -### Quick-Run Script -Run from Windows Powershell (Administrator) with the following commands: -- Script Version: -``` -iwr -useb https://setupWin11.ps1 | iex -``` ### Download and Run Script -You have to change Powershell Execution-Policy in order to run the script manually:
-- Script Version: + +Execute the following file with right-click as Administrator: ``` -powershell -ExecutionPolicy Bypass -File setupWin11.ps1 +_start_hardening.cmd ``` -To change it permanently use: `Set-ExecutionPolicy Unrestricted` - ## Disclaimer -Run this script at your own risk, it is highly experimental and untested. Always manually backup your data before doing so. \ No newline at end of file +You run this script at your own risk. +Before it makes it's changes it will create a system restore point, which you can go back every time. \ No newline at end of file diff --git a/Win11.ps1 b/Win11.ps1 index 8c777c6..bf1ef93 100644 --- a/Win11.ps1 +++ b/Win11.ps1 @@ -1,54 +1,62 @@ $ErrorActionPreference = 'SilentlyContinue' +If (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")) { + # + Read-Host -Prompt "The script needs Administrator privileges! [ENTER to confirm.]" + Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`" $PSCommandArgs" -Verb RunAs + Exit +} # --------------------------------------------------------------------- # Data # --------------------------------------------------------------------- + $Bloatware = @( - "Microsoft.AppConnector", "SpotifyAB.SpotifyMusic", "Microsoft.XboxIdentityProvider", - "Disney.*", "TobiiAB.TobiiEyeTrackingPortal", "microsoft.windowscommunicationsapps", - "Microsoft.XboxGameCallableUI ", "Microsoft.XboxSpeechToTextOverlay ", "Disney*", - "Microsoft.WindowsFeedbackHub", "Microsoft.XboxGamingOverlay", "Microsoft.XboxGameOverlay", "Microsoft.Xbox.TCUI", - - "Microsoft.BingFinance", "Microsoft.BingNews", "Microsoft.BingSports", - "Microsoft.BingTranslator", "Microsoft.BingWeather", "Microsoft.BingFoodAndDrink", - "Microsoft.BingHealthAndFitness", "Microsoft.BingTravel", "Microsoft.GetHelp", - - "Microsoft.People", "Microsoft.Wallet", "Microsoft.WindowsAlarms", - "Microsoft.WindowsMaps", "Microsoft.WindowsPhone", - "Microsoft.ConnectivityStore", "Microsoft.CommsPhone", "Microsoft.ScreenSketch", - "Microsoft.ZuneMusic", "Microsoft.ZuneVideo", "Microsoft.YourPhone", - - "*ActiproSoftwareLLC*", "*Duolingo-LearnLanguagesforFree*", "*PandoraMediaInc*", "*CandyCrush*", - "*BubbleWitch3Saga*", "*Wunderlist*", "*Flipboard*", "*Twitter*", "*Facebook*", "*Royal Revolt*", "*Speed Test*", - "*Viber*", "*ACGMediaPlayer*", "*Netflix*", "*OneCalendar*", "*LinkedInforWindows*", "*HiddenCityMysteryofShadows*", "*Hulu*", - "*HiddenCity*", "*HotspotShieldFreeVPN*", "*Microsoft.Advertising.Xaml*", "Microsoft.Todos", "Microsoft.549981C3F5F10_8wekyb3d8bbwe" + "*Spotify*", "*CandyCrush*", "*Facebook*", "*Twitter*", "*LinkedInforWindows*", + "*Disney*", "*Netflix*", "*BubbleWitch*", "*Duolingo*", "*Minecraft*", + + "Microsoft.WindowsFeedback*", "*Microsoft.Xbox*", "Microsoft.GamingApp*", + "Microsoft.OneDrive*", "*MicrosoftTeams*", "Microsoft.WindowsMaps*", + "Microsoft.WindowsPhone*", "Microsoft.WindowsAlarms*", "Microsoft.YourPhone*", + "Microsoft.People*", "Microsoft.Wallet*", "Microsoft.GetHelp", + "Microsoft.Zune*", "Microsoft.SkypeApp*", "*Microsoft.Messaging*", + "Microsoft.Advertising.Xaml*", "Microsoft.Bing*", "*windowscommunicationsapps*" ) $services = @( "diagnosticshub.standardcollector.service", "DiagTrack", "dmwappushsvc", "DPS", "MapsBroker", "NetTcpPortSharing", "RemoteRegistry", "Fax", "PhoneSvc", "RetailDemo", "edgeupdate", - "edgeupdatem" + "edgeupdatem", "WalletService" ) + # --------------------------------------------------------------------- # Restore Point # --------------------------------------------------------------------- Enable-ComputerRestore -Drive "C:\" -Checkpoint-Computer -Description "Win11 Hardening Script" -RestorePointType "MODIFY_SETTINGS" +Checkpoint-Computer -Description "Michu-IT | pre Win11 Hardening Script" -RestorePointType "MODIFY_SETTINGS" + # --------------------------------------------------------------------- # O&O Shutup Integration # --------------------------------------------------------------------- Start-BitsTransfer "https://dl5.oo-software.com/files/ooshutup10/OOSU10.exe" -#Start-BitsTransfer "https://code.michu-it.com/mrit_ooshutup.cfg" -Start-Process -FilePath "./OOSU10.exe" -ArgumentList 'mrit_ooshutup.cfg /quiet' -Wait +#Start-BitsTransfer "https://code.michu-it.com/michael/win11-initial-setup-script/raw/branch/master/mrit_ooshutup.cfg" +Start-Process -FilePath "./OOSU10.exe" -ArgumentList 'mrit_ooshutup.cfg' -Wait Remove-Item -Path ".\OOSU10.exe" -Force #Remove-Item -Path ".\mrit_ooshutup.cfg" -Force + +# --------------------------------------------------------------------- +# Install Basic Tools with Ninite +# --------------------------------------------------------------------- + +Start-Process -FilePath "./ninite.exe" -Wait + + # --------------------------------------------------------------------- # Design # --------------------------------------------------------------------- @@ -73,16 +81,10 @@ Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarDa" -type "Dword" -Value "0" # Remove Search from Taskbar -Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "SearchboxTaskbarMode" -type "Dword" -Value "0" - -# New Boot Animation -If (!(Test-Path "HKLM:\SYSTEM\ControlSet001\Control\BootControl")) { - New-Item -Path "HKLM:\SYSTEM\ControlSet001\Control" -Name "BootControl" -} -New-ItemProperty -Path "HKLM:\SYSTEM\ControlSet001\Control\BootControl" -Name "BootProgressAnimation" -Value "1" -PropertyType "Dword" +#Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" -Name "SearchboxTaskbarMode" -type "Dword" -Value "0" # Enable Windows Explorer Compact View -Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -type "Dword" -Name "UseCompactMode" -Value "1" +#Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -type "Dword" -Name "UseCompactMode" -Value "1" # Enable Windows Dark Theme Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" -type "Dword" -Name "SystemUsesLightTheme" -Value "0" @@ -90,6 +92,7 @@ Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Themes\P # Enable App Dark Theme Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" -type "Dword" -Name "AppsUseLightTheme" -Value "0" + # --------------------------------------------------------------------- # Debloat # --------------------------------------------------------------------- @@ -97,25 +100,28 @@ Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Themes\P # Disk Cleanup Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\*' | ForEach-Object { New-ItemProperty -Path $_.PSPath -Name StateFlags0005 -Value 2 -PropertyType DWord -Force - }; +}; Start-Process -FilePath CleanMgr.exe -ArgumentList '/sagerun:5' -Wait # Remove Temp Files -Remove-Item "C:\Windows\Temp\*" -Recurse -Force -ErrorAction SilentlyContinue -Remove-Item $env:TEMP\* -Recurse -Force -ErrorAction SilentlyContinue +Remove-Item "C:\Windows\Temp\*" -Recurse -Force -ErrorAction $ErrorActionPreference +Remove-Item $env:TEMP\* -Recurse -Force -ErrorAction $ErrorActionPreference # Uninstall Bloatware-Apps foreach ($Bloat in $Bloatware) { - Get-AppxPackage -Name $Bloat| Remove-AppxPackage - Get-AppxProvisionedPackage -Online | Where-Object DisplayName -like $Bloat | Remove-AppxProvisionedPackage -Online + # Uninstall App on all Current User: + Get-AppxPackage -Name $Bloat -AllUsers | Remove-AppxPackage + # This will prevent these apps from being reinstalled on new user first logon: + Get-AppxProvisionedPackage -Online | Where-Object DisplayName -like $Bloat | Remove-AppxProvisionedPackage -Online } # Disable Services foreach ($service in $services) { - Get-Service -Name $service -ErrorAction SilentlyContinue | Set-Service -StartupType Disabled -ErrorAction SilentlyContinue + Get-Service -Name $service -ErrorAction $ErrorActionPreference | Set-Service -StartupType Disabled -ErrorAction $ErrorActionPreference Write-Output Disabling $service... } + # --------------------------------------------------------------------- # Privacy # --------------------------------------------------------------------- @@ -127,12 +133,15 @@ Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Privacy" Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 0 Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" -Name "MaxTelemetryAllowed" -Type DWord -Value 0 Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" -Type DWord -Value 0 + +# Disable Scheduled Tasks: Disable-ScheduledTask -TaskName "Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" Disable-ScheduledTask -TaskName "Microsoft\Windows\Application Experience\ProgramDataUpdater" Disable-ScheduledTask -TaskName "Microsoft\Windows\Autochk\Proxy" Disable-ScheduledTask -TaskName "Microsoft\Windows\Customer Experience Improvement Program\Consolidator" Disable-ScheduledTask -TaskName "Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" Disable-ScheduledTask -TaskName "Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" + Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "EnableActivityFeed" -Type DWord -Value 0 Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "PublishUserActivities" -Type DWord -Value 0 Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "UploadUserActivities" -Type DWord -Value 0 @@ -207,6 +216,10 @@ Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer # Disable Thumbs.db File Creation on Network Shares reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v DisableThumbsDBOnNetworkFolders /d 0x1 /t REG_DWORD /f +# Register GIT_SSH for Putty +setx GIT_SSH "C:\Program Files\PuTTY\plink.exe" +reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Environment" /v GIT_SSH /d "C:\Program Files\PuTTY\plink.exe" /t REG_SZ /f + # Install winget if (!(Test-Path $env:LOCALAPPDATA\Microsoft\WindowsApps\winget.exe)){ $latest = (Invoke-WebRequest -UseBasicParsing -URI "https://github.com/microsoft/winget-cli/releases/latest").Links.Href | Select-String ".msixbundle" @@ -233,5 +246,5 @@ Remove-Item -Path ".\Microsoft.VCLibs*.appx" -Force Remove-Item -Path ".\Microsoft.DesktopAppInstaller_*.msixbundle" -Force # End of Script - Restart PC -#Start-Sleep 5 -#Restart-Computer \ No newline at end of file +Read-Host -Prompt "Success! Press any key to restart" +Restart-Computer \ No newline at end of file diff --git a/start_hardening.cmd b/_start_hardening.cmd similarity index 100% rename from start_hardening.cmd rename to _start_hardening.cmd diff --git a/mrit_ooshutup.cfg b/mrit_ooshutup.cfg index cfc12c4..b5266a0 100644 --- a/mrit_ooshutup.cfg +++ b/mrit_ooshutup.cfg @@ -7,7 +7,7 @@ # # Alternativ können Sie die Datei auch über die Kommandozeile automatisch # importieren lassen. Nutzen Sie dazu folgende Parameter -# OOSU10 (1).exe +# OOSU10.exe # # Mit der Option /quiet wird die Anwendung nach dem Import sofort beendet # und der Nutzer erhält auch kein Feedback über den Import. @@ -136,22 +136,6 @@ E005 - E013 - E014 - E006 - -F002 + -F014 + -F015 + -F016 + -F001 - -F003 + -F004 + -F005 + -F007 + -F008 + -F009 + -F006 - -F010 - -F011 - -F012 - -F013 - Y001 + Y002 + Y003 + diff --git a/ninite.exe b/ninite.exe new file mode 100644 index 0000000..d0dc46b Binary files /dev/null and b/ninite.exe differ