TaskbarDa (Widgets) registry change is now blocked

You need to login to view this posts content.

 

You need to login to view this posts content.

 

what version of windows 11 are we talking about?

i'm on 23h2 latest cu and that reg setting is 0 and i have no widget icon.

 

BTW, they do harder on Windows 10 with ShellFeedsTaskbarViewMode replaced by a hashed EnShellFeedsTaskbarViewMode !
Here I don't want use Policy to block "News and interests" widget, just disable it, then user can enable it if he wants, like before June 2024 (or KB5036979 )

 

You need to login to view this posts content.

 

Thanks! is there EnShellFeedsTaskbarViewMode.exe by lucky789741 available ?

 

Isn't the other workaround to disable UCPD service, and the scheduled task which enforces it?

 

I've hijacked this Windows 11 topic. Better was create a new topic but want genius get notified .
EnShellFeedsTaskbarViewMode is only for Windows 10 and value is hashed instead 0/1 switch for Windows 11.
reg1.exe is only the UCPD regedit protection bypass.

 

Yeah, sorry I wasn't clear when I was replying on W11.

 

Some clarification might be needed here, you use EncShellFeedsTaskbarViewMode while the image in @jeff789741 's post above clearly shows EnShellFeedsTaskbarViewMode
surely only one of these could be correct?

 

indeed EnShellFeedsTaskbarViewMode , sorry typo, posts edited

 

I can't find where I can attach files but I made a PowerShell script that performs the same job without error handling.

We can import HashData first

Code:

$MethodDefinition = @'

[DllImport("Shlwapi.dll", CharSet = CharSet.Unicode, ExactSpelling = true, SetLastError = false)]
   public static extern int HashData(
    byte[] pbData,
    int cbData,
    byte[] piet,
   int outputLen);

'@
$Shlwapi = Add-Type -MemberDefinition $MethodDefinition -Name 'Shlwapi' -Namespace 'Win32' -PassThru

Set option variable (2 is for off)

Code:

$option=2

Get MachineId from registry
the fallback value is hardcoded into explorer.exe

Code:

$machineIdReg = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\SQMClient\' -Name 'MachineId' -ErrorAction SilentlyContinue
$machineId = '{C283D224-5CAD-4502-95F0-2569E4C85074}' #Fallback Value
if($machineIdReg) {
    $machineId = $machineIdReg.MachineId
}

Do what the Encrypt algorithm does in explorer.exe

Code:

$combined = $machineId+'_'+$option.ToString()
$reverse = $combined[($combined.Length-1)..0] -join ''
$bytesIn = [system.Text.Encoding]::Unicode.GetBytes($reverse)
$bytesOut = [byte[]]::new(4)
$Shlwapi::HashData($bytesIn,0x53, $bytesOut, $bytesOut.Count)

Convert bytes to dword

Code:

$dwordData = [System.BitConverter]::ToUInt32($bytesOut,0)

Make the reg1.exe

Code:

Copy-Item (Get-Command reg).Source .\reg1.exe

Run the reg1.exe
There are reports about feeds turning self back to previous state when first build of this encryption thing was released because ShellFeedsTaskbarViewMode isn't being set and part of it still respects it so I still set the value

Code:

Start-Process -NoNewWindow -Wait -FilePath .\reg1.exe -ArgumentList 'ADD','HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Feeds\','/v','ShellFeedsTaskbarViewMode','/t','REG_DWORD','/d',$option,'/f'
Start-Process -NoNewWindow -Wait -FilePath .\reg1.exe -ArgumentList 'ADD','HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Feeds\','/v','EnShellFeedsTaskbarViewMode','/t','REG_DWORD','/d',$dwordData,'/f'

 

mklink work fine .. too.
see 2 posts under (#17)

-------------------------

mklink ... will works too ?

Code:

cmd /c mklink %windir%\reg.exe %windir%\reg1.exe

edit.
error with syntax. i will fix it.

edit. this fail. access denied.
i want try something else

Code:

mklink /h %windir%\system32\reg_1.exe %windir%\system32\reg.exe

 

Thanks for your powershell code @jeff789741

 

this work, if you run as TI. (using mklink)

Code:

del /q c:\Windows\reg1.exe
mklink /h c:\Windows\reg1.exe c:\Windows\System32\reg.exe
reg1 add "HKLM\Software\Microsoft\Windows\CurrentVersion\Feeds" /f /v ShellFeedsTaskbarViewMode /t REG_DWORD /d 2
reg1 add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /f /v TaskbarDa /t REG_DWORD /d 0
del /q c:\Windows\reg1.exe
pause

 

I've made a note for my Windows 10 systems deployed before June 2024 where ShellFeedsTaskbarViewMode was set to 2 by RunOnce reg add ,
I had written down delete ShellFeedsTaskbarViewMode because users can't re-enable Feeds or if they can, not kept on Reboot.

 

You need to login to view this posts content.