diff --git a/README.md b/README.md
index cb4600b..9854f90 100644
--- a/README.md
+++ b/README.md
@@ -197,6 +197,12 @@ The MultiStaller tool provides flexible, configuration-driven software installat
 
 3. If you are using this script on arm64, you might see a glimpse of an error while running the script. This is caused by the fact that the arm64 image doesn't have OneDriveSetup.exe included in the System32 folder.
 
+4. **DISM/SFC repair after install won't work against the tweaked media.** The build runs `/Cleanup-Image /StartComponentCleanup /ResetBase` to shrink the component store, which permanently deletes superseded package versions from the image. If your installed system's component store ever needs repair (`DISM /Online /Cleanup-Image /RestoreHealth` or `sfc /scannow`), pointing `/Source` at the *tweaked* `install.wim`/`install.esd`/ISO will not help - those files are gone from every copy of that build, not just the one you're repairing. Keep the **original, untouched stock Windows ISO** you downloaded from Microsoft around, and use that as the repair source instead, e.g.:
+   ```powershell
+   DISM /Online /Cleanup-Image /RestoreHealth /Source:WIM:D:\sources\install.wim:1 /LimitAccess
+   ```
+   (where `D:` is your mounted *original* ISO, not the tiny11 output.)
+
 ## Documentation
 
 For more detailed information, see the documentation in the `/docs/` folder:
diff --git a/TinyWindowsMaker.ps1 b/TinyWindowsMaker.ps1
index 84a86e9..ecb1cf2 100644
--- a/TinyWindowsMaker.ps1
+++ b/TinyWindowsMaker.ps1
@@ -9,7 +9,8 @@ param (
     [string]$imageindex,
     [ValidateSet("10", "11", "auto")]
     [string]$WindowsVersion = "auto",
-    [switch]$UseSetupTemplate
+    [switch]$UseSetupTemplate,
+    [switch]$IgnoreSecBoot
 )
 
 # Check if PowerShell execution is Restricted or AllSigned or Undefined
@@ -49,6 +50,7 @@ if (! $myWindowsPrincipal.IsInRole($adminRole)) {
         $argString += " -WindowsVersion `"$WindowsVersion`""
     }
     if ($UseSetupTemplate) { $argString += " -UseSetupTemplate" }
+    if ($IgnoreSecBoot) { $argString += " -IgnoreSecBoot" }
     $newProcess.Arguments = $argString;
     $newProcess.Verb = "runas";
     [System.Diagnostics.Process]::Start($newProcess);
@@ -472,6 +474,9 @@ if ($imageindex) {
 if ($UseSetupTemplate) {
     $argumentList += "-UseSetupTemplate"
 }
+if ($IgnoreSecBoot) {
+    $argumentList += "-IgnoreSecBoot"
+}
 
 # Start the appropriate maker script
 try {
diff --git a/includes/$OEM$/$$/OEM/scripts/install-win-apps.ps1 b/includes/$OEM$/$$/OEM/scripts/install-win-apps.ps1
index 34c8ed4..7d4e0c3 100644
--- a/includes/$OEM$/$$/OEM/scripts/install-win-apps.ps1
+++ b/includes/$OEM$/$$/OEM/scripts/install-win-apps.ps1
@@ -50,7 +50,13 @@ function Get-RemotePackage {
 
     if (-not (Test-Path $dest)) {
         Write-Host "Downloading $fileName..." -ForegroundColor Cyan
-        Invoke-WebRequest -Uri $Url -OutFile $dest -UseBasicParsing
+        try {
+            Invoke-WebRequest -Uri $Url -OutFile $dest -UseBasicParsing -TimeoutSec 15
+        }
+        catch {
+            Write-Host "Download failed or timed out for $Url : $($_.Exception.Message)" -ForegroundColor Red
+            return $null
+        }
     }
 
     return $dest
@@ -290,6 +296,9 @@ else {
                 }
 
                 $mainAppPath = Get-RemotePackage $selectedFile.url
+                if (-not $mainAppPath) {
+                    continue
+                }
             }
 
             default {
diff --git a/includes/$OEM$/$$/OEM/scripts/script-helper.ps1 b/includes/$OEM$/$$/OEM/scripts/script-helper.ps1
index 5bd087d..6a94dea 100644
--- a/includes/$OEM$/$$/OEM/scripts/script-helper.ps1
+++ b/includes/$OEM$/$$/OEM/scripts/script-helper.ps1
@@ -17,7 +17,7 @@ if (-not (Test-Path -Path $logPath)) {
 
 function Get-ContentFromUrl {
     param([string]$url)
-    (Invoke-WebRequest -Uri $url -UseBasicParsing -ErrorAction Stop).Content
+    (Invoke-WebRequest -Uri $url -UseBasicParsing -TimeoutSec 15 -ErrorAction Stop).Content
 }
 
 # =========================
diff --git a/includes/$OEM$/$$/OEM/setup/scripts/UpdatePackages-oxmc.ps1 b/includes/$OEM$/$$/OEM/setup/scripts/Backup-PreUpdate.ps1
similarity index 100%
rename from includes/$OEM$/$$/OEM/setup/scripts/UpdatePackages-oxmc.ps1
rename to includes/$OEM$/$$/OEM/setup/scripts/Backup-PreUpdate.ps1
diff --git a/includes/$OEM$/$$/OEM/setup/scripts/enable-custom-bootres.ps1 b/includes/$OEM$/$$/OEM/setup/scripts/enable-custom-bootres.ps1
new file mode 100644
index 0000000..7c761d5
--- /dev/null
+++ b/includes/$OEM$/$$/OEM/setup/scripts/enable-custom-bootres.ps1
@@ -0,0 +1,37 @@
+# Check PowerShell version for use in path
+if ($PSVersionTable.PSVersion.Major -ge 3) {
+    $currentDir = $PSScriptRoot
+}
+else {
+    $currentDir = (Get-Item .).FullName
+}
+
+# Only run if the maker script flagged this build with -IgnoreSecBoot
+$labConfigPath = "HKLM:\SYSTEM\Setup\LabConfig"
+$flag = Get-ItemProperty -Path $labConfigPath -Name "IgnoreSecBootBootRes" -ErrorAction SilentlyContinue
+
+if (-not $flag -or $flag.IgnoreSecBootBootRes -ne 1) {
+    return
+}
+
+Write-Output "IgnoreSecBootBootRes flag set - checking Secure Boot state before touching BCD..."
+
+# Confirm-SecureBootUEFI throws on legacy BIOS / non-UEFI firmware - no Secure Boot to worry about there
+$secureBootOn = $false
+try {
+    $secureBootOn = Confirm-SecureBootUEFI
+}
+catch {
+    Write-Output "Confirm-SecureBootUEFI unavailable (legacy BIOS/non-UEFI) - Secure Boot not applicable, proceeding."
+    $secureBootOn = $false
+}
+
+if ($secureBootOn) {
+    Write-Warning "Secure Boot is ENABLED - skipping testsigning/nointegritychecks. Windows ignores both settings while Secure Boot is on, and forcing them here would do nothing but risk an inconsistent BCD. Disable Secure Boot in UEFI firmware, then re-run this script (`"$PSCommandPath`") manually to apply the settings - it only runs automatically once, during setup."
+    return
+}
+
+& bcdedit /set '{current}' testsigning on | Out-Null
+& bcdedit /set '{current}' nointegritychecks on | Out-Null
+
+Write-Output "testsigning/nointegritychecks enabled - Secure Boot was off, so this should take effect on next reboot."
diff --git a/includes/$OEM$/$$/OEM/setup/scripts/first-time-setup.ps1 b/includes/$OEM$/$$/OEM/setup/scripts/first-time-setup.ps1
index 3d3a60d..41d270b 100644
--- a/includes/$OEM$/$$/OEM/setup/scripts/first-time-setup.ps1
+++ b/includes/$OEM$/$$/OEM/setup/scripts/first-time-setup.ps1
@@ -93,4 +93,8 @@ Write-Output "Installing UWP UI Components for all users..."
 
 #### Install Normal Apps (Machine wide) ####
 Start-Process -FilePath "$windowsDrive\Windows\OEM\MultiStaller.exe" -ArgumentList "--config", "$windowsDrive\Windows\OEM\setup\apps-machine-wide.yml" -WindowStyle Maximized -Wait
-Start-Process -FilePath "$windowsDrive\Windows\OEM\ChromeMassInstaller.exe" -ArgumentList "--no_pref" -Wait
\ No newline at end of file
+Start-Process -FilePath "$windowsDrive\Windows\OEM\ChromeMassInstaller.exe" -ArgumentList "--no_pref" -Wait
+
+# Install other miscellaneous applications (mostly for user convenience)
+Start-Process -FilePath "msiexec.exe" -ArgumentList "/i `"$windowsDrive\Windows\OEM\apps\other\Monitarian-4.14.0.msi`" /quiet /norestart" -Wait -PassThru
+Start-Process -FilePath "$windowsDrive\Windows\OEM\apps\other\ShareX-19.0.2-setup.exe" -ArgumentList "/S" -Wait
\ No newline at end of file
diff --git a/includes/$OEM$/$$/OEM/setup/scripts/setup-user.ps1 b/includes/$OEM$/$$/OEM/setup/scripts/setup-user.ps1
index 78d121c..742cc3d 100644
--- a/includes/$OEM$/$$/OEM/setup/scripts/setup-user.ps1
+++ b/includes/$OEM$/$$/OEM/setup/scripts/setup-user.ps1
@@ -1,20 +1,35 @@
-# Check PowerShell version for use in path
-if ($PSVersionTable.PSVersion.Major -ge 3) {
-    # Use new variable syntax in PowerShell 3 and above
-    $currentDir = $PSScriptRoot
+try {
+    Start-Transcript -Path "$env:WINDIR\OEM\setup\scripts\setup-user.log" -Append
 }
-else {
-    # Use old variable syntax in Windows PowerShell 3 and below
-    $currentDir = (Get-Item .).FullName
+catch {
+    # Transcript failing to start must not block the rest of setup
 }
 
-# Import script-helper.ps1
-. "$currentDir\..\..\scripts\script-helper.ps1"
+try {
+    # Check PowerShell version for use in path
+    if ($PSVersionTable.PSVersion.Major -ge 3) {
+        # Use new variable syntax in PowerShell 3 and above
+        $currentDir = $PSScriptRoot
+    }
+    else {
+        # Use old variable syntax in Windows PowerShell 3 and below
+        $currentDir = (Get-Item .).FullName
+    }
 
-# Before doing ANYTHING, check if windwos is activated
-if ((Get-WindowsVersionDetails).LicenseStatus -ne "Licensed") {
-    & ([ScriptBlock]::Create((Invoke-RestMethod https://get.activated.win))) /HWID /HWID-NoEditionChange
-}
+    # Import script-helper.ps1
+    . "$currentDir\..\..\scripts\script-helper.ps1"
+
+    # Before doing ANYTHING, check if windows is activated
+    try {
+        if ((Get-WindowsVersionDetails).LicenseStatus -ne "Licensed") {
+            Write-Output "Windows not licensed - fetching activation script from get.activated.win..."
+            $activationScript = Invoke-RestMethod -Uri "https://get.activated.win" -TimeoutSec 15 -UseBasicParsing
+            & ([ScriptBlock]::Create($activationScript)) /HWID /HWID-NoEditionChange
+        }
+    }
+    catch {
+        Write-Warning "Activation step failed or timed out, continuing setup without activation: $($_.Exception.Message)"
+    }
 
 #### Set cursor theme to Posys Cursor ####
 $cursorkey = "HKCU:\Control Panel\Cursors"
@@ -88,4 +103,21 @@ if (-not (Get-Process -Name explorer -ErrorAction SilentlyContinue)) {
 & "$windowsDrive\Windows\OEM\setup\scripts\install-apps-user.ps1"
 
 ## Install apps (modern windows apps, such as: store apps, winget, appx, msix, etc [appx/msix/others can be downloaded from url])
-& "$windowsDrive\Windows\OEM\scripts\install-win-apps.ps1"
\ No newline at end of file
+& "$windowsDrive\Windows\OEM\scripts\install-win-apps.ps1"
+}
+catch {
+    Write-Error "setup-user.ps1 failed: $($_.Exception.Message)"
+    Write-Output $_.ScriptStackTrace
+}
+finally {
+    try {
+        Stop-Transcript
+    }
+    catch {
+        # Nothing to stop, ignore
+    }
+}
+
+# Always exit 0 - a failure here must be logged and diagnosed via setup-user.log,
+# not surfaced as an OOBE error dialog or left to hang FirstLogonCommands.
+exit 0
\ No newline at end of file
diff --git a/includes/$OEM$/$$/OEM/setup/scripts/winsetupcomplete.ps1 b/includes/$OEM$/$$/OEM/setup/scripts/winsetupcomplete.ps1
index 92e9d43..fa31993 100644
--- a/includes/$OEM$/$$/OEM/setup/scripts/winsetupcomplete.ps1
+++ b/includes/$OEM$/$$/OEM/setup/scripts/winsetupcomplete.ps1
@@ -22,6 +22,9 @@ if ($appsRoot -and (Test-Path $bootcampPath)) {
     & $bootcampPath
 }
 
+#### Apply custom bootres.dll Secure Boot compatibility settings (only runs if flagged at build time) ####
+& "$currentDir\enable-custom-bootres.ps1"
+
 #### Install oxmc-servers Root Certificate (required for system apps) ####
 Write-Output "Installing oxmc-servers root certificate..."
 & "$windowsDrive\Windows\OEM\scripts\install-certs.ps1" -Silent
diff --git a/includes/utils/ResourceHacker.ini b/includes/utils/ResourceHacker.ini
index 28114fc..51686e7 100644
--- a/includes/utils/ResourceHacker.ini
+++ b/includes/utils/ResourceHacker.ini
@@ -1,6 +1,6 @@
 [MRU List]
 MRU1=C:\Users\oxmc\Documents\Github\CustomTiny11\working\tiny11\sources\spwizimg.dll
-MRU2=C:\Users\oxmc\Documents\Github\CustomTiny11\working\tiny10\sources\spwizimg.dll
+MRU2=
 MRU3=
 MRU4=
 MRU5=
diff --git a/includes/utils/change-bootres.ps1 b/includes/utils/change-bootres.ps1
index 9b2b788..cb02ffa 100644
--- a/includes/utils/change-bootres.ps1
+++ b/includes/utils/change-bootres.ps1
@@ -16,8 +16,10 @@ param(
     
     [Parameter(Mandatory = $false)]
     [string]$PfxPassword = "",
-    
-    [switch]$UseLegacySizes
+
+    [switch]$UseLegacySizes,
+
+    [switch]$IgnoreSecBoot
 )
 
 #Requires -RunAsAdministrator
@@ -253,6 +255,14 @@ function Sign-FileWithCertificate {
     }
 }
 
+# Function to create a throwaway self-signed code-signing cert (IgnoreSecBoot path only)
+function New-ThrowawaySigningCert {
+    $cert = New-SelfSignedCertificate -Type CodeSigningCert -Subject "CN=CustomTiny11 IgnoreSecBoot" `
+        -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy Exportable -KeyUsage DigitalSignature `
+        -NotAfter (Get-Date).AddYears(5)
+    return $cert
+}
+
 # Function to resize bitmap
 function Resize-Bitmap {
     param(
@@ -412,6 +422,12 @@ try {
             $signed = Sign-FileWithCertificate -FilePath $outputDll -SignToolPath $signToolPath `
                 -CertificateThumbprint $CertificateThumbprint -PfxPath $PfxPath -PfxPassword $PfxPassword
         }
+        elseif ($IgnoreSecBoot) {
+            Write-Log "IgnoreSecBoot set and no certificate given - generating throwaway self-signed cert..." -Color "Yellow"
+            $throwawayCert = New-ThrowawaySigningCert
+            $signed = Sign-FileWithCertificate -FilePath $outputDll -SignToolPath $signToolPath `
+                -CertificateThumbprint $throwawayCert.Thumbprint
+        }
         else {
             Write-Log "No certificate specified. Skipping code signing." -Color "Yellow"
         }
@@ -439,7 +455,16 @@ try {
         Write-Host "[!] File is NOT signed" -ForegroundColor Yellow
         Write-Host "    Requires Test Signing mode or Secure Boot disabled" -ForegroundColor Gray
     }
-    
+
+    if ($IgnoreSecBoot) {
+        Write-Host ""
+        Write-Host "[IgnoreSecBoot] Signed with throwaway cert (not Microsoft-trusted)." -ForegroundColor Yellow
+        Write-Host "  Build the image with -IgnoreSecBoot on the maker script too - it flags first boot" -ForegroundColor Gray
+        Write-Host "  to run 'bcdedit /set testsigning on' and 'bcdedit /set nointegritychecks on'." -ForegroundColor Gray
+        Write-Host "  Those settings are IGNORED by Windows while Secure Boot is on in firmware." -ForegroundColor Gray
+        Write-Host "  Secure Boot must be disabled manually in UEFI setup for this to boot." -ForegroundColor Gray
+    }
+
     # Copy final DLL to script directory
     $FinallDLL = Join-Path $PSScriptRoot "bootres_modified.dll"
     Copy-Item -Path $outputDll -Destination $FinallDLL -Force
diff --git a/includes/utils/patch-iso-autounattend.ps1 b/includes/utils/patch-iso-autounattend.ps1
index 0e06f77..87bfcbe 100644
--- a/includes/utils/patch-iso-autounattend.ps1
+++ b/includes/utils/patch-iso-autounattend.ps1
@@ -6,6 +6,36 @@ param(
 
 $projectRoot = (Resolve-Path "$PSScriptRoot\..\..")
 
+# Detect Windows 10 vs 11 from install.wim/install.esd so the right autounattend variant gets injected
+function Get-WindowsVersionFromMedia {
+    param([string]$MediaRoot)
+
+    $srcBase = $MediaRoot
+    if (-not (Test-Path "$srcBase\sources\install.wim") -and -not (Test-Path "$srcBase\sources\install.esd") -and (Test-Path "$srcBase\x64\sources")) {
+        $srcBase = "$srcBase\x64"
+    }
+
+    $imagePath = if (Test-Path "$srcBase\sources\install.wim") { "$srcBase\sources\install.wim" }
+                 elseif (Test-Path "$srcBase\sources\install.esd") { "$srcBase\sources\install.esd" }
+                 else { $null }
+
+    if (-not $imagePath) { return $null }
+
+    try {
+        $imgInfo = Get-WindowsImage -ImagePath $imagePath -Index 1
+        $parts = $imgInfo.Version.Split('.')
+        if ($parts.Count -ge 3) {
+            $build = [int]$parts[2]
+            if ($build -ge 22000) { return "11" }
+            elseif ($build -ge 10240) { return "10" }
+        }
+    }
+    catch {
+        Write-Warning "Could not read Windows version from media: $($_.Exception.Message)"
+    }
+    return $null
+}
+
 if (-not (Test-Path $IsoPath)) {
     Write-Error "ISO not found: $IsoPath"
     exit 1
@@ -81,18 +111,31 @@ try {
         }
     }
 
-    # Replace autounattend.xml
-    $newXml = "$projectRoot\includes\autounattend-win10.xml"
+    # Detect Windows version so we inject the matching autounattend variant
+    Write-Host "Detecting Windows version from media..."
+    $detectedVersion = Get-WindowsVersionFromMedia -MediaRoot $tempDir
+    if (-not $detectedVersion) {
+        Write-Host "Could not automatically detect Windows version from media."
+        do {
+            $detectedVersion = Read-Host "Enter Windows version (10 or 11)"
+        } while ($detectedVersion -notin @("10", "11"))
+    }
+    else {
+        Write-Host "Detected Windows $detectedVersion media."
+    }
+
+    # Replace autounattend.xml with the version-matched variant
+    $newXml = "$projectRoot\includes\autounattend-win$detectedVersion.xml"
     if (-not (Test-Path $newXml)) {
-        Write-Error "autounattend-win10.xml not found at: $newXml"
+        Write-Error "autounattend-win$detectedVersion.xml not found at: $newXml"
         exit 1
     }
-    Write-Host "Replacing autounattend.xml..."
+    Write-Host "Replacing autounattend.xml with autounattend-win$detectedVersion.xml..."
     Copy-Item -Path $newXml -Destination "$tempDir\autounattend.xml" -Force
 
-    # Detect label from ISO filename
+    # Detect label from ISO filename, tagged with the detected version
     $isoName = [System.IO.Path]::GetFileNameWithoutExtension($IsoPath)
-    $label = if ($isoName -match 'x86') { "Tiny10_x86" } else { "Tiny10_x64" }
+    $label = if ($isoName -match 'x86') { "Tiny${detectedVersion}_x86" } else { "Tiny${detectedVersion}_x64" }
 
     $bootEtfs = "$tempDir\boot\etfsboot.com"
     $bootEfi  = "$tempDir\efi\microsoft\boot\efisys.bin"
diff --git a/tiny10Coremaker.ps1 b/tiny10Coremaker.ps1
index dc24844..10d36e4 100644
--- a/tiny10Coremaker.ps1
+++ b/tiny10Coremaker.ps1
@@ -5,7 +5,8 @@ param (
     [ValidatePattern('^[c-zC-Z]:?$|^[a-zA-Z]:\\.*$')]
     [string]$ScratchDisk,
     [string]$imageindex,
-    [switch]$UseSetupTemplate
+    [switch]$UseSetupTemplate,
+    [switch]$IgnoreSecBoot
 )
 
 $needchange = @("AllSigned", "Restricted", "Undefined")
@@ -60,6 +61,7 @@ if (-not $ScratchDisk) {
     }
 }
 Write-Output "Scratch disk set to $ScratchDisk"
+$hostArchitecture = $Env:PROCESSOR_ARCHITECTURE
 $setupMediaTemplatePath = "$PSScriptRoot\setup-media-template"
 New-Item -ItemType Directory -Force -Path "$ScratchDisk\tiny10\sources" >null
 $DriveLetter = Read-Host "Please enter the drive letter for the Windows 10 image"
@@ -247,6 +249,13 @@ Set-RegistryValue -KeyPath 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotif
 Set-RegistryValue -KeyPath 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotificationCache' -ValueName 'SV2' -ValueType 'REG_DWORD' -ValueData '0' -Description "Unsupported hardware notification SV2"
 Set-RegistryValue -KeyPath 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' -ValueName 'SV1' -ValueType 'REG_DWORD' -ValueData '0' -Description "User unsupported hardware notification SV1"
 Set-RegistryValue -KeyPath 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' -ValueName 'SV2' -ValueType 'REG_DWORD' -ValueData '0' -Description "User unsupported hardware notification SV2"
+Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassCPUCheck' -ValueType 'REG_DWORD' -ValueData '1' -Description "Bypass CPU check"
+Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassRAMCheck' -ValueType 'REG_DWORD' -ValueData '1' -Description "Bypass RAM check"
+Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassSecureBootCheck' -ValueType 'REG_DWORD' -ValueData '1' -Description "Bypass Secure Boot check"
+Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassStorageCheck' -ValueType 'REG_DWORD' -ValueData '1' -Description "Bypass storage check"
+Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassTPMCheck' -ValueType 'REG_DWORD' -ValueData '1' -Description "Bypass TPM check"
+Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\MoSetup' -ValueName 'AllowUpgradesWithUnsupportedTPMOrCPU' -ValueType 'REG_DWORD' -ValueData '1' -Description "Allow upgrades with unsupported TPM or CPU"
+Set-RegistryValue -KeyPath 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\OOBE' -ValueName 'BypassNRO' -ValueType 'REG_DWORD' -ValueData '1' -Description "Bypass network requirement in OOBE"
 
 Write-Host "Disabling Sponsored Apps:"
 Set-RegistryValue -KeyPath 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' -ValueName 'OemPreInstalledAppsEnabled' -ValueType 'REG_DWORD' -ValueData '0' -Description "OEM pre-installed apps"
@@ -376,6 +385,21 @@ if (Test-Path "$ScratchDisk\scratchdir\Windows\WinSxS_backup") {
     Move-Item -Path "$ScratchDisk\scratchdir\Windows\WinSxS_backup" -Destination "$ScratchDisk\scratchdir\Windows\WinSxS" -Force
 }
 
+# Verify the component store isn't corrupt before we capture it.
+# Must run AFTER the WinSxS restore above - scanning while WinSxS is swapped out would
+# always report corruption. /AnalyzeComponentStore is online-only (running OS) and only
+# reports size/cleanup recommendations, not a healthy/unhealthy verdict - /ScanHealth is
+# the offline-capable corruption check with an actual pass/fail result worth aborting on.
+Write-Host "Verifying component store health before capture..."
+$scanHealthOutput = & 'dism' '/English' "/image:$ScratchDisk\scratchdir" '/Cleanup-Image' '/ScanHealth'
+if ($scanHealthOutput -notmatch 'No component store corruption detected') {
+    $scanHealthOutput | Write-Host
+    Write-Error "Component store health check failed - possible corruption detected. Aborting build - image was NOT captured."
+    & 'dism' '/English' '/unmount-image' "/mountdir:$ScratchDisk\scratchdir" '/discard' >null
+    exit 1
+}
+Write-Host "Component store is healthy."
+
 Write-Host "Unmounting image..."
 & 'dism' '/English' '/unmount-image' "/mountdir:$ScratchDisk\scratchdir" '/commit'
 
@@ -414,6 +438,9 @@ Set-RegistryValue -KeyPath 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotif
 Set-RegistryValue -KeyPath 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' -ValueName 'SV1' -ValueType 'REG_DWORD' -ValueData '0' -Description "Setup image user unsupported hardware notification SV1"
 Set-RegistryValue -KeyPath 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' -ValueName 'SV2' -ValueType 'REG_DWORD' -ValueData '0' -Description "Setup image user unsupported hardware notification SV2"
 Set-RegistryValue -KeyPath 'HKEY_LOCAL_MACHINE\zSYSTEM\Setup' -ValueName 'CmdLine' -ValueType 'REG_SZ' -ValueData 'X:\sources\setup.exe' -Description "Setup command line"
+if ($IgnoreSecBoot) {
+    Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'IgnoreSecBootBootRes' -ValueType 'REG_DWORD' -ValueData '1' -Description "Setup image flag first boot to enable testsigning/nointegritychecks for custom bootres.dll"
+}
 
 Write-Host "Tweaking complete!"
 Write-Host "Unmounting Registry..."
@@ -451,13 +478,50 @@ Write-Host "Would you like to create an ISO? (y/n)"
 $iso = Read-Host
 
 if ($iso -eq 'y') {
-    if (Test-Path "$env:ProgramFiles(x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\amd64\Oscdimg\oscdimg.exe") {
-        Write-Host "Creating ISO..."
-        & "$env:ProgramFiles(x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\amd64\Oscdimg\oscdimg.exe" '-m' '-o' '-u2' '-udfver102' "-bootdata:2#p0,e,b$ScratchDisk\tiny10\boot\etfsboot.com#pEF,e,b$ScratchDisk\tiny10\efi\microsoft\boot\efisys.bin" "$ScratchDisk\tiny10" "$PSScriptRoot\tiny10core.iso"
-        Write-Host "ISO created successfully!"
-    } else {
-        Write-Host "Windows ADK is not installed. Cannot create ISO."
+    Write-Host "Creating ISO image..."
+    # Get Windows ADK path from registry (following Visual Studio's winsdk.bat approach).
+    $WinSDKPath = [Microsoft.Win32.Registry]::GetValue("HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Kits\Installed Roots", "KitsRoot10", $null)
+    if ($null -eq $WinSDKPath) {
+        $WinSDKPath = [Microsoft.Win32.Registry]::GetValue("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Kits\Installed Roots", "KitsRoot10", $null)
     }
+
+    if ($null -ne $WinSDKPath) {
+        # Trim the following backslash for path concatenation.
+        $WinSDKPath = $WinSDKPath.TrimEnd('\')
+        $ADKDepTools = "$WinSDKPath\Assessment and Deployment Kit\Deployment Tools\$hostArchitecture\Oscdimg"
+    }
+    $localOSCDIMGPath = "$PSScriptRoot\oscdimg.exe"
+
+    if ((Test-Path variable:ADKDepTools) -and (Test-Path "$ADKDepTools\oscdimg.exe" -PathType leaf)) {
+        Write-Host "Will be using oscdimg.exe from system ADK."
+        $OSCDIMG = "$ADKDepTools\oscdimg.exe"
+    }
+    else {
+        Write-Host "oscdimg.exe from system ADK not found. Will be using bundled oscdimg.exe."
+
+        $url = "https://msdl.microsoft.com/download/symbols/oscdimg.exe/3D44737265000/oscdimg.exe"
+
+        if (![System.IO.File]::Exists($localOSCDIMGPath)) {
+            Write-Host "Downloading oscdimg.exe..."
+            Invoke-WebRequest -Uri $url -OutFile $localOSCDIMGPath
+
+            if ([System.IO.File]::Exists($localOSCDIMGPath)) {
+                Write-Host "oscdimg.exe downloaded successfully."
+            }
+            else {
+                Write-Error "Failed to download oscdimg.exe."
+                exit 1
+            }
+        }
+        else {
+            Write-Host "oscdimg.exe already exists locally."
+        }
+
+        $OSCDIMG = $localOSCDIMGPath
+    }
+
+    & "$OSCDIMG" '-m' '-o' '-u2' '-udfver102' "-bootdata:2#p0,e,b$ScratchDisk\tiny10\boot\etfsboot.com#pEF,e,b$ScratchDisk\tiny10\efi\microsoft\boot\efisys.bin" "$ScratchDisk\tiny10" "$PSScriptRoot\tiny10core.iso"
+    Write-Host "ISO created successfully!"
 }
 
 Write-Host "Performing Cleanup..."
diff --git a/tiny10maker.ps1 b/tiny10maker.ps1
index db0b928..6f57a9c 100644
--- a/tiny10maker.ps1
+++ b/tiny10maker.ps1
@@ -6,7 +6,8 @@ param (
     [string]$ScratchDisk,
     [string]$windowsisopath,
     [string]$imageindex,
-    [switch]$UseSetupTemplate
+    [switch]$UseSetupTemplate,
+    [switch]$IgnoreSecBoot
 )
 
 if (-not $ScratchDisk) {
@@ -542,6 +543,10 @@ Write-Host "Bypassing system requirements(on the system image):"
 & 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassTPMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
 & 'reg' 'add' 'HKLM\zSYSTEM\Setup\MoSetup' '/v' 'AllowUpgradesWithUnsupportedTPMOrCPU' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
 & 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\OOBE' '/v' 'BypassNRO' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+if ($IgnoreSecBoot) {
+    Write-Host "IgnoreSecBoot set: flagging image to enable testsigning/nointegritychecks on first boot..."
+    & 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'IgnoreSecBootBootRes' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+}
 Write-Host "Disabling Sponsored Apps:"
 & 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'OemPreInstalledAppsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
 & 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'PreInstalledAppsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
@@ -796,6 +801,20 @@ Write-Host "Cleaning up image..."
 dism.exe /Image:$ScratchDisk\scratchdir /Cleanup-Image /StartComponentCleanup /ResetBase
 Write-Host "Cleanup complete."
 Write-Host ' '
+
+# Verify the component store isn't corrupt before we capture it.
+# /AnalyzeComponentStore is online-only (running OS) and only reports size/cleanup
+# recommendations, not a healthy/unhealthy verdict - /ScanHealth is the offline-capable
+# corruption check with an actual pass/fail result worth aborting the build on.
+Write-Host "Verifying component store health before capture..."
+$healthCheck = Repair-WindowsImage -Path $ScratchDisk\scratchdir -ScanHealth
+if ($healthCheck.ImageHealthState -ne 'Healthy') {
+    Write-Error "Component store health check failed (state: $($healthCheck.ImageHealthState)). Aborting build - image was NOT captured."
+    Dismount-WindowsImage -Path $ScratchDisk\scratchdir -Discard | Out-Null
+    exit 1
+}
+Write-Host "Component store is healthy."
+
 Write-Host "Unmounting image..."
 Dismount-WindowsImage -Path $ScratchDisk\scratchdir -Save
 Write-Host "Exporting image..."
@@ -828,6 +847,9 @@ Write-Host "Bypassing system requirements(on the setup image)..."
 & 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassStorageCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
 & 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassTPMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
 & 'reg' 'add' 'HKLM\zSYSTEM\Setup\MoSetup' '/v' 'AllowUpgradesWithUnsupportedTPMOrCPU' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+if ($IgnoreSecBoot) {
+    & 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'IgnoreSecBootBootRes' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+}
 Write-Host "Tweaking complete! Unmounting Registry..."
 $regKey.Close()
 reg unload HKLM\zCOMPONENTS | Out-Null
diff --git a/tiny11Coremaker.ps1 b/tiny11Coremaker.ps1
index f46dc7f..4fa7ccc 100644
--- a/tiny11Coremaker.ps1
+++ b/tiny11Coremaker.ps1
@@ -5,7 +5,8 @@ param (
     [ValidatePattern('^[c-zC-Z]:?$|^[a-zA-Z]:\\.*$')]
     [string]$ScratchDisk,
     [string]$imageindex,
-    [switch]$UseSetupTemplate
+    [switch]$UseSetupTemplate,
+    [switch]$IgnoreSecBoot
 )
 
 $needchange = @("AllSigned", "Restricted", "Undefined")
@@ -421,6 +422,9 @@ Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassSecu
 Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassStorageCheck' -ValueType 'REG_DWORD' -ValueData '1' -Description "Bypass storage check"
 Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassTPMCheck' -ValueType 'REG_DWORD' -ValueData '1' -Description "Bypass TPM check"
 Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\MoSetup' -ValueName 'AllowUpgradesWithUnsupportedTPMOrCPU' -ValueType 'REG_DWORD' -ValueData '1' -Description "Allow upgrades with unsupported TPM or CPU"
+if ($IgnoreSecBoot) {
+    Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'IgnoreSecBootBootRes' -ValueType 'REG_DWORD' -ValueData '1' -Description "Flag first boot to enable testsigning/nointegritychecks for custom bootres.dll"
+}
 Write-Host "Disabling Sponsored Apps:"
 Set-RegistryValue -KeyPath 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' -ValueName 'OemPreInstalledAppsEnabled' -ValueType 'REG_DWORD' -ValueData '0' -Description "OEM pre-installed apps"
 Set-RegistryValue -KeyPath 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' -ValueName 'PreInstalledAppsEnabled' -ValueType 'REG_DWORD' -ValueData '0' -Description "Pre-installed apps"
@@ -780,6 +784,21 @@ Write-Host "Cleaning up image..."
 & 'dism' '/English' "/image:$ScratchDisk\scratchdir" '/Cleanup-Image' '/StartComponentCleanup' '/ResetBase' >null
 Write-Host "Cleanup complete."
 Write-Host ' '
+
+# Verify the component store isn't corrupt before we capture it.
+# /AnalyzeComponentStore is online-only (running OS) and only reports size/cleanup
+# recommendations, not a healthy/unhealthy verdict - /ScanHealth is the offline-capable
+# corruption check with an actual pass/fail result worth aborting the build on.
+Write-Host "Verifying component store health before capture..."
+$scanHealthOutput = & 'dism' '/English' "/image:$ScratchDisk\scratchdir" '/Cleanup-Image' '/ScanHealth'
+if ($scanHealthOutput -notmatch 'No component store corruption detected') {
+    $scanHealthOutput | Write-Host
+    Write-Error "Component store health check failed - possible corruption detected. Aborting build - image was NOT captured."
+    & 'dism' '/English' '/unmount-image' "/mountdir:$ScratchDisk\scratchdir" '/discard' >null
+    exit 1
+}
+Write-Host "Component store is healthy."
+
 Write-Host "Unmounting image..."
 & 'dism' '/English' '/unmount-image' "/mountdir:$ScratchDisk\scratchdir" '/commit'
 Write-Host "Exporting image..."
@@ -812,6 +831,9 @@ Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassSecu
 Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassStorageCheck' -ValueType 'REG_DWORD' -ValueData '1' -Description "Setup image bypass storage check"
 Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'BypassTPMCheck' -ValueType 'REG_DWORD' -ValueData '1' -Description "Setup image bypass TPM check"
 Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\MoSetup' -ValueName 'AllowUpgradesWithUnsupportedTPMOrCPU' -ValueType 'REG_DWORD' -ValueData '1' -Description "Setup image allow upgrades with unsupported TPM or CPU"
+if ($IgnoreSecBoot) {
+    Set-RegistryValue -KeyPath 'HKLM\zSYSTEM\Setup\LabConfig' -ValueName 'IgnoreSecBootBootRes' -ValueType 'REG_DWORD' -ValueData '1' -Description "Setup image flag first boot to enable testsigning/nointegritychecks for custom bootres.dll"
+}
 Set-RegistryValue -KeyPath 'HKEY_LOCAL_MACHINE\zSYSTEM\Setup' -ValueName 'CmdLine' -ValueType 'REG_SZ' -ValueData 'X:\sources\setup.exe' -Description "Setup command line"
 Write-Host "Tweaking complete!"
 Write-Host "Unmounting Registry..."
diff --git a/tiny11maker.ps1 b/tiny11maker.ps1
index 263aa68..8935cff 100644
--- a/tiny11maker.ps1
+++ b/tiny11maker.ps1
@@ -1,4 +1,4 @@
-# Enable debugging
+# Enable debugging
 #Set-PSDebug -Trace 1
 
 param (
@@ -6,7 +6,8 @@ param (
     [string]$ScratchDisk,
     [string]$windowsisopath,
     [string]$imageindex,
-    [switch]$UseSetupTemplate
+    [switch]$UseSetupTemplate,
+    [switch]$IgnoreSecBoot
 )
 
 if (-not $ScratchDisk) {
@@ -288,6 +289,7 @@ else {
 
 Write-Host "Mounting complete! Performing removal of applications..."
 
+# Remove APPX packages from the mounted Windows image
 $packages = Get-ProvisionedAppxPackage -Path "$ScratchDisk\scratchdir" |
 ForEach-Object {
     $_.PackageName
@@ -331,7 +333,11 @@ $packagePrefixes = @(
     'Microsoft.MicrosoftStickyNotes_',
     'Microsoft.ScreenSketch_',
     'MicrosoftWindows.Client.WebExperience_',
-    'MicrosoftWindows.CrossDevice_'
+    'MicrosoftWindows.CrossDevice_',
+    'Microsoft.GetHelp',
+    'Microsoft.StorePurchaseApp',
+    'MicrosoftCorporationII.QuickAssist',
+    'Microsoft.XboxIdentityProvider'
 )
 $packagesToRemove = foreach ($pkg in $packages) {
     if ($packagePrefixes | Where-Object { $pkg -like "$_*" }) {
@@ -339,10 +345,38 @@ $packagesToRemove = foreach ($pkg in $packages) {
     }
 }
 foreach ($package in $packagesToRemove) {
-    Write-Host "Removing $package..."
+    Write-Host "Removing APPX $package..."
     Remove-AppxProvisionedPackage -Path "$ScratchDisk\scratchdir" -PackageName "$package" | Out-Null
 }
 
+# Remove Capabilities from the mounted Windows image
+$capabilityPrefixes = @(
+    'Browser.InternetExplorer',
+    'Microsoft.Windows.PowerShell.ISE',
+    'Microsoft.Wallpapers.Extended',
+    'OneCoreUAP.OneSync'
+)
+$installedCapabilities = Get-WindowsCapability -Path "$ScratchDisk\scratchdir" | Where-Object { $_.State -eq 'Installed' }
+foreach ($prefix in $capabilityPrefixes) {
+    $capabilitiesMatches = $installedCapabilities | Where-Object { $_.Name -like "$prefix*" }
+    foreach ($capability in $capabilitiesMatches) {
+        Write-Host "Removing capability $($capability.Name)..."
+        Remove-WindowsCapability -Path "$ScratchDisk\scratchdir" -Name $capability.Name -ErrorAction SilentlyContinue | Out-Null
+    }
+}
+
+# Remove features from the mounted Windows image
+$featuresToRemove = @(
+    'WCF-Services45',
+    'WCF-TCP-PortSharing45',
+    'WorkFolders-Client'
+)
+foreach ($feature in $featuresToRemove) {
+    Write-Host "Removing feature $feature..."
+    Disable-WindowsOptionalFeature -Path "$ScratchDisk\scratchdir" -FeatureName $feature -Remove -NoRestart -ErrorAction SilentlyContinue | Out-Null
+}
+
+# Remove Microsoft Edge from the mounted Windows image
 Write-Host "Removing Edge..."
 # Remove Edge directories
 Write-Host "Removing Edge directories..."
@@ -377,42 +411,43 @@ if (Test-Path "$ScratchDisk\scratchdir\Program Files\Microsoft\EdgeUpdate") {
     Remove-Item -Path "$ScratchDisk\scratchdir\Program Files\Microsoft\EdgeUpdate" -Recurse -Force -ErrorAction SilentlyContinue | Out-Null
 }
 
+# The line below is commented out as some apps require the webview2 component, so removing it could break certain applications.
 # Remove architecture-specific Edge WebView components
-if ($architecture -eq 'amd64') {
-    $folderPath = Get-ChildItem -Path "$ScratchDisk\scratchdir\Windows\WinSxS" -Filter "amd64_microsoft-edge-webview_31bf3856ad364e35*" -Directory -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName
-
-    if ($folderPath) {
-        foreach ($folder in $folderPath) {
-            if (Test-Path $folder) {
-                & 'takeown' '/f' $folder '/r' '/d' 'y' | Out-Null
-                & 'icacls' $folder '/grant' "$($adminGroup.Value):(F)" '/T' '/C' | Out-Null
-                Remove-Item -Path $folder -Recurse -Force -ErrorAction SilentlyContinue | Out-Null
-            }
-        }
-    }
-    else {
-        Write-Host "AMD64 Edge WebView folder not found."
-    }
-}
-elseif ($architecture -eq 'arm64') {
-    $folderPath = Get-ChildItem -Path "$ScratchDisk\scratchdir\Windows\WinSxS" -Filter "arm64_microsoft-edge-webview_31bf3856ad364e35*" -Directory -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName
-
-    if ($folderPath) {
-        foreach ($folder in $folderPath) {
-            if (Test-Path $folder) {
-                & 'takeown' '/f' $folder '/r' '/d' 'y' | Out-Null
-                & 'icacls' $folder '/grant' "$($adminGroup.Value):(F)" '/T' '/C' | Out-Null
-                Remove-Item -Path $folder -Recurse -Force -ErrorAction SilentlyContinue | Out-Null
-            }
-        }
-    }
-    else {
-        Write-Host "ARM64 Edge WebView folder not found."
-    }
-}
-else {
-    Write-Host "Unknown architecture: $architecture"
-}
+#if ($architecture -eq 'amd64') {
+#    $folderPath = Get-ChildItem -Path "$ScratchDisk\scratchdir\Windows\WinSxS" -Filter "amd64_microsoft-edge-webview_31bf3856ad364e35*" -Directory -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName
+#
+#    if ($folderPath) {
+#        foreach ($folder in $folderPath) {
+#            if (Test-Path $folder) {
+#                & 'takeown' '/f' $folder '/r' '/d' 'y' | Out-Null
+#                & 'icacls' $folder '/grant' "$($adminGroup.Value):(F)" '/T' '/C' | Out-Null
+#                Remove-Item -Path $folder -Recurse -Force -ErrorAction SilentlyContinue | Out-Null
+#            }
+#        }
+#    }
+#    else {
+#        Write-Host "AMD64 Edge WebView folder not found."
+#    }
+#}
+#elseif ($architecture -eq 'arm64') {
+#    $folderPath = Get-ChildItem -Path "$ScratchDisk\scratchdir\Windows\WinSxS" -Filter "arm64_microsoft-edge-webview_31bf3856ad364e35*" -Directory -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName
+#
+#    if ($folderPath) {
+#        foreach ($folder in $folderPath) {
+#            if (Test-Path $folder) {
+#                & 'takeown' '/f' $folder '/r' '/d' 'y' | Out-Null
+#                & 'icacls' $folder '/grant' "$($adminGroup.Value):(F)" '/T' '/C' | Out-Null
+#                Remove-Item -Path $folder -Recurse -Force -ErrorAction SilentlyContinue | Out-Null
+#            }
+#        }
+#    }
+#    else {
+#        Write-Host "ARM64 Edge WebView folder not found."
+#    }
+#}
+#else {
+#    Write-Host "Unknown architecture: $architecture"
+#}
 
 # Remove Microsoft Edge WebView directory
 #if (Test-Path "$ScratchDisk\scratchdir\Windows\System32\Microsoft-Edge-Webview") {
@@ -480,6 +515,139 @@ reg load HKLM\zNTUSER $ScratchDisk\scratchdir\Users\Default\ntuser.dat | Out-Nul
 reg load HKLM\zSOFTWARE $ScratchDisk\scratchdir\Windows\System32\config\SOFTWARE | Out-Null
 reg load HKLM\zSYSTEM $ScratchDisk\scratchdir\Windows\System32\config\SYSTEM | Out-Null
 
+## this function allows PowerShell to take ownership of a TrustedInstaller-owned registry key. Based on Jose Espitia's script.
+## Moved here (was previously defined near the end of the registry-tweak section) so keys that
+## need ownership taken - like Component Based Servicing below - can be fixed BEFORE anything
+## tries to write to them, instead of failing with "Access is denied" partway through.
+function Enable-Privilege {
+    param(
+        [ValidateSet(
+            "SeAssignPrimaryTokenPrivilege", "SeAuditPrivilege", "SeBackupPrivilege",
+            "SeChangeNotifyPrivilege", "SeCreateGlobalPrivilege", "SeCreatePagefilePrivilege",
+            "SeCreatePermanentPrivilege", "SeCreateSymbolicLinkPrivilege", "SeCreateTokenPrivilege",
+            "SeDebugPrivilege", "SeEnableDelegationPrivilege", "SeImpersonatePrivilege", "SeIncreaseBasePriorityPrivilege",
+            "SeIncreaseQuotaPrivilege", "SeIncreaseWorkingSetPrivilege", "SeLoadDriverPrivilege",
+            "SeLockMemoryPrivilege", "SeMachineAccountPrivilege", "SeManageVolumePrivilege",
+            "SeProfileSingleProcessPrivilege", "SeRelabelPrivilege", "SeRemoteShutdownPrivilege",
+            "SeRestorePrivilege", "SeSecurityPrivilege", "SeShutdownPrivilege", "SeSyncAgentPrivilege",
+            "SeSystemEnvironmentPrivilege", "SeSystemProfilePrivilege", "SeSystemtimePrivilege",
+            "SeTakeOwnershipPrivilege", "SeTcbPrivilege", "SeTimeZonePrivilege", "SeTrustedCredManAccessPrivilege",
+            "SeUndockPrivilege", "SeUnsolicitedInputPrivilege")]
+        $Privilege,
+        ## The process on which to adjust the privilege. Defaults to the current process.
+        $ProcessId = $pid,
+        ## Switch to disable the privilege, rather than enable it.
+        [Switch] $Disable
+    )
+    $definition = @'
+ using System;
+ using System.Runtime.InteropServices;
+
+ public class AdjPriv
+ {
+  [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
+  internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall,
+   ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen);
+
+  [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
+  internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok);
+  [DllImport("advapi32.dll", SetLastError = true)]
+  internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid);
+  [StructLayout(LayoutKind.Sequential, Pack = 1)]
+  internal struct TokPriv1Luid
+  {
+   public int Count;
+   public long Luid;
+   public int Attr;
+  }
+
+  internal const int SE_PRIVILEGE_ENABLED = 0x00000002;
+  internal const int SE_PRIVILEGE_DISABLED = 0x00000000;
+  internal const int TOKEN_QUERY = 0x00000008;
+  internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
+  public static bool EnablePrivilege(long processHandle, string privilege, bool disable)
+  {
+   bool retVal;
+   TokPriv1Luid tp;
+   IntPtr hproc = new IntPtr(processHandle);
+   IntPtr htok = IntPtr.Zero;
+   retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok);
+   tp.Count = 1;
+   tp.Luid = 0;
+   if(disable)
+   {
+    tp.Attr = SE_PRIVILEGE_DISABLED;
+   }
+   else
+   {
+    tp.Attr = SE_PRIVILEGE_ENABLED;
+   }
+   retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid);
+   retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
+   return retVal;
+  }
+ }
+'@
+
+    $processHandle = (Get-Process -id $ProcessId).Handle
+    $type = Add-Type $definition -PassThru
+    $type[0]::EnablePrivilege($processHandle, $Privilege, $Disable)
+}
+
+Enable-Privilege SeTakeOwnershipPrivilege
+
+# Forcibly takes ownership of an offline-hive registry key and REPLACES its ACL with a
+# single Allow-FullControl rule for the local Administrators group (rather than just adding
+# an Allow rule on top of the stock ACL), because some stock keys carry an explicit Deny that
+# would otherwise outrank an appended Allow. Returns $true/$false so callers can tell whether
+# a downstream reg add against this key is expected to work.
+function Set-OfflineRegistryOwnership {
+    param([Parameter(Mandatory)][string]$Path)
+    # A leaked (unclosed) handle here keeps the whole hive file open, which later makes
+    # "reg unload" fail with Access Denied and can cascade into DISM cleanup failing outright
+    # because it needs the underlying config file unlocked. try/finally guarantees Close()
+    # runs even if TakeOwnership/SetAccessControl throws partway through.
+    $regKey = $null
+    try {
+        $regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey($Path, [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree, [System.Security.AccessControl.RegistryRights]::TakeOwnership)
+        $regACL = $regKey.GetAccessControl()
+        $regACL.SetOwner($adminGroup)
+        $regKey.SetAccessControl($regACL)
+        $regKey.Close()
+        $regKey = $null
+
+        $regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey($Path, [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree, [System.Security.AccessControl.RegistryRights]::ChangePermissions)
+        $regACL = New-Object System.Security.AccessControl.RegistrySecurity
+        $regACL.SetAccessRuleProtection($true, $false)
+        $regRule = New-Object System.Security.AccessControl.RegistryAccessRule($adminGroup, "FullControl", "ContainerInherit", "None", "Allow")
+        $regACL.AddAccessRule($regRule)
+        $regKey.SetAccessControl($regACL)
+        return $true
+    } catch {
+        Write-Warning "Could not take ownership of HKLM\$Path : $($_.Exception.Message)"
+        return $false
+    } finally {
+        if ($regKey) { $regKey.Close() }
+    }
+}
+
+# Component Based Servicing key is TrustedInstaller-owned in a stock hive, and permissions
+# travel with the hive even when it's offline-loaded, so the "Disable Windows Error Reporting"
+# AtlasOS tweak further down (which writes a value under this key) would otherwise fail with
+# "Access is denied" every single build.
+Write-Host "Taking ownership of Component Based Servicing key..."
+if (Set-OfflineRegistryOwnership "zSOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing") {
+    Write-Host "Component Based Servicing ownership taken."
+}
+
+# WindowsRuntime\ActivatableClassId is TrustedInstaller-owned too, so the "Disable Windows 11
+# Settings Banner" and "Disable Game Bar Presence Writer" AtlasOS tweaks further down (which
+# write values under this key) would otherwise fail with "Access is denied" every single build.
+Write-Host "Taking ownership of WindowsRuntime ActivatableClassId key..."
+if (Set-OfflineRegistryOwnership "zSOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId") {
+    Write-Host "WindowsRuntime ActivatableClassId ownership taken."
+}
+
 Write-Host "Bypassing system requirements(on the system image):"
 & 'reg' 'add' 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV1' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
 & 'reg' 'add' 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV2' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
@@ -491,7 +659,11 @@ Write-Host "Bypassing system requirements(on the system image):"
 & 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassStorageCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
 & 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassTPMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
 & 'reg' 'add' 'HKLM\zSYSTEM\Setup\MoSetup' '/v' 'AllowUpgradesWithUnsupportedTPMOrCPU' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
-& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\OOBE' '/v' 'BypassNRO' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+# BypassNRO set below under "Enabling Local Accounts on OOBE"
+if ($IgnoreSecBoot) {
+    Write-Host "IgnoreSecBoot set: flagging image to enable testsigning/nointegritychecks on first boot..."
+    & 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'IgnoreSecBootBootRes' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+}
 
 Write-Host "Disabling Sponsored Apps:"
 & 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'OemPreInstalledAppsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
@@ -532,7 +704,7 @@ Write-Host "Disabling Delivery Optimization (P2P cloud updates)..."
 Write-Host "Disabling Diagnostic Data Viewer..."
 & 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack' '/v' 'ShowedToastAtLevel' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
 & 'reg' 'add' 'HKLM\zSYSTEM\ControlSet001\Services\DiagTrack' '/v' 'Start' '/t' 'REG_DWORD' '/d' '4' '/f' | Out-Null
-& 'reg' 'add' 'HKLM\zSYSTEM\ControlSet001\Services\dmwappushservice' '/v' 'Start' '/t' 'REG_DWORD' '/d' '4' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSYSTEM\ControlSet001\Services\dmwappushservice' '/v' 'Start' '/t' 'REG_DWORD' '/d' '4' '/f' | Out-Null # also covers "Disabling Telemetry" dmwappushservice/Start
 
 Write-Host "Disabling Cloud Store sync..."
 # Windows.CloudStore.dll data sync
@@ -590,7 +762,16 @@ Write-Host "Disabling Telemetry:"
 & 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\InputPersonalization\TrainedDataStore' '/v' 'HarvestContacts' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
 & 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Personalization\Settings' '/v' 'AcceptedPrivacyPolicy' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
 & 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\DataCollection' '/v' 'AllowTelemetry' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
-& 'reg' 'add' 'HKLM\zSYSTEM\ControlSet001\Services\dmwappushservice' '/v' 'Start' '/t' 'REG_DWORD' '/d' '4' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\DataCollection' '/v' 'MaxTelemetryAllowed' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\Windows Error Reporting' '/v' 'Disabled' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\SQMClient\Windows' '/v' 'CEIPEnable' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# Disable Copilot
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsCopilot' '/v' 'TurnOffWindowsCopilot' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# Disable Recall (Windows AI / 26100+ builds)
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsAI' '/v' 'DisableAIDataAnalysis' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
 ## Disable Windows Spotlight and tips on lockscreen
 & 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'RotatingLockScreenEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
 & 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'RotatingLockScreenOverlayEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
@@ -598,8 +779,8 @@ Write-Host "Disabling Telemetry:"
 
 ## Prevents installation of DevHome and Outlook
 Write-Host "Prevents installation of DevHome and Outlook:"
-& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator\UScheduler\OutlookUpdate' '/v' 'workCompleted' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
-& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator\UScheduler\DevHomeUpdate' '/v' 'workCompleted' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler\OutlookUpdate' '/v' 'workCompleted' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler\DevHomeUpdate' '/v' 'workCompleted' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
 & 'reg' 'delete' 'HKLM\zSOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\OutlookUpdate' '/f' | Out-Null
 & 'reg' 'delete' 'HKLM\zSOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\DevHomeUpdate' '/f' | Out-Null
 
@@ -627,6 +808,829 @@ Write-Host "Aligning the taskbar to the left..."
 & 'reg' 'add' 'HKLM\zDEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'TaskbarAl' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
 & 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'TaskbarAl' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
 
+# =====================================================================================
+# Additional registry tweaks ported from AtlasOS (github.com/Atlas-OS/Atlas)
+# Source: src/playbook/Configuration/tweaks/**/*.yml (pure registryValue/registryKey files)
+# Applied against offline-loaded hives: zSOFTWARE, zSYSTEM, zNTUSER
+# Review before use -- some tweaks affect security posture (UAC, LLMNR, anonymous access, etc.)
+# =====================================================================================
+
+# --- Configure Content Delivery Manager ---
+Write-Host "[AtlasOS tweak] Configure Content Delivery Manager"
+# source: tweaks/debloat/config-content-delivery.yml
+# Most ContentDeliveryManager values here already set above under "Disabling Sponsored
+# Apps" and "Disable Windows Spotlight and tips on lockscreen" - only the two values not
+# covered by those blocks are kept here.
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'RemediationRequired' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\SystemSettings\AccountNotifications' '/v' 'EnableAccountNotifications' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Hide Unused Windows Security Pages ---
+Write-Host "[AtlasOS tweak] Hide Unused Windows Security Pages"
+# source: tweaks/debloat/hide-unused-security-pages.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows Defender Security Center\Family options' '/v' 'UILockdown' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows Defender Security Center\Device performance and health' '/v' 'UILockdown' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows Defender Security Center\Account protection' '/v' 'UILockdown' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable SMB Bandwidth Throttling ---
+Write-Host "[AtlasOS tweak] Disable SMB Bandwidth Throttling"
+# source: tweaks/networking/shares/disable-smb-bandwidth-throttling.yml
+& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters' '/v' 'DisableBandwidthThrottling' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Restrict Anonymous Access ---
+Write-Host "[AtlasOS tweak] Restrict Anonymous Access"
+# source: tweaks/networking/shares/restrict-anonymous-access.yml
+& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Services\LanManServer\Parameters' '/v' 'RestrictNullSessAccess' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Restrict Anonymous Enumeration of Shares ---
+Write-Host "[AtlasOS tweak] Restrict Anonymous Enumeration of Shares"
+# source: tweaks/networking/shares/restrict-anonymous-enumeration.yml
+& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\Lsa' '/v' 'RestrictAnonymous' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Configure Automatic Maintenance ---
+Write-Host "[AtlasOS tweak] Configure Automatic Maintenance"
+# source: tweaks/performance/config-automatic-maintenance.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\Task Scheduler\Maintenance' '/v' 'WakeUp' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Configure the Multimedia Class Scheduler Service ---
+Write-Host "[AtlasOS tweak] Configure the Multimedia Class Scheduler Service"
+# source: tweaks/performance/config-mmcss.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile' '/v' 'SystemResponsiveness' '/t' 'REG_DWORD' '/d' '10' '/f' | Out-Null
+
+# --- Disable Background Apps ---
+Write-Host "[AtlasOS tweak] Disable Background Apps"
+# source: tweaks/performance/disable-background-apps.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications' '/v' 'GlobalUserDisabled' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search' '/v' 'BackgroundAppGlobalToggle' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Game Bar ---
+Write-Host "[AtlasOS tweak] Disable Game Bar"
+# source: tweaks/performance/disable-game-bar.yml
+# GameConfigStore/GameDVR/GameBar are TrustedInstaller-owned in a stock hive, so the reg adds
+# below would otherwise fail with "Access is denied" every single build.
+# GameConfigStore/GameDVR/GameBar don't exist yet in a fresh hive (reg add has to create
+# them), so taking ownership of those exact paths is a no-op - OpenSubKey returns null for a
+# missing key rather than throwing, so there's nothing to take ownership OF yet. The actual
+# access-denied is "System" itself (a top-level HKCU key) refusing to let a new child key be
+# created under it; GameDVR/GameBar's parents are ordinary writable CurrentVersion/Microsoft
+# keys already used successfully by other tweaks, so only "System" needs fixing here.
+Set-OfflineRegistryOwnership "zNTUSER\System" | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\System\GameConfigStore' '/v' 'GameDVR_Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\GameDVR' '/v' 'AppCaptureEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\GameBar' '/v' 'GamePanelStartupTipIndex' '/t' 'REG_DWORD' '/d' '3' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\GameBar' '/v' 'ShowStartupPanel' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\GameBar' '/v' 'UseNexusForGameBarEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Gaming.GameBar.PresenceServer.Internal.PresenceWriter' '/v' 'ActivationType' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\GameDVR' '/v' 'AllowGameDVR' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\PolicyManager\default\ApplicationManagement\AllowGameDVR' '/v' 'value' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Respect Power Modes Windows Search Indexing ---
+Write-Host "[AtlasOS tweak] Respect Power Modes Windows Search Indexing"
+# source: tweaks/performance/respect-power-modes-search.yml
+# Windows Search\Gather\Windows\SystemIndex is TrustedInstaller-owned in a stock hive, so the
+# reg add below would otherwise fail with "Access is denied" every single build.
+Set-OfflineRegistryOwnership "zSOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex" | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex' '/v' 'RespectPowerModes' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Paging Settings ---
+Write-Host "[AtlasOS tweak] Disable Paging Settings"
+# source: tweaks/performance/system/disable-paging.yml
+& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\Session Manager\Memory Management' '/v' 'DisablePagingExecutive' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\Session Manager\Memory Management' '/v' 'DisablePageCombining' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Prioritize Foreground Applications ---
+Write-Host "[AtlasOS tweak] Prioritize Foreground Applications"
+# source: tweaks/performance/system/win32-priority-separation.yml
+& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\PriorityControl' '/v' 'Win32PrioritySeparation' '/t' 'REG_DWORD' '/d' '38' '/f' | Out-Null
+
+# --- Disable Advertising ID ---
+Write-Host "[AtlasOS tweak] Disable Advertising ID"
+# source: tweaks/privacy/advertising/disable-advertising-info.yml
+# AdvertisingInfo\Enabled already set above under "Disabling Telemetry"; only the group
+# policy lockout value is new here.
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo' '/v' 'DisabledByGroupPolicy' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Sync Provider Notifications ---
+Write-Host "[AtlasOS tweak] Disable Sync Provider Notifications"
+# source: tweaks/privacy/advertising/disable-sync-provider-notifs.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'ShowSyncProviderNotifications' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable NVIDIA Control Panel Telemetry ---
+Write-Host "[AtlasOS tweak] Disable NVIDIA Control Panel Telemetry"
+# source: tweaks/privacy/apps/disable-nvidia-telemetry.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Software\NVIDIA Corporation\NVControlPanel2\Client' '/v' 'OptInOrOutPreference' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Office Telemetry ---
+Write-Host "[AtlasOS tweak] Disable Office Telemetry"
+# source: tweaks/privacy/apps/disable-office-telemetry.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Policies\Microsoft\office\16.0\common' '/v' 'sendcustomerdata' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Policies\Microsoft\office\common\clienttelemetry' '/v' 'sendtelemetry' '/t' 'REG_DWORD' '/d' '3' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Policies\Microsoft\office\16.0\common' '/v' 'qmenable' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Settings Sync ---
+Write-Host "[AtlasOS tweak] Disable Settings Sync"
+# source: tweaks/privacy/cloud/disable-setting-sync.yml
+# DisableSettingSync/DisableSettingSyncUserOverride/SyncPolicy already set above under
+# "Disabling Cloud Store sync" - only the additional policy + per-group keys are new here.
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\SettingSync' '/v' 'DisableSyncOnPaidNetwork' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\SettingSync' '/v' 'DisableWindowsSettingSync' '/t' 'REG_DWORD' '/d' '2' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Personalization' '/v' 'Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\BrowserSettings' '/v' 'Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Credentials' '/v' 'Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Accessibility' '/v' 'Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Windows' '/v' 'Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Suggested Ways to Finish Setting Up Your Device ---
+Write-Host "[AtlasOS tweak] Disable Suggested Ways to Finish Setting Up Your Device"
+# source: tweaks/privacy/cloud/disable-suggest-ways-to-finish-setup.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\UserProfileEngagement' '/v' 'ScoobeSystemSettingEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disallow Message Service Cloud Sync ---
+Write-Host "[AtlasOS tweak] Disallow Message Service Cloud Sync"
+# source: tweaks/privacy/cloud/disallow-message-cloud-sync.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\Messaging' '/v' 'AllowMessageSync' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Configure App Permissions ---
+Write-Host "[AtlasOS tweak] Configure App Permissions"
+# source: tweaks/privacy/config-app-permissions.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\appDiagnostics' '/v' 'Value' '/t' 'REG_SZ' '/d' 'Deny' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location' '/v' 'Value' '/t' 'REG_SZ' '/d' 'Deny' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userAccountInformation' '/v' 'Value' '/t' 'REG_SZ' '/d' 'Deny' '/f' | Out-Null
+
+# --- Configure Windows Media Player ---
+Write-Host "[AtlasOS tweak] Configure Windows Media Player"
+# source: tweaks/privacy/config-windows-media-player.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\WMDRM' '/v' 'DisableOnline' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\MediaPlayer\Preferences' '/v' 'AcceptedPrivacyStatement' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\MediaPlayer\Preferences' '/v' 'UsageTracking' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Activity Feed ---
+Write-Host "[AtlasOS tweak] Disable Activity Feed"
+# source: tweaks/privacy/disable-activity-feed.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\System' '/v' 'EnableActivityFeed' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable App Launch Tracking ---
+Write-Host "[AtlasOS tweak] Disable App Launch Tracking"
+# source: tweaks/privacy/disable-app-launch-tracking.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'Start_TrackProgs' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Device Health Attestation Monitoring and Reporting ---
+Write-Host "[AtlasOS tweak] Disable Device Health Attestation Monitoring and Reporting"
+# source: tweaks/privacy/disable-device-monitoring.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\DeviceHealthAttestationService' '/v' 'EnableDeviceHealthAttestationService' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Experimentation ---
+Write-Host "[AtlasOS tweak] Disable Experimentation"
+# source: tweaks/privacy/disable-experimentation.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\PolicyManager\default\System\AllowExperimentation' '/v' 'Value' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Lockscreen Camera ---
+Write-Host "[AtlasOS tweak] Disable Lockscreen Camera"
+# source: tweaks/privacy/disable-lockscreen-camera.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\Personalization' '/v' 'NoLockScreenCamera' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Online Speech Recognition ---
+Write-Host "[AtlasOS tweak] Disable Online Speech Recognition"
+# source: tweaks/privacy/disable-online-speech-recognition.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy' '/v' 'HasAccepted' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Program Compatibility Assistant (PCA) ---
+Write-Host "[AtlasOS tweak] Disable Program Compatibility Assistant (PCA)"
+# source: tweaks/privacy/disable-pca.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\AppCompat' '/v' 'AITEnable' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\AppCompat' '/v' 'AllowTelemetry' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\AppCompat' '/v' 'DisableEngine' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\AppCompat' '/v' 'DisableInventory' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\AppCompat' '/v' 'DisablePCA' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\AppCompat' '/v' 'DisableUAR' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable OOBE Privacy Experience ---
+Write-Host "[AtlasOS tweak] Disable OOBE Privacy Experience"
+# source: tweaks/privacy/disable-privacy-experience.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\OOBE' '/v' 'DisablePrivacyExperience' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Resultant Set of Policy (RSoP) Logging ---
+Write-Host "[AtlasOS tweak] Disable Resultant Set of Policy (RSoP) Logging"
+# source: tweaks/privacy/disable-rsop-logging.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\System' '/v' 'RSoPLogging' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Automatic Updates Of Speech Data ---
+Write-Host "[AtlasOS tweak] Disable Automatic Updates Of Speech Data"
+# source: tweaks/privacy/disable-speech-auto-updates.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Speech' '/v' 'AllowSpeechModelUpdate' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Do Not Use Diagnostic Data For Tailored Experiences ---
+Write-Host "[AtlasOS tweak] Do Not Use Diagnostic Data For Tailored Experiences"
+# source: tweaks/privacy/disable-tailored-experiences.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Privacy' '/v' 'TailoredExperiencesWithDiagnosticDataEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableTailoredExperiencesWithDiagnosticData' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Most Frequently Used Applications ---
+Write-Host "[AtlasOS tweak] Disable Most Frequently Used Applications"
+# source: tweaks/privacy/disable-user-tracking.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'NoInstrumentation' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Website Access to Language List ---
+Write-Host "[AtlasOS tweak] Disable Website Access to Language List"
+# source: tweaks/privacy/disable-web-lang-list-access.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\International\User Profile' '/v' 'HttpAcceptLanguageOptOut' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Windows Error Reporting ---
+Write-Host "[AtlasOS tweak] Disable Windows Error Reporting"
+# source: tweaks/privacy/disable-win-error-reporting.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting' '/v' 'Disabled' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting' '/v' 'DoReport' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting' '/v' 'Disabled' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting' '/v' 'DontShowUI' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting' '/v' 'ShowUI' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting' '/v' 'LoggingDisabled' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting' '/v' 'DontSendAdditionalData' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing' '/v' 'DisableWerReporting' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Settings' '/v' 'DisableSendGenericDriverNotFoundToWER' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Settings' '/v' 'DisableSendRequestAdditionalSoftwareToWER' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disallow Users to Be Non-local ---
+Write-Host "[AtlasOS tweak] Disallow Users to Be Non-local"
+# source: tweaks/privacy/disallow-ms-accounts.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' '/v' 'NoConnectedUser' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disallow Upload and Publish of User Activities ---
+Write-Host "[AtlasOS tweak] Disallow Upload and Publish of User Activities"
+# source: tweaks/privacy/disallow-user-activity-upload.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\System' '/v' 'UploadUserActivities' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\System' '/v' 'PublishUserActivities' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Key Management System Telemetry ---
+Write-Host "[AtlasOS tweak] Disable Key Management System Telemetry"
+# source: tweaks/privacy/telemetry/disable-activation-telemetry.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform' '/v' 'NoGenTicket' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Customer Experience Improvement Program ---
+Write-Host "[AtlasOS tweak] Disable Customer Experience Improvement Program"
+# source: tweaks/privacy/telemetry/disable-ceip.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\AppV\CEIP' '/v' 'CEIPEnable' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\SQMClient\Windows' '/v' 'CEIPEnable' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Diagnostic Tracing ---
+Write-Host "[AtlasOS tweak] Disable Diagnostic Tracing"
+# source: tweaks/privacy/telemetry/disable-diagnostic-tracing.yml
+& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\Diagnostics\Performance' '/v' 'DisableDiagnosticTracing' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Input Telemetry ---
+Write-Host "[AtlasOS tweak] Disable Input Telemetry"
+# source: tweaks/privacy/telemetry/disable-input-telemetry.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\InputPersonalization' '/v' 'RestrictImplicitInkCollection' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\InputPersonalization' '/v' 'RestrictImplicitTextCollection' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\InputPersonalization\TrainedDataStore' '/v' 'HarvestContacts' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Personalization\Settings' '/v' 'AcceptedPrivacyPolicy' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\TabletPC' '/v' 'PreventHandwritingDataSharing' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports' '/v' 'PreventHandwritingErrorReports' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Input\Settings' '/v' 'InsightsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Input\TIPC' '/v' 'Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Input\TIPC' '/v' 'Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Change the Tooltip Color to Blue ---
+Write-Host "[AtlasOS tweak] Change the Tooltip Color to Blue"
+# source: tweaks/qol/appearance/blue-tooltips.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Colors' '/v' 'InfoWindow' '/t' 'REG_SZ' '/d' '246 253 255' '/f' | Out-Null
+
+# --- Disallow Themes to Change Certain Personalized Features ---
+Write-Host "[AtlasOS tweak] Disallow Themes to Change Certain Personalized Features"
+# source: tweaks/qol/appearance/disallow-theme-changes.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes' '/v' 'ThemeChangesMousePointers' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes' '/v' 'ThemeChangesDesktopIcons' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Wallpaper Compression ---
+Write-Host "[AtlasOS tweak] Disable Wallpaper Compression"
+# source: tweaks/qol/best-wallpaper-quality.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop' '/v' 'JPEGImportQuality' '/t' 'REG_DWORD' '/d' '100' '/f' | Out-Null
+
+# --- Configure Windows Ink Workspace ---
+Write-Host "[AtlasOS tweak] Configure Windows Ink Workspace"
+# source: tweaks/qol/config-windows-ink-workspace.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\PenWorkspace' '/v' 'PenWorkspaceAppSuggestionsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Dynamic Lighting ---
+Write-Host "[AtlasOS tweak] Disable Dynamic Lighting"
+# source: tweaks/qol/disable-dynamic-lighting.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Lighting' '/v' 'AmbientLightingEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Mouse Acceleration ---
+Write-Host "[AtlasOS tweak] Disable Mouse Acceleration"
+# source: tweaks/qol/disable-mouse-accel.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Mouse' '/v' 'MouseSpeed' '/t' 'REG_SZ' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Mouse' '/v' 'MouseThreshold1' '/t' 'REG_SZ' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Mouse' '/v' 'MouseThreshold2' '/t' 'REG_SZ' '/d' '0' '/f' | Out-Null
+
+# --- Disable Cross Device Resume ---
+Write-Host "[AtlasOS tweak] Disable Cross Device Resume"
+# source: tweaks/qol/disable-resume.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\CrossDeviceResume\Configuration' '/v' 'IsResumeAllowed' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\PolicyManager\default\Connectivity\DisableCrossDeviceResume' '/v' 'Value' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Screen Capture Hotkey ---
+Write-Host "[AtlasOS tweak] Disable Screen Capture Hotkey"
+# source: tweaks/qol/disable-screen-capture-hotkey.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Keyboard' '/v' 'PrintScreenKeyForSnippingEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Settings Tips ---
+Write-Host "[AtlasOS tweak] Disable Settings Tips"
+# source: tweaks/qol/disable-settings-tips.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\PolicyManager\default\Settings\AllowOnlineTips' '/v' 'value' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'AllowOnlineTips' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Spell Checking ---
+Write-Host "[AtlasOS tweak] Disable Spell Checking"
+# source: tweaks/qol/disable-spell-checking.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\TabletTip\1.7' '/v' 'EnableAutocorrection' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\TabletTip\1.7' '/v' 'EnableDoubleTapSpace' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\TabletTip\1.7' '/v' 'EnablePredictionSpaceInsertion' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\TabletTip\1.7' '/v' 'EnableSpellchecking' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\TabletTip\1.7' '/v' 'EnableTextPrediction' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Automatic Updates for Apps in Store ---
+Write-Host "[AtlasOS tweak] Disable Automatic Updates for Apps in Store"
+# source: tweaks/qol/disable-store-auto-updates.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\WindowsStore\WindowsUpdate' '/v' 'AutoDownload' '/t' 'REG_DWORD' '/d' '2' '/f' | Out-Null
+
+# --- Disable Tips ---
+Write-Host "[AtlasOS tweak] Disable Tips"
+# source: tweaks/qol/disable-tips.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableSoftLanding' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Unnecessary Touch Keyboard Settings ---
+Write-Host "[AtlasOS tweak] Disable Unnecessary Touch Keyboard Settings"
+# source: tweaks/qol/disable-touch-keyboard-features.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\TabletTip\1.7' '/v' 'EnableAutoShiftEngage' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\TabletTip\1.7' '/v' 'EnableKeyAudioFeedback' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Touch Visual Feedback ---
+Write-Host "[AtlasOS tweak] Disable Touch Visual Feedback"
+# source: tweaks/qol/disable-touch-visual-feedback.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Cursors' '/v' 'GestureVisualization' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Cursors' '/v' 'ContactVisualization' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable 'Notify About USB Issues' ---
+Write-Host "[AtlasOS tweak] Disable 'Notify About USB Issues'"
+# source: tweaks/qol/disable-usb-issues-notifications.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Shell\USB' '/v' 'NotifyOnUsbErrors' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Shell\USB' '/v' 'NotifyOnWeakCharger' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Windows 11 Settings Banner ---
+Write-Host "[AtlasOS tweak] Disable Windows 11 Settings Banner"
+# source: tweaks/qol/disable-win11-settings-banner.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\ValueBanner.IdealStateFeatureControlProvider' '/v' 'ActivationType' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Windows Feedback ---
+Write-Host "[AtlasOS tweak] Disable Windows Feedback"
+# source: tweaks/qol/disable-windows-feedback.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Siuf\Rules' '/v' 'NumberOfSIUFInPeriod' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Siuf\Rules' '/v' 'PeriodInNanoSeconds' '/t' 'REG_SZ' '/d' '""' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection' '/v' 'DoNotShowFeedbackNotifications' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Windows Spotlight ---
+Write-Host "[AtlasOS tweak] Disable Windows Spotlight"
+# source: tweaks/qol/disable-windows-spotlight.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableWindowsSpotlightFeatures' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableWindowsSpotlightWindowsWelcomeExperience' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableWindowsSpotlightOnActionCenter' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableWindowsSpotlightOnSettings' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableThirdPartySuggestions' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Do Not Reduce Sounds While in a Call ---
+Write-Host "[AtlasOS tweak] Do Not Reduce Sounds While in a Call"
+# source: tweaks/qol/do-not-reduce-sounds.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Multimedia\Audio' '/v' 'UserDuckingPreference' '/t' 'REG_DWORD' '/d' '3' '/f' | Out-Null
+
+# --- Disable 'Always Read and Scan This Section' ---
+Write-Host "[AtlasOS tweak] Disable 'Always Read and Scan This Section'"
+# source: tweaks/qol/ease-of-access/disable-always-read-section.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Ease of Access' '/v' 'selfscan' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Ease of Access' '/v' 'selfvoice' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Commonly Annoying Features and Shortcuts ---
+Write-Host "[AtlasOS tweak] Disable Commonly Annoying Features and Shortcuts"
+# source: tweaks/qol/ease-of-access/disable-annoying-features-shortcuts.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Accessibility\HighContrast' '/v' 'Flags' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Accessibility\Keyboard Response' '/v' 'Flags' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Accessibility\MouseKeys' '/v' 'Flags' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Accessibility\StickyKeys' '/v' 'Flags' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Accessibility\ToggleKeys' '/v' 'Flags' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Input Method\Hot Keys\00000104' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Keyboard Layout\Toggle' '/v' 'Layout Hotkey' '/t' 'REG_DWORD' '/d' '3' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Keyboard Layout\Toggle' '/v' 'Language Hotkey' '/t' 'REG_DWORD' '/d' '3' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Keyboard Layout\Toggle' '/v' 'Hotkey' '/t' 'REG_DWORD' '/d' '3' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Narrator\NoRoam' '/v' 'WinEnterLaunchEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Accessibility Tool Shortcut ---
+Write-Host "[AtlasOS tweak] Disable Accessibility Tool Shortcut"
+# source: tweaks/qol/ease-of-access/disable-making-touch-easier.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Accessibility\SlateLaunch' '/v' 'LaunchAT' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Ease of Access Sounds ---
+Write-Host "[AtlasOS tweak] Disable Ease of Access Sounds"
+# source: tweaks/qol/ease-of-access/disable-warning-sounds.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Accessibility' '/v' 'Warning Sounds' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Accessibility' '/v' 'Sound on Activation' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Accessibility\SoundSentry' '/v' 'WindowsEffect' '/t' 'REG_SZ' '/d' '0' '/f' | Out-Null
+
+# --- Show More Details by Default on Transfers ---
+Write-Host "[AtlasOS tweak] Show More Details by Default on Transfers"
+# source: tweaks/qol/explorer/always-more-details-transfer.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\OperationStatusManager' '/v' 'EnthusiastMode' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Use Check Boxes to Select Items ---
+Write-Host "[AtlasOS tweak] Disable Use Check Boxes to Select Items"
+# source: tweaks/qol/explorer/disable-check-boxes.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'AutoCheckSelect' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Searching for Invalid Shortcuts ---
+Write-Host "[AtlasOS tweak] Disable Searching for Invalid Shortcuts"
+# source: tweaks/qol/explorer/disable-invalid-shortcuts-search.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'NoResolveSearch' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'NoResolveTrack' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Don't Show Office Files ---
+Write-Host "[AtlasOS tweak] Don't Show Office Files"
+# source: tweaks/qol/explorer/dont-show-office-files.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer' '/v' 'ShowCloudFilesInQuickAccess' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Enable Long Paths ---
+Write-Host "[AtlasOS tweak] Enable Long Paths"
+# source: tweaks/qol/explorer/enable-long-paths.yml
+& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\FileSystem' '/v' 'LongPathsEnabled' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Extend Icon Cache ---
+Write-Host "[AtlasOS tweak] Extend Icon Cache"
+# source: tweaks/qol/explorer/extend-cache.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer' '/v' 'Max Cached Icons' '/t' 'REG_SZ' '/d' '4096' '/f' | Out-Null
+
+# --- Always Show the Full Context Menu On Items ---
+Write-Host "[AtlasOS tweak] Always Show the Full Context Menu On Items"
+# source: tweaks/qol/explorer/full-context-on-more-than-15-items.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer' '/v' 'MultipleInvokePromptMinimum' '/t' 'REG_DWORD' '/d' '100' '/f' | Out-Null
+
+# --- Hide Recent Items ---
+Write-Host "[AtlasOS tweak] Hide Recent Items"
+# source: tweaks/qol/explorer/hide-frequently-used-items.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer' '/v' 'ShowFrequent' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer' '/v' 'ShowRecent' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'Start_TrackDocs' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'ClearRecentDocsOnExit' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'NoRecentDocsHistory' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Policies\Microsoft\Windows\Explorer' '/v' 'NoRemoteDestinations' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Minimize Mouse Hover Time for Item Info ---
+Write-Host "[AtlasOS tweak] Minimize Mouse Hover Time for Item Info"
+# source: tweaks/qol/explorer/minimize-mouse-hover-time.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop' '/v' 'MouseHoverTime' '/t' 'REG_SZ' '/d' '20' '/f' | Out-Null
+
+# --- Disable Internet File Association Service ---
+Write-Host "[AtlasOS tweak] Disable Internet File Association Service"
+# source: tweaks/qol/explorer/no-internet-open-with.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'NoInternetOpenWith' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Open File Explorer to This PC ---
+Write-Host "[AtlasOS tweak] Open File Explorer to This PC"
+# source: tweaks/qol/explorer/open-to-this-pc.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'LaunchTo' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Show Removable Drives Only in 'This PC' ---
+Write-Host "[AtlasOS tweak] Show Removable Drives Only in 'This PC'"
+# source: tweaks/qol/explorer/removable-drives-only-this-pc.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83' '/f' | Out-Null
+
+# --- Remove Previous Versions from Explorer ---
+Write-Host "[AtlasOS tweak] Remove Previous Versions from Explorer"
+# source: tweaks/qol/explorer/remove-previous-versions.yml
+# Fixed: source uses `operation: delete` on these two values - a previous import wrongly
+# translated that as "set to empty string" instead of actually deleting the value.
+& 'reg' 'delete' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer' '/v' 'NoPreviousVersionsPage' '/f' | Out-Null
+& 'reg' 'delete' 'HKLM\zNTUSER\SOFTWARE\Policies\Microsoft\PreviousVersions' '/v' 'DisableLocalPage' '/f' | Out-Null
+# The actual removal mechanism (the shell property-sheet/context-menu handlers) was never
+# imported at all - these are the HKCR keys resolved to their offline zSOFTWARE\Classes
+# equivalent (HKCR is a runtime merge of HKLM\SOFTWARE\Classes + HKCU\SOFTWARE\Classes;
+# these are machine-wide handler registrations, so they belong under zSOFTWARE\Classes).
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\AllFilesystemObjects\shellex\PropertySheetHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}' '/f' | Out-Null
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shellex\PropertySheetHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}' '/f' | Out-Null
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\Directory\shellex\PropertySheetHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}' '/f' | Out-Null
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\Drive\shellex\PropertySheetHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}' '/f' | Out-Null
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}' '/f' | Out-Null
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shellex\ContextMenuHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}' '/f' | Out-Null
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}' '/f' | Out-Null
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}' '/f' | Out-Null
+
+# =====================================================================================
+# Explorer context-menu tweaks ported from AtlasOS - previously skipped entirely because
+# they target HKEY_CLASSES_ROOT, which isn't a hive you can reg-load offline. Resolved
+# against the actual mounted hive: HKCR is the runtime merge of HKLM\SOFTWARE\Classes and
+# HKCU\SOFTWARE\Classes, so machine-wide registrations go under zSOFTWARE\Classes\...
+# "Merge as TrustedInstaller" (tweaks/qol/explorer/add-context-menus/merge-as-trustedinstaller.yml)
+# was NOT ported - it shells out to Atlas's own %windir%\AtlasModules\Scripts\RunAsTI.cmd,
+# which doesn't exist in this project.
+# =====================================================================================
+
+# --- Adds Batch Scripts to 'New' Context Menu ---
+Write-Host "[AtlasOS tweak] Adds Batch Scripts to 'New' Context Menu"
+# source: tweaks/qol/explorer/add-context-menus/new-bat.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\.bat\ShellNew' '/v' 'ItemName' '/t' 'REG_EXPAND_SZ' '/d' '%windir%\System32\acppage.dll,-6002' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\.bat\ShellNew' '/v' 'NullFile' '/t' 'REG_SZ' '/d' '""' '/f' | Out-Null
+
+# --- Add PowerShell Script to 'New' Context Menu ---
+Write-Host "[AtlasOS tweak] Add PowerShell Script to 'New' Context Menu"
+# source: tweaks/qol/explorer/add-context-menus/new-ps1.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\.ps1' '/ve' '/t' 'REG_SZ' '/d' 'Microsoft.PowerShellScript.1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\.ps1\ShellNew' '/v' 'NullFile' '/t' 'REG_SZ' '/d' '""' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\Microsoft.PowerShellScript.1' '/ve' '/t' 'REG_SZ' '/d' 'Windows PowerShell Script' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\Microsoft.PowerShellScript.1' '/v' 'FriendlyTypeName' '/t' 'REG_SZ' '/d' 'Windows PowerShell Script' '/f' | Out-Null
+
+# --- Add Registry Entries to 'New' Context Menu ---
+Write-Host "[AtlasOS tweak] Add Registry Entries to 'New' Context Menu"
+# source: tweaks/qol/explorer/add-context-menus/new-reg.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\.reg\ShellNew' '/v' 'NullFile' '/t' 'REG_SZ' '/d' '""' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\.reg\ShellNew' '/v' 'ItemName' '/t' 'REG_EXPAND_SZ' '/d' '%windir%\regedit.exe,-309' '/f' | Out-Null
+
+# --- Add Power Plan File Association ---
+Write-Host "[AtlasOS tweak] Add Power Plan File Association"
+# source: tweaks/qol/explorer/import-power-plan.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\powerscheme\DefaultIcon' '/ve' '/t' 'REG_SZ' '/d' '%windir%\System32\powercpl.dll,1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\powerscheme\Shell\open\command' '/ve' '/t' 'REG_SZ' '/d' 'powercfg /import "%1"' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\.pow' '/ve' '/t' 'REG_SZ' '/d' 'powerscheme' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\.pow' '/v' 'FriendlyTypeName' '/t' 'REG_SZ' '/d' 'Power Scheme' '/f' | Out-Null
+
+# --- Remove 'Include in Library' from Context Menu ---
+Write-Host "[AtlasOS tweak] Remove 'Include in Library' from Context Menu"
+# source: tweaks/qol/explorer/remove-context-menus/include-in-library.yml
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\Library Location' '/f' | Out-Null
+
+# --- Remove Bitmap Image from 'New' Context Menu ---
+Write-Host "[AtlasOS tweak] Remove Bitmap Image from 'New' Context Menu"
+# source: tweaks/qol/explorer/remove-context-menus/new-bitmap.yml
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\.bmp\ShellNew' '/f' | Out-Null
+
+# --- Remove Rich Text Document from 'New' Context Menu ---
+Write-Host "[AtlasOS tweak] Remove Rich Text Document from 'New' Context Menu"
+# source: tweaks/qol/explorer/remove-context-menus/new-rtf.yml
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\.rtf\ShellNew' '/f' | Out-Null
+
+# --- Remove 'Edit with Paint 3D' from Context Menu ---
+Write-Host "[AtlasOS tweak] Remove 'Edit with Paint 3D' from Context Menu"
+# source: tweaks/qol/explorer/remove-context-menus/paint-3D.yml
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.3mf\Shell\3D Edit' '/f' | Out-Null
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.bmp\Shell\3D Edit' '/f' | Out-Null
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.fbx\Shell\3D Edit' '/f' | Out-Null
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.gif\Shell\3D Edit' '/f' | Out-Null
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.jfif\Shell\3D Edit' '/f' | Out-Null
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.jpe\Shell\3D Edit' '/f' | Out-Null
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell\3D Edit' '/f' | Out-Null
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.jpg\Shell\3D Edit' '/f' | Out-Null
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.png\Shell\3D Edit' '/f' | Out-Null
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.tif\Shell\3D Edit' '/f' | Out-Null
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.tiff\Shell\3D Edit' '/f' | Out-Null
+
+# --- Remove 'Share' from Context Menu ---
+Write-Host "[AtlasOS tweak] Remove 'Share' from Context Menu"
+# source: tweaks/qol/explorer/remove-context-menus/share.yml
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\*\shellex\ContextMenuHandlers\ModernSharing' '/f' | Out-Null
+& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ModernSharing' '/f' | Out-Null
+
+# --- Show All Tasks in Control Panel (God Mode) ---
+Write-Host "[AtlasOS tweak] Show All Tasks in Control Panel (God Mode)"
+# source: tweaks/qol/show-all-tasks-control-panel.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\CLSID\{D15ED2E1-C75B-443c-BD7C-FC03B2F08C17}' '/ve' '/t' 'REG_SZ' '/d' 'All Tasks' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\CLSID\{D15ED2E1-C75B-443c-BD7C-FC03B2F08C17}' '/v' 'InfoTip' '/t' 'REG_SZ' '/d' 'View list of all Control Panel tasks' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\CLSID\{D15ED2E1-C75B-443c-BD7C-FC03B2F08C17}' '/v' 'System.ControlPanel.Category' '/t' 'REG_SZ' '/d' '5' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\CLSID\{D15ED2E1-C75B-443c-BD7C-FC03B2F08C17}\DefaultIcon' '/ve' '/t' 'REG_SZ' '/d' '%windir%\System32\imageres.dll,-27' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\CLSID\{D15ED2E1-C75B-443c-BD7C-FC03B2F08C17}\Shell\Open\Command' '/ve' '/t' 'REG_SZ' '/d' 'explorer.exe shell:::{ED7BA470-8E54-465E-825C-99712043E01C}' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{D15ED2E1-C75B-443c-BD7C-FC03B2F08C17}' '/ve' '/t' 'REG_SZ' '/d' 'All Tasks' '/f' | Out-Null
+
+# --- Remove Shortcut Text ---
+Write-Host "[AtlasOS tweak] Remove Shortcut Text"
+# source: tweaks/qol/explorer/remove-shortcut-text.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\NamingTemplates' '/v' 'ShortcutNameTemplate' '/t' 'REG_SZ' '/d' '"%s.lnk"' '/f' | Out-Null
+
+# --- Configure Explorer to Show All Files with File Extensions ---
+Write-Host "[AtlasOS tweak] Configure Explorer to Show All Files with File Extensions"
+# source: tweaks/qol/explorer/show-files.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'Hidden' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'HideFileExt' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Use Compact Mode ---
+Write-Host "[AtlasOS tweak] Use Compact Mode"
+# source: tweaks/qol/explorer/use-compact-mode.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'UseCompactMode' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Hide Disabled and Disconnected Devices in Sounds Panel ---
+Write-Host "[AtlasOS tweak] Hide Disabled and Disconnected Devices in Sounds Panel"
+# source: tweaks/qol/hide-disabled-disconnected-sounds.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Multimedia\Audio\DeviceCpl' '/v' 'ShowDisconnectedDevices' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Multimedia\Audio\DeviceCpl' '/v' 'ShowHiddenDevices' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable UAC Secure Desktop ---
+Write-Host "[AtlasOS tweak] Disable UAC Secure Desktop"
+# source: tweaks/qol/security/disable-uac-secure-desktop.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' '/v' 'PromptOnSecureDesktop' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Set Hidden Pages ---
+Write-Host "[AtlasOS tweak] Set Hidden Pages"
+# source: tweaks/qol/set-hidden-settings-pages.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'SettingsPageVisibility' '/t' 'REG_SZ' '/d' 'hide:recovery;maps;maps-downloadmaps;privacy;privacy-speechtyping;privacy-speech;privacy-feedback;privacy-activityhistory;search-permissions;privacy-general;sync;mobile-devices;mobile-devices-addphone;workplace;backup' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'SettingsPageVisibility' '/t' 'REG_SZ' '/d' 'hide:recovery;maps;maps-downloadmaps;privacy;privacy-feedback;privacy-activityhistory;search-permissions;privacy-general;sync;mobile-devices;mobile-devices-addphone;workplace;family-group;deviceusage;home' '/f' | Out-Null
+
+# --- Do Not Show Edge Tabs in Alt-Tab ---
+Write-Host "[AtlasOS tweak] Do Not Show Edge Tabs in Alt-Tab"
+# source: tweaks/qol/shell/alt-tab-open-windows.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'MultiTaskingAltTabFilter' '/t' 'REG_DWORD' '/d' '3' '/f' | Out-Null
+
+# --- Disable AutoRun ---
+Write-Host "[AtlasOS tweak] Disable AutoRun"
+# source: tweaks/qol/shell/config-autorun.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers' '/v' 'DisableAutoplay' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\CameraAlternate' '/v' 'MSTakeNoAction' '/t' 'REG_NONE' '/d' '""' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\StorageOnArrival' '/v' 'MSTakeNoAction' '/t' 'REG_NONE' '/d' '""' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\CameraAlternate\ShowPicturesOnArrival' '/v' 'MSTakeNoAction' '/t' 'REG_NONE' '/d' '""' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\StorageOnArrival' '/v' 'MSTakeNoAction' '/t' 'REG_NONE' '/d' '""' '/f' | Out-Null
+
+# --- Disable Aero Shake ---
+Write-Host "[AtlasOS tweak] Disable Aero Shake"
+# source: tweaks/qol/shell/disable-aero-shake.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'DisallowShaking' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Low Disk Space Checks ---
+Write-Host "[AtlasOS tweak] Disable Low Disk Space Checks"
+# source: tweaks/qol/shell/disable-low-disk-warning.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'NoLowDiskSpaceChecks' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Menu Hover Delay ---
+Write-Host "[AtlasOS tweak] Disable Menu Hover Delay"
+# source: tweaks/qol/shell/disable-menu-delay.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop' '/v' 'MenuShowDelay' '/t' 'REG_SZ' '/d' '0' '/f' | Out-Null
+
+# --- Disable Shared Experiences ---
+Write-Host "[AtlasOS tweak] Disable Shared Experiences"
+# source: tweaks/qol/shell/disable-nearby-sharing.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\CDP\SettingsPage' '/v' 'BluetoothLastDisabledNearShare' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\CDP' '/v' 'NearShareChannelUserAuthzPolicy' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\CDP' '/v' 'CdpSessionUserAuthzPolicy' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Network Location Wizard ---
+Write-Host "[AtlasOS tweak] Disable Network Location Wizard"
+# source: tweaks/qol/shell/disable-network-location-wizard.yml
+& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff' '/f' | Out-Null
+
+# --- Disable Recommendations in the Start Menu ---
+Write-Host "[AtlasOS tweak] Disable Recommendations in the Start Menu"
+# source: tweaks/qol/shell/no-recommendations-start-menu.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'Start_IrisRecommendations' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'Start_AccountNotifications' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Show More Pins in Start ---
+Write-Host "[AtlasOS tweak] Show More Pins in Start"
+# source: tweaks/qol/shell/show-more-pins.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'Start_Layout' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Decrease Shutdown Time ---
+Write-Host "[AtlasOS tweak] Decrease Shutdown Time"
+# source: tweaks/qol/startup-shutdown/decrease-shutdown-time.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop' '/v' 'HungAppTimeout' '/t' 'REG_SZ' '/d' '2000' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop' '/v' 'WaitToKillAppTimeOut' '/t' 'REG_SZ' '/d' '2000' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control' '/v' 'WaitToKillServiceTimeout' '/t' 'REG_SZ' '/d' '2000' '/f' | Out-Null
+
+# --- Disable Startup Delay ---
+Write-Host "[AtlasOS tweak] Disable Startup Delay"
+# source: tweaks/qol/startup-shutdown/disable-startup-delay.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Serialize' '/v' 'StartupDelayInMSec' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Enable verbose startup, shutdown, logon, and logoff status messages ---
+Write-Host "[AtlasOS tweak] Enable verbose startup, shutdown, logon, and logoff status messages"
+# source: tweaks/qol/startup-shutdown/enable-verbose-messages.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' '/v' 'verbosestatus' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Force Close Applications On Session End ---
+Write-Host "[AtlasOS tweak] Force Close Applications On Session End"
+# source: tweaks/qol/startup-shutdown/force-end-shutdown-apps.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop' '/v' 'AutoEndTasks' '/t' 'REG_SZ' '/d' '1' '/f' | Out-Null
+
+# --- Configure Crash Control ---
+Write-Host "[AtlasOS tweak] Configure Crash Control"
+# source: tweaks/qol/system/crash-control-qol.yml
+& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\CrashControl' '/v' 'AutoReboot' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\CrashControl' '/v' 'CrashDumpEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\CrashControl' '/v' 'LogEvent' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\CrashControl' '/v' 'DisplayParameters' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\CrashControl\StorageTelemetry' '/v' 'DeviceDumpEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable Windows Platform Binary Table Execution (WPBT) ---
+Write-Host "[AtlasOS tweak] Disable Windows Platform Binary Table Execution (WPBT)"
+# source: tweaks/qol/system/disable-wpbt.yml
+& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\Session Manager' '/v' 'DisableWpbtExecution' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Show Command Prompt on Win+X ---
+Write-Host "[AtlasOS tweak] Show Command Prompt on Win+X"
+# source: tweaks/qol/taskbar/cmd-win-x.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'DontUsePowerShellOnWinX' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Cloud Optimized Content on Taskbar ---
+Write-Host "[AtlasOS tweak] Disable Cloud Optimized Content on Taskbar"
+# source: tweaks/qol/taskbar/disable-cloud-optimized-content.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableCloudOptimizedContent' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Microsoft Copilot ---
+Write-Host "[AtlasOS tweak] Disable Microsoft Copilot"
+# source: tweaks/qol/taskbar/disable-copilot.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Policies\Microsoft\Windows\WindowsCopilot' '/v' 'TurnOffWindowsCopilot' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Show Desktop Peek on Taskbar ---
+Write-Host "[AtlasOS tweak] Disable Show Desktop Peek on Taskbar"
+# source: tweaks/qol/taskbar/disable-desktop-peek.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'DisablePreviewDesktop' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Never Use Tablet Mode ---
+Write-Host "[AtlasOS tweak] Never Use Tablet Mode"
+# source: tweaks/qol/taskbar/disable-tablet-mode.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ImmersiveShell' '/v' 'SignInMode' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Windows Chat ---
+Write-Host "[AtlasOS tweak] Disable Windows Chat"
+# source: tweaks/qol/taskbar/disable-windows-chat.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\Windows Chat' '/v' 'ChatIcon' '/t' 'REG_DWORD' '/d' '3' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'TaskbarMn' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Add 'End task' to the taskbar ---
+Write-Host "[AtlasOS tweak] Add 'End task' to the taskbar"
+# source: tweaks/qol/taskbar/end-task.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\TaskbarDeveloperSettings' '/v' 'TaskbarEndTask' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Hide 'Meet Now' on Taskbar ---
+Write-Host "[AtlasOS tweak] Hide 'Meet Now' on Taskbar"
+# source: tweaks/qol/taskbar/hide-meet-now.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'HideSCAMeetNow' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Task View on Taskbar ---
+Write-Host "[AtlasOS tweak] Disable Task View on Taskbar"
+# source: tweaks/qol/taskbar/hide-task-view.yml
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MultiTaskingView\AllUpView' '/v' 'Enabled' '/t' 'REG_SZ' '/d' '""' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'ShowTaskViewButton' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Set Taskbar to Align Left ---
+Write-Host "[AtlasOS tweak] Set Taskbar to Align Left"
+# source: tweaks/qol/taskbar/set-to-left.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'TaskbarAl' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Configure Visual Effects ---
+Write-Host "[AtlasOS tweak] Configure Visual Effects"
+# source: tweaks/qol/visual-effects.yml
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop' '/v' 'FontSmoothing' '/t' 'REG_SZ' '/d' '2' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop' '/v' 'UserPreferencesMask' '/t' 'REG_BINARY' '/d' '9012038010000000' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop' '/v' 'DragFullWindows' '/t' 'REG_SZ' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop\WindowMetrics' '/v' 'MinAnimate' '/t' 'REG_SZ' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'ListviewAlphaSelect' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'IconsOnly' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'TaskbarAnimations' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'ListviewShadow' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects' '/v' 'VisualFXSetting' '/t' 'REG_DWORD' '/d' '3' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\DWM' '/v' 'EnableAeroPeek' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\DWM' '/v' 'AlwaysHibernateThumbnails' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Disable WU Auto-Reboot ---
+Write-Host "[AtlasOS tweak] Disable WU Auto-Reboot"
+# source: tweaks/qol/windows-update/disable-auto-reboot.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' '/v' 'AUPowerManagement' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' '/v' 'NoAutoRebootWithLoggedOnUsers' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable Delivery Optimization ---
+Write-Host "[AtlasOS tweak] Disable Delivery Optimization"
+# source: tweaks/qol/windows-update/disable-delivery-optimization.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization' '/v' 'DODownloadMode' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+
+# --- Restrict Windows Insider ---
+Write-Host "[AtlasOS tweak] Restrict Windows Insider"
+# source: tweaks/qol/windows-update/disable-insider.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' '/v' 'ManagePreviewBuilds' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' '/v' 'ManagePreviewBuildsPolicyValue' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\PreviewBuilds' '/v' 'AllowBuildPreview' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\PreviewBuilds' '/v' 'EnableConfigFlighting' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\PreviewBuilds' '/v' 'EnableExperimentation' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\WindowsSelfHost\UI\Visibility' '/v' 'HideInsiderPage' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Disable MSRT telemetry ---
+Write-Host "[AtlasOS tweak] Disable MSRT telemetry"
+# source: tweaks/qol/windows-update/disable-msrt-telemetry.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\MRT' '/v' 'DontReportInfectionInformation' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\RemovalTools\MpGears' '/v' 'HeartbeatTrackingIndex' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\RemovalTools\MpGears' '/v' 'SpyNetReportingLocation' '/t' 'REG_MULTI_SZ' '/d' '""' '/f' | Out-Null
+
+# --- Disable WU Nagging ---
+Write-Host "[AtlasOS tweak] Disable WU Nagging"
+# source: tweaks/qol/windows-update/disable-nagging.yml
+& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' '/v' 'NoAUAsDefaultShutdownOption' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\WindowsUpdate\UX\Settings' '/v' 'HideMCTLink' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
+# --- Blocks Anonymous Enumeration of SAM Accounts ---
+Write-Host "[AtlasOS tweak] Blocks Anonymous Enumeration of SAM Accounts"
+# source: tweaks/security/block-anonymous-enum-sam.yml
+& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\Lsa' '/v' 'RestrictAnonymousSAM' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+
 ## Add first run key to disable OOBE on first boot
 #Write-Host "Adding First Run key to disable OOBE on first boot..."
 #& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'FirstRunCompleted' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
@@ -636,159 +1640,121 @@ Write-Host "Aligning the taskbar to the left..."
 #reg add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\Run" /v "FirstSetup" /t REG_SZ /d "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\Windows\Setup\Scripts\FirstLogon.ps1\"" /f
 #& 'reg' 'add' 'HKLM\zNTUSER\Microsoft\Windows\CurrentVersion\RunOnce' '/v' 'FirstSetup' '/t' 'REG_SZ' '/d' 'Powershell -ExecutionPolicy Bypass -File "%SystemRoot%\Windows\Setup\Scripts\winsetupcomplete.ps1"' '/f' | Out-Null
 
-## this function allows PowerShell to take ownership of the Scheduled Tasks registry key from TrustedInstaller. Based on Jose Espitia's script.
-function Enable-Privilege {
-    param(
-        [ValidateSet(
-            "SeAssignPrimaryTokenPrivilege", "SeAuditPrivilege", "SeBackupPrivilege",
-            "SeChangeNotifyPrivilege", "SeCreateGlobalPrivilege", "SeCreatePagefilePrivilege",
-            "SeCreatePermanentPrivilege", "SeCreateSymbolicLinkPrivilege", "SeCreateTokenPrivilege",
-            "SeDebugPrivilege", "SeEnableDelegationPrivilege", "SeImpersonatePrivilege", "SeIncreaseBasePriorityPrivilege",
-            "SeIncreaseQuotaPrivilege", "SeIncreaseWorkingSetPrivilege", "SeLoadDriverPrivilege",
-            "SeLockMemoryPrivilege", "SeMachineAccountPrivilege", "SeManageVolumePrivilege",
-            "SeProfileSingleProcessPrivilege", "SeRelabelPrivilege", "SeRemoteShutdownPrivilege",
-            "SeRestorePrivilege", "SeSecurityPrivilege", "SeShutdownPrivilege", "SeSyncAgentPrivilege",
-            "SeSystemEnvironmentPrivilege", "SeSystemProfilePrivilege", "SeSystemtimePrivilege",
-            "SeTakeOwnershipPrivilege", "SeTcbPrivilege", "SeTimeZonePrivilege", "SeTrustedCredManAccessPrivilege",
-            "SeUndockPrivilege", "SeUnsolicitedInputPrivilege")]
-        $Privilege,
-        ## The process on which to adjust the privilege. Defaults to the current process.
-        $ProcessId = $pid,
-        ## Switch to disable the privilege, rather than enable it.
-        [Switch] $Disable
-    )
-    $definition = @'
- using System;
- using System.Runtime.InteropServices;
-  
- public class AdjPriv
- {
-  [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
-  internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall,
-   ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen);
-  
-  [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
-  internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok);
-  [DllImport("advapi32.dll", SetLastError = true)]
-  internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid);
-  [StructLayout(LayoutKind.Sequential, Pack = 1)]
-  internal struct TokPriv1Luid
-  {
-   public int Count;
-   public long Luid;
-   public int Attr;
-  }
-  
-  internal const int SE_PRIVILEGE_ENABLED = 0x00000002;
-  internal const int SE_PRIVILEGE_DISABLED = 0x00000000;
-  internal const int TOKEN_QUERY = 0x00000008;
-  internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
-  public static bool EnablePrivilege(long processHandle, string privilege, bool disable)
-  {
-   bool retVal;
-   TokPriv1Luid tp;
-   IntPtr hproc = new IntPtr(processHandle);
-   IntPtr htok = IntPtr.Zero;
-   retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok);
-   tp.Count = 1;
-   tp.Luid = 0;
-   if(disable)
-   {
-    tp.Attr = SE_PRIVILEGE_DISABLED;
-   }
-   else
-   {
-    tp.Attr = SE_PRIVILEGE_ENABLED;
-   }
-   retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid);
-   retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
-   return retVal;
-  }
- }
-'@
-
-    $processHandle = (Get-Process -id $ProcessId).Handle
-    $type = Add-Type $definition -PassThru
-    $type[0]::EnablePrivilege($processHandle, $Privilege, $Disable)
+# Explorer\Advanced is TrustedInstaller-owned in both the DEFAULT and NTUSER stock hives, so
+# the "Disabling widgets in taskbar" tweak further down (which writes TaskbarDa under both)
+# would otherwise fail with "Access is denied" every single build.
+Write-Host "Taking ownership of Explorer Advanced settings..."
+if (Set-OfflineRegistryOwnership "zDEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced") {
+    Write-Host "Explorer Advanced (DEFAULT) ownership taken."
+}
+if (Set-OfflineRegistryOwnership "zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced") {
+    Write-Host "Explorer Advanced (NTUSER) ownership taken."
 }
 
-Enable-Privilege SeTakeOwnershipPrivilege
-
-# Take ownership of scheduled tasks registry key
-Write-Host "Taking ownership of scheduled tasks registry key..."
-$regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks", [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree, [System.Security.AccessControl.RegistryRights]::TakeOwnership)
-$regACL = $regKey.GetAccessControl()
-$regACL.SetOwner($adminGroup)
-$regKey.SetAccessControl($regACL)
-$regKey.Close()
-Write-Host "Owner changed to Administrators."
-$regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks", [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree, [System.Security.AccessControl.RegistryRights]::ChangePermissions)
-$regACL = $regKey.GetAccessControl()
-$regRule = New-Object System.Security.AccessControl.RegistryAccessRule ($adminGroup, "FullControl", "ContainerInherit", "None", "Allow")
-$regACL.SetAccessRule($regRule)
-$regKey.SetAccessControl($regACL)
-Write-Host "Permissions modified for Administrators group."
-Write-Host "Registry key permissions successfully updated."
-$regKey.Close()
-
-# Take ownership of Explorer Advanced settings
-Write-Host "Taking ownership of Explorer Advanced settings..."
-$regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced", [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree, [System.Security.AccessControl.RegistryRights]::TakeOwnership)
-$regACL = $regKey.GetAccessControl()
-$regACL.SetOwner($adminGroup)
-$regKey.SetAccessControl($regACL)
-$regKey.Close()
-Write-Host "Explorer Advanced owner changed to Administrators."
-$regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced", [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree, [System.Security.AccessControl.RegistryRights]::ChangePermissions)
-$regACL = $regKey.GetAccessControl()
-$regRule = New-Object System.Security.AccessControl.RegistryAccessRule ($adminGroup, "FullControl", "ContainerInherit", "None", "Allow")
-$regACL.SetAccessRule($regRule)
-$regKey.SetAccessControl($regACL)
-Write-Host "Explorer Advanced permissions modified for Administrators group."
-Write-Host "Explorer Advanced registry key permissions successfully updated."
-$regKey.Close()
+Write-Host "Disabling widgets in taskbar..."
+# Writing via the .NET handle directly (rather than a separate reg.exe process) rules out
+# any doubt about whether a freshly-spawned process picks up the ACL change we just made,
+# and surfaces a real exception message if this is still denied for some other reason.
+foreach ($advKeyPath in @(
+    "zDEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced",
+    "zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
+)) {
+    $advKey = $null
+    try {
+        # try/finally here is load-bearing: if SetValue throws, skipping Close() would leave
+        # this hive's file locked, which makes "reg unload" fail with Access Denied further
+        # down and can cascade into the DISM cleanup step failing outright afterward.
+        $advKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey($advKeyPath, $true)
+        $advKey.SetValue("TaskbarDa", 0, [Microsoft.Win32.RegistryValueKind]::DWord)
+    } catch {
+        Write-Warning "Failed to set TaskbarDa under HKLM\$advKeyPath : $($_.Exception.Message)"
+    } finally {
+        if ($advKey) { $advKey.Close() }
+    }
+}
 
 # Clean up settings menu
 #Write-Host "Cleaning up Settings menu..."
 #& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'SettingsPageVisibility' '/t' 'REG_SZ' '/d' 'hide:virus;mobile-devices;gaming;cortana;search;maps;yourinfo;workplace;backup;sync;findmydevice;developers;activation;deviceencryption' '/f' | Out-Null
 
-Write-Host "Disabling widgets in taskbar..."
-& 'reg' 'add' "HKLM\zDEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" '/v' "TaskbarDa" '/t' "REG_DWORD" '/d' "0" '/f' | Out-Null
-& 'reg' 'add' "HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" '/v' "TaskbarDa" '/t' "REG_DWORD" '/d' "0" '/f' | Out-Null
-
-# Delete scheduled tasks (with error suppression for missing keys)
-Write-Host 'Deleting Application Compatibility Appraiser...'
-& 'reg' 'delete' 'HKLM\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0600DD45-FAF2-4131-A006-0B17509B9F78}' '/f' 2>$null | Out-Null
-& 'reg' 'delete' 'HKLM\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A0C71CB8-E8F0-498A-901D-4EDA09E07FF4}' '/f' 2>$null | Out-Null
-Write-Host 'Deleting Customer Experience Improvement Program...'
-& 'reg' 'delete' 'HKLM\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4738DE7A-BCC1-4E2D-B1B0-CADB044BFA81}' '/f' 2>$null | Out-Null
-& 'reg' 'delete' 'HKLM\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6FAC31FA-4A85-4E64-BFD5-2154FF4594B3}' '/f' 2>$null | Out-Null
-& 'reg' 'delete' 'HKLM\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FC931F16-B50A-472E-B061-B6F79A71EF59}' '/f' 2>$null | Out-Null
-Write-Host 'Deleting Program Data Updater...' 
-& 'reg' 'delete' 'HKLM\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0671EB05-7D95-4153-A32B-1426B9FE61DB}' '/f' 2>$null | Out-Null
-Write-Host 'Deleting autochk proxy...'
-& 'reg' 'delete' 'HKLM\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{87BF85F4-2CE1-4160-96EA-52F554AA28A2}' '/f' 2>$null | Out-Null
-& 'reg' 'delete' 'HKLM\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8A9C643C-3D74-4099-B6BD-9C6D170898B1}' '/f' 2>$null | Out-Null
-Write-Host 'Deleting QueueReporting...'
-& 'reg' 'delete' 'HKLM\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E3176A65-4E44-4ED3-AA73-3283660ACB9C}' '/f' 2>$null | Out-Null
-& 'reg' 'delete' 'HKLM\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6FD85B93-7A13-4DCA-B793-1D7D18FEAC39}' '/f' 2>$null | Out-Null
-Write-Host "Deleting OneDrive Standalone Update Task..."
-& 'reg' 'delete' 'HKLM\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A69BA1DE-BF15-4BC1-9201-71BB77CA4FB6}' '/f' 2>$null | Out-Null
-& 'reg' 'delete' 'HKLM\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B8434E90-F460-45BE-AE61-969D68C85636}' '/f' 2>$null | Out-Null
-& 'reg' 'delete' 'HKLM\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CE45C6EF-7F33-4F57-B81E-9535B89EBC2B}' '/f' 2>$null | Out-Null
 Write-Host "Tweaking complete!"
 Write-Host "Unmounting Registry..."
-$regKey.Close()
 reg unload HKLM\zCOMPONENTS | Out-Null
-reg unload HKLM\zDRIVERS | Out-Null
 reg unload HKLM\zDEFAULT | Out-Null
 reg unload HKLM\zNTUSER | Out-Null
 reg unload HKLM\zSOFTWARE | Out-Null
 reg unload HKLM\zSYSTEM | Out-Null
+
 Write-Host "Cleaning up image..."
+# /ResetBase permanently deletes superseded package versions from the component store. This
+# means the OUTPUT of this build (install.wim/install.esd/the final ISO) can never be used as
+# a DISM/SFC repair source later - those files are gone from every copy of this build, not
+# just the one being repaired. Users needing to repair their installed system's component
+# store must use the ORIGINAL, untouched stock Windows ISO as /Source, not this tweaked one.
 dism.exe /Image:$ScratchDisk\scratchdir /Cleanup-Image /StartComponentCleanup /ResetBase
 Write-Host "Cleanup complete."
 Write-Host ' '
+
+# --- Build a local repair source for DISM RestoreHealth / SFC (self-healing without the
+# original ISO) ---
+# Ported from AtlasOS (src/playbook/Executables/AtlasModules/Scripts/packageInstall.ps1,
+# MakeRepairSource) - see https://learn.microsoft.com/windows-hardware/manufacture/desktop/configure-a-windows-repair-source
+# Hardlinks the post-cleanup WinSxS manifests (not the payload - manifests are small XML
+# files, so hardlinking costs ~0 extra disk space since they point at the same data already
+# in WinSxS) into %SystemRoot%\RepairSource\Manifests, then points the legacy CBS servicing
+# policy at it so DISM/SFC stop asking for install media. Must run AFTER ResetBase so the
+# manifest set matches what's actually still in WinSxS post-cleanup.
+Write-Host "Building local component-store repair source..."
+$repairSrcPath = "$ScratchDisk\scratchdir\Windows\RepairSource\Manifests"
+New-Item -ItemType Directory -Path $repairSrcPath -Force | Out-Null
+$repairManifests = Get-ChildItem "$ScratchDisk\scratchdir\Windows\WinSxS\Manifests" -File -Filter "*.manifest" -ErrorAction SilentlyContinue
+if ($repairManifests.Count -gt 0) {
+    Write-Host "Hard linking $($repairManifests.Count) manifests (this is silent-but-not-hung; progress every 2000 files)..."
+    $manifestCounter = 0
+    foreach ($manifest in $repairManifests) {
+        try {
+            # Creating a hard link needs WRITE_ATTRIBUTES on the source file (its link count
+            # gets bumped), which Administrators don't have on TrustedInstaller-owned WinSxS
+            # manifests - falls back to a real copy (read-only access is enough for that).
+            # Also: New-Item -ItemType HardLink's Win32Exception ignores -ErrorAction
+            # SilentlyContinue, so -ErrorAction Stop + try/catch is required to suppress it.
+            New-Item -ItemType HardLink -Path "$repairSrcPath\$($manifest.Name)" -Target $manifest.FullName -ErrorAction Stop | Out-Null
+        } catch {
+            Copy-Item -Path $manifest.FullName -Destination "$repairSrcPath\$($manifest.Name)" -Force -ErrorAction SilentlyContinue
+        }
+        $manifestCounter++
+        if ($manifestCounter % 2000 -eq 0) {
+            Write-Host "  ...$manifestCounter / $($repairManifests.Count) manifests linked"
+        }
+    }
+    reg load HKLM\zSOFTWARE $ScratchDisk\scratchdir\Windows\System32\config\SOFTWARE | Out-Null
+    & 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Servicing' '/v' 'LocalSourcePath' '/t' 'REG_EXPAND_SZ' '/d' '%SystemRoot%\RepairSource' '/f' | Out-Null
+    reg unload HKLM\zSOFTWARE | Out-Null
+    Write-Host "Repair source created with $($repairManifests.Count) manifests."
+} else {
+    Write-Warning "No WinSxS manifests found - skipping repair source creation."
+}
+
+# Verify the component store isn't corrupt before we capture it.
+# Note: /AnalyzeComponentStore only works against the *running* OS (online), not an
+# offline-mounted image, so it can't gate this step - it just reports store size/cleanup
+# recommendations, not a healthy/unhealthy verdict. /ScanHealth is the offline-capable
+# corruption check and is what actually has a pass/fail result worth aborting the build on.
+# 'Repairable' is allowed through on purpose - we don't attempt an offline repair (the only
+# source available is this same image, which can't fix genuine corruption in itself), and the
+# local repair source built above means the SHIPPED install can still self-heal via DISM/SFC
+# once it's running online (with access to Windows Update or install media as a real source).
+# Only 'NonRepairable' aborts the build, since at that point nothing - not even the shipped
+# install - would be able to fix it later either.
+Write-Host "Verifying component store health before capture..."
+$healthCheck = Repair-WindowsImage -Path $ScratchDisk\scratchdir -ScanHealth
+if ($healthCheck.ImageHealthState -eq 'NonRepairable') {
+    Write-Error "Component store health check failed (state: NonRepairable). Aborting build - image was NOT captured."
+    Dismount-WindowsImage -Path $ScratchDisk\scratchdir -Discard | Out-Null
+    exit 1
+}
+Write-Host "Component store health: $($healthCheck.ImageHealthState)."
+
 Write-Host "Unmounting image..."
 Dismount-WindowsImage -Path $ScratchDisk\scratchdir -Save
 Write-Host "Exporting image..."
@@ -830,13 +1796,13 @@ Write-Host "Bypassing system requirements(on the setup image)..."
 & 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassStorageCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
 & 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassTPMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
 & 'reg' 'add' 'HKLM\zSYSTEM\Setup\MoSetup' '/v' 'AllowUpgradesWithUnsupportedTPMOrCPU' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+if ($IgnoreSecBoot) {
+    & 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'IgnoreSecBootBootRes' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+}
 Write-Host "Tweaking complete! Unmounting Registry..."
-$regKey.Close()
 reg unload HKLM\zCOMPONENTS | Out-Null
-reg unload HKLM\zDRIVERS | Out-Null
 reg unload HKLM\zDEFAULT | Out-Null
 reg unload HKLM\zNTUSER | Out-Null
-$regKey.Close()
 reg unload HKLM\zSOFTWARE | Out-Null
 reg unload HKLM\zSYSTEM | Out-Null
 if ($replaceBranding -and (Test-Path $brandingBootRes)) {
@@ -1096,7 +2062,7 @@ if ($null -ne $WinSDKPath) {
     $WinSDKPath = $WinSDKPath.TrimEnd('\')
     $ADKDepTools = "$WinSDKPath\Assessment and Deployment Kit\Deployment Tools\$hostarchitecture\Oscdimg"
 }
-$localOSCDIMGPath = "$PSScriptRoot\oscdimg.exe"
+$localOSCDIMGPath = "$PSScriptRoot\includes\utils\oscdimg.exe"
 
 if ((Test-Path variable:ADKDepTools) -and (Test-Path "$ADKDepTools\oscdimg.exe" -PathType leaf)) {
     Write-Host "Will be using oscdimg.exe from system ADK."
@@ -1130,6 +2096,25 @@ else {
 
 # Finishing up
 Write-Host "Creation completed! Performing Cleanup..."
+
+# Safety net: the hives/wim mount should already be unloaded/dismounted by the tweak steps
+# above, but if any of those were skipped or failed silently, an unloaded hive or a still-
+# mounted scratchdir will make the Remove-Item calls below fail (files in use) and leave
+# the image mounted for the next run. No-ops if everything is already clean.
+Write-Host "Verifying registry hives are unloaded..."
+foreach ($hive in @('zCOMPONENTS', 'zDEFAULT', 'zNTUSER', 'zSOFTWARE', 'zSYSTEM')) {
+    if (Test-Path "Registry::HKEY_LOCAL_MACHINE\$hive") {
+        Write-Host "  $hive still loaded - unloading."
+        reg unload "HKLM\$hive" | Out-Null
+    }
+}
+Write-Host "Verifying scratch image is unmounted..."
+if (Get-WindowsImage -Mounted -ErrorAction SilentlyContinue | Where-Object { $_.Path -eq "$ScratchDisk\scratchdir" }) {
+    Write-Host "  Scratch image still mounted - discarding and dismounting."
+    Dismount-WindowsImage -Path "$ScratchDisk\scratchdir" -Discard -ErrorAction SilentlyContinue | Out-Null
+}
+dism.exe /cleanup-mountpoints | Out-Null
+
 Remove-Item -Path "$ScratchDisk\tiny11" -Recurse -Force | Out-Null
 Remove-Item -Path "$ScratchDisk\scratchdir" -Recurse -Force | Out-Null