以下都是powershell,管理员身份
一、禁止或卸载Microsoft Defender/Endpoint Protection
禁止还是卸载,看你自己
#禁止命令
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration" /v "PreventPlatformUpdate" /t REG_DWORD /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "FallbackOrder" /d "FileShares" /t REG_SZ /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleDay" /t REG_DWORD /d 8 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ForceUpdateFromMU" /d 0 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /d 1 /t REG_DWORD /f
#卸载命令:注意操作之前做快照,以备不时之需要回滚
预览卸载Uninstall-WindowsFeature -Name Windows-Defender -WhatIf
真正卸载Uninstall-WindowsFeature -Name Windows-Defender
最后的那个-WhatIf参数是什么作用
在 PowerShell 中,-WhatIf 参数用于预览命令的结果,而不实际执行命令。当您使用 -WhatIf 参数运行命令时,PowerShell 会告诉您命令将执行哪些操作,但不会实际执行这些操作。这对于在执行潜在危险或破坏性操作之前检查命令的影响非常有用。
二、禁止可能影响渲染的计划任务
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance" /v "MaintenanceDisabled" /t REG_DWORD /d 1 /f
Get-ScheduledTask -TaskPath "\Microsoft\Windows\Data Integrity Scan\","\Microsoft\Windows\ApplicationData\","\Microsoft\Windows\Defrag\","\Microsoft\Windows\DiskCleanup\","\Microsoft\Windows\DiskDiagnostic\","\Microsoft\Windows\DiskFootprint\","\Microsoft\Windows\Windows Defender\","\Microsoft\Windows\Maintenance\" 2>$null | Disable-ScheduledTask 2>$null
Get-ScheduledTask | Where-Object { $_.TaskName -like "OneDrive*"}| Disable-ScheduledTask 2>$null
Get-Service MicrosoftEdge*, edgeupdate*|ft -auto
Get-Service GoogleChrome*, gupdate* | ft -auto
Get-Service MicrosoftEdge*, edgeupdate* | Set-Service -StartupType Disabled
Get-Service GoogleChrome*, gupdate* | Set-Service -StartupType Disabled
Get-ScheduledTask | Where-Object { $_.TaskName -like "MicrosoftEdgeUpdateTaskMachine*"} | Disable-ScheduledTask 2>&1 >$null
Get-ScheduledTask | Where-Object { $_.TaskName -like "GoogleUpdateTaskMachine*"} | Disable-ScheduledTask 2>$null
$client = new-object System.Net.WebClient
#$client.DownloadFile('http://windowsgz-1251783334.cos.ap-guangzhou.myqcloud.com/ziyan/Cloudbase-Init.zip','C:\Cloudbase-Init.zip')
$client.DownloadFile('http://windows-1251783334.cos.ap-shanghai.myqcloud.com/Cloudbase-Init.zip','C:\Cloudbase-Init.zip')
#wget "http://windowsgz-1251783334.cos.ap-guangzhou.myqcloud.com/ziyan/ec2service.py" -Outfile "C:\Program Files\Cloudbase Solutions\Cloudbase-Init\Python\Lib\site-packages\cloudbaseinit\metadata\services\ec2service.py"
#wget "http://windows-1251783334.cos.ap-shanghai.myqcloud.com/ec2service.py" -Outfile "C:\Program Files\Cloudbase Solutions\Cloudbase-Init\Python\Lib\site-packages\cloudbaseinit\metadata\services\ec2service.py"
$7zPath = "$env:ProgramFiles\7-Zip\7z.exe"
if (-not (Test-Path -Path $7zPath)) {
$client7 = new-object System.Net.WebClient
$client7.DownloadFile('http://windowsgz-1251783334.cos.ap-guangzhou.myqcloud.com/ziyan/7z2200-x64.msi','c:\7z2200-x64.msi')
msiexec.exe /i c:\7z2200-x64.msi /qn
Start-Sleep 30
del c:\7z2200-x64.msi 2>$null
}
& "$env:ProgramFiles\7-Zip\7z.exe" x -aoa C:\Cloudbase-Init.zip -o"C:\Program Files\Cloudbase Solutions\Cloudbase-Init\"
关闭UAC
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
开启UAC
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 1 /f
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v SaveZoneInformation /t REG_DWORD /d 1 /f 2>&1 > $null
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v SaveZoneInformation /t REG_DWORD /d 1 /f 2>&1 > $null
reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v "ExcludeWUDriversInQualityUpdate" /d 1 /t REG_DWORD /f
reg add "HKLM\Software\Microsoft\PolicyManager\default\Update" /v "ExcludeWUDriversInQualityUpdate" /d 1 /t REG_DWORD /f
HKEY_LOCAL_MACHINE\SOFTWARE\NVIDIA Corporation\Global\CoProcManager\AutoDownload,它是用于控制 NVIDIA 协处理器驱动程序的自动下载的。如果您不需要控制 NVIDIA 协处理器驱动程序的自动下载,可以将 AutoDownload 的值设置为 0 来禁用它。
reg add "HKCU\SOFTWARE\NVIDIA Corporation\Global\GFExperience" /v "NotifyNewDisplayUpdates" /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\NVIDIA Corporation\Global\CoProcManager" /v "AutoDownload" /t REG_DWORD /d 0 /f
运行这个命令开启麦克风访问权限
ms-settings:privacy-microphone
其他ms-settings命令了解一下:https://cloud.tencent.com/developer/article/2329408
reg add "HKEY_CURRENT_USER\Control Panel\Mouse" /v "MouseSpeed" /t REG_DWORD /d 0 /f
reg add "HKEY_USERS\.DEFAULT\Control Panel\Mouse" /v "MouseSpeed" /t REG_DWORD /d 0 /f
winrm quickconfig -q 2>&1> $null;winrm quickconfig -q -force 2>&1> $null;netstat -ano|findstr :5985;
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRM" /f 2>$null
stop-service mpssvc 2>&1 > $null
winrm quickconfig -q 2>&1 > $null
winrm quickconfig -q -force 2>&1 > $null
restart-service winrm 2>&1 > $null
#Set-Item WSMan:localhost\client\trustedhosts -value * -force 2>&1 > $null
winrm set winrm/config/client '@{TrustedHosts="*"}' 2>&1 > $null
#netstat -ato|findstr :5985
powercfg -s 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
powercfg -x -monitor-timeout-dc 0
powercfg -x -monitor-timeout-ac 0
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization" /v "NoLockScreen" /d 1 /t REG_DWORD /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "DisableLockWorkstation" /d 1 /t REG_DWORD /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Authentication\LogonUI\SessionData" /v "AllowLockScreen" /d 0 /t REG_DWORD /f
schtasks.exe /create /tn "nolockscreen" /ru SYSTEM /rl highest /sc ONSTART /tr "reg add 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Authentication\LogonUI\SessionData' /v AllowLockScreen /d 0 /t REG_DWORD /f" /f
reg add "HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSecondsInSystemClock /t REG_DWORD /d 1 /f 2>&1 > $null
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSecondsInSystemClock /t REG_DWORD /d 1 /f 2>&1 > $null
#reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSecondsInSystemClock /t REG_DWORD /d 1 /f 2>&1 > $null
schtasks.exe /create /tn "show_time_miao_second" /ru Administrator /rl highest /sc ONLOGON /tr "reg add 'HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' /v ShowSecondsInSystemClock /d 1 /t REG_DWORD /f" /f
reg add "HKCU\Keyboard Layout\Preload" /v "1" /d 00000409 /t REG_SZ /f 2>&1 > $null
reg add "HKCU\Keyboard Layout\Preload" /v "2" /d 00000804 /t REG_SZ /f 2>&1 > $null
reg add "HKLM\SYSTEM\Keyboard Layout\Preload" /v "1" /d 00000409 /t REG_SZ /f 2>&1 > $null
reg add "HKLM\SYSTEM\Keyboard Layout\Preload" /v "2" /d 00000804 /t REG_SZ /f 2>&1 > $null
reg add "HKEY_USERS\.DEFAULT\Keyboard Layout\Preload" /v "1" /d 00000409 /t REG_SZ /f 2>&1 > $null
reg add "HKEY_USERS\.DEFAULT\Keyboard Layout\Preload" /v "2" /d 00000804 /t REG_SZ /f 2>&1 > $null
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v IgnoreRemoteKeyboardLayout /t REG_DWORD /d 1 /f 2>&1 > $null
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layouts" /v IgnoreRemoteKeyboardLayout /t REG_DWORD /d 1 /f 2>&1 > $null
"SAN Policy=OnlineAll" | diskpart
""
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f 2>&1 > $null
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f 2>&1 > $null
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing" /v State /t REG_DWORD /d 0x23e00 /f 2>&1 > $null
NtpServer设置为:
time1.tencentyun.com time2.tencentyun.com time3.tencentyun.com time4.tencentyun.com time5.tencentyun.com
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation" /v "RealTimeIsUniversal" /f 2>$null
$client = new-object System.Net.WebClient
$client.DownloadFile('http://windows-1251783334.cos.ap-shanghai.myqcloud.com/wget64.exe',' c:\windows\wget.exe')
wget.exe http://windows-1251783334.cos.ap-shanghai.myqcloud.com/timesync.ps1 -O c:\timesync.ps1
powershell -file c:\timesync.ps1
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles" /f 2>$null
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff" /f 2>&1 > $null
$client = new-object System.Net.WebClient
$client.DownloadFile('http://windows-1251783334.cos.ap-shanghai.myqcloud.com/wget64.exe',' c:\windows\wget.exe')
wget.exe http://windows-1251783334.cos.ap-shanghai.myqcloud.com/115.159.148.149/devcon.exe -O c:\windows\devcon.exe
ipconfig /release;devcon.exe /r remove "PCI\VEN_1AF4&DEV_1000&SUBSYS_00011AF4&REV_00"
New-Item 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Force 2>&1 >$null
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Scan" /v "ScheduleQuickScanTime" /f 2>$null
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleQuickScanTime" /f 2>$null
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Signature Updates" /v "DefinitionUpdateFileSharesSources" /f 2>$null
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DefinitionUpdateFileSharesSources" /f 2>$null
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /f 2>$null
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /va /f 2>&1 >$null
$registryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"
Get-ItemProperty -Path $registryPath | Remove-ItemProperty -Name * -ErrorAction SilentlyContinue
Get-ChildItem -Path $registryPath | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue
reg add "HKLM\Software\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications " /t REG_DWORD /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "SignatureDisableNotification" /d 0 /t REG_DWORD /f
#Restart-Service WinDefend -Force -ErrorAction SilentlyContinue
#Restart-Service WdNisSvc -Force -ErrorAction SilentlyContinue
Start-Service WinDefend -ErrorAction SilentlyContinue
Start-Service WdNisSvc -ErrorAction SilentlyContinue
Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
Set-MpPreference -DisableIOAVProtection $true -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f
Set-MpPreference -DisableArchiveScanning $true -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableArchiveScanning" /d 1 /t REG_DWORD /f
Set-MpPreference -MAPSReporting 0 -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpynetReporting" /d 0 /t REG_DWORD /f
Set-MpPreference -SubmitSamplesConsent 2 -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /d 2 /t REG_DWORD /f
Set-MpPreference -EnableControlledFolderAccess Disabled -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access" /v "EnableControlledFolderAccess" /d 0 /t REG_DWORD /f
Set-MpPreference -PUAProtection Disabled -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /d 0 /t REG_DWORD /f
Set-MpPreference -SignatureFallbackOrder FileShares -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "FallbackOrder" /d "FileShares" /t REG_SZ /f
Set-MpPreference -SignatureScheduleDay Never -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleDay" /t REG_DWORD /d 8 /f
Set-MpPreference -SharedSignaturesPath c:\dummyPath -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "SharedSignatureRoot" /d "c:\dummyPath" /t REG_SZ /f
Set-MpPreference -SignatureDefinitionUpdateFileSharesSources "\\unc1 | \\unc2" -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DefinitionUpdateFileSharesSources" /d "\\unc1 | \\unc2" /t REG_SZ /f
Set-MpPreference -CheckForSignaturesBeforeRunningScan $false -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "CheckForSignaturesBeforeRunningScan" /d 0 /t REG_DWORD /f
Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableRealtimeMonitoring" /d 0 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /d 1 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "RealtimeSignatureDelivery" /d 0 /t REG_DWORD /f
Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DisableUpdateOnStartupWithoutEngine" /d 1 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "UpdateOnStartUp" /d 0 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DisableScanOnUpdate" /d 1 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ForceUpdateFromMU" /d 0 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration" /v "PreventPlatformUpdate" /t REG_DWORD /d 1 /f
Set-MpPreference -HighThreatDefaultAction 6 -Force -ErrorAction SilentlyContinue
Set-MpPreference -ModerateThreatDefaultAction 6 -Force -ErrorAction SilentlyContinue
Set-MpPreference -LowThreatDefaultAction 6 -Force -ErrorAction SilentlyContinue
Set-MpPreference -SevereThreatDefaultAction 6 -Force -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRoutinelyTakingAction" /d 1 /t REG_DWORD /f
Stop-Service WdNisSvc 2>&1 > $null
Stop-Service WinDefend 2>&1 > $null
Stop-Service MpsSvc 2>&1 > $null
Stop-Service wscsvc 2>&1 > $null
Stop-Service SecurityHealthService 2>&1 > $null
Stop-Service Sense 2>&1 > $null
Set-Service WdNisSvc -StartupType Disabled 2>&1 > $null
Set-Service WinDefend -StartupType Disabled 2>&1 > $null
Set-Service MpsSvc -StartupType Disabled 2>&1 > $null
Set-Service wscsvc -StartupType Disabled 2>&1 > $null
Set-Service SecurityHealthService -StartupType Disabled 2>&1 > $null
Set-Service Sense -StartupType Disabled 2>&1 > $null
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /d 1 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "1" /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications " /t REG_DWORD /d "1" /f
Get-ScheduledTask -TaskPath "\Microsoft\Windows\Data Integrity Scan\","\Microsoft\Windows\ApplicationData\","\Microsoft\Windows\Defrag\","\Microsoft\Windows\DiskCleanup\","\Microsoft\Windows\DiskDiagnostic\","\Microsoft\Windows\DiskFootprint\","\Microsoft\Windows\Windows Defender\","\Microsoft\Windows\Maintenance\" 2>$null | Disable-ScheduledTask 2>$null
stop-service BaradAgentSvc 2>&1 > $null
stop-service StargateSvc 2>&1 > $null
stop-service YDLive 2>&1 > $null
stop-service YDService 2>&1 > $null
stop-service tatsvc 2>&1 > $null
write-host > c:\windows\ipconfig_xen_vm.ini
del "C:\Program Files\Cloudbase Solutions\Cloudbase-Init\log\*" 2>$null
del "C:\Program Files\QCloud\Logs\*" 2>$null
del "C:\Program Files\QCloud\Monitor\Barad\logs\*" 2>$null
del "C:\Program Files\QCloud\Stargate\logs\*" 2>$null
del "C:\Program Files\QCloud\YunJing\log\*" 2>$null
del "C:\Windows\System32\Sysprep\Panther\*.log" 2>$null
del "C:\Windows\Panther\*.log" 2>$null
del "C:\Windows\Panther\UnattendGC\*.log" 2>$null
del "C:\cvm_init.log" 2>$null
del "C:\Windows\Logs\WindowsUpdate\*" 2>$null
del "C:\Windows\INF\setupapi.dev.log" 2>$null
del "C:\Windows\INF\setupapi.setup.log" 2>$null
wevtutil el | Foreach-Object {wevtutil cl "$_" 2>$null}
wevtutil cl security 2>$null
wevtutil cl system 2>$null
cmd.exe /c del /F /Q C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\* 2>$null
#Remove-Item (Get-PSReadlineOption).HistorySavePath
#cmd.exe /c "echo.>%userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt"
clear-history
cmd.exe /c "cscript /nologo %windir%/system32/slmgr.vbs -skms kms.03k.org:1688" 2>&1 > $null
cmd.exe /c "cscript /nologo %windir%/system32/slmgr.vbs -ato" 2>&1 > $null
netsh advfirewall set allprofiles state off
reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules /va /f 2>$null
reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System /va /f 2>$null
reg delete HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules /va /f 2>$null
reg delete HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System /va /f 2>$null
reg delete HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules /va /f 2>$null
reg delete HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System /va /f 2>$null
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy" /v DeleteUserAppContainersOnLogoff /t REG_DWORD /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy" /v DeleteUserAppContainersOnLogoff /t REG_DWORD /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy" /v DeleteUserAppContainersOnLogoff /t REG_DWORD /d 1 /f
secedit /export /cfg c:\secpol.cfg
echo. >c:\out.txt
type c:\secpol.cfg | findstr -i complex >>c:\out.txt
powershell -command "(GC C:\secpol.cfg) -Replace \"PasswordComplexity = 0\",\"PasswordComplexity = 1\" | Out-File C:\secpol.cfg"
echo. >>c:\out.txt
type c:\secpol.cfg | findstr -i complex >>c:\out.txt
secedit /configure /db c:\windows\security\local.sdb /cfg c:\secpol.cfg /areas SECURITYPOLICY
del /q c:\secpol.cfg
type c:\out.txt
del /q c:\out.txt
del %windir%\security\logs\scesrv.log
powershell -command "Set-ExecutionPolicy Unrestricted -force"
@rem wmic pagefile list /format:list
@rem start /w pkgmgr /iu:"TelnetClient"
cmd.exe /c "start /w pkgmgr /iu:TelnetClient"
reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Lanmanworkstation\Parameters" /v "FileInfoCacheLifetime" /d 0 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Lanmanworkstation\Parameters" /v "FileNotFoundCacheLifetime" /d 0 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Lanmanworkstation\Parameters" /v "DirectoryCacheLifetime" /d 0 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Client for NFS\CurrentVersion\Users\Default\Cache" /v "AttributeTimeDelta" /d 0 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Client for NFS\CurrentVersion\Users\Default\Cache" /v "FileAttributeCache" /d 0 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Client for NFS\CurrentVersion\Users\Default\Cache" /v "RemoteWriteCache" /d 0 /t REG_DWORD /f
#先是创建注册表项打标,标记要清理哪些东西
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Delivery Optimization Files" /v StateFlags6550 /t REG_DWORD /d 2 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\DownloadsFolder" /v StateFlags6550 /t REG_DWORD /d 2 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Internet Cache Files" /v StateFlags6550 /t REG_DWORD /d 2 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Recycle Bin" /v StateFlags6550 /t REG_DWORD /d 2 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Temporary Files" /v StateFlags6550 /t REG_DWORD /d 2 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Update Cleanup" /v StateFlags6550 /t REG_DWORD /d 2 /f
#然后中间有一句cleanmgr /sagerun:6550 根据打标来执行
cleanmgr /sagerun:6550 2>$null
#然后就是清理先前创建的注册表项
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Delivery Optimization Files" /v StateFlags6550 /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\DownloadsFolder" /v StateFlags6550 /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Internet Cache Files" /v StateFlags6550 /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Recycle Bin" /v StateFlags6550 /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Temporary Files" /v StateFlags6550 /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Update Cleanup" /v StateFlags6550 /f
rd /s /q %SYSTEMDRIVE%\Windows\Temp 2>nul 1>nul
@rem rd /s /q "%SYSTEMDRIVE%\Windows\Downloaded Program Files" 2>nul 1>nul
rd /s /q %SYSTEMDRIVE%\$Recycle.bin 2>nul 1>nul
@rem %SYSTEMDRIVE%\Windows\System32\cleanmgr.exe /d C /verylowdisk 2>nul 1>nul
@rem %SYSTEMDRIVE%\Windows\System32\cleanmgr.exe /d C /autoclean 2>nul 1>nul
set datemine=%date:~0,4%%date:~5,2%%date:~8,2%
echo;%time:~0,1%|find " "&&(set timehour=0%time:~1,1%) || (set timehour=%time:~0,2%)
set timeother=%time:~3,2%%time:~6,2%
set filename=%datemine%%timehour%%timeother%
copy c:\windows\system32\drivers\etc\hosts c:\windows\system32\drivers\etc\%filename%_hosts
echo.>c:\windows\system32\drivers\etc\hosts
echo 169.254.0.3 mirrors.tencentyun.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.15 update2.agent.tencentyun.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.4 receiver.barad.tencentyun.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.5 custom.message.tencentyun.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.10.10 metadata.tencentyun.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.23 metadata.tencentyun.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.19 kms.tencentyun.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.54 kms1.tencentyun.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.26 windowsupdate.tencentyun.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.2 ntpupdate.tencentyun.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.79 time1.tencentyun.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.80 time2.tencentyun.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.81 time3.tencentyun.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.82 time4.tencentyun.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.83 time5.tencentyun.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.55 s.yd.tencentyun.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.55 l.yd.tencentyun.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.55 u.yd.tencentyun.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.138 notify.tat-tc.tencentyun.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.138 invoke.tat-tc.tencentyun.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.138 invoke.tat-tc.tencent.cn>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.138 invoke.tat-tc.tencent.com.cn>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.138 invoke.tat.tencent-cloud.com>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.138 notify.tat-tc.tencent.cn>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.138 notify.tat-tc.tencent.com.cn>> c:\windows\system32\drivers\etc\hosts
echo 169.254.0.138 notify.tat.tencent-cloud.com>> c:\windows\system32\drivers\etc\hosts
机器有公网的话,按下面的powershell命令来安装,机器没公网的话,按官网文档来
$client1 = new-object System.Net.WebClient
$client1.DownloadFile('http://windows-1251783334.cos.ap-shanghai.myqcloud.com/7z2200-x64.msi','c:\7z2200-x64.msi')
msiexec.exe /i c:\7z2200-x64.msi /qn
Start-Sleep 30
del c:\7z2200-x64.msi 2>$null
cmd.exe /c rd /S /Q C:\tat_agent_windows_x86_64 2>&1 > $null
del c:\tat_agent_windows_x86_64.zip 2>&1 > $null
$client = new-object System.Net.WebClient
$client.DownloadFile('http://tat-gz-1258344699.cos.ap-guangzhou.myqcloud.com/tat_agent_windows_x86_64.zip',' c:\tat_agent_windows_x86_64.zip')
& "$env:ProgramFiles\7-Zip\7z.exe" x -aoa c:\tat_agent_windows_x86_64.zip -oC:\tat_agent_windows_x86_64
cmd /c C:\tat_agent_windows_x86_64\uninstall.bat 2>&1 >$null
cmd /c C:\tat_agent_windows_x86_64\install.bat 2>&1 >$null
cmd.exe /c rd /S /Q C:\tat_agent_windows_x86_64 2>&1 > $null
del c:\tat_agent_windows_x86_64.zip 2>$null
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "ClearPageFileAtShutdown" /d 0 /t REG_DWORD /f
Set-Service -Name RasAuto -StartupType Manual
Set-Service -Name RasMan -StartupType Manual
Set-Service -Name dot3svc -StartupType Automatic
sc.exe config dot3svc start= auto
$NICName=(Get-WmiObject Win32_NetworkAdapter -Filter 'NetEnabled=True').NetConnectionID
#Close RSS
Set-NetAdapterAdvancedProperty -Name $NICName -RegistryKeyword "*RSS" -RegistryValue 0
#Close Checksum Offload
Set-NetAdapterAdvancedProperty -Name $NICName -RegistryKeyword "*IPChecksumOffloadIPv4" -RegistryValue 0
Set-NetAdapterAdvancedProperty -Name $NICName -RegistryKeyword "*TCPChecksumOffloadIPv4" -RegistryValue 0
Set-NetAdapterAdvancedProperty -Name $NICName -RegistryKeyword "*TCPChecksumOffloadIPv6" -RegistryValue 0
Set-NetAdapterAdvancedProperty -Name $NICName -RegistryKeyword "*UDPChecksumOffloadIPv4" -RegistryValue 0
Set-NetAdapterAdvancedProperty -Name $NICName -RegistryKeyword "*UDPChecksumOffloadIPv6" -RegistryValue 0
Set-NetAdapterAdvancedProperty -Name $NICName -RegistryKeyword "OffLoad.RxCS" -RegistryValue 0
#Change Init.MaxRxBuffers to 1024
Set-NetAdapterAdvancedProperty -Name $NICName -RegistryKeyword "RxCapacity" -RegistryValue 1024
#Restart NIC
Restart-NetAdapter -Name $NICName -Confirm:$false
Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\AFD\Parameters\ -Name "DoNotHoldNicBuffers" -Value "1" -Force
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\StorageSense" /v "AllowStorageSenseGlobal" /d 0 /t REG_DWORD /f
Get-ScheduledTask -TaskPath "\Microsoft\Windows\Data Integrity Scan\","\Microsoft\Windows\ApplicationData\","\Microsoft\Windows\Defrag\","\Microsoft\Windows\DiskCleanup\","\Microsoft\Windows\DiskDiagnostic\","\Microsoft\Windows\DiskFootprint\","\Microsoft\Windows\Windows Defender\","\Microsoft\Windows\Maintenance\" 2>$null | Disable-ScheduledTask 2>$null
reg add "HKLM\System\Setup" /v DDACLSys_Disabled /t REG_DWORD /d 1 /f
统计文件数
cd /d C:\
dir D: /b /s /a-d | find /v /c ""
dir G: /b /s /a-d | find /v /c ""
数据盘是什么盘符就换成什么盘符
powershell自动化重装 cloudbase-init 为1.1.2版本
https://cloud.tencent.com/developer/article/1940021
需要提醒的是:
域业务需要删掉cloudbase-init配置文件里的hostname模块(C:\Program Files\Cloudbase Solutions\Cloudbase-Init\conf\cloudbase-init.conf中的cloudbaseinit.plugins.common.sethostname.SetHostNamePlugin,)
否则,一些特殊情况可能导致域业务异常,因为域业务跟hostname相关,如果cloudbase-init存在hostname模块,会导致hostname改变,从而影响域业务
$HubID = (Get-WmiObject Win32_USBHub).PNPDeviceID
$PowerMgmt = Get-WmiObject MSPower_DeviceEnable -Namespace root\wmi | Where {$_.InstanceName -like "*$HubID*"}
$PowerMgmt.Enable = $False
$PowerMgmt.psbase.Put()
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v NMICrashDump /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\viostor" /v Tag /t REG_DWORD /d 1 /f
如果是更新驱动,请先执行clear_virtio_driver.bat卸载旧版本,然后重新安装viostor和netkvm驱动
以下内容另存为clear_virtio_driver.bat 执行是卸载,更新虚拟化驱动参考https://cloud.tencent.com/developer/article/1927302
for /r "C:\Windows\INF" %%a in (oem*.inf) do (
REM findstr /I "balloon.sys" "%%a" >nul && echo %%~na%%~xa && pnputil -f -d %%~na%%~xa
findstr /I "netkvm.sys" "%%a" >nul && echo %%~na%%~xa && pnputil -f -d %%~na%%~xa
findstr /I "viostor.sys" "%%a" >nul && echo %%~na%%~xa && pnputil -f -d %%~na%%~xa
)
https://vb-audio.com/Cable/
https://www.e2esoft.cn/vsc/
https://vac.muzychenko.net/en/download.htm
Stop-Service SSDPSRV 2>&1 > $null
Stop-Service TabletInputService 2>&1 > $null
Set-Service SSDPSRV -StartupType Disabled 2>&1 > $null
Set-Service TabletInputService -StartupType Disabled 2>&1 > $null
Set-Service -Name Spooler -StartupType Automatic
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v SecurityLayer /t REG_DWORD /d 0 /f
REG ADD "HKLM\SYSTEM\CurrentControlSet\control\Terminal Server\Winstations\RDP-Tcp" /v SecurityLayer /t REG_DWORD /d 0 /f
REG ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\Rdp-tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "DefaultUserName" /d "Administrator" /t REG_SZ /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "DefaultPassword" /d "你自己的密码" /t REG_SZ /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AutoAdminLogon" /d "1" /t REG_SZ /f
Get-ScheduledTask | Where-Object { $_.TaskName -like "OneDrive*"}| Disable-ScheduledTask 2>$null
Get-Service MicrosoftEdge*, edgeupdate*|ft -auto
Get-Service GoogleChrome*, gupdate* | ft -auto
Get-Service MicrosoftEdge*, edgeupdate* | Set-Service -StartupType Disabled
Get-Service GoogleChrome*, gupdate* | Set-Service -StartupType Disabled
Get-ScheduledTask | Where-Object { $_.TaskName -like "MicrosoftEdgeUpdateTaskMachine*"} | Disable-ScheduledTask 2>&1 >$null
Get-ScheduledTask | Where-Object { $_.TaskName -like "GoogleUpdateTaskMachine*"} | Disable-ScheduledTask 2>$null
原创声明:本文系作者授权腾讯云开发者社区发表,未经许可,不得转载。
如有侵权,请联系 cloudcommunity@tencent.com 删除。
原创声明:本文系作者授权腾讯云开发者社区发表,未经许可,不得转载。
如有侵权,请联系 cloudcommunity@tencent.com 删除。