actions/runner-images
1
0
Fork 0
mirror of https://github.com/actions/runner-images.git synced 2025-12-20 06:35:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

[Windows] Configure Windows settings,disable services and scheduled tasks (#5017)

Browse Source 
* Configure Windows settings,disable services and scheduled tasks

* some settings are not available on Win16

* Add import New-ItemPath function

* Suppress output

* Disable Chrome and Edge tasks
This commit is contained in:
Aleksandr Chebotov
2022-02-08 17:09:32 +03:00
committed by GitHub
parent f160c496ff
commit cb8931646f
4 changed files with 137 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

102
images/win/scripts/Installers/Finalize-VM.ps1
View File

@@ -36,4 +36,106 @@ cmd /c "npm cache clean --force 2>&1" | Out-Null
# see https://github.com/actions/virtual-environments/issues/1704
cmd /c "icacls $env:SystemRoot\Temp /grant Users:f /t /c /q 2>&1" | Out-Null
# Registry settings
$registrySettings = @(
@{Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"; Name = "AUOptions"; Value = 1; PropertyType = "DWORD"}
@{Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"; Name = "NoAutoUpdate"; Value = 1; PropertyType = "DWORD"}
@{Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"; Name = "DoNotConnectToWindowsUpdateInternetLocations"; Value = 1; PropertyType = "DWORD"}
@{Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"; Name = "DisableWindowsUpdateAccess"; Value = 1; PropertyType = "DWORD"}
@{Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Metadata"; Name = "PreventDeviceMetadataFromNetwork"; Value = 1; PropertyType = "DWORD"}
@{Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection"; Name = "AllowTelemetry"; Value = 0; PropertyType = "DWORD"}
@{Path = "HKLM:\SOFTWARE\Policies\Microsoft\SQMClient\Windows"; Name = "CEIPEnable"; Value = 0; PropertyType = "DWORD"}
@{Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat"; Name = "AITEnable"; Value = 0; PropertyType = "DWORD"}
@{Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat"; Name = "DisableUAR"; Value = 1; PropertyType = "DWORD"}
@{Path = "HKLM:\Software\Policies\Microsoft\Windows\DataCollection"; Name = "AllowTelemetry"; Value = 0; PropertyType = "DWORD"}
@{Path = "HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\DataCollection"; Name = "AllowTelemetry"; Value = 0; PropertyType = "DWORD"}
@{Path = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance"; Name = "MaintenanceDisabled"; Value = 1; PropertyType = "DWORD"}
@{Path = "HKLM:\SOFTWARE\Policies\Microsoft\MRT"; Name = "DontOfferThroughWUAU"; Value = 1; PropertyType = "DWORD"}
@{Path = "HKLM:\SOFTWARE\Policies\Microsoft\MRT"; Name = "DontReportInfectionInformation"; Value = 1; PropertyType = "DWORD"}
@{Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search"; Name = "AllowCortana"; Value = 0; PropertyType = "DWORD"}
@{Path = "HKLM:\SYSTEM\CurrentControlSet\Control"; Name = "ServicesPipeTimeout"; Value = 120000; PropertyType = "DWORD"}
@{Path = "HKLM:\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\AutoLogger-Diagtrack-Listener"; Name = "Start"; Value = 0; PropertyType = "DWORD"}
@{Path = "HKLM:\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\SQMLogger"; Name = "Start"; Value = 0; PropertyType = "DWORD"}
)
$registrySettings | ForEach-Object {
$regPath = $PSItem.Path
New-ItemPath -Path $regPath
New-ItemProperty @PSItem -Force -ErrorAction Ignore
} | Out-Null
# Disable Template Services / User Services added by Desktop Experience
$regUserServicesToDisables = @(
"HKLM:\SYSTEM\CurrentControlSet\Services\CDPUserSvc"
"HKLM:\SYSTEM\CurrentControlSet\Services\OneSyncSvc"
"HKLM:\SYSTEM\CurrentControlSet\Services\PimIndexMaintenanceSvc"
"HKLM:\SYSTEM\CurrentControlSet\Services\UnistoreSvc"
"HKLM:\SYSTEM\CurrentControlSet\Services\UserDataSvc"
"HKLM:\SYSTEM\CurrentControlSet\Services\WpnUserService"
)
$regUserServicesToDisables | ForEach-Object {
$regPath = $_
New-ItemPath -Path $regPath
New-ItemProperty -Path $regPath -Name "Start" -Value 4 -PropertyType DWORD -Force -ErrorAction Ignore
New-ItemProperty -Path $regPath -Name "UserServiceFlags" -Value 0 -PropertyType DWORD -Force -ErrorAction Ignore
} | Out-Null
# Disabled services
$servicesToDisable = @(
"wuauserv"
"DiagTrack"
"dmwappushservice"
"PcaSvc"
"SysMain"
"gupdate"
"gupdatem"
)
$servicesToDisable | ForEach-Object {
Set-Service -Name $_ -StartupType Disabled -ErrorAction Ignore
} | Out-Null
# Disable scheduled tasks
$allTasksInTaskPath = @(
"\"
"\Microsoft\Azure\Security\"
"\Microsoft\VisualStudio\"
"\Microsoft\VisualStudio\Updates\"
"\Microsoft\Windows\Application Experience\"
"\Microsoft\Windows\ApplicationData\"
"\Microsoft\Windows\Autochk\"
"\Microsoft\Windows\Chkdsk\"
"\Microsoft\Windows\Customer Experience Improvement Program\"
"\Microsoft\Windows\Data Integrity Scan\"
"\Microsoft\Windows\Defrag\"
"\Microsoft\Windows\Diagnosis\"
"\Microsoft\Windows\DiskCleanup\"
"\Microsoft\Windows\DiskDiagnostic\"
"\Microsoft\Windows\Maintenance\"
"\Microsoft\Windows\PI\"
"\Microsoft\Windows\Power Efficiency Diagnostics\"
"\Microsoft\Windows\Server Manager\"
"\Microsoft\Windows\Speech\"
"\Microsoft\Windows\UpdateOrchestrator\"
"\Microsoft\Windows\Windows Error Reporting\"
"\Microsoft\Windows\WindowsUpdate\"
"\Microsoft\XblGameSave\"
)
$allTasksInTaskPath | ForEach-Object {
Get-ScheduledTask -TaskPath $_ -ErrorAction Ignore | Disable-ScheduledTask -ErrorAction Ignore
} | Out-Null
$disableTaskNames = @(
@{TaskPath = "\Microsoft\Windows\.NET Framework\"; TaskName = ".NET Framework NGEN v4.0.30319"}
@{TaskPath = "\Microsoft\Windows\.NET Framework\"; TaskName = ".NET Framework NGEN v4.0.30319 64"}
@{TaskPath = "\Microsoft\Windows\AppID\"; TaskName = "SmartScreenSpecific"}
)
$disableTaskNames | ForEach-Object {
Disable-ScheduledTask @PSItem -ErrorAction Ignore
} | Out-Null
Write-Host "Finalize-VM.ps1 - completed"