echo 获取完全的管理员权限
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f >NUL 2>nul
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "FilterAdministratorToken" /t REG_DWORD /d 0 /f >NUL 2>nul

echo 关闭用户账户控制
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableInstallerDetection" /t REG_DWORD /d 0 /f >NUL 2>nul
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableUIADesktopToggle" /t REG_DWORD /d 1 /f >NUL 2>nul
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableSecureUIAPaths" /t REG_DWORD /d 0 /f >NUL 2>nul


echo 把PowerShell策略设为 RemoteSigned（允许本地脚本，远程需签名）
reg add "HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v ExecutionPolicy /t REG_SZ /d RemoteSigned /f >NUL 2>nul


echo 禁用虚拟化安全VBS
echo 把当前启动项的 hypervisorlaunchtype 设为 Off，让 hypervisor 不再随 Windows 一起启动（等同于“关闭内核隔离”里那个最关键开关）。

for /f "delims=" %%i in ('bcdedit /enum BOOTMGR /v ^|find /i "default"') do for /f "tokens=2" %%a in ('echo %%i') do bcdedit /set %%a hypervisorlaunchtype off

echo 在 组策略、ControlSet001、CurrentControlSet 三个位置同步写入禁用标志，确保：
echo 1. 系统不再尝试在下次启动时重新开启 VBS；
echo 2. 与 Device Guard/Credential Guard 相关的所有服务不会被拉起；
echo 3. 即使 Windows 更新或 BIOS 开启虚拟化，也不会自动回开。
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 0 /f >NUL 2>nul
reg add "HKLM\SYSTEM\ControlSet001\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 0 /f >NUL 2>nul
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 0 /f >NUL 2>nul

echo 关闭远程协助
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v "fAllowToGetHelp" /t REG_DWORD /d 0 /f >NUL 2>nul
reg add "HKLM\SYSTEM\ControlSet001\Control\Remote Assistance" /v "fAllowToGetHelp" /t REG_DWORD /d 0 /f >NUL 2>nul

echo 取消文件打开警告
echo 低风险-放行列表
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".exe;.bat;.cmd;.vbs;.msi;.inf;.reg;.txt;.7z;.rar;.zip;.iso" /f >NUL 2>nul
echo 中等风险-放行列表
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "ModRiskFileTypes" /t REG_SZ /d ".exe;.bat;.cmd;.vbs;.msi;.inf;.reg;.txt;.7z;.rar;.zip;.iso" /f >NUL 2>nul

echo 禁用 Windows 安全和维护相关的系统通知
reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d 0 /f >NUL 2>nul

echo 禁止非域成员计算机自动连接到开放 Wi-Fi、临时热点等“非域”网络
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\Local" /v fBlockNonDomain /t REG_DWORD /d 1 /f >nul 2>nul