Skip to main content

Disable SmartScreen Enhanced Phishing Protection Web background services

Apply Now
Works with Windows 10 and 11Works with Windows Vista, XP, 7, 8, 10, 11, and Windows Server 2008 or newer.
  • Single actionThis page belongs to a script, containing basic changes to achieve a task.
  • Windows onlyThis script improves your privacy on Windows
  • Impact: HighSystem Functionality Loss Risk: High
    This action improves privacy with high impact when you run the recommended script.
  • Batch (batchfile)These changes use Windows system commands to update your settings.
  • Fully reversible

    You can fully restore this action (revert back to the original behavior) using this website.

    The restore/revert methods provided here can help you fix issues.

Overview

This script disables the webthreatdefsvc and webthreatdefusersvc services.

These services enhance security by monitoring for unauthorized access to user credentials 1 2 3. However, these services also collect telemetry 4 5 and sensor data 5, raising privacy concerns. Disabling these services reduces this data collection, thereby enhancing privacy.

Additionally, these services require opening firewall ports 6 and running background services 6, which may increase your attack surface and reduce security.

Disabling these services may also improve system performance by reducing background activity.

However, disabling these services may reduce protection against some web threats.

Caution

Disabling this service may reduce your defense against certain web threats.

Technical Details

This script disables the related services, their files and COM registrations.

Services Overview

ServiceService NameService File
webthreatdefsvcWeb Threat Defense Endpoint Service 1%SYSTEMROOT%\System32\webthreatdefsvc.dll 1 6
webthreatdefusersvcWeb Threat Defense User Service 2 3%SYSTEMROOT%\System32\webthreatdefusersvc.dll 2

Both services send data to Microsoft, including telemetry data from MicrosoftTelemetryAssertTriggeredUM 4 5 and sensor data Office App Sensor 5.

These services are associated with the Microsoft Defender for Endpoint suite. This program was formerly known as Windows Advanced Threat Protection 7. They read settings from Software\Microsoft\Windows Advanced Threat Protection 4. These settings manage Defender for Endpoint 8.

These services are linked to SmartScreen Enhanced Phishing Protection because:

  • They access configurations under Policies\Microsoft\Windows\WTDS\Components 4, which are specific to SmartScreen Enhanced Phishing Protection 9.
  • They are named Web Threat Defense, and SmartScreen Enhanced Phishing Protection is technically named WebThreatDefense 9.

They are available on Windows 11 22H2 and later but are missing on earlier Windows versions 1 2, including Windows 10.

Services Files

  • webthreatdefsvc.dll manages web threats using threat intelligence (via ThreatIntelligence.dll) and interfaces with system resources 4 10.
  • webthreatdefusersvc.dll provides threat detection and management at the user level, integrating with real-time monitoring and user activities in Office applications 5 11.

Registry clean-up

This script cleans up following registry keys related to the service:

  • HKLM\SOFTWARE\Microsoft\WindowsRuntime\Server\WebThreatDefSvc 6 for COM server implementation.
  • HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\WebThreatDefense 6 for service host registration.
  • HKCR\Interface\{ac889b17-df54-4854-a439-d7b68d1e16e8} 6 for interface registration.
  • HKCR\CLSID\{E2F1C91D-C762-4B5A-A8C1-4734E48C5FF4} 6 for COM class registration.
  • HKLM\Software\Microsoft\WindowsRuntime\ActivatableClassId\Microsoft.OneCore.WebThreatDefense.Service.UserSessionServiceManager 6 for Windows Runtime class activation.
  • HKLM\Software\Microsoft\WindowsRuntime\ActivatableClassId\Microsoft.OneCore.WebThreatDefense.Configuration.WTDUserSettings 6 for Windows Runtime configuration settings.

Overview of default service statuses

webthreatdefsvc:

OS VersionStatusStart type
Windows 10 (≥ 22H2)🟡 MissingN/A
Windows 11 (≥ 23H2)🟢 RunningManual

webthreatdefusersvc:

OS VersionStatusStart type
Windows 10 (≥ 22H2)🟡 MissingN/A
Windows 11 (≥ 23H2)🔴 StoppedAutomatic
  1. Not Advised

    This script should only be used by advanced users.

    This script is not recommended for daily use as it breaks important functionality.

    Consider creating a system restore point before doing any changes.

  2. Security Trade-off

    This action prioritizes privacy over certain security features. It's not recommended and should only be used by advanced users after understanding its implications.

    Increased Privacy

    Enhanced privacy through reduced data collection and tracking

    Decreased Security

    Some security features will be disabled or limited

    This script can be reversed, this allows you to restore the default system security.

Sources
PrivacyLearn.com maintains strict sourcing standards for accuracy, integrity and up-to-date content. Our content relies on authoritative sources including vendor documentation, industry standards, and verified research. Learn more about our verification process and quality standards in our editorial standards page.

Apply Now

Choose one of three ways to apply:

Download script

Download and run the script directly
  • No app needed
  • Offline usage
  • Easy-to-apply
  • Free
  • Open-source
Help

How to apply or restore "Disable SmartScreen Enhanced Phishing Protection Web background services" using script

  • ≈ 2 min to complete
  • Tools: Web Browser
  • Difficulty: Simple
  • ≈ 5 instructions
  1. 1

    Download

    Download the script file by clicking on the   Apply protection  button above.
    Use   Undo protection button above to restore changes.
  2. 2

    Keep the file

    If warned by your browser, keep the file.
  3. 3

    Open

    Open the downloaded file.
  4. 4

    Exit

    Once it's done, press any key to exit the window.
  5. 5

    Restart

    Restart your computer for all changes to take effect.

Apply with privacy.sexy

Guided, automated application with safety checks
  • Recommended for most users
  • Includes safety checks
  • Free
  • Open-source
  • Popular
  • Offline/Online usage
Open privacy.sexy
Help

How to apply or restore "Disable SmartScreen Enhanced Phishing Protection Web background services" using privacy.sexy

  • ≈ 3 min to complete
  • Tools: privacy.sexy
  • Difficulty: Simple
  • ≈ 4 instructions
privacy.sexy is free and open-source application that lets securely apply this action easily with more advanced options.
  1. 1

    Open or download

    Open or download the desktop application
  2. 2

    Choose script

    1. Search for the script name: Disable SmartScreen Enhanced Phishing Protection Web background services
    2. Check the script by clicking on the checkbox.
  3. 3

    Run

    Click on ▶️ Run button at the bottom of the page.

    This button only appears on desktop version (recommended). On browser, use 💾 Save button.

Run commands

Copy and run commands manually Requires technical knowledge
Apply changes
:: Disable service(s): `webthreatdefsvc`
:: This operation will not run on Windows versions earlier than Windows11-22H2.
PowerShell -ExecutionPolicy Unrestricted -Command "$versionName = 'Windows11-22H2'; $buildNumber = switch ($versionName) { 'Windows11-FirstRelease' { '10.0.22000' }; 'Windows11-22H2' { '10.0.22621' }; 'Windows11-21H2' { '10.0.22000' }; 'Windows10-22H2' { '10.0.19045' }; 'Windows10-21H2' { '10.0.19044' }; 'Windows10-20H2' { '10.0.19042' }; 'Windows10-1909' { '10.0.18363' }; 'Windows10-1607' { '10.0.14393' }; default { throw "^""Internal privacy$([char]0x002E)sexy error: No build for minimum Windows '$versionName'"^""; }; }; $minVersion = [System.Version]::Parse($buildNumber); $ver = [Environment]::OSVersion.Version; $verNoPatch = [System.Version]::new($ver.Major, $ver.Minor, $ver.Build); if ($verNoPatch -lt $minVersion) { Write-Output "^""Skipping: Windows ($verNoPatch) is below minimum $minVersion ($versionName)"^""; Exit 0; }; $serviceName = 'webthreatdefsvc'; Write-Host "^""Disabling service: `"^""$serviceName`"^""."^""; <# -- 1. Skip if service does not exist #>; $service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue; if(!$service) { Write-Host "^""Service `"^""$serviceName`"^"" could not be not found, no need to disable it."^""; Exit 0; }; <# -- 2. Stop if running #>; if ($service.Status -eq [System.ServiceProcess.ServiceControllerStatus]::Running) { Write-Host "^""`"^""$serviceName`"^"" is running, stopping it."^""; try { Stop-Service -Name "^""$serviceName"^"" -Force -ErrorAction Stop; Write-Host "^""Stopped `"^""$serviceName`"^"" successfully."^""; } catch { Write-Warning "^""Could not stop `"^""$serviceName`"^"", it will be stopped after reboot: $_"^""; }; } else { Write-Host "^""`"^""$serviceName`"^"" is not running, no need to stop."^""; }; <# -- 3. Skip if already disabled #>; $startupType = $service.StartType <# Does not work before .NET 4.6.1 #>; if (!$startupType) { $startupType = (Get-WmiObject -Query "^""Select StartMode From Win32_Service Where Name='$serviceName'"^"" -ErrorAction Ignore).StartMode; if(!$startupType) { $startupType = (Get-WmiObject -Class Win32_Service -Property StartMode -Filter "^""Name='$serviceName'"^"" -ErrorAction Ignore).StartMode; }; }; if ($startupType -eq 'Disabled') { Write-Host "^""$serviceName is already disabled, no further action is needed"^""; Exit 0; }; <# -- 4. Disable service #>; try { Set-Service -Name "^""$serviceName"^"" -StartupType Disabled -Confirm:$false -ErrorAction Stop; Write-Host "^""Disabled `"^""$serviceName`"^"" successfully."^""; } catch { Write-Error "^""Could not disable `"^""$serviceName`"^"": $_"^""; }"
:: Soft delete files matching pattern: "%SYSTEMROOT%\System32\webthreatdefsvc.dll" with additional permissions
:: This operation will not run on Windows versions earlier than Windows11-22H2.
PowerShell -ExecutionPolicy Unrestricted -Command "$versionName = 'Windows11-22H2'; $buildNumber = switch ($versionName) { 'Windows11-FirstRelease' { '10.0.22000' }; 'Windows11-22H2' { '10.0.22621' }; 'Windows11-21H2' { '10.0.22000' }; 'Windows10-22H2' { '10.0.19045' }; 'Windows10-21H2' { '10.0.19044' }; 'Windows10-20H2' { '10.0.19042' }; 'Windows10-1909' { '10.0.18363' }; 'Windows10-1607' { '10.0.14393' }; default { throw "^""Internal privacy$([char]0x002E)sexy error: No build for minimum Windows '$versionName'"^""; }; }; $minVersion = [System.Version]::Parse($buildNumber); $ver = [Environment]::OSVersion.Version; $verNoPatch = [System.Version]::new($ver.Major, $ver.Minor, $ver.Build); if ($verNoPatch -lt $minVersion) { Write-Output "^""Skipping: Windows ($verNoPatch) is below minimum $minVersion ($versionName)"^""; Exit 0; }; $pathGlobPattern = "^""%SYSTEMROOT%\System32\webthreatdefsvc.dll"^""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host "^""Searching for items matching pattern: `"^""$($expandedPath)`"^""."^""; $renamedCount = 0; $skippedCount = 0; $failedCount = 0; Add-Type -TypeDefinition "^""using System;`r`nusing System.Runtime.InteropServices;`r`npublic class Privileges {`r`n [DllImport(`"^""advapi32.dll`"^"", ExactSpelling = true, SetLastError = true)]`r`n internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall,`r`n ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen);`r`n [DllImport(`"^""advapi32.dll`"^"", ExactSpelling = true, SetLastError = true)]`r`n internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok);`r`n [DllImport(`"^""advapi32.dll`"^"", SetLastError = true)]`r`n internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid);`r`n [StructLayout(LayoutKind.Sequential, Pack = 1)]`r`n internal struct TokPriv1Luid {`r`n public int Count;`r`n public long Luid;`r`n public int Attr;`r`n }`r`n internal const int SE_PRIVILEGE_ENABLED = 0x00000002;`r`n internal const int TOKEN_QUERY = 0x00000008;`r`n internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;`r`n public static bool AddPrivilege(string privilege) {`r`n try {`r`n bool retVal;`r`n TokPriv1Luid tp;`r`n IntPtr hproc = GetCurrentProcess();`r`n IntPtr htok = IntPtr.Zero;`r`n retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok);`r`n tp.Count = 1;`r`n tp.Luid = 0;`r`n tp.Attr = SE_PRIVILEGE_ENABLED;`r`n retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid);`r`n retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);`r`n return retVal;`r`n } catch (Exception ex) {`r`n throw new Exception(`"^""Failed to adjust token privileges`"^"", ex);`r`n }`r`n }`r`n public static bool RemovePrivilege(string privilege) {`r`n try {`r`n bool retVal;`r`n TokPriv1Luid tp;`r`n IntPtr hproc = GetCurrentProcess();`r`n IntPtr htok = IntPtr.Zero;`r`n retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok);`r`n tp.Count = 1;`r`n tp.Luid = 0;`r`n tp.Attr = 0; // This line is changed to revoke the privilege`r`n retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid);`r`n retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);`r`n return retVal;`r`n } catch (Exception ex) {`r`n throw new Exception(`"^""Failed to adjust token privileges`"^"", ex);`r`n }`r`n }`r`n [DllImport(`"^""kernel32.dll`"^"", CharSet = CharSet.Auto)]`r`n public static extern IntPtr GetCurrentProcess();`r`n}"^""; [Privileges]::AddPrivilege('SeRestorePrivilege') | Out-Null; [Privileges]::AddPrivilege('SeTakeOwnershipPrivilege') | Out-Null; $adminSid = New-Object System.Security.Principal.SecurityIdentifier 'S-1-5-32-544'; $adminAccount = $adminSid.Translate([System.Security.Principal.NTAccount]); $adminFullControlAccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule( $adminAccount, [System.Security.AccessControl.FileSystemRights]::FullControl, [System.Security.AccessControl.AccessControlType]::Allow ); $foundAbsolutePaths = @(); try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host "^""Initiating processing of $($foundAbsolutePaths.Count) items from `"^""$expandedPath`"^""."^""; foreach ($path in $foundAbsolutePaths) { if (Test-Path -Path $path -PathType Container) { Write-Host "^""Skipping folder (not its contents): `"^""$path`"^""."^""; $skippedCount++; continue; }; if($revert -eq $true) { if (-not $path.EndsWith('.OLD')) { Write-Host "^""Skipping non-backup file: `"^""$path`"^""."^""; $skippedCount++; continue; }; } else { if ($path.EndsWith('.OLD')) { Write-Host "^""Skipping backup file: `"^""$path`"^""."^""; $skippedCount++; continue; }; }; $originalFilePath = $path; Write-Host "^""Processing file: `"^""$originalFilePath`"^""."^""; if (-Not (Test-Path $originalFilePath)) { Write-Host "^""Skipping, file `"^""$originalFilePath`"^"" not found."^""; $skippedCount++; exit 0; }; $originalAcl = Get-Acl -Path "^""$originalFilePath"^""; $accessGranted = $false; try { $acl = Get-Acl -Path "^""$originalFilePath"^""; $acl.SetOwner($adminAccount) <# Take Ownership (because file is owned by TrustedInstaller) #>; $acl.AddAccessRule($adminFullControlAccessRule) <# Grant rights to be able to move the file #>; Set-Acl -Path $originalFilePath -AclObject $acl -ErrorAction Stop; $accessGranted = $true; } catch { Write-Warning "^""Failed to grant access to `"^""$originalFilePath`"^"": $($_.Exception.Message)"^""; }; if ($revert -eq $true) { $newFilePath = $originalFilePath.Substring(0, $originalFilePath.Length - 4); } else { $newFilePath = "^""$($originalFilePath).OLD"^""; }; try { Move-Item -LiteralPath "^""$($originalFilePath)"^"" -Destination "^""$newFilePath"^"" -Force -ErrorAction Stop; Write-Host "^""Successfully processed `"^""$originalFilePath`"^""."^""; $renamedCount++; if ($accessGranted) { try { Set-Acl -Path $newFilePath -AclObject $originalAcl -ErrorAction Stop; } catch { Write-Warning "^""Failed to restore access on `"^""$newFilePath`"^"": $($_.Exception.Message)"^""; }; }; } catch { Write-Error "^""Failed to rename `"^""$originalFilePath`"^"" to `"^""$newFilePath`"^"": $($_.Exception.Message)"^""; $failedCount++; if ($accessGranted) { try { Set-Acl -Path $originalFilePath -AclObject $originalAcl -ErrorAction Stop; } catch { Write-Warning "^""Failed to restore access on `"^""$originalFilePath`"^"": $($_.Exception.Message)"^""; }; }; }; }; if (($renamedCount -gt 0) -or ($skippedCount -gt 0)) { Write-Host "^""Successfully processed $renamedCount items and skipped $skippedCount items."^""; }; if ($failedCount -gt 0) { Write-Warning "^""Failed to process $($failedCount) items."^""; }; [Privileges]::RemovePrivilege('SeRestorePrivilege') | Out-Null; [Privileges]::RemovePrivilege('SeTakeOwnershipPrivilege') | Out-Null"
:: Disable per-user "webthreatdefusersvc" service for all users
:: Disable the service `webthreatdefusersvc`
:: This operation will not run on Windows versions earlier than Windows11-22H2.
PowerShell -ExecutionPolicy Unrestricted -Command "$versionName = 'Windows11-22H2'; $buildNumber = switch ($versionName) { 'Windows11-FirstRelease' { '10.0.22000' }; 'Windows11-22H2' { '10.0.22621' }; 'Windows11-21H2' { '10.0.22000' }; 'Windows10-22H2' { '10.0.19045' }; 'Windows10-21H2' { '10.0.19044' }; 'Windows10-20H2' { '10.0.19042' }; 'Windows10-1909' { '10.0.18363' }; 'Windows10-1607' { '10.0.14393' }; default { throw "^""Internal privacy$([char]0x002E)sexy error: No build for minimum Windows '$versionName'"^""; }; }; $minVersion = [System.Version]::Parse($buildNumber); $ver = [Environment]::OSVersion.Version; $verNoPatch = [System.Version]::new($ver.Major, $ver.Minor, $ver.Build); if ($verNoPatch -lt $minVersion) { Write-Output "^""Skipping: Windows ($verNoPatch) is below minimum $minVersion ($versionName)"^""; Exit 0; }; $serviceQuery = 'webthreatdefusersvc'; $stopWithDependencies= $false; <# -- 1. Skip if service does not exist #>; $service = Get-Service -Name $serviceQuery -ErrorAction SilentlyContinue; if(!$service) { Write-Host "^""Service query `"^""$serviceQuery`"^"" did not yield any results, no need to disable it."^""; Exit 0; }; $serviceName = $service.Name; Write-Host "^""Disabling service: `"^""$serviceName`"^""."^""; <# -- 2. Stop if running #>; if ($service.Status -eq [System.ServiceProcess.ServiceControllerStatus]::Running) { Write-Host "^""`"^""$serviceName`"^"" is running, attempting to stop it."^""; try { Write-Host "^""Stopping the service `"^""$serviceName`"^""."^""; $stopParams = @{ Name = $ServiceName; Force = $true; ErrorAction = 'Stop'; }; if (-not $stopWithDependencies) { $stopParams['NoWait'] = $true; }; Stop-Service @stopParams; Write-Host "^""Stopped `"^""$serviceName`"^"" successfully."^""; } catch { if ($_.FullyQualifiedErrorId -eq 'CouldNotStopService,Microsoft.PowerShell.Commands.StopServiceCommand') { Write-Warning "^""The service `"^""$serviceName`"^"" does not accept a stop command and may need to be stopped manually or on reboot."^""; } else { Write-Warning "^""Failed to stop service `"^""$ServiceName`"^"". It will be stopped after reboot. Error: $($_.Exception.Message)"^""; }; }; } else { Write-Host "^""`"^""$serviceName`"^"" is not running, no need to stop."^""; }; <# -- 3. Skip if service info is not found in registry #>; $registryKey = "^""HKLM:\SYSTEM\CurrentControlSet\Services\$serviceName"^""; if (-Not (Test-Path $registryKey)) { Write-Host "^""`"^""$registryKey`"^"" is not found in registry, cannot enable it."^""; Exit 0; }; <# -- 4. Skip if already disabled #>; if( $(Get-ItemProperty -Path "^""$registryKey"^"").Start -eq 4) { Write-Host "^""`"^""$serviceName`"^"" is already disabled from start, no further action is needed."^""; Exit 0; }; <# -- 5. Disable service #>; try { Set-ItemProperty -LiteralPath $registryKey -Name "^""Start"^"" -Value 4 -ErrorAction Stop; Write-Host 'Successfully disabled the service. It will not start automatically on next boot.'; } catch { Write-Error "^""Failed to disable the service. Error: $($_.Exception.Message)"^""; Exit 1; }"
:: Disable per-user "webthreatdefusersvc" service for individual user accounts
:: Disable the service `webthreatdefusersvc_*`
:: This operation will not run on Windows versions earlier than Windows11-22H2.
PowerShell -ExecutionPolicy Unrestricted -Command "$versionName = 'Windows11-22H2'; $buildNumber = switch ($versionName) { 'Windows11-FirstRelease' { '10.0.22000' }; 'Windows11-22H2' { '10.0.22621' }; 'Windows11-21H2' { '10.0.22000' }; 'Windows10-22H2' { '10.0.19045' }; 'Windows10-21H2' { '10.0.19044' }; 'Windows10-20H2' { '10.0.19042' }; 'Windows10-1909' { '10.0.18363' }; 'Windows10-1607' { '10.0.14393' }; default { throw "^""Internal privacy$([char]0x002E)sexy error: No build for minimum Windows '$versionName'"^""; }; }; $minVersion = [System.Version]::Parse($buildNumber); $ver = [Environment]::OSVersion.Version; $verNoPatch = [System.Version]::new($ver.Major, $ver.Minor, $ver.Build); if ($verNoPatch -lt $minVersion) { Write-Output "^""Skipping: Windows ($verNoPatch) is below minimum $minVersion ($versionName)"^""; Exit 0; }; $serviceQuery = 'webthreatdefusersvc_*'; $stopWithDependencies= $false; <# -- 1. Skip if service does not exist #>; $service = Get-Service -Name $serviceQuery -ErrorAction SilentlyContinue; if(!$service) { Write-Host "^""Service query `"^""$serviceQuery`"^"" did not yield any results, no need to disable it."^""; Exit 0; }; $serviceName = $service.Name; Write-Host "^""Disabling service: `"^""$serviceName`"^""."^""; <# -- 2. Stop if running #>; if ($service.Status -eq [System.ServiceProcess.ServiceControllerStatus]::Running) { Write-Host "^""`"^""$serviceName`"^"" is running, attempting to stop it."^""; try { Write-Host "^""Stopping the service `"^""$serviceName`"^""."^""; $stopParams = @{ Name = $ServiceName; Force = $true; ErrorAction = 'Stop'; }; if (-not $stopWithDependencies) { $stopParams['NoWait'] = $true; }; Stop-Service @stopParams; Write-Host "^""Stopped `"^""$serviceName`"^"" successfully."^""; } catch { if ($_.FullyQualifiedErrorId -eq 'CouldNotStopService,Microsoft.PowerShell.Commands.StopServiceCommand') { Write-Warning "^""The service `"^""$serviceName`"^"" does not accept a stop command and may need to be stopped manually or on reboot."^""; } else { Write-Warning "^""Failed to stop service `"^""$ServiceName`"^"". It will be stopped after reboot. Error: $($_.Exception.Message)"^""; }; }; } else { Write-Host "^""`"^""$serviceName`"^"" is not running, no need to stop."^""; }; <# -- 3. Skip if service info is not found in registry #>; $registryKey = "^""HKLM:\SYSTEM\CurrentControlSet\Services\$serviceName"^""; if (-Not (Test-Path $registryKey)) { Write-Host "^""`"^""$registryKey`"^"" is not found in registry, cannot enable it."^""; Exit 0; }; <# -- 4. Skip if already disabled #>; if( $(Get-ItemProperty -Path "^""$registryKey"^"").Start -eq 4) { Write-Host "^""`"^""$serviceName`"^"" is already disabled from start, no further action is needed."^""; Exit 0; }; <# -- 5. Disable service #>; try { Set-ItemProperty -LiteralPath $registryKey -Name "^""Start"^"" -Value 4 -ErrorAction Stop; Write-Host 'Successfully disabled the service. It will not start automatically on next boot.'; } catch { Write-Error "^""Failed to disable the service. Error: $($_.Exception.Message)"^""; Exit 1; }"
:: Soft delete files matching pattern: "%SYSTEMROOT%\System32\webthreatdefusersvc.dll" with additional permissions
:: This operation will not run on Windows versions earlier than Windows11-22H2.
PowerShell -ExecutionPolicy Unrestricted -Command "$versionName = 'Windows11-22H2'; $buildNumber = switch ($versionName) { 'Windows11-FirstRelease' { '10.0.22000' }; 'Windows11-22H2' { '10.0.22621' }; 'Windows11-21H2' { '10.0.22000' }; 'Windows10-22H2' { '10.0.19045' }; 'Windows10-21H2' { '10.0.19044' }; 'Windows10-20H2' { '10.0.19042' }; 'Windows10-1909' { '10.0.18363' }; 'Windows10-1607' { '10.0.14393' }; default { throw "^""Internal privacy$([char]0x002E)sexy error: No build for minimum Windows '$versionName'"^""; }; }; $minVersion = [System.Version]::Parse($buildNumber); $ver = [Environment]::OSVersion.Version; $verNoPatch = [System.Version]::new($ver.Major, $ver.Minor, $ver.Build); if ($verNoPatch -lt $minVersion) { Write-Output "^""Skipping: Windows ($verNoPatch) is below minimum $minVersion ($versionName)"^""; Exit 0; }; $pathGlobPattern = "^""%SYSTEMROOT%\System32\webthreatdefusersvc.dll"^""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host "^""Searching for items matching pattern: `"^""$($expandedPath)`"^""."^""; $renamedCount = 0; $skippedCount = 0; $failedCount = 0; Add-Type -TypeDefinition "^""using System;`r`nusing System.Runtime.InteropServices;`r`npublic class Privileges {`r`n [DllImport(`"^""advapi32.dll`"^"", ExactSpelling = true, SetLastError = true)]`r`n internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall,`r`n ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen);`r`n [DllImport(`"^""advapi32.dll`"^"", ExactSpelling = true, SetLastError = true)]`r`n internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok);`r`n [DllImport(`"^""advapi32.dll`"^"", SetLastError = true)]`r`n internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid);`r`n [StructLayout(LayoutKind.Sequential, Pack = 1)]`r`n internal struct TokPriv1Luid {`r`n public int Count;`r`n public long Luid;`r`n public int Attr;`r`n }`r`n internal const int SE_PRIVILEGE_ENABLED = 0x00000002;`r`n internal const int TOKEN_QUERY = 0x00000008;`r`n internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;`r`n public static bool AddPrivilege(string privilege) {`r`n try {`r`n bool retVal;`r`n TokPriv1Luid tp;`r`n IntPtr hproc = GetCurrentProcess();`r`n IntPtr htok = IntPtr.Zero;`r`n retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok);`r`n tp.Count = 1;`r`n tp.Luid = 0;`r`n tp.Attr = SE_PRIVILEGE_ENABLED;`r`n retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid);`r`n retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);`r`n return retVal;`r`n } catch (Exception ex) {`r`n throw new Exception(`"^""Failed to adjust token privileges`"^"", ex);`r`n }`r`n }`r`n public static bool RemovePrivilege(string privilege) {`r`n try {`r`n bool retVal;`r`n TokPriv1Luid tp;`r`n IntPtr hproc = GetCurrentProcess();`r`n IntPtr htok = IntPtr.Zero;`r`n retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok);`r`n tp.Count = 1;`r`n tp.Luid = 0;`r`n tp.Attr = 0; // This line is changed to revoke the privilege`r`n retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid);`r`n retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);`r`n return retVal;`r`n } catch (Exception ex) {`r`n throw new Exception(`"^""Failed to adjust token privileges`"^"", ex);`r`n }`r`n }`r`n [DllImport(`"^""kernel32.dll`"^"", CharSet = CharSet.Auto)]`r`n public static extern IntPtr GetCurrentProcess();`r`n}"^""; [Privileges]::AddPrivilege('SeRestorePrivilege') | Out-Null; [Privileges]::AddPrivilege('SeTakeOwnershipPrivilege') | Out-Null; $adminSid = New-Object System.Security.Principal.SecurityIdentifier 'S-1-5-32-544'; $adminAccount = $adminSid.Translate([System.Security.Principal.NTAccount]); $adminFullControlAccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule( $adminAccount, [System.Security.AccessControl.FileSystemRights]::FullControl, [System.Security.AccessControl.AccessControlType]::Allow ); $foundAbsolutePaths = @(); try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host "^""Initiating processing of $($foundAbsolutePaths.Count) items from `"^""$expandedPath`"^""."^""; foreach ($path in $foundAbsolutePaths) { if (Test-Path -Path $path -PathType Container) { Write-Host "^""Skipping folder (not its contents): `"^""$path`"^""."^""; $skippedCount++; continue; }; if($revert -eq $true) { if (-not $path.EndsWith('.OLD')) { Write-Host "^""Skipping non-backup file: `"^""$path`"^""."^""; $skippedCount++; continue; }; } else { if ($path.EndsWith('.OLD')) { Write-Host "^""Skipping backup file: `"^""$path`"^""."^""; $skippedCount++; continue; }; }; $originalFilePath = $path; Write-Host "^""Processing file: `"^""$originalFilePath`"^""."^""; if (-Not (Test-Path $originalFilePath)) { Write-Host "^""Skipping, file `"^""$originalFilePath`"^"" not found."^""; $skippedCount++; exit 0; }; $originalAcl = Get-Acl -Path "^""$originalFilePath"^""; $accessGranted = $false; try { $acl = Get-Acl -Path "^""$originalFilePath"^""; $acl.SetOwner($adminAccount) <# Take Ownership (because file is owned by TrustedInstaller) #>; $acl.AddAccessRule($adminFullControlAccessRule) <# Grant rights to be able to move the file #>; Set-Acl -Path $originalFilePath -AclObject $acl -ErrorAction Stop; $accessGranted = $true; } catch { Write-Warning "^""Failed to grant access to `"^""$originalFilePath`"^"": $($_.Exception.Message)"^""; }; if ($revert -eq $true) { $newFilePath = $originalFilePath.Substring(0, $originalFilePath.Length - 4); } else { $newFilePath = "^""$($originalFilePath).OLD"^""; }; try { Move-Item -LiteralPath "^""$($originalFilePath)"^"" -Destination "^""$newFilePath"^"" -Force -ErrorAction Stop; Write-Host "^""Successfully processed `"^""$originalFilePath`"^""."^""; $renamedCount++; if ($accessGranted) { try { Set-Acl -Path $newFilePath -AclObject $originalAcl -ErrorAction Stop; } catch { Write-Warning "^""Failed to restore access on `"^""$newFilePath`"^"": $($_.Exception.Message)"^""; }; }; } catch { Write-Error "^""Failed to rename `"^""$originalFilePath`"^"" to `"^""$newFilePath`"^"": $($_.Exception.Message)"^""; $failedCount++; if ($accessGranted) { try { Set-Acl -Path $originalFilePath -AclObject $originalAcl -ErrorAction Stop; } catch { Write-Warning "^""Failed to restore access on `"^""$originalFilePath`"^"": $($_.Exception.Message)"^""; }; }; }; }; if (($renamedCount -gt 0) -or ($skippedCount -gt 0)) { Write-Host "^""Successfully processed $renamedCount items and skipped $skippedCount items."^""; }; if ($failedCount -gt 0) { Write-Warning "^""Failed to process $($failedCount) items."^""; }; [Privileges]::RemovePrivilege('SeRestorePrivilege') | Out-Null; [Privileges]::RemovePrivilege('SeTakeOwnershipPrivilege') | Out-Null"
:: Soft-delete the registry key: HKLM\SOFTWARE\Microsoft\WindowsRuntime\Server\WebThreatDefSvc as TrustedInstaller
:: This operation will not run on Windows versions earlier than Windows11-22H2.
PowerShell -ExecutionPolicy Unrestricted -Command "$versionName = 'Windows11-22H2'; $buildNumber = switch ($versionName) { 'Windows11-FirstRelease' { '10.0.22000' }; 'Windows11-22H2' { '10.0.22621' }; 'Windows11-21H2' { '10.0.22000' }; 'Windows10-22H2' { '10.0.19045' }; 'Windows10-21H2' { '10.0.19044' }; 'Windows10-20H2' { '10.0.19042' }; 'Windows10-1909' { '10.0.18363' }; 'Windows10-1607' { '10.0.14393' }; default { throw "^""Internal privacy$([char]0x002E)sexy error: No build for minimum Windows '$versionName'"^""; }; }; $minVersion = [System.Version]::Parse($buildNumber); $ver = [Environment]::OSVersion.Version; $verNoPatch = [System.Version]::new($ver.Major, $ver.Minor, $ver.Build); if ($verNoPatch -lt $minVersion) { Write-Output "^""Skipping: Windows ($verNoPatch) is below minimum $minVersion ($versionName)"^""; Exit 0; }function Invoke-AsTrustedInstaller($Script) { $principalSid = [System.Security.Principal.SecurityIdentifier]::new('S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464'); $principalName = $principalSid.Translate([System.Security.Principal.NTAccount]); $streamFile = New-TemporaryFile; $scriptFile = New-TemporaryFile; try { $scriptFile = Rename-Item -LiteralPath $scriptFile -NewName ($scriptFile.BaseName + '.ps1') -Force -PassThru; $Script | Out-File $scriptFile -Encoding UTF8; $taskName = "^""privacy$([char]0x002E)sexy invoke"^""; schtasks.exe /delete /tn $taskName /f 2>&1 | Out-Null; $executionCommand = "^""powershell.exe -ExecutionPolicy Bypass -File '$scriptFile' *>&1 | Out-File -FilePath '$streamFile' -Encoding UTF8"^""; $action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument "^""-ExecutionPolicy Bypass -Command `"^""$executionCommand`"^"""^""; $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName $taskName -Action $action -Settings $settings -Force -ErrorAction Stop | Out-Null; try { ($scheduleService = New-Object -ComObject Schedule.Service).Connect(); $scheduleService.GetFolder('\').GetTask($taskName).RunEx($null, 0, 0, $principalName) | Out-Null; $timeout = (Get-Date).AddMinutes(5); Write-Host "^""Running as $principalName"^""; while ((Get-ScheduledTaskInfo $taskName).LastTaskResult -eq 267009) { Start-Sleep -Milliseconds 200; if ((Get-Date) -gt $timeout) { Write-Warning 'Skipping: Timeout'; break; }; }; if (($result = (Get-ScheduledTaskInfo $taskName).LastTaskResult) -ne 0) { Write-Error "^""Failed, due to exit code: $result."^""; } } finally { schtasks.exe /delete /tn $taskName /f | Out-Null; }; Get-Content $streamFile } finally { Remove-Item $streamFile, $scriptFile; }; }; $cmd = 'function Copy-Acl($Src, $Dst) {'+"^""`r`n"^""+' $srcKeys = @(Get-ChildItem -LiteralPath $Src -ErrorAction SilentlyContinue)'+"^""`r`n"^""+' foreach ($key in $srcKeys) {'+"^""`r`n"^""+' $dstKey = Join-Path $Dst $key.PSChildName'+"^""`r`n"^""+' Copy-Acl -Src $key.PSPath -Dst $dstKey'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $acl = Get-Acl -Path $Src -ErrorAction Stop'+"^""`r`n"^""+' $sections = [System.Security.AccessControl.AccessControlSections]::All -band (-bnot [System.Security.AccessControl.AccessControlSections]::Owner)'+"^""`r`n"^""+' $sddl = $acl.GetSecurityDescriptorSddlForm($sections)'+"^""`r`n"^""+' $acl.SetSecurityDescriptorSddlForm($sddl, $sections)'+"^""`r`n"^""+' Set-Acl -Path $Dst -AclObject $acl -ErrorAction Stop'+"^""`r`n"^""+'}'+"^""`r`n"^""+'function Rename-KeyWithAcl($Old, $New) {'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Copy-Item -LiteralPath $Old -Destination $New -Recurse -Force -ErrorAction Stop'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' throw "^""Failed to copy: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Copy-Acl -Src $Old -Dst $New'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to copy ACL: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Remove-Item -LiteralPath $Old -Force -Recurse -ErrorAction Stop | Out-Null'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Remove-Item -LiteralPath $New -Force -Recurse -ErrorAction Stop | Out-Null'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to clean up: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' throw "^""Failed to remove: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+'}'+"^""`r`n"^""+'$rawPath=''HKLM\SOFTWARE\Microsoft\WindowsRuntime\Server\WebThreatDefSvc'''+"^""`r`n"^""+'$suffix=''.OLD'''+"^""`r`n"^""+'$global:ok = 0'+"^""`r`n"^""+'$global:skip = 0'+"^""`r`n"^""+'$global:fail = 0'+"^""`r`n"^""+'function Rename-KeyTree($Path) {'+"^""`r`n"^""+' Write-Host "^""Processing key: $Path"^""'+"^""`r`n"^""+' if (-Not (Test-Path -LiteralPath $Path)) {'+"^""`r`n"^""+' Write-Host ''Skipping: Key does not exist.'''+"^""`r`n"^""+' $global:skip++'+"^""`r`n"^""+' return'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $values = (Get-Item -LiteralPath $Path -ErrorAction Stop | Select-Object -ExpandProperty Property)'+"^""`r`n"^""+' foreach ($value in $values) {'+"^""`r`n"^""+' Write-Host "^""Renaming ''$value''"^""'+"^""`r`n"^""+' if ($value.EndsWith($suffix)) {'+"^""`r`n"^""+' Write-Host ''Skipping: Has suffix.'''+"^""`r`n"^""+' $global:skip++'+"^""`r`n"^""+' continue'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $backupName = $value + $suffix'+"^""`r`n"^""+' Write-Host "^""Renaming to ''$backupName''."^""'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Rename-ItemProperty -LiteralPath $Path -Name $value -NewName $backupName -ErrorAction Stop'+"^""`r`n"^""+' Write-Host ''Successfully renamed.'''+"^""`r`n"^""+' $global:ok++'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to rename value: $_"^""'+"^""`r`n"^""+' $global:fail++'+"^""`r`n"^""+' }'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $subkeys = @(Get-ChildItem -LiteralPath $Path -ErrorAction SilentlyContinue)'+"^""`r`n"^""+' foreach ($key in $subkeys) {'+"^""`r`n"^""+' Rename-KeyTree $key.PSPath'+"^""`r`n"^""+' }'+"^""`r`n"^""+' Write-Host "^""Renaming key ''$Path''."^""'+"^""`r`n"^""+' if ($Path.EndsWith($suffix)) {'+"^""`r`n"^""+' Write-Host ''Skipping: Has suffix.'''+"^""`r`n"^""+' $global:skip++'+"^""`r`n"^""+' } else {'+"^""`r`n"^""+' $backupPath = $Path + $suffix'+"^""`r`n"^""+' while (Test-Path -LiteralPath $backupPath) {'+"^""`r`n"^""+' $backupPath += $suffix'+"^""`r`n"^""+' }'+"^""`r`n"^""+' Write-Host "^""Renaming to ''$backupPath''."^""'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Rename-KeyWithAcl -Old $Path -New $backupPath -ErrorAction Stop'+"^""`r`n"^""+' Write-Host ''Successfully renamed.'''+"^""`r`n"^""+' $global:ok++'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to rename: $_"^""'+"^""`r`n"^""+' $global:fail++'+"^""`r`n"^""+' }'+"^""`r`n"^""+' }'+"^""`r`n"^""+'}'+"^""`r`n"^""+'Write-Host "^""Soft deleting registry key ''$rawPath'' recursively."^""'+"^""`r`n"^""+'$hive = $rawPath.Split(''\'')[0]'+"^""`r`n"^""+'$path = $hive + '':'' + $rawPath.Substring($hive.Length)'+"^""`r`n"^""+'Rename-KeyTree $path'+"^""`r`n"^""+'$totalItems = $global:ok + $global:skip + $global:fail'+"^""`r`n"^""+'Write-Host "^""Total items: $totalItems, Renamed: $global:ok, Skipped: $global:skip, Failed: $global:fail"^""'+"^""`r`n"^""+'if (($totalItems -eq 0) -or ($totalItems -eq $global:skip)) {'+"^""`r`n"^""+' Write-Host ''No items were processed. The operation had no effect.'''+"^""`r`n"^""+'} elseif ($global:fail -eq $totalItems) {'+"^""`r`n"^""+' throw "^""Operation failed. All $global:fail items could not be processed."^""'+"^""`r`n"^""+'} elseif ($global:ok) {'+"^""`r`n"^""+' Write-Host "^""Successfully processed $global:ok item(s)."^""'+"^""`r`n"^""+'}'; Invoke-AsTrustedInstaller $cmd"
:: Soft-delete the registry key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\WebThreatDefense
:: This operation will not run on Windows versions earlier than Windows11-22H2.
PowerShell -ExecutionPolicy Unrestricted -Command "$versionName = 'Windows11-22H2'; $buildNumber = switch ($versionName) { 'Windows11-FirstRelease' { '10.0.22000' }; 'Windows11-22H2' { '10.0.22621' }; 'Windows11-21H2' { '10.0.22000' }; 'Windows10-22H2' { '10.0.19045' }; 'Windows10-21H2' { '10.0.19044' }; 'Windows10-20H2' { '10.0.19042' }; 'Windows10-1909' { '10.0.18363' }; 'Windows10-1607' { '10.0.14393' }; default { throw "^""Internal privacy$([char]0x002E)sexy error: No build for minimum Windows '$versionName'"^""; }; }; $minVersion = [System.Version]::Parse($buildNumber); $ver = [Environment]::OSVersion.Version; $verNoPatch = [System.Version]::new($ver.Major, $ver.Minor, $ver.Build); if ($verNoPatch -lt $minVersion) { Write-Output "^""Skipping: Windows ($verNoPatch) is below minimum $minVersion ($versionName)"^""; Exit 0; }; function Copy-Acl($Src, $Dst) { $srcKeys = @(Get-ChildItem -LiteralPath $Src -ErrorAction SilentlyContinue); foreach ($key in $srcKeys) { $dstKey = Join-Path $Dst $key.PSChildName; Copy-Acl -Src $key.PSPath -Dst $dstKey; }; $acl = Get-Acl -Path $Src -ErrorAction Stop; $sections = [System.Security.AccessControl.AccessControlSections]::All -band (-bnot [System.Security.AccessControl.AccessControlSections]::Owner); $sddl = $acl.GetSecurityDescriptorSddlForm($sections); $acl.SetSecurityDescriptorSddlForm($sddl, $sections); Set-Acl -Path $Dst -AclObject $acl -ErrorAction Stop; }; function Rename-KeyWithAcl($Old, $New) { try { Copy-Item -LiteralPath $Old -Destination $New -Recurse -Force -ErrorAction Stop; } catch { throw "^""Failed to copy: $_"^""; }; try { Copy-Acl -Src $Old -Dst $New; } catch { Write-Warning "^""Failed to copy ACL: $_"^""; }; try { Remove-Item -LiteralPath $Old -Force -Recurse -ErrorAction Stop | Out-Null; } catch { try { Remove-Item -LiteralPath $New -Force -Recurse -ErrorAction Stop | Out-Null; } catch { Write-Warning "^""Failed to clean up: $_"^""; }; throw "^""Failed to remove: $_"^""; }; }; $rawPath='HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\WebThreatDefense'; $suffix='.OLD'; $global:ok = 0; $global:skip = 0; $global:fail = 0; function Rename-KeyTree($Path) { Write-Host "^""Processing key: $Path"^""; if (-Not (Test-Path -LiteralPath $Path)) { Write-Host 'Skipping: Key does not exist.'; $global:skip++; return; }; $values = (Get-Item -LiteralPath $Path -ErrorAction Stop | Select-Object -ExpandProperty Property); foreach ($value in $values) { Write-Host "^""Renaming '$value'"^""; if ($value.EndsWith($suffix)) { Write-Host 'Skipping: Has suffix.'; $global:skip++; continue; }; $backupName = $value + $suffix; Write-Host "^""Renaming to '$backupName'."^""; try { Rename-ItemProperty -LiteralPath $Path -Name $value -NewName $backupName -ErrorAction Stop; Write-Host 'Successfully renamed.'; $global:ok++; } catch { Write-Warning "^""Failed to rename value: $_"^""; $global:fail++; }; }; $subkeys = @(Get-ChildItem -LiteralPath $Path -ErrorAction SilentlyContinue); foreach ($key in $subkeys) { Rename-KeyTree $key.PSPath; }; Write-Host "^""Renaming key '$Path'."^""; if ($Path.EndsWith($suffix)) { Write-Host 'Skipping: Has suffix.'; $global:skip++; } else { $backupPath = $Path + $suffix; while (Test-Path -LiteralPath $backupPath) { $backupPath += $suffix; }; Write-Host "^""Renaming to '$backupPath'."^""; try { Rename-KeyWithAcl -Old $Path -New $backupPath -ErrorAction Stop; Write-Host 'Successfully renamed.'; $global:ok++; } catch { Write-Warning "^""Failed to rename: $_"^""; $global:fail++; }; }; }; Write-Host "^""Soft deleting registry key '$rawPath' recursively."^""; $hive = $rawPath.Split('\')[0]; $path = $hive + ':' + $rawPath.Substring($hive.Length); Rename-KeyTree $path; $totalItems = $global:ok + $global:skip + $global:fail; Write-Host "^""Total items: $totalItems, Renamed: $global:ok, Skipped: $global:skip, Failed: $global:fail"^""; if (($totalItems -eq 0) -or ($totalItems -eq $global:skip)) { Write-Host 'No items were processed. The operation had no effect.'; } elseif ($global:fail -eq $totalItems) { throw "^""Operation failed. All $global:fail items could not be processed."^""; } elseif ($global:ok) { Write-Host "^""Successfully processed $global:ok item(s)."^""; }"
:: Soft-delete the registry key: HKLM\Software\Classes\Interface\{ac889b17-df54-4854-a439-d7b68d1e16e8} as TrustedInstaller
:: This operation will not run on Windows versions earlier than Windows11-22H2.
PowerShell -ExecutionPolicy Unrestricted -Command "$versionName = 'Windows11-22H2'; $buildNumber = switch ($versionName) { 'Windows11-FirstRelease' { '10.0.22000' }; 'Windows11-22H2' { '10.0.22621' }; 'Windows11-21H2' { '10.0.22000' }; 'Windows10-22H2' { '10.0.19045' }; 'Windows10-21H2' { '10.0.19044' }; 'Windows10-20H2' { '10.0.19042' }; 'Windows10-1909' { '10.0.18363' }; 'Windows10-1607' { '10.0.14393' }; default { throw "^""Internal privacy$([char]0x002E)sexy error: No build for minimum Windows '$versionName'"^""; }; }; $minVersion = [System.Version]::Parse($buildNumber); $ver = [Environment]::OSVersion.Version; $verNoPatch = [System.Version]::new($ver.Major, $ver.Minor, $ver.Build); if ($verNoPatch -lt $minVersion) { Write-Output "^""Skipping: Windows ($verNoPatch) is below minimum $minVersion ($versionName)"^""; Exit 0; }function Invoke-AsTrustedInstaller($Script) { $principalSid = [System.Security.Principal.SecurityIdentifier]::new('S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464'); $principalName = $principalSid.Translate([System.Security.Principal.NTAccount]); $streamFile = New-TemporaryFile; $scriptFile = New-TemporaryFile; try { $scriptFile = Rename-Item -LiteralPath $scriptFile -NewName ($scriptFile.BaseName + '.ps1') -Force -PassThru; $Script | Out-File $scriptFile -Encoding UTF8; $taskName = "^""privacy$([char]0x002E)sexy invoke"^""; schtasks.exe /delete /tn $taskName /f 2>&1 | Out-Null; $executionCommand = "^""powershell.exe -ExecutionPolicy Bypass -File '$scriptFile' *>&1 | Out-File -FilePath '$streamFile' -Encoding UTF8"^""; $action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument "^""-ExecutionPolicy Bypass -Command `"^""$executionCommand`"^"""^""; $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName $taskName -Action $action -Settings $settings -Force -ErrorAction Stop | Out-Null; try { ($scheduleService = New-Object -ComObject Schedule.Service).Connect(); $scheduleService.GetFolder('\').GetTask($taskName).RunEx($null, 0, 0, $principalName) | Out-Null; $timeout = (Get-Date).AddMinutes(5); Write-Host "^""Running as $principalName"^""; while ((Get-ScheduledTaskInfo $taskName).LastTaskResult -eq 267009) { Start-Sleep -Milliseconds 200; if ((Get-Date) -gt $timeout) { Write-Warning 'Skipping: Timeout'; break; }; }; if (($result = (Get-ScheduledTaskInfo $taskName).LastTaskResult) -ne 0) { Write-Error "^""Failed, due to exit code: $result."^""; } } finally { schtasks.exe /delete /tn $taskName /f | Out-Null; }; Get-Content $streamFile } finally { Remove-Item $streamFile, $scriptFile; }; }; $cmd = 'function Copy-Acl($Src, $Dst) {'+"^""`r`n"^""+' $srcKeys = @(Get-ChildItem -LiteralPath $Src -ErrorAction SilentlyContinue)'+"^""`r`n"^""+' foreach ($key in $srcKeys) {'+"^""`r`n"^""+' $dstKey = Join-Path $Dst $key.PSChildName'+"^""`r`n"^""+' Copy-Acl -Src $key.PSPath -Dst $dstKey'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $acl = Get-Acl -Path $Src -ErrorAction Stop'+"^""`r`n"^""+' $sections = [System.Security.AccessControl.AccessControlSections]::All -band (-bnot [System.Security.AccessControl.AccessControlSections]::Owner)'+"^""`r`n"^""+' $sddl = $acl.GetSecurityDescriptorSddlForm($sections)'+"^""`r`n"^""+' $acl.SetSecurityDescriptorSddlForm($sddl, $sections)'+"^""`r`n"^""+' Set-Acl -Path $Dst -AclObject $acl -ErrorAction Stop'+"^""`r`n"^""+'}'+"^""`r`n"^""+'function Rename-KeyWithAcl($Old, $New) {'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Copy-Item -LiteralPath $Old -Destination $New -Recurse -Force -ErrorAction Stop'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' throw "^""Failed to copy: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Copy-Acl -Src $Old -Dst $New'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to copy ACL: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Remove-Item -LiteralPath $Old -Force -Recurse -ErrorAction Stop | Out-Null'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Remove-Item -LiteralPath $New -Force -Recurse -ErrorAction Stop | Out-Null'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to clean up: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' throw "^""Failed to remove: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+'}'+"^""`r`n"^""+'$rawPath=''HKLM\Software\Classes\Interface\{ac889b17-df54-4854-a439-d7b68d1e16e8}'''+"^""`r`n"^""+'$suffix=''.OLD'''+"^""`r`n"^""+'$global:ok = 0'+"^""`r`n"^""+'$global:skip = 0'+"^""`r`n"^""+'$global:fail = 0'+"^""`r`n"^""+'function Rename-KeyTree($Path) {'+"^""`r`n"^""+' Write-Host "^""Processing key: $Path"^""'+"^""`r`n"^""+' if (-Not (Test-Path -LiteralPath $Path)) {'+"^""`r`n"^""+' Write-Host ''Skipping: Key does not exist.'''+"^""`r`n"^""+' $global:skip++'+"^""`r`n"^""+' return'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $values = (Get-Item -LiteralPath $Path -ErrorAction Stop | Select-Object -ExpandProperty Property)'+"^""`r`n"^""+' foreach ($value in $values) {'+"^""`r`n"^""+' Write-Host "^""Renaming ''$value''"^""'+"^""`r`n"^""+' if ($value.EndsWith($suffix)) {'+"^""`r`n"^""+' Write-Host ''Skipping: Has suffix.'''+"^""`r`n"^""+' $global:skip++'+"^""`r`n"^""+' continue'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $backupName = $value + $suffix'+"^""`r`n"^""+' Write-Host "^""Renaming to ''$backupName''."^""'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Rename-ItemProperty -LiteralPath $Path -Name $value -NewName $backupName -ErrorAction Stop'+"^""`r`n"^""+' Write-Host ''Successfully renamed.'''+"^""`r`n"^""+' $global:ok++'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to rename value: $_"^""'+"^""`r`n"^""+' $global:fail++'+"^""`r`n"^""+' }'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $subkeys = @(Get-ChildItem -LiteralPath $Path -ErrorAction SilentlyContinue)'+"^""`r`n"^""+' foreach ($key in $subkeys) {'+"^""`r`n"^""+' Rename-KeyTree $key.PSPath'+"^""`r`n"^""+' }'+"^""`r`n"^""+' Write-Host "^""Renaming key ''$Path''."^""'+"^""`r`n"^""+' if ($Path.EndsWith($suffix)) {'+"^""`r`n"^""+' Write-Host ''Skipping: Has suffix.'''+"^""`r`n"^""+' $global:skip++'+"^""`r`n"^""+' } else {'+"^""`r`n"^""+' $backupPath = $Path + $suffix'+"^""`r`n"^""+' while (Test-Path -LiteralPath $backupPath) {'+"^""`r`n"^""+' $backupPath += $suffix'+"^""`r`n"^""+' }'+"^""`r`n"^""+' Write-Host "^""Renaming to ''$backupPath''."^""'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Rename-KeyWithAcl -Old $Path -New $backupPath -ErrorAction Stop'+"^""`r`n"^""+' Write-Host ''Successfully renamed.'''+"^""`r`n"^""+' $global:ok++'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to rename: $_"^""'+"^""`r`n"^""+' $global:fail++'+"^""`r`n"^""+' }'+"^""`r`n"^""+' }'+"^""`r`n"^""+'}'+"^""`r`n"^""+'Write-Host "^""Soft deleting registry key ''$rawPath'' recursively."^""'+"^""`r`n"^""+'$hive = $rawPath.Split(''\'')[0]'+"^""`r`n"^""+'$path = $hive + '':'' + $rawPath.Substring($hive.Length)'+"^""`r`n"^""+'Rename-KeyTree $path'+"^""`r`n"^""+'$totalItems = $global:ok + $global:skip + $global:fail'+"^""`r`n"^""+'Write-Host "^""Total items: $totalItems, Renamed: $global:ok, Skipped: $global:skip, Failed: $global:fail"^""'+"^""`r`n"^""+'if (($totalItems -eq 0) -or ($totalItems -eq $global:skip)) {'+"^""`r`n"^""+' Write-Host ''No items were processed. The operation had no effect.'''+"^""`r`n"^""+'} elseif ($global:fail -eq $totalItems) {'+"^""`r`n"^""+' throw "^""Operation failed. All $global:fail items could not be processed."^""'+"^""`r`n"^""+'} elseif ($global:ok) {'+"^""`r`n"^""+' Write-Host "^""Successfully processed $global:ok item(s)."^""'+"^""`r`n"^""+'}'; Invoke-AsTrustedInstaller $cmd"
:: Soft-delete the registry key: HKLM\Software\Classes\CLSID\{E2F1C91D-C762-4B5A-A8C1-4734E48C5FF4} as TrustedInstaller
:: This operation will not run on Windows versions earlier than Windows11-22H2.
PowerShell -ExecutionPolicy Unrestricted -Command "$versionName = 'Windows11-22H2'; $buildNumber = switch ($versionName) { 'Windows11-FirstRelease' { '10.0.22000' }; 'Windows11-22H2' { '10.0.22621' }; 'Windows11-21H2' { '10.0.22000' }; 'Windows10-22H2' { '10.0.19045' }; 'Windows10-21H2' { '10.0.19044' }; 'Windows10-20H2' { '10.0.19042' }; 'Windows10-1909' { '10.0.18363' }; 'Windows10-1607' { '10.0.14393' }; default { throw "^""Internal privacy$([char]0x002E)sexy error: No build for minimum Windows '$versionName'"^""; }; }; $minVersion = [System.Version]::Parse($buildNumber); $ver = [Environment]::OSVersion.Version; $verNoPatch = [System.Version]::new($ver.Major, $ver.Minor, $ver.Build); if ($verNoPatch -lt $minVersion) { Write-Output "^""Skipping: Windows ($verNoPatch) is below minimum $minVersion ($versionName)"^""; Exit 0; }function Invoke-AsTrustedInstaller($Script) { $principalSid = [System.Security.Principal.SecurityIdentifier]::new('S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464'); $principalName = $principalSid.Translate([System.Security.Principal.NTAccount]); $streamFile = New-TemporaryFile; $scriptFile = New-TemporaryFile; try { $scriptFile = Rename-Item -LiteralPath $scriptFile -NewName ($scriptFile.BaseName + '.ps1') -Force -PassThru; $Script | Out-File $scriptFile -Encoding UTF8; $taskName = "^""privacy$([char]0x002E)sexy invoke"^""; schtasks.exe /delete /tn $taskName /f 2>&1 | Out-Null; $executionCommand = "^""powershell.exe -ExecutionPolicy Bypass -File '$scriptFile' *>&1 | Out-File -FilePath '$streamFile' -Encoding UTF8"^""; $action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument "^""-ExecutionPolicy Bypass -Command `"^""$executionCommand`"^"""^""; $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName $taskName -Action $action -Settings $settings -Force -ErrorAction Stop | Out-Null; try { ($scheduleService = New-Object -ComObject Schedule.Service).Connect(); $scheduleService.GetFolder('\').GetTask($taskName).RunEx($null, 0, 0, $principalName) | Out-Null; $timeout = (Get-Date).AddMinutes(5); Write-Host "^""Running as $principalName"^""; while ((Get-ScheduledTaskInfo $taskName).LastTaskResult -eq 267009) { Start-Sleep -Milliseconds 200; if ((Get-Date) -gt $timeout) { Write-Warning 'Skipping: Timeout'; break; }; }; if (($result = (Get-ScheduledTaskInfo $taskName).LastTaskResult) -ne 0) { Write-Error "^""Failed, due to exit code: $result."^""; } } finally { schtasks.exe /delete /tn $taskName /f | Out-Null; }; Get-Content $streamFile } finally { Remove-Item $streamFile, $scriptFile; }; }; $cmd = 'function Copy-Acl($Src, $Dst) {'+"^""`r`n"^""+' $srcKeys = @(Get-ChildItem -LiteralPath $Src -ErrorAction SilentlyContinue)'+"^""`r`n"^""+' foreach ($key in $srcKeys) {'+"^""`r`n"^""+' $dstKey = Join-Path $Dst $key.PSChildName'+"^""`r`n"^""+' Copy-Acl -Src $key.PSPath -Dst $dstKey'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $acl = Get-Acl -Path $Src -ErrorAction Stop'+"^""`r`n"^""+' $sections = [System.Security.AccessControl.AccessControlSections]::All -band (-bnot [System.Security.AccessControl.AccessControlSections]::Owner)'+"^""`r`n"^""+' $sddl = $acl.GetSecurityDescriptorSddlForm($sections)'+"^""`r`n"^""+' $acl.SetSecurityDescriptorSddlForm($sddl, $sections)'+"^""`r`n"^""+' Set-Acl -Path $Dst -AclObject $acl -ErrorAction Stop'+"^""`r`n"^""+'}'+"^""`r`n"^""+'function Rename-KeyWithAcl($Old, $New) {'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Copy-Item -LiteralPath $Old -Destination $New -Recurse -Force -ErrorAction Stop'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' throw "^""Failed to copy: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Copy-Acl -Src $Old -Dst $New'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to copy ACL: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Remove-Item -LiteralPath $Old -Force -Recurse -ErrorAction Stop | Out-Null'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Remove-Item -LiteralPath $New -Force -Recurse -ErrorAction Stop | Out-Null'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to clean up: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' throw "^""Failed to remove: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+'}'+"^""`r`n"^""+'$rawPath=''HKLM\Software\Classes\CLSID\{E2F1C91D-C762-4B5A-A8C1-4734E48C5FF4}'''+"^""`r`n"^""+'$suffix=''.OLD'''+"^""`r`n"^""+'$global:ok = 0'+"^""`r`n"^""+'$global:skip = 0'+"^""`r`n"^""+'$global:fail = 0'+"^""`r`n"^""+'function Rename-KeyTree($Path) {'+"^""`r`n"^""+' Write-Host "^""Processing key: $Path"^""'+"^""`r`n"^""+' if (-Not (Test-Path -LiteralPath $Path)) {'+"^""`r`n"^""+' Write-Host ''Skipping: Key does not exist.'''+"^""`r`n"^""+' $global:skip++'+"^""`r`n"^""+' return'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $values = (Get-Item -LiteralPath $Path -ErrorAction Stop | Select-Object -ExpandProperty Property)'+"^""`r`n"^""+' foreach ($value in $values) {'+"^""`r`n"^""+' Write-Host "^""Renaming ''$value''"^""'+"^""`r`n"^""+' if ($value.EndsWith($suffix)) {'+"^""`r`n"^""+' Write-Host ''Skipping: Has suffix.'''+"^""`r`n"^""+' $global:skip++'+"^""`r`n"^""+' continue'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $backupName = $value + $suffix'+"^""`r`n"^""+' Write-Host "^""Renaming to ''$backupName''."^""'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Rename-ItemProperty -LiteralPath $Path -Name $value -NewName $backupName -ErrorAction Stop'+"^""`r`n"^""+' Write-Host ''Successfully renamed.'''+"^""`r`n"^""+' $global:ok++'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to rename value: $_"^""'+"^""`r`n"^""+' $global:fail++'+"^""`r`n"^""+' }'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $subkeys = @(Get-ChildItem -LiteralPath $Path -ErrorAction SilentlyContinue)'+"^""`r`n"^""+' foreach ($key in $subkeys) {'+"^""`r`n"^""+' Rename-KeyTree $key.PSPath'+"^""`r`n"^""+' }'+"^""`r`n"^""+' Write-Host "^""Renaming key ''$Path''."^""'+"^""`r`n"^""+' if ($Path.EndsWith($suffix)) {'+"^""`r`n"^""+' Write-Host ''Skipping: Has suffix.'''+"^""`r`n"^""+' $global:skip++'+"^""`r`n"^""+' } else {'+"^""`r`n"^""+' $backupPath = $Path + $suffix'+"^""`r`n"^""+' while (Test-Path -LiteralPath $backupPath) {'+"^""`r`n"^""+' $backupPath += $suffix'+"^""`r`n"^""+' }'+"^""`r`n"^""+' Write-Host "^""Renaming to ''$backupPath''."^""'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Rename-KeyWithAcl -Old $Path -New $backupPath -ErrorAction Stop'+"^""`r`n"^""+' Write-Host ''Successfully renamed.'''+"^""`r`n"^""+' $global:ok++'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to rename: $_"^""'+"^""`r`n"^""+' $global:fail++'+"^""`r`n"^""+' }'+"^""`r`n"^""+' }'+"^""`r`n"^""+'}'+"^""`r`n"^""+'Write-Host "^""Soft deleting registry key ''$rawPath'' recursively."^""'+"^""`r`n"^""+'$hive = $rawPath.Split(''\'')[0]'+"^""`r`n"^""+'$path = $hive + '':'' + $rawPath.Substring($hive.Length)'+"^""`r`n"^""+'Rename-KeyTree $path'+"^""`r`n"^""+'$totalItems = $global:ok + $global:skip + $global:fail'+"^""`r`n"^""+'Write-Host "^""Total items: $totalItems, Renamed: $global:ok, Skipped: $global:skip, Failed: $global:fail"^""'+"^""`r`n"^""+'if (($totalItems -eq 0) -or ($totalItems -eq $global:skip)) {'+"^""`r`n"^""+' Write-Host ''No items were processed. The operation had no effect.'''+"^""`r`n"^""+'} elseif ($global:fail -eq $totalItems) {'+"^""`r`n"^""+' throw "^""Operation failed. All $global:fail items could not be processed."^""'+"^""`r`n"^""+'} elseif ($global:ok) {'+"^""`r`n"^""+' Write-Host "^""Successfully processed $global:ok item(s)."^""'+"^""`r`n"^""+'}'; Invoke-AsTrustedInstaller $cmd"
:: Soft-delete the registry key: HKLM\Software\Microsoft\WindowsRuntime\ActivatableClassId\Microsoft.OneCore.WebThreatDefense.Service.UserSessionServiceManager as TrustedInstaller
:: This operation will not run on Windows versions earlier than Windows11-22H2.
PowerShell -ExecutionPolicy Unrestricted -Command "$versionName = 'Windows11-22H2'; $buildNumber = switch ($versionName) { 'Windows11-FirstRelease' { '10.0.22000' }; 'Windows11-22H2' { '10.0.22621' }; 'Windows11-21H2' { '10.0.22000' }; 'Windows10-22H2' { '10.0.19045' }; 'Windows10-21H2' { '10.0.19044' }; 'Windows10-20H2' { '10.0.19042' }; 'Windows10-1909' { '10.0.18363' }; 'Windows10-1607' { '10.0.14393' }; default { throw "^""Internal privacy$([char]0x002E)sexy error: No build for minimum Windows '$versionName'"^""; }; }; $minVersion = [System.Version]::Parse($buildNumber); $ver = [Environment]::OSVersion.Version; $verNoPatch = [System.Version]::new($ver.Major, $ver.Minor, $ver.Build); if ($verNoPatch -lt $minVersion) { Write-Output "^""Skipping: Windows ($verNoPatch) is below minimum $minVersion ($versionName)"^""; Exit 0; }function Invoke-AsTrustedInstaller($Script) { $principalSid = [System.Security.Principal.SecurityIdentifier]::new('S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464'); $principalName = $principalSid.Translate([System.Security.Principal.NTAccount]); $streamFile = New-TemporaryFile; $scriptFile = New-TemporaryFile; try { $scriptFile = Rename-Item -LiteralPath $scriptFile -NewName ($scriptFile.BaseName + '.ps1') -Force -PassThru; $Script | Out-File $scriptFile -Encoding UTF8; $taskName = "^""privacy$([char]0x002E)sexy invoke"^""; schtasks.exe /delete /tn $taskName /f 2>&1 | Out-Null; $executionCommand = "^""powershell.exe -ExecutionPolicy Bypass -File '$scriptFile' *>&1 | Out-File -FilePath '$streamFile' -Encoding UTF8"^""; $action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument "^""-ExecutionPolicy Bypass -Command `"^""$executionCommand`"^"""^""; $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName $taskName -Action $action -Settings $settings -Force -ErrorAction Stop | Out-Null; try { ($scheduleService = New-Object -ComObject Schedule.Service).Connect(); $scheduleService.GetFolder('\').GetTask($taskName).RunEx($null, 0, 0, $principalName) | Out-Null; $timeout = (Get-Date).AddMinutes(5); Write-Host "^""Running as $principalName"^""; while ((Get-ScheduledTaskInfo $taskName).LastTaskResult -eq 267009) { Start-Sleep -Milliseconds 200; if ((Get-Date) -gt $timeout) { Write-Warning 'Skipping: Timeout'; break; }; }; if (($result = (Get-ScheduledTaskInfo $taskName).LastTaskResult) -ne 0) { Write-Error "^""Failed, due to exit code: $result."^""; } } finally { schtasks.exe /delete /tn $taskName /f | Out-Null; }; Get-Content $streamFile } finally { Remove-Item $streamFile, $scriptFile; }; }; $cmd = 'function Copy-Acl($Src, $Dst) {'+"^""`r`n"^""+' $srcKeys = @(Get-ChildItem -LiteralPath $Src -ErrorAction SilentlyContinue)'+"^""`r`n"^""+' foreach ($key in $srcKeys) {'+"^""`r`n"^""+' $dstKey = Join-Path $Dst $key.PSChildName'+"^""`r`n"^""+' Copy-Acl -Src $key.PSPath -Dst $dstKey'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $acl = Get-Acl -Path $Src -ErrorAction Stop'+"^""`r`n"^""+' $sections = [System.Security.AccessControl.AccessControlSections]::All -band (-bnot [System.Security.AccessControl.AccessControlSections]::Owner)'+"^""`r`n"^""+' $sddl = $acl.GetSecurityDescriptorSddlForm($sections)'+"^""`r`n"^""+' $acl.SetSecurityDescriptorSddlForm($sddl, $sections)'+"^""`r`n"^""+' Set-Acl -Path $Dst -AclObject $acl -ErrorAction Stop'+"^""`r`n"^""+'}'+"^""`r`n"^""+'function Rename-KeyWithAcl($Old, $New) {'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Copy-Item -LiteralPath $Old -Destination $New -Recurse -Force -ErrorAction Stop'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' throw "^""Failed to copy: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Copy-Acl -Src $Old -Dst $New'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to copy ACL: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Remove-Item -LiteralPath $Old -Force -Recurse -ErrorAction Stop | Out-Null'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Remove-Item -LiteralPath $New -Force -Recurse -ErrorAction Stop | Out-Null'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to clean up: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' throw "^""Failed to remove: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+'}'+"^""`r`n"^""+'$rawPath=''HKLM\Software\Microsoft\WindowsRuntime\ActivatableClassId\Microsoft.OneCore.WebThreatDefense.Service.UserSessionServiceManager'''+"^""`r`n"^""+'$suffix=''.OLD'''+"^""`r`n"^""+'$global:ok = 0'+"^""`r`n"^""+'$global:skip = 0'+"^""`r`n"^""+'$global:fail = 0'+"^""`r`n"^""+'function Rename-KeyTree($Path) {'+"^""`r`n"^""+' Write-Host "^""Processing key: $Path"^""'+"^""`r`n"^""+' if (-Not (Test-Path -LiteralPath $Path)) {'+"^""`r`n"^""+' Write-Host ''Skipping: Key does not exist.'''+"^""`r`n"^""+' $global:skip++'+"^""`r`n"^""+' return'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $values = (Get-Item -LiteralPath $Path -ErrorAction Stop | Select-Object -ExpandProperty Property)'+"^""`r`n"^""+' foreach ($value in $values) {'+"^""`r`n"^""+' Write-Host "^""Renaming ''$value''"^""'+"^""`r`n"^""+' if ($value.EndsWith($suffix)) {'+"^""`r`n"^""+' Write-Host ''Skipping: Has suffix.'''+"^""`r`n"^""+' $global:skip++'+"^""`r`n"^""+' continue'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $backupName = $value + $suffix'+"^""`r`n"^""+' Write-Host "^""Renaming to ''$backupName''."^""'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Rename-ItemProperty -LiteralPath $Path -Name $value -NewName $backupName -ErrorAction Stop'+"^""`r`n"^""+' Write-Host ''Successfully renamed.'''+"^""`r`n"^""+' $global:ok++'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to rename value: $_"^""'+"^""`r`n"^""+' $global:fail++'+"^""`r`n"^""+' }'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $subkeys = @(Get-ChildItem -LiteralPath $Path -ErrorAction SilentlyContinue)'+"^""`r`n"^""+' foreach ($key in $subkeys) {'+"^""`r`n"^""+' Rename-KeyTree $key.PSPath'+"^""`r`n"^""+' }'+"^""`r`n"^""+' Write-Host "^""Renaming key ''$Path''."^""'+"^""`r`n"^""+' if ($Path.EndsWith($suffix)) {'+"^""`r`n"^""+' Write-Host ''Skipping: Has suffix.'''+"^""`r`n"^""+' $global:skip++'+"^""`r`n"^""+' } else {'+"^""`r`n"^""+' $backupPath = $Path + $suffix'+"^""`r`n"^""+' while (Test-Path -LiteralPath $backupPath) {'+"^""`r`n"^""+' $backupPath += $suffix'+"^""`r`n"^""+' }'+"^""`r`n"^""+' Write-Host "^""Renaming to ''$backupPath''."^""'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Rename-KeyWithAcl -Old $Path -New $backupPath -ErrorAction Stop'+"^""`r`n"^""+' Write-Host ''Successfully renamed.'''+"^""`r`n"^""+' $global:ok++'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to rename: $_"^""'+"^""`r`n"^""+' $global:fail++'+"^""`r`n"^""+' }'+"^""`r`n"^""+' }'+"^""`r`n"^""+'}'+"^""`r`n"^""+'Write-Host "^""Soft deleting registry key ''$rawPath'' recursively."^""'+"^""`r`n"^""+'$hive = $rawPath.Split(''\'')[0]'+"^""`r`n"^""+'$path = $hive + '':'' + $rawPath.Substring($hive.Length)'+"^""`r`n"^""+'Rename-KeyTree $path'+"^""`r`n"^""+'$totalItems = $global:ok + $global:skip + $global:fail'+"^""`r`n"^""+'Write-Host "^""Total items: $totalItems, Renamed: $global:ok, Skipped: $global:skip, Failed: $global:fail"^""'+"^""`r`n"^""+'if (($totalItems -eq 0) -or ($totalItems -eq $global:skip)) {'+"^""`r`n"^""+' Write-Host ''No items were processed. The operation had no effect.'''+"^""`r`n"^""+'} elseif ($global:fail -eq $totalItems) {'+"^""`r`n"^""+' throw "^""Operation failed. All $global:fail items could not be processed."^""'+"^""`r`n"^""+'} elseif ($global:ok) {'+"^""`r`n"^""+' Write-Host "^""Successfully processed $global:ok item(s)."^""'+"^""`r`n"^""+'}'; Invoke-AsTrustedInstaller $cmd"
:: Soft-delete the registry key: HKLM\Software\Microsoft\WindowsRuntime\ActivatableClassId\Microsoft.OneCore.WebThreatDefense.Configuration.WTDUserSettings as TrustedInstaller
:: This operation will not run on Windows versions earlier than Windows11-22H2.
PowerShell -ExecutionPolicy Unrestricted -Command "$versionName = 'Windows11-22H2'; $buildNumber = switch ($versionName) { 'Windows11-FirstRelease' { '10.0.22000' }; 'Windows11-22H2' { '10.0.22621' }; 'Windows11-21H2' { '10.0.22000' }; 'Windows10-22H2' { '10.0.19045' }; 'Windows10-21H2' { '10.0.19044' }; 'Windows10-20H2' { '10.0.19042' }; 'Windows10-1909' { '10.0.18363' }; 'Windows10-1607' { '10.0.14393' }; default { throw "^""Internal privacy$([char]0x002E)sexy error: No build for minimum Windows '$versionName'"^""; }; }; $minVersion = [System.Version]::Parse($buildNumber); $ver = [Environment]::OSVersion.Version; $verNoPatch = [System.Version]::new($ver.Major, $ver.Minor, $ver.Build); if ($verNoPatch -lt $minVersion) { Write-Output "^""Skipping: Windows ($verNoPatch) is below minimum $minVersion ($versionName)"^""; Exit 0; }function Invoke-AsTrustedInstaller($Script) { $principalSid = [System.Security.Principal.SecurityIdentifier]::new('S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464'); $principalName = $principalSid.Translate([System.Security.Principal.NTAccount]); $streamFile = New-TemporaryFile; $scriptFile = New-TemporaryFile; try { $scriptFile = Rename-Item -LiteralPath $scriptFile -NewName ($scriptFile.BaseName + '.ps1') -Force -PassThru; $Script | Out-File $scriptFile -Encoding UTF8; $taskName = "^""privacy$([char]0x002E)sexy invoke"^""; schtasks.exe /delete /tn $taskName /f 2>&1 | Out-Null; $executionCommand = "^""powershell.exe -ExecutionPolicy Bypass -File '$scriptFile' *>&1 | Out-File -FilePath '$streamFile' -Encoding UTF8"^""; $action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument "^""-ExecutionPolicy Bypass -Command `"^""$executionCommand`"^"""^""; $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName $taskName -Action $action -Settings $settings -Force -ErrorAction Stop | Out-Null; try { ($scheduleService = New-Object -ComObject Schedule.Service).Connect(); $scheduleService.GetFolder('\').GetTask($taskName).RunEx($null, 0, 0, $principalName) | Out-Null; $timeout = (Get-Date).AddMinutes(5); Write-Host "^""Running as $principalName"^""; while ((Get-ScheduledTaskInfo $taskName).LastTaskResult -eq 267009) { Start-Sleep -Milliseconds 200; if ((Get-Date) -gt $timeout) { Write-Warning 'Skipping: Timeout'; break; }; }; if (($result = (Get-ScheduledTaskInfo $taskName).LastTaskResult) -ne 0) { Write-Error "^""Failed, due to exit code: $result."^""; } } finally { schtasks.exe /delete /tn $taskName /f | Out-Null; }; Get-Content $streamFile } finally { Remove-Item $streamFile, $scriptFile; }; }; $cmd = 'function Copy-Acl($Src, $Dst) {'+"^""`r`n"^""+' $srcKeys = @(Get-ChildItem -LiteralPath $Src -ErrorAction SilentlyContinue)'+"^""`r`n"^""+' foreach ($key in $srcKeys) {'+"^""`r`n"^""+' $dstKey = Join-Path $Dst $key.PSChildName'+"^""`r`n"^""+' Copy-Acl -Src $key.PSPath -Dst $dstKey'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $acl = Get-Acl -Path $Src -ErrorAction Stop'+"^""`r`n"^""+' $sections = [System.Security.AccessControl.AccessControlSections]::All -band (-bnot [System.Security.AccessControl.AccessControlSections]::Owner)'+"^""`r`n"^""+' $sddl = $acl.GetSecurityDescriptorSddlForm($sections)'+"^""`r`n"^""+' $acl.SetSecurityDescriptorSddlForm($sddl, $sections)'+"^""`r`n"^""+' Set-Acl -Path $Dst -AclObject $acl -ErrorAction Stop'+"^""`r`n"^""+'}'+"^""`r`n"^""+'function Rename-KeyWithAcl($Old, $New) {'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Copy-Item -LiteralPath $Old -Destination $New -Recurse -Force -ErrorAction Stop'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' throw "^""Failed to copy: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Copy-Acl -Src $Old -Dst $New'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to copy ACL: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Remove-Item -LiteralPath $Old -Force -Recurse -ErrorAction Stop | Out-Null'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Remove-Item -LiteralPath $New -Force -Recurse -ErrorAction Stop | Out-Null'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to clean up: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' throw "^""Failed to remove: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+'}'+"^""`r`n"^""+'$rawPath=''HKLM\Software\Microsoft\WindowsRuntime\ActivatableClassId\Microsoft.OneCore.WebThreatDefense.Configuration.WTDUserSettings'''+"^""`r`n"^""+'$suffix=''.OLD'''+"^""`r`n"^""+'$global:ok = 0'+"^""`r`n"^""+'$global:skip = 0'+"^""`r`n"^""+'$global:fail = 0'+"^""`r`n"^""+'function Rename-KeyTree($Path) {'+"^""`r`n"^""+' Write-Host "^""Processing key: $Path"^""'+"^""`r`n"^""+' if (-Not (Test-Path -LiteralPath $Path)) {'+"^""`r`n"^""+' Write-Host ''Skipping: Key does not exist.'''+"^""`r`n"^""+' $global:skip++'+"^""`r`n"^""+' return'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $values = (Get-Item -LiteralPath $Path -ErrorAction Stop | Select-Object -ExpandProperty Property)'+"^""`r`n"^""+' foreach ($value in $values) {'+"^""`r`n"^""+' Write-Host "^""Renaming ''$value''"^""'+"^""`r`n"^""+' if ($value.EndsWith($suffix)) {'+"^""`r`n"^""+' Write-Host ''Skipping: Has suffix.'''+"^""`r`n"^""+' $global:skip++'+"^""`r`n"^""+' continue'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $backupName = $value + $suffix'+"^""`r`n"^""+' Write-Host "^""Renaming to ''$backupName''."^""'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Rename-ItemProperty -LiteralPath $Path -Name $value -NewName $backupName -ErrorAction Stop'+"^""`r`n"^""+' Write-Host ''Successfully renamed.'''+"^""`r`n"^""+' $global:ok++'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to rename value: $_"^""'+"^""`r`n"^""+' $global:fail++'+"^""`r`n"^""+' }'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $subkeys = @(Get-ChildItem -LiteralPath $Path -ErrorAction SilentlyContinue)'+"^""`r`n"^""+' foreach ($key in $subkeys) {'+"^""`r`n"^""+' Rename-KeyTree $key.PSPath'+"^""`r`n"^""+' }'+"^""`r`n"^""+' Write-Host "^""Renaming key ''$Path''."^""'+"^""`r`n"^""+' if ($Path.EndsWith($suffix)) {'+"^""`r`n"^""+' Write-Host ''Skipping: Has suffix.'''+"^""`r`n"^""+' $global:skip++'+"^""`r`n"^""+' } else {'+"^""`r`n"^""+' $backupPath = $Path + $suffix'+"^""`r`n"^""+' while (Test-Path -LiteralPath $backupPath) {'+"^""`r`n"^""+' $backupPath += $suffix'+"^""`r`n"^""+' }'+"^""`r`n"^""+' Write-Host "^""Renaming to ''$backupPath''."^""'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Rename-KeyWithAcl -Old $Path -New $backupPath -ErrorAction Stop'+"^""`r`n"^""+' Write-Host ''Successfully renamed.'''+"^""`r`n"^""+' $global:ok++'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to rename: $_"^""'+"^""`r`n"^""+' $global:fail++'+"^""`r`n"^""+' }'+"^""`r`n"^""+' }'+"^""`r`n"^""+'}'+"^""`r`n"^""+'Write-Host "^""Soft deleting registry key ''$rawPath'' recursively."^""'+"^""`r`n"^""+'$hive = $rawPath.Split(''\'')[0]'+"^""`r`n"^""+'$path = $hive + '':'' + $rawPath.Substring($hive.Length)'+"^""`r`n"^""+'Rename-KeyTree $path'+"^""`r`n"^""+'$totalItems = $global:ok + $global:skip + $global:fail'+"^""`r`n"^""+'Write-Host "^""Total items: $totalItems, Renamed: $global:ok, Skipped: $global:skip, Failed: $global:fail"^""'+"^""`r`n"^""+'if (($totalItems -eq 0) -or ($totalItems -eq $global:skip)) {'+"^""`r`n"^""+' Write-Host ''No items were processed. The operation had no effect.'''+"^""`r`n"^""+'} elseif ($global:fail -eq $totalItems) {'+"^""`r`n"^""+' throw "^""Operation failed. All $global:fail items could not be processed."^""'+"^""`r`n"^""+'} elseif ($global:ok) {'+"^""`r`n"^""+' Write-Host "^""Successfully processed $global:ok item(s)."^""'+"^""`r`n"^""+'}'; Invoke-AsTrustedInstaller $cmd"
Help

How to apply or restore "Disable SmartScreen Enhanced Phishing Protection Web background services" using commands

  • ≈ 2 min to complete
  • Tools: Command Prompt
  • Difficulty: Medium
  • ≈ 3 instructions
View step-by-step guide with screenshots
  1. 1

    Open Command Prompt

    Open Command Prompt as Administrator.
  2. 2

    Copy code

  3. 3

    Paste & run

    Paste the commands into Command Prompt and press Enter to run.

    Some changes require a system restart to take effect

Similar Guides

Wider Goal

Guides below includes this guide to achieve a wider goal.See other more general settings that includes this one as one of its actions.
These plans combine multiple privacy settings, including this one, for stronger protection.
This category contains scripts to disable SmartScreen's Enhanced Phishing Protection feature, which monitors password usage and sends data to Microsoft. ...

Disable SmartScreen Enhanced Phishing Protection


About the Creators

These people have authored this documentation and written its scripts:

  • Avatar of undergroundwires. The creator of PrivacyLearn and privacy.sexy. Black and white portrait showing a person wearing a polka dot tie and suit jacket, reflecting the professional expertise behind the privacy protection tools.
    • Certified security professional
    • 7+ years experience securing banks
    • Open-source developer since 2005
    • EU advisor, Public Speaker, Moderator
    • Hundreds across the globe
    • Testers, reviewers, developers
    • Companies, military agencies
    • Community since 2017

Reviewed By

This guide has undergone comprehensive auditing and peer review:
  • Expert review by undergroundwires

    • Verified technical accuracy and editorial standards
    • Assessed system impact and user privacy risks
    • Audited and verified using automated security tests
  • Public review by large community

    • Privacy enthusiasts and professionals peer-reviewed
    • Millions of end-users tested across different environments
    • Audited and verified using third-party security software

History

We continually monitor our guides, their impact and other potential privacy options. We update our guides when new information becomes available. On every update, we publicly store who made the change, what has been changed, why the change was made and when the change was made.