Add files via upload

Manage-BrowserPrivacy.ps1

@@ -205,9 +205,9 @@ function Get-Controls {
     [void]$c.Add( (New-PolicyControl -Name 'Spotlight Recommendations' -Browser Edge -PolicyPath $edge `
         -ValueName 'SpotlightExperiencesAndRecommendationsEnabled' -OnValue 1 -OffValue 0) )
 
-    [void]$c.Add( (New-PolicyControl -Name 'Do Not Track OFF' -Browser Edge -PolicyPath $edge `
+    [void]$c.Add( (New-PolicyControl -Name 'DNT Header Not Sent' -Browser Edge -PolicyPath $edge `
         -ValueName 'ConfigureDoNotTrack' -OnValue 0 -OffValue 1 `
-        -Note 'Disabled = DNT header IS sent (hardened)') )
+        -Note 'Disabled = Do Not Track header IS sent (hardened)') )
 
     [void]$c.Add( (New-PolicyControl -Name 'Nav Error Web Service' -Browser Edge -PolicyPath $edge `
         -ValueName 'ResolveNavigationErrorsUseWebService' -OnValue 1 -OffValue 0) )
@@ -370,27 +370,32 @@ function Show-Status {
     Write-Host ('{0,-4}{1,-36}{2,-10}{3}' -f '---', '-------', '-------', '-----') -ForegroundColor DarkGray
 
     $i = 0
-    $nEnabled = 0; $nDisabled = 0; $nSecOff = 0
+    $nEnabled = 0; $nDisabled = 0; $nSecOff = 0; $nNotInstalled = 0
     foreach ($ctrl in $Controls) {
         $i++
-        $state = Get-ControlState -Ctrl $ctrl
+        $state     = Get-ControlState -Ctrl $ctrl
-        if     ($state -like 'Enabled*')  { $nEnabled++ }
+        $installed = $Script:Browsers[$ctrl.Category].Installed
-        elseif ($state -like 'Disabled*') { $nDisabled++ }
+        if ($installed) {
+            if     ($state -like 'Enabled*')  { $nEnabled++ }
+            elseif ($state -like 'Disabled*') { $nDisabled++ }
+        } else { $nNotInstalled++ }
         $sec = ''
         if ($ctrl.Security) {
             $sec = ' [SEC]'
-            if ($state -like 'Disabled*') { $nSecOff++ }
+            if ($installed -and $state -like 'Disabled*') { $nSecOff++ }
         }
         $lock = ''
         if ($ctrl.AdminReq -and -not $Script:IsAdmin) { $lock = ' *' }
         $flag = ''
-        if (-not $Script:Browsers[$ctrl.Category].Installed) { $flag = ' (not installed)' }
+        if (-not $installed) { $flag = ' (not installed)' }
         $line = ('{0,-4}{1,-36}{2,-10}' -f $i, ($ctrl.Name + $sec), $ctrl.Category)
         Write-Host $line -NoNewline
         Write-Host ($state + $lock + $flag) -ForegroundColor (Get-StateColor $state)
     }
     Write-Host ('{0,-4}{1,-36}{2,-10}{3}' -f '---', '-------', '-------', '-----') -ForegroundColor DarkGray
-    Write-Host ('  Summary: {0} enabled, {1} disabled' -f $nEnabled, $nDisabled) -ForegroundColor White
+    $summary = ('  Summary: {0} enabled, {1} disabled' -f $nEnabled, $nDisabled)
+    if ($nNotInstalled -gt 0) { $summary += (' ({0} not counted: browser not installed)' -f $nNotInstalled) }
+    Write-Host $summary -ForegroundColor White
     Write-Host '  [SEC] = anti-malware URL/site check. Disabling REDUCES protection' -ForegroundColor DarkYellow
     if ($nSecOff -gt 0) {
         Write-Host ('  WARNING: {0} security URL-check feature(s) are currently OFF' -f $nSecOff) -ForegroundColor Red
@@ -479,7 +484,8 @@ function Start-Menu {
         Write-Host '  D            disable ALL (harden; keeps [SEC] URL checks ON)'
         Write-Host '  E            enable ALL (restore browser defaults)'
         Write-Host '  S            disable ALL [SEC] URL-check features (reduces security)'
-        Write-Host '  b <name>     apply D to one browser (e.g. b Edge)'
+        Write-Host '  b <name>     harden one browser  (e.g. b Edge)'
+        Write-Host '  B <name>     restore one browser (e.g. B Edge)'
         Write-Host '  r            refresh view'
         Write-Host '  c <path>     export status to CSV'
         Write-Host '  q            quit'
@@ -506,6 +512,10 @@ function Start-Menu {
             }
             '^S$'         {
                 $secList = @($Controls | Where-Object { $_.Security })
+                if ($secList.Count -eq 0) {
+                    Write-Host 'No [SEC] controls for the detected browsers.' -ForegroundColor DarkYellow
+                    Read-Host 'Press Enter'; continue
+                }
                 Write-Host ''
                 Write-Host 'WARNING: This turns OFF anti-malware URL/site reputation checks' -ForegroundColor Red
                 Write-Host ('(SmartScreen / Safe Browsing) for {0} item(s). Your browser will' -f $secList.Count) -ForegroundColor Red
@@ -515,7 +525,17 @@ function Start-Menu {
                 }
                 Read-Host 'Press Enter'; continue
             }
-            '^[Bb]\s+(\w+)$' {
+            '^B\s+(\w+)$' {
+                $target = $Matches[1]
+                $subset = @($Controls | Where-Object { $_.Category -eq $target })
+                if ($subset.Count -eq 0) {
+                    Write-Host ('No controls for browser "{0}" (use Edge/Chrome/Firefox/Brave)' -f $target) -ForegroundColor Red
+                } elseif ((Read-Host ('Restore all {0} defaults? type YES' -f $target)) -ceq 'YES') {
+                    Invoke-AllAction -Controls $subset -Action Enable
+                }
+                Read-Host 'Press Enter'; continue
+            }
+            '^b\s+(\w+)$' {
                 $target = $Matches[1]
                 $subset = @($Controls | Where-Object { $_.Category -eq $target })
                 if ($subset.Count -eq 0) {
@@ -551,7 +571,7 @@ function Start-Menu {
                 } else { Write-Host 'Out of range' -ForegroundColor Red }
                 Read-Host 'Press Enter'; continue
             }
-            default { Write-Host 'Unknown command (d/e need an item number; D/E alone mean ALL)' -ForegroundColor Red; Start-Sleep -Milliseconds 600 }
+            default { Write-Host 'Unknown command (d/e need an item number; D/E/S alone act on ALL; b/B <browser>)' -ForegroundColor Red; Start-Sleep -Milliseconds 600 }
         }
     }
 }
@@ -561,6 +581,10 @@ function Start-Menu {
 # ---------------------------------------------------------------------------
 $controls = Get-Controls
 
+if ($IncludeSecurity -and -not $DisableAll) {
+    Write-Host 'NOTE: -IncludeSecurity only has an effect together with -DisableAll; ignoring it.' -ForegroundColor DarkYellow
+}
+
 if (@($controls).Count -eq 0) {
     Write-Host 'No supported browsers detected (Edge/Chrome/Firefox/Brave).' -ForegroundColor Red
     Write-Host 'Use -IncludeAll to manage policies for browsers not yet installed.' -ForegroundColor DarkYellow

Manage-WindowsTelemetry.ps1

@@ -14,7 +14,9 @@
               appraiser, Cloud Content / Tailored Experiences, Activity
               History, Advertising ID, Feedback (SIUF), inking/typing and
               speech data, search suggestions, DiagTrack + related services,
-              and telemetry scheduled tasks.
+              telemetry scheduled tasks, and Windows SmartScreen ([SEC]:
+              apps-and-files check, Store app URL check, Enhanced Phishing
+              Protection - excluded from bulk disable unless requested).
 
     Notes   : - Windows PowerShell 5.1 compatible. ASCII-only source.
               - Registry (HKLM) and service changes require Administrator.
@@ -27,7 +29,8 @@
     Usage   :
         .\Manage-WindowsTelemetry.ps1                 # interactive menu
         .\Manage-WindowsTelemetry.ps1 -Report         # print status and exit
-        .\Manage-WindowsTelemetry.ps1 -DisableAll     # turn telemetry OFF
+        .\Manage-WindowsTelemetry.ps1 -DisableAll     # turn telemetry OFF (keeps [SEC] ON)
+        .\Manage-WindowsTelemetry.ps1 -DisableAll -IncludeSecurity  # also disable SmartScreen
         .\Manage-WindowsTelemetry.ps1 -EnableAll      # restore Windows default ON
         .\Manage-WindowsTelemetry.ps1 -Csv .\out.csv  # export status and exit
         .\Manage-WindowsTelemetry.ps1 -Report -Csv .\status.csv
@@ -41,6 +44,7 @@ param(
     [switch]$Report,
     [switch]$DisableAll,
     [switch]$EnableAll,
+    [switch]$IncludeSecurity,   # also disable [SEC] SmartScreen features in bulk actions
     [string]$Csv
 )
 
@@ -107,7 +111,8 @@ function New-RegControl {
         [string]$ValueName, [int]$OnValue, [int]$OffValue,
         [ValidateSet('On','Off')][string]$Default = 'On',
         [string]$RegType = 'DWord', [string]$Note = '',
-        [switch]$RemoveOnEnable
+        [switch]$RemoveOnEnable,
+        [switch]$Security   # marks a control whose "Disabled" state REDUCES protection
     )
     [pscustomobject]@{
         Type           = 'Reg'
@@ -121,6 +126,7 @@ function New-RegControl {
         Default        = $Default
         RegType        = $RegType
         RemoveOnEnable = [bool]$RemoveOnEnable
+        Security       = [bool]$Security
         AdminReq       = ($Hive -eq 'HKLM')
     }
 }
@@ -138,6 +144,7 @@ function New-ServiceControl {
         Note               = $Note
         ServiceName        = $ServiceName
         DefaultStartupType = $DefaultStartupType
+        Security           = $false
         AdminReq           = $true
     }
 }
@@ -151,6 +158,7 @@ function New-TaskControl {
         Category = 'Scheduled Task'
         Note     = $Note
         Tasks    = $Tasks
+        Security = $false
         AdminReq = $true
     }
 }
@@ -374,6 +382,24 @@ function Get-Controls {
         -ValueName 'BingSearchEnabled' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable `
         -Note 'Win10-era value; largely ignored on Win11') )
 
+    # --- Windows SmartScreen: OS-level URL/file reputation (SECURITY) ---
+    # These check apps, files and URLs against Microsoft's cloud reputation
+    # service. Disabling them REDUCES protection against malware/phishing.
+    [void]$c.Add( (New-RegControl -Name 'SmartScreen (apps and files)' -Category 'SmartScreen' `
+        -Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\System' `
+        -ValueName 'EnableSmartScreen' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable -Security `
+        -Note 'SECURITY: shell check of downloaded apps/files') )
+
+    [void]$c.Add( (New-RegControl -Name 'SmartScreen (Store apps)' -Category 'SmartScreen' `
+        -Hive HKCU -Path 'SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost' `
+        -ValueName 'EnableWebContentEvaluation' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable -Security `
+        -Note 'SECURITY: URL check for web content in Store apps') )
+
+    [void]$c.Add( (New-RegControl -Name 'Enhanced Phishing Protection' -Category 'SmartScreen' `
+        -Hive HKLM -Path 'SOFTWARE\Policies\Microsoft\Windows\WTDS\Components' `
+        -ValueName 'ServiceEnabled' -OnValue 1 -OffValue 0 -Default On -RemoveOnEnable -Security `
+        -Note 'SECURITY: Win11 password/phishing protection service') )
+
     # --- Services ---
     [void]$c.Add( (New-ServiceControl -Name 'Connected User Experiences' `
         -ServiceName 'DiagTrack' -DefaultStartupType Automatic `
@@ -436,25 +462,34 @@ function Show-Status {
     Write-Host ('  Host: {0}   Admin: {1}   {2}' -f $env:COMPUTERNAME, $Script:IsAdmin, (Get-Date)) -ForegroundColor DarkCyan
     Write-Host '  Enabled = collecting/on    Disabled = hardened/off' -ForegroundColor DarkCyan
     Write-Host '==================================================================' -ForegroundColor Cyan
-    Write-Host ('{0,-4}{1,-34}{2,-18}{3}' -f '#', 'Setting', 'Category', 'State') -ForegroundColor White
+    Write-Host ('{0,-4}{1,-36}{2,-18}{3}' -f '#', 'Setting', 'Category', 'State') -ForegroundColor White
-    Write-Host ('{0,-4}{1,-34}{2,-18}{3}' -f '---', '-------', '--------', '-----') -ForegroundColor DarkGray
+    Write-Host ('{0,-4}{1,-36}{2,-18}{3}' -f '---', '-------', '--------', '-----') -ForegroundColor DarkGray
 
     $i = 0
-    $nEnabled = 0; $nDisabled = 0; $nAbsent = 0
+    $nEnabled = 0; $nDisabled = 0; $nAbsent = 0; $nSecOff = 0
     foreach ($ctrl in $Controls) {
         $i++
         $state = Get-ControlState -Ctrl $ctrl
         if     ($state -like 'Enabled*')     { $nEnabled++ }
         elseif ($state -like 'Disabled*')    { $nDisabled++ }
         elseif ($state -like 'Not present*') { $nAbsent++ }
+        $sec = ''
+        if ($ctrl.Security) {
+            $sec = ' [SEC]'
+            if ($state -like 'Disabled*') { $nSecOff++ }
+        }
         $lock  = ''
         if ($ctrl.AdminReq -and -not $Script:IsAdmin) { $lock = ' *' }
-        $line = ('{0,-4}{1,-34}{2,-18}' -f $i, $ctrl.Name, $ctrl.Category)
+        $line = ('{0,-4}{1,-36}{2,-18}' -f $i, ($ctrl.Name + $sec), $ctrl.Category)
         Write-Host $line -NoNewline
         Write-Host ($state + $lock) -ForegroundColor (Get-StateColor $state)
     }
-    Write-Host ('{0,-4}{1,-34}{2,-18}{3}' -f '---', '-------', '--------', '-----') -ForegroundColor DarkGray
+    Write-Host ('{0,-4}{1,-36}{2,-18}{3}' -f '---', '-------', '--------', '-----') -ForegroundColor DarkGray
     Write-Host ('  Summary: {0} enabled, {1} disabled, {2} not present' -f $nEnabled, $nDisabled, $nAbsent) -ForegroundColor White
+    Write-Host '  [SEC] = anti-malware reputation check. Disabling REDUCES protection' -ForegroundColor DarkYellow
+    if ($nSecOff -gt 0) {
+        Write-Host ('  WARNING: {0} security SmartScreen feature(s) are currently OFF' -f $nSecOff) -ForegroundColor Red
+    }
     if (-not $Script:IsAdmin) {
         Write-Host '  * requires Administrator to change (run elevated)' -ForegroundColor DarkYellow
     }
@@ -502,11 +537,26 @@ function Invoke-ControlAction {
 }
 
 function Invoke-AllAction {
-    param($Controls, [ValidateSet('Enable','Disable')][string]$Action)
+    param(
+        $Controls,
+        [ValidateSet('Enable','Disable')][string]$Action,
+        [switch]$WithSecurity   # when disabling, also include [SEC] SmartScreen features
+    )
     $verb = if ($Action -eq 'Enable') { 'ENABLE (restore Windows default)' } else { 'DISABLE (harden)' }
     Write-Host ''
     Write-Host ("Applying {0} to ALL items..." -f $verb) -ForegroundColor Cyan
-    foreach ($ctrl in $Controls) { Invoke-ControlAction -Ctrl $ctrl -Action $Action }
+    $skippedSec = 0
+    foreach ($ctrl in $Controls) {
+        # Never auto-disable SmartScreen reputation checks in bulk unless explicitly requested.
+        if ($Action -eq 'Disable' -and $ctrl.Security -and -not $WithSecurity) {
+            $skippedSec++
+            continue
+        }
+        Invoke-ControlAction -Ctrl $ctrl -Action $Action
+    }
+    if ($skippedSec -gt 0) {
+        Write-Host ('  Kept {0} [SEC] SmartScreen feature(s) ON (use -IncludeSecurity / menu "S" to disable).' -f $skippedSec) -ForegroundColor DarkYellow
+    }
     Write-Host ''
 }
 
@@ -521,8 +571,9 @@ function Start-Menu {
         Write-Host '  <n>          toggle item n (Enable<->Disable)'
         Write-Host '  e <n>        enable item n'
         Write-Host '  d <n>        disable item n'
-        Write-Host '  D            disable ALL (harden)'
+        Write-Host '  D            disable ALL (harden; keeps [SEC] SmartScreen ON)'
         Write-Host '  E            enable ALL (restore Windows default)'
+        Write-Host '  S            disable ALL [SEC] SmartScreen features (reduces security)'
         Write-Host '  r            refresh view'
         Write-Host '  c <path>     export status to CSV'
         Write-Host '  q            quit'
@@ -547,6 +598,21 @@ function Start-Menu {
                 }
                 Read-Host 'Press Enter'; continue
             }
+            '^S$'         {
+                $secList = @($Controls | Where-Object { $_.Security })
+                if ($secList.Count -eq 0) {
+                    Write-Host 'No [SEC] controls in the catalog.' -ForegroundColor DarkYellow
+                    Read-Host 'Press Enter'; continue
+                }
+                Write-Host ''
+                Write-Host 'WARNING: This turns OFF Windows SmartScreen reputation checks' -ForegroundColor Red
+                Write-Host ('for {0} item(s). Windows will no longer warn about known' -f $secList.Count) -ForegroundColor Red
+                Write-Host 'malicious apps, files and phishing pages.' -ForegroundColor Red
+                if ((Read-Host 'Proceed? type DISABLE-SECURITY') -ceq 'DISABLE-SECURITY') {
+                    Invoke-AllAction -Controls $secList -Action Disable -WithSecurity
+                }
+                Read-Host 'Press Enter'; continue
+            }
             '^[Cc]\s+(.+)$' {
                 Export-StatusCsv -Controls $Controls -Path $Matches[1].Trim('"')
                 Read-Host 'Press Enter'; continue
@@ -573,7 +639,7 @@ function Start-Menu {
                 } else { Write-Host 'Out of range' -ForegroundColor Red }
                 Read-Host 'Press Enter'; continue
             }
-            default { Write-Host 'Unknown command (d/e need an item number; D/E alone mean ALL)' -ForegroundColor Red; Start-Sleep -Milliseconds 600 }
+            default { Write-Host 'Unknown command (d/e need an item number; D/E/S alone act on ALL)' -ForegroundColor Red; Start-Sleep -Milliseconds 600 }
         }
     }
 }
@@ -583,8 +649,12 @@ function Start-Menu {
 # ---------------------------------------------------------------------------
 $controls = Get-Controls
 
+if ($IncludeSecurity -and -not $DisableAll) {
+    Write-Host 'NOTE: -IncludeSecurity only has an effect together with -DisableAll; ignoring it.' -ForegroundColor DarkYellow
+}
+
 if ($DisableAll) {
-    Invoke-AllAction -Controls $controls -Action Disable
+    Invoke-AllAction -Controls $controls -Action Disable -WithSecurity:$IncludeSecurity
     Show-Status -Controls $controls
     if ($Csv) { Export-StatusCsv -Controls $controls -Path $Csv }
     return

README.md

@@ -33,9 +33,12 @@ services and scheduled tasks** from one place.
 # Interactive menu (run from an ELEVATED PowerShell to change HKLM/services/tasks)
 .\Manage-WindowsTelemetry.ps1
 
-# One-shot hardening: turn all telemetry OFF
+# One-shot hardening: turn all telemetry OFF (keeps [SEC] SmartScreen ON)
 .\Manage-WindowsTelemetry.ps1 -DisableAll
 
+# ... also disable the SmartScreen reputation checks (see [SEC] note below)
+.\Manage-WindowsTelemetry.ps1 -DisableAll -IncludeSecurity
+
 # Restore Windows default behaviour: turn everything back ON
 .\Manage-WindowsTelemetry.ps1 -EnableAll
 
@@ -79,7 +82,8 @@ Two design rules worth knowing:
 |---|---|
 | `<n>` | Toggle item *n* (Enabled <-> Disabled) |
 | `e <n>` / `d <n>` | Enable / disable item *n* |
-| `E` / `D` (uppercase) | Enable / disable **ALL** items (asks for `YES` confirmation) |
+| `E` / `D` (uppercase) | Enable / disable **ALL** items (asks for `YES` confirmation; `D` keeps `[SEC]` items ON) |
+| `S` | Disable the `[SEC]` SmartScreen features (requires typing `DISABLE-SECURITY`) |
 | `r` | Refresh the view |
 | `c <path>` | Export status to CSV |
 | `q` | Quit |
@@ -87,6 +91,17 @@ Two design rules worth knowing:
 The menu is case-sensitive where it matters: a bare lowercase `d`/`e` will
 **not** trigger the ALL branches.
 
+### `[SEC]` items: Windows SmartScreen
+
+Three controls check apps, files and URLs against Microsoft's cloud
+reputation service: **SmartScreen for apps and files** (shell), **SmartScreen
+for Store apps**, and **Enhanced Phishing Protection**. They are marked
+`[SEC]` because disabling them *reduces protection* against malware and
+phishing. The same guard rails as the browser tool apply: `-DisableAll` and
+menu `D` leave them ON; disabling requires `-IncludeSecurity`, the menu `S`
+command, or an individual item toggle. A red WARNING line appears in the
+status view whenever any `[SEC]` item is OFF.
+
 ## What is covered
 
 ### Registry (policy and per-user)
@@ -100,6 +115,7 @@ The menu is case-sensitive where it matters: a bare lowercase `d`/`e` will
 | Cloud content | Consumer Features, Tailored Experiences (policy) |
 | Activity history | Publish / Upload User Activities |
 | Per-user privacy (no admin needed) | Advertising ID, Tailored Experiences, Feedback frequency (SIUF), implicit ink/text collection, Typing Insights (TIPC), online speech recognition, linguistic data collection, Search box web suggestions (Win11) + legacy `BingSearchEnabled` |
+| SmartScreen `[SEC]` | Apps-and-files check (`EnableSmartScreen` policy), Store apps URL check (`EnableWebContentEvaluation`), Enhanced Phishing Protection (`WTDS ServiceEnabled`) |
 
 ### Services
 
@@ -167,8 +183,9 @@ registration); only installed ones are shown unless you pass `-IncludeAll`.
 ```
 
 The menu supports the same commands as the Windows tool, plus
-`b <browser>` to harden a single browser at once (e.g. `b Edge`), and
+`b <browser>` to harden a single browser, `B <browser>` to restore a single
-`S` to disable the malicious-URL checks (see below).
+browser's defaults (e.g. `b Edge` / `B Edge`), and `S` to disable the
+malicious-URL checks (see below).
 
 ## Safe Browsing / SmartScreen (URL reputation) - read this