Compare commits
1 commit
main
...
experiment
| Author | SHA1 | Date | |
|---|---|---|---|
|
024aba051b |
7 changed files with 1298 additions and 657 deletions
7
.github/FUNDING.yml
vendored
7
.github/FUNDING.yml
vendored
|
|
@ -1,5 +1,8 @@
|
|||
|
||||
github: [0n1cOn3]
|
||||
|
||||
github: [ntdevlabs]
|
||||
patreon: [ntdev]
|
||||
ko-fi: [ntdev]
|
||||
|
||||
# Add custom links to support your work
|
||||
custom: ['https://paypal.me/StefanKuny']
|
||||
custom: ['https://paypal.me/ntdev2']
|
||||
|
|
|
|||
22
Dockerfile
22
Dockerfile
|
|
@ -1,22 +0,0 @@
|
|||
# Use Windows Server Core as base image
|
||||
FROM mcr.microsoft.com/windows/servercore:ltsc2022
|
||||
|
||||
# Define environment variables matching script paths
|
||||
ENV ISO_MOUNT="C:\\ISOMount" `
|
||||
OUTPUT_PATH="C:\\Tiny11_Output"
|
||||
|
||||
# Create necessary directories
|
||||
RUN mkdir $ISO_MOUNT $OUTPUT_PATH
|
||||
|
||||
# Copy the PowerShell script into the container
|
||||
COPY install_tiny11.ps1 C:\install_tiny11.ps1
|
||||
|
||||
# Set the working directory
|
||||
WORKDIR C:\
|
||||
|
||||
# Set execution policy for scripts
|
||||
SHELL ["powershell", "-Command"]
|
||||
RUN Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force
|
||||
|
||||
# Define entrypoint for running the script
|
||||
ENTRYPOINT ["powershell.exe", "-File", "C:\\install_tiny11.ps1", "-OutputPath", "C:\\Tiny11_Output"]
|
||||
|
|
@ -1,581 +0,0 @@
|
|||
<#
|
||||
.SYNOPSIS
|
||||
Tiny11 Image Creator – Full Workflow (ISO Download, Mount, Customization, and ISO Creation)
|
||||
|
||||
.DESCRIPTION
|
||||
This script uses DISM and other tools to create a customized Windows 11 image.
|
||||
It now supports obtaining the Windows 11 ISO from a user-supplied path or by auto‑downloading
|
||||
(using massgrave.dev as the source) if no ISO is provided. The ISO is then mounted and assigned
|
||||
a free drive letter. The script then copies installation files, processes install.wim and boot.wim,
|
||||
applies registry tweaks and removals, and finally creates an ISO using oscdimg.exe.
|
||||
|
||||
.PARAMETER ScratchDisk
|
||||
A drive letter (e.g. "D") or path where the working files will be stored.
|
||||
|
||||
.PARAMETER ISOPath
|
||||
(Optional) Full path to a Windows 11 ISO file. If not provided, the script will prompt for
|
||||
the desired language and auto‑download the ISO.
|
||||
|
||||
.PARAMETER Language
|
||||
(Optional) Desired language code for the ISO download (e.g. "en-US", "de-DE"). Only used if ISOPath is not provided.
|
||||
|
||||
.NOTES
|
||||
- This script requires administrative privileges.
|
||||
- It assumes that your original workflow (registry tweaks, application removals, etc.) must remain intact.
|
||||
- Some API endpoints (for downloading the ISO) are hypothetical and may need adjustment.
|
||||
#>
|
||||
|
||||
param (
|
||||
[ValidatePattern('^[c-zC-Z]$')]
|
||||
[string]$ScratchDisk,
|
||||
[string]$ISOPath, # Full path to a Windows 11 ISO (optional)
|
||||
[string]$Language # Desired language code (e.g., "en-US", "de-DE")
|
||||
)
|
||||
|
||||
#region Helper Functions (ISO download and mount)
|
||||
|
||||
function Get-Win11DownloadLink {
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Queries the API (via massgrave.dev) for the proper ISO download link.
|
||||
.PARAMETER Language
|
||||
The desired language code.
|
||||
.OUTPUTS
|
||||
The download URL as a string.
|
||||
#>
|
||||
param(
|
||||
[Parameter(Mandatory = $true)]
|
||||
[string]$Language
|
||||
)
|
||||
# Adjust the endpoint and parameters as required.
|
||||
$apiBase = "https://api.gravesoft.dev/msdl/"
|
||||
$endpoint = "getDownloadLink" # Hypothetical endpoint.
|
||||
$url = "$apiBase$endpoint?language=$Language"
|
||||
|
||||
Write-Host "Querying download link for Windows 11 ISO for language: $Language" -ForegroundColor Cyan
|
||||
try {
|
||||
$response = Invoke-RestMethod -Uri $url -Method Get
|
||||
if ($response -and $response.downloadUrl) {
|
||||
Write-Host "Download URL obtained: $($response.downloadUrl)" -ForegroundColor Green
|
||||
return $response.downloadUrl
|
||||
}
|
||||
else {
|
||||
Write-Error "API did not return a valid download URL."
|
||||
return $null
|
||||
}
|
||||
}
|
||||
catch {
|
||||
Write-Error "Error calling the download API: $_"
|
||||
return $null
|
||||
}
|
||||
}
|
||||
|
||||
function Get-Windows11ISO {
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Returns the path to a Windows 11 ISO. If a valid ISOPath is provided, that file is used.
|
||||
Otherwise, prompts (or uses the provided language) and downloads the ISO.
|
||||
.PARAMETER ISOPath
|
||||
User-supplied ISO path.
|
||||
.PARAMETER Language
|
||||
Desired language code.
|
||||
.OUTPUTS
|
||||
The full path to the Windows 11 ISO.
|
||||
#>
|
||||
param(
|
||||
[string]$ISOPath,
|
||||
[string]$Language
|
||||
)
|
||||
# Use provided ISO if valid
|
||||
if ($ISOPath -and (Test-Path $ISOPath -PathType Leaf)) {
|
||||
Write-Host "Using provided ISO: $ISOPath" -ForegroundColor Green
|
||||
return $ISOPath
|
||||
}
|
||||
|
||||
# If no ISO path, prompt for language (if not provided)
|
||||
if (-not $Language) {
|
||||
$Language = Read-Host "Enter your desired Windows 11 language (e.g., en-US, de-DE)"
|
||||
}
|
||||
|
||||
$downloadLink = Get-Win11DownloadLink -Language $Language
|
||||
if (-not $downloadLink) {
|
||||
Write-Error "Could not retrieve a valid download link. Exiting."
|
||||
exit 1
|
||||
}
|
||||
|
||||
$DownloadPath = "$env:TEMP\Windows11_$Language.iso"
|
||||
Write-Host "Downloading Windows 11 ISO from $downloadLink ..." -ForegroundColor Cyan
|
||||
try {
|
||||
Invoke-WebRequest -Uri $downloadLink -OutFile $DownloadPath
|
||||
Write-Host "Download complete: $DownloadPath" -ForegroundColor Green
|
||||
return $DownloadPath
|
||||
}
|
||||
catch {
|
||||
Write-Error "Failed to download the ISO: $_"
|
||||
exit 1
|
||||
}
|
||||
}
|
||||
|
||||
function Mount-ISOAndAssignDriveLetter {
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Mounts an ISO image and assigns a free drive letter if none is already assigned.
|
||||
.PARAMETER ISOPath
|
||||
The full path to the ISO file.
|
||||
.OUTPUTS
|
||||
The drive letter (e.g., "E:") where the ISO is mounted.
|
||||
#>
|
||||
param(
|
||||
[Parameter(Mandatory = $true)]
|
||||
[string]$ISOPath
|
||||
)
|
||||
if (-not (Test-Path $ISOPath)) {
|
||||
Write-Error "The ISO file '$ISOPath' does not exist."
|
||||
return
|
||||
}
|
||||
|
||||
Write-Host "Mounting ISO image: $ISOPath" -ForegroundColor Cyan
|
||||
$mountedImage = Mount-DiskImage -ImagePath $ISOPath -PassThru
|
||||
if (-not $mountedImage) {
|
||||
Write-Error "Failed to mount ISO image."
|
||||
return
|
||||
}
|
||||
Start-Sleep -Seconds 3 # Wait for the volume to become available
|
||||
|
||||
$diskImage = Get-DiskImage -ImagePath $ISOPath
|
||||
if (-not $diskImage) {
|
||||
Write-Error "Unable to retrieve disk image information."
|
||||
return
|
||||
}
|
||||
$disk = $diskImage | Get-Disk
|
||||
if (-not $disk) {
|
||||
Write-Error "Unable to retrieve disk information for the mounted image."
|
||||
return
|
||||
}
|
||||
$diskNumber = $disk.Number
|
||||
|
||||
# Retrieve the first partition (most ISOs contain a single partition)
|
||||
$partition = Get-Partition -DiskNumber $diskNumber | Select-Object -First 1
|
||||
if (-not $partition) {
|
||||
Write-Error "No partition found on the mounted ISO."
|
||||
return
|
||||
}
|
||||
|
||||
# If no drive letter is assigned, choose a free one (from C: to Z:)
|
||||
if (-not $partition.DriveLetter) {
|
||||
$freeLetters = [char[]](67..90) | ForEach-Object { [char]$_ }
|
||||
$usedLetters = (Get-Volume | Where-Object { $_.DriveLetter } | Select-Object -ExpandProperty DriveLetter)
|
||||
$availableLetters = $freeLetters | Where-Object { $usedLetters -notcontains $_ }
|
||||
if ($availableLetters.Count -eq 0) {
|
||||
Write-Error "No free drive letters available."
|
||||
return
|
||||
}
|
||||
$freeLetter = $availableLetters | Select-Object -First 1
|
||||
Write-Host "Assigning drive letter '$freeLetter' to the mounted ISO." -ForegroundColor Yellow
|
||||
Set-Partition -DiskNumber $diskNumber -PartitionNumber $partition.PartitionNumber -NewDriveLetter $freeLetter
|
||||
$driveLetter = "$freeLetter`:"
|
||||
}
|
||||
else {
|
||||
$driveLetter = "$($partition.DriveLetter):"
|
||||
}
|
||||
|
||||
Write-Host "ISO mounted at drive letter: $driveLetter" -ForegroundColor Green
|
||||
return $driveLetter
|
||||
}
|
||||
|
||||
#endregion Helper Functions
|
||||
|
||||
#region Environment Setup
|
||||
|
||||
function Setup-Environment {
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Performs pre-flight checks, sets the scratch disk, adjusts execution policy,
|
||||
ensures admin rights, starts logging, and creates necessary directories.
|
||||
#>
|
||||
# Set ScratchDisk (if not provided, use the script folder)
|
||||
if (-not $ScratchDisk) {
|
||||
$global:ScratchDisk = $PSScriptRoot.TrimEnd('\')
|
||||
} else {
|
||||
$global:ScratchDisk = "$ScratchDisk`:" # Append colon if needed.
|
||||
}
|
||||
Write-Output "Scratch disk set to $global:ScratchDisk"
|
||||
|
||||
# Check and adjust execution policy
|
||||
if ((Get-ExecutionPolicy) -eq 'Restricted') {
|
||||
Write-Host "Your current PowerShell Execution Policy is 'Restricted'. Changing it to 'RemoteSigned'..."
|
||||
Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -Confirm:$false
|
||||
}
|
||||
|
||||
# Ensure script is running as administrator
|
||||
$adminRole = [System.Security.Principal.WindowsBuiltInRole]::Administrator
|
||||
$principal = New-Object System.Security.Principal.WindowsPrincipal([System.Security.Principal.WindowsIdentity]::GetCurrent())
|
||||
if (-not $principal.IsInRole($adminRole)) {
|
||||
Write-Host "Restarting the script with elevated privileges..."
|
||||
$arguments = "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`""
|
||||
Start-Process powershell -Verb RunAs -ArgumentList $arguments
|
||||
exit
|
||||
}
|
||||
|
||||
# Start logging and set window title
|
||||
Start-Transcript -Path "$global:ScratchDisk\tiny11.log"
|
||||
$Host.UI.RawUI.WindowTitle = "Tiny11 Image Creator"
|
||||
Clear-Host
|
||||
Write-Host "Welcome to the Tiny11 Image Creator! Release: 05-06-24" -ForegroundColor Cyan
|
||||
|
||||
# Create required directories
|
||||
$global:tiny11Folder = Join-Path $global:ScratchDisk "tiny11"
|
||||
$global:sourcesFolder = Join-Path $global:tiny11Folder "sources"
|
||||
$global:mountPath = Join-Path $global:ScratchDisk "scratchdir"
|
||||
New-Item -ItemType Directory -Force -Path $global:sourcesFolder | Out-Null
|
||||
New-Item -ItemType Directory -Force -Path $global:mountPath | Out-Null
|
||||
}
|
||||
|
||||
#endregion Environment Setup
|
||||
|
||||
#region Obtain & Mount Installation Media
|
||||
|
||||
function Get-InstallationMedia {
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Obtains the Windows 11 ISO (using a provided path or by downloading it) and mounts it.
|
||||
.OUTPUTS
|
||||
The drive letter where the installation media is mounted.
|
||||
#>
|
||||
# Get the ISO (download if necessary)
|
||||
$global:win11ISO = Get-Windows11ISO -ISOPath $ISOPath -Language $Language
|
||||
if (-not $global:win11ISO) {
|
||||
Write-Error "Failed to obtain a Windows 11 ISO. Exiting."
|
||||
exit
|
||||
}
|
||||
|
||||
# Mount the ISO and retrieve the drive letter
|
||||
$mediaDrive = Mount-ISOAndAssignDriveLetter -ISOPath $global:win11ISO
|
||||
if (-not $mediaDrive) {
|
||||
Write-Error "Failed to mount the Windows 11 ISO. Exiting."
|
||||
exit
|
||||
}
|
||||
Write-Output "Installation media mounted at: $mediaDrive"
|
||||
return $mediaDrive
|
||||
}
|
||||
|
||||
#endregion Obtain & Mount Installation Media
|
||||
|
||||
#region Process install.wim Image
|
||||
|
||||
function Process-InstallImage {
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Processes the Windows installation image (install.wim). This includes:
|
||||
- Validating that the necessary installation files exist (or converting install.esd)
|
||||
- Copying installation files from the installation media to the working folder
|
||||
- Mounting the install.wim, gathering image information, applying customizations,
|
||||
removing apps, tweaking registries, and finally unmounting the image.
|
||||
#>
|
||||
param(
|
||||
[string]$DriveLetter # Installation media drive letter
|
||||
)
|
||||
|
||||
# Validate Windows installation files
|
||||
if ((Test-Path "$DriveLetter\sources\boot.wim") -eq $false -or (Test-Path "$DriveLetter\sources\install.wim") -eq $false) {
|
||||
if (Test-Path "$DriveLetter\sources\install.esd") {
|
||||
Write-Host "Found install.esd, converting to install.wim..."
|
||||
Get-WindowsImage -ImagePath "$DriveLetter\sources\install.esd"
|
||||
$index = Read-Host "Please enter the image index to convert from install.esd"
|
||||
Write-Host "Converting install.esd to install.wim. This may take a while..."
|
||||
Export-WindowsImage -SourceImagePath "$DriveLetter\sources\install.esd" `
|
||||
-SourceIndex $index `
|
||||
-DestinationImagePath "$global:ScratchDisk\tiny11\sources\install.wim" `
|
||||
-CompressionType Maximum -CheckIntegrity
|
||||
} else {
|
||||
Write-Host "Cannot find Windows OS installation files on the installation media."
|
||||
exit
|
||||
}
|
||||
}
|
||||
else {
|
||||
Write-Host "Copying Windows installation files from $DriveLetter..."
|
||||
Copy-Item -Path "$DriveLetter\*" -Destination "$global:tiny11Folder" -Recurse -Force | Out-Null
|
||||
# Remove install.esd if present
|
||||
Set-ItemProperty -Path "$global:tiny11Folder\sources\install.esd" -Name IsReadOnly -Value $false -ErrorAction SilentlyContinue
|
||||
Remove-Item "$global:tiny11Folder\sources\install.esd" -ErrorAction SilentlyContinue
|
||||
Write-Host "Copy complete!"
|
||||
}
|
||||
|
||||
Start-Sleep -Seconds 2
|
||||
Clear-Host
|
||||
Write-Host "Retrieving image information from install.wim..."
|
||||
Get-WindowsImage -ImagePath (Join-Path $global:sourcesFolder "install.wim")
|
||||
$index = Read-Host "Please enter the desired image index"
|
||||
Write-Host "Mounting install.wim image. This may take a while..."
|
||||
$global:wimFilePath = Join-Path $global:sourcesFolder "install.wim"
|
||||
& takeown "/F" $global:wimFilePath
|
||||
& icacls $global:wimFilePath "/grant" "$($adminGroup.Value):(F)"
|
||||
try {
|
||||
Set-ItemProperty -Path $global:wimFilePath -Name IsReadOnly -Value $false -ErrorAction Stop
|
||||
} catch {
|
||||
# Suppress errors
|
||||
}
|
||||
New-Item -ItemType Directory -Force -Path $global:mountPath > $null
|
||||
Mount-WindowsImage -ImagePath $global:wimFilePath -Index $index -Path $global:mountPath
|
||||
|
||||
# Retrieve system UI language from the mounted image
|
||||
$imageIntl = & dism /English /Get-Intl "/Image:$global:mountPath"
|
||||
$languageLine = $imageIntl -split '\n' | Where-Object { $_ -match 'Default system UI language : ([a-zA-Z]{2}-[a-zA-Z]{2})' }
|
||||
if ($languageLine) {
|
||||
$languageCode = $Matches[1]
|
||||
Write-Host "Default system UI language code: $languageCode"
|
||||
} else {
|
||||
Write-Host "Default system UI language code not found."
|
||||
}
|
||||
|
||||
# Retrieve architecture information from the image
|
||||
$imageInfo = & dism /English /Get-WimInfo "/wimFile:$global:sourcesFolder\install.wim" "/index:$index"
|
||||
$lines = $imageInfo -split '\r?\n'
|
||||
foreach ($line in $lines) {
|
||||
if ($line -like '*Architecture : *') {
|
||||
$architecture = $line -replace 'Architecture : ',''
|
||||
if ($architecture -eq 'x64') {
|
||||
$architecture = 'amd64'
|
||||
}
|
||||
Write-Host "Architecture: $architecture"
|
||||
break
|
||||
}
|
||||
}
|
||||
if (-not $architecture) {
|
||||
Write-Host "Architecture information not found."
|
||||
}
|
||||
|
||||
Write-Host "Install image mounted. Proceeding with application removals and customizations..."
|
||||
|
||||
# Remove unwanted applications (bloatware) via DISM
|
||||
$packages = & dism /English "/image:$global:mountPath" '/Get-ProvisionedAppxPackages' |
|
||||
ForEach-Object {
|
||||
if ($_ -match 'PackageName : (.*)') {
|
||||
$matches[1]
|
||||
}
|
||||
}
|
||||
$packagePrefixes = 'Clipchamp.Clipchamp_', 'Microsoft.BingNews_', 'Microsoft.BingWeather_', 'Microsoft.GamingApp_', 'Microsoft.GetHelp_', 'Microsoft.Getstarted_', 'Microsoft.MicrosoftOfficeHub_', 'Microsoft.MicrosoftSolitaireCollection_', 'Microsoft.People_', 'Microsoft.PowerAutomateDesktop_', 'Microsoft.Todos_', 'Microsoft.WindowsAlarms_', 'microsoft.windowscommunicationsapps_', 'Microsoft.WindowsFeedbackHub_', 'Microsoft.WindowsMaps_', 'Microsoft.WindowsSoundRecorder_', 'Microsoft.Xbox.TCUI_', 'Microsoft.XboxGamingOverlay_', 'Microsoft.XboxGameOverlay_', 'Microsoft.XboxSpeechToTextOverlay_', 'Microsoft.YourPhone_', 'Microsoft.ZuneMusic_', 'Microsoft.ZuneVideo_', 'MicrosoftCorporationII.MicrosoftFamily_', 'MicrosoftCorporationII.QuickAssist_', 'MicrosoftTeams_', 'Microsoft.549981C3F5F10_'
|
||||
$packagesToRemove = $packages | Where-Object {
|
||||
$packageName = $_
|
||||
$packagePrefixes -contains ($packagePrefixes | Where-Object { $packageName -like "$_*" })
|
||||
}
|
||||
foreach ($package in $packagesToRemove) {
|
||||
& dism /English "/image:$global:mountPath" '/Remove-ProvisionedAppxPackage' "/PackageName:$package"
|
||||
}
|
||||
|
||||
# Remove Microsoft Edge and its components
|
||||
Write-Host "Removing Microsoft Edge..."
|
||||
Remove-Item -Path "$global:mountPath\Program Files (x86)\Microsoft\Edge" -Recurse -Force -ErrorAction SilentlyContinue
|
||||
Remove-Item -Path "$global:mountPath\Program Files (x86)\Microsoft\EdgeUpdate" -Recurse -Force -ErrorAction SilentlyContinue
|
||||
Remove-Item -Path "$global:mountPath\Program Files (x86)\Microsoft\EdgeCore" -Recurse -Force -ErrorAction SilentlyContinue
|
||||
if ($architecture -eq 'amd64') {
|
||||
$folderPath = Get-ChildItem -Path "$global:mountPath\Windows\WinSxS" -Filter "amd64_microsoft-edge-webview_31bf3856ad364e35*" -Directory | Select-Object -ExpandProperty FullName
|
||||
if ($folderPath) {
|
||||
& takeown '/f' $folderPath '/r' | Out-Null
|
||||
& icacls $folderPath "/grant" "$($adminGroup.Value):(F)" '/T' '/C' | Out-Null
|
||||
Remove-Item -Path $folderPath -Recurse -Force | Out-Null
|
||||
} else {
|
||||
Write-Host "Edge WebView folder not found."
|
||||
}
|
||||
}
|
||||
elseif ($architecture -eq 'arm64') {
|
||||
$folderPath = Get-ChildItem -Path "$global:mountPath\Windows\WinSxS" -Filter "arm64_microsoft-edge-webview_31bf3856ad364e35*" -Directory | Select-Object -ExpandProperty FullName
|
||||
if ($folderPath) {
|
||||
& takeown '/f' $folderPath '/r' | Out-Null
|
||||
& icacls $folderPath "/grant" "$($adminGroup.Value):(F)" '/T' '/C' | Out-Null
|
||||
Remove-Item -Path $folderPath -Recurse -Force | Out-Null
|
||||
} else {
|
||||
Write-Host "Edge WebView folder not found."
|
||||
}
|
||||
}
|
||||
& takeown '/f' "$global:mountPath\Windows\System32\Microsoft-Edge-Webview" '/r' | Out-Null
|
||||
& icacls "$global:mountPath\Windows\System32\Microsoft-Edge-Webview" '/grant' "$($adminGroup.Value):(F)" '/T' '/C' | Out-Null
|
||||
Remove-Item -Path "$global:mountPath\Windows\System32\Microsoft-Edge-Webview" -Recurse -Force | Out-Null
|
||||
|
||||
# Remove OneDrive
|
||||
Write-Host "Removing OneDrive..."
|
||||
& takeown '/f' "$global:mountPath\Windows\System32\OneDriveSetup.exe" | Out-Null
|
||||
& icacls "$global:mountPath\Windows\System32\OneDriveSetup.exe" '/grant' "$($adminGroup.Value):(F)" '/T' '/C' | Out-Null
|
||||
Remove-Item -Path "$global:mountPath\Windows\System32\OneDriveSetup.exe" -Force | Out-Null
|
||||
Write-Host "Application removal complete!"
|
||||
|
||||
Start-Sleep -Seconds 2
|
||||
Clear-Host
|
||||
|
||||
# Load registry hives from the mounted image and apply tweaks
|
||||
Write-Host "Loading registry hives from the mounted image..."
|
||||
reg load HKLM\zCOMPONENTS "$global:mountPath\Windows\System32\config\COMPONENTS" | Out-Null
|
||||
reg load HKLM\zDEFAULT "$global:mountPath\Windows\System32\config\default" | Out-Null
|
||||
reg load HKLM\zNTUSER "$global:mountPath\Users\Default\ntuser.dat" | Out-Null
|
||||
reg load HKLM\zSOFTWARE "$global:mountPath\Windows\System32\config\SOFTWARE" | Out-Null
|
||||
reg load HKLM\zSYSTEM "$global:mountPath\Windows\System32\config\SYSTEM" | Out-Null
|
||||
|
||||
Write-Host "Applying registry tweaks to bypass system requirements..."
|
||||
& reg add 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV1' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
|
||||
& reg add 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV2' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
|
||||
& reg add 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV1' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
|
||||
& reg add 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV2' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
|
||||
& reg add 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassCPUCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
|
||||
& reg add 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassRAMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
|
||||
& reg add 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassSecureBootCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
|
||||
& reg add 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassStorageCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
|
||||
& reg add 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassTPMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
|
||||
& reg add 'HKLM\zSYSTEM\Setup\MoSetup' '/v' 'AllowUpgradesWithUnsupportedTPMOrCPU' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
|
||||
|
||||
Write-Host "Registry tweaks complete. Unloading registry hives..."
|
||||
reg unload HKLM\zCOMPONENTS | Out-Null
|
||||
reg unload HKLM\zDEFAULT | Out-Null
|
||||
reg unload HKLM\zNTUSER | Out-Null
|
||||
reg unload HKLM\zSOFTWARE | Out-Null
|
||||
reg unload HKLM\zSYSTEM | Out-Null
|
||||
|
||||
Write-Host "Performing component cleanup on the image..."
|
||||
Repair-WindowsImage -Path $global:mountPath -StartComponentCleanup -ResetBase
|
||||
Write-Host "Unmounting install.wim image (saving changes)..."
|
||||
Dismount-WindowsImage -Path $global:mountPath -Save
|
||||
Clear-Host
|
||||
|
||||
Write-Host "Exporting updated install.wim..."
|
||||
Export-WindowsImage -SourceImagePath (Join-Path $global:sourcesFolder "install.wim") -SourceIndex $index `
|
||||
-DestinationImagePath (Join-Path $global:sourcesFolder "install2.wim") -CompressionType Fast
|
||||
Remove-Item -Path (Join-Path $global:sourcesFolder "install.wim") -Force | Out-Null
|
||||
Rename-Item -Path (Join-Path $global:sourcesFolder "install2.wim") -NewName "install.wim" -Force | Out-Null
|
||||
Write-Host "Install image processing complete. Proceeding with boot.wim..."
|
||||
}
|
||||
|
||||
#endregion Process install.wim Image
|
||||
|
||||
#region Process boot.wim Image
|
||||
|
||||
function Process-BootImage {
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Processes the boot image (boot.wim). This includes mounting the boot image,
|
||||
applying necessary tweaks (if any), and then unmounting the image.
|
||||
#>
|
||||
Write-Host "Mounting boot.wim image..."
|
||||
$global:wimFilePath = Join-Path $global:sourcesFolder "boot.wim"
|
||||
& takeown "/F" $global:wimFilePath | Out-Null
|
||||
& icacls $global:wimFilePath "/grant" "$($adminGroup.Value):(F)" | Out-Null
|
||||
Set-ItemProperty -Path $global:wimFilePath -Name IsReadOnly -Value $false
|
||||
Mount-WindowsImage -ImagePath $global:wimFilePath -Index 2 -Path $global:mountPath
|
||||
Write-Host "Boot image mounted. Loading registry from boot image..."
|
||||
reg load HKLM\zCOMPONENTS "$global:mountPath\Windows\System32\config\COMPONENTS" | Out-Null
|
||||
reg load HKLM\zDEFAULT "$global:mountPath\Windows\System32\config\default" | Out-Null
|
||||
reg load HKLM\zNTUSER "$global:mountPath\Users\Default\ntuser.dat" | Out-Null
|
||||
reg load HKLM\zSOFTWARE "$global:mountPath\Windows\System32\config\SOFTWARE" | Out-Null
|
||||
reg load HKLM\zSYSTEM "$global:mountPath\Windows\System32\config\SYSTEM" | Out-Null
|
||||
|
||||
Write-Host "Applying tweaks to boot image registry..."
|
||||
& reg add 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV1' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
|
||||
& reg add 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV2' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
|
||||
& reg add 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV1' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
|
||||
& reg add 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV2' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
|
||||
& reg add 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassCPUCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
|
||||
& reg add 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassRAMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
|
||||
& reg add 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassSecureBootCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
|
||||
& reg add 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassStorageCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
|
||||
& reg add 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassTPMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
|
||||
& reg add 'HKLM\zSYSTEM\Setup\MoSetup' '/v' 'AllowUpgradesWithUnsupportedTPMOrCPU' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
|
||||
|
||||
Write-Host "Tweaks for boot image applied. Unloading registry hives..."
|
||||
reg unload HKLM\zCOMPONENTS | Out-Null
|
||||
reg unload HKLM\zDEFAULT | Out-Null
|
||||
reg unload HKLM\zNTUSER | Out-Null
|
||||
reg unload HKLM\zSOFTWARE | Out-Null
|
||||
reg unload HKLM\zSYSTEM | Out-Null
|
||||
|
||||
Write-Host "Unmounting boot image (saving changes)..."
|
||||
Dismount-WindowsImage -Path $global:mountPath -Save
|
||||
}
|
||||
|
||||
#endregion Process boot.wim Image
|
||||
|
||||
#region Finalize ISO Creation
|
||||
|
||||
function Finalize-ISO {
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Uses oscdimg.exe to create the final Tiny11 ISO from the customized image.
|
||||
#>
|
||||
Write-Host "Copying unattended file for bypassing MS account on OOBE..."
|
||||
Copy-Item -Path "$PSScriptRoot\autounattend.xml" -Destination "$global:tiny11Folder\autounattend.xml" -Force | Out-Null
|
||||
|
||||
Write-Host "Creating final ISO image..."
|
||||
$ADKDepTools = "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\$hostarchitecture\Oscdimg"
|
||||
$localOSCDIMGPath = "$PSScriptRoot\oscdimg.exe"
|
||||
|
||||
if ([System.IO.Directory]::Exists($ADKDepTools)) {
|
||||
Write-Host "Using oscdimg.exe from the system ADK."
|
||||
$OSCDIMG = Join-Path $ADKDepTools "oscdimg.exe"
|
||||
} else {
|
||||
Write-Host "ADK folder not found. Using bundled oscdimg.exe."
|
||||
if (-not (Test-Path -Path $localOSCDIMGPath)) {
|
||||
Write-Host "Downloading oscdimg.exe..."
|
||||
$url = "https://msdl.microsoft.com/download/symbols/oscdimg.exe/3D44737265000/oscdimg.exe"
|
||||
Invoke-WebRequest -Uri $url -OutFile $localOSCDIMGPath
|
||||
if (-not (Test-Path $localOSCDIMGPath)) {
|
||||
Write-Error "Failed to download oscdimg.exe."
|
||||
exit 1
|
||||
}
|
||||
} else {
|
||||
Write-Host "oscdimg.exe already exists locally."
|
||||
}
|
||||
$OSCDIMG = $localOSCDIMGPath
|
||||
}
|
||||
|
||||
# Define boot data (adjust paths if necessary)
|
||||
$bootData = "2#p0,e,b$global:tiny11Folder\boot\etfsboot.com#pEF,e,b$global:tiny11Folder\efi\microsoft\boot\efisys.bin"
|
||||
$isoOutput = Join-Path $PSScriptRoot "tiny11.iso"
|
||||
& "$OSCDIMG" '-m' '-o' '-u2' '-udfver102' "-bootdata:$bootData" "$global:tiny11Folder" "$isoOutput"
|
||||
Write-Host "ISO creation complete: $isoOutput" -ForegroundColor Green
|
||||
}
|
||||
|
||||
#endregion Finalize ISO Creation
|
||||
|
||||
#region Cleanup
|
||||
|
||||
function Cleanup-Environment {
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Cleans up temporary folders used during image processing.
|
||||
#>
|
||||
Write-Host "Performing cleanup..."
|
||||
Remove-Item -Path "$global:tiny11Folder" -Recurse -Force -ErrorAction SilentlyContinue
|
||||
Remove-Item -Path "$global:mountPath" -Recurse -Force -ErrorAction SilentlyContinue
|
||||
Stop-Transcript
|
||||
Write-Host "Cleanup complete."
|
||||
}
|
||||
|
||||
#endregion Cleanup
|
||||
|
||||
#region Main Flow
|
||||
|
||||
function Main {
|
||||
# Step 1: Setup environment (parameters, admin check, logging, directories)
|
||||
Setup-Environment
|
||||
|
||||
# Step 2: Obtain and mount installation media (ISO)
|
||||
$mediaDrive = Get-InstallationMedia
|
||||
|
||||
# Step 3: Process the install.wim image (copy files, convert ESD if needed, apply tweaks)
|
||||
Process-InstallImage -DriveLetter $mediaDrive
|
||||
|
||||
# Step 4: Process the boot.wim image
|
||||
Process-BootImage
|
||||
|
||||
# Step 5: Finalize ISO creation using oscdimg.exe
|
||||
Finalize-ISO
|
||||
|
||||
# Step 6: Cleanup temporary folders and stop logging
|
||||
Cleanup-Environment
|
||||
|
||||
Write-Host "Tiny11 image creation completed. Press Enter to exit."
|
||||
Read-Host
|
||||
exit
|
||||
}
|
||||
|
||||
# Start the main flow
|
||||
Main
|
||||
|
||||
#endregion Main Flow
|
||||
111
README.md
111
README.md
|
|
@ -1,39 +1,41 @@
|
|||
# ElevenBuilder
|
||||
# tiny11builder
|
||||
|
||||
To build a trimmed-down Windows 11 image.
|
||||
Scripts to build a trimmed-down Windows 11 image - now in **PowerShell**!
|
||||
<br>
|
||||
Tiny11 builder, now completely overhauled.
|
||||
</br>
|
||||
After more than a year (for which I am so sorry) of no updates, tiny11 builder is now a much more complete and flexible solution - one script fits all. Also, it is a steppingstone for an even more fleshed-out solution.
|
||||
<br>
|
||||
You can now use it on ANY Windows 11 release (not just a specific build), as well as ANY language or architecture.
|
||||
This is made possible thanks to the much-improved scripting capabilities of PowerShell, compared to the older Batch release.
|
||||
</br>
|
||||
Since it is written in PowerShell, you need to set the execution policy to `Unrestricted`, so that you could run the script.
|
||||
If you haven't done this before, make sure to run `Set-ExecutionPolicy unrestricted` as administrator in PowerShell before running the script, otherwise it would just crash.
|
||||
|
||||
ElevenBuilder is a flexible solution - one script fits all. Also, it is a steppingstone for an even more fleshed-out solution.
|
||||
|
||||
You need to set the execution policy to Unrestricted, so that you can run the script.
|
||||
If you haven't done this before, make sure to run:
|
||||
This is a script created to automate the build of a streamlined Windows 11 image, similar to tiny11.
|
||||
My main goal is to use only Microsoft utilities like DISM, and no utilities from external sources. The only executable included is **oscdimg.exe**, which is provided in the Windows ADK and it is used to create bootable ISO images.
|
||||
Also included is an unattended answer file, which is used to bypass the Microsoft Account on OOBE and to deploy the image with the `/compact` flag.
|
||||
It's open-source, **so feel free to add or remove anything you want!** Feedback is also much appreciated.
|
||||
|
||||
```powershell
|
||||
Set-ExecutionPolicy unrestricted
|
||||
```
|
||||
Also, for the very first time, **introducing tiny11 core builder**! A more powerful script, designed for a quick and dirty development testbed. Just the bare minimun, none of the fluff.
|
||||
This script generates a significantly reduced Windows 11 image. However, it's not suitable for regular use due to its lack of serviceability - you can't add languages, updates, or features post-creation. tiny11 Core is not a full Windows 11 substitute but a rapid testing or development tool, potentially useful for VM environments.
|
||||
|
||||
as administrator in PowerShell before running the script, otherwise it will not run.
|
||||
Instructions:
|
||||
|
||||
This is a script has been created to automate the build of a streamlined Windows 11 Image, similar to tiny11.
|
||||
The main goal is to use only Microsoft utilities like DISM, and no utilities from external sources.
|
||||
The only executable included is oscdimg.exe, which is provided in the Windows ADK and is used to create bootable ISO images.
|
||||
Also included is an unattended answer file, which is used to bypass the Microsoft Account on OOBE and to deploy the image with the /compact flag.
|
||||
1. Download Windows 11 from the Microsoft website (<https://www.microsoft.com/software-download/windows11>)
|
||||
2. Mount the downloaded ISO image using Windows Explorer.
|
||||
3. Select the drive letter where the image is mounted (only the letter, no colon (:))
|
||||
4. Select the SKU that you want the image to be based.
|
||||
5. Sit back and relax :)
|
||||
6. When the image is completed, you will see it in the folder where the script was extracted, with the name tiny11.iso
|
||||
|
||||
Instructions: (Needs to be rewritten - Consider as unstable/broken for the moment...)
|
||||
|
||||
- Download Windows 11 from the Microsoft website: Microsoft Windows 11 Download
|
||||
- Mount the downloaded ISO image using Windows Explorer.
|
||||
- Select the drive letter where the image is mounted (only the letter, no colon :)
|
||||
- Select the SKU that you want the image to be based on.
|
||||
- Sit back and relax :)
|
||||
|
||||
When the image is completed, you will see it in the folder where the script was extracted, with the name tiny11.iso
|
||||
|
||||
What has been removed:
|
||||
What is removed:
|
||||
|
||||
- Clipchamp
|
||||
- News
|
||||
- Weather
|
||||
- Xbox (although Xbox Identity provider is still here, so it should be possible to reinstall it with no issues)
|
||||
- Xbox (although Xbox Identity provider is still here, so it should be possible to be reinstalled with no issues)
|
||||
- GetHelp
|
||||
- GetStarted
|
||||
- Office Hub
|
||||
|
|
@ -51,34 +53,39 @@ What has been removed:
|
|||
- QuickAssist
|
||||
- Internet Explorer
|
||||
- Tablet PC Math
|
||||
- Microsoft Edge
|
||||
- Microsoft OneDrive
|
||||
- Edge
|
||||
- OneDrive
|
||||
|
||||
You will be asked during image creation if you want to enable .NET 3.5 support!
|
||||
For tiny11 core:
|
||||
- all of the above +
|
||||
- Windows Component Store (WinSxS)
|
||||
- Windows Defender (only disabled, can be enabled back if needed)
|
||||
- Windows Update (Windows Update wouldn't work anyway without WinSxS, so enabling it would only put the system in a state where it would try to update but fail spectacularily)
|
||||
- WinRE
|
||||
<br>
|
||||
Keep in mind that **you cannot add back features in tiny11 core**!
|
||||
</br>
|
||||
<br>
|
||||
You will be asked during image creation if you want to enable .net 3.5 support!
|
||||
</br>
|
||||
Known issues:
|
||||
|
||||
### Known Issues:
|
||||
1. Although Edge is removed, there are some remnants in the Settings. But the app in itself is deleted. You can install any browser using WinGet (after you update the app using Microsoft Store). If you want Edge, Copilot and Web Search back, simply install Edge using Winget: `winget install edge`.
|
||||
<br>
|
||||
Note: You might have to update Winget before being able to install any apps, using Microsoft Store.
|
||||
<br>
|
||||
</br>
|
||||
2. Outlook and Dev Home might reappear after some time.
|
||||
<br>
|
||||
</br>
|
||||
3. If you are using this script on arm64, you might see a glimpse of an error while running the script. This is caused by the fact that the arm64 image doesn't have OneDriveSetup.exe included in the System32 folder.
|
||||
|
||||
Edge remnants: Although Edge is removed, some remnants exist in the Settings. However, the app itself is deleted. You can install any browser using WinGet (after updating the app using the Microsoft Store). If you want Edge, Copilot, and Web Search back, simply install Edge using:
|
||||
Features to be implemented:
|
||||
~~- disabling telemetry~~ Implemented in the 04-29-24 release!
|
||||
- more ad suppression
|
||||
- improved language and arch detection
|
||||
- more flexibility in what to keep and what to delete
|
||||
- maybe a GUI???
|
||||
|
||||
```powershell
|
||||
winget install edge
|
||||
```
|
||||
|
||||
**Note:** You might need to update Winget before being able to install any apps via Microsoft Store.
|
||||
|
||||
Outlook and Dev Home might reappear after some time due to Windows Updates.
|
||||
|
||||
ARM64 error message: If using this script on ARM64, you might see an error while running the script. This happens because the ARM64 image doesn't have OneDriveSetup.exe included in the System32 folder.
|
||||
|
||||
### Features to be implemented:
|
||||
|
||||
- More ad suppression
|
||||
- Improved language and architecture detection
|
||||
- More flexibility in what to keep and what to delete
|
||||
- Maybe a GUI???
|
||||
|
||||
### Disclaimer
|
||||
|
||||
Microsoft and there Products are registered trademarks.
|
||||
|
||||
It's open-source, so feel free to add or remove anything you want! Feedback is also much appreciated! :-)
|
||||
And that's pretty much it for now!
|
||||
Thanks for trying it and let me know how you like it!
|
||||
|
|
|
|||
BIN
oscdimg.exe
Normal file
BIN
oscdimg.exe
Normal file
Binary file not shown.
782
tiny11Coremaker.ps1
Normal file
782
tiny11Coremaker.ps1
Normal file
|
|
@ -0,0 +1,782 @@
|
|||
# Enable debugging
|
||||
Set-PSDebug -Trace 1
|
||||
|
||||
# Check if PowerShell execution is restricted
|
||||
if ((Get-ExecutionPolicy) -eq 'Restricted') {
|
||||
Write-Host "Your current PowerShell Execution Policy is set to Restricted, which prevents scripts from running. Do you want to change it to RemoteSigned? (yes/no)"
|
||||
$response = Read-Host
|
||||
if ($response -eq 'yes') {
|
||||
Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -Confirm:$false
|
||||
} else {
|
||||
Write-Host "The script cannot be run without changing the execution policy. Exiting..."
|
||||
exit
|
||||
}
|
||||
}
|
||||
|
||||
# Check and run the script as admin if required
|
||||
$adminSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
|
||||
$adminGroup = $adminSID.Translate([System.Security.Principal.NTAccount])
|
||||
$myWindowsID=[System.Security.Principal.WindowsIdentity]::GetCurrent()
|
||||
$myWindowsPrincipal=new-object System.Security.Principal.WindowsPrincipal($myWindowsID)
|
||||
$adminRole=[System.Security.Principal.WindowsBuiltInRole]::Administrator
|
||||
if (! $myWindowsPrincipal.IsInRole($adminRole))
|
||||
{
|
||||
Write-Host "Restarting Tiny11 image creator as admin in a new window, you can close this one."
|
||||
$newProcess = new-object System.Diagnostics.ProcessStartInfo "PowerShell";
|
||||
$newProcess.Arguments = $myInvocation.MyCommand.Definition;
|
||||
$newProcess.Verb = "runas";
|
||||
[System.Diagnostics.Process]::Start($newProcess);
|
||||
exit
|
||||
}
|
||||
Start-Transcript -Path "$PSScriptRoot\tiny11.log"
|
||||
# Ask the user for input
|
||||
Write-Host "Welcome to tiny11 core builder!"
|
||||
Write-Host "This script generates a significantly reduced Windows 11 image. However, it's not suitable for regular use due to its lack of serviceability - you can't add languages, updates, or features post-creation. tiny11 Core is not a full Windows 11 substitute but a rapid testing or development tool, potentially useful for VM environments."
|
||||
Write-Host "Do you want to continue? (y/n)"
|
||||
$input = Read-Host
|
||||
|
||||
if ($input -eq 'y') {
|
||||
Write-Host "Off we go..."
|
||||
Start-Sleep -Seconds 3
|
||||
Clear-Host
|
||||
|
||||
$mainOSDrive = $env:SystemDrive
|
||||
$hostArchitecture = $Env:PROCESSOR_ARCHITECTURE
|
||||
New-Item -ItemType Directory -Force -Path "$mainOSDrive\tiny11\sources" >null
|
||||
$DriveLetter = Read-Host "Please enter the drive letter for the Windows 11 image"
|
||||
$DriveLetter = $DriveLetter + ":"
|
||||
|
||||
if ((Test-Path "$DriveLetter\sources\boot.wim") -eq $false -or (Test-Path "$DriveLetter\sources\install.wim") -eq $false) {
|
||||
if ((Test-Path "$DriveLetter\sources\install.esd") -eq $true) {
|
||||
Write-Host "Found install.esd, converting to install.wim..."
|
||||
& 'dism' '/English' "/Get-WimInfo" "/wimfile:$DriveLetter\sources\install.esd"
|
||||
$index = Read-Host "Please enter the image index"
|
||||
Write-Host ' '
|
||||
Write-Host 'Converting install.esd to install.wim. This may take a while...'
|
||||
& 'DISM' /Export-Image /SourceImageFile:"$DriveLetter\sources\install.esd" /SourceIndex:$index /DestinationImageFile:"$mainOSDrive\tiny11\sources\install.wim" /Compress:max /CheckIntegrity
|
||||
} else {
|
||||
Write-Host "Can't find Windows OS Installation files in the specified Drive Letter.."
|
||||
Write-Host "Please enter the correct DVD Drive Letter.."
|
||||
exit
|
||||
}
|
||||
}
|
||||
|
||||
Write-Host "Copying Windows image..."
|
||||
Copy-Item -Path "$DriveLetter\*" -Destination "$mainOSDrive\tiny11" -Recurse -Force > null
|
||||
Set-ItemProperty -Path "$mainOSDrive\tiny11\sources\install.esd" -Name IsReadOnly -Value $false > $null 2>&1
|
||||
Remove-Item "$mainOSDrive\tiny11\sources\install.esd" > $null 2>&1
|
||||
Write-Host "Copy complete!"
|
||||
Start-Sleep -Seconds 2
|
||||
Clear-Host
|
||||
Write-Host "Getting image information:"
|
||||
& 'dism' '/English' "/Get-WimInfo" "/wimfile:$mainOSDrive\tiny11\sources\install.wim"
|
||||
$index = Read-Host "Please enter the image index"
|
||||
Write-Host "Mounting Windows image. This may take a while."
|
||||
$wimFilePath = "$($env:SystemDrive)\tiny11\sources\install.wim"
|
||||
& takeown "/F" $wimFilePath
|
||||
& icacls $wimFilePath "/grant" "$($adminGroup.Value):(F)"
|
||||
try {
|
||||
Set-ItemProperty -Path $wimFilePath -Name IsReadOnly -Value $false -ErrorAction Stop
|
||||
} catch {
|
||||
# This block will catch the error and suppress it.
|
||||
}
|
||||
New-Item -ItemType Directory -Force -Path "$mainOSDrive\scratchdir" > $null
|
||||
& dism /English "/mount-image" "/imagefile:$($env:SystemDrive)\tiny11\sources\install.wim" "/index:$index" "/mountdir:$($env:SystemDrive)\scratchdir"
|
||||
|
||||
$imageIntl = & dism /English /Get-Intl "/Image:$($env:SystemDrive)\scratchdir"
|
||||
$languageLine = $imageIntl -split '\n' | Where-Object { $_ -match 'Default system UI language : ([a-zA-Z]{2}-[a-zA-Z]{2})' }
|
||||
|
||||
if ($languageLine) {
|
||||
$languageCode = $Matches[1]
|
||||
Write-Host "Default system UI language code: $languageCode"
|
||||
} else {
|
||||
Write-Host "Default system UI language code not found."
|
||||
}
|
||||
|
||||
$imageInfo = & 'dism' '/English' '/Get-WimInfo' "/wimFile:$($env:SystemDrive)\tiny11\sources\install.wim" "/index:$index"
|
||||
$lines = $imageInfo -split '\r?\n'
|
||||
|
||||
foreach ($line in $lines) {
|
||||
if ($line -like '*Architecture : *') {
|
||||
$architecture = $line -replace 'Architecture : ',''
|
||||
# If the architecture is x64, replace it with amd64
|
||||
if ($architecture -eq 'x64') {
|
||||
$architecture = 'amd64'
|
||||
}
|
||||
Write-Host "Architecture: $architecture"
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
if (-not $architecture) {
|
||||
Write-Host "Architecture information not found."
|
||||
}
|
||||
|
||||
Write-Host "Mounting complete! Performing removal of applications..."
|
||||
|
||||
$packages = & 'dism' '/English' "/image:$($env:SystemDrive)\scratchdir" '/Get-ProvisionedAppxPackages' |
|
||||
ForEach-Object {
|
||||
if ($_ -match 'PackageName : (.*)') {
|
||||
$matches[1]
|
||||
}
|
||||
}
|
||||
$packagePrefixes = 'Clipchamp.Clipchamp_', 'Microsoft.SecHealthUI_', 'Microsoft.Windows.PeopleExperienceHost_', 'Microsoft.Windows.PinningConfirmationDialog_', 'Windows.CBSPreview_', 'Microsoft.BingNews_', 'Microsoft.BingWeather_', 'Microsoft.GamingApp_', 'Microsoft.GetHelp_', 'Microsoft.Getstarted_', 'Microsoft.MicrosoftOfficeHub_', 'Microsoft.MicrosoftSolitaireCollection_', 'Microsoft.People_', 'Microsoft.PowerAutomateDesktop_', 'Microsoft.Todos_', 'Microsoft.WindowsAlarms_', 'microsoft.windowscommunicationsapps_', 'Microsoft.WindowsFeedbackHub_', 'Microsoft.WindowsMaps_', 'Microsoft.WindowsSoundRecorder_', 'Microsoft.Xbox.TCUI_', 'Microsoft.XboxGamingOverlay_', 'Microsoft.XboxGameOverlay_', 'Microsoft.XboxSpeechToTextOverlay_', 'Microsoft.YourPhone_', 'Microsoft.ZuneMusic_', 'Microsoft.ZuneVideo_', 'MicrosoftCorporationII.MicrosoftFamily_', 'MicrosoftCorporationII.QuickAssist_', 'MicrosoftTeams_', 'Microsoft.549981C3F5F10_'
|
||||
|
||||
$packagesToRemove = $packages | Where-Object {
|
||||
$packageName = $_
|
||||
$packagePrefixes -contains ($packagePrefixes | Where-Object { $packageName -like "$_*" })
|
||||
}
|
||||
foreach ($package in $packagesToRemove) {
|
||||
write-host "Removing $package :"
|
||||
& 'dism' '/English' "/image:$($env:SystemDrive)\scratchdir" '/Remove-ProvisionedAppxPackage' "/PackageName:$package"
|
||||
}
|
||||
|
||||
Write-Host "Removing of system apps complete! Now proceeding to removal of system packages..."
|
||||
Start-Sleep -Seconds 1
|
||||
Clear-Host
|
||||
|
||||
$scratchDir = "$($env:SystemDrive)\scratchdir"
|
||||
$packagePatterns = @(
|
||||
"Microsoft-Windows-InternetExplorer-Optional-Package~31bf3856ad364e35",
|
||||
"Microsoft-Windows-Kernel-LA57-FoD-Package~31bf3856ad364e35~amd64",
|
||||
"Microsoft-Windows-LanguageFeatures-Handwriting-$languageCode-Package~31bf3856ad364e35",
|
||||
"Microsoft-Windows-LanguageFeatures-OCR-$languageCode-Package~31bf3856ad364e35",
|
||||
"Microsoft-Windows-LanguageFeatures-Speech-$languageCode-Package~31bf3856ad364e35",
|
||||
"Microsoft-Windows-LanguageFeatures-TextToSpeech-$languageCode-Package~31bf3856ad364e35",
|
||||
"Microsoft-Windows-MediaPlayer-Package~31bf3856ad364e35",
|
||||
"Microsoft-Windows-Wallpaper-Content-Extended-FoD-Package~31bf3856ad364e35",
|
||||
"Windows-Defender-Client-Package~31bf3856ad364e35~",
|
||||
"Microsoft-Windows-WordPad-FoD-Package~",
|
||||
"Microsoft-Windows-TabletPCMath-Package~",
|
||||
"Microsoft-Windows-StepsRecorder-Package~"
|
||||
|
||||
)
|
||||
|
||||
# Get all packages
|
||||
$allPackages = & dism /image:$scratchDir /Get-Packages /Format:Table
|
||||
$allPackages = $allPackages -split "`n" | Select-Object -Skip 1
|
||||
|
||||
foreach ($packagePattern in $packagePatterns) {
|
||||
# Filter the packages to remove
|
||||
$packagesToRemove = $allPackages | Where-Object { $_ -like "$packagePattern*" }
|
||||
|
||||
foreach ($package in $packagesToRemove) {
|
||||
# Extract the package identity
|
||||
$packageIdentity = ($package -split "\s+")[0]
|
||||
|
||||
Write-Host "Removing $packageIdentity..."
|
||||
& dism /image:$scratchDir /Remove-Package /PackageName:$packageIdentity
|
||||
}
|
||||
}
|
||||
|
||||
Write-Host "Do you want to enable .NET 3.5? (y/n)"
|
||||
$input = Read-Host
|
||||
|
||||
# Check the user's input
|
||||
if ($input -eq 'y') {
|
||||
# If the user entered 'y', enable .NET 3.5 using DISM
|
||||
Write-Host "Enabling .NET 3.5..."
|
||||
& 'dism' "/image:$scratchDir" '/enable-feature' '/featurename:NetFX3' '/All' "/source:$($env:SystemDrive)\tiny11\sources\sxs"
|
||||
Write-Host ".NET 3.5 has been enabled."
|
||||
}
|
||||
elseif ($input -eq 'n') {
|
||||
# If the user entered 'n', exit the script
|
||||
Write-Host "You chose not to enable .NET 3.5. Continuing..."
|
||||
}
|
||||
else {
|
||||
# If the user entered anything other than 'y' or 'n', ask for input again
|
||||
Write-Host "Invalid input. Please enter 'y' to enable .NET 3.5 or 'n' to continue without installing .net 3.5."
|
||||
}
|
||||
Write-Host "Removing Edge:"
|
||||
Remove-Item -Path "$mainOSDrive\scratchdir\Program Files (x86)\Microsoft\Edge" -Recurse -Force >null
|
||||
Remove-Item -Path "$mainOSDrive\scratchdir\Program Files (x86)\Microsoft\EdgeUpdate" -Recurse -Force >null
|
||||
Remove-Item -Path "$mainOSDrive\scratchdir\Program Files (x86)\Microsoft\EdgeCore" -Recurse -Force >null
|
||||
if ($architecture -eq 'amd64') {
|
||||
$folderPath = Get-ChildItem -Path "$mainOSDrive\scratchdir\Windows\WinSxS" -Filter "amd64_microsoft-edge-webview_31bf3856ad364e35*" -Directory | Select-Object -ExpandProperty FullName
|
||||
|
||||
if ($folderPath) {
|
||||
& 'takeown' '/f' $folderPath '/r' >null
|
||||
& icacls $folderPath "/grant" "$($adminGroup.Value):(F)" '/T' '/C' >null
|
||||
Remove-Item -Path $folderPath -Recurse -Force >null
|
||||
} else {
|
||||
Write-Host "Folder not found."
|
||||
}
|
||||
} elseif ($architecture -eq 'arm64') {
|
||||
$folderPath = Get-ChildItem -Path "$mainOSDrive\scratchdir\Windows\WinSxS" -Filter "arm64_microsoft-edge-webview_31bf3856ad364e35*" -Directory | Select-Object -ExpandProperty FullName >null
|
||||
|
||||
if ($folderPath) {
|
||||
& 'takeown' '/f' $folderPath '/r'>null
|
||||
& icacls $folderPath "/grant" "$($adminGroup.Value):(F)" '/T' '/C' >null
|
||||
Remove-Item -Path $folderPath -Recurse -Force >null
|
||||
} else {
|
||||
Write-Host "Folder not found."
|
||||
}
|
||||
} else {
|
||||
Write-Host "Unknown architecture: $architecture"
|
||||
}
|
||||
& 'takeown' '/f' "$mainOSDrive\scratchdir\Windows\System32\Microsoft-Edge-Webview" '/r'
|
||||
& 'icacls' "$mainOSDrive\scratchdir\Windows\System32\Microsoft-Edge-Webview" '/grant' "$($adminGroup.Value):(F)" '/T' '/C'
|
||||
Remove-Item -Path "$mainOSDrive\scratchdir\Windows\System32\Microsoft-Edge-Webview" -Recurse -Force
|
||||
Write-Host "Removing WinRE"
|
||||
& 'takeown' '/f' "$mainOSDrive\scratchdir\Windows\System32\Recovery" '/r'
|
||||
& 'icacls' "$mainOSDrive\scratchdir\Windows\System32\Recovery" '/grant' 'Administrators:F' '/T' '/C'
|
||||
Remove-Item -Path "$mainOSDrive\scratchdir\Windows\System32\Recovery\winre.wim" -Recurse -Force
|
||||
New-Item -Path "$mainOSDrive\scratchdir\Windows\System32\Recovery\winre.wim" -ItemType File -Force
|
||||
Write-Host "Removing OneDrive:"
|
||||
& 'takeown' '/f' "$mainOSDrive\scratchdir\Windows\System32\OneDriveSetup.exe" >null
|
||||
& 'icacls' "$mainOSDrive\scratchdir\Windows\System32\OneDriveSetup.exe" '/grant' "$($adminGroup.Value):(F)" '/T' '/C' >null
|
||||
Remove-Item -Path "$mainOSDrive\scratchdir\Windows\System32\OneDriveSetup.exe" -Force >null
|
||||
Write-Host "Removal complete!"
|
||||
Start-Sleep -Seconds 2
|
||||
Clear-Host
|
||||
Write-Host "Taking ownership of the WinSxS folder. This might take a while..."
|
||||
& 'takeown' '/f' "$mainOSDrive\scratchdir\Windows\WinSxS" '/r'
|
||||
& 'icacls' "$mainOSDrive\scratchdir\Windows\WinSxS" '/grant' "$($adminGroup.Value):(F)" '/T' '/C'
|
||||
Write-host "Complete!"
|
||||
Start-Sleep -Seconds 2
|
||||
Clear-Host
|
||||
Write-Host "Preparing..."
|
||||
$folderPath = Join-Path -Path $mainOSDrive -ChildPath "\scratchdir\Windows\WinSxS_edit"
|
||||
$sourceDirectory = "$mainOSDrive\scratchdir\Windows\WinSxS"
|
||||
$destinationDirectory = "$mainOSDrive\scratchdir\Windows\WinSxS_edit"
|
||||
New-Item -Path $folderPath -ItemType Directory
|
||||
if ($architecture -eq "amd64") {
|
||||
# Specify the list of files to copy
|
||||
$dirsToCopy = @(
|
||||
"x86_microsoft.windows.common-controls_6595b64144ccf1df_*",
|
||||
"x86_microsoft.windows.gdiplus_6595b64144ccf1df_*",
|
||||
"x86_microsoft.windows.i..utomation.proxystub_6595b64144ccf1df_*",
|
||||
"x86_microsoft.windows.isolationautomation_6595b64144ccf1df_*",
|
||||
"x86_microsoft-windows-s..ngstack-onecorebase_31bf3856ad364e35_*",
|
||||
"x86_microsoft-windows-s..stack-termsrv-extra_31bf3856ad364e35_*",
|
||||
"x86_microsoft-windows-servicingstack_31bf3856ad364e35_*",
|
||||
"x86_microsoft-windows-servicingstack-inetsrv_*",
|
||||
"x86_microsoft-windows-servicingstack-onecore_*",
|
||||
"amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_*",
|
||||
"amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_*",
|
||||
"amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_*",
|
||||
"amd64_microsoft.windows.common-controls_6595b64144ccf1df_*",
|
||||
"amd64_microsoft.windows.gdiplus_6595b64144ccf1df_*",
|
||||
"amd64_microsoft.windows.i..utomation.proxystub_6595b64144ccf1df_*",
|
||||
"amd64_microsoft.windows.isolationautomation_6595b64144ccf1df_*",
|
||||
"amd64_microsoft-windows-s..stack-inetsrv-extra_31bf3856ad364e35_*",
|
||||
"amd64_microsoft-windows-s..stack-msg.resources_31bf3856ad364e35_*",
|
||||
"amd64_microsoft-windows-s..stack-termsrv-extra_31bf3856ad364e35_*",
|
||||
"amd64_microsoft-windows-servicingstack_31bf3856ad364e35_*",
|
||||
"amd64_microsoft-windows-servicingstack-inetsrv_31bf3856ad364e35_*",
|
||||
"amd64_microsoft-windows-servicingstack-msg_31bf3856ad364e35_*",
|
||||
"amd64_microsoft-windows-servicingstack-onecore_31bf3856ad364e35_*",
|
||||
"Catalogs",
|
||||
"FileMaps",
|
||||
"Fusion",
|
||||
"InstallTemp",
|
||||
"Manifests",
|
||||
"x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_*",
|
||||
"x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_*",
|
||||
"x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_*",
|
||||
"x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_*"
|
||||
)
|
||||
# Copy each directory
|
||||
foreach ($dir in $dirsToCopy) {
|
||||
$sourceDirs = Get-ChildItem -Path $sourceDirectory -Filter $dir -Directory
|
||||
foreach ($sourceDir in $sourceDirs) {
|
||||
$destDir = Join-Path -Path $destinationDirectory -ChildPath $sourceDir.Name
|
||||
Write-Host "Copying $sourceDir.FullName to $destDir"
|
||||
Copy-Item -Path $sourceDir.FullName -Destination $destDir -Recurse -Force
|
||||
}
|
||||
}
|
||||
}
|
||||
elseif ($architecture -eq "arm64") {
|
||||
# Specify the list of files to copy
|
||||
$dirsToCopy = @(
|
||||
"arm64_microsoft-windows-servicingstack-onecore_31bf3856ad364e35_*",
|
||||
"Catalogs"
|
||||
"FileMaps"
|
||||
"Fusion"
|
||||
"InstallTemp"
|
||||
"Manifests"
|
||||
"SettingsManifests"
|
||||
"Temp"
|
||||
"x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_*"
|
||||
"x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_*"
|
||||
"x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_*"
|
||||
"x86_microsoft.windows.common-controls_6595b64144ccf1df_*"
|
||||
"x86_microsoft.windows.gdiplus_6595b64144ccf1df_*"
|
||||
"x86_microsoft.windows.i..utomation.proxystub_6595b64144ccf1df_*"
|
||||
"x86_microsoft.windows.isolationautomation_6595b64144ccf1df_*"
|
||||
"arm_microsoft.windows.c..-controls.resources_6595b64144ccf1df_*"
|
||||
"arm_microsoft.windows.common-controls_6595b64144ccf1df_*"
|
||||
"arm_microsoft.windows.gdiplus_6595b64144ccf1df_*"
|
||||
"arm_microsoft.windows.i..utomation.proxystub_6595b64144ccf1df_*"
|
||||
"arm_microsoft.windows.isolationautomation_6595b64144ccf1df_*"
|
||||
"arm64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_*"
|
||||
"arm64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_*"
|
||||
"arm64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_*"
|
||||
"arm64_microsoft.windows.common-controls_6595b64144ccf1df_*"
|
||||
"arm64_microsoft.windows.gdiplus_6595b64144ccf1df_*"
|
||||
"arm64_microsoft.windows.i..utomation.proxystub_6595b64144ccf1df_*"
|
||||
"arm64_microsoft.windows.isolationautomation_6595b64144ccf1df_*"
|
||||
"arm64_microsoft-windows-servicing-adm_31bf3856ad364e35_*"
|
||||
"arm64_microsoft-windows-servicingcommon_31bf3856ad364e35_*"
|
||||
"arm64_microsoft-windows-servicing-onecore-uapi_31bf3856ad364e35_*"
|
||||
"arm64_microsoft-windows-servicingstack_31bf3856ad364e35_*"
|
||||
"arm64_microsoft-windows-servicingstack-inetsrv_31bf3856ad364e35_*"
|
||||
"arm64_microsoft-windows-servicingstack-msg_31bf3856ad364e35_*"
|
||||
)
|
||||
}
|
||||
foreach ($dir in $dirsToCopy) {
|
||||
$sourceDirs = Get-ChildItem -Path $sourceDirectory -Filter $dir -Directory
|
||||
foreach ($sourceDir in $sourceDirs) {
|
||||
$destDir = Join-Path -Path $destinationDirectory -ChildPath $sourceDir.Name
|
||||
Write-Host "Copying $sourceDir.FullName to $destDir"
|
||||
Copy-Item -Path $sourceDir.FullName -Destination $destDir -Recurse -Force
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Write-Host "Deleting WinSxS. This may take a while..."
|
||||
Remove-Item -Path $mainOSDrive\scratchdir\Windows\WinSxS -Recurse -Force
|
||||
|
||||
Rename-Item -Path $mainOSDrive\scratchdir\Windows\WinSxS_edit -NewName $mainOSDrive\scratchdir\Windows\WinSxS
|
||||
Write-Host "Complete!"
|
||||
|
||||
Write-Host "Loading registry..."
|
||||
reg load HKLM\zCOMPONENTS $mainOSDrive\scratchdir\Windows\System32\config\COMPONENTS >null
|
||||
reg load HKLM\zDEFAULT $mainOSDrive\scratchdir\Windows\System32\config\default >null
|
||||
reg load HKLM\zNTUSER $mainOSDrive\scratchdir\Users\Default\ntuser.dat >null
|
||||
reg load HKLM\zSOFTWARE $mainOSDrive\scratchdir\Windows\System32\config\SOFTWARE >null
|
||||
reg load HKLM\zSYSTEM $mainOSDrive\scratchdir\Windows\System32\config\SYSTEM >null
|
||||
Write-Host "Bypassing system requirements(on the system image):"
|
||||
& 'reg' 'add' 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV1' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV2' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV1' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV2' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassCPUCheck' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassRAMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassSecureBootCheck' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassStorageCheck' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassTPMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\MoSetup' '/v' 'AllowUpgradesWithUnsupportedTPMOrCPU' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
Write-Host "Disabling Sponsored Apps:"
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'OemPreInstalledAppsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'PreInstalledAppsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SilentInstalledAppsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableWindowsConsumerFeatures' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'ContentDeliveryAllowed' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\PolicyManager\current\device\Start' '/v' 'ConfigureStartPins' '/t' 'REG_SZ' '/d' '{"pinnedList": [{}]}' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'ContentDeliveryAllowed' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'ContentDeliveryAllowed' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'FeatureManagementEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'OemPreInstalledAppsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'PreInstalledAppsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'PreInstalledAppsEverEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SilentInstalledAppsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SoftLandingEnabled' '/t' 'REG_DWORD' '/d' '0' '/f'>null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContentEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContent-310093Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContent-338388Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContent-338389Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContent-338393Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContent-353694Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContent-353696Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContentEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SystemPaneSuggestionsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\PushToInstall' '/v' 'DisablePushToInstall' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\MRT' '/v' 'DontOfferThroughWUAU' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'delete' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions' '/f' >null
|
||||
& 'reg' 'delete' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\SuggestedApps' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableConsumerAccountStateContent' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableCloudOptimizedContent' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
Write-Host "Enabling Local Accounts on OOBE:"
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\OOBE' '/v' 'BypassNRO' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
Write-Host "Disabling Reserved Storage:"
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\ReserveManager' '/v' 'ShippedWithReserves' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
Write-Host "Disabling BitLocker Device Encryption"
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\ControlSet001\Control\BitLocker' '/v' 'PreventDeviceEncryption' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
Write-Host "Disabling Chat icon:"
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\Windows Chat' '/v' 'ChatIcon' '/t' 'REG_DWORD' '/d' '3' '/f'
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'TaskbarMn' '/t' 'REG_DWORD' '/d' '0' '/f'
|
||||
Write-Host "Disabling Telemetry:"
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo' '/v' 'Enabled' '/t' 'REG_DWORD' '/d' '0' '/f'
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Privacy' '/v' 'TailoredExperiencesWithDiagnosticDataEnabled' '/t' 'REG_DWORD' '/d' '0' '/f'
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy' '/v' 'HasAccepted' '/t' 'REG_DWORD' '/d' '0' '/f'
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Input\TIPC' '/v' 'Enabled' '/t' 'REG_DWORD' '/d' '0' '/f'
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\InputPersonalization' '/v' 'RestrictImplicitInkCollection' '/t' 'REG_DWORD' '/d' '1' '/f'
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\InputPersonalization' '/v' 'RestrictImplicitTextCollection' '/t' 'REG_DWORD' '/d' '1' '/f'
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\InputPersonalization\TrainedDataStore' '/v' 'HarvestContacts' '/t' 'REG_DWORD' '/d' '0' '/f'
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Personalization\Settings' '/v' 'AcceptedPrivacyPolicy' '/t' 'REG_DWORD' '/d' '0' '/f'
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\DataCollection' '/v' 'AllowTelemetry' '/t' 'REG_DWORD' '/d' '0' '/f'
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\ControlSet001\Services\dmwappushservice' '/v' 'Start' '/t' 'REG_DWORD' '/d' '4' '/f'
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\Windows Chat' '/v' 'ChatIcon' '/t' 'REG_DWORD' '/d' '3' '/f'
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'TaskbarMn' '/t' 'REG_DWORD' '/d' '0' '/f'
|
||||
Write-Host "Disabling OneDrive folder backup"
|
||||
& 'reg' 'add' "HKLM\zSOFTWARE\Policies\Microsoft\Windows\OneDrive" '/v' 'DisableFileSyncNGSC' '/t' 'REG_DWORD' '/d' '1' '/f'
|
||||
Write-Host "Removing Edge related registries"
|
||||
reg delete "HKEY_LOCAL_MACHINE\zSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" /f
|
||||
reg delete "HKEY_LOCAL_MACHINE\zSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" /f
|
||||
Write-Host "Disabling bing in Start Menu:"
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Policies\Microsoft\Windows\Explorer'
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Policies\Microsoft\Windows\Explorer' '/v' 'ShowRunAsDifferentUserInStart' '/t' 'REG_DWORD' '/d' '1' '/f'
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Policies\Microsoft\Windows\Explorer' '/v' 'DisableSearchBoxSuggestions' '/t' 'REG_DWORD' '/d' '1' '/f'
|
||||
## Prevents installation or DevHome and Outlook
|
||||
Write-Host "Prevents installation or DevHome and Outlook:"
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator\UScheduler\OutlookUpdate' '/v' 'workCompleted' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator\UScheduler\DevHomeUpdate' '/v' 'workCompleted' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
|
||||
& 'reg' 'delete' 'HKLM\zSOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\OutlookUpdate' '/f' | Out-Null
|
||||
& 'reg' 'delete' 'HKLM\zSOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\DevHomeUpdate' '/f' | Out-Null
|
||||
## this function allows PowerShell to take ownership of the Scheduled Tasks registry key from TrustedInstaller. Based on Jose Espitia's script.
|
||||
function Enable-Privilege {
|
||||
param(
|
||||
[ValidateSet(
|
||||
"SeAssignPrimaryTokenPrivilege", "SeAuditPrivilege", "SeBackupPrivilege",
|
||||
"SeChangeNotifyPrivilege", "SeCreateGlobalPrivilege", "SeCreatePagefilePrivilege",
|
||||
"SeCreatePermanentPrivilege", "SeCreateSymbolicLinkPrivilege", "SeCreateTokenPrivilege",
|
||||
"SeDebugPrivilege", "SeEnableDelegationPrivilege", "SeImpersonatePrivilege", "SeIncreaseBasePriorityPrivilege",
|
||||
"SeIncreaseQuotaPrivilege", "SeIncreaseWorkingSetPrivilege", "SeLoadDriverPrivilege",
|
||||
"SeLockMemoryPrivilege", "SeMachineAccountPrivilege", "SeManageVolumePrivilege",
|
||||
"SeProfileSingleProcessPrivilege", "SeRelabelPrivilege", "SeRemoteShutdownPrivilege",
|
||||
"SeRestorePrivilege", "SeSecurityPrivilege", "SeShutdownPrivilege", "SeSyncAgentPrivilege",
|
||||
"SeSystemEnvironmentPrivilege", "SeSystemProfilePrivilege", "SeSystemtimePrivilege",
|
||||
"SeTakeOwnershipPrivilege", "SeTcbPrivilege", "SeTimeZonePrivilege", "SeTrustedCredManAccessPrivilege",
|
||||
"SeUndockPrivilege", "SeUnsolicitedInputPrivilege")]
|
||||
$Privilege,
|
||||
## The process on which to adjust the privilege. Defaults to the current process.
|
||||
$ProcessId = $pid,
|
||||
## Switch to disable the privilege, rather than enable it.
|
||||
[Switch] $Disable
|
||||
)
|
||||
$definition = @'
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
public class AdjPriv
|
||||
{
|
||||
[DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
|
||||
internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall,
|
||||
ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen);
|
||||
|
||||
[DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
|
||||
internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok);
|
||||
[DllImport("advapi32.dll", SetLastError = true)]
|
||||
internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid);
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
internal struct TokPriv1Luid
|
||||
{
|
||||
public int Count;
|
||||
public long Luid;
|
||||
public int Attr;
|
||||
}
|
||||
|
||||
internal const int SE_PRIVILEGE_ENABLED = 0x00000002;
|
||||
internal const int SE_PRIVILEGE_DISABLED = 0x00000000;
|
||||
internal const int TOKEN_QUERY = 0x00000008;
|
||||
internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
|
||||
public static bool EnablePrivilege(long processHandle, string privilege, bool disable)
|
||||
{
|
||||
bool retVal;
|
||||
TokPriv1Luid tp;
|
||||
IntPtr hproc = new IntPtr(processHandle);
|
||||
IntPtr htok = IntPtr.Zero;
|
||||
retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok);
|
||||
tp.Count = 1;
|
||||
tp.Luid = 0;
|
||||
if(disable)
|
||||
{
|
||||
tp.Attr = SE_PRIVILEGE_DISABLED;
|
||||
}
|
||||
else
|
||||
{
|
||||
tp.Attr = SE_PRIVILEGE_ENABLED;
|
||||
}
|
||||
retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid);
|
||||
retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
|
||||
return retVal;
|
||||
}
|
||||
}
|
||||
'@
|
||||
|
||||
$processHandle = (Get-Process -id $ProcessId).Handle
|
||||
$type = Add-Type $definition -PassThru
|
||||
$type[0]::EnablePrivilege($processHandle, $Privilege, $Disable)
|
||||
}
|
||||
|
||||
Enable-Privilege SeTakeOwnershipPrivilege
|
||||
|
||||
$regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks",[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,[System.Security.AccessControl.RegistryRights]::TakeOwnership)
|
||||
$regACL = $regKey.GetAccessControl()
|
||||
$regACL.SetOwner($adminGroup)
|
||||
$regKey.SetAccessControl($regACL)
|
||||
$regKey.Close()
|
||||
Write-Host "Owner changed to Administrators."
|
||||
$regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks",[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,[System.Security.AccessControl.RegistryRights]::ChangePermissions)
|
||||
$regACL = $regKey.GetAccessControl()
|
||||
$regRule = New-Object System.Security.AccessControl.RegistryAccessRule ($adminGroup,"FullControl","ContainerInherit","None","Allow")
|
||||
$regACL.SetAccessRule($regRule)
|
||||
$regKey.SetAccessControl($regACL)
|
||||
Write-Host "Permissions modified for Administrators group."
|
||||
Write-Host "Registry key permissions successfully updated."
|
||||
$regKey.Close()
|
||||
|
||||
Write-Host 'Deleting Application Compatibility Appraiser'
|
||||
reg delete "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0600DD45-FAF2-4131-A006-0B17509B9F78}" /f
|
||||
Write-Host 'Deleting Customer Experience Improvement Program'
|
||||
reg delete "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4738DE7A-BCC1-4E2D-B1B0-CADB044BFA81}" /f
|
||||
reg delete "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6FAC31FA-4A85-4E64-BFD5-2154FF4594B3}" /f
|
||||
reg delete "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FC931F16-B50A-472E-B061-B6F79A71EF59}" /f
|
||||
Write-Host 'Deleting Program Data Updater'
|
||||
reg delete "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0671EB05-7D95-4153-A32B-1426B9FE61DB}" /f
|
||||
Write-Host 'Deleting autochk proxy'
|
||||
reg delete "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{87BF85F4-2CE1-4160-96EA-52F554AA28A2}" /f
|
||||
reg delete "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8A9C643C-3D74-4099-B6BD-9C6D170898B1}" /f
|
||||
Write-Host 'Deleting QueueReporting'
|
||||
reg delete "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E3176A65-4E44-4ED3-AA73-3283660ACB9C}" /f
|
||||
Write-Host "Disabling Windows Update..."
|
||||
& 'reg' 'add' "HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" '/v' 'StopWUPostOOBE1' '/t' 'REG_SZ' '/d' 'net stop wuauserv' '/f'
|
||||
& 'reg' 'add' "HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" '/v' 'StopWUPostOOBE2' '/t' 'REG_SZ' '/d' 'sc stop wuauserv' '/f'
|
||||
& 'reg' 'add' "HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" '/v' 'StopWUPostOOBE3' '/t' 'REG_SZ' '/d' 'sc config wuauserv start= disabled' '/f'
|
||||
& 'reg' 'add' "HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" '/v' 'DisbaleWUPostOOBE1' '/t' 'REG_SZ' '/d' 'reg add HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v Start /t REG_DWORD /d 4 /f' '/f'
|
||||
& 'reg' 'add' "HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" '/v' 'DisbaleWUPostOOBE2' '/t' 'REG_SZ' '/d' 'reg add HKLM\SYSTEM\ControlSet001\Services\wuauserv /v Start /t REG_DWORD /d 4 /f' '/f'
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' '/v' 'DoNotConnectToWindowsUpdateInternetLocations' '/t' 'REG_DWORD' '/d' '1' '/f'
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' '/v' 'DisableWindowsUpdateAccess' '/t' 'REG_DWORD' '/d' '1' '/f'
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' '/v' 'WUServer' '/t' 'REG_SZ' '/d' 'localhost' '/f'
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' '/v' 'WUStatusServer' '/t' 'REG_SZ' '/d' 'localhost' '/f'
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' '/v' 'UpdateServiceUrlAlternate' '/t' 'REG_SZ' '/d' 'localhost' '/f'
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' '/v' 'UseWUServer' '/t' 'REG_DWORD' '/d' '1' '/f'
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\OOBE' '/v' 'DisableOnline' '/t' 'REG_DWORD' '/d' '1' '/f'
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\ControlSet001\Services\wuauserv' '/v' 'Start' '/t' 'REG_DWORD' '/d' '4' '/f'
|
||||
function Disable-Privilege {
|
||||
param(
|
||||
[ValidateSet(
|
||||
"SeAssignPrimaryTokenPrivilege", "SeAuditPrivilege", "SeBackupPrivilege",
|
||||
"SeChangeNotifyPrivilege", "SeCreateGlobalPrivilege", "SeCreatePagefilePrivilege",
|
||||
"SeCreatePermanentPrivilege", "SeCreateSymbolicLinkPrivilege", "SeCreateTokenPrivilege",
|
||||
"SeDebugPrivilege", "SeEnableDelegationPrivilege", "SeImpersonatePrivilege", "SeIncreaseBasePriorityPrivilege",
|
||||
"SeIncreaseQuotaPrivilege", "SeIncreaseWorkingSetPrivilege", "SeLoadDriverPrivilege",
|
||||
"SeLockMemoryPrivilege", "SeMachineAccountPrivilege", "SeManageVolumePrivilege",
|
||||
"SeProfileSingleProcessPrivilege", "SeRelabelPrivilege", "SeRemoteShutdownPrivilege",
|
||||
"SeRestorePrivilege", "SeSecurityPrivilege", "SeShutdownPrivilege", "SeSyncAgentPrivilege",
|
||||
"SeSystemEnvironmentPrivilege", "SeSystemProfilePrivilege", "SeSystemtimePrivilege",
|
||||
"SeTakeOwnershipPrivilege", "SeTcbPrivilege", "SeTimeZonePrivilege", "SeTrustedCredManAccessPrivilege",
|
||||
"SeUndockPrivilege", "SeUnsolicitedInputPrivilege")]
|
||||
$Privilege,
|
||||
## The process on which to adjust the privilege. Defaults to the current process.
|
||||
$ProcessId = $pid,
|
||||
## Switch to disable the privilege, rather than enable it.
|
||||
[Switch] $Disable
|
||||
)
|
||||
$definition = @'
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
public class AdjPriv
|
||||
{
|
||||
[DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
|
||||
internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall,
|
||||
ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen);
|
||||
|
||||
[DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
|
||||
internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok);
|
||||
[DllImport("advapi32.dll", SetLastError = true)]
|
||||
internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid);
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
internal struct TokPriv1Luid
|
||||
{
|
||||
public int Count;
|
||||
public long Luid;
|
||||
public int Attr;
|
||||
}
|
||||
|
||||
internal const int SE_PRIVILEGE_ENABLED = 0x00000002;
|
||||
internal const int SE_PRIVILEGE_DISABLED = 0x00000000;
|
||||
internal const int TOKEN_QUERY = 0x00000008;
|
||||
internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
|
||||
public static bool EnablePrivilege(long processHandle, string privilege, bool disable)
|
||||
{
|
||||
bool retVal;
|
||||
TokPriv1Luid tp;
|
||||
IntPtr hproc = new IntPtr(processHandle);
|
||||
IntPtr htok = IntPtr.Zero;
|
||||
retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok);
|
||||
tp.Count = 1;
|
||||
tp.Luid = 0;
|
||||
if(disable)
|
||||
{
|
||||
tp.Attr = SE_PRIVILEGE_DISABLED;
|
||||
}
|
||||
else
|
||||
{
|
||||
tp.Attr = SE_PRIVILEGE_ENABLED;
|
||||
}
|
||||
retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid);
|
||||
retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
|
||||
return retVal;
|
||||
}
|
||||
}
|
||||
'@
|
||||
|
||||
$processHandle = (Get-Process -id $ProcessId).Handle
|
||||
$type = Add-Type $definition -PassThru
|
||||
$type[0]::EnablePrivilege($processHandle, $Privilege, $Disable)
|
||||
}
|
||||
|
||||
Disable-Privilege SeTakeOwnershipPrivilege
|
||||
$everyone = New-Object System.Security.Principal.NTAccount('Everyone')
|
||||
$accessRule = New-Object System.Security.AccessControl.RegistryAccessRule($everyone, 'ReadKey', 'Allow')
|
||||
$regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("zSYSTEM\ControlSet001\Services\wuauserv",[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,[System.Security.AccessControl.RegistryRights]::TakeOwnership)
|
||||
$regACL = $regKey.GetAccessControl()
|
||||
$regACL.SetOwner($everyone)
|
||||
$regKey.Close()
|
||||
Write-Host "Owner changed to Everyone."
|
||||
$regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("zSYSTEM\ControlSet001\Services\wuauserv",[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,[System.Security.AccessControl.RegistryRights]::ChangePermissions)
|
||||
$regACL = $regKey.GetAccessControl()
|
||||
$regRule = New-Object System.Security.AccessControl.RegistryAccessRule ($everyone, 'ReadKey', 'Allow')
|
||||
$regACL.SetAccessRule($regRule)
|
||||
$regKey.SetAccessControl($regACL)
|
||||
Write-Host "Permissions modified for Everyone group."
|
||||
Write-Host "Registry key permissions successfully updated."
|
||||
|
||||
|
||||
Write-Host "All users have been granted read-only access to the registry key."
|
||||
$regKey.Close()
|
||||
& 'reg' 'delete' "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2540477E-E654-4302-AD44-383BBFFBFF16}" '/f'
|
||||
& 'reg' 'delete' "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{341B2255-6A6B-442A-AF5A-C610B7DBE12D}" '/f'
|
||||
& 'reg' 'delete' "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{476E8CFA-78E2-4C51-854E-538F8643B4FD}" '/f'
|
||||
& 'reg' 'delete' "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{764DDB74-CB08-4E0A-8580-B41F94F2C7BE}" '/f'
|
||||
& 'reg' 'delete' "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{817CCFDD-4DD0-4102-AC6E-3F5D3B789FB8}" '/f'
|
||||
& 'reg' 'delete' "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{99CEDA8C-A866-4787-BBD3-6F3C9F61DD5C}" '/f'
|
||||
& 'reg' 'delete' "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9B3CDCDA-4197-490B-AA5C-C9F5F42A9D88}" '/f'
|
||||
& 'reg' 'delete' "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9CBBFAAE-DB9F-48B4-BAC0-4CFF482A4E01}" '/f'
|
||||
& 'reg' 'delete' "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A31197EC-EAEE-4837-8A9C-3A17D358B9EB}" '/f'
|
||||
& 'reg' 'delete' "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B4FBEFA9-6F7C-4C74-A891-3774B7BCD072}" '/f'
|
||||
& 'reg' 'delete' "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B53BD60A-5823-411C-9C75-AA91DB3C35F8}" '/f'
|
||||
& 'reg' 'delete' "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CECDC345-7460-4A15-9D8B-DAC3F9CC5368}" '/f'
|
||||
& 'reg' 'delete' "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E0F10DCF-44AD-40E8-9370-FB5DA59F93FB}" '/f'
|
||||
& 'reg' 'delete' 'HKLM\zSYSTEM\ControlSet001\Services\WaaSMedicSVC' '/f'
|
||||
& 'reg' 'delete' 'HKLM\zSYSTEM\ControlSet001\Services\UsoSvc' '/f'
|
||||
& 'reg' 'add' 'HKEY_LOCAL_MACHINE\zSOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' '/v' 'NoAutoUpdate' '/t' 'REG_DWORD' '/d' '1' '/f'
|
||||
Write-Host "Disabling Windows Defender"
|
||||
# Set registry values for Windows Defender services
|
||||
$servicePaths = @(
|
||||
"WinDefend",
|
||||
"WdNisSvc",
|
||||
"WdNisDrv",
|
||||
"WdFilter",
|
||||
"Sense"
|
||||
)
|
||||
|
||||
foreach ($path in $servicePaths) {
|
||||
Set-ItemProperty -Path "HKLM:\zSYSTEM\ControlSet001\Services\$path" -Name "Start" -Value 4
|
||||
}
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'SettingsPageVisibility' '/t' 'REG_SZ' '/d' 'hide:virus;windowsupdate' '/f'
|
||||
Write-Host "Tweaking complete!"
|
||||
Write-Host "Unmounting Registry..."
|
||||
$regKey.Close()
|
||||
reg unload HKLM\zCOMPONENTS >null
|
||||
reg unload HKLM\zDEFAULT >null
|
||||
reg unload HKLM\zNTUSER >null
|
||||
reg unload HKLM\zSOFTWARE
|
||||
reg unload HKLM\zSYSTEM >null
|
||||
Write-Host "Cleaning up image..."
|
||||
& 'dism' '/English' "/image:$mainOSDrive\scratchdir" '/Cleanup-Image' '/StartComponentCleanup' '/ResetBase' >null
|
||||
Write-Host "Cleanup complete."
|
||||
Write-Host ' '
|
||||
Write-Host "Unmounting image..."
|
||||
& 'dism' '/English' '/unmount-image' "/mountdir:$mainOSDrive\scratchdir" '/commit'
|
||||
Write-Host "Exporting image..."
|
||||
& 'dism' '/English' '/Export-Image' "/SourceImageFile:$mainOSDrive\tiny11\sources\install.wim" "/SourceIndex:$index" "/DestinationImageFile:$mainOSDrive\tiny11\sources\install2.wim" '/compress:max'
|
||||
Remove-Item -Path "$mainOSDrive\tiny11\sources\install.wim" -Force >null
|
||||
Rename-Item -Path "$mainOSDrive\tiny11\sources\install2.wim" -NewName "install.wim" >null
|
||||
Write-Host "Windows image completed. Continuing with boot.wim."
|
||||
Start-Sleep -Seconds 2
|
||||
Clear-Host
|
||||
Write-Host "Mounting boot image:"
|
||||
$wimFilePath = "$($env:SystemDrive)\tiny11\sources\boot.wim"
|
||||
& takeown "/F" $wimFilePath >null
|
||||
& icacls $wimFilePath "/grant" "$($adminGroup.Value):(F)"
|
||||
Set-ItemProperty -Path $wimFilePath -Name IsReadOnly -Value $false
|
||||
& 'dism' '/English' '/mount-image' "/imagefile:$mainOSDrive\tiny11\sources\boot.wim" '/index:2' "/mountdir:$mainOSDrive\scratchdir"
|
||||
Write-Host "Loading registry..."
|
||||
reg load HKLM\zCOMPONENTS $mainOSDrive\scratchdir\Windows\System32\config\COMPONENTS
|
||||
reg load HKLM\zDEFAULT $mainOSDrive\scratchdir\Windows\System32\config\default
|
||||
reg load HKLM\zNTUSER $mainOSDrive\scratchdir\Users\Default\ntuser.dat
|
||||
reg load HKLM\zSOFTWARE $mainOSDrive\scratchdir\Windows\System32\config\SOFTWARE
|
||||
reg load HKLM\zSYSTEM $mainOSDrive\scratchdir\Windows\System32\config\SYSTEM
|
||||
Write-Host "Bypassing system requirements(on the setup image):"
|
||||
& 'reg' 'add' 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV1' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV2' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV1' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV2' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassCPUCheck' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassRAMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassSecureBootCheck' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassStorageCheck' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassTPMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\MoSetup' '/v' 'AllowUpgradesWithUnsupportedTPMOrCPU' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKEY_LOCAL_MACHINE\zSYSTEM\Setup' '/v' 'CmdLine' '/t' 'REG_SZ' '/d' 'X:\sources\setup.exe' '/f' >null
|
||||
Write-Host "Tweaking complete!"
|
||||
Write-Host "Unmounting Registry..."
|
||||
$regKey.Close()
|
||||
reg unload HKLM\zCOMPONENTS >null
|
||||
reg unload HKLM\zDEFAULT >null
|
||||
reg unload HKLM\zNTUSER >null
|
||||
$regKey.Close()
|
||||
reg unload HKLM\zSOFTWARE
|
||||
reg unload HKLM\zSYSTEM >null
|
||||
Write-Host "Unmounting image..."
|
||||
& 'dism' '/English' '/unmount-image' "/mountdir:$mainOSDrive\scratchdir" '/commit'
|
||||
Clear-Host
|
||||
Write-Host "Exporting ESD. This may take a while..."
|
||||
& dism /Export-Image /SourceImageFile:"$mainOSDrive\tiny11\sources\install.wim" /SourceIndex:1 /DestinationImageFile:"$mainOSDrive\tiny11\sources\install.esd" /Compress:recovery
|
||||
Remove-Item "$mainOSDrive\tiny11\sources\install.wim" > $null 2>&1
|
||||
Write-Host "The tiny11 image is now completed. Proceeding with the making of the ISO..."
|
||||
Write-Host "Creating ISO image..."
|
||||
$ADKDepTools = "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\$hostarchitecture\Oscdimg"
|
||||
$localOSCDIMGPath = "$PSScriptRoot\oscdimg.exe"
|
||||
|
||||
if ([System.IO.Directory]::Exists($ADKDepTools)) {
|
||||
Write-Host "Will be using oscdimg.exe from system ADK."
|
||||
$OSCDIMG = "$ADKDepTools\oscdimg.exe"
|
||||
} else {
|
||||
Write-Host "ADK folder not found. Will be using bundled oscdimg.exe."
|
||||
|
||||
|
||||
$url = "https://msdl.microsoft.com/download/symbols/oscdimg.exe/3D44737265000/oscdimg.exe"
|
||||
|
||||
if (-not (Test-Path -Path $localOSCDIMGPath)) {
|
||||
Write-Host "Downloading oscdimg.exe..."
|
||||
Invoke-WebRequest -Uri $url -OutFile $localOSCDIMGPath
|
||||
|
||||
if (Test-Path $localOSCDIMGPath) {
|
||||
Write-Host "oscdimg.exe downloaded successfully."
|
||||
} else {
|
||||
Write-Error "Failed to download oscdimg.exe."
|
||||
exit 1
|
||||
}
|
||||
} else {
|
||||
Write-Host "oscdimg.exe already exists locally."
|
||||
}
|
||||
|
||||
$OSCDIMG = $localOSCDIMGPath
|
||||
}
|
||||
|
||||
& "$OSCDIMG" '-m' '-o' '-u2' '-udfver102' "-bootdata:2#p0,e,b$ScratchDisk\tiny11\boot\etfsboot.com#pEF,e,b$ScratchDisk\tiny11\efi\microsoft\boot\efisys.bin" "$ScratchDisk\tiny11" "$PSScriptRoot\tiny11.iso"
|
||||
|
||||
# Finishing up
|
||||
Write-Host "Creation completed! Press any key to exit the script..."
|
||||
Read-Host "Press Enter to continue"
|
||||
Write-Host "Performing Cleanup..."
|
||||
Remove-Item -Path "$mainOSDrive\tiny11" -Recurse -Force >null
|
||||
Remove-Item -Path "$mainOSDrive\scratchdir" -Recurse -Force >null
|
||||
|
||||
# Stop the transcript
|
||||
Stop-Transcript
|
||||
|
||||
exit
|
||||
}
|
||||
elseif ($input -eq 'n') {
|
||||
Write-Host "You chose not to continue. The script will now exit."
|
||||
exit
|
||||
}
|
||||
else {
|
||||
Write-Host "Invalid input. Please enter 'y' to continue or 'n' to exit."
|
||||
}
|
||||
452
tiny11maker.ps1
Normal file
452
tiny11maker.ps1
Normal file
|
|
@ -0,0 +1,452 @@
|
|||
# Enable debugging
|
||||
#Set-PSDebug -Trace 1
|
||||
|
||||
# Check if PowerShell execution is restricted
|
||||
if ((Get-ExecutionPolicy) -eq 'Restricted') {
|
||||
Write-Host "Your current PowerShell Execution Policy is set to Restricted, which prevents scripts from running. Do you want to change it to RemoteSigned? (yes/no)"
|
||||
$response = Read-Host
|
||||
if ($response -eq 'yes') {
|
||||
Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -Confirm:$false
|
||||
} else {
|
||||
Write-Host "The script cannot be run without changing the execution policy. Exiting..."
|
||||
exit
|
||||
}
|
||||
}
|
||||
|
||||
# Check and run the script as admin if required
|
||||
$adminSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
|
||||
$adminGroup = $adminSID.Translate([System.Security.Principal.NTAccount])
|
||||
$myWindowsID=[System.Security.Principal.WindowsIdentity]::GetCurrent()
|
||||
$myWindowsPrincipal=new-object System.Security.Principal.WindowsPrincipal($myWindowsID)
|
||||
$adminRole=[System.Security.Principal.WindowsBuiltInRole]::Administrator
|
||||
if (! $myWindowsPrincipal.IsInRole($adminRole))
|
||||
{
|
||||
Write-Host "Restarting Tiny11 image creator as admin in a new window, you can close this one."
|
||||
$newProcess = new-object System.Diagnostics.ProcessStartInfo "PowerShell";
|
||||
$newProcess.Arguments = $myInvocation.MyCommand.Definition;
|
||||
$newProcess.Verb = "runas";
|
||||
[System.Diagnostics.Process]::Start($newProcess);
|
||||
exit
|
||||
}
|
||||
|
||||
param ($ScratchDisk)
|
||||
if ($Null -eq $ScratchDisk) {
|
||||
$ScratchDisk = $env:SystemDrive
|
||||
}
|
||||
|
||||
# Start the transcript and prepare the window
|
||||
Start-Transcript -Path "$PSScriptRoot\tiny11.log"
|
||||
|
||||
$Host.UI.RawUI.WindowTitle = "Tiny11 image creator"
|
||||
Clear-Host
|
||||
Write-Host "Welcome to the tiny11 image creator! Release: 05-06-24"
|
||||
|
||||
$hostArchitecture = $Env:PROCESSOR_ARCHITECTURE
|
||||
New-Item -ItemType Directory -Force -Path "$ScratchDisk\tiny11\sources" >null
|
||||
$DriveLetter = Read-Host "Please enter the drive letter for the Windows 11 image"
|
||||
$DriveLetter = $DriveLetter + ":"
|
||||
|
||||
if ((Test-Path "$DriveLetter\sources\boot.wim") -eq $false -or (Test-Path "$DriveLetter\sources\install.wim") -eq $false) {
|
||||
if ((Test-Path "$DriveLetter\sources\install.esd") -eq $true) {
|
||||
Write-Host "Found install.esd, converting to install.wim..."
|
||||
& 'dism' '/English' "/Get-WimInfo" "/wimfile:$DriveLetter\sources\install.esd"
|
||||
$index = Read-Host "Please enter the image index"
|
||||
Write-Host ' '
|
||||
Write-Host 'Converting install.esd to install.wim. This may take a while...'
|
||||
& 'DISM' /Export-Image /SourceImageFile:"$DriveLetter\sources\install.esd" /SourceIndex:$index /DestinationImageFile:"$ScratchDisk\tiny11\sources\install.wim" /Compress:max /CheckIntegrity
|
||||
} else {
|
||||
Write-Host "Can't find Windows OS Installation files in the specified Drive Letter.."
|
||||
Write-Host "Please enter the correct DVD Drive Letter.."
|
||||
exit
|
||||
}
|
||||
}
|
||||
|
||||
Write-Host "Copying Windows image..."
|
||||
Copy-Item -Path "$DriveLetter\*" -Destination "$ScratchDisk\tiny11" -Recurse -Force > null
|
||||
Set-ItemProperty -Path "$ScratchDisk\tiny11\sources\install.esd" -Name IsReadOnly -Value $false > $null 2>&1
|
||||
Remove-Item "$ScratchDisk\tiny11\sources\install.esd" > $null 2>&1
|
||||
Write-Host "Copy complete!"
|
||||
Start-Sleep -Seconds 2
|
||||
Clear-Host
|
||||
Write-Host "Getting image information:"
|
||||
& 'dism' '/English' "/Get-WimInfo" "/wimfile:$ScratchDisk\tiny11\sources\install.wim"
|
||||
$index = Read-Host "Please enter the image index"
|
||||
Write-Host "Mounting Windows image. This may take a while."
|
||||
$wimFilePath = "$($env:SystemDrive)\tiny11\sources\install.wim"
|
||||
& takeown "/F" $wimFilePath
|
||||
& icacls $wimFilePath "/grant" "$($adminGroup.Value):(F)"
|
||||
try {
|
||||
Set-ItemProperty -Path $wimFilePath -Name IsReadOnly -Value $false -ErrorAction Stop
|
||||
} catch {
|
||||
# This block will catch the error and suppress it.
|
||||
}
|
||||
New-Item -ItemType Directory -Force -Path "$ScratchDisk\scratchdir" > $null
|
||||
& dism /English "/mount-image" "/imagefile:$($env:SystemDrive)\tiny11\sources\install.wim" "/index:$index" "/mountdir:$($env:SystemDrive)\scratchdir"
|
||||
|
||||
$imageIntl = & dism /English /Get-Intl "/Image:$($env:SystemDrive)\scratchdir"
|
||||
$languageLine = $imageIntl -split '\n' | Where-Object { $_ -match 'Default system UI language : ([a-zA-Z]{2}-[a-zA-Z]{2})' }
|
||||
|
||||
if ($languageLine) {
|
||||
$languageCode = $Matches[1]
|
||||
Write-Host "Default system UI language code: $languageCode"
|
||||
} else {
|
||||
Write-Host "Default system UI language code not found."
|
||||
}
|
||||
|
||||
$imageInfo = & 'dism' '/English' '/Get-WimInfo' "/wimFile:$($env:SystemDrive)\tiny11\sources\install.wim" "/index:$index"
|
||||
$lines = $imageInfo -split '\r?\n'
|
||||
|
||||
foreach ($line in $lines) {
|
||||
if ($line -like '*Architecture : *') {
|
||||
$architecture = $line -replace 'Architecture : ',''
|
||||
# If the architecture is x64, replace it with amd64
|
||||
if ($architecture -eq 'x64') {
|
||||
$architecture = 'amd64'
|
||||
}
|
||||
Write-Host "Architecture: $architecture"
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
if (-not $architecture) {
|
||||
Write-Host "Architecture information not found."
|
||||
}
|
||||
|
||||
Write-Host "Mounting complete! Performing removal of applications..."
|
||||
|
||||
$packages = & 'dism' '/English' "/image:$($env:SystemDrive)\scratchdir" '/Get-ProvisionedAppxPackages' |
|
||||
ForEach-Object {
|
||||
if ($_ -match 'PackageName : (.*)') {
|
||||
$matches[1]
|
||||
}
|
||||
}
|
||||
$packagePrefixes = 'Clipchamp.Clipchamp_', 'Microsoft.BingNews_', 'Microsoft.BingWeather_', 'Microsoft.GamingApp_', 'Microsoft.GetHelp_', 'Microsoft.Getstarted_', 'Microsoft.MicrosoftOfficeHub_', 'Microsoft.MicrosoftSolitaireCollection_', 'Microsoft.People_', 'Microsoft.PowerAutomateDesktop_', 'Microsoft.Todos_', 'Microsoft.WindowsAlarms_', 'microsoft.windowscommunicationsapps_', 'Microsoft.WindowsFeedbackHub_', 'Microsoft.WindowsMaps_', 'Microsoft.WindowsSoundRecorder_', 'Microsoft.Xbox.TCUI_', 'Microsoft.XboxGamingOverlay_', 'Microsoft.XboxGameOverlay_', 'Microsoft.XboxSpeechToTextOverlay_', 'Microsoft.YourPhone_', 'Microsoft.ZuneMusic_', 'Microsoft.ZuneVideo_', 'MicrosoftCorporationII.MicrosoftFamily_', 'MicrosoftCorporationII.QuickAssist_', 'MicrosoftTeams_', 'Microsoft.549981C3F5F10_'
|
||||
|
||||
$packagesToRemove = $packages | Where-Object {
|
||||
$packageName = $_
|
||||
$packagePrefixes -contains ($packagePrefixes | Where-Object { $packageName -like "$_*" })
|
||||
}
|
||||
foreach ($package in $packagesToRemove) {
|
||||
& 'dism' '/English' "/image:$($env:SystemDrive)\scratchdir" '/Remove-ProvisionedAppxPackage' "/PackageName:$package"
|
||||
}
|
||||
|
||||
|
||||
Write-Host "Removing Edge:"
|
||||
Remove-Item -Path "$ScratchDisk\scratchdir\Program Files (x86)\Microsoft\Edge" -Recurse -Force >null
|
||||
Remove-Item -Path "$ScratchDisk\scratchdir\Program Files (x86)\Microsoft\EdgeUpdate" -Recurse -Force >null
|
||||
Remove-Item -Path "$ScratchDisk\scratchdir\Program Files (x86)\Microsoft\EdgeCore" -Recurse -Force >null
|
||||
if ($architecture -eq 'amd64') {
|
||||
$folderPath = Get-ChildItem -Path "$ScratchDisk\scratchdir\Windows\WinSxS" -Filter "amd64_microsoft-edge-webview_31bf3856ad364e35*" -Directory | Select-Object -ExpandProperty FullName
|
||||
|
||||
if ($folderPath) {
|
||||
& 'takeown' '/f' $folderPath '/r' >null
|
||||
& icacls $folderPath "/grant" "$($adminGroup.Value):(F)" '/T' '/C' >null
|
||||
Remove-Item -Path $folderPath -Recurse -Force >null
|
||||
} else {
|
||||
Write-Host "Folder not found."
|
||||
}
|
||||
} elseif ($architecture -eq 'arm64') {
|
||||
$folderPath = Get-ChildItem -Path "$ScratchDisk\scratchdir\Windows\WinSxS" -Filter "arm64_microsoft-edge-webview_31bf3856ad364e35*" -Directory | Select-Object -ExpandProperty FullName >null
|
||||
|
||||
if ($folderPath) {
|
||||
& 'takeown' '/f' $folderPath '/r'>null
|
||||
& icacls $folderPath "/grant" "$($adminGroup.Value):(F)" '/T' '/C' >null
|
||||
Remove-Item -Path $folderPath -Recurse -Force >null
|
||||
} else {
|
||||
Write-Host "Folder not found."
|
||||
}
|
||||
} else {
|
||||
Write-Host "Unknown architecture: $architecture"
|
||||
}
|
||||
& 'takeown' '/f' "$ScratchDisk\scratchdir\Windows\System32\Microsoft-Edge-Webview" '/r' >null
|
||||
& 'icacls' "$ScratchDisk\scratchdir\Windows\System32\Microsoft-Edge-Webview" '/grant' "$($adminGroup.Value):(F)" '/T' '/C' >null
|
||||
Remove-Item -Path "$ScratchDisk\scratchdir\Windows\System32\Microsoft-Edge-Webview" -Recurse -Force >null
|
||||
Write-Host "Removing OneDrive:"
|
||||
& 'takeown' '/f' "$ScratchDisk\scratchdir\Windows\System32\OneDriveSetup.exe" >null
|
||||
& 'icacls' "$ScratchDisk\scratchdir\Windows\System32\OneDriveSetup.exe" '/grant' "$($adminGroup.Value):(F)" '/T' '/C' >null
|
||||
Remove-Item -Path "$ScratchDisk\scratchdir\Windows\System32\OneDriveSetup.exe" -Force >null
|
||||
Write-Host "Removal complete!"
|
||||
Start-Sleep -Seconds 2
|
||||
Clear-Host
|
||||
Write-Host "Loading registry..."
|
||||
reg load HKLM\zCOMPONENTS $ScratchDisk\scratchdir\Windows\System32\config\COMPONENTS >null
|
||||
reg load HKLM\zDEFAULT $ScratchDisk\scratchdir\Windows\System32\config\default >null
|
||||
reg load HKLM\zNTUSER $ScratchDisk\scratchdir\Users\Default\ntuser.dat >null
|
||||
reg load HKLM\zSOFTWARE $ScratchDisk\scratchdir\Windows\System32\config\SOFTWARE >null
|
||||
reg load HKLM\zSYSTEM $ScratchDisk\scratchdir\Windows\System32\config\SYSTEM >null
|
||||
Write-Host "Bypassing system requirements(on the system image):"
|
||||
& 'reg' 'add' 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV1' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV2' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV1' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV2' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassCPUCheck' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassRAMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassSecureBootCheck' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassStorageCheck' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassTPMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\MoSetup' '/v' 'AllowUpgradesWithUnsupportedTPMOrCPU' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
Write-Host "Disabling Sponsored Apps:"
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'OemPreInstalledAppsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'PreInstalledAppsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SilentInstalledAppsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableWindowsConsumerFeatures' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'ContentDeliveryAllowed' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\PolicyManager\current\device\Start' '/v' 'ConfigureStartPins' '/t' 'REG_SZ' '/d' '{"pinnedList": [{}]}' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'ContentDeliveryAllowed' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'ContentDeliveryAllowed' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'FeatureManagementEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'OemPreInstalledAppsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'PreInstalledAppsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'PreInstalledAppsEverEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SilentInstalledAppsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SoftLandingEnabled' '/t' 'REG_DWORD' '/d' '0' '/f'>null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContentEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContent-310093Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContent-338388Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContent-338389Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContent-338393Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContent-353694Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContent-353696Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContentEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SystemPaneSuggestionsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\PushToInstall' '/v' 'DisablePushToInstall' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\MRT' '/v' 'DontOfferThroughWUAU' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'delete' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions' '/f' >null
|
||||
& 'reg' 'delete' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\SuggestedApps' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableConsumerAccountStateContent' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableCloudOptimizedContent' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
Write-Host "Enabling Local Accounts on OOBE:"
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\OOBE' '/v' 'BypassNRO' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
Copy-Item -Path "$PSScriptRoot\autounattend.xml" -Destination "$ScratchDisk\scratchdir\Windows\System32\Sysprep\autounattend.xml" -Force >null
|
||||
Write-Host "Disabling Reserved Storage:"
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\ReserveManager' '/v' 'ShippedWithReserves' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
Write-Host "Disabling Chat icon:"
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\Windows Chat' '/v' 'ChatIcon' '/t' 'REG_DWORD' '/d' '3' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'TaskbarMn' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
Write-Host "Removing Edge related registries"
|
||||
reg delete "HKEY_LOCAL_MACHINE\zSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" /f >null
|
||||
reg delete "HKEY_LOCAL_MACHINE\zSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" /f >null
|
||||
Write-Host "Disabling OneDrive folder backup"
|
||||
& 'reg' 'add' "HKLM\zSOFTWARE\Policies\Microsoft\Windows\OneDrive" '/v' 'DisableFileSyncNGSC' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
Write-Host "Disabling Telemetry:"
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo' '/v' 'Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Privacy' '/v' 'TailoredExperiencesWithDiagnosticDataEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy' '/v' 'HasAccepted' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Input\TIPC' '/v' 'Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\InputPersonalization' '/v' 'RestrictImplicitInkCollection' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\InputPersonalization' '/v' 'RestrictImplicitTextCollection' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\InputPersonalization\TrainedDataStore' '/v' 'HarvestContacts' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Personalization\Settings' '/v' 'AcceptedPrivacyPolicy' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\DataCollection' '/v' 'AllowTelemetry' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\ControlSet001\Services\dmwappushservice' '/v' 'Start' '/t' 'REG_DWORD' '/d' '4' '/f' >null
|
||||
## this function allows PowerShell to take ownership of the Scheduled Tasks registry key from TrustedInstaller. Based on Jose Espitia's script.
|
||||
function Enable-Privilege {
|
||||
param(
|
||||
[ValidateSet(
|
||||
"SeAssignPrimaryTokenPrivilege", "SeAuditPrivilege", "SeBackupPrivilege",
|
||||
"SeChangeNotifyPrivilege", "SeCreateGlobalPrivilege", "SeCreatePagefilePrivilege",
|
||||
"SeCreatePermanentPrivilege", "SeCreateSymbolicLinkPrivilege", "SeCreateTokenPrivilege",
|
||||
"SeDebugPrivilege", "SeEnableDelegationPrivilege", "SeImpersonatePrivilege", "SeIncreaseBasePriorityPrivilege",
|
||||
"SeIncreaseQuotaPrivilege", "SeIncreaseWorkingSetPrivilege", "SeLoadDriverPrivilege",
|
||||
"SeLockMemoryPrivilege", "SeMachineAccountPrivilege", "SeManageVolumePrivilege",
|
||||
"SeProfileSingleProcessPrivilege", "SeRelabelPrivilege", "SeRemoteShutdownPrivilege",
|
||||
"SeRestorePrivilege", "SeSecurityPrivilege", "SeShutdownPrivilege", "SeSyncAgentPrivilege",
|
||||
"SeSystemEnvironmentPrivilege", "SeSystemProfilePrivilege", "SeSystemtimePrivilege",
|
||||
"SeTakeOwnershipPrivilege", "SeTcbPrivilege", "SeTimeZonePrivilege", "SeTrustedCredManAccessPrivilege",
|
||||
"SeUndockPrivilege", "SeUnsolicitedInputPrivilege")]
|
||||
$Privilege,
|
||||
## The process on which to adjust the privilege. Defaults to the current process.
|
||||
$ProcessId = $pid,
|
||||
## Switch to disable the privilege, rather than enable it.
|
||||
[Switch] $Disable
|
||||
)
|
||||
$definition = @'
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
public class AdjPriv
|
||||
{
|
||||
[DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
|
||||
internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall,
|
||||
ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen);
|
||||
|
||||
[DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
|
||||
internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok);
|
||||
[DllImport("advapi32.dll", SetLastError = true)]
|
||||
internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid);
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
internal struct TokPriv1Luid
|
||||
{
|
||||
public int Count;
|
||||
public long Luid;
|
||||
public int Attr;
|
||||
}
|
||||
|
||||
internal const int SE_PRIVILEGE_ENABLED = 0x00000002;
|
||||
internal const int SE_PRIVILEGE_DISABLED = 0x00000000;
|
||||
internal const int TOKEN_QUERY = 0x00000008;
|
||||
internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
|
||||
public static bool EnablePrivilege(long processHandle, string privilege, bool disable)
|
||||
{
|
||||
bool retVal;
|
||||
TokPriv1Luid tp;
|
||||
IntPtr hproc = new IntPtr(processHandle);
|
||||
IntPtr htok = IntPtr.Zero;
|
||||
retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok);
|
||||
tp.Count = 1;
|
||||
tp.Luid = 0;
|
||||
if(disable)
|
||||
{
|
||||
tp.Attr = SE_PRIVILEGE_DISABLED;
|
||||
}
|
||||
else
|
||||
{
|
||||
tp.Attr = SE_PRIVILEGE_ENABLED;
|
||||
}
|
||||
retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid);
|
||||
retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
|
||||
return retVal;
|
||||
}
|
||||
}
|
||||
'@
|
||||
|
||||
$processHandle = (Get-Process -id $ProcessId).Handle
|
||||
$type = Add-Type $definition -PassThru
|
||||
$type[0]::EnablePrivilege($processHandle, $Privilege, $Disable)
|
||||
}
|
||||
|
||||
Enable-Privilege SeTakeOwnershipPrivilege
|
||||
|
||||
$regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks",[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,[System.Security.AccessControl.RegistryRights]::TakeOwnership)
|
||||
$regACL = $regKey.GetAccessControl()
|
||||
$regACL.SetOwner($adminGroup)
|
||||
$regKey.SetAccessControl($regACL)
|
||||
$regKey.Close()
|
||||
Write-Host "Owner changed to Administrators."
|
||||
$regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks",[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,[System.Security.AccessControl.RegistryRights]::ChangePermissions)
|
||||
$regACL = $regKey.GetAccessControl()
|
||||
$regRule = New-Object System.Security.AccessControl.RegistryAccessRule ($adminGroup,"FullControl","ContainerInherit","None","Allow")
|
||||
$regACL.SetAccessRule($regRule)
|
||||
$regKey.SetAccessControl($regACL)
|
||||
Write-Host "Permissions modified for Administrators group."
|
||||
Write-Host "Registry key permissions successfully updated."
|
||||
$regKey.Close()
|
||||
|
||||
Write-Host 'Deleting Application Compatibility Appraiser'
|
||||
reg delete "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0600DD45-FAF2-4131-A006-0B17509B9F78}" /f >null
|
||||
Write-Host 'Deleting Customer Experience Improvement Program'
|
||||
reg delete "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4738DE7A-BCC1-4E2D-B1B0-CADB044BFA81}" /f >null
|
||||
reg delete "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6FAC31FA-4A85-4E64-BFD5-2154FF4594B3}" /f >null
|
||||
reg delete "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FC931F16-B50A-472E-B061-B6F79A71EF59}" /f >null
|
||||
Write-Host 'Deleting Program Data Updater'
|
||||
reg delete "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0671EB05-7D95-4153-A32B-1426B9FE61DB}" /f >null
|
||||
Write-Host 'Deleting autochk proxy'
|
||||
reg delete "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{87BF85F4-2CE1-4160-96EA-52F554AA28A2}" /f >null
|
||||
reg delete "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8A9C643C-3D74-4099-B6BD-9C6D170898B1}" /f >null
|
||||
Write-Host 'Deleting QueueReporting'
|
||||
reg delete "HKEY_LOCAL_MACHINE\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E3176A65-4E44-4ED3-AA73-3283660ACB9C}" /f >null
|
||||
Write-Host "Tweaking complete!"
|
||||
Write-Host "Unmounting Registry..."
|
||||
$regKey.Close()
|
||||
reg unload HKLM\zCOMPONENTS >null
|
||||
reg unload HKLM\zDRIVERS >null
|
||||
reg unload HKLM\zDEFAULT >null
|
||||
reg unload HKLM\zNTUSER >null
|
||||
reg unload HKLM\zSCHEMA >null
|
||||
reg unload HKLM\zSOFTWARE
|
||||
reg unload HKLM\zSYSTEM >null
|
||||
Write-Host "Cleaning up image..."
|
||||
& 'dism' '/English' "/image:$ScratchDisk\scratchdir" '/Cleanup-Image' '/StartComponentCleanup' '/ResetBase' >null
|
||||
Write-Host "Cleanup complete."
|
||||
Write-Host ' '
|
||||
Write-Host "Unmounting image..."
|
||||
& 'dism' '/English' '/unmount-image' "/mountdir:$ScratchDisk\scratchdir" '/commit'
|
||||
Write-Host "Exporting image..."
|
||||
& 'dism' '/English' '/Export-Image' "/SourceImageFile:$ScratchDisk\tiny11\sources\install.wim" "/SourceIndex:$index" "/DestinationImageFile:$ScratchDisk\tiny11\sources\install2.wim" '/compress:recovery'
|
||||
Remove-Item -Path "$ScratchDisk\tiny11\sources\install.wim" -Force >null
|
||||
Rename-Item -Path "$ScratchDisk\tiny11\sources\install2.wim" -NewName "install.wim" >null
|
||||
Write-Host "Windows image completed. Continuing with boot.wim."
|
||||
Start-Sleep -Seconds 2
|
||||
Clear-Host
|
||||
Write-Host "Mounting boot image:"
|
||||
$wimFilePath = "$($env:SystemDrive)\tiny11\sources\boot.wim"
|
||||
& takeown "/F" $wimFilePath >null
|
||||
& icacls $wimFilePath "/grant" "$($adminGroup.Value):(F)"
|
||||
Set-ItemProperty -Path $wimFilePath -Name IsReadOnly -Value $false
|
||||
& 'dism' '/English' '/mount-image' "/imagefile:$ScratchDisk\tiny11\sources\boot.wim" '/index:2' "/mountdir:$ScratchDisk\scratchdir"
|
||||
Write-Host "Loading registry..."
|
||||
reg load HKLM\zCOMPONENTS $ScratchDisk\scratchdir\Windows\System32\config\COMPONENTS
|
||||
reg load HKLM\zDEFAULT $ScratchDisk\scratchdir\Windows\System32\config\default
|
||||
reg load HKLM\zNTUSER $ScratchDisk\scratchdir\Users\Default\ntuser.dat
|
||||
reg load HKLM\zSOFTWARE $ScratchDisk\scratchdir\Windows\System32\config\SOFTWARE
|
||||
reg load HKLM\zSYSTEM $ScratchDisk\scratchdir\Windows\System32\config\SYSTEM
|
||||
Write-Host "Bypassing system requirements(on the setup image):"
|
||||
& 'reg' 'add' 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV1' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV2' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV1' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV2' '/t' 'REG_DWORD' '/d' '0' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassCPUCheck' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassRAMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassSecureBootCheck' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassStorageCheck' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassTPMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\MoSetup' '/v' 'AllowUpgradesWithUnsupportedTPMOrCPU' '/t' 'REG_DWORD' '/d' '1' '/f' >null
|
||||
Write-Host "Tweaking complete!"
|
||||
Write-Host "Unmounting Registry..."
|
||||
$regKey.Close()
|
||||
reg unload HKLM\zCOMPONENTS >null
|
||||
reg unload HKLM\zDRIVERS >null
|
||||
reg unload HKLM\zDEFAULT >null
|
||||
reg unload HKLM\zNTUSER >null
|
||||
reg unload HKLM\zSCHEMA >null
|
||||
$regKey.Close()
|
||||
reg unload HKLM\zSOFTWARE
|
||||
reg unload HKLM\zSYSTEM >null
|
||||
Write-Host "Unmounting image..."
|
||||
& 'dism' '/English' '/unmount-image' "/mountdir:$ScratchDisk\scratchdir" '/commit'
|
||||
Clear-Host
|
||||
Write-Host "The tiny11 image is now completed. Proceeding with the making of the ISO..."
|
||||
Write-Host "Copying unattended file for bypassing MS account on OOBE..."
|
||||
Copy-Item -Path "$PSScriptRoot\autounattend.xml" -Destination "$ScratchDisk\tiny11\autounattend.xml" -Force >null
|
||||
Write-Host "Creating ISO image..."
|
||||
$ADKDepTools = "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\$hostarchitecture\Oscdimg"
|
||||
$localOSCDIMGPath = "$PSScriptRoot\oscdimg.exe"
|
||||
|
||||
if ([System.IO.Directory]::Exists($ADKDepTools)) {
|
||||
Write-Host "Will be using oscdimg.exe from system ADK."
|
||||
$OSCDIMG = "$ADKDepTools\oscdimg.exe"
|
||||
} else {
|
||||
Write-Host "ADK folder not found. Will be using bundled oscdimg.exe."
|
||||
|
||||
$url = "https://msdl.microsoft.com/download/symbols/oscdimg.exe/3D44737265000/oscdimg.exe"
|
||||
|
||||
if (-not (Test-Path -Path $localOSCDIMGPath)) {
|
||||
Write-Host "Downloading oscdimg.exe..."
|
||||
Invoke-WebRequest -Uri $url -OutFile $localOSCDIMGPath
|
||||
|
||||
if (Test-Path $localOSCDIMGPath) {
|
||||
Write-Host "oscdimg.exe downloaded successfully."
|
||||
} else {
|
||||
Write-Error "Failed to download oscdimg.exe."
|
||||
exit 1
|
||||
}
|
||||
} else {
|
||||
Write-Host "oscdimg.exe already exists locally."
|
||||
}
|
||||
|
||||
$OSCDIMG = $localOSCDIMGPath
|
||||
}
|
||||
|
||||
& "$OSCDIMG" '-m' '-o' '-u2' '-udfver102' "-bootdata:2#p0,e,b$ScratchDisk\tiny11\boot\etfsboot.com#pEF,e,b$ScratchDisk\tiny11\efi\microsoft\boot\efisys.bin" "$ScratchDisk\tiny11" "$PSScriptRoot\tiny11.iso"
|
||||
|
||||
# Finishing up
|
||||
Write-Host "Creation completed! Press any key to exit the script..."
|
||||
Read-Host "Press Enter to continue"
|
||||
Write-Host "Performing Cleanup..."
|
||||
Remove-Item -Path "$ScratchDisk\tiny11" -Recurse -Force >null
|
||||
Remove-Item -Path "$ScratchDisk\scratchdir" -Recurse -Force >null
|
||||
|
||||
# Stop the transcript
|
||||
Stop-Transcript
|
||||
|
||||
exit
|
||||
Loading…
Add table
Reference in a new issue