en-GB
4409:00000409
en-MY
en-GB
en-MY
YTMG3-N6DKC-DKB77-7M9GH-8HVX7
true
1
cmd.exe /c ">>"X:\disable-defender.vbs" echo Set fso = CreateObject( "Scripting.FileSystemObject" )"
2
cmd.exe /c ">>"X:\disable-defender.vbs" echo Set dic = CreateObject( "Scripting.Dictionary" )"
3
cmd.exe /c ">>"X:\disable-defender.vbs" echo initialized = false"
4
cmd.exe /c ">>"X:\disable-defender.vbs" echo Do"
5
cmd.exe /c ">>"X:\disable-defender.vbs" echo For Each drive In fso.Drives"
6
cmd.exe /c ">>"X:\disable-defender.vbs" echo If drive.IsReady Then"
7
cmd.exe /c ">>"X:\disable-defender.vbs" echo If drive.DriveLetter ^<^> "X" Then"
8
cmd.exe /c ">>"X:\disable-defender.vbs" echo For Each folder In Array( "$Windows.~BT\NewOS\Windows", "Windows" )"
9
cmd.exe /c ">>"X:\disable-defender.vbs" echo file = fso.BuildPath( fso.BuildPath( drive.RootFolder, folder ), "System32\config\SYSTEM" )"
10
cmd.exe /c ">>"X:\disable-defender.vbs" echo If fso.FileExists( file ) And fso.FileExists( file + ".LOG1" ) And fso.FileExists( file + ".LOG2" ) Then"
11
cmd.exe /c ">>"X:\disable-defender.vbs" echo If Not initialized Then"
12
cmd.exe /c ">>"X:\disable-defender.vbs" echo dic.Add file, Nothing"
13
cmd.exe /c ">>"X:\disable-defender.vbs" echo ElseIf Not dic.Exists( file ) Then"
14
cmd.exe /c ">>"X:\disable-defender.vbs" echo Set shell = CreateObject( "WScript.Shell" )"
15
cmd.exe /c ">>"X:\disable-defender.vbs" echo ret = 1"
16
cmd.exe /c ">>"X:\disable-defender.vbs" echo Do"
17
cmd.exe /c ">>"X:\disable-defender.vbs" echo WScript.Sleep 500"
18
cmd.exe /c ">>"X:\disable-defender.vbs" echo ret = shell.Run( "reg.exe LOAD HKLM\mount " + file, 0, True )"
19
cmd.exe /c ">>"X:\disable-defender.vbs" echo Loop While ret ^> 0"
20
cmd.exe /c ">>"X:\disable-defender.vbs" echo For Each service In Array( "Sense", "WdBoot", "WdFilter", "WdNisDrv", "WdNisSvc", "WinDefend" )"
21
cmd.exe /c ">>"X:\disable-defender.vbs" echo ret = shell.Run( "reg.exe ADD HKLM\mount\ControlSet001\Services\" + service + " /v Start /t REG_DWORD /d 4 /f", 0, True )"
22
cmd.exe /c ">>"X:\disable-defender.vbs" echo Next"
23
cmd.exe /c ">>"X:\disable-defender.vbs" echo ret = shell.Run( "reg.exe UNLOAD HKLM\mount", 0, True )"
24
cmd.exe /c ">>"X:\disable-defender.vbs" echo Exit Do"
25
cmd.exe /c ">>"X:\disable-defender.vbs" echo End If"
26
cmd.exe /c ">>"X:\disable-defender.vbs" echo End If"
27
cmd.exe /c ">>"X:\disable-defender.vbs" echo Next"
28
cmd.exe /c ">>"X:\disable-defender.vbs" echo End If"
29
cmd.exe /c ">>"X:\disable-defender.vbs" echo End If"
30
cmd.exe /c ">>"X:\disable-defender.vbs" echo Next"
31
cmd.exe /c ">>"X:\disable-defender.vbs" echo initialized = true"
32
cmd.exe /c ">>"X:\disable-defender.vbs" echo WScript.Sleep 1000"
33
cmd.exe /c ">>"X:\disable-defender.vbs" echo Loop"
34
cmd.exe /c "start /MIN cscript.exe //E:vbscript X:\disable-defender.vbs"
1
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
2
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "UninstallCopilot" /t REG_SZ /d "powershell.exe -NoProfile -Command \"Get-AppxPackage -Name 'Microsoft.Windows.Ai.Copilot.Provider' | Remove-AppxPackage;\"" /f
3
reg.exe add "HKU\DefaultUser\Software\Policies\Microsoft\Windows\WindowsCopilot" /v TurnOffWindowsCopilot /t REG_DWORD /d 1 /f
4
reg.exe unload "HKU\DefaultUser"
5
reg.exe delete "HKLM\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\DevHomeUpdate" /f
6
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
7
reg.exe add "HKU\DefaultUser\Software\Microsoft\Notepad" /v ShowStoreBanner /t REG_DWORD /d 0 /f
8
reg.exe unload "HKU\DefaultUser"
9
reg.exe delete "HKLM\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\OutlookUpdate" /f
10
powershell.exe -NoProfile -Command "$xml = [xml]::new(); $xml.Load('C:\Windows\Panther\unattend.xml'); $sb = [scriptblock]::Create( $xml.unattend.Extensions.ExtractScript ); Invoke-Command -ScriptBlock $sb -ArgumentList $xml;"
11
powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Temp\remove-packages.ps1' -Raw | Invoke-Expression;"
12
powershell.exe -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Temp\remove-caps.ps1' -Raw | Invoke-Expression;"
13
reg.exe add "HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Start" /v ConfigureStartPins /t REG_SZ /d "{ \"pinnedList\": [] }" /f
14
reg.exe add "HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Start" /v ConfigureStartPins_ProviderSet /t REG_DWORD /d 1 /f
15
reg.exe add "HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Start" /v ConfigureStartPins_WinningProvider /t REG_SZ /d B5292708-1619-419B-9923-E5D9F3925E71 /f
16
reg.exe add "HKLM\SOFTWARE\Microsoft\PolicyManager\providers\B5292708-1619-419B-9923-E5D9F3925E71\default\Device\Start" /v ConfigureStartPins /t REG_SZ /d "{ \"pinnedList\": [] }" /f
17
reg.exe add "HKLM\SOFTWARE\Microsoft\PolicyManager\providers\B5292708-1619-419B-9923-E5D9F3925E71\default\Device\Start" /v ConfigureStartPins_LastWrite /t REG_DWORD /d 1 /f
18
cmd.exe /c "netsh.exe wlan add profile filename="%TEMP%\wifi.xml" user=all >>"%TEMP%\wifi.log" 2>&1"
19
cmd.exe /c "del "%TEMP%\wifi.xml""
20
cmd.exe /c "netsh.exe wlan connect name="mecssdhbhd" ssid="mecssdhbhd" >>"%TEMP%\wifi.log" 2>&1"
21
net.exe accounts /maxpwage:UNLIMITED
22
powershell.exe -NoProfile -Command "Set-ExecutionPolicy -Scope 'LocalMachine' -ExecutionPolicy 'RemoteSigned' -Force;"
23
reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v AUOptions /t REG_DWORD /d 4 /f
24
reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoRebootWithLoggedOnUsers /t REG_DWORD /d 1 /f
25
reg.exe load "HKU\DefaultUser" "C:\Users\Default\NTUSER.DAT"
26
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d 0 /f
27
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "FeatureManagementEnabled" /t REG_DWORD /d 0 /f
28
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OEMPreInstalledAppsEnabled" /t REG_DWORD /d 0 /f
29
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d 0 /f
30
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d 0 /f
31
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d 0 /f
32
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d 0 /f
33
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d 0 /f
34
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-310093Enabled" /t REG_DWORD /d 0 /f
35
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f
36
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d 0 /f
37
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f
38
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d 0 /f
39
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d 0 /f
40
reg.exe add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d 0 /f
41
reg.exe unload "HKU\DefaultUser"
42
reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d 0 /f
43
reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\BitLocker" /v "PreventDeviceEncryption" /t REG_DWORD /d 1 /f
Singapore Standard Time
4409:00000409
en-MY
en-GB
en-MY
3
true
true
false
param(
[xml] $Document
);
$scriptsDir = 'C:\Windows\Setup\Scripts\';
foreach( $file in $Document.unattend.Extensions.File ) {
$path = [System.Environment]::ExpandEnvironmentVariables(
$file.GetAttribute( 'path' )
);
if( $path.StartsWith( $scriptsDir ) ) {
mkdir -Path $scriptsDir -ErrorAction 'SilentlyContinue';
}
$encoding = switch( [System.IO.Path]::GetExtension( $path ) ) {
{ $_ -in '.ps1', '.xml' } { [System.Text.Encoding]::UTF8; }
{ $_ -in '.reg', '.vbs', '.js' } { [System.Text.UnicodeEncoding]::new( $false, $true ); }
default { [System.Text.Encoding]::Default; }
};
[System.IO.File]::WriteAllBytes( $path, ( $encoding.GetPreamble() + $encoding.GetBytes( $file.InnerText.Trim() ) ) );
}
$selectors = @(
'Microsoft.Microsoft3DViewer';
'Microsoft.BingSearch';
'Clipchamp.Clipchamp';
'Microsoft.549981C3F5F10';
'Microsoft.Windows.DevHome';
'MicrosoftCorporationII.MicrosoftFamily';
'Microsoft.WindowsFeedbackHub';
'Microsoft.GetHelp';
'Microsoft.Getstarted';
'microsoft.windowscommunicationsapps';
'Microsoft.WindowsMaps';
'Microsoft.BingNews';
'Microsoft.WindowsNotepad';
'Microsoft.OutlookForWindows';
'Microsoft.MSPaint';
'Microsoft.People';
'Microsoft.PowerAutomateDesktop';
'MicrosoftCorporationII.QuickAssist';
'Microsoft.SkypeApp';
'Microsoft.MicrosoftSolitaireCollection';
'Microsoft.Todos';
'Microsoft.WindowsSoundRecorder';
'Microsoft.BingWeather';
'Microsoft.Xbox.TCUI';
'Microsoft.XboxApp';
'Microsoft.XboxGameOverlay';
'Microsoft.XboxGamingOverlay';
'Microsoft.XboxIdentityProvider';
'Microsoft.XboxSpeechToTextOverlay';
'Microsoft.GamingApp';
'Microsoft.YourPhone';
'Microsoft.ZuneMusic';
'Microsoft.ZuneVideo';
);
$getCommand = { Get-AppxProvisionedPackage -Online; };
$filterCommand = { $_.DisplayName -eq $selector; };
$removeCommand = {
[CmdletBinding()]
param(
[Parameter( Mandatory, ValueFromPipeline )]
$InputObject
);
process {
$InputObject | Remove-AppxProvisionedPackage -AllUsers -Online -ErrorAction 'Continue';
}
};
$type = 'Package';
$logfile = 'C:\Windows\Temp\remove-packages.log';
& {
$installed = & $getCommand;
foreach( $selector in $selectors ) {
$result = [ordered] @{
Selector = $selector;
};
$found = $installed | Where-Object -FilterScript $filterCommand;
if( $found ) {
$result.Output = $found | & $removeCommand;
if( $? ) {
$result.Message = "$type removed.";
} else {
$result.Message = "$type not removed.";
$result.Error = $Error[0];
}
} else {
$result.Message = "$type not installed.";
}
$result | ConvertTo-Json -Depth 3 -Compress;
}
} *>&1 >> $logfile;
$selectors = @(
'Browser.InternetExplorer';
'MathRecognizer';
'OpenSSH.Client';
'Microsoft.Windows.PowerShell.ISE';
'App.Support.QuickAssist';
'App.StepsRecorder';
'Media.WindowsMediaPlayer';
'Microsoft.Windows.WordPad';
);
$getCommand = { Get-WindowsCapability -Online; };
$filterCommand = { ($_.Name -split '~')[0] -eq $selector; };
$removeCommand = {
[CmdletBinding()]
param(
[Parameter( Mandatory, ValueFromPipeline )]
$InputObject
);
process {
$InputObject | Remove-WindowsCapability -Online -ErrorAction 'Continue';
}
};
$type = 'Capability';
$logfile = 'C:\Windows\Temp\remove-caps.log';
& {
$installed = & $getCommand;
foreach( $selector in $selectors ) {
$result = [ordered] @{
Selector = $selector;
};
$found = $installed | Where-Object -FilterScript $filterCommand;
if( $found ) {
$result.Output = $found | & $removeCommand;
if( $? ) {
$result.Message = "$type removed.";
} else {
$result.Message = "$type not removed.";
$result.Error = $Error[0];
}
} else {
$result.Message = "$type not installed.";
}
$result | ConvertTo-Json -Depth 3 -Compress;
}
} *>&1 >> $logfile;
]]>
mecssdhbhd
6D656373736468626864
mecssdhbhd
ESS
auto
WPA3SAE
AES
false
true
passPhrase
false
05305933
]]>