Lean And Mean snippets for power users RunAsTI / reg_own / ToggleDefender / Edge removal / redirect

Discussion in 'Scripting' started by AveYo, May 7, 2021.

  1. Jamsmiter

    Jamsmiter MDL Novice

    Dec 16, 2022
    3
    3
    0
    Thanks geepnozeex
    that runs well ,it can remove edge from the offline image.
    Here is my test result : [OS:LTSC 2021]
    After Remove edge and deployed image ,the edge does not appear in new system ,but when performed online update ,the windows update brings edge(initial version ) back and edge self can be uninstalled normally ,no remains left.
    whatever ,we won't be bothered by the annoying Edge neither on living system nor offline image NOW.
    Thanks again:):):) @AveYo @geepnozeex
     
  2. geepnozeex

    geepnozeex MDL Junior Member

    Oct 21, 2014
    81
    79
    0
    #182 geepnozeex, Mar 2, 2024
    Last edited: Jul 31, 2024
    I have shortened the powershell code.
    to remove microsoft edge chromium, on the live system has my Edge Chromium Remover
    it is advisable to unpack it to the root of the disk.
    run the Start Edge Remover.bat from the admin and wait for it to finish. (1-2 minutes)
    [​IMG]
     
  3. Jingzin

    Jingzin MDL Addicted

    Nov 10, 2021
    666
    532
    30
    on 11 22h2 22621.2283 winget uninstall Microsoft.Edge works, tested it
     
  4. JeepWillys58

    JeepWillys58 MDL Addicted

    Nov 6, 2010
    604
    380
    30
    Hi dear friend @geepnozeex

    But it removes all Edge browsers or just Edge Chromium?

    Thanks in advanced.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. geepnozeex

    geepnozeex MDL Junior Member

    Oct 21, 2014
    81
    79
    0
    Edge Chromium only.
     
  6. retest

    retest MDL Member

    Nov 2, 2010
    116
    63
    10
    @geepnozeex

    Can you please explain what this script does. Apart from the mount/unmount & hive load.
    What does SU64 /w /s Powershell "LS HKLM:\SSOFTWARE -Rec -ea 0|?{$_.Name -Match 'edge' -and $_.Name -NotMatch 'EdgeGesture'}|RI -Rec" actually do?
    ----------------------
    Also the EdgeRemover script mentioned in post 182,
    Is that a replacement for the AveYo Edge_Removal scipt ?

     
  7. geepnozeex

    geepnozeex MDL Junior Member

    Oct 21, 2014
    81
    79
    0
    #187 geepnozeex, Apr 26, 2024
    Last edited: Apr 26, 2024
    searches for and deletes edge partitions, except for the partition EdgeGesture
    SU64 /w /s - utility for starting any process with TrustedInstaller privileges.

    https://github.com/mspaintmsi/superUser/releases
     
  8. retest

    retest MDL Member

    Nov 2, 2010
    116
    63
    10
    Thanks. Just removed edge using your script. Worked well.
    I could not find a reference to "/Remove-Edge" anywhere.

    Is it possible to remove Windows Defender from install.wim ?
     
  9. geepnozeex

    geepnozeex MDL Junior Member

    Oct 21, 2014
    81
    79
    0
    #189 geepnozeex, Apr 29, 2024
    Last edited: Apr 30, 2024
    In Windows 10, to remove Defender, you had to remove its packages.
    for windows 11 this is not enough. You need to write commands yourself to remove defender elements, but this may make it impossible to install cumulative updates.
    so I just turn off the defender in the image.

    command to remove old defender databases
    Code:
    Dism /Image:C:\WORK\Mount /Disable-Feature /FeatureName:Windows-Defender-Default-Definitions
    commands to turn off the defender in the offline image
    Code:
    Dism /Mount-Wim /WimFile:C:\WORK\install.wim /index:1 /MountDir:C:\WORK\Mount
    Dism /Image:C:\WORK\Mount /Disable-Feature /FeatureName:Windows-Defender-Default-Definitions
    Reg load HKLM\SSOFTWARE C:\WORK\Mount\Windows\System32\Config\SOFTWARE
    Reg load HKLM\SSYSTEM C:\WORK\Mount\Windows\System32\Config\SYSTEM
    SU64 /w /s Powershell -ep bypass D:\PSREG.ps1
    Reg unload HKLM\SSOFTWARE
    Reg unload HKLM\SSYSTEM
    Dism /Unmount-Wim /MountDir:C:\WORK\Mount /commit
    
    PSREG.ps1 file contents
    Code:
    Reg add HKLM\SSOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance /v Enabled /t REG_DWORD /d 0 /f
    Reg add HKLM\SSOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService /v ActivationType /t REG_DWORD /d 1 /f
    Reg add HKLM\SSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v SettingsPageVisibility /d "hide:windowsdefender" /f
    RP HKLM:\SSOFTWARE\Microsoft\Windows\CurrentVersion\Run SecurityHealth
    'WinDefend','Sense','WdBoot','WdFilter','WdNisSvc','WdNisDrv','wscsvc','SecurityHealth*'|%{SP HKLM:\SSYSTEM\ControlSet001\Services\$_ Start -V 4}
    
    SU64 /w /s - utility for starting any process with TrustedInstaller privileges.
    https://github.com/mspaintmsi/superUser/releases
     
  10. retest

    retest MDL Member

    Nov 2, 2010
    116
    63
    10
    @geepnozeex

    Thanks, I'll def try this. When I have some time.

    EDIT:
    If it's not too much trouble, post code to remove the Defender elements you mention. I'm not too bothered about updates.
     
  11. geepnozeex

    geepnozeex MDL Junior Member

    Oct 21, 2014
    81
    79
    0
    #191 geepnozeex, Apr 29, 2024
    Last edited: Apr 29, 2024
    I haven't looked into this issue.
    I only understand in general terms what needs to be done.
    for work, it makes no difference whether the Defender is removed or turned off.
    My defender is turned off and installing updates does not turn it on.
     
  12. retest

    retest MDL Member

    Nov 2, 2010
    116
    63
    10
    ok, thanks. i'll try the commands this weekend.
     
  13. retest

    retest MDL Member

    Nov 2, 2010
    116
    63
    10
    Tried out the disable defender script. Seems to have worked well.
    Except for "Dism /Image:"%MOUNTDIR%" /Disable-Feature /FeatureName:Windows-Defender-Default-Definitions"

    Maybe because I used the install.wim from Win11 Ent LTSC 2024 ?

    Error was :
    Code:
    Deployment Image Servicing and Management tool
    Version: 10.0.22621.1
    
    Error: 32
    
    An initialization error occurred.
    For more information, review the log file.
    
    I had included the remove edge script too, BTW. below :

    Code:
    ...
    echo mounting ...
    Dism /Mount-Wim /WimFile:"%INSTALLWIM%" /index:1 /MountDir:"%MOUNTDIR%"
    
    echo removing edge ...
    Dism /Image:"%MOUNTDIR%" /Remove-Edge
    
    pause
    echo loading hives ...
    Reg load HKLM\SSOFTWARE "%MOUNTDIR%\Windows\System32\Config\SOFTWARE"
    Reg load HKLM\SSYSTEM     "%MOUNTDIR%\Windows\System32\Config\SYSTEM"
    
    echo processing reg keys ...
    superUser64.exe /w /s Powershell "LS HKLM:\SSOFTWARE -Rec -ea 0|?{$_.Name -Match 'edge' -and $_.Name -NotMatch 'EdgeGesture'}|RI -Rec"
    pause
    
    echo disabling defender default defs ...
    Dism /Image:"%MOUNTDIR%" /Disable-Feature /FeatureName:Windows-Defender-Default-Definitions
    
    ...
    

    Thanks again, @geepnozeex
     
  14. geepnozeex

    geepnozeex MDL Junior Member

    Oct 21, 2014
    81
    79
    0
    first this command.

    and the rest later.

    problem in loaded registry hives (Reg load HKLM\SSOFTWARE)
     
  15. qkwxx

    qkwxx MDL Novice

    Jul 22, 2015
    19
    3
    0
  16. drew84

    drew84 MDL Expert

    Mar 13, 2014
    1,402
    2,391
    60
  17. tlstls

    tlstls MDL Novice

    Aug 12, 2009
    25
    6
    0
    Did this and works flawlessly but I encountered a problem, I can't disable Virtualization Based Security without defender, is there a way to permanently remove it too?
     
  18. geepnozeex

    geepnozeex MDL Junior Member

    Oct 21, 2014
    81
    79
    0
    This is disabled by default.
    You can check it - run - msinfo32
     
  19. catosis

    catosis MDL Junior Member

    Apr 24, 2022
    90
    23
    0
  20. KleineZiege

    KleineZiege MDL Expert

    Dec 11, 2018
    1,855
    2,115
    60

    ## Toggle Defender, AveYo 2023.09.13
    ## for users that understand the risk but still need it off to prevent unexpected interference and i/o handicap
    ## may copy-paste directly into powershell

    Code:
    $ENABLE_TAMPER_PROTECTION = 0    <#  1 script re-enables Tamper Protection   0 skip  #>
    $TOGGLE_SMARTSCREENFILTER = 1    <#  1 script toggles SmartScreen as well    0 skip  #>