jacob.b.nelson2
e4741ccc96
Fully unattended Windows 11 Pro build using Autounattend.xml, swtpm for TPM 2.0 emulation, and VirtIO drivers. Five PowerShell provisioners strip bloatware, telemetry, unused services, and apply performance tuning for a resource-constrained host. Output is a compressed QCOW2 image. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
64 lines
3.5 KiB
PowerShell
64 lines
3.5 KiB
PowerShell
#Requires -RunAsAdministrator
|
|
|
|
# Telemetry level — policy key can enforce 0 (Security) even on Home/Pro
|
|
$telemetryPaths = @(
|
|
"HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection",
|
|
"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection"
|
|
)
|
|
foreach ($p in $telemetryPaths) {
|
|
New-Item -Path $p -Force -ErrorAction SilentlyContinue | Out-Null
|
|
Set-ItemProperty -Path $p -Name AllowTelemetry -Value 0 -Type DWord -Force
|
|
Set-ItemProperty -Path $p -Name MaxTelemetryAllowed -Value 0 -Type DWord -Force
|
|
}
|
|
|
|
# Advertising ID
|
|
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo" -Force -ErrorAction SilentlyContinue | Out-Null
|
|
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo" -Name DisabledByGroupPolicy -Value 1 -Type DWord -Force
|
|
|
|
# Windows Error Reporting
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f | Out-Null
|
|
|
|
# Customer Experience Improvement Program
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\SQMClient\Windows" /v CEIPEnable /t REG_DWORD /d 0 /f | Out-Null
|
|
|
|
# Feedback notifications
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v DoNotShowFeedbackNotifications /t REG_DWORD /d 1 /f | Out-Null
|
|
|
|
# Cortana and web search
|
|
$searchPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search"
|
|
New-Item -Path $searchPath -Force -ErrorAction SilentlyContinue | Out-Null
|
|
Set-ItemProperty -Path $searchPath -Name AllowCortana -Value 0 -Type DWord -Force
|
|
Set-ItemProperty -Path $searchPath -Name DisableWebSearch -Value 1 -Type DWord -Force
|
|
Set-ItemProperty -Path $searchPath -Name ConnectedSearchUseWeb -Value 0 -Type DWord -Force
|
|
Set-ItemProperty -Path $searchPath -Name AllowSearchToUseLocation -Value 0 -Type DWord -Force
|
|
|
|
# Activity History / Timeline
|
|
$systemPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System"
|
|
New-Item -Path $systemPath -Force -ErrorAction SilentlyContinue | Out-Null
|
|
Set-ItemProperty -Path $systemPath -Name EnableActivityFeed -Value 0 -Type DWord -Force
|
|
Set-ItemProperty -Path $systemPath -Name PublishUserActivities -Value 0 -Type DWord -Force
|
|
Set-ItemProperty -Path $systemPath -Name UploadUserActivities -Value 0 -Type DWord -Force
|
|
|
|
# Disable DiagTrack (telemetry) service
|
|
Stop-Service DiagTrack -Force -ErrorAction SilentlyContinue
|
|
Set-Service DiagTrack -StartupType Disabled -ErrorAction SilentlyContinue
|
|
|
|
# Disable telemetry-related scheduled tasks
|
|
$tasks = @(
|
|
@{Path="\Microsoft\Windows\Application Experience"; Name="Microsoft Compatibility Appraiser"},
|
|
@{Path="\Microsoft\Windows\Application Experience"; Name="ProgramDataUpdater"},
|
|
@{Path="\Microsoft\Windows\Application Experience"; Name="StartupAppTask"},
|
|
@{Path="\Microsoft\Windows\Autochk"; Name="Proxy"},
|
|
@{Path="\Microsoft\Windows\Customer Experience Improvement Program"; Name="Consolidator"},
|
|
@{Path="\Microsoft\Windows\Customer Experience Improvement Program"; Name="UsbCeip"},
|
|
@{Path="\Microsoft\Windows\DiskDiagnostic"; Name="Microsoft-Windows-DiskDiagnosticDataCollector"},
|
|
@{Path="\Microsoft\Windows\Feedback\Siuf"; Name="DmClient"},
|
|
@{Path="\Microsoft\Windows\Feedback\Siuf"; Name="DmClientOnScenarioDownload"},
|
|
@{Path="\Microsoft\Windows\Maps"; Name="MapsToastTask"},
|
|
@{Path="\Microsoft\Windows\Maps"; Name="MapsUpdateTask"},
|
|
@{Path="\Microsoft\Windows\Windows Error Reporting"; Name="QueueReporting"}
|
|
)
|
|
foreach ($t in $tasks) {
|
|
Disable-ScheduledTask -TaskPath $t.Path -TaskName $t.Name -ErrorAction SilentlyContinue | Out-Null
|
|
}
|