rem Turn off Windows Startup Recovery Screen
bcdedit /set {current} bootstatuspolicy ignoreallfailures
bcdedit /set {default} recoveryenabled no
rem Create new pagefile. (2nd line indented because wmic will eat a character when pasting)
wmic pagefileset delete
wmic pagefileset create name=C:\pagefile.sys
wmic pagefileset set InitialSize=16384,MaximumSize=16384
rem Enable Administrator account
net user Administrator /active:yes
rem Set Timezone
tzutil /s "W. Europe Standard Time"
rem Make sure time and date are correct
w32tm /resync /rediscover
rem Disable Error Reporting
reg add "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
rem Disable automatic TCG/Opal disk locking on supported SSD drives with PSID
reg add HKLM\Software\Policies\Microsoft\Windows\EnhancedStorageDevices /v TCGSecurityActivationDisabled /t REG_DWORD /d 1 /f
rem Control Panel shows Large Icons
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v ForceClassicControlPanel /t REG_DWORD /d 1 /f
rem Disable UAC
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f
rem Disable discovery of LAN devices like printers
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\NcdAutoSetup\Private /f /v AutoSetup /t REG_DWORD /d 0
rem Delete all printers discovered so far
powershell "Get-WMIObject Win32_Printer | where{$_.Network -eq 'true'} | foreach{$_.delete()}"
rem Set Ethernet connection to private
powershell Set-NetConnectionProfile -InterfaceAlias Ethernet* -NetworkCategory private
rem Set all "unknown network"s to private by default (such adapters are created by VMWare and VirtualBox for their networking, we don't want the Firewall popup)
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\010103000F0000F0010000000F0000F0C967A3643C3AD745950DA7859209176EF5B87C875FA20DF21951640E807D7C24" /v Category /t REG_DWORD /d 1 /f
rem Disable Warnings due to Firewall / Defender being disabled
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance /v Enabled /t REG_DWORD /d 0 /f
reg add "HKLM\Software\Microsoft\Windows Defender Security Center\Notifications" /v DisableNotifications /t REG_DWORD /d 1 /f
rem Disable Windows Firewall for private network
netsh advfirewall set private state off
rem Workaround for bug that shows Firewall "application blocked" messages, despite Firewall being disabled for private network
netsh firewall set notifications mode=disable profile=standard
rem Disable Windows Defender. For this to work you have to manually disable "Tamper protection"
powershell "if ((Get-ItemProperty -Path 'HKLM:SOFTWARE\Microsoft\Windows Defender\Features').TamperProtection -eq 4) { exit 0; } ; Write-Output 'Windows Defender can not be disabled, Tamper Protection is still active' '' 'Disable Tamper Protection manually, then press OK' | msg /w *"
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableAntivirus /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d "Off" /f
reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /f
rem Remove Windows Defender Scheduled Tasks
for /f "delims=" %f in ('dir /b "%WINDIR%\System32\Tasks\Microsoft\Windows\Windows Defender"') do schtasks /delete /f /tn "Microsoft\Windows\Windows Defender\%f"
rem Disable "Consumer Features" (aka downloading apps from the internet automatically)
reg add HKLM\Software\Policies\Microsoft\Windows\CloudContent /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f
rem Disable Lock Screen
reg add HKLM\Software\Policies\Microsoft\Windows\Personalization /v NoLockScreen /t REG_DWORD /d 1 /f
rem Remove Logon Wallpaper
reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableLogonBackgroundImage /t REG_DWORD /d 1 /f
rem Remove Meet Now icon
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v HideSCAMeetNow /t REG_DWORD /d 1 /f
rem Disable One Drive
reg add HKLM\Software\Policies\Microsoft\Windows\OneDrive /v DisableFileSyncNGSC /t REG_DWORD /d 1 /f
start /wait %SystemRoot%\System32\OneDriveSetup.exe /uninstall
rd "%PROGRAMDATA%\Microsoft OneDrive" /Q /S
reg delete "HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveSetup /f
reg delete "HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveSetup /f
reg load HKLM\DEFAULT c:\users\default\ntuser.dat
reg delete HKLM\DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run /v OneDriveSetup /f
reg unload HKLM\DEFAULT
rem Remove Home and Windows Gallery from Explorer
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace_36354489\{f874310e-b6b7-47dc-bc84-b9e6b38f5903} /f
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace_41040327\{e88865ea-0e1c-4e20-9aa6-edcd0212c87c} /f
rem These seem to exist without the number suffix on some installations
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{f874310e-b6b7-47dc-bc84-b9e6b38f5903} /f
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e88865ea-0e1c-4e20-9aa6-edcd0212c87c} /f
rem Disable Hibernate
powercfg -h off
rem Turn off sleep mode
powercfg.exe -x -standby-timeout-ac 0
rem Set 4 hours screen blank timeout
powercfg.exe -x -monitor-timeout-ac 240
rem Disable System Restore and delete restore points
powershell disable-computerrestore c:
vssadmin delete shadows /all /quiet
rem Disable reboot on Bluescreen, and no dump
reg add HKLM\SYSTEM\CurrentControlSet\Control\CrashControl /v CrashDumpEnabled /t REG_DWORD /d 0 /f
reg add HKLM\SYSTEM\CurrentControlSet\Control\CrashControl /v LogEvent /t REG_DWORD /d 0 /f
reg add HKLM\SYSTEM\CurrentControlSet\Control\CrashControl /v SendAlert /t REG_DWORD /d 0 /f
reg add HKLM\SYSTEM\CurrentControlSet\Control\CrashControl /v AutoReboot /t REG_DWORD /d 0 /f
rem Don't allow Remote Assistance
reg add "HKLM\System\CurrentControlSet\Control\Remote Assistance" /v fAllowToGetHelp /t REG_DWORD /d 0 /f
rem Enable Remote Desktop
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
rem Allow Remote Desktop without password
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f
rem Disable Edge Browser preload on startup. We'll never use it anyway, saves memory and startup time
reg add HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main /v AllowPrelaunch /t REG_DWORD /d 0 /f
reg add HKLM\Software\Policies\Microsoft\Edge /v StartupBoostEnabled /t REG_DWORD /d 0 /f
reg add HKLM\Software\Policies\Microsoft\Edge /v BackgroundModeEnabled /t REG_DWORD /d 0 /f
rem Disable Edge Browser (Chromium) first run experience
reg add HKLM\Software\Policies\Microsoft\Edge /v HideFirstRunExperience /t REG_DWORD /d 1 /f
rem Block Edge from recreating the desktop icon on every update
reg add HKLM\Software\Policies\Microsoft\EdgeUpdate /v CreateDesktopShortcutDefault /t REG_DWORD /d 0 /f
reg add HKLM\Software\Policies\Microsoft\EdgeUpdate /v RemoveDesktopShortcutDefault /t REG_DWORD /d 1 /f
rem Disable Look for App in Store prompt when opening unknown file type
reg add HKLM\Software\Policies\Microsoft\Windows\Explorer /v NoUseStoreOpenWith /t REG_DWORD /d 1 /f
rem Disable Windows Program Compatibility Assistant
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\AppCompat /v DisablePCA /t REG_DWORD /d 1 /f
rem Disable Inventory collecting data and sending the info to Microsoft
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\AppCompat /v DisableInventory /t REG_DWORD /d 1 /f
rem Disable Application Telemetry
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\AppCompat /v AITEnable /t REG_DWORD /d 0 /f
rem Disable Shared Experiences
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v EnableCdp /t REG_DWORD /d 0 /f
rem Disable Widgets
reg add HKLM\SOFTWARE\Policies\Microsoft\Dsh /v AllowNewsAndInterests /t REG_DWORD /d 0 /f
rem Remove "Chat" from Taskbar and block automatic Teams installation
rem We need to take ownership of the key first
PowerShell "(New-Object System.Net.WebClient).DownloadFile('https://www.techpowerup.com/wizzard/SetACL.exe', '%TEMP%\SetACL.exe');
%TEMP%\SetACL.exe -on "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Communications" -ot reg -actn setowner -ownr "n:Everyone"
%TEMP%\SetACL.exe -on "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Communications" -ot reg -actn ace -ace "n:Everyone;p:full"
del %TEMP%\SetACL.exe
reg add "HKLM\Software\Policies\Microsoft\Windows\Windows Chat" /f /v ChatIcon /t REG_DWORD /d 3
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Communications /v ConfigureChatAutoInstall /t REG_DWORD /d 0 /f
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v TaskbarMn /t REG_DWORD /d 0
rem Remove useless Windows components
dism /online /norestart /disable-feature /featurename:Printing-PrintToPDFServices-Features
dism /online /norestart /disable-feature /featurename:Printing-XPSServices-Features
dism /online /norestart /disable-feature /featurename:WorkFolders-Client
dism /online /norestart /disable-feature /featurename:Printing-Foundation-Features
dism /online /norestart /disable-feature /featurename:Printing-Foundation-InternetPrinting-Client
dism /online /norestart /disable-feature /featurename:MSRDC-Infrastructure
dism /online /norestart /disable-feature /featurename:SmbDirect
dism /online /norestart /disable-feature /featurename:MediaPlayback
dism /online /norestart /disable-feature /featurename:WCF-TCP-PortSharing45
dism /online /norestart /disable-feature /featurename:WCF-Services45
dism /online /norestart /disable-feature /featurename:WindowsMediaPlayer
rem Install .NET 3.5 Framework, some older apps and games need this, and you can't install it on demand once Windows Update is disabled
dism /online /norestart /enable-feature /featurename:NetFx3 /all
rem Remove useless optional features
dism /online /norestart /Remove-Capability /CapabilityName:App.StepsRecorder~~~~0.0.1.0
dism /online /norestart /Remove-Capability /CapabilityName:App.Support.QuickAssist~~~~0.0.1.0
dism /online /norestart /Remove-Capability /CapabilityName:Browser.InternetExplorer~~~~0.0.11.0
dism /online /norestart /Remove-Capability /CapabilityName:Hello.Face.20134~~~~0.0.1.0
dism /online /norestart /Remove-Capability /CapabilityName:Language.Handwriting~~~en-US~0.0.1.0
dism /online /norestart /Remove-Capability /CapabilityName:Language.Speech~~~en-US~0.0.1.0
dism /online /norestart /Remove-Capability /CapabilityName:Language.TextToSpeech~~~en-US~0.0.1.0
dism /online /norestart /Remove-Capability /CapabilityName:MathRecognizer~~~~0.0.1.0
dism /online /norestart /Remove-Capability /CapabilityName:Media.WindowsMediaPlayer~~~~0.0.12.0
dism /online /norestart /Remove-Capability /CapabilityName:Microsoft.Windows.WordPad~~~~0.0.1.0
dism /online /norestart /Remove-Capability /CapabilityName:OneCoreUAP.OneSync~~~~0.0.1.0
dism /online /norestart /Remove-Capability /CapabilityName:OpenSSH.Client~~~~0.0.1.0
dism /online /norestart /Remove-Capability /CapabilityName:Print.Management.Console~~~~0.0.1.0
dism /online /norestart /Remove-Capability /CapabilityName:Microsoft.Wallpapers.Extended~~~~0.0.1.0
rem Do not remove OCR or Windows will show "Something happened, and we couldn't install a feature" a few hours after cleanup
rem dism /online /norestart /Remove-Capability /CapabilityName:Language.OCR~~~en-US~0.0.1.0
rem Remove a lot of unnecessary apps
powershell "Get-AppXPackage | Where NonRemovable -Match false | Where IsFramework -Match false | Where Name -NotMatch '.*Windows(Store|Notepad|Calculator|Terminal)|NVIDIAControlPanel.*' | Remove-AppXPackage"
powershell "sleep 5"
powershell "Get-AppXProvisionedPackage -online | Where DisplayName -NotMatch '.*Windows(Store|Notepad|Calculator|Terminal)|NVIDIAControlPanel.*' | ForEach-Object { try { Write-Host $_.DisplayName ; Remove-AppxProvisionedPackage -Online -PackageName $_.PackageName } catch { Write-Host $_ } }"
rem If you find widgets.exe running with several MSEdgeWebView2 child processes, run
powershell "Get-AppxPackage *WebExperience* | Remove-AppxPackage"
rem Set Computer name
powershell "Rename-Computer -NewName VGATESTx"
rem Finished