Tweaks (#2051)

* Fix Numlock toggle (#2044) * Fix Numlock at login * Compile Winutil --------- Co-authored-by: ChrisTitusTech <[email protected]> * Compile Winutil * fix typo (#2041) * Compile Winutil * Update README.md * * Fixed .getignore issues, it's it not enough to just add to gitgnore if it was already tracked by git it will be continued to be tracked by git, so you have to 'git rm' it * Fixed ooshutup, there is no need to download configs, they are already compiled into winutil + Added a tweak to remove and disable Intel LMS, which have been identifed as a potential backdoor into Windows. * Update winget.ps1 * + Added new release actions, every time we merge into main it will create a release by extracting the version fromwinutil.ps1 and setting all appropriate tags and versions * fix merge * add compile back in * Update action to latest tools * Ensure Compile is finished --------- Co-authored-by: Chris Titus <[email protected]> Co-authored-by: ChrisTitusTech <[email protected]> Co-authored-by: nikolan <[email protected]> Co-authored-by: KonTy <[email protected]> Co-authored-by: Chris Titus <[email protected]>
ChrisTitusTech · Jun 10, 2024 · 2ced2f7 · 2ced2f7
1 parent bea87e8
commit 2ced2f7
Show file tree

Hide file tree

Showing 9 changed files with 140 additions and 35 deletions.
diff --git a/.github/workflows/compile.yaml b/.github/workflows/compile.yaml
@@ -0,0 +1,24 @@
+name: Compile
+
+on:
+  push: 
+    branches: 
+      - main
+      - test*
+
+jobs:
+  build-runspace:
+    runs-on: windows-latest
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: ${{ github.head_ref }}
+    - name: Compile project
+      shell: pwsh
+      run: |
+        Set-ExecutionPolicy Bypass -Scope Process -Force; ./Compile.ps1
+      continue-on-error: false # Directly fail the job on error, removing the need for a separate check
+    - uses: stefanzweifel/git-auto-commit-action@v5
+      with:
+        commit_message: Compile Winutil
+      if: success()
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -1,24 +1,42 @@
-name: Update Branch
+name: Release WinUtil
 
 on:
-  push: 
-    branches: 
-      - main
-      - test*
+  workflow_run:
+    workflows: ["Compile WinUtil"] #Ensure Compile winget.ps1 is done
+    types:
+      - completed
 
 jobs:
   build-runspace:
     runs-on: windows-latest
     steps:
-    - uses: actions/checkout@v4
-      with:
-        ref: ${{ github.head_ref }}
-    - name: Compile project
-      shell: pwsh
-      run: |
-        Set-ExecutionPolicy Bypass -Scope Process -Force; ./Compile.ps1
-      continue-on-error: false # Directly fail the job on error, removing the need for a separate check
-    - uses: stefanzweifel/git-auto-commit-action@v5
-      with:
-        commit_message: Compile Winutil
-      if: success()
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Extract Version from winutil.ps1
+        id: extract_version
+        run: |
+          $version = ''
+          Get-Content ./winutil.ps1 -TotalCount 30 | ForEach-Object {
+            if ($_ -match 'Version\s*:\s*(\d{2}\.\d{2}\.\d{2})') {
+              $version = $matches[1]
+              echo "version=$version" >> $GITHUB_ENV
+              break
+            }
+          }
+          if (-not $version) {
+            Write-Error "Version not found in winutil.ps1"
+            exit 1
+          }
+        shell: pwsh       
+
+      - name: Create and Upload Release
+        id: create_release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ steps.extract_version.outputs.version }}
+          name: Release ${{ steps.extract_version.outputs.version }}
+          body_path: path/to/release-notes.md
+          files: ./winutil.ps1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/README.md b/README.md
@@ -32,10 +32,9 @@ or by executing:
 iwr -useb https://christitus.com/win | iex
 ```
 
-if for some reason this site is not reachable from your country please try running it directly from github
-
+if for some reason this site is not reachable from your country please try running it directly from github (replace 24.06.07 with current release that you are interested in)
 ```
-irm https://raw.githubusercontent.com/ChrisTitusTech/winutil/main/winutil.ps1 | iex
+irm "https://raw.githubusercontent.com/ChrisTitusTech/winutil/24.06.07/winutil.ps1" | iex
 ```
 
 #### Automation
@@ -128,7 +127,9 @@ If you encounter any challenges or problems with the script, I kindly request th
 
 ## Contribute Code
 
-To contribute new code, please ensure that it is submitted to the **TEST BRANCH**. Please note that merges will not be performed directly on the MAIN branch.
+If you adding, changing, or deleting an Application... submit to **APPLICATIONS branch**. We batch these in at the end of the month.
+
+If doing a code change and you can submit a PR to main branch, but I am very selective about these. Do not use a code formatter, massive amounts of line changes, and make multiple feature changes. EACH FEATURE CHANGE SHOULD BE IT'S OWN Pull Request!
 
 When creating pull requests, it is essential to thoroughly document all changes made. This includes documenting any additions made to the tweaks section and ensuring that corresponding undo measures are in place to remove the newly added tweaks if necessary. Failure to adhere to this format may result in denial of the pull request. Additionally, comprehensive documentation is required for all code changes. Any code lacking sufficient documentation may also be denied.
 

diff --git a/config/ooshutup10_recommended.cfg b/config/ooshutup10_recommended.cfg
@@ -1,5 +1,5 @@
 ############################################################################
-# This file was created with O&O ShutUp10++ V1.9.1436
+# This file was created with O&O ShutUp10++ V1.9.1438
 # and can be imported onto another computer. 
 #
 # Download the application at https://www.oo-software.com/shutup10
@@ -13,7 +13,7 @@
 # user does not get any feedback about the import.
 #
 # We are always happy to answer any questions you may have!
-# © 2015-2023 O&O Software GmbH, Berlin. All rights reserved.
+# © 2015-2024 O&O Software GmbH, Berlin. All rights reserved.
 # https://www.oo-software.com/
 ############################################################################
 
@@ -179,6 +179,8 @@ C015	+
 C101	+
 C201	+
 C102	+
+C103	+
+C203	+
 L001	+
 L003	+
 L004	-
@@ -208,9 +210,9 @@ S014	-
 K001	+
 K002	+
 K005	+
-M003	-
+M003	+
 M015	+
-M016	-
+M016	+
 M017	-
 M018	+
 M019	-
@@ -221,7 +223,9 @@ M001	+
 M004	+
 M005	+
 M024	+
+M026	+
+M027	+
 M012	-
 M013	-
 M014	-
-N001	-
+N001	-
diff --git a/config/tweaks.json b/config/tweaks.json
@@ -2232,7 +2232,7 @@
     "Description": "Creates a restore point at runtime in case a revert is needed from WinUtil modifications",
     "category": "Essential Tweaks",
     "panel": "1",
-    "Checked": "True",
+    "Checked": "False",
     "Order": "a001_",
     "InvokeScript": [
       "
@@ -2394,7 +2394,7 @@
     ],
     "InvokeScript": [
       "
-      Write-Host \"Remove Popilot\"
+      Write-Host \"Remove Copilot\"
       dism /online /remove-package /package-name:Microsoft.Windows.Copilot  
       "
     ],
@@ -2405,6 +2405,64 @@
       "
     ]
   },
+  "WPFTweaksDisableLMS1": {
+    "Content": "Disable Intel MM (vPro LMS)",
+    "Description": "Intel LMS service is always listening on all ports and could be a huge security risk. There is no need to run LMS on home machines and even in the Enterprise there are better solutions.",
+    "category": "Essential Tweaks",
+    "panel": "1",
+    "Order": "a0015_",
+    "InvokeScript": [
+        "
+        Write-Host \"Kill OneDrive process\"
+        $serviceName = \"LMS\"   
+        Write-Host \"Stopping and disabling service: $serviceName\"
+        Stop-Service -Name $serviceName -Force -ErrorAction SilentlyContinue;
+        Set-Service -Name $serviceName -StartupType Disabled -ErrorAction SilentlyContinue;
+
+        Write-Host \"Removing service: $serviceName\";
+        sc.exe delete $serviceName;
+
+        Write-Host \"Removing LMS driver packages\";
+        $lmsDriverPackages = Get-ChildItem -Path \"C:\\Windows\\System32\\DriverStore\\FileRepository\" -Recurse -Filter \"lms.inf*\";
+        foreach ($package in $lmsDriverPackages) {
+            Write-Host \"Removing driver package: $($package.Name)\";
+            pnputil /delete-driver $($package.Name) /uninstall /force;
+        }
+        if ($lmsDriverPackages.Count -eq 0) {
+            Write-Host \"No LMS driver packages found in the driver store.\";
+        } else {
+            Write-Host \"All found LMS driver packages have been removed.\";
+        }
+
+        Write-Host \"Searching and deleting LMS executable files\";
+        $programFilesDirs = @(\"C:\\Program Files\", \"C:\\Program Files (x86)\");
+        $lmsFiles = @();
+        foreach ($dir in $programFilesDirs) {
+            $lmsFiles += Get-ChildItem -Path $dir -Recurse -Filter \"LMS.exe\" -ErrorAction SilentlyContinue;
+        }
+        foreach ($file in $lmsFiles) {
+            Write-Host \"Taking ownership of file: $($file.FullName)\";
+            & icacls $($file.FullName) /grant Administrators:F /T /C /Q;
+            & takeown /F $($file.FullName) /A /R /D Y;
+            Write-Host \"Deleting file: $($file.FullName)\";
+            Remove-Item $($file.FullName) -Force -ErrorAction SilentlyContinue;
+        }
+        if ($lmsFiles.Count -eq 0) {
+            Write-Host \"No LMS.exe files found in Program Files directories.\";
+        } else {
+            Write-Host \"All found LMS.exe files have been deleted.\";
+        }        
+        Write-Host 'Intel LMS vPro service has been disabled, removed, and blocked.';
+       "
+    ],
+    "UndoScript": [
+      "
+      Write-Host \"Install Microsoft Edge\"
+      taskkill.exe /F /IM \"OneDrive.exe\"
+
+      "
+    ]
+  },  
   "WPFTweaksRemoveOnedrive": {
     "Content": "Remove OneDrive",
     "Description": "Copies OneDrive files to Default Home Folders and Uninstalls it.",
@@ -3084,4 +3142,4 @@
     "Order": "a082_",
     "Type": "300"
   }
-}
+}
diff --git a/functions/private/Invoke-WinUtilNumLock.ps1 b/functions/private/Invoke-WinUtilNumLock.ps1
@@ -15,7 +15,7 @@ function Invoke-WinUtilNumLock {
             Write-Host "Disabling Numlock on startup"
             $value = 0
         }
-        $Path = "HKCU:\Control Panel\Keyboard"
+        $Path = "HKU:\.Default\Control Panel\Keyboard"
         Set-ItemProperty -Path $Path -Name InitialKeyboardIndicators -Value $value
     }
     Catch [System.Security.SecurityException] {

diff --git a/functions/public/Invoke-WPFOOSU.ps1 b/functions/public/Invoke-WPFOOSU.ps1
@@ -28,13 +28,13 @@ function Invoke-WPFOOSU {
         }
         "recommended"{
             $oosu_config = "$ENV:temp\ooshutup10_recommended.cfg"
-            Invoke-WebRequest -Uri "https://raw.githubusercontent.com/ChrisTitusTech/winutil/main/config/ooshutup10_recommended.cfg" -OutFile $oosu_config
+            $sync.configs.ooshutup10_recommended | Out-File -FilePath $oosu_config -Force
             Write-Host "Applying recommended OO Shutup 10 Policies"
             Start-Process $OOSU_filepath -ArgumentList "$oosu_config /quiet" -Wait
         }
         "undo"{
             $oosu_config = "$ENV:temp\ooshutup10_factory.cfg"
-            Invoke-WebRequest -Uri "https://raw.githubusercontent.com/ChrisTitusTech/winutil/main/config/ooshutup10_factory.cfg" -OutFile $oosu_config
+            $sync.configs.ooshutup10_factory | Out-File -FilePath $oosu_config -Force
             Write-Host "Resetting all OO Shutup 10 Policies"
             Start-Process $OOSU_filepath -ArgumentList "$oosu_config /quiet" -Wait
         }

diff --git a/winget.ps1 b/winget.ps1
@@ -922,4 +922,4 @@ try {
         }
         Write-Warning "Error: $($_.Exception.Message)`n"
     }
-}
+}
diff --git a/winutil.ps1 b/winutil.ps1
@@ -1987,7 +1987,7 @@ function Invoke-WinUtilNumLock {
             Write-Host "Disabling Numlock on startup"
             $value = 0
         }
-        $Path = "HKCU:\Control Panel\Keyboard"
+        $Path = "HKU:\.Default\Control Panel\Keyboard"
         Set-ItemProperty -Path $Path -Name InitialKeyboardIndicators -Value $value
     }
     Catch [System.Security.SecurityException] {
@@ -10950,7 +10950,7 @@ $sync.configs.tweaks = '{
     ],
     "InvokeScript": [
       "
-      Write-Host \"Remove Popilot\"
+      Write-Host \"Remove Copilot\"
       dism /online /remove-package /package-name:Microsoft.Windows.Copilot  
       "
     ],