Win11-Privacy.ps1 使用文档

powershell -ExecutionPolicy Bypass -File .\Win11-Privacy.ps1 -Mode Enable

powershell -ExecutionPolicy Bypass -File .\Win11-Privacy.ps1 -Mode Disable -RestartExplorer

<#
.SYNOPSIS
  Win11-Privacy.ps1 v1.2 — Windows 11 数据外发加固脚本（单文件 / 零依赖 / 可回滚）
  适用: Windows 11 24H2 各版本；IoT 企业版 LTSC 效果最佳（支持"安全级"遥测）
.CHANGELOG
  v1.2
    1.[整合] 注册表写入升级为「四层自动修复」级联，失败项全自动处理、无需人工干预：
           ① 直接写入 → ② 修复键ACL后重试 → ③ 删除旧值/同名子键残留后重建 → ④ reg.exe 兜底
    2.[新增] -RestartExplorer 开关：结束时自动重启资源管理器使任务栏设置立即生效
    3.[优化] 汇总区新增"自动修复"计数；失败判读更新（四层修复后仍失败≈安全软件注册表防护拦截）
  v1.1
    1.[FIX] 计划任务 TaskPath 尾部反斜杠导致 0 匹配 → 全量索引精确匹配
    2.[FIX] 删除防火墙段残留垃圾行
    3.[新增] 注册表写入 try/catch + ACL 自动修复 + 末尾失败汇总
    4.[新增] Status 模式免管理员，显示运行身份
  v1.0 初版
.EXAMPLE
  .\Win11-Privacy.ps1 -Mode Disable                       # 加固（默认档，可安全重复执行）
  .\Win11-Privacy.ps1 -Mode Disable -Aggressive           # 连同有副作用的项一起关闭
  .\Win11-Privacy.ps1 -Mode Disable -RestartExplorer      # 加固并立即重启资源管理器
  .\Win11-Privacy.ps1 -Mode Disable -BlockTelemetryHosts  # 额外屏蔽遥测域名(hosts)
  .\Win11-Privacy.ps1 -Mode Enable                        # 按微软默认值全部还原
  .\Win11-Privacy.ps1 -Mode Status                        # 审计当前状态（无需管理员）
.NOTES
  - HKCU 部分只写入"运行本脚本的账户"：多用户环境请在每个账户下各执行一次
  - 文件保存编码必须为 UTF-8 with BOM（否则中文注释/提示会乱码）
  - 幂等：重复执行 Disable 安全无副作用
#>
[CmdletBinding()]
param(
  [ValidateSet('Disable','Enable','Status')][string]$Mode = 'Disable',
  [switch]$Aggressive,
  [switch]$BlockTelemetryHosts,
  [switch]$RestartExplorer
)

 $Disable = ($Mode -eq 'Disable')

# ==================== 权限检查（Status 免提权） ====================
if ($Mode -ne 'Status') {
  $id = [Security.Principal.WindowsIdentity]::GetCurrent()
  if (-not (New-Object Security.Principal.WindowsPrincipal($id)).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    throw 'Disable/Enable 需在管理员 PowerShell 中运行（Status 可不提权）。'
  }
}

# ==================== 工具函数 ====================
 $script:RegOk   = 0
 $script:RegFix  = 0
 $script:RegFail = New-Object System.Collections.Generic.List[string]

function Set-Reg {                       # 底层写入（失败即抛出）
  param($Path,$Name,$Value,[string]$Type='DWord')
  if (-not (Test-Path $Path)) { New-Item -Path $Path -Force -ErrorAction Stop | Out-Null }
  New-ItemProperty -Path $Path -Name $Name -Value $Value -PropertyType $Type -Force -ErrorAction Stop | Out-Null
}
function Remove-Reg { param($Path,$Name)
  Remove-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue
}
function Repair-RegAcl {                 # 给当前用户补上该键的完全控制权限
  param($Path)
  try {
    if (-not (Test-Path $Path)) { return $false }
    $me   = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
    $acl  = Get-Acl -Path $Path
    $rule = New-Object System.Security.AccessControl.RegistryAccessRule($me,'FullControl','ContainerInherit','None','Allow')
    $acl.SetAccessRule($rule)
    Set-Acl -Path $Path -AclObject $acl
    return $true
  } catch { return $false }
}
function Set-RegChecked {                # ★ 四层自动修复写入（v1.2 核心）
  param($Path,$Name,$Value,[string]$Type='DWord')

  # ─ 第 1 层：直接写入（绝大多数情况在此成功） ─
  try { Set-Reg -Path $Path -Name $Name -Value $Value -Type $Type; $script:RegOk++; return } catch { }

  # ─ 第 2 层：修复键 ACL 后重试（键权限被 tweak 工具/定制镜像改坏） ─
  if (Repair-RegAcl $Path) {
    try { Set-Reg -Path $Path -Name $Name -Value $Value -Type $Type
          Write-Host "  [自动修复] $Path\$Name ← 键权限已修复" -ForegroundColor Yellow
          $script:RegFix++; return } catch { }
  }

  # ─ 第 3 层：删除旧值/同名子键残留后重建（值状态异常，如 TaskbarDa） ─
  try {
    Remove-ItemProperty -Path $Path -Name $Name -Force -ErrorAction SilentlyContinue
    Remove-Item -Path (Join-Path $Path $Name) -Recurse -Force -ErrorAction SilentlyContinue
    Set-Reg -Path $Path -Name $Name -Value $Value -Type $Type
    Write-Host "  [自动修复] $Path\$Name ← 已删除重建" -ForegroundColor Yellow
    $script:RegFix++; return
  } catch { }

  # ─ 第 4 层：reg.exe 兜底（独立于 PowerShell 提供程序的写入路径） ─
  $rt = switch ($Type) { 'DWord'{'REG_DWORD'} 'QWord'{'REG_QWORD'} 'String'{'REG_SZ'}
                         'ExpandString'{'REG_EXPAND_SZ'} 'Binary'{'REG_BINARY'} default{'REG_DWORD'} }
  $rp = $Path -replace ':(?=\\)', ''
  reg.exe add "$rp" /v "$Name" /t $rt /d "$Value" /f | Out-Null
  if ($LASTEXITCODE -eq 0) {
    Write-Host "  [自动修复] $Path\$Name ← 经 reg.exe 写入" -ForegroundColor Yellow
    $script:RegFix++; return
  }

  # ─ 全部失败：记录（四层修复后仍失败 ≈ 安全软件「注册表防护」拦截） ─
  $script:RegFail.Add("${Path}\${Name}")
}

# ==================== 数据表 ====================
# 服务：名称 = Enable 时的还原默认值
 $SvcCore = [ordered]@{
  'DiagTrack'            = 'Automatic'  # 体验与遥测（核心外发通道）
  'WerSvc'               = 'Manual'     # 错误报告（崩溃转储上传）
  'wisvc'                = 'Manual'     # Windows 预览体验
  'dmwappushservice'     = 'Manual'     # WAP 推送（旧遥测载体）
  'diagnosticshub.standardcollector.service' = 'Manual' # 诊断收集器
  'RetailDemo'           = 'Manual'     # 卖场演示模式
  'MapsBroker'           = 'Automatic'  # 离线地图
  'lfsvc'                = 'Manual'     # 地理位置服务
  'SensrSvc'             = 'Manual'     # 传感器监视
  'CDPSvc'               = 'Automatic'  # 互联设备平台（跨设备/附近共享）
  'XblAuthManager'       = 'Manual'     # Xbox 身份
  'XblGameSave'          = 'Manual'     # Xbox 云存档
  'XboxNetApiSvc'        = 'Manual'     # Xbox 网络
  'XboxGipSvc'           = 'Manual'     # Xbox 输入
  'WalletService'        = 'Manual'     # 钱包
  'SEMgrSvc'             = 'Manual'     # NFC/安全单元（支付）
  'PhoneSvc'             = 'Manual'     # 电话服务
  'DsmSvc'               = 'Automatic'  # 设备设置（向微软请求设备元数据）
  'RemoteRegistry'       = 'Disabled'   # 远程注册表（局域网暴露面）
  'SSDPSRV'              = 'Manual'     # SSDP 发现（局域网暴露面）
  'upnphost'             = 'Manual'     # UPnP 设备宿主
  'FDResPub'             = 'Manual'     # 功能发现发布
  'FDPhost'              = 'Manual'     # 功能发现宿主
  'WMPNetworkSvc'        = 'Manual'     # WMP 媒体共享
  'SharedAccess'         = 'Manual'     # ICS/移动热点
  'RemoteAccess'         = 'Manual'     # 路由和远程访问
  'Wecsvc'               = 'Manual'     # 事件收集器（入站监听）
}
 $SvcAggressive = [ordered]@{             # --- 有明显副作用 ---
  'WpnService'     = 'Automatic'  # 推送通知（禁用=所有应用通知失效）
  'DPS'            = 'Manual'     # 诊断策略（禁用=系统疑难解答失效）
  'WdiServiceHost' = 'Manual'     # 诊断服务宿主
  'WdiSystemHost'  = 'Manual'     # 诊断系统宿主
  'PcaSvc'         = 'Automatic'  # 程序兼容性助手
  'LicenseManager' = 'Manual'     # Store 授权（LTSC 无商店一般无影响）
  'TokenBroker'    = 'Manual'     # Web 账户管理（MSA 令牌）
  'wlidsvc'        = 'Manual'     # MSA 登录助手
  'ClipSVC'        = 'Manual'     # 客户端许可服务（UWP 授权）
}
 $PerUserTemplates = 'CDPUserSvc','OneSyncSvc'   # 按用户实例化的模板服务

# 遥测/清单类计划任务
 $Tasks = @(
 '\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser',
 '\Microsoft\Windows\Application Experience\ProgramDataUpdater',
 '\Microsoft\Windows\Application Experience\MareBackup',
 '\Microsoft\Windows\Application Experience\AitAgent',
 '\Microsoft\Windows\Application Experience\PcaPatchDbTask',
 '\Microsoft\Windows\Application Experience\StartupAppTask',
 '\Microsoft\Windows\Customer Experience Improvement Program\Consolidator',
 '\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip',
 '\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask',
 '\Microsoft\Windows\Autochk\Proxy',
 '\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector',
 '\Microsoft\Windows\Windows Error Reporting\QueueReporting',
 '\Microsoft\Windows\WindowsUpdate\Automatic App Update',
 '\Microsoft\Windows\PushToInstall\LoginCheck',
 '\Microsoft\Windows\PushToInstall\Registration',
 '\Microsoft\Windows\Feedback\Siuf\DmClient',
 '\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload',
 '\Microsoft\Windows\NetTrace\GatherNetworkInfo',
 '\Microsoft\Windows\Maps\MapsToastTask',
 '\Microsoft\Windows\Maps\MapsUpdateTask',
 '\Microsoft\Windows\Device Information\Device',
 '\Microsoft\Windows\Device Information\Device User',
 '\Microsoft\Windows\Clip\License Validation',
 '\Microsoft\Windows\Subscription\EnableLicenseAcquisition',
 '\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeAll'
)

# HKLM 策略：Disable=写入 / Enable=删除（回到"未配置"即系统默认）
 $HklmPolicies = @(
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection'; n='AllowTelemetry'; v=0},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection'; n='DoNotShowFeedbackNotifications'; v=1},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection'; n='DisableOneSettingsDownloads'; v=1},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection'; n='AllowDeviceNameInTelemetry'; v=0},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection'; n='DisableDiagnosticDataViewer'; v=1},
  @{k='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection'; n='AllowTelemetry'; v=0},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent'; n='DisableWindowsConsumerFeatures'; v=1},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent'; n='DisableCloudOptimizedContent'; v=1},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent'; n='DisableConsumerAccountStateContent'; v=1},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent'; n='DisableWindowsSpotlightFeatures'; v=1},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent'; n='DisableSoftLanding'; v=1},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search'; n='DisableWebSearch'; v=1},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search'; n='ConnectedSearchUseWeb'; v=0},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\System'; n='EnableActivityFeed'; v=0},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\System'; n='PublishUserActivities'; v=0},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\System'; n='UploadUserActivities'; v=0},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization'; n='RestrictImplicitInkCollection'; v=1},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization'; n='RestrictImplicitTextCollection'; v=1},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\SettingSync'; n='DisableSettingSync'; v=2},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\SettingSync'; n='DisableSettingSyncUserOverride'; v=1},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting'; n='Disabled'; v=1},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo'; n='DisabledByGroupPolicy'; v=1},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Dsh'; n='AllowNewsAndInterests'; v=0},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\FindMyDevice'; n='AllowFindMyDevice'; v=0},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI'; n='DisableAIDataAnalysis'; v=1},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsStore'; n='AutoDownload'; v=2},
  @{k='HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization'; n='DODownloadMode'; v=0},
  @{k='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location'; n='Value'; v='Deny'; t='String'}
)

# HKCU 用户设置：off=Disable 值，on=Enable 还原值（on=$null 表示还原时删除）
 $Cdm = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'
 $CdmValues = 'FeatureManagementEnabled','RotatingLockScreenEnabled','RotatingLockScreenOverlayEnabled',
  'SilentInstalledAppsEnabled','SoftLandingEnabled','SystemPaneSuggestionsEnabled',
  'PreInstalledAppsEnabled','PreInstalledAppsEverEnabled','OemPreInstalledAppsEnabled',
  'SubscribedContent-310093Enabled','SubscribedContent-338388Enabled','SubscribedContent-338389Enabled',
  'SubscribedContent-338393Enabled','SubscribedContent-353694Enabled','SubscribedContent-353696Enabled',
  'SubscribedContent-353698Enabled','SubscribedContent-88000326Enabled'
 $HkcuSettings = @(
  @{k='HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo'; n='Enabled'; off=0; on=1},
  @{k='HKCU:\Software\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy'; n='HasAccepted'; off=0; on=1},
  @{k='HKCU:\Software\Microsoft\Windows\CurrentVersion\Search'; n='BingSearchEnabled'; off=0; on=1},
  @{k='HKCU:\Software\Microsoft\Windows\CurrentVersion\Search'; n='CortanaConsent'; off=0; on=1},
  @{k='HKCU:\Software\Microsoft\Windows\CurrentVersion\SearchSettings'; n='IsDynamicSearchBoxEnabled'; off=0; on=1},
  @{k='HKCU:\Software\Microsoft\Windows\CurrentVersion\Privacy'; n='TailoredExperiencesWithDiagnosticDataEnabled'; off=0; on=1},
  @{k='HKCU:\Control Panel\International\User Profile'; n='HttpAcceptLanguageOptOut'; off=1; on=0},
  @{k='HKCU:\Software\Microsoft\Clipboard'; n='EnableCloudClipboard'; off=0; on=1},
  @{k='HKCU:\Software\Microsoft\Clipboard'; n='CloudClipboardAutomaticUpload'; off=0; on=1},
  @{k='HKCU:\Software\Microsoft\Personalization\Settings'; n='AcceptedPrivacyPolicy'; off=0; on=1},
  @{k='HKCU:\Software\Microsoft\InputPersonalization'; n='RestrictImplicitInkCollection'; off=1; on=0},
  @{k='HKCU:\Software\Microsoft\InputPersonalization'; n='RestrictImplicitTextCollection'; off=1; on=0},
  @{k='HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore'; n='HarvestContacts'; off=0; on=1},
  @{k='HKCU:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location'; n='Value'; off='Deny'; on='Allow'; t='String'},
  @{k='HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced'; n='ShowSyncProviderNotifications'; off=0; on=1},
  @{k='HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced'; n='TaskbarDa'; off=0; on=1},
  @{k='HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced'; n='TaskbarMn'; off=0; on=1},
  @{k='HKCU:\Software\Microsoft\Siuf\Rules'; n='NumberOfSIUFInPeriod'; off=0; on=$null}
)
 $HkcuPolicies = @(
  @{k='HKCU:\Software\Policies\Microsoft\Windows\Explorer'; n='DisableSearchBoxSuggestions'},
  @{k='HKCU:\Software\Policies\Microsoft\Windows\CloudContent'; n='DisableTailoredExperiencesWithDiagnosticData'},
  @{k='HKCU:\Software\Policies\Microsoft\Windows\WindowsCopilot'; n='TurnOffWindowsCopilot'}
)

# ==================== Status 模式（无需管理员） ====================
if ($Mode -eq 'Status') {
  Write-Host "`n========== 状态审计 =========="
  Write-Host ("当前身份: {0}   （下列 HKCU = 该账户的设置）" -f (whoami))
  $t0 = (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection' -ErrorAction SilentlyContinue).AllowTelemetry
  Write-Host ("遥测 AllowTelemetry(策略) = {0}" -f $(if ($null -ne $t0) { $t0 } else { '未设置(默认:基本)' }))
  foreach ($t in $PerUserTemplates) {
    $v = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\$t" -ErrorAction SilentlyContinue).Start
    Write-Host ("用户模板 {0}: Start={1} (4=已禁用)" -f $t, $(if ($null -ne $v) { $v } else { '未设置' }))
  }
  Write-Host "`n--- 服务 ---"
  @($SvcCore.Keys) + @($SvcAggressive.Keys) | ForEach-Object {
    $s = Get-Service -Name $_ -ErrorAction SilentlyContinue
    if ($s) { [PSCustomObject]@{ 服务=$s.Name; 状态=$s.Status; 启动类型=$s.StartType } }
  } | Format-Table -AutoSize
  $idx = @{}
  Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object { $idx[$_.TaskPath + $_.TaskName] = $_ }
  $found = 0; $dis = 0
  foreach ($p in $Tasks) { $tk = $idx[$p]; if ($tk) { $found++; if ($tk.State -eq 'Disabled') { $dis++ } } }
  Write-Host ("--- 计划任务: {0}/{1} 已禁用，另有 {2} 个本系统不存在 ---" -f $dis, $found, ($Tasks.Count - $found))
  Write-Host "`n--- 用户设置 (HKCU) ---"
  foreach ($c in @(
      @{n='开始菜单Bing(应0)'; k='HKCU:\Software\Microsoft\Windows\CurrentVersion\Search'; p='BingSearchEnabled'},
      @{n='搜索要点(应0)';     k='HKCU:\Software\Microsoft\Windows\CurrentVersion\SearchSettings'; p='IsDynamicSearchBoxEnabled'},
      @{n='广告ID(应0)';       k='HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo'; p='Enabled'},
      @{n='云剪贴板(应0)';     k='HKCU:\Software\Microsoft\Clipboard'; p='EnableCloudClipboard'},
      @{n='在线语音(应0)';     k='HKCU:\Software\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy'; p='HasAccepted'},
      @{n='小组件图标(应0)';   k='HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced'; p='TaskbarDa'},
      @{n='OneDrive广告(应0)'; k='HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced'; p='ShowSyncProviderNotifications'})) {
    $v = (Get-ItemProperty $c.k -ErrorAction SilentlyContinue).($c.p)
    Write-Host ("{0,-16} = {1}" -f $c.n, $(if ($null -ne $v) { $v } else { '未设置' }))
  }
  Write-Host ("`n防火墙阻断规则: {0} 条" -f @(Get-NetFirewallRule -DisplayName 'Block-Telemetry-*' -ErrorAction SilentlyContinue).Count)
  Write-Host "`n提示: 在管理员窗口与普通窗口各跑一次 Status，若 HKCU 数值不一致，"
  Write-Host "      说明某次提权运行时 HKCU 写进了另一个账户（需用本账户重跑 Disable）。"
  return
}

# ==================== 1. 服务 ====================
 $tables = @($SvcCore)
if ($Aggressive) { $tables += $SvcAggressive }
 $svcDone = 0
foreach ($tbl in $tables) {
  foreach ($name in $tbl.Keys) {
    if (-not (Get-Service -Name $name -ErrorAction SilentlyContinue)) { continue }  # 不存在的服务自动跳过
    try {
      if ($Disable) {
        Stop-Service -Name $name -Force -ErrorAction SilentlyContinue
        Set-Service -Name $name -StartupType Disabled -ErrorAction Stop
      } else {
        Set-Service -Name $name -StartupType $tbl[$name] -ErrorAction Stop
      }
      $svcDone++
      Write-Host ("[服务] {0,-44} {1}" -f $name, $(if ($Disable) { '已禁用' } else { '已还原→' + $tbl[$name] }))
    } catch { Write-Warning "服务 $name 处理失败: $($_.Exception.Message)" }
  }
}
# 按用户实例化的模板服务
foreach ($t in $PerUserTemplates) {
  $key = "HKLM:\SYSTEM\CurrentControlSet\Services\$t"
  if (Test-Path $key) {
    Set-RegChecked -Path $key -Name 'Start' -Value $(if ($Disable) { 4 } else { 2 })
    Get-Service -Name "$t*" -ErrorAction SilentlyContinue | Stop-Service -Force -ErrorAction SilentlyContinue
    Write-Host "[服务] $t (用户模板) $(if ($Disable) { '已禁用' } else { '已还原' })"
  }
}

# ==================== 2. 计划任务（全量索引精确匹配） ====================
 $taskIndex = @{}
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object { $taskIndex[$_.TaskPath + $_.TaskName] = $_ }
 $taskDone = 0
foreach ($path in $Tasks) {
  $t = $taskIndex[$path]
  if ($t) {
    if ($Disable) { $t | Disable-ScheduledTask -ErrorAction SilentlyContinue | Out-Null }
    else          { $t | Enable-ScheduledTask  -ErrorAction SilentlyContinue | Out-Null }
    $taskDone++
    Write-Host ("[任务] {0} {1}" -f $(if ($Disable) { '已禁用' } else { '已启用' }), $path)
  }
}
Write-Host ("计划任务: 本次处理 {0} 个；{1} 个本系统不存在（LTSC 精简，属正常）" -f $taskDone, ($Tasks.Count - $taskDone))

# ==================== 3. HKLM 策略 ====================
foreach ($p in $HklmPolicies) {
  $type = if ($p.t) { $p.t } else { 'DWord' }
  if ($Disable) { Set-RegChecked -Path $p.k -Name $p.n -Value $p.v -Type $type }
  else          { Remove-Reg -Path $p.k -Name $p.n }
}
if ($Aggressive) {   # 有安全权衡的项
  if ($Disable) {
    Set-RegChecked 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet' 'SpynetReporting' 0
    Set-RegChecked 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet' 'SubmitSamplesConsent' 2
    Set-RegChecked 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive' 'DisableFileSyncNGSC' 1
  } else {
    Remove-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet' 'SpynetReporting'
    Remove-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet' 'SubmitSamplesConsent'
    Remove-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive' 'DisableFileSyncNGSC'
  }
}

# ==================== 4. HKCU 用户设置 ====================
foreach ($p in $HkcuSettings) {
  $type = if ($p.t) { $p.t } else { 'DWord' }
  if ($Disable)            { Set-RegChecked -Path $p.k -Name $p.n -Value $p.off -Type $type }
  elseif ($null -ne $p.on) { Set-RegChecked -Path $p.k -Name $p.n -Value $p.on  -Type $type }
  else                     { Remove-Reg -Path $p.k -Name $p.n }
}
foreach ($v in $CdmValues) { Set-RegChecked -Path $Cdm -Name $v -Value $(if ($Disable) { 0 } else { 1 }) }
foreach ($p in $HkcuPolicies) {
  if ($Disable) { Set-RegChecked -Path $p.k -Name $p.n -Value 1 }
  else          { Remove-Reg -Path $p.k -Name $p.n }
}

# ==================== 5. 防火墙出站阻断 ====================
if ($Disable) {
  $fwRules = @(
    @{N='Block-Telemetry-DiagTrack';       P="$env:SystemRoot\System32\svchost.exe";         S='DiagTrack'}
    @{N='Block-Telemetry-CompatTelRunner'; P="$env:SystemRoot\System32\CompatTelRunner.exe"; S=$null}
    @{N='Block-Telemetry-WerFault';        P="$env:SystemRoot\System32\WerFault.exe";        S=$null}
  )
  foreach ($r in $fwRules) {
    if (Get-NetFirewallRule -DisplayName $r.N -ErrorAction SilentlyContinue) { continue }   # 已存在不重复
    $fwArgs = @{ DisplayName=$r.N; Direction='Outbound'; Action='Block'; Profile='Any'; Program=$r.P }
    if ($r.S) { $fwArgs['Service'] = $r.S }
    New-NetFirewallRule @fwArgs -ErrorAction Stop | Out-Null
    Write-Host "[防火墙] 已添加出站阻断: $($r.N)"
  }
} else {
  Get-NetFirewallRule -DisplayName 'Block-Telemetry-*' -ErrorAction SilentlyContinue | Remove-NetFirewallRule
  Write-Host '[防火墙] 阻断规则已移除'
}

# ==================== 6. 可选：hosts 屏蔽（-BlockTelemetryHosts 时生效） ====================
 $hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
 $telemetryHosts = 'vortex.data.microsoft.com','vortex-win.data.microsoft.com','v10.vortex-win.data.microsoft.com',
                  'v20.vortex-win.data.microsoft.com','settings-win.data.microsoft.com','watson.telemetry.microsoft.com',
                  'oca.telemetry.microsoft.com'
if ($BlockTelemetryHosts) {
  if ($Disable) {
    $block = @('# === Windows Telemetry Block (managed by script) ===') + ($telemetryHosts | ForEach-Object { "0.0.0.0 $_" })
    $cur = @(Get-Content $hostsPath -ErrorAction SilentlyContinue)
    $cur += $block | Where-Object { $cur -notcontains $_ }
    Set-Content -Path $hostsPath -Value $cur
  } else {
    $keep = Get-Content $hostsPath | Where-Object {
      $l = $_.Trim()
      if ($l -eq '# === Windows Telemetry Block (managed by script) ===') { return $false }
      if ($l -match '^0\.0\.0\.0\s+(\S+)$') { return ($telemetryHosts -notcontains $Matches[1]) }
      return $true
    }
    Set-Content -Path $hostsPath -Value $keep
  }
  ipconfig /flushdns | Out-Null
  Write-Host "[hosts] 遥测域名屏蔽已$(if ($Disable) {'写入'} else {'移除'})"
}

# ==================== 汇总 ====================
 $fwCount = @(Get-NetFirewallRule -DisplayName 'Block-Telemetry-*' -ErrorAction SilentlyContinue).Count
Write-Host ""
Write-Host ("======== 汇总（模式: {0}{1}） ========" -f $Mode, $(if ($Aggressive) { ' + Aggressive' } else { '' }))
Write-Host ("运行身份   : {0}   （HKCU 部分写入了该账户）" -f (whoami))
Write-Host ("服务       : 本次处理 {0} 项" -f $svcDone)
Write-Host ("计划任务   : 本次处理 {0} 项" -f $taskDone)
Write-Host ("注册表写入 : 一次成功 {0} 项 / 自动修复 {1} 项 / 失败 {2} 项" -f $RegOk, $RegFix, $RegFail.Count)
Write-Host ("防火墙规则 : 当前 {0} 条" -f $fwCount)
if ($RegFail.Count -gt 0) {
  Write-Host "`n失败项（已尝试四层自动修复仍未成功）:" -ForegroundColor Red
  $RegFail | ForEach-Object { Write-Host "  ✗ $_" -ForegroundColor Red }
  $hkcuFails = @($RegFail | Where-Object { $_ -like 'HKCU:*' })
  if ($hkcuFails.Count -ge 5) {
    Write-Host "`n诊断: HKCU 大量失败 → 很可能用另一个管理员账户提权，HKCU 写进了那个账户。" -ForegroundColor Yellow
    Write-Host "      请用「当前登录账户」的管理员 PowerShell 重新运行本脚本。" -ForegroundColor Yellow
  } else {
    Write-Host "`n诊断: 连 reg.exe 兜底都被拒绝，几乎可以确定是安全软件的「注册表防护」在拦截" -ForegroundColor Yellow
    Write-Host "      （火绒/360 等的防护日志中可查到对应拦截记录）。" -ForegroundColor Yellow
    Write-Host "处理: 将本脚本加入白名单或临时关闭注册表防护后重跑；" -ForegroundColor Yellow
    Write-Host "      或逐项确认影响后忽略（本脚本清单内均为策略/外观项）。" -ForegroundColor Yellow
  }
}
if ($Disable) {
  if ($RestartExplorer) {
    Write-Host ""
    Write-Host "正在重启资源管理器以应用任务栏设置..."
    Stop-Process -Name explorer -Force -ErrorAction SilentlyContinue
    Start-Sleep -Seconds 2
    if (-not (Get-Process -Name explorer -ErrorAction SilentlyContinue)) { Start-Process explorer.exe }
  } else {
    Write-Host ""
    Write-Host "建议注销重新登录（或重启 explorer.exe）使任务栏/资源管理器相关变更生效；"
    Write-Host "服务与防火墙变更即时生效。"
  }
}