mirror of
https://github.com/mr-r3b00t/go_darker
synced 2026-08-07 04:33:00 +00:00
Add files via upload
This commit is contained in:
Daniel Card
@@ -0,0 +1,608 @@
|
||||
#Requires -Version 5.1
|
||||
<#
|
||||
Manage-DefenderAntivirus.ps1
|
||||
|
||||
Purpose : View the health of Microsoft Defender Antivirus and view/toggle
|
||||
its protection settings, plus run common actions (update
|
||||
signatures, quick/full scan, view threats and exclusions).
|
||||
|
||||
IMPORTANT: This is a SECURITY tool. Unlike the telemetry/privacy scripts,
|
||||
here "Enabled / On" is the DESIRED (protected) state and
|
||||
"Off" REDUCES protection. Turning protections off is guarded
|
||||
and should only be done deliberately (e.g. troubleshooting).
|
||||
|
||||
How : Uses the built-in Defender PowerShell module (Get-MpComputerStatus,
|
||||
Get-MpPreference, Set-MpPreference, Update-MpSignature, Start-MpScan).
|
||||
Registry is intentionally NOT used - Tamper Protection and policy
|
||||
layering make direct registry edits to Defender unreliable.
|
||||
|
||||
Notes : - Windows PowerShell 5.1 compatible. ASCII-only source.
|
||||
- Viewing works as a standard user; changing settings and running
|
||||
scans require Administrator.
|
||||
- TAMPER PROTECTION: when on (default on Windows 11), Windows
|
||||
blocks programmatic changes to core protection. Such changes
|
||||
will fail here by design - turn Tamper Protection off in the
|
||||
Windows Security app first if you really need to change them.
|
||||
|
||||
Usage :
|
||||
.\Manage-DefenderAntivirus.ps1 # interactive menu
|
||||
.\Manage-DefenderAntivirus.ps1 -Report # print status and exit
|
||||
.\Manage-DefenderAntivirus.ps1 -EnableRecommended # set all to protected
|
||||
.\Manage-DefenderAntivirus.ps1 -DisableAll # turn all protections OFF
|
||||
.\Manage-DefenderAntivirus.ps1 -Update # update signatures and exit
|
||||
.\Manage-DefenderAntivirus.ps1 -QuickScan # run a quick scan and exit
|
||||
.\Manage-DefenderAntivirus.ps1 -Csv .\def.csv # export status and exit
|
||||
|
||||
DISCLAIMER: USE AT YOUR OWN RISK. Provided as-is with no warranty. Disabling
|
||||
antivirus protection exposes the system to malware. Review before use.
|
||||
#>
|
||||
|
||||
[CmdletBinding()]
|
||||
param(
|
||||
[switch]$Report,
|
||||
[switch]$EnableRecommended,
|
||||
[switch]$DisableAll,
|
||||
[switch]$Update,
|
||||
[switch]$QuickScan,
|
||||
[switch]$FullScan,
|
||||
[string]$Csv
|
||||
)
|
||||
|
||||
Set-StrictMode -Version 2.0
|
||||
$ErrorActionPreference = 'Stop'
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Elevation / availability
|
||||
# ---------------------------------------------------------------------------
|
||||
function Test-IsAdmin {
|
||||
$id = [Security.Principal.WindowsIdentity]::GetCurrent()
|
||||
$pr = New-Object Security.Principal.WindowsPrincipal($id)
|
||||
return $pr.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
|
||||
}
|
||||
|
||||
$Script:IsAdmin = Test-IsAdmin
|
||||
|
||||
if (-not (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue)) {
|
||||
Write-Host 'Microsoft Defender PowerShell module not found on this system.' -ForegroundColor Red
|
||||
Write-Host 'This tool requires the built-in Defender cmdlets (Windows client / Server' -ForegroundColor DarkYellow
|
||||
Write-Host 'with the Defender feature installed). Nothing to do.' -ForegroundColor DarkYellow
|
||||
return
|
||||
}
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Cached preference / status reads
|
||||
# ---------------------------------------------------------------------------
|
||||
$Script:Mp = $null
|
||||
$Script:Status = $null
|
||||
|
||||
function Get-MpPref {
|
||||
if ($null -eq $Script:Mp) { $Script:Mp = Get-MpPreference }
|
||||
return $Script:Mp
|
||||
}
|
||||
function Get-MpStatus {
|
||||
if ($null -eq $Script:Status) { $Script:Status = Get-MpComputerStatus }
|
||||
return $Script:Status
|
||||
}
|
||||
function Reset-MpCache {
|
||||
$Script:Mp = $null
|
||||
$Script:Status = $null
|
||||
}
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Control model
|
||||
# Pref controls map to a single Set-MpPreference parameter.
|
||||
# Kind:
|
||||
# Bool - the parameter is a Disable* boolean; ProtectOn = $false.
|
||||
# Enum - integer-backed; ProtectOn/ProtectOff are ints, Map gives labels.
|
||||
# "On" (protected) is always the recommended state.
|
||||
# ---------------------------------------------------------------------------
|
||||
function New-PrefControl {
|
||||
param(
|
||||
[string]$Name,
|
||||
[string]$PrefName,
|
||||
[ValidateSet('Bool','Enum')][string]$Kind,
|
||||
$ProtectOn, $ProtectOff,
|
||||
[hashtable]$Map = $null,
|
||||
[string]$Note = '',
|
||||
[switch]$PrivacyTradeoff # feature that also sends data to Microsoft
|
||||
)
|
||||
[pscustomobject]@{
|
||||
Type = 'Pref'
|
||||
Name = $Name
|
||||
PrefName = $PrefName
|
||||
Kind = $Kind
|
||||
ProtectOn = $ProtectOn
|
||||
ProtectOff = $ProtectOff
|
||||
Map = $Map
|
||||
Note = $Note
|
||||
PrivacyTradeoff = [bool]$PrivacyTradeoff
|
||||
AdminReq = $true
|
||||
}
|
||||
}
|
||||
|
||||
function Get-PrefRaw {
|
||||
param($Ctrl)
|
||||
$mp = Get-MpPref
|
||||
try { return $mp.$($Ctrl.PrefName) }
|
||||
catch { return $null }
|
||||
}
|
||||
|
||||
function Get-ControlState {
|
||||
param($Ctrl)
|
||||
$cur = Get-PrefRaw -Ctrl $Ctrl
|
||||
if ($null -eq $cur) { return 'Unknown' }
|
||||
|
||||
if ($Ctrl.Kind -eq 'Bool') {
|
||||
if ([bool]$cur -eq [bool]$Ctrl.ProtectOn) { return 'On' }
|
||||
if ([bool]$cur -eq [bool]$Ctrl.ProtectOff) { return 'Off' }
|
||||
return ('? ({0})' -f $cur)
|
||||
} else {
|
||||
$curInt = $null
|
||||
try { $curInt = [int]$cur } catch { return ('? ({0})' -f $cur) }
|
||||
$label = $curInt
|
||||
if ($Ctrl.Map -and $Ctrl.Map.ContainsKey($curInt)) { $label = $Ctrl.Map[$curInt] }
|
||||
if ($curInt -eq [int]$Ctrl.ProtectOn) { return ('On ({0})' -f $label) }
|
||||
if ($curInt -eq [int]$Ctrl.ProtectOff) { return ('Off ({0})' -f $label) }
|
||||
return ('Other ({0})' -f $label) # e.g. Audit mode
|
||||
}
|
||||
}
|
||||
|
||||
function Set-ControlValue {
|
||||
param($Ctrl, [ValidateSet('Enable','Disable')][string]$Action)
|
||||
$val = if ($Action -eq 'Enable') { $Ctrl.ProtectOn } else { $Ctrl.ProtectOff }
|
||||
$splat = @{ $Ctrl.PrefName = $val }
|
||||
Set-MpPreference @splat -ErrorAction Stop
|
||||
}
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Control catalog
|
||||
# ---------------------------------------------------------------------------
|
||||
function Get-Controls {
|
||||
$c = New-Object System.Collections.ArrayList
|
||||
|
||||
# --- Core real-time engine (Tamper Protection usually guards these) ---
|
||||
[void]$c.Add( (New-PrefControl -Name 'Real-time Monitoring' -PrefName 'DisableRealtimeMonitoring' `
|
||||
-Kind Bool -ProtectOn $false -ProtectOff $true `
|
||||
-Note 'Core on-access scanning. Guarded by Tamper Protection.') )
|
||||
|
||||
[void]$c.Add( (New-PrefControl -Name 'Behavior Monitoring' -PrefName 'DisableBehaviorMonitoring' `
|
||||
-Kind Bool -ProtectOn $false -ProtectOff $true `
|
||||
-Note 'Detects malicious behaviour patterns at runtime.') )
|
||||
|
||||
[void]$c.Add( (New-PrefControl -Name 'Downloads/Attachment Scan (IOAV)' -PrefName 'DisableIOAVProtection' `
|
||||
-Kind Bool -ProtectOn $false -ProtectOff $true `
|
||||
-Note 'Scans files downloaded from the internet / email.') )
|
||||
|
||||
[void]$c.Add( (New-PrefControl -Name 'Script Scanning' -PrefName 'DisableScriptScanning' `
|
||||
-Kind Bool -ProtectOn $false -ProtectOff $true `
|
||||
-Note 'Scans scripts before they run.') )
|
||||
|
||||
# --- Scan surface ---
|
||||
[void]$c.Add( (New-PrefControl -Name 'Archive Scanning' -PrefName 'DisableArchiveScanning' `
|
||||
-Kind Bool -ProtectOn $false -ProtectOff $true `
|
||||
-Note 'Scans inside .zip/.rar/etc during scans.') )
|
||||
|
||||
[void]$c.Add( (New-PrefControl -Name 'Email Scanning' -PrefName 'DisableEmailScanning' `
|
||||
-Kind Bool -ProtectOn $false -ProtectOff $true `
|
||||
-Note 'Parses mailbox/email files during scans.') )
|
||||
|
||||
[void]$c.Add( (New-PrefControl -Name 'Removable Drive Scanning' -PrefName 'DisableRemovableDriveScanning' `
|
||||
-Kind Bool -ProtectOn $false -ProtectOff $true `
|
||||
-Note 'Includes USB/removable media in full scans.') )
|
||||
|
||||
# --- Cloud protection ---
|
||||
[void]$c.Add( (New-PrefControl -Name 'Cloud-delivered Protection (MAPS)' -PrefName 'MAPSReporting' `
|
||||
-Kind Enum -ProtectOn 2 -ProtectOff 0 `
|
||||
-Map @{ 0='Disabled'; 1='Basic'; 2='Advanced' } `
|
||||
-Note 'Real-time cloud lookups. Recommended: Advanced.') )
|
||||
|
||||
[void]$c.Add( (New-PrefControl -Name 'Automatic Sample Submission' -PrefName 'SubmitSamplesConsent' `
|
||||
-Kind Enum -ProtectOn 1 -ProtectOff 2 `
|
||||
-Map @{ 0='AlwaysPrompt'; 1='SendSafeSamples'; 2='NeverSend'; 3='SendAllSamples' } `
|
||||
-PrivacyTradeoff `
|
||||
-Note 'Needed for full cloud protection; sends files to Microsoft. 2=Never for privacy.') )
|
||||
|
||||
[void]$c.Add( (New-PrefControl -Name 'Cloud Block Level' -PrefName 'CloudBlockLevel' `
|
||||
-Kind Enum -ProtectOn 2 -ProtectOff 0 `
|
||||
-Map @{ 0='Default'; 1='Moderate'; 2='High'; 4='HighPlus'; 6='ZeroTolerance' } `
|
||||
-Note 'How aggressively cloud blocks suspicious files. Higher = safer, more false positives.') )
|
||||
|
||||
# --- Advanced protections ---
|
||||
[void]$c.Add( (New-PrefControl -Name 'PUA Protection' -PrefName 'PUAProtection' `
|
||||
-Kind Enum -ProtectOn 1 -ProtectOff 0 `
|
||||
-Map @{ 0='Disabled'; 1='Enabled'; 2='AuditMode' } `
|
||||
-Note 'Blocks potentially unwanted apps (adware, bundleware).') )
|
||||
|
||||
[void]$c.Add( (New-PrefControl -Name 'Network Protection' -PrefName 'EnableNetworkProtection' `
|
||||
-Kind Enum -ProtectOn 1 -ProtectOff 0 `
|
||||
-Map @{ 0='Disabled'; 1='Enabled'; 2='AuditMode' } `
|
||||
-Note 'Blocks connections to malicious domains/IPs (SmartScreen for any app).') )
|
||||
|
||||
[void]$c.Add( (New-PrefControl -Name 'Controlled Folder Access' -PrefName 'EnableControlledFolderAccess' `
|
||||
-Kind Enum -ProtectOn 1 -ProtectOff 0 `
|
||||
-Map @{ 0='Disabled'; 1='Enabled'; 2='AuditMode' } `
|
||||
-Note 'Anti-ransomware: blocks untrusted apps writing to protected folders. May need app allow-listing.') )
|
||||
|
||||
return $c
|
||||
}
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Display: health summary
|
||||
# ---------------------------------------------------------------------------
|
||||
function Format-Bool {
|
||||
param([bool]$Value, [bool]$GoodIsTrue = $true)
|
||||
if ($Value) { return 'Yes' } else { return 'No' }
|
||||
}
|
||||
|
||||
# Safe property read - property names on MpComputerStatus vary by Windows build,
|
||||
# and Set-StrictMode makes a missing property throw. Try each candidate name.
|
||||
function Get-Prop {
|
||||
param($Obj, [string[]]$Names, $Default = $null)
|
||||
foreach ($n in $Names) {
|
||||
if ($Obj.PSObject.Properties.Match($n).Count -gt 0) {
|
||||
$v = $Obj.$n
|
||||
if ($null -ne $v) { return $v }
|
||||
}
|
||||
}
|
||||
return $Default
|
||||
}
|
||||
|
||||
function Show-Health {
|
||||
$s = Get-MpStatus
|
||||
|
||||
Write-Host ''
|
||||
Write-Host '==================================================================' -ForegroundColor Cyan
|
||||
Write-Host ' Microsoft Defender Antivirus - Health' -ForegroundColor Cyan
|
||||
Write-Host (' Host: {0} Admin: {1} {2}' -f $env:COMPUTERNAME, $Script:IsAdmin, (Get-Date)) -ForegroundColor DarkCyan
|
||||
Write-Host '==================================================================' -ForegroundColor Cyan
|
||||
|
||||
function Line {
|
||||
param([string]$Label, $Value, [string]$Color = 'Gray')
|
||||
Write-Host (' {0,-32}' -f $Label) -NoNewline
|
||||
Write-Host $Value -ForegroundColor $Color
|
||||
}
|
||||
|
||||
# Running mode (Normal / Passive / EDR Block / etc.)
|
||||
$mode = Get-Prop $s @('AMRunningMode') 'Unknown'
|
||||
$modeColor = if ($mode -eq 'Normal') { 'Green' } else { 'Yellow' }
|
||||
Line 'Running mode' $mode $modeColor
|
||||
if ($mode -ne 'Normal' -and $mode -ne 'Unknown') {
|
||||
Write-Host ' (Passive/other mode: another AV may be primary; some settings inactive)' -ForegroundColor DarkYellow
|
||||
}
|
||||
|
||||
Line 'AntiMalware service' (Format-Bool $s.AMServiceEnabled) ($(if ($s.AMServiceEnabled) {'Green'} else {'Red'}))
|
||||
Line 'Real-time protection' (Format-Bool $s.RealTimeProtectionEnabled) ($(if ($s.RealTimeProtectionEnabled) {'Green'} else {'Red'}))
|
||||
Line 'Behavior monitor' (Format-Bool $s.BehaviorMonitorEnabled) ($(if ($s.BehaviorMonitorEnabled) {'Green'} else {'Yellow'}))
|
||||
Line 'On-access (IOAV) protection' (Format-Bool $s.IoavProtectionEnabled) ($(if ($s.IoavProtectionEnabled) {'Green'} else {'Yellow'}))
|
||||
Line 'Network inspection (NIS)' (Format-Bool $s.NISEnabled) ($(if ($s.NISEnabled) {'Green'} else {'Yellow'}))
|
||||
Line 'Tamper Protection' (Format-Bool $s.IsTamperProtected) ($(if ($s.IsTamperProtected) {'Green'} else {'Yellow'}))
|
||||
|
||||
# Signature freshness
|
||||
$age = [int](Get-Prop $s @('AntivirusSignatureAge') 0)
|
||||
$ageColor = if ($age -le 2) { 'Green' } elseif ($age -le 7) { 'Yellow' } else { 'Red' }
|
||||
Line 'Signature version' (Get-Prop $s @('AntivirusSignatureVersion') 'n/a') 'Gray'
|
||||
Line 'Signature age (days)' $age $ageColor
|
||||
Line 'Engine version' (Get-Prop $s @('AMEngineVersion') 'n/a') 'Gray'
|
||||
|
||||
# Last scans (property names differ across builds)
|
||||
$lastQuick = Get-Prop $s @('QuickScanEndTime','LastQuickScanEndTime') 'never'
|
||||
$lastFull = Get-Prop $s @('FullScanEndTime','LastFullScanEndTime') 'never'
|
||||
Line 'Last quick scan' $lastQuick 'Gray'
|
||||
Line 'Last full scan' $lastFull 'Gray'
|
||||
}
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Display: configurable protections
|
||||
# ---------------------------------------------------------------------------
|
||||
function Get-StateColor {
|
||||
param([string]$State)
|
||||
if ($State -like 'On*') { return 'Green' }
|
||||
if ($State -like 'Off*') { return 'Red' }
|
||||
if ($State -like 'Other*') { return 'Yellow' } # audit mode etc.
|
||||
return 'DarkGray'
|
||||
}
|
||||
|
||||
function Show-Controls {
|
||||
param($Controls)
|
||||
|
||||
Write-Host ''
|
||||
Write-Host ' Configurable protections (On = protected / recommended)' -ForegroundColor White
|
||||
Write-Host (' {0,-3}{1,-36}{2}' -f '#', 'Protection', 'State') -ForegroundColor White
|
||||
Write-Host (' {0,-3}{1,-36}{2}' -f '---', '----------', '-----') -ForegroundColor DarkGray
|
||||
|
||||
$i = 0
|
||||
$nOff = 0
|
||||
foreach ($ctrl in $Controls) {
|
||||
$i++
|
||||
$state = Get-ControlState -Ctrl $ctrl
|
||||
if ($state -like 'Off*') { $nOff++ }
|
||||
$tag = ''
|
||||
if ($ctrl.PrivacyTradeoff) { $tag = ' [PRIV]' }
|
||||
$lock = ''
|
||||
if ($ctrl.AdminReq -and -not $Script:IsAdmin) { $lock = ' *' }
|
||||
Write-Host (' {0,-3}{1,-36}' -f $i, ($ctrl.Name + $tag)) -NoNewline
|
||||
Write-Host ($state + $lock) -ForegroundColor (Get-StateColor $state)
|
||||
}
|
||||
Write-Host (' {0,-3}{1,-36}{2}' -f '---', '----------', '-----') -ForegroundColor DarkGray
|
||||
if ($nOff -gt 0) {
|
||||
Write-Host (' WARNING: {0} protection(s) are currently OFF (reduced security)' -f $nOff) -ForegroundColor Red
|
||||
} else {
|
||||
Write-Host ' All listed protections are ON.' -ForegroundColor Green
|
||||
}
|
||||
Write-Host ' [PRIV] = also sends data to Microsoft (privacy tradeoff)' -ForegroundColor DarkCyan
|
||||
if (-not $Script:IsAdmin) {
|
||||
Write-Host ' * requires Administrator to change (run elevated)' -ForegroundColor DarkYellow
|
||||
}
|
||||
if ((Get-MpStatus).IsTamperProtected) {
|
||||
Write-Host ' NOTE: Tamper Protection is ON - changes to core items may be blocked.' -ForegroundColor DarkYellow
|
||||
}
|
||||
Write-Host ''
|
||||
}
|
||||
|
||||
function Show-Status {
|
||||
param($Controls)
|
||||
Show-Health
|
||||
Show-Controls -Controls $Controls
|
||||
}
|
||||
|
||||
function Export-StatusCsv {
|
||||
param($Controls, [string]$Path)
|
||||
$s = Get-MpStatus
|
||||
$rows = New-Object System.Collections.ArrayList
|
||||
|
||||
# Health rows
|
||||
[void]$rows.Add([pscustomobject]@{ Group='Health'; Name='RealTimeProtection'; State=$s.RealTimeProtectionEnabled; Note='' })
|
||||
[void]$rows.Add([pscustomobject]@{ Group='Health'; Name='TamperProtection'; State=$s.IsTamperProtected; Note='' })
|
||||
[void]$rows.Add([pscustomobject]@{ Group='Health'; Name='SignatureAgeDays'; State=[int](Get-Prop $s @('AntivirusSignatureAge') 0); Note=(Get-Prop $s @('AntivirusSignatureVersion') 'n/a') })
|
||||
# Config rows
|
||||
foreach ($ctrl in $Controls) {
|
||||
[void]$rows.Add([pscustomobject]@{
|
||||
Group = 'Protection'
|
||||
Name = $ctrl.Name
|
||||
State = (Get-ControlState -Ctrl $ctrl)
|
||||
Note = $ctrl.Note
|
||||
})
|
||||
}
|
||||
$rows | Export-Csv -Path $Path -NoTypeInformation -Encoding ASCII
|
||||
Write-Host ("Status written to {0}" -f $Path) -ForegroundColor Green
|
||||
}
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Apply helpers
|
||||
# ---------------------------------------------------------------------------
|
||||
function Invoke-ControlAction {
|
||||
param($Ctrl, [ValidateSet('Enable','Disable')][string]$Action)
|
||||
|
||||
if ($Ctrl.AdminReq -and -not $Script:IsAdmin) {
|
||||
Write-Host (" SKIP {0} (needs Administrator)" -f $Ctrl.Name) -ForegroundColor DarkYellow
|
||||
return
|
||||
}
|
||||
try {
|
||||
Set-ControlValue -Ctrl $Ctrl -Action $Action
|
||||
Reset-MpCache
|
||||
$new = Get-ControlState -Ctrl $Ctrl
|
||||
Write-Host (" OK {0} -> {1}" -f $Ctrl.Name, $new) -ForegroundColor Green
|
||||
} catch {
|
||||
Write-Host (" FAIL {0}: {1}" -f $Ctrl.Name, $_.Exception.Message) -ForegroundColor Red
|
||||
Write-Host ' (If Tamper Protection is on, this change is blocked by design.)' -ForegroundColor DarkYellow
|
||||
}
|
||||
}
|
||||
|
||||
function Invoke-EnableRecommended {
|
||||
param($Controls)
|
||||
Write-Host ''
|
||||
Write-Host 'Setting all protections to recommended (ON)...' -ForegroundColor Cyan
|
||||
foreach ($ctrl in $Controls) {
|
||||
$state = Get-ControlState -Ctrl $ctrl
|
||||
if ($state -like 'On*') {
|
||||
Write-Host (" -- {0} already On" -f $ctrl.Name) -ForegroundColor DarkGray
|
||||
continue
|
||||
}
|
||||
Invoke-ControlAction -Ctrl $ctrl -Action Enable
|
||||
}
|
||||
Write-Host ''
|
||||
}
|
||||
|
||||
function Invoke-DisableAll {
|
||||
param($Controls)
|
||||
Write-Host ''
|
||||
Write-Host 'Disabling ALL Defender protections (REDUCES SECURITY)...' -ForegroundColor Red
|
||||
foreach ($ctrl in $Controls) {
|
||||
$state = Get-ControlState -Ctrl $ctrl
|
||||
if ($state -like 'Off*') {
|
||||
Write-Host (" -- {0} already Off" -f $ctrl.Name) -ForegroundColor DarkGray
|
||||
continue
|
||||
}
|
||||
Invoke-ControlAction -Ctrl $ctrl -Action Disable
|
||||
}
|
||||
Write-Host ''
|
||||
if ((Get-MpStatus).IsTamperProtected) {
|
||||
Write-Host 'Note: core items stay ON while Tamper Protection is enabled - turn it' -ForegroundColor DarkYellow
|
||||
Write-Host ' off in the Windows Security app first if you need them off too.' -ForegroundColor DarkYellow
|
||||
}
|
||||
Write-Host 'This also stops Defender cloud lookups and sample submission to Microsoft.' -ForegroundColor DarkCyan
|
||||
Write-Host ''
|
||||
}
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Actions: update / scan / threats / exclusions
|
||||
# ---------------------------------------------------------------------------
|
||||
function Invoke-Update {
|
||||
if (-not $Script:IsAdmin) { Write-Host 'Signature update requires Administrator.' -ForegroundColor DarkYellow; return }
|
||||
Write-Host 'Updating Defender signatures...' -ForegroundColor Cyan
|
||||
try {
|
||||
Update-MpSignature -ErrorAction Stop
|
||||
Reset-MpCache
|
||||
$s = Get-MpStatus
|
||||
Write-Host ('Done. Signature version {0} (age {1} day(s)).' -f $s.AntivirusSignatureVersion, [int]$s.AntivirusSignatureAge) -ForegroundColor Green
|
||||
} catch {
|
||||
Write-Host ('Update failed: {0}' -f $_.Exception.Message) -ForegroundColor Red
|
||||
}
|
||||
}
|
||||
|
||||
function Invoke-Scan {
|
||||
param([ValidateSet('Quick','Full')][string]$Kind)
|
||||
if (-not $Script:IsAdmin) { Write-Host 'Scanning requires Administrator.' -ForegroundColor DarkYellow; return }
|
||||
Write-Host ("Starting {0} scan (this may take a while)..." -f $Kind) -ForegroundColor Cyan
|
||||
try {
|
||||
Start-MpScan -ScanType ($Kind + 'Scan') -ErrorAction Stop
|
||||
Reset-MpCache
|
||||
Write-Host 'Scan complete.' -ForegroundColor Green
|
||||
} catch {
|
||||
Write-Host ('Scan failed: {0}' -f $_.Exception.Message) -ForegroundColor Red
|
||||
}
|
||||
}
|
||||
|
||||
function Show-Threats {
|
||||
Write-Host ''
|
||||
Write-Host 'Recent threat detections:' -ForegroundColor White
|
||||
try {
|
||||
$threats = @(Get-MpThreatDetection -ErrorAction Stop | Sort-Object InitialDetectionTime -Descending | Select-Object -First 15)
|
||||
if ($threats.Count -eq 0) {
|
||||
Write-Host ' None recorded.' -ForegroundColor Green
|
||||
} else {
|
||||
foreach ($t in $threats) {
|
||||
$name = try { (Get-MpThreat -ThreatID $t.ThreatID -ErrorAction SilentlyContinue).ThreatName } catch { $t.ThreatID }
|
||||
if (-not $name) { $name = $t.ThreatID }
|
||||
Write-Host (' {0} {1} (action: {2})' -f $t.InitialDetectionTime, $name, $t.ThreatStatusID) -ForegroundColor Yellow
|
||||
}
|
||||
}
|
||||
} catch {
|
||||
Write-Host (' Could not read threat history: {0}' -f $_.Exception.Message) -ForegroundColor Red
|
||||
}
|
||||
Write-Host ''
|
||||
}
|
||||
|
||||
function Show-Exclusions {
|
||||
$mp = Get-MpPref
|
||||
Write-Host ''
|
||||
Write-Host 'Configured exclusions (attack surface - review carefully):' -ForegroundColor White
|
||||
function Dump {
|
||||
param([string]$Label, $Items)
|
||||
$arr = @($Items)
|
||||
if ($arr.Count -eq 0) { Write-Host (' {0}: none' -f $Label) -ForegroundColor DarkGray; return }
|
||||
Write-Host (' {0}:' -f $Label) -ForegroundColor Yellow
|
||||
foreach ($x in $arr) { Write-Host (' {0}' -f $x) -ForegroundColor Gray }
|
||||
}
|
||||
Dump 'Paths' $mp.ExclusionPath
|
||||
Dump 'Extensions' $mp.ExclusionExtension
|
||||
Dump 'Processes' $mp.ExclusionProcess
|
||||
Write-Host ''
|
||||
}
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Interactive menu
|
||||
# ---------------------------------------------------------------------------
|
||||
function Start-Menu {
|
||||
param($Controls)
|
||||
while ($true) {
|
||||
Reset-MpCache
|
||||
Show-Status -Controls $Controls
|
||||
Write-Host 'Commands:' -ForegroundColor White
|
||||
Write-Host ' <n> toggle protection n (On<->Off)'
|
||||
Write-Host ' e <n> enable (protect) item n'
|
||||
Write-Host ' d <n> disable item n (REDUCES security)'
|
||||
Write-Host ' E enable ALL recommended protections'
|
||||
Write-Host ' D disable ALL protections (reduces security)'
|
||||
Write-Host ' u update signatures'
|
||||
Write-Host ' s run quick scan'
|
||||
Write-Host ' f run full scan'
|
||||
Write-Host ' t show recent threat detections'
|
||||
Write-Host ' x show exclusions'
|
||||
Write-Host ' r refresh view'
|
||||
Write-Host ' c <path> export status to CSV'
|
||||
Write-Host ' q quit'
|
||||
Write-Host ''
|
||||
$inp = Read-Host 'Select'
|
||||
if ([string]::IsNullOrWhiteSpace($inp)) { continue }
|
||||
$inp = $inp.Trim()
|
||||
|
||||
switch -Regex -CaseSensitive ($inp) {
|
||||
'^[Qq]$' { return }
|
||||
'^[Rr]$' { continue }
|
||||
'^E$' {
|
||||
Invoke-EnableRecommended -Controls $Controls
|
||||
Read-Host 'Press Enter'; continue
|
||||
}
|
||||
'^D$' {
|
||||
Write-Host ''
|
||||
Write-Host 'WARNING: This disables ALL Defender protections listed above.' -ForegroundColor Red
|
||||
Write-Host 'The system will be left without Defender antivirus coverage.' -ForegroundColor Red
|
||||
if ((Read-Host 'Proceed? type DISABLE-ALL') -ceq 'DISABLE-ALL') {
|
||||
Invoke-DisableAll -Controls $Controls
|
||||
}
|
||||
Read-Host 'Press Enter'; continue
|
||||
}
|
||||
'^[Uu]$' { Invoke-Update; Read-Host 'Press Enter'; continue }
|
||||
'^[Ss]$' { Invoke-Scan -Kind Quick; Read-Host 'Press Enter'; continue }
|
||||
'^[Ff]$' { Invoke-Scan -Kind Full; Read-Host 'Press Enter'; continue }
|
||||
'^[Tt]$' { Show-Threats; Read-Host 'Press Enter'; continue }
|
||||
'^[Xx]$' { Show-Exclusions; Read-Host 'Press Enter'; continue }
|
||||
'^[Cc]\s+(.+)$' {
|
||||
Export-StatusCsv -Controls $Controls -Path $Matches[1].Trim('"')
|
||||
Read-Host 'Press Enter'; continue
|
||||
}
|
||||
'^[Ee]\s+(\d+)$' {
|
||||
$n = [int]$Matches[1]
|
||||
if ($n -ge 1 -and $n -le $Controls.Count) { Invoke-ControlAction -Ctrl $Controls[$n-1] -Action Enable }
|
||||
else { Write-Host 'Out of range' -ForegroundColor Red }
|
||||
Read-Host 'Press Enter'; continue
|
||||
}
|
||||
'^[Dd]\s+(\d+)$' {
|
||||
$n = [int]$Matches[1]
|
||||
if ($n -ge 1 -and $n -le $Controls.Count) {
|
||||
$ctrl = $Controls[$n-1]
|
||||
Write-Host ''
|
||||
Write-Host ('WARNING: Disabling "{0}" reduces protection.' -f $ctrl.Name) -ForegroundColor Red
|
||||
if ((Read-Host 'Proceed? type YES') -ceq 'YES') {
|
||||
Invoke-ControlAction -Ctrl $ctrl -Action Disable
|
||||
}
|
||||
} else { Write-Host 'Out of range' -ForegroundColor Red }
|
||||
Read-Host 'Press Enter'; continue
|
||||
}
|
||||
'^\d+$' {
|
||||
$n = [int]$inp
|
||||
if ($n -ge 1 -and $n -le $Controls.Count) {
|
||||
$ctrl = $Controls[$n-1]
|
||||
$state = Get-ControlState -Ctrl $ctrl
|
||||
if ($state -like 'On*') {
|
||||
Write-Host ''
|
||||
Write-Host ('WARNING: Disabling "{0}" reduces protection.' -f $ctrl.Name) -ForegroundColor Red
|
||||
if ((Read-Host 'Proceed? type YES') -ceq 'YES') {
|
||||
Invoke-ControlAction -Ctrl $ctrl -Action Disable
|
||||
}
|
||||
} else {
|
||||
Invoke-ControlAction -Ctrl $ctrl -Action Enable
|
||||
}
|
||||
} else { Write-Host 'Out of range' -ForegroundColor Red }
|
||||
Read-Host 'Press Enter'; continue
|
||||
}
|
||||
default { Write-Host 'Unknown command' -ForegroundColor Red; Start-Sleep -Milliseconds 600 }
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Main
|
||||
# ---------------------------------------------------------------------------
|
||||
$controls = Get-Controls
|
||||
|
||||
if ($Update) { Invoke-Update; return }
|
||||
if ($QuickScan) { Invoke-Scan -Kind Quick; return }
|
||||
if ($FullScan) { Invoke-Scan -Kind Full; return }
|
||||
if ($EnableRecommended) { Invoke-EnableRecommended -Controls $controls; Show-Status -Controls $controls; if ($Csv) { Export-StatusCsv -Controls $controls -Path $Csv }; return }
|
||||
if ($DisableAll) { Invoke-DisableAll -Controls $controls; Show-Status -Controls $controls; if ($Csv) { Export-StatusCsv -Controls $controls -Path $Csv }; return }
|
||||
if ($Report -or $Csv) {
|
||||
if ($Report) { Show-Status -Controls $controls }
|
||||
if ($Csv) { Export-StatusCsv -Controls $controls -Path $Csv }
|
||||
return
|
||||
}
|
||||
|
||||
if (-not $Script:IsAdmin) {
|
||||
Write-Host ''
|
||||
Write-Host 'NOTE: Not running as Administrator. You can VIEW status, but changing' -ForegroundColor DarkYellow
|
||||
Write-Host ' protections, updating signatures and scanning need an elevated' -ForegroundColor DarkYellow
|
||||
Write-Host ' PowerShell window.' -ForegroundColor DarkYellow
|
||||
}
|
||||
|
||||
Start-Menu -Controls $controls
|
||||
@@ -14,9 +14,12 @@
|
||||
appraiser, Cloud Content / Tailored Experiences, Activity
|
||||
History, Advertising ID, Feedback (SIUF), inking/typing and
|
||||
speech data, search suggestions, DiagTrack + related services,
|
||||
telemetry scheduled tasks, and Windows SmartScreen ([SEC]:
|
||||
apps-and-files check, Store app URL check, Enhanced Phishing
|
||||
Protection - excluded from bulk disable unless requested).
|
||||
telemetry scheduled tasks, Cortana/cloud search, cloud clipboard
|
||||
and settings sync, suggestions/ads (Content Delivery Manager),
|
||||
location, Find My Device, Copilot/Recall, Delivery Optimization,
|
||||
and Windows SmartScreen ([SEC]: apps-and-files check, Store app
|
||||
URL check, Enhanced Phishing Protection - excluded from bulk
|
||||
disable unless requested).
|
||||
|
||||
Notes : - Windows PowerShell 5.1 compatible. ASCII-only source.
|
||||
- Registry (HKLM) and service changes require Administrator.
|
||||
@@ -382,6 +385,92 @@ function Get-Controls {
|
||||
-ValueName 'BingSearchEnabled' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable `
|
||||
-Note 'Win10-era value; largely ignored on Win11') )
|
||||
|
||||
# --- Search / Cortana cloud ---
|
||||
[void]$c.Add( (New-RegControl -Name 'Cortana' -Category 'Search/Cortana' `
|
||||
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\Windows Search' `
|
||||
-ValueName 'AllowCortana' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable) )
|
||||
|
||||
[void]$c.Add( (New-RegControl -Name 'Search Web Results (Cloud)' -Category 'Search/Cortana' `
|
||||
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\Windows Search' `
|
||||
-ValueName 'ConnectedSearchUseWeb' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable `
|
||||
-Note 'Bing web results in Start/Search') )
|
||||
|
||||
[void]$c.Add( (New-RegControl -Name 'Cloud Content Search' -Category 'Search/Cortana' `
|
||||
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\Windows Search' `
|
||||
-ValueName 'AllowCloudSearch' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable `
|
||||
-Note 'Search of OneDrive/Outlook/SharePoint content') )
|
||||
|
||||
[void]$c.Add( (New-RegControl -Name 'Search Uses Location' -Category 'Search/Cortana' `
|
||||
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\Windows Search' `
|
||||
-ValueName 'AllowSearchToUseLocation' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable) )
|
||||
|
||||
# --- Cloud sync (clipboard / settings) ---
|
||||
[void]$c.Add( (New-RegControl -Name 'Clipboard History' -Category 'Cloud Sync' `
|
||||
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\System' `
|
||||
-ValueName 'AllowClipboardHistory' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable `
|
||||
-Note 'Local clipboard history (Win+V)') )
|
||||
|
||||
[void]$c.Add( (New-RegControl -Name 'Cross-Device Clipboard (Cloud)' -Category 'Cloud Sync' `
|
||||
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\System' `
|
||||
-ValueName 'AllowCrossDeviceClipboard' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable `
|
||||
-Note 'Syncs clipboard contents to Microsoft cloud') )
|
||||
|
||||
[void]$c.Add( (New-RegControl -Name 'Settings Sync' -Category 'Cloud Sync' `
|
||||
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\SettingSync' `
|
||||
-ValueName 'DisableSettingSync' -OnValue 0 -OffValue 2 -Default On -RemoveOnEnable `
|
||||
-Note 'Syncs Windows settings across devices via MS account') )
|
||||
|
||||
# --- Suggestions / ads (Content Delivery Manager, per-user) ---
|
||||
[void]$c.Add( (New-RegControl -Name 'Auto-install Suggested Apps' -Category 'Suggestions/Ads' `
|
||||
-Hive HKCU -Path 'SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' `
|
||||
-ValueName 'SilentInstalledAppsEnabled' -OnValue 1 -OffValue 0 -Default On) )
|
||||
|
||||
[void]$c.Add( (New-RegControl -Name 'Start Menu Suggestions' -Category 'Suggestions/Ads' `
|
||||
-Hive HKCU -Path 'SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' `
|
||||
-ValueName 'SystemPaneSuggestionsEnabled' -OnValue 1 -OffValue 0 -Default On) )
|
||||
|
||||
[void]$c.Add( (New-RegControl -Name 'Settings App Suggestions' -Category 'Suggestions/Ads' `
|
||||
-Hive HKCU -Path 'SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' `
|
||||
-ValueName 'SubscribedContent-338393Enabled' -OnValue 1 -OffValue 0 -Default On) )
|
||||
|
||||
[void]$c.Add( (New-RegControl -Name 'Tips and Notifications' -Category 'Suggestions/Ads' `
|
||||
-Hive HKCU -Path 'SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' `
|
||||
-ValueName 'SubscribedContent-338389Enabled' -OnValue 1 -OffValue 0 -Default On `
|
||||
-Note 'Windows tips/suggestion notifications') )
|
||||
|
||||
[void]$c.Add( (New-RegControl -Name 'Lock Screen Spotlight' -Category 'Suggestions/Ads' `
|
||||
-Hive HKCU -Path 'SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' `
|
||||
-ValueName 'RotatingLockScreenOverlayEnabled' -OnValue 1 -OffValue 0 -Default On `
|
||||
-Note 'Spotlight ads/facts on the lock screen') )
|
||||
|
||||
# --- Location ---
|
||||
[void]$c.Add( (New-RegControl -Name 'Location Platform' -Category 'Location' `
|
||||
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors' `
|
||||
-ValueName 'DisableLocation' -OnValue 0 -OffValue 1 -Default On -RemoveOnEnable `
|
||||
-Note 'System-wide location services') )
|
||||
|
||||
# --- Find My Device ---
|
||||
[void]$c.Add( (New-RegControl -Name 'Find My Device' -Category 'Find My Device' `
|
||||
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\FindMyDevice' `
|
||||
-ValueName 'AllowFindMyDevice' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable `
|
||||
-Note 'Periodic location reporting to your MS account') )
|
||||
|
||||
# --- AI features (Copilot / Recall) ---
|
||||
[void]$c.Add( (New-RegControl -Name 'Windows Copilot' -Category 'AI' `
|
||||
-Hive HKCU -Path 'SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot' `
|
||||
-ValueName 'TurnOffWindowsCopilot' -OnValue 0 -OffValue 1 -Default On -RemoveOnEnable) )
|
||||
|
||||
[void]$c.Add( (New-RegControl -Name 'Recall (AI Data Analysis)' -Category 'AI' `
|
||||
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\WindowsAI' `
|
||||
-ValueName 'DisableAIDataAnalysis' -OnValue 0 -OffValue 1 -Default On -RemoveOnEnable `
|
||||
-Note 'Recall screen snapshots (Copilot+ PCs)') )
|
||||
|
||||
# --- Delivery Optimization (update peer sharing) ---
|
||||
[void]$c.Add( (New-RegControl -Name 'Delivery Optimization P2P' -Category 'Network' `
|
||||
-Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization' `
|
||||
-ValueName 'DODownloadMode' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable `
|
||||
-Note '0=HTTP only (no peers) 1=LAN 3=Internet peers') )
|
||||
|
||||
# --- Windows SmartScreen: OS-level URL/file reputation (SECURITY) ---
|
||||
# These check apps, files and URLs against Microsoft's cloud reputation
|
||||
# service. Disabling them REDUCES protection against malware/phishing.
|
||||
|
||||
@@ -6,11 +6,23 @@ Two single-file, dependency-free PowerShell 5.1 scripts:
|
||||
|---|---|
|
||||
| `Manage-WindowsTelemetry.ps1` | Windows 11 telemetry / diagnostic-data settings, services and scheduled tasks |
|
||||
| `Manage-BrowserPrivacy.ps1` | Privacy / telemetry policies for Edge, Chrome, Firefox and Brave |
|
||||
| `Manage-DefenderAntivirus.ps1` | Microsoft Defender Antivirus health, protection settings, scans and updates |
|
||||
|
||||
Both share the same UX: a color-coded status view (**Enabled** = collecting,
|
||||
**Disabled** = hardened), interactive per-item toggling, one-shot
|
||||
`-DisableAll` / `-EnableAll`, `-Report`, and CSV export. Both are ASCII-only,
|
||||
BOM-free, module-free, and run in stock `powershell.exe` on Windows 11.
|
||||
All three share the same UX: a color-coded status view, interactive per-item
|
||||
toggling, `-Report`, and CSV export. They are ASCII-only, BOM-free, and run
|
||||
in stock `powershell.exe` on Windows 11.
|
||||
|
||||
**Intended audience:** this is a privacy-enabling / telemetry-disabling
|
||||
toolkit for **advanced users and administrators** who understand the
|
||||
tradeoffs. It is **not** aimed at general users and it deliberately exposes
|
||||
switches that reduce data sharing *and* switches that reduce security
|
||||
protection. Know what each item does before you flip it.
|
||||
|
||||
**Important difference in orientation:** in the telemetry and browser tools,
|
||||
**Disabled = hardened** (you turn data collection *off*). In the Defender
|
||||
tool the polarity is **reversed** - **On/Enabled = protected/recommended**,
|
||||
and turning a protection *off* reduces security. Each tool's status view is
|
||||
labelled accordingly.
|
||||
|
||||
> **Disclaimer - USE AT YOUR OWN RISK.** These scripts modify registry
|
||||
> values, service startup types and scheduled tasks. They are provided as-is,
|
||||
@@ -26,11 +38,11 @@ Read this before running either script with `-DisableAll` or the menu
|
||||
|
||||
| Risk | Detail | Mitigation |
|
||||
|---|---|---|
|
||||
| **Reduced malware/phishing protection** | Disabling the `[SEC]` items (Windows SmartScreen, Edge SmartScreen, Chrome/Brave Safe Browsing) removes URL, download and app reputation warnings. This is a genuine security downgrade. | `[SEC]` items are excluded from bulk disable by default; only disable them deliberately, and only if other filtering (DNS/proxy/EDR) covers the gap. |
|
||||
| **Reduced malware/phishing protection** | Disabling the `[SEC]` items (Windows SmartScreen, Edge SmartScreen, Chrome/Brave Safe Browsing) removes URL, download and app reputation warnings. Likewise the **Defender** tool's `-DisableAll` / menu `D` turns off real-time monitoring, cloud protection, network protection and controlled folder access - a direct antivirus downgrade that leaves the machine without Defender coverage. | Browser `[SEC]` items are excluded from bulk disable by default; the Defender bulk disable requires an explicit switch/confirmation. Only disable deliberately, and only if other controls (DNS/proxy/EDR) cover the gap. |
|
||||
| **Managed / corporate machines** | On a domain-joined or Intune/MDM-managed device, these settings may be owned by your organisation. Changing them can conflict with GPO/MDM (which will usually re-apply), break compliance posture, or violate your IT policy. | Only run on machines you own or are authorised to change. Expect GPO/MDM to win any conflict. |
|
||||
| **MDM / provisioning breakage** | Disabling `dmwappushservice` can break provisioning-package installation (`Add-ProvisioningPackage`) and some MDM enrolment flows. | Skip that item (or re-enable it) on devices that will be enrolled. |
|
||||
| **Lost crash reporting** | Disabling Windows Error Reporting stops crash reports to Microsoft, and WER-based *local* workflows too (e.g. LocalDumps collection for debugging). | Re-enable WER while troubleshooting crashes. |
|
||||
| **Feature loss** | Some features depend on the data flows being disabled: Find My Device, Windows Insider Program (requires Optional diagnostic data), inking/typing personalisation, cross-device Timeline/resume, cloud speech recognition, live search suggestions. | Review the per-setting tables below and keep the items you use enabled. |
|
||||
| **Feature loss** | Some features depend on the data flows being disabled: Find My Device, Windows Insider Program (requires Optional diagnostic data), inking/typing personalisation, cross-device Timeline/resume, cloud speech recognition, live search suggestions, Cortana, cross-device clipboard paste, settings sync across devices, location-aware apps (maps/weather/timezone), Windows Copilot and Recall. | Review the per-setting tables below and keep the items you use enabled. |
|
||||
| **"Managed by your organization" notices** | While hardened, Windows Settings and browser settings pages show a managed/policy notice. This is expected policy behaviour, not malware - but it can alarm users and support desks. | `-EnableAll` removes all values written by the tools and clears the notice. |
|
||||
| **Updates can revert changes** | Windows feature updates, cumulative updates and browser updates can re-enable items or re-create scheduled tasks. | Re-run `-Report` after major updates; re-apply as needed. |
|
||||
| **Upgrade readiness data** | Disabling the Compatibility Appraiser stops the inventory Microsoft uses to assess upgrade compatibility for your device. | Low impact for most; re-enable before a major feature upgrade if you want Microsoft's compatibility safeguards. |
|
||||
@@ -205,6 +217,64 @@ Key: `HKLM\SOFTWARE\Policies\Microsoft\Windows\System`
|
||||
| `HKCU\SOFTWARE\Policies\Microsoft\Windows\Explorer` -> `DisableSearchBoxSuggestions` | `1` | Removes Bing web search/suggestions from the Start menu and taskbar Search on Windows 11 - queries stay local. |
|
||||
| `HKCU\...\CurrentVersion\Search` -> `BingSearchEnabled` | `0` | The Windows 10-era equivalent of the above; largely ignored by Windows 11 but kept for completeness. |
|
||||
|
||||
#### Search / Cortana cloud
|
||||
Key: `HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search`
|
||||
|
||||
| Value | Hardened | Explanation |
|
||||
|---|---|---|
|
||||
| `AllowCortana` | `0` | Disables Cortana, which sends voice/text queries and context to Microsoft. |
|
||||
| `ConnectedSearchUseWeb` | `0` | Stops Start/Search sending typed queries to Bing for web results. |
|
||||
| `AllowCloudSearch` | `0` | Disables searching your OneDrive/Outlook/SharePoint content from the local search box (each query hits Microsoft cloud). |
|
||||
| `AllowSearchToUseLocation` | `0` | Stops the search/Cortana stack using your device location. |
|
||||
|
||||
#### Cloud sync (clipboard / settings)
|
||||
Keys: `HKLM\SOFTWARE\Policies\Microsoft\Windows\System` and `...\SettingSync`
|
||||
|
||||
| Value | Hardened | Explanation |
|
||||
|---|---|---|
|
||||
| `AllowClipboardHistory` | `0` | Disables local clipboard history (Win+V). Local only, but a data-retention surface. |
|
||||
| `AllowCrossDeviceClipboard` | `0` | Disables syncing clipboard **contents** to the Microsoft cloud for cross-device paste - potentially very sensitive data. |
|
||||
| `DisableSettingSync` (SettingSync key) | `2` | Stops Windows settings/credentials/preferences syncing across devices via your Microsoft account. |
|
||||
|
||||
#### Suggestions / ads (Content Delivery Manager - per-user, HKCU)
|
||||
Key: `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager`
|
||||
|
||||
| Value | Hardened | Explanation |
|
||||
|---|---|---|
|
||||
| `SilentInstalledAppsEnabled` | `0` | Stops Windows silently installing sponsored/suggested apps. |
|
||||
| `SystemPaneSuggestionsEnabled` | `0` | Removes app/content suggestions in the Start menu. |
|
||||
| `SubscribedContent-338393Enabled` | `0` | Removes suggested content in the Settings app. |
|
||||
| `SubscribedContent-338389Enabled` | `0` | Disables Windows tips/suggestion notifications. |
|
||||
| `RotatingLockScreenOverlayEnabled` | `0` | Disables Spotlight ads/"fun facts" overlaid on the lock screen. |
|
||||
|
||||
#### Location
|
||||
Key: `HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors`
|
||||
|
||||
| Value | Hardened | Explanation |
|
||||
|---|---|---|
|
||||
| `DisableLocation` | `1` | Turns off the system-wide location platform for all apps and services. |
|
||||
|
||||
#### Find My Device
|
||||
Key: `HKLM\SOFTWARE\Policies\Microsoft\FindMyDevice`
|
||||
|
||||
| Value | Hardened | Explanation |
|
||||
|---|---|---|
|
||||
| `AllowFindMyDevice` | `0` | Stops Windows periodically reporting device location to your Microsoft account. |
|
||||
|
||||
#### AI features (Copilot / Recall)
|
||||
|
||||
| Key / Value | Hardened | Explanation |
|
||||
|---|---|---|
|
||||
| `HKCU\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot` -> `TurnOffWindowsCopilot` | `1` | Disables the Windows Copilot assistant (prompts and context leave the device to Microsoft/OpenAI services). |
|
||||
| `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsAI` -> `DisableAIDataAnalysis` | `1` | Disables **Recall** screen-snapshot capture and analysis. Local-first, but a large capture surface; only present on Copilot+ PCs (24H2+). |
|
||||
|
||||
#### Network
|
||||
Key: `HKLM\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization`
|
||||
|
||||
| Value | Hardened | Explanation |
|
||||
|---|---|---|
|
||||
| `DODownloadMode` | `0` | Delivery Optimization peer sharing: `0` = HTTP only (no peers), `1` = LAN peers, `3` = internet peers. Hardened = your PC neither pulls from nor advertises update chunks to other machines. |
|
||||
|
||||
#### Windows SmartScreen `[SEC]` - reputation checks
|
||||
|
||||
| Key / Value | Hardened | Explanation |
|
||||
@@ -423,13 +493,146 @@ such in the `Name` column).
|
||||
|
||||
---
|
||||
|
||||
# 3. Manage-DefenderAntivirus.ps1
|
||||
|
||||
Views the **health of Microsoft Defender Antivirus** and lets you view/toggle
|
||||
its protection settings, plus run common actions (update signatures,
|
||||
quick/full scan, view threats and exclusions).
|
||||
|
||||
Unlike the other two tools this is a **security** tool, so the polarity is
|
||||
reversed: **On = protected (good, green)**, **Off = reduced protection (red)**.
|
||||
It uses the built-in Defender PowerShell module (`Get-MpComputerStatus`,
|
||||
`Get-MpPreference`, `Set-MpPreference`, `Update-MpSignature`, `Start-MpScan`)
|
||||
- **not** the registry, because Tamper Protection and policy layering make
|
||||
direct registry edits to Defender unreliable.
|
||||
|
||||
## Quick start
|
||||
|
||||
```powershell
|
||||
# View health + protection status (read-only, works as standard user)
|
||||
.\Manage-DefenderAntivirus.ps1 -Report
|
||||
|
||||
# Interactive menu (run ELEVATED to change settings, scan or update)
|
||||
.\Manage-DefenderAntivirus.ps1
|
||||
|
||||
# Set every protection to its recommended (ON) state
|
||||
.\Manage-DefenderAntivirus.ps1 -EnableRecommended
|
||||
|
||||
# Turn ALL protections OFF (reduces security; also stops Defender cloud
|
||||
# lookups and sample submission to Microsoft)
|
||||
.\Manage-DefenderAntivirus.ps1 -DisableAll
|
||||
|
||||
# Update signatures / run a scan and exit
|
||||
.\Manage-DefenderAntivirus.ps1 -Update
|
||||
.\Manage-DefenderAntivirus.ps1 -QuickScan
|
||||
.\Manage-DefenderAntivirus.ps1 -FullScan
|
||||
|
||||
# Export health + config to CSV
|
||||
.\Manage-DefenderAntivirus.ps1 -Csv .\defender-status.csv
|
||||
```
|
||||
|
||||
## Tamper Protection
|
||||
|
||||
On Windows 11, **Tamper Protection** is on by default and deliberately
|
||||
**blocks programmatic changes** to core protection (real-time monitoring,
|
||||
etc.). When it is on, `Set-MpPreference` calls for those items will fail -
|
||||
the tool detects this, shows a NOTE, and reports the failure clearly rather
|
||||
than pretending the change succeeded. To change guarded items you must first
|
||||
turn Tamper Protection off in the **Windows Security app** (Virus & threat
|
||||
protection -> Manage settings) or via Intune. The tool intentionally cannot
|
||||
disable Tamper Protection for you - that is by design.
|
||||
|
||||
## Health summary (read-only)
|
||||
|
||||
From `Get-MpComputerStatus`: running mode (Normal / Passive / EDR Block -
|
||||
passive means another AV is primary and Defender settings are inactive),
|
||||
AntiMalware service, real-time protection, behaviour monitor, on-access
|
||||
(IOAV), network inspection (NIS), Tamper Protection state, signature version
|
||||
and **age in days** (green <=2, yellow <=7, red older), engine version, and
|
||||
last quick/full scan times.
|
||||
|
||||
## Configurable protections
|
||||
|
||||
Each maps to one `Set-MpPreference` parameter. "Recommended" is always **On**.
|
||||
|
||||
| Protection | Preference | Recommended | Explanation |
|
||||
|---|---|---|---|
|
||||
| Real-time Monitoring | `DisableRealtimeMonitoring` | On (`$false`) | Core on-access scanning. Guarded by Tamper Protection. |
|
||||
| Behavior Monitoring | `DisableBehaviorMonitoring` | On (`$false`) | Detects malicious behaviour patterns at runtime. |
|
||||
| Downloads/Attachment Scan | `DisableIOAVProtection` | On (`$false`) | Scans files downloaded from internet/email. |
|
||||
| Script Scanning | `DisableScriptScanning` | On (`$false`) | Scans scripts before they execute. |
|
||||
| Archive Scanning | `DisableArchiveScanning` | On (`$false`) | Scans inside .zip/.rar/etc. |
|
||||
| Email Scanning | `DisableEmailScanning` | On (`$false`) | Parses mailbox/email files during scans. |
|
||||
| Removable Drive Scanning | `DisableRemovableDriveScanning` | On (`$false`) | Includes USB media in full scans. |
|
||||
| Cloud-delivered Protection | `MAPSReporting` | Advanced (`2`) | Real-time cloud lookups (`0` off, `1` basic, `2` advanced). |
|
||||
| Automatic Sample Submission `[PRIV]` | `SubmitSamplesConsent` | SendSafeSamples (`1`) | Needed for full cloud protection; **sends files to Microsoft**. `2` = Never (privacy). |
|
||||
| Cloud Block Level | `CloudBlockLevel` | High (`2`) | Aggressiveness of cloud blocking; higher = safer but more false positives. |
|
||||
| PUA Protection | `PUAProtection` | Enabled (`1`) | Blocks potentially unwanted apps (adware/bundleware); `2` = audit. |
|
||||
| Network Protection | `EnableNetworkProtection` | Enabled (`1`) | Blocks connections to malicious domains/IPs; `2` = audit. |
|
||||
| Controlled Folder Access | `EnableControlledFolderAccess` | Enabled (`1`) | Anti-ransomware; blocks untrusted apps writing to protected folders. May need app allow-listing. |
|
||||
|
||||
`[PRIV]` marks the one setting that improves protection but also sends data
|
||||
to Microsoft, so you can make an informed choice. **Audit mode** (for PUA /
|
||||
Network Protection / Controlled Folder Access) shows as `Other (AuditMode)` -
|
||||
it logs but does not block, useful for testing before enforcing.
|
||||
|
||||
## Menu commands
|
||||
|
||||
| Command | Action |
|
||||
|---|---|
|
||||
| `<n>` | Toggle protection *n* (disabling asks for `YES` confirmation) |
|
||||
| `e <n>` / `d <n>` | Enable / disable item *n* (`d` warns and confirms) |
|
||||
| `E` | Enable **all** recommended protections |
|
||||
| `D` | Disable **all** protections (requires typing `DISABLE-ALL`) |
|
||||
| `u` | Update signatures (`Update-MpSignature`) |
|
||||
| `s` / `f` | Run quick / full scan (`Start-MpScan`) |
|
||||
| `t` | Show recent threat detections |
|
||||
| `x` | Show configured exclusions (paths/extensions/processes) |
|
||||
| `r` / `c <path>` / `q` | Refresh / export CSV / quit |
|
||||
|
||||
### Bulk disable
|
||||
|
||||
This is a privacy/telemetry-hardening toolkit for advanced users, so a bulk
|
||||
disable is provided to match the other scripts:
|
||||
|
||||
- **CLI:** `-DisableAll` runs immediately (scriptable), then reprints status.
|
||||
- **Menu:** `D` requires typing `DISABLE-ALL` to confirm.
|
||||
|
||||
Disabling here doubles as privacy hardening: it sets `MAPSReporting` to
|
||||
Disabled and `SubmitSamplesConsent` to Never, which **stops Defender's cloud
|
||||
lookups and file/sample uploads to Microsoft**. Note that with **Tamper
|
||||
Protection on**, core items (real-time monitoring, etc.) stay ON regardless -
|
||||
turn Tamper Protection off in the Windows Security app first if you need
|
||||
those off too. Individual protections can still be re-enabled with `e <n>`
|
||||
or restored wholesale with `E` / `-EnableRecommended`.
|
||||
|
||||
## Requirements and caveats
|
||||
|
||||
- Needs the built-in **Defender module**; the tool exits cleanly if the
|
||||
cmdlets are absent (e.g. Defender removed, or a Server SKU without the
|
||||
feature).
|
||||
- Viewing works as a standard user; **changing settings, scanning and
|
||||
updating require Administrator**.
|
||||
- If a **third-party AV** is installed, Defender runs in **passive mode** and
|
||||
most of these settings will not take effect until Defender is primary
|
||||
again. The running-mode line makes this visible.
|
||||
- Exclusions are shown (`x`) but not edited here - review them, as each
|
||||
exclusion is a gap in coverage that malware can hide behind.
|
||||
|
||||
## CSV output columns
|
||||
|
||||
`Group (Health/Protection), Name, State, Note`
|
||||
|
||||
---
|
||||
|
||||
# Files
|
||||
|
||||
| File | Purpose |
|
||||
|---|---|
|
||||
| `Manage-WindowsTelemetry.ps1` | Windows telemetry view + control |
|
||||
| `Manage-BrowserPrivacy.ps1` | Browser privacy view + hardening |
|
||||
| `Manage-DefenderAntivirus.ps1` | Defender health + protection management |
|
||||
| `README.md` | This file |
|
||||
|
||||
Both CSV exports are useful for fleet auditing: run with `-Csv` on multiple
|
||||
All CSV exports are useful for fleet auditing: run with `-Csv` on multiple
|
||||
machines and diff or aggregate the results.
|
||||
|
||||
Reference in New Issue
Block a user