🚀 Оптимизация на Windows 11 с PowerShell: Как да Подобрим Поверителността, Сигурността и Производителността 🛡️💻ewdfrewfewf

<#
    Script Name: Secure-Windows11-Enhanced.ps1
    Description: Comprehensive PowerShell script to optimize Windows 11 for privacy, security, and performance, with additional enhancements.
    Author: AiFlux (Toni Angelchovski) toni.linux@gmail.com
    Requirements: Run PowerShell as Administrator
#>

# -------------------------------------------
# SECTION 1: SYSTEM CHECK & INFORMATION
# -------------------------------------------
Write-Host "Performing system checks..." -ForegroundColor Cyan

# Detect Windows Edition
$windowsEdition = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").EditionID
Write-Host "Windows Edition: $windowsEdition"

# Determine if the system is Windows Home or Professional
$isPro = $windowsEdition -match "Professional"
$isHome = $windowsEdition -match "Home"

# Ensure the script is run as Administrator
If (-not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
    Write-Host "Please run PowerShell as Administrator!" -ForegroundColor Red
    exit
}

# ----------------------------------------------------------
# SECTION 2: DISABLE TELEMETRY & DATA COLLECTION
# ----------------------------------------------------------
Write-Host "Disabling telemetry and data collection..." -ForegroundColor Yellow

# Set telemetry level to lowest (Security) for Pro version
if ($isPro) {
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" -Value 0 -Force
} else {
    Write-Host "Telemetry settings are limited on Windows Home." -ForegroundColor Red
}

# Disable telemetry services
$telemetryServices = @("DiagTrack", "dmwappushservice")
foreach ($service in $telemetryServices) {
    Stop-Service -Name $service -Force -ErrorAction SilentlyContinue
    Set-Service -Name $service -StartupType Disabled
}

# -------------------------------------------------
# SECTION 3: OPTIMIZE STARTUP APPLICATIONS
# -------------------------------------------------
Write-Host "Optimizing startup applications..." -ForegroundColor Yellow

# Exclude important applications from being disabled
$excludedApps = @("Windows Security", "OneDrive", "Intel Rapid Storage")
$startupApps = Get-CimInstance -Class Win32_StartupCommand

foreach ($app in $startupApps) {
    if (-not ($excludedApps -contains $app.Name)) {
        Write-Host "Disabling startup application: $($app.Name)" -ForegroundColor Red
        Remove-Item -Path $app.Command -ErrorAction SilentlyContinue
    } else {
        Write-Host "Skipping important application: $($app.Name)" -ForegroundColor Green
    }
}

# ---------------------------------------------------
# SECTION 4: IMPROVE PRIVACY IN EDGE
# ---------------------------------------------------
Write-Host "Improving privacy settings in Microsoft Edge..." -ForegroundColor Yellow

# Create missing keys for Edge if not existing
New-Item -Path "HKCU:\Software\Microsoft\Edge\Privacy" -Force -ErrorAction SilentlyContinue
New-Item -Path "HKCU:\Software\Microsoft\Edge\Settings" -Force -ErrorAction SilentlyContinue

$edgePrivacySettings = @{
    "TelemetryEnabled" = 0
    "AdvertisingId" = 0
    "SmartScreenEnabled" = 0
    "BrowserTrackingProtectionEnabled" = 1
}

foreach ($setting in $edgePrivacySettings.GetEnumerator()) {
    Set-ItemProperty -Path "HKCU:\Software\Microsoft\Edge\Privacy" -Name $setting.Key -Value $setting.Value -Force
}

# Additional privacy settings
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Edge\Settings" -Name "SyncDisabled" -Value 1 -Force
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Edge\Settings" -Name "ExtensionInstallAllowlist" -Value 0 -Force

# -------------------------------
# SECTION 5: DISK CLEANUP
# -------------------------------
Write-Host "Performing automatic disk cleanup..." -ForegroundColor Yellow

cleanmgr.exe /sageset:1
Start-Process -FilePath "cleanmgr.exe" -ArgumentList "/sagerun:1" -NoNewWindow -Wait

# ------------------------------------------
# SECTION 6: ENHANCE REGISTRY SECURITY
# ------------------------------------------
Write-Host "Enhancing registry protection..." -ForegroundColor Yellow

# Restrict remote access to the registry
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\RemoteRegistry" -Name "Start" -Value 4 -Force

# Additional registry protection
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg" -Name "AuthorizedApplications" -Value 0 -Force
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedExactPaths" -Name "Machine" -Value "Software\Policies\Microsoft\Windows NT\CurrentVersion\SystemRestore" -Force

# ---------------------------------------------
# SECTION 7: CONFIGURE FIREWALL
# ---------------------------------------------
Write-Host "Configuring Windows Firewall..." -ForegroundColor Green

netsh advfirewall reset
netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound
netsh advfirewall set domainprofile state on
netsh advfirewall set privateprofile state on
netsh advfirewall set publicprofile state on

Set-NetFirewallProfile -Profile Domain,Private,Public -NotifyOnListen False
Set-NetFirewallProfile -Profile Domain,Private,Public -LogBlocked True -LogFileName "%SystemRoot%\System32\LogFiles\Firewall\pfirewall.log"

# ---------------------------------------------
# SECTION 8: CONFIGURE WINDOWS DEFENDER
# ---------------------------------------------
Write-Host "Ensuring Windows Defender is enabled..." -ForegroundColor Green

Set-MpPreference -DisableRealtimeMonitoring $false
Set-MpPreference -MAPSReporting 2
Set-MpPreference -SubmitSamplesConsent 1

# -------------------------------------------
# SECTION 9: DISABLE UNNECESSARY SERVICES
# -------------------------------------------
Write-Host "Disabling unnecessary services..." -ForegroundColor Yellow

$servicesToDisable = @(
    "XblGameSave",
    "XboxNetApiSvc",
    "RetailDemo",
    "MapsBroker",
    "OneSyncSvc"
)

foreach ($service in $servicesToDisable) {
    Stop-Service -Name $service -Force -ErrorAction SilentlyContinue
    Set-Service -Name $service -StartupType Disabled
}

# -----------------------------------------------
# SECTION 10: FINISH & RESTART RECOMMENDATION
# -----------------------------------------------
Write-Host "Optimizations are complete!" -ForegroundColor Cyan
Write-Host "It is recommended to restart your computer to apply the changes." -ForegroundColor Cyan