From 70c6316a2ce549a86bb8a102195a504e095caabd Mon Sep 17 00:00:00 2001 From: Daniel Card Date: Sat, 4 Jul 2026 22:12:04 +0100 Subject: [PATCH] Add files via upload --- Manage-BrowserPrivacy.ps1 | 48 ++++++++++++++----- Manage-WindowsTelemetry.ps1 | 96 ++++++++++++++++++++++++++++++++----- README.md | 25 ++++++++-- 3 files changed, 140 insertions(+), 29 deletions(-) diff --git a/Manage-BrowserPrivacy.ps1 b/Manage-BrowserPrivacy.ps1 index e69e597..7dc7127 100644 --- a/Manage-BrowserPrivacy.ps1 +++ b/Manage-BrowserPrivacy.ps1 @@ -205,9 +205,9 @@ function Get-Controls { [void]$c.Add( (New-PolicyControl -Name 'Spotlight Recommendations' -Browser Edge -PolicyPath $edge ` -ValueName 'SpotlightExperiencesAndRecommendationsEnabled' -OnValue 1 -OffValue 0) ) - [void]$c.Add( (New-PolicyControl -Name 'Do Not Track OFF' -Browser Edge -PolicyPath $edge ` + [void]$c.Add( (New-PolicyControl -Name 'DNT Header Not Sent' -Browser Edge -PolicyPath $edge ` -ValueName 'ConfigureDoNotTrack' -OnValue 0 -OffValue 1 ` - -Note 'Disabled = DNT header IS sent (hardened)') ) + -Note 'Disabled = Do Not Track header IS sent (hardened)') ) [void]$c.Add( (New-PolicyControl -Name 'Nav Error Web Service' -Browser Edge -PolicyPath $edge ` -ValueName 'ResolveNavigationErrorsUseWebService' -OnValue 1 -OffValue 0) ) @@ -370,27 +370,32 @@ function Show-Status { Write-Host ('{0,-4}{1,-36}{2,-10}{3}' -f '---', '-------', '-------', '-----') -ForegroundColor DarkGray $i = 0 - $nEnabled = 0; $nDisabled = 0; $nSecOff = 0 + $nEnabled = 0; $nDisabled = 0; $nSecOff = 0; $nNotInstalled = 0 foreach ($ctrl in $Controls) { $i++ - $state = Get-ControlState -Ctrl $ctrl - if ($state -like 'Enabled*') { $nEnabled++ } - elseif ($state -like 'Disabled*') { $nDisabled++ } + $state = Get-ControlState -Ctrl $ctrl + $installed = $Script:Browsers[$ctrl.Category].Installed + if ($installed) { + if ($state -like 'Enabled*') { $nEnabled++ } + elseif ($state -like 'Disabled*') { $nDisabled++ } + } else { $nNotInstalled++ } $sec = '' if ($ctrl.Security) { $sec = ' [SEC]' - if ($state -like 'Disabled*') { $nSecOff++ } + if ($installed -and $state -like 'Disabled*') { $nSecOff++ } } $lock = '' if ($ctrl.AdminReq -and -not $Script:IsAdmin) { $lock = ' *' } $flag = '' - if (-not $Script:Browsers[$ctrl.Category].Installed) { $flag = ' (not installed)' } + if (-not $installed) { $flag = ' (not installed)' } $line = ('{0,-4}{1,-36}{2,-10}' -f $i, ($ctrl.Name + $sec), $ctrl.Category) Write-Host $line -NoNewline Write-Host ($state + $lock + $flag) -ForegroundColor (Get-StateColor $state) } Write-Host ('{0,-4}{1,-36}{2,-10}{3}' -f '---', '-------', '-------', '-----') -ForegroundColor DarkGray - Write-Host (' Summary: {0} enabled, {1} disabled' -f $nEnabled, $nDisabled) -ForegroundColor White + $summary = (' Summary: {0} enabled, {1} disabled' -f $nEnabled, $nDisabled) + if ($nNotInstalled -gt 0) { $summary += (' ({0} not counted: browser not installed)' -f $nNotInstalled) } + Write-Host $summary -ForegroundColor White Write-Host ' [SEC] = anti-malware URL/site check. Disabling REDUCES protection' -ForegroundColor DarkYellow if ($nSecOff -gt 0) { Write-Host (' WARNING: {0} security URL-check feature(s) are currently OFF' -f $nSecOff) -ForegroundColor Red @@ -479,7 +484,8 @@ function Start-Menu { Write-Host ' D disable ALL (harden; keeps [SEC] URL checks ON)' Write-Host ' E enable ALL (restore browser defaults)' Write-Host ' S disable ALL [SEC] URL-check features (reduces security)' - Write-Host ' b apply D to one browser (e.g. b Edge)' + Write-Host ' b harden one browser (e.g. b Edge)' + Write-Host ' B restore one browser (e.g. B Edge)' Write-Host ' r refresh view' Write-Host ' c export status to CSV' Write-Host ' q quit' @@ -506,6 +512,10 @@ function Start-Menu { } '^S$' { $secList = @($Controls | Where-Object { $_.Security }) + if ($secList.Count -eq 0) { + Write-Host 'No [SEC] controls for the detected browsers.' -ForegroundColor DarkYellow + Read-Host 'Press Enter'; continue + } Write-Host '' Write-Host 'WARNING: This turns OFF anti-malware URL/site reputation checks' -ForegroundColor Red Write-Host ('(SmartScreen / Safe Browsing) for {0} item(s). Your browser will' -f $secList.Count) -ForegroundColor Red @@ -515,7 +525,17 @@ function Start-Menu { } Read-Host 'Press Enter'; continue } - '^[Bb]\s+(\w+)$' { + '^B\s+(\w+)$' { + $target = $Matches[1] + $subset = @($Controls | Where-Object { $_.Category -eq $target }) + if ($subset.Count -eq 0) { + Write-Host ('No controls for browser "{0}" (use Edge/Chrome/Firefox/Brave)' -f $target) -ForegroundColor Red + } elseif ((Read-Host ('Restore all {0} defaults? type YES' -f $target)) -ceq 'YES') { + Invoke-AllAction -Controls $subset -Action Enable + } + Read-Host 'Press Enter'; continue + } + '^b\s+(\w+)$' { $target = $Matches[1] $subset = @($Controls | Where-Object { $_.Category -eq $target }) if ($subset.Count -eq 0) { @@ -551,7 +571,7 @@ function Start-Menu { } else { Write-Host 'Out of range' -ForegroundColor Red } Read-Host 'Press Enter'; continue } - default { Write-Host 'Unknown command (d/e need an item number; D/E alone mean ALL)' -ForegroundColor Red; Start-Sleep -Milliseconds 600 } + default { Write-Host 'Unknown command (d/e need an item number; D/E/S alone act on ALL; b/B )' -ForegroundColor Red; Start-Sleep -Milliseconds 600 } } } } @@ -561,6 +581,10 @@ function Start-Menu { # --------------------------------------------------------------------------- $controls = Get-Controls +if ($IncludeSecurity -and -not $DisableAll) { + Write-Host 'NOTE: -IncludeSecurity only has an effect together with -DisableAll; ignoring it.' -ForegroundColor DarkYellow +} + if (@($controls).Count -eq 0) { Write-Host 'No supported browsers detected (Edge/Chrome/Firefox/Brave).' -ForegroundColor Red Write-Host 'Use -IncludeAll to manage policies for browsers not yet installed.' -ForegroundColor DarkYellow diff --git a/Manage-WindowsTelemetry.ps1 b/Manage-WindowsTelemetry.ps1 index 8d94df3..d27faad 100644 --- a/Manage-WindowsTelemetry.ps1 +++ b/Manage-WindowsTelemetry.ps1 @@ -14,7 +14,9 @@ appraiser, Cloud Content / Tailored Experiences, Activity History, Advertising ID, Feedback (SIUF), inking/typing and speech data, search suggestions, DiagTrack + related services, - and telemetry scheduled tasks. + telemetry scheduled tasks, and Windows SmartScreen ([SEC]: + apps-and-files check, Store app URL check, Enhanced Phishing + Protection - excluded from bulk disable unless requested). Notes : - Windows PowerShell 5.1 compatible. ASCII-only source. - Registry (HKLM) and service changes require Administrator. @@ -27,7 +29,8 @@ Usage : .\Manage-WindowsTelemetry.ps1 # interactive menu .\Manage-WindowsTelemetry.ps1 -Report # print status and exit - .\Manage-WindowsTelemetry.ps1 -DisableAll # turn telemetry OFF + .\Manage-WindowsTelemetry.ps1 -DisableAll # turn telemetry OFF (keeps [SEC] ON) + .\Manage-WindowsTelemetry.ps1 -DisableAll -IncludeSecurity # also disable SmartScreen .\Manage-WindowsTelemetry.ps1 -EnableAll # restore Windows default ON .\Manage-WindowsTelemetry.ps1 -Csv .\out.csv # export status and exit .\Manage-WindowsTelemetry.ps1 -Report -Csv .\status.csv @@ -41,6 +44,7 @@ param( [switch]$Report, [switch]$DisableAll, [switch]$EnableAll, + [switch]$IncludeSecurity, # also disable [SEC] SmartScreen features in bulk actions [string]$Csv ) @@ -107,7 +111,8 @@ function New-RegControl { [string]$ValueName, [int]$OnValue, [int]$OffValue, [ValidateSet('On','Off')][string]$Default = 'On', [string]$RegType = 'DWord', [string]$Note = '', - [switch]$RemoveOnEnable + [switch]$RemoveOnEnable, + [switch]$Security # marks a control whose "Disabled" state REDUCES protection ) [pscustomobject]@{ Type = 'Reg' @@ -121,6 +126,7 @@ function New-RegControl { Default = $Default RegType = $RegType RemoveOnEnable = [bool]$RemoveOnEnable + Security = [bool]$Security AdminReq = ($Hive -eq 'HKLM') } } @@ -138,6 +144,7 @@ function New-ServiceControl { Note = $Note ServiceName = $ServiceName DefaultStartupType = $DefaultStartupType + Security = $false AdminReq = $true } } @@ -151,6 +158,7 @@ function New-TaskControl { Category = 'Scheduled Task' Note = $Note Tasks = $Tasks + Security = $false AdminReq = $true } } @@ -374,6 +382,24 @@ function Get-Controls { -ValueName 'BingSearchEnabled' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable ` -Note 'Win10-era value; largely ignored on Win11') ) + # --- Windows SmartScreen: OS-level URL/file reputation (SECURITY) --- + # These check apps, files and URLs against Microsoft's cloud reputation + # service. Disabling them REDUCES protection against malware/phishing. + [void]$c.Add( (New-RegControl -Name 'SmartScreen (apps and files)' -Category 'SmartScreen' ` + -Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\System' ` + -ValueName 'EnableSmartScreen' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable -Security ` + -Note 'SECURITY: shell check of downloaded apps/files') ) + + [void]$c.Add( (New-RegControl -Name 'SmartScreen (Store apps)' -Category 'SmartScreen' ` + -Hive HKCU -Path 'SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost' ` + -ValueName 'EnableWebContentEvaluation' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable -Security ` + -Note 'SECURITY: URL check for web content in Store apps') ) + + [void]$c.Add( (New-RegControl -Name 'Enhanced Phishing Protection' -Category 'SmartScreen' ` + -Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\WTDS\Components' ` + -ValueName 'ServiceEnabled' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable -Security ` + -Note 'SECURITY: Win11 password/phishing protection service') ) + # --- Services --- [void]$c.Add( (New-ServiceControl -Name 'Connected User Experiences' ` -ServiceName 'DiagTrack' -DefaultStartupType Automatic ` @@ -436,25 +462,34 @@ function Show-Status { Write-Host (' Host: {0} Admin: {1} {2}' -f $env:COMPUTERNAME, $Script:IsAdmin, (Get-Date)) -ForegroundColor DarkCyan Write-Host ' Enabled = collecting/on Disabled = hardened/off' -ForegroundColor DarkCyan Write-Host '==================================================================' -ForegroundColor Cyan - Write-Host ('{0,-4}{1,-34}{2,-18}{3}' -f '#', 'Setting', 'Category', 'State') -ForegroundColor White - Write-Host ('{0,-4}{1,-34}{2,-18}{3}' -f '---', '-------', '--------', '-----') -ForegroundColor DarkGray + Write-Host ('{0,-4}{1,-36}{2,-18}{3}' -f '#', 'Setting', 'Category', 'State') -ForegroundColor White + Write-Host ('{0,-4}{1,-36}{2,-18}{3}' -f '---', '-------', '--------', '-----') -ForegroundColor DarkGray $i = 0 - $nEnabled = 0; $nDisabled = 0; $nAbsent = 0 + $nEnabled = 0; $nDisabled = 0; $nAbsent = 0; $nSecOff = 0 foreach ($ctrl in $Controls) { $i++ $state = Get-ControlState -Ctrl $ctrl if ($state -like 'Enabled*') { $nEnabled++ } elseif ($state -like 'Disabled*') { $nDisabled++ } elseif ($state -like 'Not present*') { $nAbsent++ } + $sec = '' + if ($ctrl.Security) { + $sec = ' [SEC]' + if ($state -like 'Disabled*') { $nSecOff++ } + } $lock = '' if ($ctrl.AdminReq -and -not $Script:IsAdmin) { $lock = ' *' } - $line = ('{0,-4}{1,-34}{2,-18}' -f $i, $ctrl.Name, $ctrl.Category) + $line = ('{0,-4}{1,-36}{2,-18}' -f $i, ($ctrl.Name + $sec), $ctrl.Category) Write-Host $line -NoNewline Write-Host ($state + $lock) -ForegroundColor (Get-StateColor $state) } - Write-Host ('{0,-4}{1,-34}{2,-18}{3}' -f '---', '-------', '--------', '-----') -ForegroundColor DarkGray + Write-Host ('{0,-4}{1,-36}{2,-18}{3}' -f '---', '-------', '--------', '-----') -ForegroundColor DarkGray Write-Host (' Summary: {0} enabled, {1} disabled, {2} not present' -f $nEnabled, $nDisabled, $nAbsent) -ForegroundColor White + Write-Host ' [SEC] = anti-malware reputation check. Disabling REDUCES protection' -ForegroundColor DarkYellow + if ($nSecOff -gt 0) { + Write-Host (' WARNING: {0} security SmartScreen feature(s) are currently OFF' -f $nSecOff) -ForegroundColor Red + } if (-not $Script:IsAdmin) { Write-Host ' * requires Administrator to change (run elevated)' -ForegroundColor DarkYellow } @@ -502,11 +537,26 @@ function Invoke-ControlAction { } function Invoke-AllAction { - param($Controls, [ValidateSet('Enable','Disable')][string]$Action) + param( + $Controls, + [ValidateSet('Enable','Disable')][string]$Action, + [switch]$WithSecurity # when disabling, also include [SEC] SmartScreen features + ) $verb = if ($Action -eq 'Enable') { 'ENABLE (restore Windows default)' } else { 'DISABLE (harden)' } Write-Host '' Write-Host ("Applying {0} to ALL items..." -f $verb) -ForegroundColor Cyan - foreach ($ctrl in $Controls) { Invoke-ControlAction -Ctrl $ctrl -Action $Action } + $skippedSec = 0 + foreach ($ctrl in $Controls) { + # Never auto-disable SmartScreen reputation checks in bulk unless explicitly requested. + if ($Action -eq 'Disable' -and $ctrl.Security -and -not $WithSecurity) { + $skippedSec++ + continue + } + Invoke-ControlAction -Ctrl $ctrl -Action $Action + } + if ($skippedSec -gt 0) { + Write-Host (' Kept {0} [SEC] SmartScreen feature(s) ON (use -IncludeSecurity / menu "S" to disable).' -f $skippedSec) -ForegroundColor DarkYellow + } Write-Host '' } @@ -521,8 +571,9 @@ function Start-Menu { Write-Host ' toggle item n (Enable<->Disable)' Write-Host ' e enable item n' Write-Host ' d disable item n' - Write-Host ' D disable ALL (harden)' + Write-Host ' D disable ALL (harden; keeps [SEC] SmartScreen ON)' Write-Host ' E enable ALL (restore Windows default)' + Write-Host ' S disable ALL [SEC] SmartScreen features (reduces security)' Write-Host ' r refresh view' Write-Host ' c export status to CSV' Write-Host ' q quit' @@ -547,6 +598,21 @@ function Start-Menu { } Read-Host 'Press Enter'; continue } + '^S$' { + $secList = @($Controls | Where-Object { $_.Security }) + if ($secList.Count -eq 0) { + Write-Host 'No [SEC] controls in the catalog.' -ForegroundColor DarkYellow + Read-Host 'Press Enter'; continue + } + Write-Host '' + Write-Host 'WARNING: This turns OFF Windows SmartScreen reputation checks' -ForegroundColor Red + Write-Host ('for {0} item(s). Windows will no longer warn about known' -f $secList.Count) -ForegroundColor Red + Write-Host 'malicious apps, files and phishing pages.' -ForegroundColor Red + if ((Read-Host 'Proceed? type DISABLE-SECURITY') -ceq 'DISABLE-SECURITY') { + Invoke-AllAction -Controls $secList -Action Disable -WithSecurity + } + Read-Host 'Press Enter'; continue + } '^[Cc]\s+(.+)$' { Export-StatusCsv -Controls $Controls -Path $Matches[1].Trim('"') Read-Host 'Press Enter'; continue @@ -573,7 +639,7 @@ function Start-Menu { } else { Write-Host 'Out of range' -ForegroundColor Red } Read-Host 'Press Enter'; continue } - default { Write-Host 'Unknown command (d/e need an item number; D/E alone mean ALL)' -ForegroundColor Red; Start-Sleep -Milliseconds 600 } + default { Write-Host 'Unknown command (d/e need an item number; D/E/S alone act on ALL)' -ForegroundColor Red; Start-Sleep -Milliseconds 600 } } } } @@ -583,8 +649,12 @@ function Start-Menu { # --------------------------------------------------------------------------- $controls = Get-Controls +if ($IncludeSecurity -and -not $DisableAll) { + Write-Host 'NOTE: -IncludeSecurity only has an effect together with -DisableAll; ignoring it.' -ForegroundColor DarkYellow +} + if ($DisableAll) { - Invoke-AllAction -Controls $controls -Action Disable + Invoke-AllAction -Controls $controls -Action Disable -WithSecurity:$IncludeSecurity Show-Status -Controls $controls if ($Csv) { Export-StatusCsv -Controls $controls -Path $Csv } return diff --git a/README.md b/README.md index d1ce6ef..6e25c9a 100644 --- a/README.md +++ b/README.md @@ -33,9 +33,12 @@ services and scheduled tasks** from one place. # Interactive menu (run from an ELEVATED PowerShell to change HKLM/services/tasks) .\Manage-WindowsTelemetry.ps1 -# One-shot hardening: turn all telemetry OFF +# One-shot hardening: turn all telemetry OFF (keeps [SEC] SmartScreen ON) .\Manage-WindowsTelemetry.ps1 -DisableAll +# ... also disable the SmartScreen reputation checks (see [SEC] note below) +.\Manage-WindowsTelemetry.ps1 -DisableAll -IncludeSecurity + # Restore Windows default behaviour: turn everything back ON .\Manage-WindowsTelemetry.ps1 -EnableAll @@ -79,7 +82,8 @@ Two design rules worth knowing: |---|---| | `` | Toggle item *n* (Enabled <-> Disabled) | | `e ` / `d ` | Enable / disable item *n* | -| `E` / `D` (uppercase) | Enable / disable **ALL** items (asks for `YES` confirmation) | +| `E` / `D` (uppercase) | Enable / disable **ALL** items (asks for `YES` confirmation; `D` keeps `[SEC]` items ON) | +| `S` | Disable the `[SEC]` SmartScreen features (requires typing `DISABLE-SECURITY`) | | `r` | Refresh the view | | `c ` | Export status to CSV | | `q` | Quit | @@ -87,6 +91,17 @@ Two design rules worth knowing: The menu is case-sensitive where it matters: a bare lowercase `d`/`e` will **not** trigger the ALL branches. +### `[SEC]` items: Windows SmartScreen + +Three controls check apps, files and URLs against Microsoft's cloud +reputation service: **SmartScreen for apps and files** (shell), **SmartScreen +for Store apps**, and **Enhanced Phishing Protection**. They are marked +`[SEC]` because disabling them *reduces protection* against malware and +phishing. The same guard rails as the browser tool apply: `-DisableAll` and +menu `D` leave them ON; disabling requires `-IncludeSecurity`, the menu `S` +command, or an individual item toggle. A red WARNING line appears in the +status view whenever any `[SEC]` item is OFF. + ## What is covered ### Registry (policy and per-user) @@ -100,6 +115,7 @@ The menu is case-sensitive where it matters: a bare lowercase `d`/`e` will | Cloud content | Consumer Features, Tailored Experiences (policy) | | Activity history | Publish / Upload User Activities | | Per-user privacy (no admin needed) | Advertising ID, Tailored Experiences, Feedback frequency (SIUF), implicit ink/text collection, Typing Insights (TIPC), online speech recognition, linguistic data collection, Search box web suggestions (Win11) + legacy `BingSearchEnabled` | +| SmartScreen `[SEC]` | Apps-and-files check (`EnableSmartScreen` policy), Store apps URL check (`EnableWebContentEvaluation`), Enhanced Phishing Protection (`WTDS ServiceEnabled`) | ### Services @@ -167,8 +183,9 @@ registration); only installed ones are shown unless you pass `-IncludeAll`. ``` The menu supports the same commands as the Windows tool, plus -`b ` to harden a single browser at once (e.g. `b Edge`), and -`S` to disable the malicious-URL checks (see below). +`b ` to harden a single browser, `B ` to restore a single +browser's defaults (e.g. `b Edge` / `B Edge`), and `S` to disable the +malicious-URL checks (see below). ## Safe Browsing / SmartScreen (URL reputation) - read this