windows

windows/system/advanced-settings/apply.ps1

@@ -0,0 +1,78 @@
+[CmdletBinding()]
+param(
+    [string] $TargetUserSid = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+)
+
+$ErrorActionPreference = "Stop"
+
+function Test-Administrator {
+    $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+    $principal = [Security.Principal.WindowsPrincipal]::new($identity)
+
+    return $principal.IsInRole(
+        [Security.Principal.WindowsBuiltInRole]::Administrator
+    )
+}
+
+if (-not (Test-Administrator)) {
+    $powershell = (Get-Process -Id $PID).Path
+    $arguments = @(
+        "-NoProfile"
+        "-ExecutionPolicy"
+        "Bypass"
+        "-File"
+        ('"{0}"' -f $PSCommandPath)
+        "-TargetUserSid"
+        $TargetUserSid
+    )
+
+    $process = Start-Process `
+        -FilePath $powershell `
+        -ArgumentList $arguments `
+        -Verb RunAs `
+        -Wait `
+        -PassThru
+
+    if ($process.ExitCode -ne 0) {
+        throw "Elevated advanced settings failed with exit code $($process.ExitCode)."
+    }
+
+    return
+}
+
+$explorerPolicyKey = Join-Path `
+    "Registry::HKEY_USERS\$TargetUserSid" `
+    "Software\Policies\Microsoft\Windows\Explorer"
+
+New-Item -Path $explorerPolicyKey -Force | Out-Null
+New-ItemProperty `
+    -Path $explorerPolicyKey `
+    -Name "ShowRunAsDifferentUserInStart" `
+    -PropertyType DWord `
+    -Value 1 `
+    -Force | Out-Null
+
+$showRunAsDifferentUser = Get-ItemPropertyValue `
+    -Path $explorerPolicyKey `
+    -Name "ShowRunAsDifferentUserInStart"
+
+if ($showRunAsDifferentUser -ne 1) {
+    throw 'Failed to enable "Run as different user" in Start.'
+}
+
+$fileSystemKey = "HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem"
+
+New-ItemProperty `
+    -Path $fileSystemKey `
+    -Name "LongPathsEnabled" `
+    -PropertyType DWord `
+    -Value 1 `
+    -Force | Out-Null
+
+$longPathsEnabled = Get-ItemPropertyValue `
+    -Path $fileSystemKey `
+    -Name "LongPathsEnabled"
+
+if ($longPathsEnabled -ne 1) {
+    throw "Failed to enable Win32 long paths."
+}

windows/system/advanced-settings/configuration.dsc.yaml

@@ -0,0 +1,20 @@
+$schema: https://aka.ms/dsc/schemas/v3/bundled/config/document.json
+
+resources:
+  - name: Enable End task from the taskbar
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\TaskbarDeveloperSettings
+      valueName: TaskbarEndTask
+      valueData:
+        DWord: 1
+      _exist: true
+
+  - name: Enable clipboard history
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Clipboard
+      valueName: EnableClipboardHistory
+      valueData:
+        DWord: 1
+      _exist: true

windows/system/device-usage.dsc.yaml

@@ -0,0 +1,128 @@
+$schema: https://aka.ms/dsc/schemas/v3/bundled/config/document.json
+
+resources:
+  - name: Disable development usage
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\CloudExperienceHost\Intent\developer
+      valueName: Intent
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Clear development priority
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\CloudExperienceHost\Intent\developer
+      valueName: Priority
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Disable gaming usage
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\CloudExperienceHost\Intent\gaming
+      valueName: Intent
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Clear gaming priority
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\CloudExperienceHost\Intent\gaming
+      valueName: Priority
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Disable family usage
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\CloudExperienceHost\Intent\family
+      valueName: Intent
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Clear family priority
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\CloudExperienceHost\Intent\family
+      valueName: Priority
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Disable creativity usage
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\CloudExperienceHost\Intent\creative
+      valueName: Intent
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Clear creativity priority
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\CloudExperienceHost\Intent\creative
+      valueName: Priority
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Disable school usage
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\CloudExperienceHost\Intent\schoolwork
+      valueName: Intent
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Clear school priority
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\CloudExperienceHost\Intent\schoolwork
+      valueName: Priority
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Disable entertainment usage
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\CloudExperienceHost\Intent\entertainment
+      valueName: Intent
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Clear entertainment priority
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\CloudExperienceHost\Intent\entertainment
+      valueName: Priority
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Disable business usage
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\CloudExperienceHost\Intent\business
+      valueName: Intent
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Clear business priority
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\CloudExperienceHost\Intent\business
+      valueName: Priority
+      valueData:
+        DWord: 0
+      _exist: true

windows/system/explorer.dsc.yaml

@@ -9,3 +9,39 @@ resources:
       valueData:
         DWord: 0
       _exist: true
+
+  - name: Show hidden files
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
+      valueName: Hidden
+      valueData:
+        DWord: 1
+      _exist: true
+
+  - name: Show protected operating system files
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
+      valueName: ShowSuperHidden
+      valueData:
+        DWord: 1
+      _exist: true
+
+  - name: Show full path in title bar
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState
+      valueName: FullPath
+      valueData:
+        DWord: 1
+      _exist: true
+
+  - name: Show empty drives
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
+      valueName: HideDrivesWithNoMedia
+      valueData:
+        DWord: 0
+      _exist: true

windows/system/lock-screen/apply.ps1

@@ -0,0 +1,87 @@
+$ErrorActionPreference = "Stop"
+
+function Wait-WinRtOperation {
+    param(
+        [Parameter(Mandatory)]
+        [object] $Operation,
+
+        [Parameter(Mandatory)]
+        [type] $ResultType
+    )
+
+    $asTask = [System.WindowsRuntimeSystemExtensions].GetMethods() |
+        Where-Object {
+            $_.Name -eq "AsTask" -and
+            $_.IsGenericMethod -and
+            $_.GetParameters().Count -eq 1 -and
+            $_.GetParameters()[0].ParameterType.Name -eq "IAsyncOperation``1"
+        } |
+        Select-Object -First 1
+
+    if (-not $asTask) {
+        throw "The WinRT AsTask adapter was not found."
+    }
+
+    $task = $asTask.MakeGenericMethod($ResultType).Invoke($null, @($Operation))
+    return $task.GetAwaiter().GetResult()
+}
+
+function Wait-WinRtAction {
+    param(
+        [Parameter(Mandatory)]
+        [object] $Action
+    )
+
+    $asTask = [System.WindowsRuntimeSystemExtensions].GetMethods() |
+        Where-Object {
+            $_.Name -eq "AsTask" -and
+            -not $_.IsGenericMethod -and
+            $_.GetParameters().Count -eq 1 -and
+            $_.GetParameters()[0].ParameterType.Name -eq "IAsyncAction"
+        } |
+        Select-Object -First 1
+
+    if (-not $asTask) {
+        throw "The WinRT action adapter was not found."
+    }
+
+    $task = $asTask.Invoke($null, @($Action))
+    $task.GetAwaiter().GetResult()
+}
+
+Add-Type -AssemblyName System.Runtime.WindowsRuntime
+[Windows.Storage.StorageFile, Windows.Storage, ContentType = WindowsRuntime] |
+    Out-Null
+[Windows.System.UserProfile.LockScreen, Windows.System.UserProfile, ContentType = WindowsRuntime] |
+    Out-Null
+
+$imagePath = Join-Path $env:SystemRoot "Web\Screen\img100.jpg"
+
+if (-not (Test-Path -LiteralPath $imagePath -PathType Leaf)) {
+    throw "The default Windows lock screen image was not found: $imagePath"
+}
+
+$currentImage = [Windows.System.UserProfile.LockScreen]::OriginalImageFile
+$currentPath = if ($currentImage) {
+    $currentImage.AbsolutePath.Replace("/", "\")
+}
+
+if ($currentPath -ieq $imagePath) {
+    return
+}
+
+$file = Wait-WinRtOperation `
+    -Operation ([Windows.Storage.StorageFile]::GetFileFromPathAsync($imagePath)) `
+    -ResultType ([Windows.Storage.StorageFile])
+
+Wait-WinRtAction `
+    -Action ([Windows.System.UserProfile.LockScreen]::SetImageFileAsync($file))
+
+$updatedPath = [Windows.System.UserProfile.LockScreen]::OriginalImageFile.AbsolutePath.Replace(
+    "/",
+    "\"
+)
+
+if ($updatedPath -ine $imagePath) {
+    throw "Windows did not accept the default lock screen image."
+}

windows/system/personalization.dsc.yaml

@@ -0,0 +1,71 @@
+$schema: https://aka.ms/dsc/schemas/v3/bundled/config/document.json
+
+resources:
+  - name: Use dark app mode
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize
+      valueName: AppsUseLightTheme
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Use dark Windows mode
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize
+      valueName: SystemUsesLightTheme
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Choose accent color automatically
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Control Panel\Desktop
+      valueName: AutoColorization
+      valueData:
+        DWord: 1
+      _exist: true
+
+  - name: Disable rotating lock screen
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager
+      valueName: RotatingLockScreenEnabled
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Disable lock screen facts and tips
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager
+      valueName: RotatingLockScreenOverlayEnabled
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Disable lock screen slideshow
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager
+      valueName: SlideshowEnabled
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Do not automatically select lock screen widgets
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\Lock Screen
+      valueName: AutoSelectWidgetsOnLockScreen
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Clear selected lock screen status
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\Lock Screen\FeedManager\Selected
+      _exist: false

windows/system/power/apply.ps1

@@ -0,0 +1,138 @@
+$ErrorActionPreference = "Stop"
+
+if (-not ("WindowsPowerMode.NativeMethods" -as [type])) {
+    Add-Type -TypeDefinition @"
+using System;
+using System.Runtime.InteropServices;
+
+namespace WindowsPowerMode
+{
+    public static class NativeMethods
+    {
+        [DllImport("powrprof.dll")]
+        public static extern uint PowerSetUserConfiguredACPowerMode(
+            ref Guid powerModeGuid);
+
+        [DllImport("powrprof.dll")]
+        public static extern uint PowerSetUserConfiguredDCPowerMode(
+            ref Guid powerModeGuid);
+
+        [DllImport("powrprof.dll")]
+        public static extern uint PowerGetUserConfiguredACPowerMode(
+            out Guid powerModeGuid);
+
+        [DllImport("powrprof.dll")]
+        public static extern uint PowerGetUserConfiguredDCPowerMode(
+            out Guid powerModeGuid);
+    }
+}
+"@
+}
+
+function Assert-Win32Success {
+    param(
+        [Parameter(Mandatory)]
+        [uint32] $Result,
+
+        [Parameter(Mandatory)]
+        [string] $Operation
+    )
+
+    if ($Result -ne 0) {
+        $message = [ComponentModel.Win32Exception]::new([int] $Result).Message
+        throw "$Operation failed: $message (error $Result)."
+    }
+}
+
+function Invoke-PowerCfg {
+    param(
+        [Parameter(Mandatory)]
+        [string[]] $Arguments
+    )
+
+    & $script:powerCfg @Arguments | Out-Null
+
+    if ($LASTEXITCODE -ne 0) {
+        throw "powercfg $($Arguments -join ' ') failed with exit code $LASTEXITCODE."
+    }
+}
+
+$bestPerformance = [guid] "ded574b5-45a0-4f42-8737-46345c09c238"
+
+$result = [WindowsPowerMode.NativeMethods]::PowerSetUserConfiguredACPowerMode(
+    [ref] $bestPerformance
+)
+Assert-Win32Success $result "Setting the AC power mode"
+
+$result = [WindowsPowerMode.NativeMethods]::PowerSetUserConfiguredDCPowerMode(
+    [ref] $bestPerformance
+)
+Assert-Win32Success $result "Setting the DC power mode"
+
+$actualAcMode = [guid]::Empty
+$result = [WindowsPowerMode.NativeMethods]::PowerGetUserConfiguredACPowerMode(
+    [ref] $actualAcMode
+)
+Assert-Win32Success $result "Reading the AC power mode"
+
+$actualDcMode = [guid]::Empty
+$result = [WindowsPowerMode.NativeMethods]::PowerGetUserConfiguredDCPowerMode(
+    [ref] $actualDcMode
+)
+Assert-Win32Success $result "Reading the DC power mode"
+
+if ($actualAcMode -ne $bestPerformance -or $actualDcMode -ne $bestPerformance) {
+    throw "Windows did not retain Best performance for both AC and DC power."
+}
+
+$script:powerCfg = Join-Path $env:SystemRoot "System32\powercfg.exe"
+$energySaverSubgroup = "de830923-a562-41af-a086-e3a2c6bad2da"
+$energySaverThreshold = "e69653ca-cf7f-4f05-aa73-cb833fa90ad4"
+$guidPattern = "[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}"
+
+$activeSchemeOutput = & $script:powerCfg /getactivescheme
+if ($LASTEXITCODE -ne 0) {
+    throw "Failed to read the active power scheme."
+}
+
+$activeScheme = [regex]::Match(
+    ($activeSchemeOutput -join [Environment]::NewLine),
+    $guidPattern
+).Value
+
+if (-not $activeScheme) {
+    throw "The active power scheme GUID could not be parsed."
+}
+
+$schemeOutput = & $script:powerCfg /list
+if ($LASTEXITCODE -ne 0) {
+    throw "Failed to enumerate power schemes."
+}
+
+$schemes = [regex]::Matches(
+    ($schemeOutput -join [Environment]::NewLine),
+    $guidPattern
+).Value | Sort-Object -Unique
+
+if (-not $schemes) {
+    throw "No power schemes were found."
+}
+
+foreach ($scheme in $schemes) {
+    Invoke-PowerCfg @(
+        "/setacvalueindex"
+        $scheme
+        $energySaverSubgroup
+        $energySaverThreshold
+        "0"
+    )
+    Invoke-PowerCfg @(
+        "/setdcvalueindex"
+        $scheme
+        $energySaverSubgroup
+        $energySaverThreshold
+        "0"
+    )
+}
+
+Invoke-PowerCfg @("/setactive", $activeScheme)

windows/system/start.dsc.yaml

@@ -0,0 +1,38 @@
+$schema: https://aka.ms/dsc/schemas/v3/bundled/config/document.json
+
+resources:
+  - name: Show recently added apps
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\Start
+      valueName: ShowRecentList
+      valueData:
+        DWord: 1
+      _exist: true
+
+  - name: Hide recommended and recent files
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
+      valueName: Start_TrackDocs
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Hide recommendations for tips and new apps
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
+      valueName: Start_IrisRecommendations
+      valueData:
+        DWord: 0
+      _exist: true
+
+  - name: Show most used apps
+    type: Microsoft.Windows/Registry
+    properties:
+      keyPath: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
+      valueName: Start_TrackProgs
+      valueData:
+        DWord: 1
+      _exist: true