x9/xetup
1
0
Fork 0
Code Issues 17 Pull requests Projects Releases 5 Packages Wiki Activity Actions

feat(03): disable hibernation, Smart App Control; rework Edge config
Some checks failed
release / build-and-release (push) Failing after 32s
Details

Browse source 
- powercfg /hibernate off added to powercfg block
- Smart App Control: VerifiedAndReputablePolicyState=0 (Win11, permanent)
- Edge: replaced non-working Recommended policies with two-tier approach:
  - Mandatory: only HideFirstRunExperience, DefaultBrowserSettingEnabled,
    DiagnosticData, FeedbackSurveysEnabled (privacy/first-run, locked)
  - initial_preferences JSON written to Edge Application dir: sets UI
    defaults (favorites bar, no home button, clean NTP, no shopping/rewards)
    that users can freely override in Edge settings
- Removed invalid PerformanceButtonEnabled policy key
- SPEC.md and web/spec/index.html updated accordingly

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
X9 Dev 2026-04-27 17:53:07 +02:00
parent 5b9c373e89
commit 0cfe7510aa
3 changed files with 98 additions and 60 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
SPEC.md
View file

@ -86,10 +86,14 @@ Atera RMM agent: downloaded from x9.servicedesk.atera.com, installed via msiexec
Always applied: password max age unlimited, timezone (Central Europe Standard Time). Always applied: password max age unlimited, timezone (Central Europe Standard Time).
Feature-toggled sections: Feature-toggled sections:
- **systemTweaks**: BypassNRO, disable Teams auto-install, Widgets, GameDVR, Recall, Copilot search - **systemTweaks**: BypassNRO, disable Teams auto-install, Widgets, GameDVR, Recall, Copilot search,
- **edgePolicies**: mandatory (first-run, telemetry) + recommended (UI defaults user can change) Smart App Control (VerifiedAndReputablePolicyState=0, permanent)
- **edgePolicies**: mandatory only (HideFirstRunExperience, DefaultBrowserSettingEnabled,
DiagnosticData, FeedbackSurveysEnabled) + initial_preferences file for UI defaults
(favorites bar, no home button, no search suggestions, clean NTP, no rewards/shopping/collections).
initial_preferences is read by Edge once on first profile creation - user can override freely.
- **oneDriveUninstall**: removes consumer OneDrive (no policy block - M365 can reinstall) - **oneDriveUninstall**: removes consumer OneDrive (no policy block - M365 can reinstall)
- **powercfg**: standby-ac=0, monitor-ac=60, standby-dc=30, monitor-dc=15 - **powercfg**: hibernate off; standby-ac=0, monitor-ac=60, standby-dc=30, monitor-dc=15
- **proxyDisable**: WPAD auto-detect off - **proxyDisable**: WPAD auto-detect off
--- ---

134
scripts/03-system-registry.ps1
View file

@ -18,11 +18,11 @@
hesla-bez-expirace-net-accounts-maxpwage: net accounts /maxpwage:UNLIMITED. Sets the local password expiration policy to never. MSP-managed machines handle password rotation via other means (Atera, domain policy, manual). hesla-bez-expirace-net-accounts-maxpwage: net accounts /maxpwage:UNLIMITED. Sets the local password expiration policy to never. MSP-managed machines handle password rotation via other means (Atera, domain policy, manual).
casova-zona-central-europe-standard-time: Set-TimeZone -Id "Central Europe Standard Time". UTC+1 (UTC+2 in summer DST). Applied system-wide. Critical for correct log timestamps, scheduled task timing, and calendar sync. casova-zona-central-europe-standard-time: Set-TimeZone -Id "Central Europe Standard Time". UTC+1 (UTC+2 in summer DST). Applied system-wide. Critical for correct log timestamps, scheduled task timing, and calendar sync.
zakaz-gamedvr: HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR\AppCaptureEnabled = 0. Disables Xbox Game Bar screen capture overlay. Reduces background resource usage and eliminates unintended capture prompts on business machines. zakaz-gamedvr: HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR\AppCaptureEnabled = 0. Disables Xbox Game Bar screen capture overlay. Reduces background resource usage and eliminates unintended capture prompts on business machines.
edge-skryt-first-run-experience: HideFirstRunExperience=1 + DefaultBrowserSettingEnabled=0. Suppresses Edge welcome wizard and default browser prompts on first launch. zakaz-smart-app-control: HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy\VerifiedAndReputablePolicyState = 0. Disables Windows 11 Smart App Control (Intelligent App Control). Prevents SAC from blocking unrecognized business software during deployment. 0=Off, 1=Evaluation, 2=Enforcing. Setting to 0 is permanent - cannot be re-enabled without OS reset.
edge-policies-panel-oblibeny-vyhledavac: FavoritesBarEnabled=1 (always show), DefaultSearchProviderEnabled=1, DefaultSearchProviderName=Google, ManagedSearchEngines removes other providers. zakaz-hibernace-powercfg-h-off: powercfg /hibernate off. Disables hibernation entirely. Removes hiberfil.sys, prevents hibernate-related power state issues, and ensures clean shutdown behavior on business machines.
edge-policies-tlacitka-zobrazit: DownloadsButtonEnabled=1, HistoryButtonEnabled=1. edge-skryt-first-run-experience: HideFirstRunExperience=1 + DefaultBrowserSettingEnabled=0 (Mandatory). Suppresses Edge welcome wizard and default browser prompts on first launch.
edge-policies-tlacitka-skryt: HomeButtonEnabled=0, SplitScreenEnabled=0, EdgeEDropEnabled=0 (Drop), WebCaptureEnabled=0 (Screenshot), ShareAllowed=0. edge-telemetrie-mandatory: DiagnosticData=0, FeedbackSurveysEnabled=0 (Mandatory). Telemetry and feedback always off - user cannot change.
edge-policies-obsah-a-telemetrie: NewTabPageContentEnabled=0, ShowRecommendationsEnabled=0, SpotlightExperiencesAndRecommendationsEnabled=0, PersonalizationReportingEnabled=0, EdgeShoppingAssistantEnabled=0, ShowMicrosoftRewards=0, HubsSidebarEnabled=0, SearchSuggestEnabled=0, DiagnosticData=0, FeedbackSurveysEnabled=0, EdgeCollectionsEnabled=0. edge-initial-preferences: Writes C:\Program Files (x86)\Microsoft\Edge\Application\initial_preferences. Sets Edge UI defaults (clean NTP, favorites bar visible, home button hidden, search suggestions off) that the user can freely override in Edge settings. Read by Edge once on first profile creation.
onedrive-uninstall-intentional: Uninstalls the pre-installed OneDrive consumer version via OneDriveSetup.exe /uninstall and removes Start Menu shortcut. Intentional for clean MSP deployment baseline. No DisableFileSyncNGSC policy key is set - M365 installation can reinstall and run OneDrive normally. Only the stock consumer pre-install is removed. onedrive-uninstall-intentional: Uninstalls the pre-installed OneDrive consumer version via OneDriveSetup.exe /uninstall and removes Start Menu shortcut. Intentional for clean MSP deployment baseline. No DisableFileSyncNGSC policy key is set - M365 installation can reinstall and run OneDrive normally. Only the stock consumer pre-install is removed.
powercfg-nastaveni-spotreba-energie: powercfg /change: standby-timeout-ac 0 (never sleep on AC), monitor-timeout-ac 60 (screen off after 60 min on AC), standby-timeout-dc 30 (sleep after 30 min on battery), monitor-timeout-dc 15 (screen off after 15 min on battery). Applied to active power plan. powercfg-nastaveni-spotreba-energie: powercfg /change: standby-timeout-ac 0 (never sleep on AC), monitor-timeout-ac 60 (screen off after 60 min on AC), standby-timeout-dc 30 (sleep after 30 min on battery), monitor-timeout-dc 15 (screen off after 15 min on battery). Applied to active power plan.
proxy-auto-detect-zakaz-autodetect-0: HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AutoDetect = 0. Disables WPAD (Web Proxy Auto-Discovery). Eliminates startup delays from WPAD DNS lookup and prevents MITM via rogue WPAD on untrusted networks. proxy-auto-detect-zakaz-autodetect-0: HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AutoDetect = 0. Disables WPAD (Web Proxy Auto-Discovery). Eliminates startup delays from WPAD DNS lookup and prevents MITM via rogue WPAD on untrusted networks.
@ -283,69 +283,99 @@ if (Get-Feature $Config "systemRegistry" "systemTweaks") {
# Start menu - hide Recommended section (Win11) # Start menu - hide Recommended section (Win11)
Set-Reg -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" ` Set-Reg -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" `
-Name "HideRecommendedSection" -Value 1 -Name "HideRecommendedSection" -Value 1
# Disable Smart App Control (Intelligent App Control) - Win11 only key, safe to set on Win10
# 0=Off, 1=Evaluation, 2=Enforcing. Protected key - Set-Reg SYSTEM task fallback handles ACL.
Set-Reg -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy" `
-Name "VerifiedAndReputablePolicyState" -Value 0
} else { } else {
Write-Log "systemTweaks feature disabled - skipping" -Level INFO Write-Log "systemTweaks feature disabled - skipping" -Level INFO
} }
# ----------------------------------------------------------------------- # -----------------------------------------------------------------------
# Microsoft Edge policies # Microsoft Edge policies + initial_preferences
#
# Strategy (two-tier):
# Mandatory GPO - only privacy/first-run items (user cannot change)
# initial_preferences - all UI defaults (user CAN change freely in Edge settings)
#
# initial_preferences is read by Edge ONCE when a new user profile is created.
# It has no effect on profiles that already exist (i.e. Edge was already launched).
# For a clean deployment where xetup runs before any user opens Edge this is reliable.
# ----------------------------------------------------------------------- # -----------------------------------------------------------------------
if (Get-Feature $Config "systemRegistry" "edgePolicies") { if (Get-Feature $Config "systemRegistry" "edgePolicies") {
Write-Log " Applying Edge policies" -Level INFO Write-Log " Applying Edge policies" -Level INFO
$edgeMandatory = "HKLM:\SOFTWARE\Policies\Microsoft\Edge" $edgeMandatory = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"
$edgeRecommended = "HKLM:\SOFTWARE\Policies\Microsoft\Edge\Recommended"
# --- Mandatory (user cannot override, locked in Edge UI) --- # --- Mandatory: privacy and first-run suppression only ---
# First run / default browser nag
Set-Reg -Path $edgeMandatory -Name "HideFirstRunExperience" -Value 1 Set-Reg -Path $edgeMandatory -Name "HideFirstRunExperience" -Value 1
Set-Reg -Path $edgeMandatory -Name "DefaultBrowserSettingEnabled" -Value 0 Set-Reg -Path $edgeMandatory -Name "DefaultBrowserSettingEnabled" -Value 0
Set-Reg -Path $edgeMandatory -Name "DiagnosticData" -Value 0
Set-Reg -Path $edgeMandatory -Name "FeedbackSurveysEnabled" -Value 0
# Telemetry / feedback - always off # Suppress desktop shortcut creation on Edge install/update (EdgeUpdate key)
Set-Reg -Path $edgeMandatory -Name "DiagnosticData" -Value 0
Set-Reg -Path $edgeMandatory -Name "FeedbackSurveysEnabled" -Value 0
# Disable desktop shortcut on install/update
Set-Reg -Path "HKLM:\SOFTWARE\Policies\Microsoft\EdgeUpdate" ` Set-Reg -Path "HKLM:\SOFTWARE\Policies\Microsoft\EdgeUpdate" `
-Name "CreateDesktopShortcutDefault" -Value 0 -Name "CreateDesktopShortcutDefault" -Value 0
# --- Recommended (sets default, user can change in Edge settings) --- # --- initial_preferences: UI defaults the user can override ---
# New tab page - clean defaults # Path: Edge Application dir (stable channel on x64 Windows)
Set-Reg -Path $edgeRecommended -Name "NewTabPageContentEnabled" -Value 0 $edgeAppDir = "C:\Program Files (x86)\Microsoft\Edge\Application"
Set-Reg -Path $edgeRecommended -Name "NewTabPageQuickLinksEnabled" -Value 0 $edgeInitPrefPath = "$edgeAppDir\initial_preferences"
Set-Reg -Path $edgeRecommended -Name "NewTabPageBackgroundEnabled" -Value 0
Set-Reg -Path $edgeRecommended -Name "NewTabPageAllowedBackgroundTypes" -Value 3
Set-Reg -Path $edgeRecommended -Name "ShowRecommendationsEnabled" -Value 0
Set-Reg -Path $edgeRecommended -Name "SpotlightExperiencesAndRecommendationsEnabled" -Value 0
Set-Reg -Path $edgeRecommended -Name "PersonalizationReportingEnabled" -Value 0
# Shopping / rewards / sidebar if (Test-Path $edgeAppDir) {
Set-Reg -Path $edgeRecommended -Name "EdgeShoppingAssistantEnabled" -Value 0 # Build JSON as hashtable - ConvertTo-Json handles serialization
Set-Reg -Path $edgeRecommended -Name "ShowMicrosoftRewards" -Value 0 $prefs = [ordered]@{
Set-Reg -Path $edgeRecommended -Name "HubsSidebarEnabled" -Value 0 # Favorites bar always visible
Set-Reg -Path $edgeRecommended -Name "EdgeCollectionsEnabled" -Value 0 bookmark_bar = [ordered]@{ show_on_all_tabs = $true }
# Search suggestions / import browser = [ordered]@{
Set-Reg -Path $edgeRecommended -Name "SearchSuggestEnabled" -Value 0 show_home_button = $false # hide home button
Set-Reg -Path $edgeRecommended -Name "ImportOnEachLaunch" -Value 0 }
# Toolbar buttons - show # Disable search-as-you-type suggestions (privacy + less noise)
Set-Reg -Path $edgeRecommended -Name "FavoritesBarEnabled" -Value 1 search = [ordered]@{ suggest_enabled = $false }
Set-Reg -Path $edgeRecommended -Name "DownloadsButtonEnabled" -Value 1
Set-Reg -Path $edgeRecommended -Name "HistoryButtonEnabled" -Value 1
Set-Reg -Path $edgeRecommended -Name "PerformanceButtonEnabled" -Value 1
# Toolbar buttons - hide # First-run / import suppression (belt-and-suspenders alongside Mandatory policy)
Set-Reg -Path $edgeRecommended -Name "HomeButtonEnabled" -Value 0 distribution = [ordered]@{
Set-Reg -Path $edgeRecommended -Name "SplitScreenEnabled" -Value 0 suppress_first_run_default_browser_prompt = $true
Set-Reg -Path $edgeRecommended -Name "EdgeEDropEnabled" -Value 0 skip_first_run_ui = $true
Set-Reg -Path $edgeRecommended -Name "WebCaptureEnabled" -Value 0 do_not_create_desktop_shortcut = $true
Set-Reg -Path $edgeRecommended -Name "ShareAllowed" -Value 0 make_chrome_default = $false
import_bookmarks = $false
import_history = $false
import_home_page = $false
import_search_engine = $false
show_welcome_page = $false
}
# Default search engine: Google # No first-run tabs (e.g. Edge welcome page)
Set-Reg -Path $edgeRecommended -Name "DefaultSearchProviderEnabled" -Value 1 -Type "DWord" first_run_tabs = @()
Set-Reg -Path $edgeRecommended -Name "DefaultSearchProviderName" -Value "Google" -Type "String"
Set-Reg -Path $edgeRecommended -Name "DefaultSearchProviderSearchURL" ` # Edge-specific defaults (best-effort: key names are internal/semi-documented)
-Value "https://www.google.com/search?q={searchTerms}" -Type "String" # These set sane defaults; if Edge ignores an unknown key it is a no-op.
edge = [ordered]@{
newTabPageContentEnabled = $false # clean new tab page
newTabPageQuickLinksEnabled = $false # no quick links on NTP
newTabPageBackgroundEnabled = $false # no background image on NTP
showMicrosoftRewards = $false # no rewards badge
collections_enabled = $false # no Collections
shopping_list_enabled = $false # no shopping assistant
share_experience_enabled = $false # no Share button
}
}
try {
$json = $prefs | ConvertTo-Json -Depth 6
$utf8 = New-Object System.Text.UTF8Encoding $false # no BOM
[System.IO.File]::WriteAllText($edgeInitPrefPath, $json, $utf8)
Write-Log " Edge initial_preferences written: $edgeInitPrefPath" -Level OK
}
catch {
Write-Log " Failed to write Edge initial_preferences: $_" -Level WARN
}
} else {
Write-Log " Edge application dir not found - initial_preferences skipped" -Level WARN
}
} else { } else {
Write-Log "edgePolicies feature disabled - skipping" -Level INFO Write-Log "edgePolicies feature disabled - skipping" -Level INFO
} }
@ -390,6 +420,14 @@ if (Get-Feature $Config "systemRegistry" "oneDriveUninstall") {
if (Get-Feature $Config "systemRegistry" "powercfg") { if (Get-Feature $Config "systemRegistry" "powercfg") {
Write-Log " Applying power configuration" -Level INFO Write-Log " Applying power configuration" -Level INFO
# Disable hibernation (removes hiberfil.sys, prevents hibernate-related power issues)
$hibResult = & powercfg /hibernate off 2>&1
if ($LASTEXITCODE -eq 0) {
Write-Log " powercfg /hibernate off" -Level OK
} else {
Write-Log " powercfg /hibernate off failed: $hibResult" -Level WARN
}
$powercfgArgs = @( $powercfgArgs = @(
@("/change", "standby-timeout-ac", "0"), # never sleep on AC @("/change", "standby-timeout-ac", "0"), # never sleep on AC
@("/change", "monitor-timeout-ac", "60"), # screen off after 60 min on AC @("/change", "monitor-timeout-ac", "60"), # screen off after 60 min on AC

14
web/spec/index.html
View file

@ -631,17 +631,13 @@
<tr class="flag-done"><td>Hesla bez expirace (<code>net accounts /maxpwage:UNLIMITED</code>)</td><td>OK</td></tr> <tr class="flag-done"><td>Hesla bez expirace (<code>net accounts /maxpwage:UNLIMITED</code>)</td><td>OK</td></tr>
<tr class="flag-done"><td>Casova zona: Central Europe Standard Time</td><td>OK</td></tr> <tr class="flag-done"><td>Casova zona: Central Europe Standard Time</td><td>OK</td></tr>
<tr class="flag-done"><td>Zakaz GameDVR</td><td>OK</td></tr> <tr class="flag-done"><td>Zakaz GameDVR</td><td>OK</td></tr>
<tr class="flag-done"><td>Edge &ndash; skryt First Run Experience + zakaz default browser prompt</td><td>HideFirstRunExperience=1, DefaultBrowserSettingEnabled=0</td></tr> <tr class="flag-done"><td>Zakaz Smart App Control (Intelligent App Control)</td><td>HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy\VerifiedAndReputablePolicyState = 0. Permanentni &ndash; bez reset OS nelze zapnout zpet.</td></tr>
<tr class="flag-done"><td>Edge policies &ndash; panel oblibeny, vyhledavac Google</td><td>FavoritesBarEnabled=1, DefaultSearchProviderName=Google, ManagedSearchEngines</td></tr> <tr class="flag-done"><td>Zakaz hibernace (<code>powercfg /hibernate off</code>)</td><td>Odstrani hiberfil.sys, predchazi problemum s power stavy pri deployi</td></tr>
<tr class="flag-done"><td>Edge policies &ndash; tlacitka zobrazit (Historie, Stahnout)</td><td>DownloadsButtonEnabled=1, HistoryButtonEnabled=1</td></tr> <tr class="flag-done"><td>Edge &ndash; Mandatory: zakaz First Run, telemetrie</td><td>HideFirstRunExperience=1, DefaultBrowserSettingEnabled=0, DiagnosticData=0, FeedbackSurveysEnabled=0. Uzivatel nemuze zmenit.</td></tr>
<tr class="flag-done"><td>Edge policies &ndash; tlacitka skryt (Home, Kolekce, Split, Drop, Screenshot, Share, Zpetna vazba)</td><td>HomeButtonEnabled=0, SplitScreenEnabled=0, EdgeEDropEnabled=0, WebCaptureEnabled=0, ShareAllowed=0, FeedbackSurveysEnabled=0, EdgeCollectionsEnabled=0</td></tr> <tr class="flag-done"><td>Edge &ndash; initial_preferences: UI defaults (uzivatel muze zmenit)</td><td>Zapise <code>C:\Program Files (x86)\Microsoft\Edge\Application\initial_preferences</code>. Edge precte jednou pri prvnim vytvoreni profilu. Nastavuje: oblibene vzdy viditelne, skryt Home, zakaz navrhu vyhledavani, cisty NTP, zakaz nakupniho asistenta, odmen a kolekci.</td></tr>
<tr class="flag-done"><td>Edge policies &ndash; obsah a telemetrie</td><td>NewTabPageContentEnabled=0, ShowRecommendationsEnabled=0, EdgeShoppingAssistantEnabled=0, DiagnosticData=0, &hellip;</td></tr>
<tr class="flag-done"><td>OneDrive uninstall (intentional)</td><td>OneDriveSetup.exe /uninstall &ndash; odstrani pre-installed verzi. M365 si nainstaluje vlastni.</td></tr> <tr class="flag-done"><td>OneDrive uninstall (intentional)</td><td>OneDriveSetup.exe /uninstall &ndash; odstrani pre-installed verzi. M365 si nainstaluje vlastni.</td></tr>
<tr class="flag-done"><td>Powercfg nastaveni (spotreba energie)</td><td>standby-ac 0, monitor-ac 60, standby-dc 30, monitor-dc 15</td></tr> <tr class="flag-done"><td>Powercfg nastaveni (spotreba energie)</td><td>hibernate off; standby-ac 0, monitor-ac 60, standby-dc 30, monitor-dc 15</td></tr>
<tr class="flag-done"><td>Proxy auto-detect zakaz (AutoDetect = 0)</td><td>HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings</td></tr> <tr class="flag-done"><td>Proxy auto-detect zakaz (AutoDetect = 0)</td><td>HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings</td></tr>
<tr class="flag-done"><td>Edge nova karta &ndash; zakaz rychlych odkazu</td><td>NewTabPageQuickLinksEnabled = 0</td></tr>
<tr class="flag-done"><td>Edge nova karta &ndash; zakaz pozadi</td><td>NewTabPageBackgroundEnabled = 0</td></tr>
<tr class="flag-done"><td>Edge nova karta &ndash; zakaz obsahu / feedu</td><td>NewTabPageAllowedBackgroundTypes = 3 (pouze plna barva)</td></tr>
</table> </table>
</div> </div>
<div class="step-footer"> <div class="step-footer">