=Windows 10 settings

==System info

  systeminfo
  cmd /k ver

===Windows Product key

  wmic path SoftwareLicensingService get OA3xOriginalProductKey

or use [[https://www.nirsoft.net/utils/product_cd_key_viewer.html|NirSoft's ProduKey]]

===Get computer name

* ''hostname'' (hostname.exe) in both CMD and PS
* ''%COMPUTERNAME%'' in CMD or ''$ENV:COMPUTERNAME'' in PowerShell

===Rename computer

In admin PowerShell: 

  Rename-Computer "new_hostname"

or with restart

  Rename-Computer "new_hostname" -Restart

==Language
https://superuser.com/a/1310632/53547

  Set-WinSystemLocale en-US
  Set-WinUserLanguageList en-US

Or https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/dism-languages-and-international-servicing-command-line-options ?

But the language packs need to be downloaded. Easier in Control Panel.

===Keyboard

Try

  Set-WinUserLanguageList -Force -LanguageList fr-CH,de-CH,en-US

==No Hiberboot

Disable "Fast boot"

<code>
@echo off

echo "Hiberboot (Fast boot) settings"
echo "Current:"

reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled

echo "Disabling..."
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f

echo "New:"
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled

PAUSE
</code>

I think the above registry hack is the same as running

  powercfg /hibernate off

and then deleting the ''C:\hiberfil.sys'' file




==Network

https://superuser.com/questions/1160421/how-do-i-force-windows-10-to-see-a-network-as-private/1160433#1160433
networking - How do I force Windows 10 to see a network as private? - Super User

https://superuser.com/a/1160447/53547

Change NetWorkConnection Category to Private. (Requires ''-RunasAdministrator'')

<file ps net2private.ps1>
Get-NetConnectionProfile |
  Where{ $_.NetWorkCategory -ne 'Private'} |
  ForEach {
    $_
    $_ | Set-NetConnectionProfile -NetWorkCategory Private -Confirm
  }
</file>

===Delete WiFi passwords

  netsh wlan show profiles
  netsh wlan delete profile name="WiFi network name"

or delete all:

  netsh wlan delete profile name=*

===Enable ADMIN$ shares

"By default, Windows Vista and newer versions of Windows prevent local accounts from accessing administrative shares through the network." ([[https://docs.microsoft.com/en-us/troubleshoot/windows-client/networking/cannot-logon-access-administrative-share#cause|docs.microsoft.com]])
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1

===Disable IPv6
Not tested yet:

From https://4sysops.com/archives/disable-ipv6-in-windows/

  Get-NetAdapterBinding -ComponentID "ms_tcpip6" | where Enabled -eq $true | Disable-NetAdapterBinding -ComponentID "ms_tcpip6"

or (probably needs restart?):

  reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v DisabledComponents /t REG_DWORD /d 255 /f

or the same in PowerShell:

  New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ -Name DisabledComponents -Type DWord -Value 255

The Value 32 may be better than 255.

Or a .reg file (here with value 32 (hex 20)):

<file reg NoIPv6.reg>Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters]
"DisabledComponents"=dword:00000020
</file>

Or maybe ''netsh'' commands as suggested in https://systemadminspro.com/how-to-disable-ipv6-on-windows/ 
(needs a restart)

<code>netsh interface ipv6 set teredo disabled
netsh interface ipv6 6to4 set state disabled
netsh interface ipv6 isatap set state disabled
</code>

==WSL

https://docs.microsoft.com/en-us/windows/wsl/install-win10#manual-installation-steps

  dism.exe /online /enable-feature /featurename:Microsoft-Windows-Subsystem-Linux /all /norestart
  dism.exe /online /enable-feature /featurename:VirtualMachinePlatform /all /norestart

Reboot

Download and install https://wslstorestorage.blob.core.windows.net/wslblob/wsl_update_x64.msi

  wsl --set-default-version 2

Select wanted Ubuntu version from https://wiki.ubuntu.com/WSL#Installing_Ubuntu_on_WSL_by_sideloading_the_.appx and download it. For example, for "Ubuntu 20.04 LTS (Focal)" get https://aka.ms/wslubuntu2004

Install with

  Add-AppxPackage $env:USERPROFILE\Downloads\Ubuntu...(press TAB to find file name)

See also: https://wiki.ubuntu.com/WSL

Once in Ubuntu:

  sudo apt update && sudo apt upgrade
  sudo apt install mc rsync
  sudo apt install perl-doc ...
  
==Windows Terminal

https://docs.microsoft.com/en-us/windows/terminal/get-started

==Path

===Show current path

  $env:path -split ";"

or

<code powershell>
# Only parts for current user
reg query HKCU\Environment /v Path

# Only machine path
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v Path

(New-Object -ComObject WScript.Shell).RegRead("HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\Path") -split ";"
</code>
===Add to Machine Path

<code>
$addpath = "C:\bin"
$regenv  = "SYSTEM\CurrentControlSet\Control\Session Manager\Environment"

$machinepath = (New-Object -ComObject WScript.Shell).RegRead("$regenv\Path") -split ";" | Where-Object { $_ -ne $addpath }
$machinepath += $addpath

# show:
$machinepath -join ';'

# do it
Set-ItemProperty -Path "HKLM:\$regenv" -Name 'Path' -Value ($machinepath -join ';') -Type ExpandString
</code>

The new path is not active immediately for users. For users to get the updated machine path, it is necessary to Sign out and Sign back in.

https://stackoverflow.com/a/36379814/111036

https://docs.microsoft.com/en-us/powershell/scripting/samples/working-with-registry-entries?view=powershell-7.1

===WSL Path

bash $PATH includes native Windows path (work around "AppendNtPath"=dword:00000000 *Not working*) #2048
https://github.com/microsoft/WSL/issues/2048#issuecomment-324072237 (by benhillis)

  reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LxssManager /T REG_DWORD /V "DistributionFlags" /D 4294967293

OR https://github.com/microsoft/WSL/issues/1493#issuecomment-580643734 ?

	After configuring wsl.conf

	[Interop]
	appendWindowsPath = False
	don't forget to open Powershell (as administrator) and put this command:

	Restart-Service LxssManager

==File Explorer
===Show file extensions:
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v HideFileExt /t REG_DWORD /d 0 /f
  
==Notepad++

Make it replace notepad.exe:

  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v "Debugger" /t REG_SZ /d "$env:ProgramFiles\Notepad++\notepad++.exe -notepadStyleCmdline -z" /f

Or?

https://npp-user-manual.org/docs/other-resources/#notepad-replacement

%%#%% check if we have 64 or 32 bit notepad++

  if (Test-Path "C:\Program Files\Notepad++\notepad++.exe") { echo "64bit" } `
  elseif (Test-Path "C:\Program Files(x86)\Notepad++\notepad++.exe") {echo "32bit"} `
  else {echo "Not installed!"}


%%#%% Make notepad++ the default

  reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe"

%%#%% In cmd.exe:

  REM If 64-bit Notepad++
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v "Debugger" /t REG_SZ /d "\"%ProgramFiles%\Notepad++\notepad++.exe\" -notepadStyleCmdline -z" /f

  REM If 32-bit Notepad++
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v "Debugger" /t REG_SZ /d "\"%ProgramFiles(x86)%\Notepad++\notepad++.exe\" -notepadStyleCmdline -z" /f

%%#%% In Powershell:
%%#%% 64bit

  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v "Debugger" /t REG_SZ /d "$env:ProgramFiles\Notepad++\notepad++.exe -notepadStyleCmdline -z" /f

%%#%% 32bit

  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v "Debugger" /t REG_SZ /d "$env:ProgramFiles(x86)%\Notepad++\notepad++.exe -notepadStyleCmdline -z" /f

==No OneDrive

  reg query  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /s
  reg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v OneDrive

==Solitaire

The old Solitaire from Windows 95.

This assumes there is already a C:\bin directory, and it's in the Path:

  cd C:\bin
  curl.exe -O -R http://alma.ch/install/win7/bin/sol.exe
  curl.exe -O -R http://alma.ch/install/win7/bin/cards.dll

To install it in Ubuntu Linux for running it with [[https://www.winehq.org/|wine]] :

<code bash>
# If not done already, install wine
sudo apt install wine winetricks
# and run wine at least once to make it create it's directories in your $HOME
wine
  
# Install Solitaire
wget http://alma.ch/install/win7/bin/{sol.exe,cards.dll}
mv -t ~/.wine/drive_c/windows/ sol.exe cards.dll

# run Solitaire with
wine sol
</code> 

==Cached credentials

Clear Network Saved Credentials

  rundll32.exe keymgr.dll, KRShowKeyMgr

  net use * /del
  
  klist purge
  
  control keymgr.dll
  
==Windows Defender

To check which paths are ignored by Windows Defender:

  Get-MpPreference
  
or

  reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /s
  reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /s


To protect paths from Windows Defender (so that it doesn't delete nc.exe for example):

  Add-MpPreference -ExclusionPath "C:\bin"
 
or 

  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /d 0 /t REG_SZ /v "C:\bin"
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /d 0 /t REG_SZ /v "\\server\install\bin"
  ...
  
With the 2nd option using Policies, they must also be activated by rebooting or by running ''gpudate /force'' (see also https://cloudbrothers.info/create-persistent-defender-av-exclusions-circumvent-defender-endpoint-detection/)

==Firewall

Show current ICMP ping rule state:

  netsh advfirewall firewall show rule name="Allow ping ICMP V4"

Enable ping replies:

  netsh advfirewall firewall add rule name="Allow ping ICMP V4" protocol=icmpv4:any,any dir=in action=allow

==Verbose start

Script to run in an admin command prompt to enable some messages during startup and login:

<code>
@echo off

echo Current value for HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\verbosestatus
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\" /v "verbosestatus"
echo Current value for HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableStatusMessages
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\" /v "DisableStatusMessages"

echo Enabling (slightly) Verbose boot
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\" /v "verbosestatus" /t REG_DWORD /d 1 /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\" /v "DisableStatusMessages"

pause
</code>