From 346ce562520f0f5343c02e04eae2d79267337c77 Mon Sep 17 00:00:00 2001 From: Daniel Card Date: Sun, 5 Jul 2026 05:11:39 +0100 Subject: [PATCH] Add files via upload --- Manage-DefenderAntivirus.ps1 | 608 +++++++++++++++++++++++++++++++++++ Manage-WindowsTelemetry.ps1 | 95 +++++- README.md | 217 ++++++++++++- 3 files changed, 910 insertions(+), 10 deletions(-) create mode 100644 Manage-DefenderAntivirus.ps1 diff --git a/Manage-DefenderAntivirus.ps1 b/Manage-DefenderAntivirus.ps1 new file mode 100644 index 0000000..03fe03e --- /dev/null +++ b/Manage-DefenderAntivirus.ps1 @@ -0,0 +1,608 @@ +#Requires -Version 5.1 +<# + Manage-DefenderAntivirus.ps1 + + Purpose : View the health of Microsoft Defender Antivirus and view/toggle + its protection settings, plus run common actions (update + signatures, quick/full scan, view threats and exclusions). + + IMPORTANT: This is a SECURITY tool. Unlike the telemetry/privacy scripts, + here "Enabled / On" is the DESIRED (protected) state and + "Off" REDUCES protection. Turning protections off is guarded + and should only be done deliberately (e.g. troubleshooting). + + How : Uses the built-in Defender PowerShell module (Get-MpComputerStatus, + Get-MpPreference, Set-MpPreference, Update-MpSignature, Start-MpScan). + Registry is intentionally NOT used - Tamper Protection and policy + layering make direct registry edits to Defender unreliable. + + Notes : - Windows PowerShell 5.1 compatible. ASCII-only source. + - Viewing works as a standard user; changing settings and running + scans require Administrator. + - TAMPER PROTECTION: when on (default on Windows 11), Windows + blocks programmatic changes to core protection. Such changes + will fail here by design - turn Tamper Protection off in the + Windows Security app first if you really need to change them. + + Usage : + .\Manage-DefenderAntivirus.ps1 # interactive menu + .\Manage-DefenderAntivirus.ps1 -Report # print status and exit + .\Manage-DefenderAntivirus.ps1 -EnableRecommended # set all to protected + .\Manage-DefenderAntivirus.ps1 -DisableAll # turn all protections OFF + .\Manage-DefenderAntivirus.ps1 -Update # update signatures and exit + .\Manage-DefenderAntivirus.ps1 -QuickScan # run a quick scan and exit + .\Manage-DefenderAntivirus.ps1 -Csv .\def.csv # export status and exit + + DISCLAIMER: USE AT YOUR OWN RISK. Provided as-is with no warranty. Disabling + antivirus protection exposes the system to malware. Review before use. +#> + +[CmdletBinding()] +param( + [switch]$Report, + [switch]$EnableRecommended, + [switch]$DisableAll, + [switch]$Update, + [switch]$QuickScan, + [switch]$FullScan, + [string]$Csv +) + +Set-StrictMode -Version 2.0 +$ErrorActionPreference = 'Stop' + +# --------------------------------------------------------------------------- +# Elevation / availability +# --------------------------------------------------------------------------- +function Test-IsAdmin { + $id = [Security.Principal.WindowsIdentity]::GetCurrent() + $pr = New-Object Security.Principal.WindowsPrincipal($id) + return $pr.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) +} + +$Script:IsAdmin = Test-IsAdmin + +if (-not (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue)) { + Write-Host 'Microsoft Defender PowerShell module not found on this system.' -ForegroundColor Red + Write-Host 'This tool requires the built-in Defender cmdlets (Windows client / Server' -ForegroundColor DarkYellow + Write-Host 'with the Defender feature installed). Nothing to do.' -ForegroundColor DarkYellow + return +} + +# --------------------------------------------------------------------------- +# Cached preference / status reads +# --------------------------------------------------------------------------- +$Script:Mp = $null +$Script:Status = $null + +function Get-MpPref { + if ($null -eq $Script:Mp) { $Script:Mp = Get-MpPreference } + return $Script:Mp +} +function Get-MpStatus { + if ($null -eq $Script:Status) { $Script:Status = Get-MpComputerStatus } + return $Script:Status +} +function Reset-MpCache { + $Script:Mp = $null + $Script:Status = $null +} + +# --------------------------------------------------------------------------- +# Control model +# Pref controls map to a single Set-MpPreference parameter. +# Kind: +# Bool - the parameter is a Disable* boolean; ProtectOn = $false. +# Enum - integer-backed; ProtectOn/ProtectOff are ints, Map gives labels. +# "On" (protected) is always the recommended state. +# --------------------------------------------------------------------------- +function New-PrefControl { + param( + [string]$Name, + [string]$PrefName, + [ValidateSet('Bool','Enum')][string]$Kind, + $ProtectOn, $ProtectOff, + [hashtable]$Map = $null, + [string]$Note = '', + [switch]$PrivacyTradeoff # feature that also sends data to Microsoft + ) + [pscustomobject]@{ + Type = 'Pref' + Name = $Name + PrefName = $PrefName + Kind = $Kind + ProtectOn = $ProtectOn + ProtectOff = $ProtectOff + Map = $Map + Note = $Note + PrivacyTradeoff = [bool]$PrivacyTradeoff + AdminReq = $true + } +} + +function Get-PrefRaw { + param($Ctrl) + $mp = Get-MpPref + try { return $mp.$($Ctrl.PrefName) } + catch { return $null } +} + +function Get-ControlState { + param($Ctrl) + $cur = Get-PrefRaw -Ctrl $Ctrl + if ($null -eq $cur) { return 'Unknown' } + + if ($Ctrl.Kind -eq 'Bool') { + if ([bool]$cur -eq [bool]$Ctrl.ProtectOn) { return 'On' } + if ([bool]$cur -eq [bool]$Ctrl.ProtectOff) { return 'Off' } + return ('? ({0})' -f $cur) + } else { + $curInt = $null + try { $curInt = [int]$cur } catch { return ('? ({0})' -f $cur) } + $label = $curInt + if ($Ctrl.Map -and $Ctrl.Map.ContainsKey($curInt)) { $label = $Ctrl.Map[$curInt] } + if ($curInt -eq [int]$Ctrl.ProtectOn) { return ('On ({0})' -f $label) } + if ($curInt -eq [int]$Ctrl.ProtectOff) { return ('Off ({0})' -f $label) } + return ('Other ({0})' -f $label) # e.g. Audit mode + } +} + +function Set-ControlValue { + param($Ctrl, [ValidateSet('Enable','Disable')][string]$Action) + $val = if ($Action -eq 'Enable') { $Ctrl.ProtectOn } else { $Ctrl.ProtectOff } + $splat = @{ $Ctrl.PrefName = $val } + Set-MpPreference @splat -ErrorAction Stop +} + +# --------------------------------------------------------------------------- +# Control catalog +# --------------------------------------------------------------------------- +function Get-Controls { + $c = New-Object System.Collections.ArrayList + + # --- Core real-time engine (Tamper Protection usually guards these) --- + [void]$c.Add( (New-PrefControl -Name 'Real-time Monitoring' -PrefName 'DisableRealtimeMonitoring' ` + -Kind Bool -ProtectOn $false -ProtectOff $true ` + -Note 'Core on-access scanning. Guarded by Tamper Protection.') ) + + [void]$c.Add( (New-PrefControl -Name 'Behavior Monitoring' -PrefName 'DisableBehaviorMonitoring' ` + -Kind Bool -ProtectOn $false -ProtectOff $true ` + -Note 'Detects malicious behaviour patterns at runtime.') ) + + [void]$c.Add( (New-PrefControl -Name 'Downloads/Attachment Scan (IOAV)' -PrefName 'DisableIOAVProtection' ` + -Kind Bool -ProtectOn $false -ProtectOff $true ` + -Note 'Scans files downloaded from the internet / email.') ) + + [void]$c.Add( (New-PrefControl -Name 'Script Scanning' -PrefName 'DisableScriptScanning' ` + -Kind Bool -ProtectOn $false -ProtectOff $true ` + -Note 'Scans scripts before they run.') ) + + # --- Scan surface --- + [void]$c.Add( (New-PrefControl -Name 'Archive Scanning' -PrefName 'DisableArchiveScanning' ` + -Kind Bool -ProtectOn $false -ProtectOff $true ` + -Note 'Scans inside .zip/.rar/etc during scans.') ) + + [void]$c.Add( (New-PrefControl -Name 'Email Scanning' -PrefName 'DisableEmailScanning' ` + -Kind Bool -ProtectOn $false -ProtectOff $true ` + -Note 'Parses mailbox/email files during scans.') ) + + [void]$c.Add( (New-PrefControl -Name 'Removable Drive Scanning' -PrefName 'DisableRemovableDriveScanning' ` + -Kind Bool -ProtectOn $false -ProtectOff $true ` + -Note 'Includes USB/removable media in full scans.') ) + + # --- Cloud protection --- + [void]$c.Add( (New-PrefControl -Name 'Cloud-delivered Protection (MAPS)' -PrefName 'MAPSReporting' ` + -Kind Enum -ProtectOn 2 -ProtectOff 0 ` + -Map @{ 0='Disabled'; 1='Basic'; 2='Advanced' } ` + -Note 'Real-time cloud lookups. Recommended: Advanced.') ) + + [void]$c.Add( (New-PrefControl -Name 'Automatic Sample Submission' -PrefName 'SubmitSamplesConsent' ` + -Kind Enum -ProtectOn 1 -ProtectOff 2 ` + -Map @{ 0='AlwaysPrompt'; 1='SendSafeSamples'; 2='NeverSend'; 3='SendAllSamples' } ` + -PrivacyTradeoff ` + -Note 'Needed for full cloud protection; sends files to Microsoft. 2=Never for privacy.') ) + + [void]$c.Add( (New-PrefControl -Name 'Cloud Block Level' -PrefName 'CloudBlockLevel' ` + -Kind Enum -ProtectOn 2 -ProtectOff 0 ` + -Map @{ 0='Default'; 1='Moderate'; 2='High'; 4='HighPlus'; 6='ZeroTolerance' } ` + -Note 'How aggressively cloud blocks suspicious files. Higher = safer, more false positives.') ) + + # --- Advanced protections --- + [void]$c.Add( (New-PrefControl -Name 'PUA Protection' -PrefName 'PUAProtection' ` + -Kind Enum -ProtectOn 1 -ProtectOff 0 ` + -Map @{ 0='Disabled'; 1='Enabled'; 2='AuditMode' } ` + -Note 'Blocks potentially unwanted apps (adware, bundleware).') ) + + [void]$c.Add( (New-PrefControl -Name 'Network Protection' -PrefName 'EnableNetworkProtection' ` + -Kind Enum -ProtectOn 1 -ProtectOff 0 ` + -Map @{ 0='Disabled'; 1='Enabled'; 2='AuditMode' } ` + -Note 'Blocks connections to malicious domains/IPs (SmartScreen for any app).') ) + + [void]$c.Add( (New-PrefControl -Name 'Controlled Folder Access' -PrefName 'EnableControlledFolderAccess' ` + -Kind Enum -ProtectOn 1 -ProtectOff 0 ` + -Map @{ 0='Disabled'; 1='Enabled'; 2='AuditMode' } ` + -Note 'Anti-ransomware: blocks untrusted apps writing to protected folders. May need app allow-listing.') ) + + return $c +} + +# --------------------------------------------------------------------------- +# Display: health summary +# --------------------------------------------------------------------------- +function Format-Bool { + param([bool]$Value, [bool]$GoodIsTrue = $true) + if ($Value) { return 'Yes' } else { return 'No' } +} + +# Safe property read - property names on MpComputerStatus vary by Windows build, +# and Set-StrictMode makes a missing property throw. Try each candidate name. +function Get-Prop { + param($Obj, [string[]]$Names, $Default = $null) + foreach ($n in $Names) { + if ($Obj.PSObject.Properties.Match($n).Count -gt 0) { + $v = $Obj.$n + if ($null -ne $v) { return $v } + } + } + return $Default +} + +function Show-Health { + $s = Get-MpStatus + + Write-Host '' + Write-Host '==================================================================' -ForegroundColor Cyan + Write-Host ' Microsoft Defender Antivirus - Health' -ForegroundColor Cyan + Write-Host (' Host: {0} Admin: {1} {2}' -f $env:COMPUTERNAME, $Script:IsAdmin, (Get-Date)) -ForegroundColor DarkCyan + Write-Host '==================================================================' -ForegroundColor Cyan + + function Line { + param([string]$Label, $Value, [string]$Color = 'Gray') + Write-Host (' {0,-32}' -f $Label) -NoNewline + Write-Host $Value -ForegroundColor $Color + } + + # Running mode (Normal / Passive / EDR Block / etc.) + $mode = Get-Prop $s @('AMRunningMode') 'Unknown' + $modeColor = if ($mode -eq 'Normal') { 'Green' } else { 'Yellow' } + Line 'Running mode' $mode $modeColor + if ($mode -ne 'Normal' -and $mode -ne 'Unknown') { + Write-Host ' (Passive/other mode: another AV may be primary; some settings inactive)' -ForegroundColor DarkYellow + } + + Line 'AntiMalware service' (Format-Bool $s.AMServiceEnabled) ($(if ($s.AMServiceEnabled) {'Green'} else {'Red'})) + Line 'Real-time protection' (Format-Bool $s.RealTimeProtectionEnabled) ($(if ($s.RealTimeProtectionEnabled) {'Green'} else {'Red'})) + Line 'Behavior monitor' (Format-Bool $s.BehaviorMonitorEnabled) ($(if ($s.BehaviorMonitorEnabled) {'Green'} else {'Yellow'})) + Line 'On-access (IOAV) protection' (Format-Bool $s.IoavProtectionEnabled) ($(if ($s.IoavProtectionEnabled) {'Green'} else {'Yellow'})) + Line 'Network inspection (NIS)' (Format-Bool $s.NISEnabled) ($(if ($s.NISEnabled) {'Green'} else {'Yellow'})) + Line 'Tamper Protection' (Format-Bool $s.IsTamperProtected) ($(if ($s.IsTamperProtected) {'Green'} else {'Yellow'})) + + # Signature freshness + $age = [int](Get-Prop $s @('AntivirusSignatureAge') 0) + $ageColor = if ($age -le 2) { 'Green' } elseif ($age -le 7) { 'Yellow' } else { 'Red' } + Line 'Signature version' (Get-Prop $s @('AntivirusSignatureVersion') 'n/a') 'Gray' + Line 'Signature age (days)' $age $ageColor + Line 'Engine version' (Get-Prop $s @('AMEngineVersion') 'n/a') 'Gray' + + # Last scans (property names differ across builds) + $lastQuick = Get-Prop $s @('QuickScanEndTime','LastQuickScanEndTime') 'never' + $lastFull = Get-Prop $s @('FullScanEndTime','LastFullScanEndTime') 'never' + Line 'Last quick scan' $lastQuick 'Gray' + Line 'Last full scan' $lastFull 'Gray' +} + +# --------------------------------------------------------------------------- +# Display: configurable protections +# --------------------------------------------------------------------------- +function Get-StateColor { + param([string]$State) + if ($State -like 'On*') { return 'Green' } + if ($State -like 'Off*') { return 'Red' } + if ($State -like 'Other*') { return 'Yellow' } # audit mode etc. + return 'DarkGray' +} + +function Show-Controls { + param($Controls) + + Write-Host '' + Write-Host ' Configurable protections (On = protected / recommended)' -ForegroundColor White + Write-Host (' {0,-3}{1,-36}{2}' -f '#', 'Protection', 'State') -ForegroundColor White + Write-Host (' {0,-3}{1,-36}{2}' -f '---', '----------', '-----') -ForegroundColor DarkGray + + $i = 0 + $nOff = 0 + foreach ($ctrl in $Controls) { + $i++ + $state = Get-ControlState -Ctrl $ctrl + if ($state -like 'Off*') { $nOff++ } + $tag = '' + if ($ctrl.PrivacyTradeoff) { $tag = ' [PRIV]' } + $lock = '' + if ($ctrl.AdminReq -and -not $Script:IsAdmin) { $lock = ' *' } + Write-Host (' {0,-3}{1,-36}' -f $i, ($ctrl.Name + $tag)) -NoNewline + Write-Host ($state + $lock) -ForegroundColor (Get-StateColor $state) + } + Write-Host (' {0,-3}{1,-36}{2}' -f '---', '----------', '-----') -ForegroundColor DarkGray + if ($nOff -gt 0) { + Write-Host (' WARNING: {0} protection(s) are currently OFF (reduced security)' -f $nOff) -ForegroundColor Red + } else { + Write-Host ' All listed protections are ON.' -ForegroundColor Green + } + Write-Host ' [PRIV] = also sends data to Microsoft (privacy tradeoff)' -ForegroundColor DarkCyan + if (-not $Script:IsAdmin) { + Write-Host ' * requires Administrator to change (run elevated)' -ForegroundColor DarkYellow + } + if ((Get-MpStatus).IsTamperProtected) { + Write-Host ' NOTE: Tamper Protection is ON - changes to core items may be blocked.' -ForegroundColor DarkYellow + } + Write-Host '' +} + +function Show-Status { + param($Controls) + Show-Health + Show-Controls -Controls $Controls +} + +function Export-StatusCsv { + param($Controls, [string]$Path) + $s = Get-MpStatus + $rows = New-Object System.Collections.ArrayList + + # Health rows + [void]$rows.Add([pscustomobject]@{ Group='Health'; Name='RealTimeProtection'; State=$s.RealTimeProtectionEnabled; Note='' }) + [void]$rows.Add([pscustomobject]@{ Group='Health'; Name='TamperProtection'; State=$s.IsTamperProtected; Note='' }) + [void]$rows.Add([pscustomobject]@{ Group='Health'; Name='SignatureAgeDays'; State=[int](Get-Prop $s @('AntivirusSignatureAge') 0); Note=(Get-Prop $s @('AntivirusSignatureVersion') 'n/a') }) + # Config rows + foreach ($ctrl in $Controls) { + [void]$rows.Add([pscustomobject]@{ + Group = 'Protection' + Name = $ctrl.Name + State = (Get-ControlState -Ctrl $ctrl) + Note = $ctrl.Note + }) + } + $rows | Export-Csv -Path $Path -NoTypeInformation -Encoding ASCII + Write-Host ("Status written to {0}" -f $Path) -ForegroundColor Green +} + +# --------------------------------------------------------------------------- +# Apply helpers +# --------------------------------------------------------------------------- +function Invoke-ControlAction { + param($Ctrl, [ValidateSet('Enable','Disable')][string]$Action) + + if ($Ctrl.AdminReq -and -not $Script:IsAdmin) { + Write-Host (" SKIP {0} (needs Administrator)" -f $Ctrl.Name) -ForegroundColor DarkYellow + return + } + try { + Set-ControlValue -Ctrl $Ctrl -Action $Action + Reset-MpCache + $new = Get-ControlState -Ctrl $Ctrl + Write-Host (" OK {0} -> {1}" -f $Ctrl.Name, $new) -ForegroundColor Green + } catch { + Write-Host (" FAIL {0}: {1}" -f $Ctrl.Name, $_.Exception.Message) -ForegroundColor Red + Write-Host ' (If Tamper Protection is on, this change is blocked by design.)' -ForegroundColor DarkYellow + } +} + +function Invoke-EnableRecommended { + param($Controls) + Write-Host '' + Write-Host 'Setting all protections to recommended (ON)...' -ForegroundColor Cyan + foreach ($ctrl in $Controls) { + $state = Get-ControlState -Ctrl $ctrl + if ($state -like 'On*') { + Write-Host (" -- {0} already On" -f $ctrl.Name) -ForegroundColor DarkGray + continue + } + Invoke-ControlAction -Ctrl $ctrl -Action Enable + } + Write-Host '' +} + +function Invoke-DisableAll { + param($Controls) + Write-Host '' + Write-Host 'Disabling ALL Defender protections (REDUCES SECURITY)...' -ForegroundColor Red + foreach ($ctrl in $Controls) { + $state = Get-ControlState -Ctrl $ctrl + if ($state -like 'Off*') { + Write-Host (" -- {0} already Off" -f $ctrl.Name) -ForegroundColor DarkGray + continue + } + Invoke-ControlAction -Ctrl $ctrl -Action Disable + } + Write-Host '' + if ((Get-MpStatus).IsTamperProtected) { + Write-Host 'Note: core items stay ON while Tamper Protection is enabled - turn it' -ForegroundColor DarkYellow + Write-Host ' off in the Windows Security app first if you need them off too.' -ForegroundColor DarkYellow + } + Write-Host 'This also stops Defender cloud lookups and sample submission to Microsoft.' -ForegroundColor DarkCyan + Write-Host '' +} + +# --------------------------------------------------------------------------- +# Actions: update / scan / threats / exclusions +# --------------------------------------------------------------------------- +function Invoke-Update { + if (-not $Script:IsAdmin) { Write-Host 'Signature update requires Administrator.' -ForegroundColor DarkYellow; return } + Write-Host 'Updating Defender signatures...' -ForegroundColor Cyan + try { + Update-MpSignature -ErrorAction Stop + Reset-MpCache + $s = Get-MpStatus + Write-Host ('Done. Signature version {0} (age {1} day(s)).' -f $s.AntivirusSignatureVersion, [int]$s.AntivirusSignatureAge) -ForegroundColor Green + } catch { + Write-Host ('Update failed: {0}' -f $_.Exception.Message) -ForegroundColor Red + } +} + +function Invoke-Scan { + param([ValidateSet('Quick','Full')][string]$Kind) + if (-not $Script:IsAdmin) { Write-Host 'Scanning requires Administrator.' -ForegroundColor DarkYellow; return } + Write-Host ("Starting {0} scan (this may take a while)..." -f $Kind) -ForegroundColor Cyan + try { + Start-MpScan -ScanType ($Kind + 'Scan') -ErrorAction Stop + Reset-MpCache + Write-Host 'Scan complete.' -ForegroundColor Green + } catch { + Write-Host ('Scan failed: {0}' -f $_.Exception.Message) -ForegroundColor Red + } +} + +function Show-Threats { + Write-Host '' + Write-Host 'Recent threat detections:' -ForegroundColor White + try { + $threats = @(Get-MpThreatDetection -ErrorAction Stop | Sort-Object InitialDetectionTime -Descending | Select-Object -First 15) + if ($threats.Count -eq 0) { + Write-Host ' None recorded.' -ForegroundColor Green + } else { + foreach ($t in $threats) { + $name = try { (Get-MpThreat -ThreatID $t.ThreatID -ErrorAction SilentlyContinue).ThreatName } catch { $t.ThreatID } + if (-not $name) { $name = $t.ThreatID } + Write-Host (' {0} {1} (action: {2})' -f $t.InitialDetectionTime, $name, $t.ThreatStatusID) -ForegroundColor Yellow + } + } + } catch { + Write-Host (' Could not read threat history: {0}' -f $_.Exception.Message) -ForegroundColor Red + } + Write-Host '' +} + +function Show-Exclusions { + $mp = Get-MpPref + Write-Host '' + Write-Host 'Configured exclusions (attack surface - review carefully):' -ForegroundColor White + function Dump { + param([string]$Label, $Items) + $arr = @($Items) + if ($arr.Count -eq 0) { Write-Host (' {0}: none' -f $Label) -ForegroundColor DarkGray; return } + Write-Host (' {0}:' -f $Label) -ForegroundColor Yellow + foreach ($x in $arr) { Write-Host (' {0}' -f $x) -ForegroundColor Gray } + } + Dump 'Paths' $mp.ExclusionPath + Dump 'Extensions' $mp.ExclusionExtension + Dump 'Processes' $mp.ExclusionProcess + Write-Host '' +} + +# --------------------------------------------------------------------------- +# Interactive menu +# --------------------------------------------------------------------------- +function Start-Menu { + param($Controls) + while ($true) { + Reset-MpCache + Show-Status -Controls $Controls + Write-Host 'Commands:' -ForegroundColor White + Write-Host ' toggle protection n (On<->Off)' + Write-Host ' e enable (protect) item n' + Write-Host ' d disable item n (REDUCES security)' + Write-Host ' E enable ALL recommended protections' + Write-Host ' D disable ALL protections (reduces security)' + Write-Host ' u update signatures' + Write-Host ' s run quick scan' + Write-Host ' f run full scan' + Write-Host ' t show recent threat detections' + Write-Host ' x show exclusions' + Write-Host ' r refresh view' + Write-Host ' c export status to CSV' + Write-Host ' q quit' + Write-Host '' + $inp = Read-Host 'Select' + if ([string]::IsNullOrWhiteSpace($inp)) { continue } + $inp = $inp.Trim() + + switch -Regex -CaseSensitive ($inp) { + '^[Qq]$' { return } + '^[Rr]$' { continue } + '^E$' { + Invoke-EnableRecommended -Controls $Controls + Read-Host 'Press Enter'; continue + } + '^D$' { + Write-Host '' + Write-Host 'WARNING: This disables ALL Defender protections listed above.' -ForegroundColor Red + Write-Host 'The system will be left without Defender antivirus coverage.' -ForegroundColor Red + if ((Read-Host 'Proceed? type DISABLE-ALL') -ceq 'DISABLE-ALL') { + Invoke-DisableAll -Controls $Controls + } + Read-Host 'Press Enter'; continue + } + '^[Uu]$' { Invoke-Update; Read-Host 'Press Enter'; continue } + '^[Ss]$' { Invoke-Scan -Kind Quick; Read-Host 'Press Enter'; continue } + '^[Ff]$' { Invoke-Scan -Kind Full; Read-Host 'Press Enter'; continue } + '^[Tt]$' { Show-Threats; Read-Host 'Press Enter'; continue } + '^[Xx]$' { Show-Exclusions; Read-Host 'Press Enter'; continue } + '^[Cc]\s+(.+)$' { + Export-StatusCsv -Controls $Controls -Path $Matches[1].Trim('"') + Read-Host 'Press Enter'; continue + } + '^[Ee]\s+(\d+)$' { + $n = [int]$Matches[1] + if ($n -ge 1 -and $n -le $Controls.Count) { Invoke-ControlAction -Ctrl $Controls[$n-1] -Action Enable } + else { Write-Host 'Out of range' -ForegroundColor Red } + Read-Host 'Press Enter'; continue + } + '^[Dd]\s+(\d+)$' { + $n = [int]$Matches[1] + if ($n -ge 1 -and $n -le $Controls.Count) { + $ctrl = $Controls[$n-1] + Write-Host '' + Write-Host ('WARNING: Disabling "{0}" reduces protection.' -f $ctrl.Name) -ForegroundColor Red + if ((Read-Host 'Proceed? type YES') -ceq 'YES') { + Invoke-ControlAction -Ctrl $ctrl -Action Disable + } + } else { Write-Host 'Out of range' -ForegroundColor Red } + Read-Host 'Press Enter'; continue + } + '^\d+$' { + $n = [int]$inp + if ($n -ge 1 -and $n -le $Controls.Count) { + $ctrl = $Controls[$n-1] + $state = Get-ControlState -Ctrl $ctrl + if ($state -like 'On*') { + Write-Host '' + Write-Host ('WARNING: Disabling "{0}" reduces protection.' -f $ctrl.Name) -ForegroundColor Red + if ((Read-Host 'Proceed? type YES') -ceq 'YES') { + Invoke-ControlAction -Ctrl $ctrl -Action Disable + } + } else { + Invoke-ControlAction -Ctrl $ctrl -Action Enable + } + } else { Write-Host 'Out of range' -ForegroundColor Red } + Read-Host 'Press Enter'; continue + } + default { Write-Host 'Unknown command' -ForegroundColor Red; Start-Sleep -Milliseconds 600 } + } + } +} + +# --------------------------------------------------------------------------- +# Main +# --------------------------------------------------------------------------- +$controls = Get-Controls + +if ($Update) { Invoke-Update; return } +if ($QuickScan) { Invoke-Scan -Kind Quick; return } +if ($FullScan) { Invoke-Scan -Kind Full; return } +if ($EnableRecommended) { Invoke-EnableRecommended -Controls $controls; Show-Status -Controls $controls; if ($Csv) { Export-StatusCsv -Controls $controls -Path $Csv }; return } +if ($DisableAll) { Invoke-DisableAll -Controls $controls; Show-Status -Controls $controls; if ($Csv) { Export-StatusCsv -Controls $controls -Path $Csv }; return } +if ($Report -or $Csv) { + if ($Report) { Show-Status -Controls $controls } + if ($Csv) { Export-StatusCsv -Controls $controls -Path $Csv } + return +} + +if (-not $Script:IsAdmin) { + Write-Host '' + Write-Host 'NOTE: Not running as Administrator. You can VIEW status, but changing' -ForegroundColor DarkYellow + Write-Host ' protections, updating signatures and scanning need an elevated' -ForegroundColor DarkYellow + Write-Host ' PowerShell window.' -ForegroundColor DarkYellow +} + +Start-Menu -Controls $controls diff --git a/Manage-WindowsTelemetry.ps1 b/Manage-WindowsTelemetry.ps1 index d27faad..215e6eb 100644 --- a/Manage-WindowsTelemetry.ps1 +++ b/Manage-WindowsTelemetry.ps1 @@ -14,9 +14,12 @@ appraiser, Cloud Content / Tailored Experiences, Activity History, Advertising ID, Feedback (SIUF), inking/typing and speech data, search suggestions, DiagTrack + related services, - telemetry scheduled tasks, and Windows SmartScreen ([SEC]: - apps-and-files check, Store app URL check, Enhanced Phishing - Protection - excluded from bulk disable unless requested). + telemetry scheduled tasks, Cortana/cloud search, cloud clipboard + and settings sync, suggestions/ads (Content Delivery Manager), + location, Find My Device, Copilot/Recall, Delivery Optimization, + and Windows SmartScreen ([SEC]: apps-and-files check, Store app + URL check, Enhanced Phishing Protection - excluded from bulk + disable unless requested). Notes : - Windows PowerShell 5.1 compatible. ASCII-only source. - Registry (HKLM) and service changes require Administrator. @@ -382,6 +385,92 @@ function Get-Controls { -ValueName 'BingSearchEnabled' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable ` -Note 'Win10-era value; largely ignored on Win11') ) + # --- Search / Cortana cloud --- + [void]$c.Add( (New-RegControl -Name 'Cortana' -Category 'Search/Cortana' ` + -Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\Windows Search' ` + -ValueName 'AllowCortana' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable) ) + + [void]$c.Add( (New-RegControl -Name 'Search Web Results (Cloud)' -Category 'Search/Cortana' ` + -Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\Windows Search' ` + -ValueName 'ConnectedSearchUseWeb' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable ` + -Note 'Bing web results in Start/Search') ) + + [void]$c.Add( (New-RegControl -Name 'Cloud Content Search' -Category 'Search/Cortana' ` + -Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\Windows Search' ` + -ValueName 'AllowCloudSearch' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable ` + -Note 'Search of OneDrive/Outlook/SharePoint content') ) + + [void]$c.Add( (New-RegControl -Name 'Search Uses Location' -Category 'Search/Cortana' ` + -Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\Windows Search' ` + -ValueName 'AllowSearchToUseLocation' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable) ) + + # --- Cloud sync (clipboard / settings) --- + [void]$c.Add( (New-RegControl -Name 'Clipboard History' -Category 'Cloud Sync' ` + -Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\System' ` + -ValueName 'AllowClipboardHistory' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable ` + -Note 'Local clipboard history (Win+V)') ) + + [void]$c.Add( (New-RegControl -Name 'Cross-Device Clipboard (Cloud)' -Category 'Cloud Sync' ` + -Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\System' ` + -ValueName 'AllowCrossDeviceClipboard' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable ` + -Note 'Syncs clipboard contents to Microsoft cloud') ) + + [void]$c.Add( (New-RegControl -Name 'Settings Sync' -Category 'Cloud Sync' ` + -Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\SettingSync' ` + -ValueName 'DisableSettingSync' -OnValue 0 -OffValue 2 -Default On -RemoveOnEnable ` + -Note 'Syncs Windows settings across devices via MS account') ) + + # --- Suggestions / ads (Content Delivery Manager, per-user) --- + [void]$c.Add( (New-RegControl -Name 'Auto-install Suggested Apps' -Category 'Suggestions/Ads' ` + -Hive HKCU -Path 'SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' ` + -ValueName 'SilentInstalledAppsEnabled' -OnValue 1 -OffValue 0 -Default On) ) + + [void]$c.Add( (New-RegControl -Name 'Start Menu Suggestions' -Category 'Suggestions/Ads' ` + -Hive HKCU -Path 'SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' ` + -ValueName 'SystemPaneSuggestionsEnabled' -OnValue 1 -OffValue 0 -Default On) ) + + [void]$c.Add( (New-RegControl -Name 'Settings App Suggestions' -Category 'Suggestions/Ads' ` + -Hive HKCU -Path 'SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' ` + -ValueName 'SubscribedContent-338393Enabled' -OnValue 1 -OffValue 0 -Default On) ) + + [void]$c.Add( (New-RegControl -Name 'Tips and Notifications' -Category 'Suggestions/Ads' ` + -Hive HKCU -Path 'SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' ` + -ValueName 'SubscribedContent-338389Enabled' -OnValue 1 -OffValue 0 -Default On ` + -Note 'Windows tips/suggestion notifications') ) + + [void]$c.Add( (New-RegControl -Name 'Lock Screen Spotlight' -Category 'Suggestions/Ads' ` + -Hive HKCU -Path 'SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' ` + -ValueName 'RotatingLockScreenOverlayEnabled' -OnValue 1 -OffValue 0 -Default On ` + -Note 'Spotlight ads/facts on the lock screen') ) + + # --- Location --- + [void]$c.Add( (New-RegControl -Name 'Location Platform' -Category 'Location' ` + -Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors' ` + -ValueName 'DisableLocation' -OnValue 0 -OffValue 1 -Default On -RemoveOnEnable ` + -Note 'System-wide location services') ) + + # --- Find My Device --- + [void]$c.Add( (New-RegControl -Name 'Find My Device' -Category 'Find My Device' ` + -Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\FindMyDevice' ` + -ValueName 'AllowFindMyDevice' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable ` + -Note 'Periodic location reporting to your MS account') ) + + # --- AI features (Copilot / Recall) --- + [void]$c.Add( (New-RegControl -Name 'Windows Copilot' -Category 'AI' ` + -Hive HKCU -Path 'SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot' ` + -ValueName 'TurnOffWindowsCopilot' -OnValue 0 -OffValue 1 -Default On -RemoveOnEnable) ) + + [void]$c.Add( (New-RegControl -Name 'Recall (AI Data Analysis)' -Category 'AI' ` + -Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\WindowsAI' ` + -ValueName 'DisableAIDataAnalysis' -OnValue 0 -OffValue 1 -Default On -RemoveOnEnable ` + -Note 'Recall screen snapshots (Copilot+ PCs)') ) + + # --- Delivery Optimization (update peer sharing) --- + [void]$c.Add( (New-RegControl -Name 'Delivery Optimization P2P' -Category 'Network' ` + -Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization' ` + -ValueName 'DODownloadMode' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable ` + -Note '0=HTTP only (no peers) 1=LAN 3=Internet peers') ) + # --- Windows SmartScreen: OS-level URL/file reputation (SECURITY) --- # These check apps, files and URLs against Microsoft's cloud reputation # service. Disabling them REDUCES protection against malware/phishing. diff --git a/README.md b/README.md index 51f4cd8..b240489 100644 --- a/README.md +++ b/README.md @@ -6,11 +6,23 @@ Two single-file, dependency-free PowerShell 5.1 scripts: |---|---| | `Manage-WindowsTelemetry.ps1` | Windows 11 telemetry / diagnostic-data settings, services and scheduled tasks | | `Manage-BrowserPrivacy.ps1` | Privacy / telemetry policies for Edge, Chrome, Firefox and Brave | +| `Manage-DefenderAntivirus.ps1` | Microsoft Defender Antivirus health, protection settings, scans and updates | -Both share the same UX: a color-coded status view (**Enabled** = collecting, -**Disabled** = hardened), interactive per-item toggling, one-shot -`-DisableAll` / `-EnableAll`, `-Report`, and CSV export. Both are ASCII-only, -BOM-free, module-free, and run in stock `powershell.exe` on Windows 11. +All three share the same UX: a color-coded status view, interactive per-item +toggling, `-Report`, and CSV export. They are ASCII-only, BOM-free, and run +in stock `powershell.exe` on Windows 11. + +**Intended audience:** this is a privacy-enabling / telemetry-disabling +toolkit for **advanced users and administrators** who understand the +tradeoffs. It is **not** aimed at general users and it deliberately exposes +switches that reduce data sharing *and* switches that reduce security +protection. Know what each item does before you flip it. + +**Important difference in orientation:** in the telemetry and browser tools, +**Disabled = hardened** (you turn data collection *off*). In the Defender +tool the polarity is **reversed** - **On/Enabled = protected/recommended**, +and turning a protection *off* reduces security. Each tool's status view is +labelled accordingly. > **Disclaimer - USE AT YOUR OWN RISK.** These scripts modify registry > values, service startup types and scheduled tasks. They are provided as-is, @@ -26,11 +38,11 @@ Read this before running either script with `-DisableAll` or the menu | Risk | Detail | Mitigation | |---|---|---| -| **Reduced malware/phishing protection** | Disabling the `[SEC]` items (Windows SmartScreen, Edge SmartScreen, Chrome/Brave Safe Browsing) removes URL, download and app reputation warnings. This is a genuine security downgrade. | `[SEC]` items are excluded from bulk disable by default; only disable them deliberately, and only if other filtering (DNS/proxy/EDR) covers the gap. | +| **Reduced malware/phishing protection** | Disabling the `[SEC]` items (Windows SmartScreen, Edge SmartScreen, Chrome/Brave Safe Browsing) removes URL, download and app reputation warnings. Likewise the **Defender** tool's `-DisableAll` / menu `D` turns off real-time monitoring, cloud protection, network protection and controlled folder access - a direct antivirus downgrade that leaves the machine without Defender coverage. | Browser `[SEC]` items are excluded from bulk disable by default; the Defender bulk disable requires an explicit switch/confirmation. Only disable deliberately, and only if other controls (DNS/proxy/EDR) cover the gap. | | **Managed / corporate machines** | On a domain-joined or Intune/MDM-managed device, these settings may be owned by your organisation. Changing them can conflict with GPO/MDM (which will usually re-apply), break compliance posture, or violate your IT policy. | Only run on machines you own or are authorised to change. Expect GPO/MDM to win any conflict. | | **MDM / provisioning breakage** | Disabling `dmwappushservice` can break provisioning-package installation (`Add-ProvisioningPackage`) and some MDM enrolment flows. | Skip that item (or re-enable it) on devices that will be enrolled. | | **Lost crash reporting** | Disabling Windows Error Reporting stops crash reports to Microsoft, and WER-based *local* workflows too (e.g. LocalDumps collection for debugging). | Re-enable WER while troubleshooting crashes. | -| **Feature loss** | Some features depend on the data flows being disabled: Find My Device, Windows Insider Program (requires Optional diagnostic data), inking/typing personalisation, cross-device Timeline/resume, cloud speech recognition, live search suggestions. | Review the per-setting tables below and keep the items you use enabled. | +| **Feature loss** | Some features depend on the data flows being disabled: Find My Device, Windows Insider Program (requires Optional diagnostic data), inking/typing personalisation, cross-device Timeline/resume, cloud speech recognition, live search suggestions, Cortana, cross-device clipboard paste, settings sync across devices, location-aware apps (maps/weather/timezone), Windows Copilot and Recall. | Review the per-setting tables below and keep the items you use enabled. | | **"Managed by your organization" notices** | While hardened, Windows Settings and browser settings pages show a managed/policy notice. This is expected policy behaviour, not malware - but it can alarm users and support desks. | `-EnableAll` removes all values written by the tools and clears the notice. | | **Updates can revert changes** | Windows feature updates, cumulative updates and browser updates can re-enable items or re-create scheduled tasks. | Re-run `-Report` after major updates; re-apply as needed. | | **Upgrade readiness data** | Disabling the Compatibility Appraiser stops the inventory Microsoft uses to assess upgrade compatibility for your device. | Low impact for most; re-enable before a major feature upgrade if you want Microsoft's compatibility safeguards. | @@ -205,6 +217,64 @@ Key: `HKLM\SOFTWARE\Policies\Microsoft\Windows\System` | `HKCU\SOFTWARE\Policies\Microsoft\Windows\Explorer` -> `DisableSearchBoxSuggestions` | `1` | Removes Bing web search/suggestions from the Start menu and taskbar Search on Windows 11 - queries stay local. | | `HKCU\...\CurrentVersion\Search` -> `BingSearchEnabled` | `0` | The Windows 10-era equivalent of the above; largely ignored by Windows 11 but kept for completeness. | +#### Search / Cortana cloud +Key: `HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search` + +| Value | Hardened | Explanation | +|---|---|---| +| `AllowCortana` | `0` | Disables Cortana, which sends voice/text queries and context to Microsoft. | +| `ConnectedSearchUseWeb` | `0` | Stops Start/Search sending typed queries to Bing for web results. | +| `AllowCloudSearch` | `0` | Disables searching your OneDrive/Outlook/SharePoint content from the local search box (each query hits Microsoft cloud). | +| `AllowSearchToUseLocation` | `0` | Stops the search/Cortana stack using your device location. | + +#### Cloud sync (clipboard / settings) +Keys: `HKLM\SOFTWARE\Policies\Microsoft\Windows\System` and `...\SettingSync` + +| Value | Hardened | Explanation | +|---|---|---| +| `AllowClipboardHistory` | `0` | Disables local clipboard history (Win+V). Local only, but a data-retention surface. | +| `AllowCrossDeviceClipboard` | `0` | Disables syncing clipboard **contents** to the Microsoft cloud for cross-device paste - potentially very sensitive data. | +| `DisableSettingSync` (SettingSync key) | `2` | Stops Windows settings/credentials/preferences syncing across devices via your Microsoft account. | + +#### Suggestions / ads (Content Delivery Manager - per-user, HKCU) +Key: `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager` + +| Value | Hardened | Explanation | +|---|---|---| +| `SilentInstalledAppsEnabled` | `0` | Stops Windows silently installing sponsored/suggested apps. | +| `SystemPaneSuggestionsEnabled` | `0` | Removes app/content suggestions in the Start menu. | +| `SubscribedContent-338393Enabled` | `0` | Removes suggested content in the Settings app. | +| `SubscribedContent-338389Enabled` | `0` | Disables Windows tips/suggestion notifications. | +| `RotatingLockScreenOverlayEnabled` | `0` | Disables Spotlight ads/"fun facts" overlaid on the lock screen. | + +#### Location +Key: `HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors` + +| Value | Hardened | Explanation | +|---|---|---| +| `DisableLocation` | `1` | Turns off the system-wide location platform for all apps and services. | + +#### Find My Device +Key: `HKLM\SOFTWARE\Policies\Microsoft\FindMyDevice` + +| Value | Hardened | Explanation | +|---|---|---| +| `AllowFindMyDevice` | `0` | Stops Windows periodically reporting device location to your Microsoft account. | + +#### AI features (Copilot / Recall) + +| Key / Value | Hardened | Explanation | +|---|---|---| +| `HKCU\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot` -> `TurnOffWindowsCopilot` | `1` | Disables the Windows Copilot assistant (prompts and context leave the device to Microsoft/OpenAI services). | +| `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsAI` -> `DisableAIDataAnalysis` | `1` | Disables **Recall** screen-snapshot capture and analysis. Local-first, but a large capture surface; only present on Copilot+ PCs (24H2+). | + +#### Network +Key: `HKLM\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization` + +| Value | Hardened | Explanation | +|---|---|---| +| `DODownloadMode` | `0` | Delivery Optimization peer sharing: `0` = HTTP only (no peers), `1` = LAN peers, `3` = internet peers. Hardened = your PC neither pulls from nor advertises update chunks to other machines. | + #### Windows SmartScreen `[SEC]` - reputation checks | Key / Value | Hardened | Explanation | @@ -423,13 +493,146 @@ such in the `Name` column). --- +# 3. Manage-DefenderAntivirus.ps1 + +Views the **health of Microsoft Defender Antivirus** and lets you view/toggle +its protection settings, plus run common actions (update signatures, +quick/full scan, view threats and exclusions). + +Unlike the other two tools this is a **security** tool, so the polarity is +reversed: **On = protected (good, green)**, **Off = reduced protection (red)**. +It uses the built-in Defender PowerShell module (`Get-MpComputerStatus`, +`Get-MpPreference`, `Set-MpPreference`, `Update-MpSignature`, `Start-MpScan`) +- **not** the registry, because Tamper Protection and policy layering make +direct registry edits to Defender unreliable. + +## Quick start + +```powershell +# View health + protection status (read-only, works as standard user) +.\Manage-DefenderAntivirus.ps1 -Report + +# Interactive menu (run ELEVATED to change settings, scan or update) +.\Manage-DefenderAntivirus.ps1 + +# Set every protection to its recommended (ON) state +.\Manage-DefenderAntivirus.ps1 -EnableRecommended + +# Turn ALL protections OFF (reduces security; also stops Defender cloud +# lookups and sample submission to Microsoft) +.\Manage-DefenderAntivirus.ps1 -DisableAll + +# Update signatures / run a scan and exit +.\Manage-DefenderAntivirus.ps1 -Update +.\Manage-DefenderAntivirus.ps1 -QuickScan +.\Manage-DefenderAntivirus.ps1 -FullScan + +# Export health + config to CSV +.\Manage-DefenderAntivirus.ps1 -Csv .\defender-status.csv +``` + +## Tamper Protection + +On Windows 11, **Tamper Protection** is on by default and deliberately +**blocks programmatic changes** to core protection (real-time monitoring, +etc.). When it is on, `Set-MpPreference` calls for those items will fail - +the tool detects this, shows a NOTE, and reports the failure clearly rather +than pretending the change succeeded. To change guarded items you must first +turn Tamper Protection off in the **Windows Security app** (Virus & threat +protection -> Manage settings) or via Intune. The tool intentionally cannot +disable Tamper Protection for you - that is by design. + +## Health summary (read-only) + +From `Get-MpComputerStatus`: running mode (Normal / Passive / EDR Block - +passive means another AV is primary and Defender settings are inactive), +AntiMalware service, real-time protection, behaviour monitor, on-access +(IOAV), network inspection (NIS), Tamper Protection state, signature version +and **age in days** (green <=2, yellow <=7, red older), engine version, and +last quick/full scan times. + +## Configurable protections + +Each maps to one `Set-MpPreference` parameter. "Recommended" is always **On**. + +| Protection | Preference | Recommended | Explanation | +|---|---|---|---| +| Real-time Monitoring | `DisableRealtimeMonitoring` | On (`$false`) | Core on-access scanning. Guarded by Tamper Protection. | +| Behavior Monitoring | `DisableBehaviorMonitoring` | On (`$false`) | Detects malicious behaviour patterns at runtime. | +| Downloads/Attachment Scan | `DisableIOAVProtection` | On (`$false`) | Scans files downloaded from internet/email. | +| Script Scanning | `DisableScriptScanning` | On (`$false`) | Scans scripts before they execute. | +| Archive Scanning | `DisableArchiveScanning` | On (`$false`) | Scans inside .zip/.rar/etc. | +| Email Scanning | `DisableEmailScanning` | On (`$false`) | Parses mailbox/email files during scans. | +| Removable Drive Scanning | `DisableRemovableDriveScanning` | On (`$false`) | Includes USB media in full scans. | +| Cloud-delivered Protection | `MAPSReporting` | Advanced (`2`) | Real-time cloud lookups (`0` off, `1` basic, `2` advanced). | +| Automatic Sample Submission `[PRIV]` | `SubmitSamplesConsent` | SendSafeSamples (`1`) | Needed for full cloud protection; **sends files to Microsoft**. `2` = Never (privacy). | +| Cloud Block Level | `CloudBlockLevel` | High (`2`) | Aggressiveness of cloud blocking; higher = safer but more false positives. | +| PUA Protection | `PUAProtection` | Enabled (`1`) | Blocks potentially unwanted apps (adware/bundleware); `2` = audit. | +| Network Protection | `EnableNetworkProtection` | Enabled (`1`) | Blocks connections to malicious domains/IPs; `2` = audit. | +| Controlled Folder Access | `EnableControlledFolderAccess` | Enabled (`1`) | Anti-ransomware; blocks untrusted apps writing to protected folders. May need app allow-listing. | + +`[PRIV]` marks the one setting that improves protection but also sends data +to Microsoft, so you can make an informed choice. **Audit mode** (for PUA / +Network Protection / Controlled Folder Access) shows as `Other (AuditMode)` - +it logs but does not block, useful for testing before enforcing. + +## Menu commands + +| Command | Action | +|---|---| +| `` | Toggle protection *n* (disabling asks for `YES` confirmation) | +| `e ` / `d ` | Enable / disable item *n* (`d` warns and confirms) | +| `E` | Enable **all** recommended protections | +| `D` | Disable **all** protections (requires typing `DISABLE-ALL`) | +| `u` | Update signatures (`Update-MpSignature`) | +| `s` / `f` | Run quick / full scan (`Start-MpScan`) | +| `t` | Show recent threat detections | +| `x` | Show configured exclusions (paths/extensions/processes) | +| `r` / `c ` / `q` | Refresh / export CSV / quit | + +### Bulk disable + +This is a privacy/telemetry-hardening toolkit for advanced users, so a bulk +disable is provided to match the other scripts: + +- **CLI:** `-DisableAll` runs immediately (scriptable), then reprints status. +- **Menu:** `D` requires typing `DISABLE-ALL` to confirm. + +Disabling here doubles as privacy hardening: it sets `MAPSReporting` to +Disabled and `SubmitSamplesConsent` to Never, which **stops Defender's cloud +lookups and file/sample uploads to Microsoft**. Note that with **Tamper +Protection on**, core items (real-time monitoring, etc.) stay ON regardless - +turn Tamper Protection off in the Windows Security app first if you need +those off too. Individual protections can still be re-enabled with `e ` +or restored wholesale with `E` / `-EnableRecommended`. + +## Requirements and caveats + +- Needs the built-in **Defender module**; the tool exits cleanly if the + cmdlets are absent (e.g. Defender removed, or a Server SKU without the + feature). +- Viewing works as a standard user; **changing settings, scanning and + updating require Administrator**. +- If a **third-party AV** is installed, Defender runs in **passive mode** and + most of these settings will not take effect until Defender is primary + again. The running-mode line makes this visible. +- Exclusions are shown (`x`) but not edited here - review them, as each + exclusion is a gap in coverage that malware can hide behind. + +## CSV output columns + +`Group (Health/Protection), Name, State, Note` + +--- + # Files | File | Purpose | |---|---| | `Manage-WindowsTelemetry.ps1` | Windows telemetry view + control | | `Manage-BrowserPrivacy.ps1` | Browser privacy view + hardening | +| `Manage-DefenderAntivirus.ps1` | Defender health + protection management | | `README.md` | This file | -Both CSV exports are useful for fleet auditing: run with `-Csv` on multiple +All CSV exports are useful for fleet auditing: run with `-Csv` on multiple machines and diff or aggregate the results.