# Enable debugging
#Set-PSDebug -Trace 1

param (
    [ValidatePattern('^[c-zC-Z]:?$|^[a-zA-Z]:\\.*$')]
    [string]$ScratchDisk,
    [string]$windowsisopath,
    [string]$imageindex,
    [switch]$UseSetupTemplate,
    [switch]$IgnoreSecBoot
)

if (-not $ScratchDisk) {
    $ScratchDisk = Join-Path $PSScriptRoot 'working'  # Set to './working' in the script's directory
}
else {
    if ($ScratchDisk -match '^[a-zA-Z]:?$') {
        $ScratchDisk = $ScratchDisk[0] + ':'
    }
}

Write-Output "Scratch disk set to $ScratchDisk"

# Normalize windowsisopath: accept D, D:, D:\ all as drive letter D:
if ($windowsisopath -match '^[a-zA-Z]:?\\?$') {
    $windowsisopath = $windowsisopath[0] + ':'
}

# Check if PowerShell execution is Restricted or AllSigned or Undefined
$needchange = @("AllSigned", "Restricted", "Undefined")
$curpolicy = Get-ExecutionPolicy
if ($curpolicy -in $needchange) {
    Write-Host "Your current PowerShell Execution Policy is set to $curpolicy, which prevents scripts from running. Do you want to change it to RemoteSigned? (yes/no)"
    $response = Read-Host
    if ($response -eq 'yes') {
        Set-ExecutionPolicy RemoteSigned -Scope Process -Confirm:$false
    }
    else {
        Write-Host "The script cannot be run without changing the execution policy. Exiting..."
        exit
    }
}

# Check and run the script as admin if required
$adminSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
$adminGroup = $adminSID.Translate([System.Security.Principal.NTAccount])
$myWindowsID = [System.Security.Principal.WindowsIdentity]::GetCurrent()
$myWindowsPrincipal = new-object System.Security.Principal.WindowsPrincipal($myWindowsID)
$adminRole = [System.Security.Principal.WindowsBuiltInRole]::Administrator
if (! $myWindowsPrincipal.IsInRole($adminRole)) {
    Write-Host "Restarting Tiny11 image creator as admin in a new window, you can close this one."
    $newProcess = new-object System.Diagnostics.ProcessStartInfo "PowerShell";
    $argString = "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`""
    # Add additional parameters if they are set
    if ($windowsisopath) {
        $argString += " -windowsisopath `"$windowsisopath`""
    }
    if ($imageindex) {
        $argString += " -imageindex `"$imageindex`""
    }
    if ($UseSetupTemplate) { $argString += " -UseSetupTemplate" }
    $newProcess.Arguments = $argString;
    $newProcess.Verb = "runas";
    [System.Diagnostics.Process]::Start($newProcess);
    exit
}

# Start the transcript and prepare the window
Start-Transcript -Path "$ScratchDisk\tiny11.log" 

$Host.UI.RawUI.WindowTitle = "Tiny11 image creator"
Clear-Host

$hostArchitecture = $Env:PROCESSOR_ARCHITECTURE
$setupMediaTemplatePath = "$PSScriptRoot\setup-media-template"
New-Item -ItemType Directory -Force -Path "$ScratchDisk\tiny11\sources" | Out-Null

# -- Direct file input: auto-mount ISO or extract WIM/ESD --
$mountedISO     = $null    # path of ISO we mounted (for cleanup)
$sourceFromFile = $false   # true when scratch dir populated directly from WIM/ESD

if ($windowsisopath -and $windowsisopath -notmatch '^[c-zC-Z]:$') {
    $ext = [System.IO.Path]::GetExtension($windowsisopath).ToLower()

    if ($ext -eq '.iso') {
        Write-Host "ISO file provided  -  mounting: $windowsisopath"
        $resolvedIso = (Resolve-Path $windowsisopath).Path
        $mountResult = Mount-DiskImage -ImagePath $resolvedIso -PassThru -ErrorAction Stop
        $mountedISO  = $resolvedIso
        $windowsisopath = ($mountResult | Get-Volume).DriveLetter + ":"
        Write-Host "ISO mounted at $windowsisopath"
    }
    elseif ($ext -in @('.wim', '.esd')) {
        $sourceFile = (Resolve-Path $windowsisopath).Path
        Write-Host "Direct WIM/ESD source: $sourceFile"

        $allIndexes = Get-WindowsImage -ImagePath $sourceFile
        Write-Host "Indexes in source file:"
        $allIndexes | ForEach-Object { Write-Host "  [$($_.ImageIndex)] $($_.ImageName)" }

        if ($allIndexes.Count -ge 4) {
            # WOR-format ESD: idx 1 = setup structure, 2 = WinPE, 3 = Setup, 4+ = OS editions
            Write-Host "Full ESD with setup structure detected."

            if (-not $UseSetupTemplate) {
                Write-Host "Extracting setup media structure (index 1)..."
                Expand-WindowsImage -ImagePath $sourceFile -Index 1 -ApplyPath "$ScratchDisk\tiny11\" -ErrorAction Stop

                $bootWimDest = "$ScratchDisk\tiny11\sources\boot.wim"
                if (Test-Path $bootWimDest) { Remove-Item $bootWimDest -Force }

                Write-Host "Building boot.wim (PE index 2 + Setup index 3)..."
                & dism /English /Export-Image "/SourceImageFile:$sourceFile" "/SourceIndex:2" `
                    "/DestinationImageFile:$bootWimDest" /Compress:max /CheckIntegrity | Out-Null
                & dism /English /Export-Image "/SourceImageFile:$sourceFile" "/SourceIndex:3" `
                    "/DestinationImageFile:$bootWimDest" /Compress:max /CheckIntegrity | Out-Null
            }

            if ($imageindex) {
                $installSrcIndex = [int]$imageindex
            } else {
                $installSrcIndex = ($allIndexes | Where-Object { $_.ImageName -match 'Windows 1[01] Pro$' } |
                                    Select-Object -First 1).ImageIndex
                if (-not $installSrcIndex) { $installSrcIndex = $allIndexes[-1].ImageIndex }
                $editionName = ($allIndexes | Where-Object { $_.ImageIndex -eq $installSrcIndex }).ImageName
                Write-Host "Using install image index $installSrcIndex ($editionName)"
            }

            Write-Host "Extracting install image to sources\install.wim..."
            Export-WindowsImage -SourceImagePath $sourceFile -SourceIndex $installSrcIndex `
                -DestinationImagePath "$ScratchDisk\tiny11\sources\install.wim" -CompressionType None -ErrorAction Stop

            $index              = 1
            $indexAlreadySelected = $true
            $sourceFromFile     = $true
            Write-Host "Source extraction complete."
        }
        else {
            # Install-only WIM/ESD  -  no boot structure
            Write-Host "Install-only source (no setup structure). Copying to scratch..."
            if ($ext -eq '.esd') {
                Copy-Item $sourceFile "$ScratchDisk\tiny11\sources\install.esd" -Force
                Set-ItemProperty "$ScratchDisk\tiny11\sources\install.esd" -Name IsReadOnly -Value $false -ErrorAction SilentlyContinue
            } else {
                Copy-Item $sourceFile "$ScratchDisk\tiny11\sources\install.wim" -Force
                & takeown "/F" "$ScratchDisk\tiny11\sources\install.wim" | Out-Null
                & icacls "$ScratchDisk\tiny11\sources\install.wim" "/grant" "$($adminGroup.Value):(F)" | Out-Null
                try { Set-ItemProperty "$ScratchDisk\tiny11\sources\install.wim" -Name IsReadOnly -Value $false -ErrorAction Stop } catch {}
            }
            $sourceFromFile = $true
            Write-Warning "No boot structure found. ISO creation will fail without etfsboot.com and efisys.bin."
            Write-Warning "Use a full WOR-format ESD for a complete bootable image."
        }
    }
}

# -- Drive letter input (existing path) --
if (-not $sourceFromFile) {
    if ($windowsisopath -match '^[c-zC-Z]:$') {
        write-host "windows iso path: $windowsisopath"
        $DriveLetter = $windowsisopath
    }
    else {
        do {
            $DriveLetter = Read-Host "Please enter the drive letter for the Windows 11 image, e.g. D:"
            if ($DriveLetter -match '^[c-zC-Z]$') {
                $DriveLetter = "$DriveLetter`:"  # Ensure proper format
                Write-Output "Drive letter set to $DriveLetter"
            }
            else {
                Write-Output "Invalid drive letter. Please enter a letter between C and Z."
            }
        } while ($DriveLetter -notmatch '^[c-zC-Z]:$')  # Continue until valid
    }

    if ((-not $UseSetupTemplate -and (Test-Path "$DriveLetter\sources\boot.wim") -eq $false) -or (Test-Path "$DriveLetter\sources\install.wim") -eq $false) {
        if ((Test-Path "$DriveLetter\sources\install.esd") -eq $true) {
            Write-Host "Found install.esd, converting to install.wim..."

            # Use provided imageindex parameter or ask user
            if ($imageindex) {
                $esdIndex = $imageindex
                Write-Host "Using provided image index: $esdIndex"
            }
            else {
                Get-WindowsImage -ImagePath $DriveLetter\sources\install.esd
                $esdIndex = Read-Host "Please enter the image index"
            }

            Write-Host ' '
            Write-Host 'Converting install.esd to install.wim. This may take a while...'
            Export-WindowsImage -SourceImagePath $DriveLetter\sources\install.esd -SourceIndex $esdIndex -DestinationImagePath $ScratchDisk\tiny11\sources\install.wim -Compressiontype Maximum -CheckIntegrity

            # After ESD conversion, the selected image becomes index 1 in the new WIM
            $index = 1
            $indexAlreadySelected = $true
            Write-Host "ESD image index $esdIndex has been converted and is now index 1 in the WIM file."
        }
        else {
            Write-Host "Can't find Windows OS Installation files in the specified Drive Letter.."
            Write-Host "Please enter the correct DVD Drive Letter.."
            exit
        }
    }

    if ($UseSetupTemplate) {
        if (-not $indexAlreadySelected) {
            Write-Host "Template mode: copying install.wim from source..."
            Copy-Item -Path "$DriveLetter\sources\install.wim" -Destination "$ScratchDisk\tiny11\sources\install.wim" -Force | Out-Null
        }
    } else {
        Write-Host "Copying Windows image..."
        Copy-Item -Path "$DriveLetter\*" -Destination "$ScratchDisk\tiny11" -Recurse -Force | Out-Null
        Set-ItemProperty -Path "$ScratchDisk\tiny11\sources\install.esd" -Name IsReadOnly -Value $false > $null 2>&1
        Remove-Item "$ScratchDisk\tiny11\sources\install.esd" > $null 2>&1
        Write-Host "Copy complete!"
        Start-Sleep -Seconds 2
        Clear-Host
    }
}

# -- Template mode: copy setup media base --
if ($UseSetupTemplate) {
    if (-not (Test-Path "$setupMediaTemplatePath")) {
        Write-Error "setup-media-template folder not found: $setupMediaTemplatePath"
        exit 1
    }
    Write-Host "Copying setup media template to scratch..."
    Copy-Item -Path "$setupMediaTemplatePath\*" -Destination "$ScratchDisk\tiny11" -Recurse -Force | Out-Null
    Write-Host "Template copy complete."
}

# Only ask for image index if we haven't already selected one during ESD conversion
if ($indexAlreadySelected) {
    Write-Host "Using converted image at index: $index"
}
elseif ($imageindex) {
    $index = $imageindex
    Write-Host "Using provided image index: $index"
}
else {
    Write-Host "Getting image information..."
    Get-WindowsImage -ImagePath $ScratchDisk\tiny11\sources\install.wim
    $index = Read-Host "Please enter the image index : "
    $ImagesIndex = (Get-WindowsImage -ImagePath $ScratchDisk\tiny11\sources\install.wim).ImageIndex
    while ($ImagesIndex -notcontains $index) {
        $index = Read-Host "Please enter a valide image index : "
    }
}
Write-Host "Mounting Windows image. This may take a while."
$wimFilePath = "$ScratchDisk\tiny11\sources\install.wim"
& takeown "/F" $wimFilePath 
& icacls $wimFilePath "/grant" "$($adminGroup.Value):(F)"
try {
    Set-ItemProperty -Path $wimFilePath -Name IsReadOnly -Value $false -ErrorAction Stop
}
catch {
    # This block will catch the error and suppress it.
}
New-Item -ItemType Directory -Force -Path "$ScratchDisk\scratchdir" > $null
Mount-WindowsImage -ImagePath $wimFilePath -Index $index -Path $ScratchDisk\scratchdir

# Powershell dism module does not have direct equivalent for /Get-Intl
$imageIntl = & dism /English /Get-Intl "/Image:$($ScratchDisk)\scratchdir"
$languageLine = $imageIntl -split '\n' | Where-Object { $_ -match 'Default system UI language : ([a-zA-Z]{2}-[a-zA-Z]{2})' }

if ($languageLine) {
    $languageCode = $Matches[1]
    Write-Host "Default system UI language code: $languageCode"
}
else {
    Write-Host "Default system UI language code not found."
}

# Defined in (Microsoft.Dism.Commands.ImageInfoObject).Architecture formatting script
# 0 -> x86, 5 -> arm(currently unused), 6 -> ia64(currently unused), 9 -> x64, 12 -> arm64
switch ((Get-WindowsImage -ImagePath $wimFilePath -Index $index).Architecture) {
    0 { $architecture = "x86" }
    9 { $architecture = "amd64" }
    12 { $architecture = "arm64" }
}

if ($architecture) {
    Write-Host "Architecture: $architecture"
}
else {
    Write-Host "Architecture information not found."
}

Write-Host "Mounting complete! Performing removal of applications..."

# Remove APPX packages from the mounted Windows image
$packages = Get-ProvisionedAppxPackage -Path "$ScratchDisk\scratchdir" |
ForEach-Object {
    $_.PackageName
}
$packagePrefixes = @(
    'Clipchamp.Clipchamp_',
    'Microsoft.BingNews_',
    'Microsoft.BingSearch_',
    'Microsoft.BingWeather_',
    'Microsoft.MicrosoftEdge.Stable_',
    'Microsoft.GamingApp_', 
    'Microsoft.Getstarted_',
    'Microsoft.MicrosoftOfficeHub_',
    'Microsoft.MicrosoftSolitaireCollection_',
    'Microsoft.OutlookForWindows_',
    'Microsoft.People_',
    'Microsoft.PowerAutomateDesktop_',
    'Microsoft.Todos_',
    'Microsoft.Windows.DevHome_',
    'Microsoft.WindowsAlarms_',
    'microsoft.windowscommunicationsapps_',
    'Microsoft.WindowsFeedbackHub_',
    'Microsoft.WindowsMaps_',
    'Microsoft.WindowsSoundRecorder_',
    'Microsoft.ZuneMusic_',
    'Microsoft.ZuneVideo_',
    'Microsoft.Xbox.TCUI_', 
    'Microsoft.XboxGamingOverlay_', 
    'Microsoft.XboxGameOverlay_', 
    'Microsoft.XboxSpeechToTextOverlay_', 
    'MicrosoftCorporationII.MicrosoftFamily_',
    'MicrosoftTeams_',
    'MSTeams_',
    'Microsoft.549981C3F5F10_',
    'Microsoft.Copilot_',
    'Microsoft.MSPaint_',
    'Microsoft.Paint_',
    'Microsoft.YourPhone_',
    'Microsoft.WindowsCalculator_',
    'Microsoft.WindowsCamera_',
    'Microsoft.MicrosoftStickyNotes_',
    'Microsoft.ScreenSketch_',
    'MicrosoftWindows.Client.WebExperience_',
    'MicrosoftWindows.CrossDevice_',
    'Microsoft.GetHelp',
    'Microsoft.StorePurchaseApp',
    'MicrosoftCorporationII.QuickAssist',
    'Microsoft.XboxIdentityProvider'
)
$packagesToRemove = foreach ($pkg in $packages) {
    if ($packagePrefixes | Where-Object { $pkg -like "$_*" }) {
        $pkg
    }
}
foreach ($package in $packagesToRemove) {
    Write-Host "Removing APPX $package..."
    Remove-AppxProvisionedPackage -Path "$ScratchDisk\scratchdir" -PackageName "$package" | Out-Null
}

# Remove Capabilities from the mounted Windows image
$capabilityPrefixes = @(
    'Browser.InternetExplorer',
    'Microsoft.Windows.PowerShell.ISE',
    'Microsoft.Wallpapers.Extended',
    'OneCoreUAP.OneSync'
)
$installedCapabilities = Get-WindowsCapability -Path "$ScratchDisk\scratchdir" | Where-Object { $_.State -eq 'Installed' }
foreach ($prefix in $capabilityPrefixes) {
    $capabilitiesMatches = $installedCapabilities | Where-Object { $_.Name -like "$prefix*" }
    foreach ($capability in $capabilitiesMatches) {
        Write-Host "Removing capability $($capability.Name)..."
        Remove-WindowsCapability -Path "$ScratchDisk\scratchdir" -Name $capability.Name -ErrorAction SilentlyContinue | Out-Null
    }
}

# Remove features from the mounted Windows image
$featuresToRemove = @(
    'WCF-Services45',
    'WCF-TCP-PortSharing45',
    'WorkFolders-Client'
)
foreach ($feature in $featuresToRemove) {
    Write-Host "Removing feature $feature..."
    Disable-WindowsOptionalFeature -Path "$ScratchDisk\scratchdir" -FeatureName $feature -Remove -NoRestart -ErrorAction SilentlyContinue | Out-Null
}

# Remove Microsoft Edge from the mounted Windows image
Write-Host "Removing Edge..."
# Remove Edge directories
Write-Host "Removing Edge directories..."
if (Test-Path "$ScratchDisk\scratchdir\Program Files (x86)\Microsoft\Edge") {
    & 'takeown' '/f' "$ScratchDisk\scratchdir\Program Files (x86)\Microsoft\Edge" '/r' '/d' 'y' | Out-Null
    & 'icacls' "$ScratchDisk\scratchdir\Program Files (x86)\Microsoft\Edge" '/grant' "$($adminGroup.Value):(F)" '/T' '/C' | Out-Null
    Remove-Item -Path "$ScratchDisk\scratchdir\Program Files (x86)\Microsoft\Edge" -Recurse -Force -ErrorAction SilentlyContinue | Out-Null
}

if (Test-Path "$ScratchDisk\scratchdir\Program Files (x86)\Microsoft\EdgeUpdate") {
    & 'takeown' '/f' "$ScratchDisk\scratchdir\Program Files (x86)\Microsoft\EdgeUpdate" '/r' '/d' 'y' | Out-Null
    & 'icacls' "$ScratchDisk\scratchdir\Program Files (x86)\Microsoft\EdgeUpdate" '/grant' "$($adminGroup.Value):(F)" '/T' '/C' | Out-Null
    Remove-Item -Path "$ScratchDisk\scratchdir\Program Files (x86)\Microsoft\EdgeUpdate" -Recurse -Force -ErrorAction SilentlyContinue | Out-Null
}

if (Test-Path "$ScratchDisk\scratchdir\Program Files (x86)\Microsoft\EdgeCore") {
    & 'takeown' '/f' "$ScratchDisk\scratchdir\Program Files (x86)\Microsoft\EdgeCore" '/r' '/d' 'y' | Out-Null
    & 'icacls' "$ScratchDisk\scratchdir\Program Files (x86)\Microsoft\EdgeCore" '/grant' "$($adminGroup.Value):(F)" '/T' '/C' | Out-Null
    Remove-Item -Path "$ScratchDisk\scratchdir\Program Files (x86)\Microsoft\EdgeCore" -Recurse -Force -ErrorAction SilentlyContinue | Out-Null
}

# Also check for Edge in Program Files (some installations)
if (Test-Path "$ScratchDisk\scratchdir\Program Files\Microsoft\Edge") {
    & 'takeown' '/f' "$ScratchDisk\scratchdir\Program Files\Microsoft\Edge" '/r' '/d' 'y' | Out-Null
    & 'icacls' "$ScratchDisk\scratchdir\Program Files\Microsoft\Edge" '/grant' "$($adminGroup.Value):(F)" '/T' '/C' | Out-Null
    Remove-Item -Path "$ScratchDisk\scratchdir\Program Files\Microsoft\Edge" -Recurse -Force -ErrorAction SilentlyContinue | Out-Null
}

if (Test-Path "$ScratchDisk\scratchdir\Program Files\Microsoft\EdgeUpdate") {
    & 'takeown' '/f' "$ScratchDisk\scratchdir\Program Files\Microsoft\EdgeUpdate" '/r' '/d' 'y' | Out-Null
    & 'icacls' "$ScratchDisk\scratchdir\Program Files\Microsoft\EdgeUpdate" '/grant' "$($adminGroup.Value):(F)" '/T' '/C' | Out-Null
    Remove-Item -Path "$ScratchDisk\scratchdir\Program Files\Microsoft\EdgeUpdate" -Recurse -Force -ErrorAction SilentlyContinue | Out-Null
}

# The line below is commented out as some apps require the webview2 component, so removing it could break certain applications.
# Remove architecture-specific Edge WebView components
#if ($architecture -eq 'amd64') {
#    $folderPath = Get-ChildItem -Path "$ScratchDisk\scratchdir\Windows\WinSxS" -Filter "amd64_microsoft-edge-webview_31bf3856ad364e35*" -Directory -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName
#
#    if ($folderPath) {
#        foreach ($folder in $folderPath) {
#            if (Test-Path $folder) {
#                & 'takeown' '/f' $folder '/r' '/d' 'y' | Out-Null
#                & 'icacls' $folder '/grant' "$($adminGroup.Value):(F)" '/T' '/C' | Out-Null
#                Remove-Item -Path $folder -Recurse -Force -ErrorAction SilentlyContinue | Out-Null
#            }
#        }
#    }
#    else {
#        Write-Host "AMD64 Edge WebView folder not found."
#    }
#}
#elseif ($architecture -eq 'arm64') {
#    $folderPath = Get-ChildItem -Path "$ScratchDisk\scratchdir\Windows\WinSxS" -Filter "arm64_microsoft-edge-webview_31bf3856ad364e35*" -Directory -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName
#
#    if ($folderPath) {
#        foreach ($folder in $folderPath) {
#            if (Test-Path $folder) {
#                & 'takeown' '/f' $folder '/r' '/d' 'y' | Out-Null
#                & 'icacls' $folder '/grant' "$($adminGroup.Value):(F)" '/T' '/C' | Out-Null
#                Remove-Item -Path $folder -Recurse -Force -ErrorAction SilentlyContinue | Out-Null
#            }
#        }
#    }
#    else {
#        Write-Host "ARM64 Edge WebView folder not found."
#    }
#}
#else {
#    Write-Host "Unknown architecture: $architecture"
#}

# Remove Microsoft Edge WebView directory
#if (Test-Path "$ScratchDisk\scratchdir\Windows\System32\Microsoft-Edge-Webview") {
#    & 'takeown' '/f' "$ScratchDisk\scratchdir\Windows\System32\Microsoft-Edge-Webview" '/r' '/d' 'y' | Out-Null
#    & 'icacls' "$ScratchDisk\scratchdir\Windows\System32\Microsoft-Edge-Webview" '/grant' "$($adminGroup.Value):(F)" '/T' '/C' | Out-Null
#    Remove-Item -Path "$ScratchDisk\scratchdir\Windows\System32\Microsoft-Edge-Webview" -Recurse -Force -ErrorAction SilentlyContinue | Out-Null
#}

Write-Host "Removing OneDrive..."
# Remove OneDrive setup file
if (Test-Path "$ScratchDisk\scratchdir\Windows\System32\OneDriveSetup.exe") {
    & 'takeown' '/f' "$ScratchDisk\scratchdir\Windows\System32\OneDriveSetup.exe" | Out-Null
    & 'icacls' "$ScratchDisk\scratchdir\Windows\System32\OneDriveSetup.exe" '/grant' "$($adminGroup.Value):(F)" '/C' | Out-Null
    Remove-Item -Path "$ScratchDisk\scratchdir\Windows\System32\OneDriveSetup.exe" -Force -ErrorAction SilentlyContinue | Out-Null
}

if (Test-Path "$ScratchDisk\scratchdir\Windows\SysWOW64\OneDriveSetup.exe") {
    & 'takeown' '/f' "$ScratchDisk\scratchdir\Windows\SysWOW64\OneDriveSetup.exe" | Out-Null
    & 'icacls' "$ScratchDisk\scratchdir\Windows\SysWOW64\OneDriveSetup.exe" '/grant' "$($adminGroup.Value):(F)" '/C' | Out-Null
    Remove-Item -Path "$ScratchDisk\scratchdir\Windows\SysWOW64\OneDriveSetup.exe" -Force -ErrorAction SilentlyContinue | Out-Null
}

Write-Host "Removal complete!"
Start-Sleep -Seconds 2

$replaceBranding = $true # Set to $false to skip branding replacement
if ($replaceBranding) {
    # Replace system files for OEM branding
    Write-Host "Replacing system files for OEM branding..."

    # Take ownership and grant permissions before copying
    & 'takeown' '/f' "$ScratchDisk\scratchdir\Windows\Branding\Basebrd\basebrd.dll" | Out-Null
    & 'icacls' "$ScratchDisk\scratchdir\Windows\Branding\Basebrd\basebrd.dll" '/grant' "$($adminGroup.Value):(F)" '/C' | Out-Null
    & 'takeown' '/f' "$ScratchDisk\scratchdir\Windows\Branding\Basebrd\en-US\basebrd.dll.mui" | Out-Null
    & 'icacls' "$ScratchDisk\scratchdir\Windows\Branding\Basebrd\en-US\basebrd.dll.mui" '/grant' "$($adminGroup.Value):(F)" '/C' | Out-Null
    & 'takeown' '/f' "$ScratchDisk\scratchdir\Windows\Branding\shellbrd\shellbrd.dll" | Out-Null
    & 'icacls' "$ScratchDisk\scratchdir\Windows\Branding\shellbrd\shellbrd.dll" '/grant' "$($adminGroup.Value):(F)" '/C' | Out-Null

    # Now copy the new files
    Copy-Item -Path "$PSScriptRoot\includes\branding-resources\system\basebrd.dll" -Destination "$ScratchDisk\scratchdir\Windows\Branding\Basebrd\basebrd.dll" -Force | Out-Null
    Copy-Item -Path "$PSScriptRoot\includes\branding-resources\system\basebrd.dll.mui" -Destination "$ScratchDisk\scratchdir\Windows\Branding\Basebrd\en-US\basebrd.dll.mui" -Force | Out-Null
    Copy-Item -Path "$PSScriptRoot\includes\branding-resources\system\shellbrd.dll" -Destination "$ScratchDisk\scratchdir\Windows\Branding\shellbrd\shellbrd.dll" -Force | Out-Null

    $brandingBootRes = "$PSScriptRoot\includes\branding-resources\system\bootres.dll"
    if (Test-Path $brandingBootRes) {
        Write-Host "Copying bootres.dll..."
        foreach ($bootresPath in @(
            "$ScratchDisk\scratchdir\Windows\Boot\EFI\bootres.dll",
            "$ScratchDisk\scratchdir\Windows\Boot\PCAT\bootres.dll"
        )) {
            if (Test-Path $bootresPath) {
                & 'takeown' '/f' $bootresPath | Out-Null
                & 'icacls' $bootresPath '/grant' "$($adminGroup.Value):(F)" '/C' | Out-Null
                Copy-Item -Path $brandingBootRes -Destination $bootresPath -Force | Out-Null
            }
        }
    }
}
Start-Sleep -Seconds 2
Clear-Host
Write-Host "Loading registry..."
reg load HKLM\zCOMPONENTS $ScratchDisk\scratchdir\Windows\System32\config\COMPONENTS | Out-Null
reg load HKLM\zDEFAULT $ScratchDisk\scratchdir\Windows\System32\config\default | Out-Null
reg load HKLM\zNTUSER $ScratchDisk\scratchdir\Users\Default\ntuser.dat | Out-Null
reg load HKLM\zSOFTWARE $ScratchDisk\scratchdir\Windows\System32\config\SOFTWARE | Out-Null
reg load HKLM\zSYSTEM $ScratchDisk\scratchdir\Windows\System32\config\SYSTEM | Out-Null

## this function allows PowerShell to take ownership of a TrustedInstaller-owned registry key. Based on Jose Espitia's script.
## Moved here (was previously defined near the end of the registry-tweak section) so keys that
## need ownership taken - like Component Based Servicing below - can be fixed BEFORE anything
## tries to write to them, instead of failing with "Access is denied" partway through.
function Enable-Privilege {
    param(
        [ValidateSet(
            "SeAssignPrimaryTokenPrivilege", "SeAuditPrivilege", "SeBackupPrivilege",
            "SeChangeNotifyPrivilege", "SeCreateGlobalPrivilege", "SeCreatePagefilePrivilege",
            "SeCreatePermanentPrivilege", "SeCreateSymbolicLinkPrivilege", "SeCreateTokenPrivilege",
            "SeDebugPrivilege", "SeEnableDelegationPrivilege", "SeImpersonatePrivilege", "SeIncreaseBasePriorityPrivilege",
            "SeIncreaseQuotaPrivilege", "SeIncreaseWorkingSetPrivilege", "SeLoadDriverPrivilege",
            "SeLockMemoryPrivilege", "SeMachineAccountPrivilege", "SeManageVolumePrivilege",
            "SeProfileSingleProcessPrivilege", "SeRelabelPrivilege", "SeRemoteShutdownPrivilege",
            "SeRestorePrivilege", "SeSecurityPrivilege", "SeShutdownPrivilege", "SeSyncAgentPrivilege",
            "SeSystemEnvironmentPrivilege", "SeSystemProfilePrivilege", "SeSystemtimePrivilege",
            "SeTakeOwnershipPrivilege", "SeTcbPrivilege", "SeTimeZonePrivilege", "SeTrustedCredManAccessPrivilege",
            "SeUndockPrivilege", "SeUnsolicitedInputPrivilege")]
        $Privilege,
        ## The process on which to adjust the privilege. Defaults to the current process.
        $ProcessId = $pid,
        ## Switch to disable the privilege, rather than enable it.
        [Switch] $Disable
    )
    $definition = @'
 using System;
 using System.Runtime.InteropServices;

 public class AdjPriv
 {
  [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
  internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall,
   ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen);

  [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
  internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok);
  [DllImport("advapi32.dll", SetLastError = true)]
  internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid);
  [StructLayout(LayoutKind.Sequential, Pack = 1)]
  internal struct TokPriv1Luid
  {
   public int Count;
   public long Luid;
   public int Attr;
  }

  internal const int SE_PRIVILEGE_ENABLED = 0x00000002;
  internal const int SE_PRIVILEGE_DISABLED = 0x00000000;
  internal const int TOKEN_QUERY = 0x00000008;
  internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
  public static bool EnablePrivilege(long processHandle, string privilege, bool disable)
  {
   bool retVal;
   TokPriv1Luid tp;
   IntPtr hproc = new IntPtr(processHandle);
   IntPtr htok = IntPtr.Zero;
   retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok);
   tp.Count = 1;
   tp.Luid = 0;
   if(disable)
   {
    tp.Attr = SE_PRIVILEGE_DISABLED;
   }
   else
   {
    tp.Attr = SE_PRIVILEGE_ENABLED;
   }
   retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid);
   retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
   return retVal;
  }
 }
'@

    $processHandle = (Get-Process -id $ProcessId).Handle
    $type = Add-Type $definition -PassThru
    $type[0]::EnablePrivilege($processHandle, $Privilege, $Disable)
}

Enable-Privilege SeTakeOwnershipPrivilege

# Forcibly takes ownership of an offline-hive registry key and REPLACES its ACL with a
# single Allow-FullControl rule for the local Administrators group (rather than just adding
# an Allow rule on top of the stock ACL), because some stock keys carry an explicit Deny that
# would otherwise outrank an appended Allow. Returns $true/$false so callers can tell whether
# a downstream reg add against this key is expected to work.
function Set-OfflineRegistryOwnership {
    param([Parameter(Mandatory)][string]$Path)
    # A leaked (unclosed) handle here keeps the whole hive file open, which later makes
    # "reg unload" fail with Access Denied and can cascade into DISM cleanup failing outright
    # because it needs the underlying config file unlocked. try/finally guarantees Close()
    # runs even if TakeOwnership/SetAccessControl throws partway through.
    $regKey = $null
    try {
        $regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey($Path, [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree, [System.Security.AccessControl.RegistryRights]::TakeOwnership)
        $regACL = $regKey.GetAccessControl()
        $regACL.SetOwner($adminGroup)
        $regKey.SetAccessControl($regACL)
        $regKey.Close()
        $regKey = $null

        $regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey($Path, [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree, [System.Security.AccessControl.RegistryRights]::ChangePermissions)
        $regACL = New-Object System.Security.AccessControl.RegistrySecurity
        $regACL.SetAccessRuleProtection($true, $false)
        $regRule = New-Object System.Security.AccessControl.RegistryAccessRule($adminGroup, "FullControl", "ContainerInherit", "None", "Allow")
        $regACL.AddAccessRule($regRule)
        $regKey.SetAccessControl($regACL)
        return $true
    } catch {
        Write-Warning "Could not take ownership of HKLM\$Path : $($_.Exception.Message)"
        return $false
    } finally {
        if ($regKey) { $regKey.Close() }
    }
}

# Component Based Servicing key is TrustedInstaller-owned in a stock hive, and permissions
# travel with the hive even when it's offline-loaded, so the "Disable Windows Error Reporting"
# AtlasOS tweak further down (which writes a value under this key) would otherwise fail with
# "Access is denied" every single build.
Write-Host "Taking ownership of Component Based Servicing key..."
if (Set-OfflineRegistryOwnership "zSOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing") {
    Write-Host "Component Based Servicing ownership taken."
}

# WindowsRuntime\ActivatableClassId is TrustedInstaller-owned too, so the "Disable Windows 11
# Settings Banner" and "Disable Game Bar Presence Writer" AtlasOS tweaks further down (which
# write values under this key) would otherwise fail with "Access is denied" every single build.
Write-Host "Taking ownership of WindowsRuntime ActivatableClassId key..."
if (Set-OfflineRegistryOwnership "zSOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId") {
    Write-Host "WindowsRuntime ActivatableClassId ownership taken."
}

Write-Host "Bypassing system requirements(on the system image):"
& 'reg' 'add' 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV1' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV2' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV1' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV2' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassCPUCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassRAMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassSecureBootCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassStorageCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassTPMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\MoSetup' '/v' 'AllowUpgradesWithUnsupportedTPMOrCPU' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
# BypassNRO set below under "Enabling Local Accounts on OOBE"
if ($IgnoreSecBoot) {
    Write-Host "IgnoreSecBoot set: flagging image to enable testsigning/nointegritychecks on first boot..."
    & 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'IgnoreSecBootBootRes' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
}

Write-Host "Disabling Sponsored Apps:"
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'OemPreInstalledAppsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'PreInstalledAppsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SilentInstalledAppsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'ContentDeliveryAllowed' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'FeatureManagementEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'PreInstalledAppsEverEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SoftLandingEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContentEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContent-310093Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContent-338388Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContent-338389Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContent-338393Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContent-353694Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContent-353696Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SystemPaneSuggestionsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\SuggestedApps' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\PushToInstall' '/v' 'DisablePushToInstall' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\MRT' '/v' 'DontOfferThroughWUAU' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableConsumerAccountStateContent' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableCloudOptimizedContent' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableWindowsConsumerFeatures' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\PolicyManager\current\device\Start' '/v' 'ConfigureStartPins' '/t' 'REG_SZ' '/d' '{"pinnedList": [{}]}' '/f' | Out-Null

Write-Host "Configuring Windows Update to prevent cloud feature injection..."
# Disable feature updates (but allow security)
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' '/v' 'DeferFeatureUpdates' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' '/v' 'DeferFeatureUpdatesPeriodInDays' '/t' 'REG_DWORD' '/d' '365' '/f' | Out-Null
# Disable driver updates from Windows Update (cloud source)
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' '/v' 'ExcludeWUDriversInQualityUpdate' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

Write-Host "Disabling Delivery Optimization (P2P cloud updates)..."
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization' '/v' 'DODownloadMode' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\ControlSet001\Services\DoSvc' '/v' 'Start' '/t' 'REG_DWORD' '/d' '4' '/f' | Out-Null

Write-Host "Disabling Diagnostic Data Viewer..."
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack' '/v' 'ShowedToastAtLevel' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\ControlSet001\Services\DiagTrack' '/v' 'Start' '/t' 'REG_DWORD' '/d' '4' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\ControlSet001\Services\dmwappushservice' '/v' 'Start' '/t' 'REG_DWORD' '/d' '4' '/f' | Out-Null # also covers "Disabling Telemetry" dmwappushservice/Start

Write-Host "Disabling Cloud Store sync..."
# Windows.CloudStore.dll data sync
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\SettingSync' '/v' 'DisableSettingSync' '/t' 'REG_DWORD' '/d' '2' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\SettingSync' '/v' 'DisableSettingSyncUserOverride' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
# Per-user cloud sync disable
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\SettingSync' '/v' 'SyncPolicy' '/t' 'REG_DWORD' '/d' '5' '/f' | Out-Null

Write-Host "Disabling Windows Insider Program..."
# Prevents cloud-based preview builds
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\PreviewBuilds' '/v' 'AllowBuildPreview' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\PreviewBuilds' '/v' 'EnableConfigFlighting' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

Write-Host "Disabling Windows Feedback..."
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\DataCollection' '/v' 'DoNotShowFeedbackNotifications' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Siuf\Rules' '/v' 'NumberOfSIUFInPeriod' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Siuf\Rules' '/v' 'PeriodInNanoSeconds' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

Write-Host "Disabling Experimentation and Configuration Service..."
# Prevents A/B testing and cloud-based feature rollouts
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\PolicyManager\current\device\System' '/v' 'AllowExperimentation' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\PolicyManager\default\System\AllowExperimentation' '/v' 'value' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

Write-Host "Disabling Start Menu Iris recommendations"
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'Start_IrisRecommendations' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

Write-Host "Enabling Local Accounts on OOBE:"
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\OOBE' '/v' 'BypassNRO' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
Copy-Item -Path "$PSScriptRoot\includes\autounattend-win11.xml" -Destination "$ScratchDisk\scratchdir\Windows\System32\Sysprep\autounattend.xml" -Force | Out-Null

Write-Host "Disabling Reserved Storage:"
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\ReserveManager' '/v' 'ShippedWithReserves' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

Write-Host "Disabling BitLocker Device Encryption"
& 'reg' 'add' 'HKLM\zSYSTEM\ControlSet001\Control\BitLocker' '/v' 'PreventDeviceEncryption' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

Write-Host "Disabling Chat icon:"
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\Windows Chat' '/v' 'ChatIcon' '/t' 'REG_DWORD' '/d' '3' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'TaskbarMn' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

Write-Host "Removing Edge related registries"
& 'reg' 'delete' 'HKLM\zSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update' '/f' | Out-Null

Write-Host "Disabling OneDrive folder backup"
& 'reg' 'add' "HKLM\zSOFTWARE\Policies\Microsoft\Windows\OneDrive" '/v' 'DisableFileSyncNGSC' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

Write-Host "Disabling Telemetry:"
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo' '/v' 'Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Privacy' '/v' 'TailoredExperiencesWithDiagnosticDataEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy' '/v' 'HasAccepted' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Input\TIPC' '/v' 'Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\InputPersonalization' '/v' 'RestrictImplicitInkCollection' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\InputPersonalization' '/v' 'RestrictImplicitTextCollection' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\InputPersonalization\TrainedDataStore' '/v' 'HarvestContacts' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Personalization\Settings' '/v' 'AcceptedPrivacyPolicy' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\DataCollection' '/v' 'AllowTelemetry' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\DataCollection' '/v' 'MaxTelemetryAllowed' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\Windows Error Reporting' '/v' 'Disabled' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\SQMClient\Windows' '/v' 'CEIPEnable' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# Disable Copilot
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsCopilot' '/v' 'TurnOffWindowsCopilot' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# Disable Recall (Windows AI / 26100+ builds)
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsAI' '/v' 'DisableAIDataAnalysis' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

## Disable Windows Spotlight and tips on lockscreen
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'RotatingLockScreenEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'RotatingLockScreenOverlayEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'SubscribedContent-338387Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

## Prevents installation of DevHome and Outlook
Write-Host "Prevents installation of DevHome and Outlook:"
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler\OutlookUpdate' '/v' 'workCompleted' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler\DevHomeUpdate' '/v' 'workCompleted' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\OutlookUpdate' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\DevHomeUpdate' '/f' | Out-Null

## Set default wallpaper and dark mode
Write-Host "Setting default dark mode..."
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize' '/v' 'SystemUsesLightTheme' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize' '/v' 'AppsUseLightTheme' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize' '/v' 'EnableTransparency' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zDEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize' '/v' 'SystemUsesLightTheme' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zDEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize' '/v' 'AppsUseLightTheme' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zDEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize' '/v' 'EnableTransparency' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

Write-Host "Setting up the default wallpaper..."
& 'reg' 'add' 'HKLM\zDEFAULT\Control Panel\Desktop' '/v' 'WallPaper' '/t' 'REG_SZ' '/d' '%SystemRoot%\Windows\Web\Wallpaper\Windows\flooded-city.jpg' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zDEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers' '/v' 'WallpaperStyle' '/t' 'REG_DWORD' '/d' '10' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop' '/v' 'WallPaper' '/t' 'REG_SZ' '/d' '%SystemRoot%\Windows\Web\Wallpaper\Windows\flooded-city.jpg' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers' '/v' 'WallpaperStyle' '/t' 'REG_DWORD' '/d' '10' '/f' | Out-Null

Write-Host "Setting up the default lockscreen..."
& 'reg' 'add' 'HKLM\zDEFAULT\Software\Microsoft\Windows\CurrentVersion\Lock Screen' '/v' 'LandscapeAssetPath' '/t' 'REG_SZ' '/d' '%SystemRoot%\Windows\Web\Wallpaper\Windows\leafy-greens.jpg' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Lock Screen' '/v' 'LandscapeAssetPath' '/t' 'REG_SZ' '/d' '%SystemRoot%\Windows\Web\Wallpaper\Windows\leafy-greens.jpg' '/f' | Out-Null

## Align the taskbar to the left
Write-Host "Aligning the taskbar to the left..."
& 'reg' 'add' 'HKLM\zDEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'TaskbarAl' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'TaskbarAl' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# =====================================================================================
# Additional registry tweaks ported from AtlasOS (github.com/Atlas-OS/Atlas)
# Source: src/playbook/Configuration/tweaks/**/*.yml (pure registryValue/registryKey files)
# Applied against offline-loaded hives: zSOFTWARE, zSYSTEM, zNTUSER
# Review before use -- some tweaks affect security posture (UAC, LLMNR, anonymous access, etc.)
# =====================================================================================

# --- Configure Content Delivery Manager ---
Write-Host "[AtlasOS tweak] Configure Content Delivery Manager"
# source: tweaks/debloat/config-content-delivery.yml
# Most ContentDeliveryManager values here already set above under "Disabling Sponsored
# Apps" and "Disable Windows Spotlight and tips on lockscreen" - only the two values not
# covered by those blocks are kept here.
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'RemediationRequired' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\SystemSettings\AccountNotifications' '/v' 'EnableAccountNotifications' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Hide Unused Windows Security Pages ---
Write-Host "[AtlasOS tweak] Hide Unused Windows Security Pages"
# source: tweaks/debloat/hide-unused-security-pages.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows Defender Security Center\Family options' '/v' 'UILockdown' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows Defender Security Center\Device performance and health' '/v' 'UILockdown' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows Defender Security Center\Account protection' '/v' 'UILockdown' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable SMB Bandwidth Throttling ---
Write-Host "[AtlasOS tweak] Disable SMB Bandwidth Throttling"
# source: tweaks/networking/shares/disable-smb-bandwidth-throttling.yml
& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters' '/v' 'DisableBandwidthThrottling' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Restrict Anonymous Access ---
Write-Host "[AtlasOS tweak] Restrict Anonymous Access"
# source: tweaks/networking/shares/restrict-anonymous-access.yml
& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Services\LanManServer\Parameters' '/v' 'RestrictNullSessAccess' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Restrict Anonymous Enumeration of Shares ---
Write-Host "[AtlasOS tweak] Restrict Anonymous Enumeration of Shares"
# source: tweaks/networking/shares/restrict-anonymous-enumeration.yml
& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\Lsa' '/v' 'RestrictAnonymous' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Configure Automatic Maintenance ---
Write-Host "[AtlasOS tweak] Configure Automatic Maintenance"
# source: tweaks/performance/config-automatic-maintenance.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\Task Scheduler\Maintenance' '/v' 'WakeUp' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Configure the Multimedia Class Scheduler Service ---
Write-Host "[AtlasOS tweak] Configure the Multimedia Class Scheduler Service"
# source: tweaks/performance/config-mmcss.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile' '/v' 'SystemResponsiveness' '/t' 'REG_DWORD' '/d' '10' '/f' | Out-Null

# --- Disable Background Apps ---
Write-Host "[AtlasOS tweak] Disable Background Apps"
# source: tweaks/performance/disable-background-apps.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications' '/v' 'GlobalUserDisabled' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search' '/v' 'BackgroundAppGlobalToggle' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Game Bar ---
Write-Host "[AtlasOS tweak] Disable Game Bar"
# source: tweaks/performance/disable-game-bar.yml
# GameConfigStore/GameDVR/GameBar are TrustedInstaller-owned in a stock hive, so the reg adds
# below would otherwise fail with "Access is denied" every single build.
# GameConfigStore/GameDVR/GameBar don't exist yet in a fresh hive (reg add has to create
# them), so taking ownership of those exact paths is a no-op - OpenSubKey returns null for a
# missing key rather than throwing, so there's nothing to take ownership OF yet. The actual
# access-denied is "System" itself (a top-level HKCU key) refusing to let a new child key be
# created under it; GameDVR/GameBar's parents are ordinary writable CurrentVersion/Microsoft
# keys already used successfully by other tweaks, so only "System" needs fixing here.
Set-OfflineRegistryOwnership "zNTUSER\System" | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\System\GameConfigStore' '/v' 'GameDVR_Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\GameDVR' '/v' 'AppCaptureEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\GameBar' '/v' 'GamePanelStartupTipIndex' '/t' 'REG_DWORD' '/d' '3' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\GameBar' '/v' 'ShowStartupPanel' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\GameBar' '/v' 'UseNexusForGameBarEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Gaming.GameBar.PresenceServer.Internal.PresenceWriter' '/v' 'ActivationType' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\GameDVR' '/v' 'AllowGameDVR' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\PolicyManager\default\ApplicationManagement\AllowGameDVR' '/v' 'value' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Respect Power Modes Windows Search Indexing ---
Write-Host "[AtlasOS tweak] Respect Power Modes Windows Search Indexing"
# source: tweaks/performance/respect-power-modes-search.yml
# Windows Search\Gather\Windows\SystemIndex is TrustedInstaller-owned in a stock hive, so the
# reg add below would otherwise fail with "Access is denied" every single build.
Set-OfflineRegistryOwnership "zSOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex" | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex' '/v' 'RespectPowerModes' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Paging Settings ---
Write-Host "[AtlasOS tweak] Disable Paging Settings"
# source: tweaks/performance/system/disable-paging.yml
& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\Session Manager\Memory Management' '/v' 'DisablePagingExecutive' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\Session Manager\Memory Management' '/v' 'DisablePageCombining' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Prioritize Foreground Applications ---
Write-Host "[AtlasOS tweak] Prioritize Foreground Applications"
# source: tweaks/performance/system/win32-priority-separation.yml
& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\PriorityControl' '/v' 'Win32PrioritySeparation' '/t' 'REG_DWORD' '/d' '38' '/f' | Out-Null

# --- Disable Advertising ID ---
Write-Host "[AtlasOS tweak] Disable Advertising ID"
# source: tweaks/privacy/advertising/disable-advertising-info.yml
# AdvertisingInfo\Enabled already set above under "Disabling Telemetry"; only the group
# policy lockout value is new here.
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo' '/v' 'DisabledByGroupPolicy' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Sync Provider Notifications ---
Write-Host "[AtlasOS tweak] Disable Sync Provider Notifications"
# source: tweaks/privacy/advertising/disable-sync-provider-notifs.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'ShowSyncProviderNotifications' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable NVIDIA Control Panel Telemetry ---
Write-Host "[AtlasOS tweak] Disable NVIDIA Control Panel Telemetry"
# source: tweaks/privacy/apps/disable-nvidia-telemetry.yml
& 'reg' 'add' 'HKLM\zNTUSER\Software\NVIDIA Corporation\NVControlPanel2\Client' '/v' 'OptInOrOutPreference' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Office Telemetry ---
Write-Host "[AtlasOS tweak] Disable Office Telemetry"
# source: tweaks/privacy/apps/disable-office-telemetry.yml
& 'reg' 'add' 'HKLM\zNTUSER\Software\Policies\Microsoft\office\16.0\common' '/v' 'sendcustomerdata' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Policies\Microsoft\office\common\clienttelemetry' '/v' 'sendtelemetry' '/t' 'REG_DWORD' '/d' '3' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Policies\Microsoft\office\16.0\common' '/v' 'qmenable' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Settings Sync ---
Write-Host "[AtlasOS tweak] Disable Settings Sync"
# source: tweaks/privacy/cloud/disable-setting-sync.yml
# DisableSettingSync/DisableSettingSyncUserOverride/SyncPolicy already set above under
# "Disabling Cloud Store sync" - only the additional policy + per-group keys are new here.
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\SettingSync' '/v' 'DisableSyncOnPaidNetwork' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\SettingSync' '/v' 'DisableWindowsSettingSync' '/t' 'REG_DWORD' '/d' '2' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Personalization' '/v' 'Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\BrowserSettings' '/v' 'Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Credentials' '/v' 'Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Accessibility' '/v' 'Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Windows' '/v' 'Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Suggested Ways to Finish Setting Up Your Device ---
Write-Host "[AtlasOS tweak] Disable Suggested Ways to Finish Setting Up Your Device"
# source: tweaks/privacy/cloud/disable-suggest-ways-to-finish-setup.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\UserProfileEngagement' '/v' 'ScoobeSystemSettingEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disallow Message Service Cloud Sync ---
Write-Host "[AtlasOS tweak] Disallow Message Service Cloud Sync"
# source: tweaks/privacy/cloud/disallow-message-cloud-sync.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\Messaging' '/v' 'AllowMessageSync' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Configure App Permissions ---
Write-Host "[AtlasOS tweak] Configure App Permissions"
# source: tweaks/privacy/config-app-permissions.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\appDiagnostics' '/v' 'Value' '/t' 'REG_SZ' '/d' 'Deny' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location' '/v' 'Value' '/t' 'REG_SZ' '/d' 'Deny' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userAccountInformation' '/v' 'Value' '/t' 'REG_SZ' '/d' 'Deny' '/f' | Out-Null

# --- Configure Windows Media Player ---
Write-Host "[AtlasOS tweak] Configure Windows Media Player"
# source: tweaks/privacy/config-windows-media-player.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\WMDRM' '/v' 'DisableOnline' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\MediaPlayer\Preferences' '/v' 'AcceptedPrivacyStatement' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\MediaPlayer\Preferences' '/v' 'UsageTracking' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Activity Feed ---
Write-Host "[AtlasOS tweak] Disable Activity Feed"
# source: tweaks/privacy/disable-activity-feed.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\System' '/v' 'EnableActivityFeed' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable App Launch Tracking ---
Write-Host "[AtlasOS tweak] Disable App Launch Tracking"
# source: tweaks/privacy/disable-app-launch-tracking.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'Start_TrackProgs' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Device Health Attestation Monitoring and Reporting ---
Write-Host "[AtlasOS tweak] Disable Device Health Attestation Monitoring and Reporting"
# source: tweaks/privacy/disable-device-monitoring.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\DeviceHealthAttestationService' '/v' 'EnableDeviceHealthAttestationService' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Experimentation ---
Write-Host "[AtlasOS tweak] Disable Experimentation"
# source: tweaks/privacy/disable-experimentation.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\PolicyManager\default\System\AllowExperimentation' '/v' 'Value' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Lockscreen Camera ---
Write-Host "[AtlasOS tweak] Disable Lockscreen Camera"
# source: tweaks/privacy/disable-lockscreen-camera.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\Personalization' '/v' 'NoLockScreenCamera' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Online Speech Recognition ---
Write-Host "[AtlasOS tweak] Disable Online Speech Recognition"
# source: tweaks/privacy/disable-online-speech-recognition.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy' '/v' 'HasAccepted' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Program Compatibility Assistant (PCA) ---
Write-Host "[AtlasOS tweak] Disable Program Compatibility Assistant (PCA)"
# source: tweaks/privacy/disable-pca.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\AppCompat' '/v' 'AITEnable' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\AppCompat' '/v' 'AllowTelemetry' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\AppCompat' '/v' 'DisableEngine' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\AppCompat' '/v' 'DisableInventory' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\AppCompat' '/v' 'DisablePCA' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\AppCompat' '/v' 'DisableUAR' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable OOBE Privacy Experience ---
Write-Host "[AtlasOS tweak] Disable OOBE Privacy Experience"
# source: tweaks/privacy/disable-privacy-experience.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\OOBE' '/v' 'DisablePrivacyExperience' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Resultant Set of Policy (RSoP) Logging ---
Write-Host "[AtlasOS tweak] Disable Resultant Set of Policy (RSoP) Logging"
# source: tweaks/privacy/disable-rsop-logging.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\System' '/v' 'RSoPLogging' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Automatic Updates Of Speech Data ---
Write-Host "[AtlasOS tweak] Disable Automatic Updates Of Speech Data"
# source: tweaks/privacy/disable-speech-auto-updates.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Speech' '/v' 'AllowSpeechModelUpdate' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Do Not Use Diagnostic Data For Tailored Experiences ---
Write-Host "[AtlasOS tweak] Do Not Use Diagnostic Data For Tailored Experiences"
# source: tweaks/privacy/disable-tailored-experiences.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Privacy' '/v' 'TailoredExperiencesWithDiagnosticDataEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableTailoredExperiencesWithDiagnosticData' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Most Frequently Used Applications ---
Write-Host "[AtlasOS tweak] Disable Most Frequently Used Applications"
# source: tweaks/privacy/disable-user-tracking.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'NoInstrumentation' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Website Access to Language List ---
Write-Host "[AtlasOS tweak] Disable Website Access to Language List"
# source: tweaks/privacy/disable-web-lang-list-access.yml
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\International\User Profile' '/v' 'HttpAcceptLanguageOptOut' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Windows Error Reporting ---
Write-Host "[AtlasOS tweak] Disable Windows Error Reporting"
# source: tweaks/privacy/disable-win-error-reporting.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting' '/v' 'Disabled' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting' '/v' 'DoReport' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting' '/v' 'Disabled' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting' '/v' 'DontShowUI' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting' '/v' 'ShowUI' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting' '/v' 'LoggingDisabled' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting' '/v' 'DontSendAdditionalData' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing' '/v' 'DisableWerReporting' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Settings' '/v' 'DisableSendGenericDriverNotFoundToWER' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Settings' '/v' 'DisableSendRequestAdditionalSoftwareToWER' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disallow Users to Be Non-local ---
Write-Host "[AtlasOS tweak] Disallow Users to Be Non-local"
# source: tweaks/privacy/disallow-ms-accounts.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' '/v' 'NoConnectedUser' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disallow Upload and Publish of User Activities ---
Write-Host "[AtlasOS tweak] Disallow Upload and Publish of User Activities"
# source: tweaks/privacy/disallow-user-activity-upload.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\System' '/v' 'UploadUserActivities' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\System' '/v' 'PublishUserActivities' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Key Management System Telemetry ---
Write-Host "[AtlasOS tweak] Disable Key Management System Telemetry"
# source: tweaks/privacy/telemetry/disable-activation-telemetry.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform' '/v' 'NoGenTicket' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Customer Experience Improvement Program ---
Write-Host "[AtlasOS tweak] Disable Customer Experience Improvement Program"
# source: tweaks/privacy/telemetry/disable-ceip.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\AppV\CEIP' '/v' 'CEIPEnable' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\SQMClient\Windows' '/v' 'CEIPEnable' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Diagnostic Tracing ---
Write-Host "[AtlasOS tweak] Disable Diagnostic Tracing"
# source: tweaks/privacy/telemetry/disable-diagnostic-tracing.yml
& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\Diagnostics\Performance' '/v' 'DisableDiagnosticTracing' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Input Telemetry ---
Write-Host "[AtlasOS tweak] Disable Input Telemetry"
# source: tweaks/privacy/telemetry/disable-input-telemetry.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\InputPersonalization' '/v' 'RestrictImplicitInkCollection' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\InputPersonalization' '/v' 'RestrictImplicitTextCollection' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\InputPersonalization\TrainedDataStore' '/v' 'HarvestContacts' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Personalization\Settings' '/v' 'AcceptedPrivacyPolicy' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\TabletPC' '/v' 'PreventHandwritingDataSharing' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports' '/v' 'PreventHandwritingErrorReports' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Input\Settings' '/v' 'InsightsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Input\TIPC' '/v' 'Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Input\TIPC' '/v' 'Enabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Change the Tooltip Color to Blue ---
Write-Host "[AtlasOS tweak] Change the Tooltip Color to Blue"
# source: tweaks/qol/appearance/blue-tooltips.yml
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Colors' '/v' 'InfoWindow' '/t' 'REG_SZ' '/d' '246 253 255' '/f' | Out-Null

# --- Disallow Themes to Change Certain Personalized Features ---
Write-Host "[AtlasOS tweak] Disallow Themes to Change Certain Personalized Features"
# source: tweaks/qol/appearance/disallow-theme-changes.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes' '/v' 'ThemeChangesMousePointers' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes' '/v' 'ThemeChangesDesktopIcons' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Wallpaper Compression ---
Write-Host "[AtlasOS tweak] Disable Wallpaper Compression"
# source: tweaks/qol/best-wallpaper-quality.yml
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop' '/v' 'JPEGImportQuality' '/t' 'REG_DWORD' '/d' '100' '/f' | Out-Null

# --- Configure Windows Ink Workspace ---
Write-Host "[AtlasOS tweak] Configure Windows Ink Workspace"
# source: tweaks/qol/config-windows-ink-workspace.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\PenWorkspace' '/v' 'PenWorkspaceAppSuggestionsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Dynamic Lighting ---
Write-Host "[AtlasOS tweak] Disable Dynamic Lighting"
# source: tweaks/qol/disable-dynamic-lighting.yml
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Lighting' '/v' 'AmbientLightingEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Mouse Acceleration ---
Write-Host "[AtlasOS tweak] Disable Mouse Acceleration"
# source: tweaks/qol/disable-mouse-accel.yml
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Mouse' '/v' 'MouseSpeed' '/t' 'REG_SZ' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Mouse' '/v' 'MouseThreshold1' '/t' 'REG_SZ' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Mouse' '/v' 'MouseThreshold2' '/t' 'REG_SZ' '/d' '0' '/f' | Out-Null

# --- Disable Cross Device Resume ---
Write-Host "[AtlasOS tweak] Disable Cross Device Resume"
# source: tweaks/qol/disable-resume.yml
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\CrossDeviceResume\Configuration' '/v' 'IsResumeAllowed' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\PolicyManager\default\Connectivity\DisableCrossDeviceResume' '/v' 'Value' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Screen Capture Hotkey ---
Write-Host "[AtlasOS tweak] Disable Screen Capture Hotkey"
# source: tweaks/qol/disable-screen-capture-hotkey.yml
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Keyboard' '/v' 'PrintScreenKeyForSnippingEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Settings Tips ---
Write-Host "[AtlasOS tweak] Disable Settings Tips"
# source: tweaks/qol/disable-settings-tips.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\PolicyManager\default\Settings\AllowOnlineTips' '/v' 'value' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'AllowOnlineTips' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Spell Checking ---
Write-Host "[AtlasOS tweak] Disable Spell Checking"
# source: tweaks/qol/disable-spell-checking.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\TabletTip\1.7' '/v' 'EnableAutocorrection' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\TabletTip\1.7' '/v' 'EnableDoubleTapSpace' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\TabletTip\1.7' '/v' 'EnablePredictionSpaceInsertion' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\TabletTip\1.7' '/v' 'EnableSpellchecking' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\TabletTip\1.7' '/v' 'EnableTextPrediction' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Automatic Updates for Apps in Store ---
Write-Host "[AtlasOS tweak] Disable Automatic Updates for Apps in Store"
# source: tweaks/qol/disable-store-auto-updates.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\WindowsStore\WindowsUpdate' '/v' 'AutoDownload' '/t' 'REG_DWORD' '/d' '2' '/f' | Out-Null

# --- Disable Tips ---
Write-Host "[AtlasOS tweak] Disable Tips"
# source: tweaks/qol/disable-tips.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableSoftLanding' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Unnecessary Touch Keyboard Settings ---
Write-Host "[AtlasOS tweak] Disable Unnecessary Touch Keyboard Settings"
# source: tweaks/qol/disable-touch-keyboard-features.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\TabletTip\1.7' '/v' 'EnableAutoShiftEngage' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\TabletTip\1.7' '/v' 'EnableKeyAudioFeedback' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Touch Visual Feedback ---
Write-Host "[AtlasOS tweak] Disable Touch Visual Feedback"
# source: tweaks/qol/disable-touch-visual-feedback.yml
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Cursors' '/v' 'GestureVisualization' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Cursors' '/v' 'ContactVisualization' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable 'Notify About USB Issues' ---
Write-Host "[AtlasOS tweak] Disable 'Notify About USB Issues'"
# source: tweaks/qol/disable-usb-issues-notifications.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Shell\USB' '/v' 'NotifyOnUsbErrors' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Shell\USB' '/v' 'NotifyOnWeakCharger' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Windows 11 Settings Banner ---
Write-Host "[AtlasOS tweak] Disable Windows 11 Settings Banner"
# source: tweaks/qol/disable-win11-settings-banner.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\ValueBanner.IdealStateFeatureControlProvider' '/v' 'ActivationType' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Windows Feedback ---
Write-Host "[AtlasOS tweak] Disable Windows Feedback"
# source: tweaks/qol/disable-windows-feedback.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Siuf\Rules' '/v' 'NumberOfSIUFInPeriod' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Siuf\Rules' '/v' 'PeriodInNanoSeconds' '/t' 'REG_SZ' '/d' '""' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection' '/v' 'DoNotShowFeedbackNotifications' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Windows Spotlight ---
Write-Host "[AtlasOS tweak] Disable Windows Spotlight"
# source: tweaks/qol/disable-windows-spotlight.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableWindowsSpotlightFeatures' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableWindowsSpotlightWindowsWelcomeExperience' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableWindowsSpotlightOnActionCenter' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableWindowsSpotlightOnSettings' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableThirdPartySuggestions' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Do Not Reduce Sounds While in a Call ---
Write-Host "[AtlasOS tweak] Do Not Reduce Sounds While in a Call"
# source: tweaks/qol/do-not-reduce-sounds.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Multimedia\Audio' '/v' 'UserDuckingPreference' '/t' 'REG_DWORD' '/d' '3' '/f' | Out-Null

# --- Disable 'Always Read and Scan This Section' ---
Write-Host "[AtlasOS tweak] Disable 'Always Read and Scan This Section'"
# source: tweaks/qol/ease-of-access/disable-always-read-section.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Ease of Access' '/v' 'selfscan' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Ease of Access' '/v' 'selfvoice' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Commonly Annoying Features and Shortcuts ---
Write-Host "[AtlasOS tweak] Disable Commonly Annoying Features and Shortcuts"
# source: tweaks/qol/ease-of-access/disable-annoying-features-shortcuts.yml
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Accessibility\HighContrast' '/v' 'Flags' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Accessibility\Keyboard Response' '/v' 'Flags' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Accessibility\MouseKeys' '/v' 'Flags' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Accessibility\StickyKeys' '/v' 'Flags' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Accessibility\ToggleKeys' '/v' 'Flags' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Input Method\Hot Keys\00000104' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Keyboard Layout\Toggle' '/v' 'Layout Hotkey' '/t' 'REG_DWORD' '/d' '3' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Keyboard Layout\Toggle' '/v' 'Language Hotkey' '/t' 'REG_DWORD' '/d' '3' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Keyboard Layout\Toggle' '/v' 'Hotkey' '/t' 'REG_DWORD' '/d' '3' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Narrator\NoRoam' '/v' 'WinEnterLaunchEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Accessibility Tool Shortcut ---
Write-Host "[AtlasOS tweak] Disable Accessibility Tool Shortcut"
# source: tweaks/qol/ease-of-access/disable-making-touch-easier.yml
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Accessibility\SlateLaunch' '/v' 'LaunchAT' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Ease of Access Sounds ---
Write-Host "[AtlasOS tweak] Disable Ease of Access Sounds"
# source: tweaks/qol/ease-of-access/disable-warning-sounds.yml
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Accessibility' '/v' 'Warning Sounds' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Accessibility' '/v' 'Sound on Activation' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Accessibility\SoundSentry' '/v' 'WindowsEffect' '/t' 'REG_SZ' '/d' '0' '/f' | Out-Null

# --- Show More Details by Default on Transfers ---
Write-Host "[AtlasOS tweak] Show More Details by Default on Transfers"
# source: tweaks/qol/explorer/always-more-details-transfer.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\OperationStatusManager' '/v' 'EnthusiastMode' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Use Check Boxes to Select Items ---
Write-Host "[AtlasOS tweak] Disable Use Check Boxes to Select Items"
# source: tweaks/qol/explorer/disable-check-boxes.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'AutoCheckSelect' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Searching for Invalid Shortcuts ---
Write-Host "[AtlasOS tweak] Disable Searching for Invalid Shortcuts"
# source: tweaks/qol/explorer/disable-invalid-shortcuts-search.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'NoResolveSearch' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'NoResolveTrack' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Don't Show Office Files ---
Write-Host "[AtlasOS tweak] Don't Show Office Files"
# source: tweaks/qol/explorer/dont-show-office-files.yml
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer' '/v' 'ShowCloudFilesInQuickAccess' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Enable Long Paths ---
Write-Host "[AtlasOS tweak] Enable Long Paths"
# source: tweaks/qol/explorer/enable-long-paths.yml
& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\FileSystem' '/v' 'LongPathsEnabled' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Extend Icon Cache ---
Write-Host "[AtlasOS tweak] Extend Icon Cache"
# source: tweaks/qol/explorer/extend-cache.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer' '/v' 'Max Cached Icons' '/t' 'REG_SZ' '/d' '4096' '/f' | Out-Null

# --- Always Show the Full Context Menu On Items ---
Write-Host "[AtlasOS tweak] Always Show the Full Context Menu On Items"
# source: tweaks/qol/explorer/full-context-on-more-than-15-items.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer' '/v' 'MultipleInvokePromptMinimum' '/t' 'REG_DWORD' '/d' '100' '/f' | Out-Null

# --- Hide Recent Items ---
Write-Host "[AtlasOS tweak] Hide Recent Items"
# source: tweaks/qol/explorer/hide-frequently-used-items.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer' '/v' 'ShowFrequent' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer' '/v' 'ShowRecent' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'Start_TrackDocs' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'ClearRecentDocsOnExit' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'NoRecentDocsHistory' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Policies\Microsoft\Windows\Explorer' '/v' 'NoRemoteDestinations' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Minimize Mouse Hover Time for Item Info ---
Write-Host "[AtlasOS tweak] Minimize Mouse Hover Time for Item Info"
# source: tweaks/qol/explorer/minimize-mouse-hover-time.yml
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop' '/v' 'MouseHoverTime' '/t' 'REG_SZ' '/d' '20' '/f' | Out-Null

# --- Disable Internet File Association Service ---
Write-Host "[AtlasOS tweak] Disable Internet File Association Service"
# source: tweaks/qol/explorer/no-internet-open-with.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'NoInternetOpenWith' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Open File Explorer to This PC ---
Write-Host "[AtlasOS tweak] Open File Explorer to This PC"
# source: tweaks/qol/explorer/open-to-this-pc.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'LaunchTo' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Show Removable Drives Only in 'This PC' ---
Write-Host "[AtlasOS tweak] Show Removable Drives Only in 'This PC'"
# source: tweaks/qol/explorer/removable-drives-only-this-pc.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83' '/f' | Out-Null

# --- Remove Previous Versions from Explorer ---
Write-Host "[AtlasOS tweak] Remove Previous Versions from Explorer"
# source: tweaks/qol/explorer/remove-previous-versions.yml
# Fixed: source uses `operation: delete` on these two values - a previous import wrongly
# translated that as "set to empty string" instead of actually deleting the value.
& 'reg' 'delete' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer' '/v' 'NoPreviousVersionsPage' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zNTUSER\SOFTWARE\Policies\Microsoft\PreviousVersions' '/v' 'DisableLocalPage' '/f' | Out-Null
# The actual removal mechanism (the shell property-sheet/context-menu handlers) was never
# imported at all - these are the HKCR keys resolved to their offline zSOFTWARE\Classes
# equivalent (HKCR is a runtime merge of HKLM\SOFTWARE\Classes + HKCU\SOFTWARE\Classes;
# these are machine-wide handler registrations, so they belong under zSOFTWARE\Classes).
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\AllFilesystemObjects\shellex\PropertySheetHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shellex\PropertySheetHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\Directory\shellex\PropertySheetHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\Drive\shellex\PropertySheetHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shellex\ContextMenuHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}' '/f' | Out-Null

# =====================================================================================
# Explorer context-menu tweaks ported from AtlasOS - previously skipped entirely because
# they target HKEY_CLASSES_ROOT, which isn't a hive you can reg-load offline. Resolved
# against the actual mounted hive: HKCR is the runtime merge of HKLM\SOFTWARE\Classes and
# HKCU\SOFTWARE\Classes, so machine-wide registrations go under zSOFTWARE\Classes\...
# "Merge as TrustedInstaller" (tweaks/qol/explorer/add-context-menus/merge-as-trustedinstaller.yml)
# was NOT ported - it shells out to Atlas's own %windir%\AtlasModules\Scripts\RunAsTI.cmd,
# which doesn't exist in this project.
# =====================================================================================

# --- Adds Batch Scripts to 'New' Context Menu ---
Write-Host "[AtlasOS tweak] Adds Batch Scripts to 'New' Context Menu"
# source: tweaks/qol/explorer/add-context-menus/new-bat.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\.bat\ShellNew' '/v' 'ItemName' '/t' 'REG_EXPAND_SZ' '/d' '%windir%\System32\acppage.dll,-6002' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\.bat\ShellNew' '/v' 'NullFile' '/t' 'REG_SZ' '/d' '""' '/f' | Out-Null

# --- Add PowerShell Script to 'New' Context Menu ---
Write-Host "[AtlasOS tweak] Add PowerShell Script to 'New' Context Menu"
# source: tweaks/qol/explorer/add-context-menus/new-ps1.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\.ps1' '/ve' '/t' 'REG_SZ' '/d' 'Microsoft.PowerShellScript.1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\.ps1\ShellNew' '/v' 'NullFile' '/t' 'REG_SZ' '/d' '""' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\Microsoft.PowerShellScript.1' '/ve' '/t' 'REG_SZ' '/d' 'Windows PowerShell Script' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\Microsoft.PowerShellScript.1' '/v' 'FriendlyTypeName' '/t' 'REG_SZ' '/d' 'Windows PowerShell Script' '/f' | Out-Null

# --- Add Registry Entries to 'New' Context Menu ---
Write-Host "[AtlasOS tweak] Add Registry Entries to 'New' Context Menu"
# source: tweaks/qol/explorer/add-context-menus/new-reg.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\.reg\ShellNew' '/v' 'NullFile' '/t' 'REG_SZ' '/d' '""' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\.reg\ShellNew' '/v' 'ItemName' '/t' 'REG_EXPAND_SZ' '/d' '%windir%\regedit.exe,-309' '/f' | Out-Null

# --- Add Power Plan File Association ---
Write-Host "[AtlasOS tweak] Add Power Plan File Association"
# source: tweaks/qol/explorer/import-power-plan.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\powerscheme\DefaultIcon' '/ve' '/t' 'REG_SZ' '/d' '%windir%\System32\powercpl.dll,1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\powerscheme\Shell\open\command' '/ve' '/t' 'REG_SZ' '/d' 'powercfg /import "%1"' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\.pow' '/ve' '/t' 'REG_SZ' '/d' 'powerscheme' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\.pow' '/v' 'FriendlyTypeName' '/t' 'REG_SZ' '/d' 'Power Scheme' '/f' | Out-Null

# --- Remove 'Include in Library' from Context Menu ---
Write-Host "[AtlasOS tweak] Remove 'Include in Library' from Context Menu"
# source: tweaks/qol/explorer/remove-context-menus/include-in-library.yml
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\Library Location' '/f' | Out-Null

# --- Remove Bitmap Image from 'New' Context Menu ---
Write-Host "[AtlasOS tweak] Remove Bitmap Image from 'New' Context Menu"
# source: tweaks/qol/explorer/remove-context-menus/new-bitmap.yml
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\.bmp\ShellNew' '/f' | Out-Null

# --- Remove Rich Text Document from 'New' Context Menu ---
Write-Host "[AtlasOS tweak] Remove Rich Text Document from 'New' Context Menu"
# source: tweaks/qol/explorer/remove-context-menus/new-rtf.yml
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\.rtf\ShellNew' '/f' | Out-Null

# --- Remove 'Edit with Paint 3D' from Context Menu ---
Write-Host "[AtlasOS tweak] Remove 'Edit with Paint 3D' from Context Menu"
# source: tweaks/qol/explorer/remove-context-menus/paint-3D.yml
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.3mf\Shell\3D Edit' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.bmp\Shell\3D Edit' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.fbx\Shell\3D Edit' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.gif\Shell\3D Edit' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.jfif\Shell\3D Edit' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.jpe\Shell\3D Edit' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell\3D Edit' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.jpg\Shell\3D Edit' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.png\Shell\3D Edit' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.tif\Shell\3D Edit' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\SystemFileAssociations\.tiff\Shell\3D Edit' '/f' | Out-Null

# --- Remove 'Share' from Context Menu ---
Write-Host "[AtlasOS tweak] Remove 'Share' from Context Menu"
# source: tweaks/qol/explorer/remove-context-menus/share.yml
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\*\shellex\ContextMenuHandlers\ModernSharing' '/f' | Out-Null
& 'reg' 'delete' 'HKLM\zSOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ModernSharing' '/f' | Out-Null

# --- Show All Tasks in Control Panel (God Mode) ---
Write-Host "[AtlasOS tweak] Show All Tasks in Control Panel (God Mode)"
# source: tweaks/qol/show-all-tasks-control-panel.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\CLSID\{D15ED2E1-C75B-443c-BD7C-FC03B2F08C17}' '/ve' '/t' 'REG_SZ' '/d' 'All Tasks' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\CLSID\{D15ED2E1-C75B-443c-BD7C-FC03B2F08C17}' '/v' 'InfoTip' '/t' 'REG_SZ' '/d' 'View list of all Control Panel tasks' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\CLSID\{D15ED2E1-C75B-443c-BD7C-FC03B2F08C17}' '/v' 'System.ControlPanel.Category' '/t' 'REG_SZ' '/d' '5' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\CLSID\{D15ED2E1-C75B-443c-BD7C-FC03B2F08C17}\DefaultIcon' '/ve' '/t' 'REG_SZ' '/d' '%windir%\System32\imageres.dll,-27' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Classes\CLSID\{D15ED2E1-C75B-443c-BD7C-FC03B2F08C17}\Shell\Open\Command' '/ve' '/t' 'REG_SZ' '/d' 'explorer.exe shell:::{ED7BA470-8E54-465E-825C-99712043E01C}' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{D15ED2E1-C75B-443c-BD7C-FC03B2F08C17}' '/ve' '/t' 'REG_SZ' '/d' 'All Tasks' '/f' | Out-Null

# --- Remove Shortcut Text ---
Write-Host "[AtlasOS tweak] Remove Shortcut Text"
# source: tweaks/qol/explorer/remove-shortcut-text.yml
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\NamingTemplates' '/v' 'ShortcutNameTemplate' '/t' 'REG_SZ' '/d' '"%s.lnk"' '/f' | Out-Null

# --- Configure Explorer to Show All Files with File Extensions ---
Write-Host "[AtlasOS tweak] Configure Explorer to Show All Files with File Extensions"
# source: tweaks/qol/explorer/show-files.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'Hidden' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'HideFileExt' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Use Compact Mode ---
Write-Host "[AtlasOS tweak] Use Compact Mode"
# source: tweaks/qol/explorer/use-compact-mode.yml
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'UseCompactMode' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Hide Disabled and Disconnected Devices in Sounds Panel ---
Write-Host "[AtlasOS tweak] Hide Disabled and Disconnected Devices in Sounds Panel"
# source: tweaks/qol/hide-disabled-disconnected-sounds.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Multimedia\Audio\DeviceCpl' '/v' 'ShowDisconnectedDevices' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Multimedia\Audio\DeviceCpl' '/v' 'ShowHiddenDevices' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable UAC Secure Desktop ---
Write-Host "[AtlasOS tweak] Disable UAC Secure Desktop"
# source: tweaks/qol/security/disable-uac-secure-desktop.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' '/v' 'PromptOnSecureDesktop' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Set Hidden Pages ---
Write-Host "[AtlasOS tweak] Set Hidden Pages"
# source: tweaks/qol/set-hidden-settings-pages.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'SettingsPageVisibility' '/t' 'REG_SZ' '/d' 'hide:recovery;maps;maps-downloadmaps;privacy;privacy-speechtyping;privacy-speech;privacy-feedback;privacy-activityhistory;search-permissions;privacy-general;sync;mobile-devices;mobile-devices-addphone;workplace;backup' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'SettingsPageVisibility' '/t' 'REG_SZ' '/d' 'hide:recovery;maps;maps-downloadmaps;privacy;privacy-feedback;privacy-activityhistory;search-permissions;privacy-general;sync;mobile-devices;mobile-devices-addphone;workplace;family-group;deviceusage;home' '/f' | Out-Null

# --- Do Not Show Edge Tabs in Alt-Tab ---
Write-Host "[AtlasOS tweak] Do Not Show Edge Tabs in Alt-Tab"
# source: tweaks/qol/shell/alt-tab-open-windows.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'MultiTaskingAltTabFilter' '/t' 'REG_DWORD' '/d' '3' '/f' | Out-Null

# --- Disable AutoRun ---
Write-Host "[AtlasOS tweak] Disable AutoRun"
# source: tweaks/qol/shell/config-autorun.yml
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers' '/v' 'DisableAutoplay' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\CameraAlternate' '/v' 'MSTakeNoAction' '/t' 'REG_NONE' '/d' '""' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\StorageOnArrival' '/v' 'MSTakeNoAction' '/t' 'REG_NONE' '/d' '""' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\CameraAlternate\ShowPicturesOnArrival' '/v' 'MSTakeNoAction' '/t' 'REG_NONE' '/d' '""' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\StorageOnArrival' '/v' 'MSTakeNoAction' '/t' 'REG_NONE' '/d' '""' '/f' | Out-Null

# --- Disable Aero Shake ---
Write-Host "[AtlasOS tweak] Disable Aero Shake"
# source: tweaks/qol/shell/disable-aero-shake.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'DisallowShaking' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Low Disk Space Checks ---
Write-Host "[AtlasOS tweak] Disable Low Disk Space Checks"
# source: tweaks/qol/shell/disable-low-disk-warning.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'NoLowDiskSpaceChecks' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Menu Hover Delay ---
Write-Host "[AtlasOS tweak] Disable Menu Hover Delay"
# source: tweaks/qol/shell/disable-menu-delay.yml
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop' '/v' 'MenuShowDelay' '/t' 'REG_SZ' '/d' '0' '/f' | Out-Null

# --- Disable Shared Experiences ---
Write-Host "[AtlasOS tweak] Disable Shared Experiences"
# source: tweaks/qol/shell/disable-nearby-sharing.yml
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\CDP\SettingsPage' '/v' 'BluetoothLastDisabledNearShare' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\CDP' '/v' 'NearShareChannelUserAuthzPolicy' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\CDP' '/v' 'CdpSessionUserAuthzPolicy' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Network Location Wizard ---
Write-Host "[AtlasOS tweak] Disable Network Location Wizard"
# source: tweaks/qol/shell/disable-network-location-wizard.yml
& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff' '/f' | Out-Null

# --- Disable Recommendations in the Start Menu ---
Write-Host "[AtlasOS tweak] Disable Recommendations in the Start Menu"
# source: tweaks/qol/shell/no-recommendations-start-menu.yml
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'Start_IrisRecommendations' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'Start_AccountNotifications' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Show More Pins in Start ---
Write-Host "[AtlasOS tweak] Show More Pins in Start"
# source: tweaks/qol/shell/show-more-pins.yml
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'Start_Layout' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Decrease Shutdown Time ---
Write-Host "[AtlasOS tweak] Decrease Shutdown Time"
# source: tweaks/qol/startup-shutdown/decrease-shutdown-time.yml
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop' '/v' 'HungAppTimeout' '/t' 'REG_SZ' '/d' '2000' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop' '/v' 'WaitToKillAppTimeOut' '/t' 'REG_SZ' '/d' '2000' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control' '/v' 'WaitToKillServiceTimeout' '/t' 'REG_SZ' '/d' '2000' '/f' | Out-Null

# --- Disable Startup Delay ---
Write-Host "[AtlasOS tweak] Disable Startup Delay"
# source: tweaks/qol/startup-shutdown/disable-startup-delay.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Serialize' '/v' 'StartupDelayInMSec' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Enable verbose startup, shutdown, logon, and logoff status messages ---
Write-Host "[AtlasOS tweak] Enable verbose startup, shutdown, logon, and logoff status messages"
# source: tweaks/qol/startup-shutdown/enable-verbose-messages.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' '/v' 'verbosestatus' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Force Close Applications On Session End ---
Write-Host "[AtlasOS tweak] Force Close Applications On Session End"
# source: tweaks/qol/startup-shutdown/force-end-shutdown-apps.yml
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop' '/v' 'AutoEndTasks' '/t' 'REG_SZ' '/d' '1' '/f' | Out-Null

# --- Configure Crash Control ---
Write-Host "[AtlasOS tweak] Configure Crash Control"
# source: tweaks/qol/system/crash-control-qol.yml
& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\CrashControl' '/v' 'AutoReboot' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\CrashControl' '/v' 'CrashDumpEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\CrashControl' '/v' 'LogEvent' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\CrashControl' '/v' 'DisplayParameters' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\CrashControl\StorageTelemetry' '/v' 'DeviceDumpEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable Windows Platform Binary Table Execution (WPBT) ---
Write-Host "[AtlasOS tweak] Disable Windows Platform Binary Table Execution (WPBT)"
# source: tweaks/qol/system/disable-wpbt.yml
& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\Session Manager' '/v' 'DisableWpbtExecution' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Show Command Prompt on Win+X ---
Write-Host "[AtlasOS tweak] Show Command Prompt on Win+X"
# source: tweaks/qol/taskbar/cmd-win-x.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'DontUsePowerShellOnWinX' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Cloud Optimized Content on Taskbar ---
Write-Host "[AtlasOS tweak] Disable Cloud Optimized Content on Taskbar"
# source: tweaks/qol/taskbar/disable-cloud-optimized-content.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\CloudContent' '/v' 'DisableCloudOptimizedContent' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Microsoft Copilot ---
Write-Host "[AtlasOS tweak] Disable Microsoft Copilot"
# source: tweaks/qol/taskbar/disable-copilot.yml
& 'reg' 'add' 'HKLM\zNTUSER\Software\Policies\Microsoft\Windows\WindowsCopilot' '/v' 'TurnOffWindowsCopilot' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Show Desktop Peek on Taskbar ---
Write-Host "[AtlasOS tweak] Disable Show Desktop Peek on Taskbar"
# source: tweaks/qol/taskbar/disable-desktop-peek.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'DisablePreviewDesktop' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Never Use Tablet Mode ---
Write-Host "[AtlasOS tweak] Never Use Tablet Mode"
# source: tweaks/qol/taskbar/disable-tablet-mode.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ImmersiveShell' '/v' 'SignInMode' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Windows Chat ---
Write-Host "[AtlasOS tweak] Disable Windows Chat"
# source: tweaks/qol/taskbar/disable-windows-chat.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\Windows Chat' '/v' 'ChatIcon' '/t' 'REG_DWORD' '/d' '3' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'TaskbarMn' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Add 'End task' to the taskbar ---
Write-Host "[AtlasOS tweak] Add 'End task' to the taskbar"
# source: tweaks/qol/taskbar/end-task.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\TaskbarDeveloperSettings' '/v' 'TaskbarEndTask' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Hide 'Meet Now' on Taskbar ---
Write-Host "[AtlasOS tweak] Hide 'Meet Now' on Taskbar"
# source: tweaks/qol/taskbar/hide-meet-now.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'HideSCAMeetNow' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Task View on Taskbar ---
Write-Host "[AtlasOS tweak] Disable Task View on Taskbar"
# source: tweaks/qol/taskbar/hide-task-view.yml
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MultiTaskingView\AllUpView' '/v' 'Enabled' '/t' 'REG_SZ' '/d' '""' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'ShowTaskViewButton' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Set Taskbar to Align Left ---
Write-Host "[AtlasOS tweak] Set Taskbar to Align Left"
# source: tweaks/qol/taskbar/set-to-left.yml
& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'TaskbarAl' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Configure Visual Effects ---
Write-Host "[AtlasOS tweak] Configure Visual Effects"
# source: tweaks/qol/visual-effects.yml
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop' '/v' 'FontSmoothing' '/t' 'REG_SZ' '/d' '2' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop' '/v' 'UserPreferencesMask' '/t' 'REG_BINARY' '/d' '9012038010000000' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop' '/v' 'DragFullWindows' '/t' 'REG_SZ' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\Desktop\WindowMetrics' '/v' 'MinAnimate' '/t' 'REG_SZ' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'ListviewAlphaSelect' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'IconsOnly' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'TaskbarAnimations' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' '/v' 'ListviewShadow' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects' '/v' 'VisualFXSetting' '/t' 'REG_DWORD' '/d' '3' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\DWM' '/v' 'EnableAeroPeek' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\DWM' '/v' 'AlwaysHibernateThumbnails' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Disable WU Auto-Reboot ---
Write-Host "[AtlasOS tweak] Disable WU Auto-Reboot"
# source: tweaks/qol/windows-update/disable-auto-reboot.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' '/v' 'AUPowerManagement' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' '/v' 'NoAutoRebootWithLoggedOnUsers' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable Delivery Optimization ---
Write-Host "[AtlasOS tweak] Disable Delivery Optimization"
# source: tweaks/qol/windows-update/disable-delivery-optimization.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization' '/v' 'DODownloadMode' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null

# --- Restrict Windows Insider ---
Write-Host "[AtlasOS tweak] Restrict Windows Insider"
# source: tweaks/qol/windows-update/disable-insider.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' '/v' 'ManagePreviewBuilds' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' '/v' 'ManagePreviewBuildsPolicyValue' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\PreviewBuilds' '/v' 'AllowBuildPreview' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\PreviewBuilds' '/v' 'EnableConfigFlighting' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\PreviewBuilds' '/v' 'EnableExperimentation' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\WindowsSelfHost\UI\Visibility' '/v' 'HideInsiderPage' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Disable MSRT telemetry ---
Write-Host "[AtlasOS tweak] Disable MSRT telemetry"
# source: tweaks/qol/windows-update/disable-msrt-telemetry.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\MRT' '/v' 'DontReportInfectionInformation' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\RemovalTools\MpGears' '/v' 'HeartbeatTrackingIndex' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\RemovalTools\MpGears' '/v' 'SpyNetReportingLocation' '/t' 'REG_MULTI_SZ' '/d' '""' '/f' | Out-Null

# --- Disable WU Nagging ---
Write-Host "[AtlasOS tweak] Disable WU Nagging"
# source: tweaks/qol/windows-update/disable-nagging.yml
& 'reg' 'add' 'HKLM\zSOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' '/v' 'NoAUAsDefaultShutdownOption' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\WindowsUpdate\UX\Settings' '/v' 'HideMCTLink' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

# --- Blocks Anonymous Enumeration of SAM Accounts ---
Write-Host "[AtlasOS tweak] Blocks Anonymous Enumeration of SAM Accounts"
# source: tweaks/security/block-anonymous-enum-sam.yml
& 'reg' 'add' 'HKLM\zSYSTEM\CurrentControlSet\Control\Lsa' '/v' 'RestrictAnonymousSAM' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

## Add first run key to disable OOBE on first boot
#Write-Host "Adding First Run key to disable OOBE on first boot..."
#& 'reg' 'add' 'HKLM\zNTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'FirstRunCompleted' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null

## Run winsetupcomplete.ps1 on first boot
#Write-Host "Setting up winsetupcomplete.ps1 to run on first boot..."
#reg add "HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\Run" /v "FirstSetup" /t REG_SZ /d "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\Windows\Setup\Scripts\FirstLogon.ps1\"" /f
#& 'reg' 'add' 'HKLM\zNTUSER\Microsoft\Windows\CurrentVersion\RunOnce' '/v' 'FirstSetup' '/t' 'REG_SZ' '/d' 'Powershell -ExecutionPolicy Bypass -File "%SystemRoot%\Windows\Setup\Scripts\winsetupcomplete.ps1"' '/f' | Out-Null

# Explorer\Advanced is TrustedInstaller-owned in both the DEFAULT and NTUSER stock hives, so
# the "Disabling widgets in taskbar" tweak further down (which writes TaskbarDa under both)
# would otherwise fail with "Access is denied" every single build.
Write-Host "Taking ownership of Explorer Advanced settings..."
if (Set-OfflineRegistryOwnership "zDEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced") {
    Write-Host "Explorer Advanced (DEFAULT) ownership taken."
}
if (Set-OfflineRegistryOwnership "zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced") {
    Write-Host "Explorer Advanced (NTUSER) ownership taken."
}

Write-Host "Disabling widgets in taskbar..."
# Writing via the .NET handle directly (rather than a separate reg.exe process) rules out
# any doubt about whether a freshly-spawned process picks up the ACL change we just made,
# and surfaces a real exception message if this is still denied for some other reason.
foreach ($advKeyPath in @(
    "zDEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced",
    "zNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
)) {
    $advKey = $null
    try {
        # try/finally here is load-bearing: if SetValue throws, skipping Close() would leave
        # this hive's file locked, which makes "reg unload" fail with Access Denied further
        # down and can cascade into the DISM cleanup step failing outright afterward.
        $advKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey($advKeyPath, $true)
        $advKey.SetValue("TaskbarDa", 0, [Microsoft.Win32.RegistryValueKind]::DWord)
    } catch {
        Write-Warning "Failed to set TaskbarDa under HKLM\$advKeyPath : $($_.Exception.Message)"
    } finally {
        if ($advKey) { $advKey.Close() }
    }
}

# Clean up settings menu
#Write-Host "Cleaning up Settings menu..."
#& 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' '/v' 'SettingsPageVisibility' '/t' 'REG_SZ' '/d' 'hide:virus;mobile-devices;gaming;cortana;search;maps;yourinfo;workplace;backup;sync;findmydevice;developers;activation;deviceencryption' '/f' | Out-Null

Write-Host "Tweaking complete!"
Write-Host "Unmounting Registry..."
reg unload HKLM\zCOMPONENTS | Out-Null
reg unload HKLM\zDEFAULT | Out-Null
reg unload HKLM\zNTUSER | Out-Null
reg unload HKLM\zSOFTWARE | Out-Null
reg unload HKLM\zSYSTEM | Out-Null

Write-Host "Cleaning up image..."
# /ResetBase permanently deletes superseded package versions from the component store. This
# means the OUTPUT of this build (install.wim/install.esd/the final ISO) can never be used as
# a DISM/SFC repair source later - those files are gone from every copy of this build, not
# just the one being repaired. Users needing to repair their installed system's component
# store must use the ORIGINAL, untouched stock Windows ISO as /Source, not this tweaked one.
dism.exe /Image:$ScratchDisk\scratchdir /Cleanup-Image /StartComponentCleanup /ResetBase
Write-Host "Cleanup complete."
Write-Host ' '

# --- Build a local repair source for DISM RestoreHealth / SFC (self-healing without the
# original ISO) ---
# Ported from AtlasOS (src/playbook/Executables/AtlasModules/Scripts/packageInstall.ps1,
# MakeRepairSource) - see https://learn.microsoft.com/windows-hardware/manufacture/desktop/configure-a-windows-repair-source
# Hardlinks the post-cleanup WinSxS manifests (not the payload - manifests are small XML
# files, so hardlinking costs ~0 extra disk space since they point at the same data already
# in WinSxS) into %SystemRoot%\RepairSource\Manifests, then points the legacy CBS servicing
# policy at it so DISM/SFC stop asking for install media. Must run AFTER ResetBase so the
# manifest set matches what's actually still in WinSxS post-cleanup.
Write-Host "Building local component-store repair source..."
$repairSrcPath = "$ScratchDisk\scratchdir\Windows\RepairSource\Manifests"
New-Item -ItemType Directory -Path $repairSrcPath -Force | Out-Null
$repairManifests = Get-ChildItem "$ScratchDisk\scratchdir\Windows\WinSxS\Manifests" -File -Filter "*.manifest" -ErrorAction SilentlyContinue
if ($repairManifests.Count -gt 0) {
    Write-Host "Hard linking $($repairManifests.Count) manifests (this is silent-but-not-hung; progress every 2000 files)..."
    $manifestCounter = 0
    foreach ($manifest in $repairManifests) {
        try {
            # Creating a hard link needs WRITE_ATTRIBUTES on the source file (its link count
            # gets bumped), which Administrators don't have on TrustedInstaller-owned WinSxS
            # manifests - falls back to a real copy (read-only access is enough for that).
            # Also: New-Item -ItemType HardLink's Win32Exception ignores -ErrorAction
            # SilentlyContinue, so -ErrorAction Stop + try/catch is required to suppress it.
            New-Item -ItemType HardLink -Path "$repairSrcPath\$($manifest.Name)" -Target $manifest.FullName -ErrorAction Stop | Out-Null
        } catch {
            Copy-Item -Path $manifest.FullName -Destination "$repairSrcPath\$($manifest.Name)" -Force -ErrorAction SilentlyContinue
        }
        $manifestCounter++
        if ($manifestCounter % 2000 -eq 0) {
            Write-Host "  ...$manifestCounter / $($repairManifests.Count) manifests linked"
        }
    }
    reg load HKLM\zSOFTWARE $ScratchDisk\scratchdir\Windows\System32\config\SOFTWARE | Out-Null
    & 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Servicing' '/v' 'LocalSourcePath' '/t' 'REG_EXPAND_SZ' '/d' '%SystemRoot%\RepairSource' '/f' | Out-Null
    reg unload HKLM\zSOFTWARE | Out-Null
    Write-Host "Repair source created with $($repairManifests.Count) manifests."
} else {
    Write-Warning "No WinSxS manifests found - skipping repair source creation."
}

# Verify the component store isn't corrupt before we capture it.
# Note: /AnalyzeComponentStore only works against the *running* OS (online), not an
# offline-mounted image, so it can't gate this step - it just reports store size/cleanup
# recommendations, not a healthy/unhealthy verdict. /ScanHealth is the offline-capable
# corruption check and is what actually has a pass/fail result worth aborting the build on.
# 'Repairable' is allowed through on purpose - we don't attempt an offline repair (the only
# source available is this same image, which can't fix genuine corruption in itself), and the
# local repair source built above means the SHIPPED install can still self-heal via DISM/SFC
# once it's running online (with access to Windows Update or install media as a real source).
# Only 'NonRepairable' aborts the build, since at that point nothing - not even the shipped
# install - would be able to fix it later either.
Write-Host "Verifying component store health before capture..."
$healthCheck = Repair-WindowsImage -Path $ScratchDisk\scratchdir -ScanHealth
if ($healthCheck.ImageHealthState -eq 'NonRepairable') {
    Write-Error "Component store health check failed (state: NonRepairable). Aborting build - image was NOT captured."
    Dismount-WindowsImage -Path $ScratchDisk\scratchdir -Discard | Out-Null
    exit 1
}
Write-Host "Component store health: $($healthCheck.ImageHealthState)."

Write-Host "Unmounting image..."
Dismount-WindowsImage -Path $ScratchDisk\scratchdir -Save
Write-Host "Exporting image..."
# Compressiontype Recovery is not supported with PShell https://learn.microsoft.com/en-us/powershell/module/dism/export-windowsimage?view=windowsserver2022-ps#-compressiontype
#Export-WindowsImage -SourceImagePath $ScratchDisk\tiny11\sources\install.wim -SourceIndex $index -DestinationImagePath $ScratchDisk\tiny11\sources\install2.wim -CompressionType Fast
#& dism /English /Export-Image "/SourceImageFile:$ScratchDisk\tiny11\sources\install.wim" "/SourceIndex:$index" "/DestinationImageFile:$ScratchDisk\tiny11\sources\install2.wim" /Compress:max
#Remove-Item -Path "$ScratchDisk\tiny11\sources\install.wim" -Force | Out-Null
#Rename-Item -Path "$ScratchDisk\tiny11\sources\install2.wim" -NewName "install.wim" | Out-Null
# Run `Export-WindowsImage` with undocumented CompressionType "LZMS" (which is the same compression used for Recovery from dism.exe)
Export-WindowsImage -SourceImagePath "$ScratchDisk\tiny11\sources\install.wim" -SourceIndex $index -DestinationImagePath "$ScratchDisk\tiny11\sources\install2.wim" -CompressionType "LZMS"
if (Test-Path "$ScratchDisk\tiny11\sources\install2.wim") {
    Move-Item -Path "$ScratchDisk\tiny11\sources\install2.wim" -Destination "$ScratchDisk\tiny11\sources\install.wim" -Force | Out-Null
} else {
    Write-Warning "LZMS re-compression failed (OOM?). Continuing with original install.wim."
}
Write-Host "Windows image completed. Continuing with boot.wim."
Start-Sleep -Seconds 2
Clear-Host
Write-Host "Mounting boot image:"
$wimFilePath = "$ScratchDisk\tiny11\sources\boot.wim" 
& takeown "/F" $wimFilePath | Out-Null
& icacls $wimFilePath "/grant" "$($adminGroup.Value):(F)"
Set-ItemProperty -Path $wimFilePath -Name IsReadOnly -Value $false
Mount-WindowsImage -ImagePath $ScratchDisk\tiny11\sources\boot.wim -Index 2 -Path $ScratchDisk\scratchdir
Write-Host "Loading registry..."
reg load HKLM\zCOMPONENTS $ScratchDisk\scratchdir\Windows\System32\config\COMPONENTS
reg load HKLM\zDEFAULT $ScratchDisk\scratchdir\Windows\System32\config\default
reg load HKLM\zNTUSER $ScratchDisk\scratchdir\Users\Default\ntuser.dat
reg load HKLM\zSOFTWARE $ScratchDisk\scratchdir\Windows\System32\config\SOFTWARE
reg load HKLM\zSYSTEM $ScratchDisk\scratchdir\Windows\System32\config\SYSTEM
Write-Host "Bypassing system requirements(on the setup image)..."
& 'reg' 'add' 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV1' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zDEFAULT\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV2' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV1' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zNTUSER\Control Panel\UnsupportedHardwareNotificationCache' '/v' 'SV2' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassCPUCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassRAMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassSecureBootCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassStorageCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassTPMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
& 'reg' 'add' 'HKLM\zSYSTEM\Setup\MoSetup' '/v' 'AllowUpgradesWithUnsupportedTPMOrCPU' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
if ($IgnoreSecBoot) {
    & 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'IgnoreSecBootBootRes' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
}
Write-Host "Tweaking complete! Unmounting Registry..."
reg unload HKLM\zCOMPONENTS | Out-Null
reg unload HKLM\zDEFAULT | Out-Null
reg unload HKLM\zNTUSER | Out-Null
reg unload HKLM\zSOFTWARE | Out-Null
reg unload HKLM\zSYSTEM | Out-Null
if ($replaceBranding -and (Test-Path $brandingBootRes)) {
    Write-Host "Copying bootres.dll to boot image..."
    foreach ($bootresPath in @(
        "$ScratchDisk\scratchdir\Windows\Boot\EFI\bootres.dll",
        "$ScratchDisk\scratchdir\Windows\Boot\PCAT\bootres.dll",
        "$ScratchDisk\scratchdir\Windows\Boot\Resources\bootres.dll"
    )) {
        if (Test-Path $bootresPath) {
            & 'takeown' '/f' $bootresPath | Out-Null
            & 'icacls' $bootresPath '/grant' "$($adminGroup.Value):(F)" '/C' | Out-Null
            Copy-Item -Path $brandingBootRes -Destination $bootresPath -Force | Out-Null
        }
    }
}
# Change the background.bmp in the sources folder of the boot image
& takeown "/F" "$ScratchDisk\scratchdir\sources\background.bmp" | Out-Null
& icacls "$ScratchDisk\scratchdir\sources\background.bmp" "/grant" "$($adminGroup.Value):(F)"
Remove-Item -Path "$ScratchDisk\scratchdir\sources\background.bmp" -Force | Out-Null
Copy-Item -Path "$PSScriptRoot\includes\branding-resources\setup-bg.bmp" -Destination "$ScratchDisk\scratchdir\sources\background.bmp" -Force | Out-Null
# Change the setup.bmp in the system32 folder of the boot image
& takeown "/F" "$ScratchDisk\scratchdir\Windows\system32\setup.bmp" | Out-Null
& icacls "$ScratchDisk\scratchdir\Windows\system32\setup.bmp" "/grant" "$($adminGroup.Value):(F)"
Remove-Item -Path "$ScratchDisk\scratchdir\Windows\system32\setup.bmp" -Force | Out-Null
Copy-Item -Path "$PSScriptRoot\includes\branding-resources\setup-bg.bmp" -Destination "$ScratchDisk\scratchdir\Windows\system32\setup.bmp" -Force | Out-Null
& takeown "/F" "$ScratchDisk\scratchdir\sources\spwizimg.dll" | Out-Null
& icacls "$ScratchDisk\scratchdir\sources\spwizimg.dll" "/grant" "$($adminGroup.Value):(F)"
# Copy in new spwizimg.dll with custom spwizimg.dll resource if it exists
if (Test-Path -Path "$PSScriptRoot\includes\spwizimg.dll") {
    Write-Host "Custom spwizimg.dll found. Replacing in boot image..."
    Copy-Item -Path "$PSScriptRoot\includes\spwizimg.dll" -Destination "$ScratchDisk\scratchdir\sources\spwizimg.dll" -Force | Out-Null
}
# If there is a spwizimg-resources folder, use the resources inside to modify spwizimg.dll
elseif (Test-Path -Path "$PSScriptRoot\includes\branding-resources\spwizimg-resources\" ) {
    Write-Host "Custom spwizimg-resources folder found. Modifying spwizimg.dll in boot image..."
    $resourceFiles = Get-ChildItem -Path "$PSScriptRoot\includes\branding-resources\spwizimg-resources\" -File
    # Create a copy of spwizimg.dll to work on
    Copy-Item -Path "$ScratchDisk\scratchdir\sources\spwizimg.dll" -Destination "$ScratchDisk\scratchdir\sources\spwizimg-temp.dll" -Force | Out-Null
    foreach ($resourceFile in $resourceFiles) {
        $resourceName = $resourceFile.Name
        $resourcePath = $resourceFile.FullName
        # Extract resource ID from the filename (format: 405.png)
        if ($resourceName -match "^(\d+)\.png$") {
            # If the name is "setup-bg.png", set resource ID to 517
            if ($resourceName -eq "setup-bg.png") {
                $resourceId = 517
            } else {
                $resourceId = $matches[1]
            }
            
            # Use Resource Hacker to add/overwrite the resource in spwizimg.dll
            Start-Process -FilePath "$PSScriptRoot\includes\utils\ResourceHacker.exe" -ArgumentList `
                "-open `"$ScratchDisk\scratchdir\sources\spwizimg-temp.dll`"", `
                "-save `"$ScratchDisk\scratchdir\sources\spwizimg-temp.dll2`"", `
                "-action addoverwrite", `
                "-resource `"$resourcePath`"", `
                "-mask PNG,$resourceId,1033" `
                -NoNewWindow -Wait
            
            # Replace the temp dll with the modified one for the next iteration
            Remove-Item -Path "$ScratchDisk\scratchdir\sources\spwizimg-temp.dll" -Force | Out-Null
            Rename-Item -Path "$ScratchDisk\scratchdir\sources\spwizimg-temp.dll2" -NewName "spwizimg-temp.dll" | Out-Null
        }
    }

    # After all resources have been processed, replace the original spwizimg.dll
    Remove-Item -Path "$ScratchDisk\scratchdir\sources\spwizimg.dll" -Force | Out-Null
    Rename-Item -Path "$ScratchDisk\scratchdir\sources\spwizimg-temp.dll" -NewName "spwizimg.dll" | Out-Null
}
# If no custom spwizimg.dll or spwizimg-resources folder, just replace the setup background image
else {
    Write-Host "No custom spwizimg.dll or resources found. Replacing setup background image in spwizimg.dll..."
    Start-Process -FilePath "$PSScriptRoot\includes\utils\ResourceHacker.exe" -ArgumentList `
        "-open `"$ScratchDisk\scratchdir\sources\spwizimg.dll`"", `
        "-save `"$ScratchDisk\scratchdir\sources\spwizimg.dll2`"", `
        "-action addoverwrite", `
        "-resource `"$PSScriptRoot\includes\branding-resources\spwizimg-resources\setup-bg.png`"", `
        "-mask IMAGE,517,1033" `
        -NoNewWindow -Wait
    Remove-Item -Path "$ScratchDisk\scratchdir\sources\spwizimg.dll" -Force | Out-Null
    Rename-Item -Path "$ScratchDisk\scratchdir\sources\spwizimg.dll2" -NewName "spwizimg.dll" | Out-Null
}
Write-Host "Unmounting image..."
Dismount-WindowsImage -Path $ScratchDisk\scratchdir -Save
Clear-Host
Write-Host "The tiny11 image is now completed. Proceeding with the making of the ISO..."
Write-Host "Copying unattended file for bypassing MS account on OOBE..."
Copy-Item -Path "$PSScriptRoot\includes\autounattend-win11.xml" -Destination "$ScratchDisk\tiny11\autounattend.xml" -Force | Out-Null
# If there is a $OEM$ folder, copy it to the setup image
if (Test-Path -Path "${PSScriptRoot}\includes\`$OEM$") {
    Write-Host 'Adding $OEM$ to the setup image...'
    Copy-Item -Path "${PSScriptRoot}\includes\`$OEM$" -Destination "$ScratchDisk\tiny11\sources\`$OEM$" -Recurse -Force | Out-Null
    if (Test-Path "$PSScriptRoot\includes\utils\multi-staller\dist\MultiStaller.exe") {
        Copy-Item -Path "$PSScriptRoot\includes\utils\multi-staller\dist\MultiStaller.exe" -Destination "$ScratchDisk\tiny11\sources\`$OEM$\`$$\OEM\" -Force | Out-Null
    }
}
# If there is a WinPE_Drivers folder, copy it to the setup image
if (Test-Path -Path "${PSScriptRoot}\includes\WinPE_Drivers") {
    Write-Host 'Adding WinPE_Drivers to the setup image...'
    Copy-Item -Path "${PSScriptRoot}\includes\WinPE_Drivers" -Destination "$ScratchDisk\tiny11\WinPE_Drivers" -Recurse -Force | Out-Null
}
# Change the setup background bmp in the sources folder
Write-Host "Changing setup background image in setup image..."
& takeown "/F" "$ScratchDisk\tiny11\sources\background_cli.bmp" | Out-Null
& icacls "$ScratchDisk\tiny11\sources\background_cli.bmp" "/grant" "$($adminGroup.Value):(F)"
Copy-Item -Path "$PSScriptRoot\includes\branding-resources\setup-bg.bmp" -Destination "$ScratchDisk\tiny11\sources\background_cli2.bmp" -Force | Out-Null
Remove-Item -Path "$ScratchDisk\tiny11\sources\background_cli.bmp" -Force | Out-Null
Rename-Item -Path "$ScratchDisk\tiny11\sources\background_cli2.bmp" -NewName "background_cli.bmp" | Out-Null
# Change the setup image spwizimg.dll in the sources folder
& takeown "/F" "$ScratchDisk\tiny11\sources\spwizimg.dll" | Out-Null
& icacls "$ScratchDisk\tiny11\sources\spwizimg.dll" "/grant" "$($adminGroup.Value):(F)"
# Copy in new spwizimg.dll with custom spwizimg.dll resource if it exists
if (Test-Path -Path "$PSScriptRoot\includes\spwizimg.dll") {
    Write-Host "Custom spwizimg.dll found. Replacing in setup image..."
    Copy-Item -Path "$PSScriptRoot\includes\spwizimg.dll" -Destination "$ScratchDisk\tiny11\sources\spwizimg.dll" -Force | Out-Null
}
# If there is a spwizimg-resources folder, use the resources inside to modify spwizimg.dll
elseif (Test-Path -Path "$PSScriptRoot\includes\spwizimg-res\") {
    Write-Host "Custom spwizimg-resources folder found. Modifying spwizimg.dll in setup image..."
    $resourceFiles = Get-ChildItem -Path "$PSScriptRoot\includes\branding-resources\spwizimg-resources\" -File
    # Create a copy of spwizimg.dll to work on
    Copy-Item -Path "$ScratchDisk\tiny11\sources\spwizimg.dll" -Destination "$ScratchDisk\tiny11\sources\spwizimg-temp.dll" -Force | Out-Null
    foreach ($resourceFile in $resourceFiles) {
        $resourceName = $resourceFile.Name
        $resourcePath = $resourceFile.FullName
        # Extract resource ID from the filename (format: 405.png)
        if ($resourceName -match "^(\d+)\.png$") {
            # If the name is "setup-bg.png", set resource ID to 517
            if ($resourceName -eq "setup-bg.png") {
                $resourceId = 517
            } else {
                $resourceId = $matches[1]
            }
            
            # Use Resource Hacker to add/overwrite the resource in spwizimg.dll
            Start-Process -FilePath "$PSScriptRoot\includes\utils\ResourceHacker.exe" -ArgumentList `
                "-open `"$ScratchDisk\tiny11\sources\spwizimg-temp.dll`"", `
                "-save `"$ScratchDisk\tiny11\sources\spwizimg-temp.dll2`"", `
                "-action addoverwrite", `
                "-resource `"$resourcePath`"", `
                "-mask PNG,$resourceId,1033" `
                -NoNewWindow -Wait
            
            # Replace the temp dll with the modified one for the next iteration
            Remove-Item -Path "$ScratchDisk\tiny11\sources\spwizimg-temp.dll" -Force | Out-Null
            Rename-Item -Path "$ScratchDisk\tiny11\sources\spwizimg-temp.dll2" -NewName "spwizimg-temp.dll" | Out-Null
        }
    }

    # After all resources have been processed, replace the original spwizimg.dll
    Remove-Item -Path "$ScratchDisk\tiny11\sources\spwizimg.dll" -Force | Out-Null
    Rename-Item -Path "$ScratchDisk\tiny11\sources\spwizimg-temp.dll" -NewName "spwizimg.dll" | Out-Null
}
# If no custom spwizimg.dll or spwizimg-resources folder, just replace the setup background image
else {
    Write-Host "No custom spwizimg.dll or resources found. Replacing setup background image in spwizimg.dll..."
    Start-Process -FilePath "$PSScriptRoot\includes\utils\ResourceHacker.exe" -ArgumentList `
        "-open `"$ScratchDisk\tiny11\sources\spwizimg.dll`"", `
        "-save `"$ScratchDisk\tiny11\sources\spwizimg.dll2`"", `
        "-action addoverwrite", `
        "-resource `"$PSScriptRoot\includes\branding-resources\spwizimg-resources\setup-bg.png`"", `
        "-mask IMAGE,517,1033" `
        -NoNewWindow -Wait
    Remove-Item -Path "$ScratchDisk\tiny11\sources\spwizimg.dll" -Force | Out-Null
    Rename-Item -Path "$ScratchDisk\tiny11\sources\spwizimg.dll2" -NewName "spwizimg.dll" | Out-Null
}

# Add additional install.wim or install.esd files to the main install.wim
Write-Host "Checking for additional install.wim or install.esd files..."
$additionalWIM = Get-Item "$PSScriptRoot\includes\install.wim" -ErrorAction SilentlyContinue
$additionalESD = Get-Item "$PSScriptRoot\includes\install.esd" -ErrorAction SilentlyContinue

# Define the main install.wim path
$mainWIM = "$ScratchDisk\tiny11\sources\install.wim"

if ($additionalWIM) {
    Write-Host "Additional WIM file found: $($additionalWIM.FullName). Adding it to the main install.wim..."
    
    # Get all images from the additional WIM and add them
    $additionalImages = Get-WindowsImage -ImagePath $additionalWIM.FullName
    foreach ($imageInfo in $additionalImages) {
        $imageIndex = $imageInfo.ImageIndex
        $imageName = $imageInfo.ImageName
        Write-Host "Adding image $imageIndex`: $imageName from WIM file..."
        & 'dism' '/Export-Image' "/SourceImageFile:$($additionalWIM.FullName)" "/SourceIndex:$imageIndex" "/DestinationImageFile:$mainWIM" '/Compress:max' '/CheckIntegrity'
    }
    
    Write-Host "Successfully added all images from $($additionalWIM.FullName) to the main install.wim."
}

if ($additionalESD) {
    Write-Host "Additional ESD file found: $($additionalESD.FullName). Adding it to the main install.wim..."
    
    # Get all images from the additional ESD and add them
    $additionalImages = Get-WindowsImage -ImagePath $additionalESD.FullName
    foreach ($imageInfo in $additionalImages) {
        $imageIndex = $imageInfo.ImageIndex
        $imageName = $imageInfo.ImageName
        Write-Host "Adding image $imageIndex`: $imageName from ESD file..."
        & 'dism' '/Export-Image' "/SourceImageFile:$($additionalESD.FullName)" "/SourceIndex:$imageIndex" "/DestinationImageFile:$mainWIM" '/Compress:max' '/CheckIntegrity'
    }
    
    Write-Host "Successfully added all images from $($additionalESD.FullName) to the main install.wim."
}

if (-not $additionalWIM -and -not $additionalESD) {
    Write-Host "No additional WIM or ESD files found."
}

# convert the install.wim to install.esd
Write-Host "Converting install.wim to install.esd..."

# Get all image indexes from the install.wim
$allImages = Get-WindowsImage -ImagePath "$ScratchDisk\tiny11\sources\install.wim"
Write-Host "Found $($allImages.Count) image(s) in install.wim"

# Export all images to install.esd using DISM.exe (since PowerShell DISM module doesn't support Recovery compression)
$esdConvertOk = $true
foreach ($imageInfo in $allImages) {
    $currentIndex = $imageInfo.ImageIndex
    $imageName = $imageInfo.ImageName
    Write-Host "Exporting image $currentIndex`: $imageName..."

    if ($currentIndex -eq $allImages[0].ImageIndex) {
        # First image - create new install.esd in the working directory
        & dism /English /Export-Image "/SourceImageFile:$ScratchDisk\tiny11\sources\install.wim" "/SourceIndex:$currentIndex" "/DestinationImageFile:$ScratchDisk\tiny11\sources\install.esd" /Compress:recovery /CheckIntegrity
    }
    else {
        # Subsequent images - append to existing install.esd
        & dism /English /Export-Image "/SourceImageFile:$ScratchDisk\tiny11\sources\install.wim" "/SourceIndex:$currentIndex" "/DestinationImageFile:$ScratchDisk\tiny11\sources\install.esd" /Compress:recovery /CheckIntegrity
    }
    if ($LASTEXITCODE -ne 0) {
        Write-Warning "ESD conversion failed (exit $LASTEXITCODE). Keeping install.wim and skipping ESD step."
        Remove-Item -Path "$ScratchDisk\tiny11\sources\install.esd" -Force -ErrorAction SilentlyContinue | Out-Null
        $esdConvertOk = $false
        break
    }
}

if ($esdConvertOk) {
    Remove-Item -Path "$ScratchDisk\tiny11\sources\install.wim" -Force | Out-Null
    Write-Host "All images converted from install.wim to install.esd successfully."
} else {
    Write-Host "ESD conversion skipped. ISO will use install.wim (larger but functional)."
}

Write-Host "Creating ISO image..."
# Get Windows ADK path from registry(following Visual Studio's winsdk.bat approach).
$WinSDKPath = [Microsoft.Win32.Registry]::GetValue("HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Kits\Installed Roots", "KitsRoot10", $null)
if ($null -eq $WinSDKPath) {
    $WinSDKPath = [Microsoft.Win32.Registry]::GetValue("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Kits\Installed Roots", "KitsRoot10", $null)
}

if ($null -ne $WinSDKPath) {
    # Trim the following backslash for path concatenation.
    $WinSDKPath = $WinSDKPath.TrimEnd('\')
    $ADKDepTools = "$WinSDKPath\Assessment and Deployment Kit\Deployment Tools\$hostarchitecture\Oscdimg"
}
$localOSCDIMGPath = "$PSScriptRoot\includes\utils\oscdimg.exe"

if ((Test-Path variable:ADKDepTools) -and (Test-Path "$ADKDepTools\oscdimg.exe" -PathType leaf)) {
    Write-Host "Will be using oscdimg.exe from system ADK."
    $OSCDIMG = "$ADKDepTools\oscdimg.exe"
}
else {
    Write-Host "oscdimg.exe from system ADK not found. Will be using bundled oscdimg.exe."
    
    $url = "https://msdl.microsoft.com/download/symbols/oscdimg.exe/3D44737265000/oscdimg.exe"

    if (![System.IO.File]::Exists($localOSCDIMGPath)) {
        Write-Host "Downloading oscdimg.exe..."
        Invoke-WebRequest -Uri $url -OutFile $localOSCDIMGPath

        if ([System.IO.File]::Exists($localOSCDIMGPath)) {
            Write-Host "oscdimg.exe downloaded successfully."
        }
        else {
            Write-Error "Failed to download oscdimg.exe."
            exit 1
        }
    }
    else {
        Write-Host "oscdimg.exe already exists locally."
    }

    $OSCDIMG = $localOSCDIMGPath
}

& "$OSCDIMG" "-lTiny11_$architecture" '-m' '-o' '-u2' '-udfver102' "-bootdata:2#p0,e,b$ScratchDisk\tiny11\boot\etfsboot.com#pEF,e,b$ScratchDisk\tiny11\efi\microsoft\boot\efisys.bin" "$ScratchDisk\tiny11" "$PSScriptRoot\tiny11.iso"

# Finishing up
Write-Host "Creation completed! Performing Cleanup..."

# Safety net: the hives/wim mount should already be unloaded/dismounted by the tweak steps
# above, but if any of those were skipped or failed silently, an unloaded hive or a still-
# mounted scratchdir will make the Remove-Item calls below fail (files in use) and leave
# the image mounted for the next run. No-ops if everything is already clean.
Write-Host "Verifying registry hives are unloaded..."
foreach ($hive in @('zCOMPONENTS', 'zDEFAULT', 'zNTUSER', 'zSOFTWARE', 'zSYSTEM')) {
    if (Test-Path "Registry::HKEY_LOCAL_MACHINE\$hive") {
        Write-Host "  $hive still loaded - unloading."
        reg unload "HKLM\$hive" | Out-Null
    }
}
Write-Host "Verifying scratch image is unmounted..."
if (Get-WindowsImage -Mounted -ErrorAction SilentlyContinue | Where-Object { $_.Path -eq "$ScratchDisk\scratchdir" }) {
    Write-Host "  Scratch image still mounted - discarding and dismounting."
    Dismount-WindowsImage -Path "$ScratchDisk\scratchdir" -Discard -ErrorAction SilentlyContinue | Out-Null
}
dism.exe /cleanup-mountpoints | Out-Null

Remove-Item -Path "$ScratchDisk\tiny11" -Recurse -Force | Out-Null
Remove-Item -Path "$ScratchDisk\scratchdir" -Recurse -Force | Out-Null

# Unmount ISO if we auto-mounted it
if ($mountedISO) {
    Write-Host "Unmounting ISO: $mountedISO"
    Dismount-DiskImage -ImagePath $mountedISO -ErrorAction SilentlyContinue | Out-Null
    Write-Host "ISO unmounted."
}

# Stop the transcript
Stop-Transcript

exit