categories/BackgroundActivity.ps1
|
# Background Activity category: services/content-fetching that run in the background without # being explicitly requested - Windows Spotlight, tips/suggestions, silent app installs, # notifications, search history, Storage Sense, Find My Device, BitLocker auto-encryption. # research.md -> background-activity category table (008). # # ponytail: Location Services was dropped - the existing `services` category already disables # the lfsvc service directly (a more complete stop than flipping its Configuration\Status flag), # adding a second, weaker mechanism for the same underlying feature here would duplicate # coverage (FR-037's spirit, even though the two TargetIdentifiers technically differ). Modern # Standby networking was dropped - its Group Policy GUID couldn't be confirmed against a real # Windows 11 install (`powercfg /q` shows no matching subgroup on the desktop hardware available # for this project), and this machine has no Modern Standby support to test against at all. function Get-OctaBackgroundActivityCategory { [CmdletBinding()] param() return [pscustomobject]@{ Id = 'background-activity' DisplayName = 'Background Activity' Description = 'Spotlight, suggestions, notifications, search history, Storage Sense, Find My Device, BitLocker auto-encryption' RequiresElevation = $true ContainsIrreversibleActions = $false GetActionsFunction = 'Get-OctaBackgroundActivityActions' ApplyActionFunction = 'Set-OctaBackgroundActivityAction' } } function Get-OctaBackgroundActivityActions { [CmdletBinding()] param() $actions = @() $cloudContentKey = 'HKCU:\SOFTWARE\Policies\Microsoft\Windows\CloudContent' $spotlight = (Get-ItemProperty -Path $cloudContentKey -Name 'DisableWindowsSpotlightFeatures' -ErrorAction SilentlyContinue).DisableWindowsSpotlightFeatures if ($spotlight -ne 1) { $displayCurrent = if ($null -eq $spotlight) { '(not set)' } else { $spotlight } $actions += New-OctaAction -TargetType Registry -TargetIdentifier "$cloudContentKey|DisableWindowsSpotlightFeatures" ` -CurrentValue $displayCurrent -PlannedValue 1 -Reversible $true -RiskLevel Safe } $cdmKey = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' $cdmTargets = @( @{ Name = 'SubscribedContent-338389Enabled'; Label = 'tips/tricks/suggestions' } @{ Name = 'SubscribedContent-338387Enabled'; Label = 'lock screen tips' } @{ Name = 'SystemPaneSuggestionsEnabled'; Label = 'system suggestions' } @{ Name = 'SilentInstalledAppsEnabled'; Label = 'silent-installed suggested apps' } ) foreach ($t in $cdmTargets) { $current = (Get-ItemProperty -Path $cdmKey -Name $t.Name -ErrorAction SilentlyContinue).($t.Name) if ($current -ne 0) { $displayCurrent = if ($null -eq $current) { '(not set)' } else { $current } $actions += New-OctaAction -TargetType Registry -TargetIdentifier "$cdmKey|$($t.Name)" ` -CurrentValue $displayCurrent -PlannedValue 0 -Reversible $true -RiskLevel Safe } } $pushKey = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\PushNotifications' $toast = (Get-ItemProperty -Path $pushKey -Name 'ToastEnabled' -ErrorAction SilentlyContinue).ToastEnabled if ($toast -ne 0) { $displayCurrent = if ($null -eq $toast) { '(not set)' } else { $toast } $actions += New-OctaAction -TargetType Registry -TargetIdentifier "$pushKey|ToastEnabled" ` -CurrentValue $displayCurrent -PlannedValue 0 -Reversible $true -RiskLevel Moderate } $searchSettingsKey = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\SearchSettings' $searchHistory = (Get-ItemProperty -Path $searchSettingsKey -Name 'IsDeviceSearchHistoryEnabled' -ErrorAction SilentlyContinue).IsDeviceSearchHistoryEnabled if ($searchHistory -ne 0) { $displayCurrent = if ($null -eq $searchHistory) { '(not set)' } else { $searchHistory } $actions += New-OctaAction -TargetType Registry -TargetIdentifier "$searchSettingsKey|IsDeviceSearchHistoryEnabled" ` -CurrentValue $displayCurrent -PlannedValue 0 -Reversible $true -RiskLevel Safe } $storageSenseKey = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\StorageSense\Parameters\StoragePolicy' $storageSense = (Get-ItemProperty -Path $storageSenseKey -Name '01' -ErrorAction SilentlyContinue).'01' if ($storageSense -ne 0) { $displayCurrent = if ($null -eq $storageSense) { '(not set)' } else { $storageSense } $actions += New-OctaAction -TargetType Registry -TargetIdentifier "$storageSenseKey|01" ` -CurrentValue $displayCurrent -PlannedValue 0 -Reversible $true -RiskLevel Moderate } $findMyDeviceKey = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\FindMyDevice' $findMyDevice = (Get-ItemProperty -Path $findMyDeviceKey -Name 'LocationSyncEnabled' -ErrorAction SilentlyContinue).LocationSyncEnabled if ($findMyDevice -ne 0) { $displayCurrent = if ($null -eq $findMyDevice) { '(not set)' } else { $findMyDevice } $actions += New-OctaAction -TargetType Registry -TargetIdentifier "$findMyDeviceKey|LocationSyncEnabled" ` -CurrentValue $displayCurrent -PlannedValue 0 -Reversible $true -RiskLevel Safe } # BitLocker auto-device-encryption - edition-gated: only offered if BitLocker's management # cmdlets are actually present (absent on Home edition), reports nothing to do otherwise. if (Get-Command -Name 'Get-BitLockerVolume' -ErrorAction SilentlyContinue) { $bitlockerKey = 'HKLM:\SYSTEM\CurrentControlSet\Control\BitLocker' $preventEncryption = (Get-ItemProperty -Path $bitlockerKey -Name 'PreventDeviceEncryption' -ErrorAction SilentlyContinue).PreventDeviceEncryption if ($preventEncryption -ne 1) { $displayCurrent = if ($null -eq $preventEncryption) { '(not set)' } else { $preventEncryption } $actions += New-OctaAction -TargetType Registry -TargetIdentifier "$bitlockerKey|PreventDeviceEncryption" ` -CurrentValue $displayCurrent -PlannedValue 1 -Reversible $true -RiskLevel Moderate } } return $actions } function Set-OctaBackgroundActivityAction { [CmdletBinding()] param([Parameter(Mandatory)]$Action) $keyPath, $valueName = $Action.TargetIdentifier -split '\|', 2 if (-not (Test-Path $keyPath)) { New-Item -Path $keyPath -Force | Out-Null } Set-ItemProperty -Path $keyPath -Name $valueName -Value $Action.PlannedValue -Type DWord } |