Multi-OEM/Retail Project {MRP} - Mk3

MRP is at RC3 stage and tested ok, as rc2 i found a spelling mistake so corrected it.

When i did a win 11 Pro test install of RC3, and before i rebooted for the first time since the desktop appeared, I had used the disable defender option, i went into Settings and opened Defender which the GUI shown in full as it needs a reboot for the option to fully set, i went into the top option it has and then manage settings or something and saw that real-time scanning was on (so turned that off) then a bit further down i turned off the Tamper Protection too, clicked dismiss on the little message at the side. Rebooted and checked registry the Tamper Protection is now off (0x4 value)...

I then went to see if Defender opened, nope a blank window , as all services and tasks for it are disabled.

I checked services.msc and it not running at all, the fire wall blocks added also prevent anything going out or in.

Did a WU check just normal updates and drivers nothing about Defender.

Rebooted several times as well after the updates installed and no defender at all...

Please don't ask for a revert script if you later want to use defender as it way to complicated, not that any files/services etc are deleted but the amount of tweaks etc done would be too much for me.

I did test RC2 in same way but not went into the defender gui i just rebooted, defender gui was inoperable as expected, registry check shown that tamper is still on (0x5 or 0x1) but that not matter as defender was nowhere to be seen.

I did try the RunAsTI method to force set the Tamper registry but it caused MRP abort out because it not return control back to mrp from the calling script. MRP will NOT run as TI as it not required and can cause issues otherwise so it will never be run as TI same as SYSTEM it just upsets all the HKCU settings (Current or Main User).

I don't think it is needed, but then the user can ignore the MRP method and just use another tool to control defender.

If all goes to plan then MRP 150 will be ready for release tomorrow.

Have added a new theme Viglen, that took me a few attempts to get to work. The wallpaper is a space themed one as i not able to find a Viglen suitable wallpaper.

There are quite a few changes in MRP150 and sadly my notes went walk about, probably defender sneaked on my pc and ate them so the changelog will not show everything done, as i lost a few revert scripts as i fixed the issues i had and not make backups...

No major panic as the most important thing is that the project works properly.

Creator v54.0 is complete too ready for MRP150. It has a few more tool tips/msg boxes when using for example 'Disable Defender' and 'Disable CompaTelRunner' options to explain more about them. Other little bits done in the code too.

 

Have uploaded MRP v150.0 , 2nd post download link, password and hashes have been updated.

Spoiler: MRP150 Summary

Added new Brand theme: Viglen - can be selected in the Creator 54.0 or automatically if the device has the DMI entries {some Intel boards are Viglen type}.

Updated information in the creator for the 'Disable CompatTelRunner' and 'Disable Defender' options so that they give more information on what they can/cant do.

When using the Disable Defender option, as soon as the Desktop appears, go to settings > Privacy/Security > Open Defender navigate to the Manage Settings to turn off real-time scanning and Tamper Protection to make sure they are disabled before you reboot. Although it not matter because once the computer has been rebooted Defender has been disabled from scanning/updating etc. Also after a reboot cycle the Defender GUI will not open, it will just be a blank window.

Note that no tasks/Services can restart it will be running. There will NOT be a revert script so choose wisely if you want to not use it. It may be best to leave this option unselected and use a 3rd party tool to either disable it or remove it from the Install.WIM file prior to deploying the OS. The MRP method does a good job of making sure it is not operative.

Fixed an issue when using the block telemetry option in that before it prevented the Data Usage graph section in Settings from working. Due to the adjustments in the code you will now you will see the banner(s) in Settings App.

Updated the 'Disable the 'Get more..' and Windows Experience notifications' option to make sure it stays quiet!

Disable WU safeguards for Win10/11, this allows the OS to 'feature' upgrade to the next build that would normally of been blocked from running/installing due to some m$ reasons.

Updated the prevent Edge from creating the Desktop shortcut, it may appear for a few seconds before being auto removed, however it may also leave a white icon on the Taskbar where the Edge Icon would of been on W11 installs. Sadly unable to delete this via a script because the taskbar works different on w11, so you will need to manually remove it from the taskbar.

Plus many other code updates which has been done since the last release.

 

Started on MRP 151

Need to work out what on Vista/Server2008 is missing/not working on the GUI QT but is on the old QT -- to see if i can get the results again...

 

In MRP150 changelog:

 

Will see about adding a multi select option for it in the Creator, will need to make sure the default is left as-is so not to cause issues.

 

It took a few attempts to 'adjust' the code without removing any services/tasks etc, everything is just disabled so in theory it could be reverted but would take a lot of effort due to the amount of parts used in the routine to disable it in the first place.

As i mentioned in my previous post(s) that the 'Tamper Protection' registry item is still set as on (0x5 or 0x1 depending on OS) but as the rest of the Defender tasks/services are disabled that is really immaterial because from my testing nothing is running, not sure if any later WU operation may change that by reinstalling part of defender such as the SecHealth UI exe, but i not had any defender definitions found or installed via WU and it never seemed to re-appear.

 

Some developments with MRP 151...

Disable Defender, have managed to switch off the Tamper Protection in registry, although the pc WILL require a reboot (not a signout/in cycle) to unlock the TamperProtection entry.

So until the reboot cycle (which is required really to make sure all other options/tweaks get established properly) the tamper bit is still set as ON (0x5 or 0x1 depending on OS), but after the reboot the registry value is set as 0x0 or 0x4 depending on OS for disabled. You can then adjust the value manually in the registry if you so wish as the key/value is hopefully unlocked.

Either way Defender is disabled via tasks etc.

The MRP log will show that Tamper is still enabled but technically it is not it just a matter of timing i think to when it gets changed. If you do the reboot cycle and check the registry entry then it should be changed from 0x1 or (0x5) to 0x0 or (0x4).

See QT log below...

Spoiler: GUI QT test after reboot

Code:

-------------------------------------------------------------------------------------------------------------------
                                             Query Tool GUI v0.10.6.18
-------------------------------------------------------------------------------------------------------------------

Log Date {UTC}: 03/03/2023 -- 15:49 {24-hour}

Some results may be shortened to fit the output stage, such as RAM information or storage drive names.

This is the postable report that does not contain full serial or sensitive information.

GUI Font Used : Lucida Console Size: 11

===================================================================================================================
                                             Operating System Information
===================================================================================================================
Installation Type               : Client
Name                            : Microsoft Windows 11 Education
Edition Name {Registry}         : Education
Composition Name {Registry}     : Enterprise
OS/CPU Architecture             : CPU and OS is 64 bit
Build                           : 10.0.22621 {UBR:382} {22H2}
Initial Full Build Information  : 22621.1.amd64fre.ni_release.220506-1250
Build Branch                    : ni_release {Nickel}
Setup/Install Locale            : English (United Kingdom)
GeoID Nation ISO Location       : United Kingdom
Current Keyboard Language       : English - United Kingdom {2057}
Current Keyboard Name           : Enhanced (101- or 102-key)
Number of Function Keys         : 12
Keyboard Description            : USB Input Device
Installed/Available Languages   : en-GB en-US
Stock Keeping Unit {SKU}        : 121
Experience Pack                 : 1000.22632.1000.0
Installation Date/Time {UTC}    : 03/03/2023 at 14:50 PM
Last Boot Up Date/Time {UTC}    : 03/03/2023 at 15:46 PM
Product ID                      : 00328-00000-00000-AA886  {Extended: 03612-03280-000-000000-00-2057-22621.0000-0622023}
Time Zone Data                  : GMT Standard Time
Hours offset from GMT           : 0
Daylight Saving In Effect       : No
Daylight Adjust Clock Mode      : Enabled/Checked
Upgrade or Clean Installation   : Clean
Previous OS Upgraded From       : N/A

StorageSense Policy             : Disabled {0x0}
Number of Licensed Users        : 1
Data Execution Prevention       : OptIn/Default {Ref: 2}
DEP Available                   : Yes
DEP 32Bit Applications          : Yes
DEP Drivers                     : Yes
DEP Support Policy              : Enabled for OS Kernel, essential binaries and all Windows-based Services.
Clipboard History Service       : Disabled {Value:4}
Clipboard History               : Disabled {0}
Allow Cross Device History      : Enabled {Default}
Allow Clipboard History         : Enabled {Default}
Current Power Policy Used       : Home/Office Desk
Power Plans Available           : Balanced Only {Others may be 'hidden'}
Current Active Power Plan       : Balanced
Long File Paths Enabled         : Yes {0x1} NTFS set to allow file paths greater than 260 characters
Part of a Domain                : No
Domain/Device Role              : Standalone Workstation {Ref: 0}
Portable OS {Win to Go}         : No
Feature Update Status           : N/A on this OS
Quality Update Status           : N/A on this OS
WSH Availability Status         : Windows Scripting Host is not restricted. {All Users}
WSH 'DisplayLogo' Value         : Enabled {1} [All Users]
HVCI Protection Status          : Disabled {0}
Download Over Metered Internet  : No
Exclude Drivers from MS/WU      : Undefined
Pointing Device {Mouse}         : HID-compliant mouse

Hypervisor Present/Installed    : No
Virtual Machine Data            : This computer does not appear to be a virtual machine
Shipped with Reserved 7GB       : No
Dirty Shutdown Count            : N/A

Windows Key 1 Installed         : 7CFBY (Last 5 digits shown)
Windows DpID4 Installed         : 7CFBY (Last 5 digits shown)
Windows Default Installed       : 8HV2C (Last 5 digits shown)
Windows Default4 Installed      : 8HV2C (Last 5 digits shown)

TPM Information                 : Active : N/A, Enabled : N/A, Owned : N/A, Version : N/A, Vendor : N/A

=============== Windows 11 Checks ===============
Checked for W11 Target Upgrade  : No
Target Build Number             : N/A
Device is OEM Specific          : N/A
DirectX 12 Detected             : N/A
Device is Genuine               : N/A
Touch Capable Hardware          : N/A
Upgrade Experience {1}          : N/A
Upgrade Experience {2}          : N/A
Upgrade Fail Reason{s}          : N/A
Bypass TPM Check                : N/A
Bypass Secure Boot Check        : N/A
Bypass RAM Check                : N/A
Allow W11 WU Upgrade            : Yes {1}
CompatTelRunner.exe {Appraiser} : Process is not running. {File is not present in C:\Windows\System32}

If 'N/A' is shown then the data may not of been fully compiled by the OS or via WU yet.
When Fail Reason's are listed then they are not compatible and will be blocked for the upgrade.
If any Upgrade Experience's are listed as 'Orange' then they will require attention to pass the OS checks.
If CompatTelRunner.exe is prevented from running then the W11 checks will not be performed.

===================================================================================================================
                                  Booted System Drive Partition Information
===================================================================================================================
Drive Type                      : SSD
BUS Type                        : SATA
Total Space                     : 446.4 GB
Free Space                      : 433.02 GB
Partition Type                  : GPT
Firmware Boot Type              : UEFI Mode {R:1}
Secure Boot Status              : Disabled [Ref:1]
File System                     : NTFS
System Drive Letter             : C:

Interface Information           : What mode an interface is in
IDE Controller Mode             : Advanced Host Controller Interface {AHCI}
SCSI Controller Mode            : Microsoft Storage Spaces

Disk and Partition Information  : Driveletter | Disk #, Partition # | Model Name {50 Chars max} | Size 'GB'
\\.\PHYSICALDRIVE0                C: | Disk #0, Partition #1 | SATA3 480GB SSD                                    | 446.4 GB
\\.\PHYSICALDRIVE1                D: | Disk #1, Partition #0 |  USB  SanDisk 3.2Gen1 USB Device                   | 57.3 GB

Drive letters/Partitions are shown as they are defined via the connected ports in the BIOS.
Partitions without Drive letters assigned are not shown.

===================================================================================================================
                                          Memory Information                                                       
===================================================================================================================
Total Physical                  : 8197296 KB (7.82 GB)
Available Physical              : 6922796 KB (6.6 GB)
Total Page Size                 : 10163376 KB (9.69 GB)
Available Page Size             : 9149380 KB (8.73 GB)
Total Virtual Size              : 4194176 KB (4 GB)
Available Virtual               : 3999164 KB (3.81 GB)
Memory Type                     : DDR3 {24}
Memory Error Correction         : Non-ECC
Memory Slots Fitted             : 2
Memory Slots Used               : 2
Memory Slots Free               : 0
Motherboard's Max Memory        : 16777216 KB (16 GB}
DIMM Information {First Eight}  : ChannelA-DIMM0 4096MB @ 1333MHz
                                  ChannelB-DIMM0 4096MB @ 1333MHz

===================================================================================================================
                                          Graphics Information                                                     
===================================================================================================================
Adaptor Name                    : Microsoft Basic Display Adapter
Adaptor DACType                 : Intel Corporation
Adaptor Driver Information      : 10.0.22621.1 {2006/06/21}
Adaptor Status                  : Active

Adaptor Name                    : Not Detected
Adaptor DACType                 : N/A
Adaptor Driver Information      : N/A
Adaptor Status                  : Inactive

Virtual Desktop Resolution      : 819 x 614
Bits Per Pixel                  : 32
Video Mode Description          : 1024 x 768 x 4294967296 colors {Ref:1}

Some values may not be accurate due to 32 bit API limitations.

===================================================================================================================
                                        Network Adaptor Information                                               
===================================================================================================================
Adaptor 1 Name                  : Realtek PCIe GbE Family Controller
Connection Status               : Media Disconnected
MAC Address                     : 60:A4:4C:xx:xx:A1

===================================================================================================================
                                          Processor 1 Information                                                 
===================================================================================================================
Name                            : Intel(R) Core(TM) i3-3220 CPU @ 3.30GHz
Architecture  {Bits}            : 64
L2 Cache Size {MB}              : 512
L3 Cache Size {MB}              : 3072
Current / Max Speed {MHz}       : 3300 / 3300 {Not Turbo Speed}
Physical Cores                  : 2
Logical Cores                   : 4
Processor Id                    : 0xBFEBFBFF000306A9
Virtualization Mode             : Enabled
Manufacturer                    : GenuineIntel [Intel]
Description                     : Intel64 Family 6 Model 58 Stepping 9
Motherboard Connection          : LGA1155
OS Loaded Microcode Revision    : 0x0000000021000000
Bios Microcode Revision         : 0x0000000017000000
Processor Family                : 191
Sockets/CPU's Present           : 1
Feature Set                     : 0x000000003D1B3FFF

Motherboard Connection is based on a OS internal database, MS may not have updated it.
Microcode registry values are converted from binary to hexadecimal, not reliable for all devices.

===================================================================================================================
                                             DMI/BIOS Information                                                 
===================================================================================================================
System Manufacturer             : System manufacturer
System Product Name             : System Product Name
BaseBoard Manufacturer          : ASUSTeK COMPUTER INC.
BaseBoard Product               : P8H61-MX USB3
BaseBoard Version               : Rev X.0x
PC System Type                  : Desktop {Ref: 1}

BIOS Vendor                     : American Megatrends Inc.
BIOS Release Date               : 08/27/2013
BIOS Version                    : 1003
Primary BIOS                    : Yes
SMBIOS Present                  : Yes
SMBIOS Version                  : 2.7
SLIC/BIOS Data                  : ALASKA - 1072009

Valid SLIC Name                 : No Valid SLIC Table {See notes below}
Possible Brand Theme            : Asus {BaseBoard Manufacturer}

SLIC Table Status               : SLIC table with valid marker present  {v2.1} {See notes below}
Emulated SLIC                   : Not required/used for this OS

MSDM Key Description            : No MSDM key Description found
MSDM Key Detected               : Not Present
MSDM Key OS Version/Edition     : N/A

Notes                           : When in UEFI mode the SLIC information may not be shown fully as it may be partially 'hidden' by the OEM/BIOS.

===================================================================================================================
                                          Miscellaneous Information                                               
===================================================================================================================
Which MRP Version Used          : CY23M03D03-R151.TV1

Wallpaper Style                 : Stretch image to display resolution
Current Theme Used              : $OEM$.theme

Installed Dot Net Frameworks    : 4.8  4.0 
Installed Powershell Versions   : 1.0, 2.0, 3.0, 4.0, 5.0, 5.1

Security Product Name{s}        : Windows Defender
Defender Tamper Protection      : Both Tamper and Cloud-delivered Protections are disabled
Defender TProtection Exclusions : Disabled
Defender Service Status         : Disabled
Defender Code Integrity Mode    : Disabled
Defender Credential Guard       : Disabled
Windows Firewall Service State  : Running {Reg: Auto}

Windows Activation Status       : Windows is in Notification mode
Windows Licence Reason          : C004F034
Windows Product Key Channel     : Retail {R:PKC}
Device has KMS Enabled          : No
KMS Auto Renewal (hook)         : No

MS Office {MSI/Traditional}     : Not Detected
C2R MS Office                   : Not Detected
C2R Excluded Apps               : N/A
C2R Last Update Channel         : N/A
C2R Office Activation Status    : N/A
C2R Partial Product Key         : N/A
Office Reason Information       : No reason information to show/No Issues
Office MAK/KMS Information      : No MAK or KMS activation detected

-------------------------------------------------------------------------------------------------------------------
                                              End of Report
-------------------------------------------------------------------------------------------------------------------

 

It is in the main MRP 150 archive on the 2nd Post of the thread.

 

The creator just creates the tweaks ini file so that MRP 150(1) can take action of those the user has selected, it is not a stand alone tweaker.

 

Widgets on the Taskbar i think i have managed to fix that in the next MRP (151) as i not seen it appear again on my testing, as i was also updating the News/Interests/Chat routines to hide/disable them better.

Most Options i check to see if they need updating and the above 3 had been changed yet again by m$ so i counteracted the changes and seems like they now disabled/hidden again.

 

You need to login to view this posts content.