param(

[switch]$EnableLogging,

[switch]$nonInteractive,

[ValidateSet('DisableRegKeys',

'PreventAIPackageReinstall',

'DisableCopilotPolicies',

'RemoveAppxPackages',

'RemoveRecallFeature',

'RemoveCBSPackages',

'RemoveAIFiles',

'HideAIComponents',

'DisableRewrite',

'RemoveRecallTasks',

'UpdateCleanupCheck')]

[array]$Options,

[switch]$AllOptions,

[switch]$revertMode,

[switch]$backupMode,

[ValidateSet('photoviewer', 'mspaint', 'snippingtool', 'notepad', 'photoslegacy')]

[array]$InstallClassicApps,

[switch]$RunWinUpdateRepair

)

if ($nonInteractive) {

if (!($AllOptions) -and (!$Options -or $Options.Count -eq 0) -and !($InstallClassicApps)) {

throw 'Non-Interactive mode was supplied without any options... Please use -Options or -AllOptions when using Non-Interactive Mode'

exit

}

}

#get powershell version to ensure run-trusted doesnt enter an infinite loop

$version = $PSVersionTable.PSVersion

if ($version -like '7*') {

$Global:psversion = 7

}

else {

$Global:psversion = 5

}

if ($psversion -ge 7) {

Write-Host 'ERROR: This script requires Windows PowerShell 5.1 (powershell.exe).' -ForegroundColor Red

Write-Host "You are currently running PowerShell version $($PSVersionTable.PSVersion.Major).$($PSVersionTable.PSVersion.Minor)." -ForegroundColor Red

Write-Host 'PowerShell 7+ (pwsh.exe) is not supported. Please run the script using the classic Windows PowerShell 5.1.' -ForegroundColor Red

if (-not $nonInteractive) {

try {

Add-Type -AssemblyName System.Windows.Forms

[System.Windows.Forms.MessageBox]::Show(

"This script must be run in Windows PowerShell 5.1.`n`nCurrent version: $($PSVersionTable.PSVersion)`n`nPlease use powershell.exe instead of pwsh.exe.",

'PowerShell Version Error',

[System.Windows.Forms.MessageBoxButtons]::OK,

[System.Windows.Forms.MessageBoxIcon]::Error

) | Out-Null

}

catch { }

}

exit 1

}

If (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]'Administrator')) {

#leave out the trailing " to add supplied params first

$arglist = "-NoProfile -ExecutionPolicy Bypass -C `"& ([scriptblock]::Create((irm 'https://raw.githubusercontent.com/zoicware/RemoveWindowsAI/main/RemoveWindowsAi.ps1')))"

#pass the correct params if supplied

if ($nonInteractive) {

$arglist = $arglist + ' -nonInteractive'

if ($AllOptions) {

$arglist = $arglist + ' -AllOptions'

}

if ($revertMode) {

$arglist = $arglist + ' -revertMode'

}

if ($backupMode) {

$arglist = $arglist + ' -backupMode'

}

if ($Options -and $Options.count -ne 0) {

#if options and alloptions is supplied just do all options

if ($AllOptions) {

#double check arglist has all options (should already have it)

if (!($arglist -like '*-AllOptions*')) {

$arglist = $arglist + ' -AllOptions'

}

}

else {

$arglist = $arglist + " -Options $Options"

}

}

if ($InstallClassicApps -and $InstallClassicApps.Count -ne 0) {

$arglist = $arglist + " -InstallClassicApps $InstallClassicApps"

}

}

if ($EnableLogging) {

$arglist = $arglist + ' -EnableLogging'

}

#add the trailing quote

$arglist = $arglist + '"'

Start-Process PowerShell.exe -ArgumentList $arglist -Verb RunAs

Exit

}

Add-Type -AssemblyName PresentationFramework

Add-Type -AssemblyName System.Windows.Forms

function Run-Trusted([String]$command, $psversion) {

#run as ti by aveyo refactored for powershell use only

#no powershell window flash

#removed reg sym link as its not needed

#fixed some issues with reflection methods

function Invoke-AsTrustedInstaller {

param(

[Parameter(Mandatory)]

[string]$Code

)

$userSid = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value

$regKey = "Registry::HKU\$userSid\Volatile Environment"

$userCodeValue = 'TI_Code'

$payloadValue = 'TI_Payload'

$bootstrapValue = 'TI_Bootstrap'

Set-ItemProperty $regKey $userCodeValue $Code -Type 1 # REG_SZ

#Bootstrap to run payload

$bootstrap = @"

`$env:R = (Get-Item 'Registry::HKU\$userSid\Volatile Environment' -EA 0).GetValue('$($payloadValue)') -join `"``n`";

iex `$env:R

"@

Set-ItemProperty $regKey $bootstrapValue $bootstrap -Type 1 # REG_SZ

#Reflection / P-Invoke payload

$payload = @'

$I=[int32];$M=$I.module.gettype("System.Runtime.InteropServices.Marshal")

$P=[IntPtr];$S=[string];$Z=[uintptr]::size

$D=@();$T=@()

$DM=[AppDomain]::CurrentDomain.DefineDynamicAssembly(1,1).DefineDynamicModule(1)

0..5 | ForEach-Object { $D += $DM.DefineType("AveYo_$_", 265, [ValueType]) }

$D += [uintptr]

4..6 | ForEach-Object { $D += $D[$_].MakeByRefType() }

$F = 'kernel','advapi','advapi',

([string],[string],[int32],[int32],[int32],[int32],[int32],[string],$D[7],$D[8]),

([uintptr],[string],[int32],[int32],$D[9]),

([uintptr],[string],[int32],[int32],[byte[]],[int32])

0..2 | ForEach-Object {

$D[0].DefinePInvokeMethod(

('CreateProcess','RegOpenKeyEx','RegSetValueEx')[$_],

$F[$_]+'32', 8214, 1, $S, $F[$_+3], 1, 4

)

}

$DF = ($P,$I,$P),

($I,$I,$I,$I,$P,$D[1]),

($I,$S,$S,$S,$I,$I,$I,$I,$I,$I,$I,$I,[int16],[int16],$P,$P,$P,$P),

($D[3],$P),

($P,$P,$I,$I)

1..5 | ForEach-Object {

$k = $_; $n = 1

$DF[$_-1] | ForEach-Object { $D[$k].DefineField('f'+$n++, $_, 6) }

}

0..5 | ForEach-Object { $T += $D[$_].CreateType() }

0..5 | ForEach-Object { New-Variable "A$_" ([Activator]::CreateInstance($T[$_])) -Force }

function Invoke-NativeMethod($Name, $MethodArgs) {

$T[0].GetMethod($Name).Invoke($null, [object[]]$MethodArgs)

}

function Invoke-MarshalMethod($Name, [type[]]$Types, $MethodArgs) {

$M.GetMethod($Name, [type[]]$Types).Invoke($null, [object[]]$MethodArgs)

}

$privMethod = [Diagnostics.Process].GetMember('SetPrivilege', 42)[0]

'SeSecurityPrivilege','SeTakeOwnershipPrivilege','SeBackupPrivilege','SeRestorePrivilege' |

ForEach-Object { $privMethod.Invoke($null, @("$_", 2)) }

$targetProcess = $null

'TrustedInstaller','lsass','winlogon' | ForEach-Object {

if (!$targetProcess) {

sc.exe start $_ 2>$null

Start-Sleep -Milliseconds 500

$targetProcess = @(Get-Process -Name $_ -EA 0)[0]

}

}

$handles = @()

$Z, (4*$Z+16) | ForEach-Object {

$handles += Invoke-MarshalMethod 'AllocHGlobal' @([int32]) @([int32]$_)

}

Invoke-MarshalMethod 'WriteIntPtr' @([IntPtr],[IntPtr]) @($handles[0], $targetProcess.Handle)

$A1.f1 = 131072; $A1.f2 = $Z; $A1.f3 = $handles[0]

$A2.f1 = 1; $A2.f2 = 1; $A2.f3 = 1; $A2.f4 = 1; $A2.f6 = $A1

$A3.f1 = 10*$Z+32

$A4.f1 = $A3; $A4.f2 = $handles[1]

Invoke-MarshalMethod 'StructureToPtr' @([object],[IntPtr],[bool]) @(($A2 -as $D[2]), $A4.f2, $false)

$HKU = [uintptr][uint32]2147483651

$NT = 'S-1-5-18'

$regArgs = @($HKU, $NT, 8, 2, ($HKU -as $D[9]))

Invoke-NativeMethod 'RegOpenKeyEx' $regArgs

$hkuLink = $regArgs[4]

# Retrieve the SID that was appended to the payload by the outer function

$currentSid = ($env:R -split '###SID###')[2].trim()

# Read TI_Code and base64-encode it to pass safely into CreateProcess command line

$rawCode = (Get-Item 'HKCU:\Volatile Environment' -EA 0).GetValue('TI_Code')

$encodedCode = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($rawCode))

$createResult = Invoke-NativeMethod 'CreateProcess' @(

$null,

"powershell -win hidden -nop -ep bypass -enc $encodedCode",

0, 0, 0, 0x0E080600, 0, $null,

($A4 -as $T[4]),

($A5 -as $T[5])

)

$childInfo = $A5 -as $T[5]

if ($childInfo.f1 -ne [IntPtr]::Zero) {

$childProc = [Diagnostics.Process]::GetProcessById(

[Runtime.InteropServices.Marshal]::ReadInt32($childInfo.f2)

)

if ($childProc) { $childProc.WaitForExit() }

}

$env:R = ''

'@

#add user sid in comment to get later

Set-ItemProperty $regKey $payloadValue "$payload`n###SID###$userSid" -Type 1 # REG_SZ

#run payload

$wshell = New-Object -ComObject WScript.Shell

$wshell.Run(

"powershell.exe -win hidden -nop -ep bypass -c iex((gi 'Registry::HKU\$userSid\Volatile Environment').GetValue('TI_Bootstrap'))",

0,

$true

) | Out-Null

#Cleanup

Remove-ItemProperty $regKey $userCodeValue -Force -EA 0

Remove-ItemProperty $regKey $payloadValue -Force -EA 0

Remove-ItemProperty $regKey $bootstrapValue -Force -EA 0

$env:B = ''

}

$psexe = 'PowerShell.exe'

#convert command to base64 to avoid errors with spaces

$bytes = [System.Text.Encoding]::Unicode.GetBytes($command)

$base64Command = [Convert]::ToBase64String($bytes)

try {

Stop-Service -Name TrustedInstaller -Force -ErrorAction Stop -WarningAction Stop

}

catch {

taskkill /im trustedinstaller.exe /f >$null

}

# trusted installer proc not found (128) or access denied (1)

if ($LASTEXITCODE -eq 128 -or $LASTEXITCODE -eq 1) {

Write-Status -msg 'Failed to stop TrustedInstaller.exe... Using fallback method!' -warningOutput

Invoke-AsTrustedInstaller -Code $command

Start-Sleep 1

return

}

#get bin path to revert later

$service = Get-CimInstance -ClassName Win32_Service -Filter "Name='TrustedInstaller'"

$DefaultBinPath = $service.PathName

#make sure path is valid and the correct location

$trustedInstallerPath = "$env:SystemRoot\servicing\TrustedInstaller.exe"

if ($DefaultBinPath -ne $trustedInstallerPath) {

$DefaultBinPath = $trustedInstallerPath

}

#change bin to command

sc.exe config TrustedInstaller binPath= "cmd.exe /c $psexe -encodedcommand $base64Command" | Out-Null

#run the command

sc.exe start TrustedInstaller | Out-Null

#set bin back to default

sc.exe config TrustedInstaller binpath= "`"$DefaultBinPath`"" | Out-Null

try {

Stop-Service -Name TrustedInstaller -Force -ErrorAction Stop -WarningAction Stop

}

catch {

taskkill /im trustedinstaller.exe /f >$null

}

}

function Write-Status {

param(

[string]$msg,

[switch]$errorOutput,

[switch]$warningOutput

)

if ($errorOutput) {

Write-Host "[ ! ERROR ] $msg" -ForegroundColor Red

}

elseif ($warningOutput) {

Write-Host "[ * WARNING ] $msg" -ForegroundColor Yellow

}

else {

Write-Host "[ + ] $msg" -ForegroundColor Cyan

}

}

# Source - https://stackoverflow.com/a/42792718

# Posted by Krisz, modified by community. See post 'Timeline' for change history

# Retrieved 2026-03-24, License - CC BY-SA 4.0

$QuickEditCodeSnippet = @'

using System;

using System.Collections.Generic;

using System.Linq;

using System.Text;

using System.Threading.Tasks;

using System.Runtime.InteropServices;

public static class DisableConsoleQuickEdit{

const uint ENABLE_QUICK_EDIT = 0x0040;

// STD_INPUT_HANDLE (DWORD): -10 is the standard input device.

const int STD_INPUT_HANDLE = -10;

[DllImport("kernel32.dll", SetLastError = true)]

static extern IntPtr GetStdHandle(int nStdHandle);

[DllImport("kernel32.dll")]

static extern bool GetConsoleMode(IntPtr hConsoleHandle, out uint lpMode);

[DllImport("kernel32.dll")]

static extern bool SetConsoleMode(IntPtr hConsoleHandle, uint dwMode);

public static bool SetQuickEdit(bool SetEnabled){

IntPtr consoleHandle = GetStdHandle(STD_INPUT_HANDLE);

// get current console mode

uint consoleMode;

if (!GetConsoleMode(consoleHandle, out consoleMode)){

// ERROR: Unable to get console mode.

return false;

}

// Clear the quick edit bit in the mode flags

if (SetEnabled){

consoleMode &= ~ENABLE_QUICK_EDIT;

}

else{

consoleMode |= ENABLE_QUICK_EDIT;

}

// set the new mode

if (!SetConsoleMode(consoleHandle, consoleMode)){

// ERROR: Unable to set console mode

return false;

}

return true;

}

}

'@

Add-Type -TypeDefinition $QuickEditCodeSnippet -Language CSharp

function Set-QuickEdit() {

[CmdletBinding()]

param(

[Parameter(Mandatory = $false, HelpMessage = 'This switch will disable Console QuickEdit option')]

[switch]$DisableQuickEdit = $false

)

if ([DisableConsoleQuickEdit]::SetQuickEdit($DisableQuickEdit)) {

Write-Output 'QuickEdit settings has been updated.'

}

else {

Write-Output 'Something went wrong.'

}

}

#some users have messed with the system envrioment variables (for some reason) this breaks inline cmdlets like Reg.exe

#to fix this we can ensure the enviroment variable for this powershell session is set properly

if ($env:PATH -notlike "*$env:SystemRoot\system32;*") {

Write-Status -msg "System Envrioment Variable 'PATH' is corrupted! Fixing for script session..." -errorOutput

$env:PATH = "$env:SystemRoot\system32;$env:SystemRoot;$env:SystemRoot\System32\Wbem;" + $env:PATH

}

#setup script

#=====================================================================================

Write-Host '~ ~ ~ Remove Windows AI by @zoicware ~ ~ ~' -ForegroundColor DarkCyan

#disables quick edit just for this session

#since the quick edit setting is stored in the powershell shortcut file when ran from startmenu its not really possible to do it any other way

#why: quick edit allows for highlighting the console text while a script is running causing it to pause until the user presses some key

#this is not clearly stated to the user causing confusion for some

Set-QuickEdit -DisableQuickEdit | Out-Null

if ($EnableLogging) {

$date = (Get-Date).ToString('MM-dd-yyyy-HH:mm') -replace ':'

$Global:logPath = "$env:USERPROFILE\RemoveWindowsAI$date.log"

New-Item $logPath -Force | Out-Null

Write-Status -msg "Starting Log at [$logPath]"

#start and stop the transcript to get the header

Start-Transcript -Path $logPath -IncludeInvocationHeader | Out-Null

Stop-Transcript | Out-Null

#create info object

$Global:logInfo = [PSCustomObject]@{

Line = $null

Result = $null

}

}

if ($revertMode) {

$Global:revert = 1

}

else {

$Global:revert = 0

}

if ($backupMode) {

$Global:backup = 1

}

else {

$Global:backup = 0

}

$Global:tempDir = ([System.IO.Path]::GetTempPath())

#=====================================================================================

function Add-LogInfo {

param(

[string]$logPath,

$info

)

$content = @"

====================================

Line: $($info.Line)

Result: $($info.Result)

"@

Add-Content $logPath -Value $content | Out-Null

}

function Create-RestorePoint {

param(

[switch]$nonInteractive

)

#check vss service first

$vssService = Get-Service -Name 'VSS' -ErrorAction SilentlyContinue

if ($vssService -and $vssService.StartType -eq 'Disabled') {

try {

Write-Status -msg 'Enabling VSS Service...'

Set-Service -Name 'VSS' -StartupType Manual -ErrorAction Stop

Start-Service -Name 'VSS' -ErrorAction Stop

}

catch {

Write-Status -msg 'Unable to Start VSS Service... Can not create restore point!' -errorOutput

return

}

}

#enable system protection to allow restore points

$restoreEnabled = Get-ComputerRestorePoint -ErrorAction SilentlyContinue

if (!$restoreEnabled) {

Write-Status -msg 'Enabling Restore Points on System...'

Enable-ComputerRestore -Drive "$env:SystemDrive\"

}

if ($nonInteractive) {

#allow restore point to be created even if one was just made

$restoreFreqPath = 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore'

$restoreFreqKey = 'SystemRestorePointCreationFrequency'

$currentValue = (Get-ItemProperty -Path $restoreFreqPath -Name $restoreFreqKey -ErrorAction SilentlyContinue).$restoreFreqKey

if ($currentValue -ne 0) {

Set-ItemProperty -Path $restoreFreqPath -Name $restoreFreqKey -Value 0 -Force

}

$restorePointName = "RemoveWindowsAI-$(Get-Date -Format 'yyyy-MM-dd')"

Write-Status -msg "Creating Restore Point: [$restorePointName]"

Write-Status -msg 'This may take a moment...please wait'

Checkpoint-Computer -Description $restorePointName -RestorePointType 'MODIFY_SETTINGS'

}

else {

Write-Status -msg 'Opening Restore Point Dialog...'

try {

$proc = Start-Process 'SystemPropertiesProtection.exe' -ErrorAction Stop -PassThru

}

catch {

$proc = Start-Process 'C:\Windows\System32\control.exe' -ArgumentList 'sysdm.cpl ,4' -PassThru

}

#click configure on the window

Start-Sleep 1

Add-Type -AssemblyName System.Windows.Forms

[System.Windows.Forms.SendKeys]::SendWait('%c')

Wait-Process -Id $proc.Id

}

}

function Set-UwpAppRegistryEntry {

# modified to work in windows powershell from https://github.com/agadiffe/WindowsMize/blob/fe78912ccb1c83d440bd2123f5e43a6156fab31a/src/modules/applications/settings/public/Set-UwpAppSetting.ps1

<#

.SYNOPSIS

Modifies UWP app registry entries in the settings.dat file.

.EXAMPLE

PS> $setting = [PSCustomObject]@{

Name = 'VideoAutoplay'

Value = '0'

Type = '5f5e10b'

}

PS> $setting | Set-UwpAppRegistryEntry -FilePath $FilePath

#>

[CmdletBinding()]

param

(

[Parameter(Mandatory, ValueFromPipeline)]

$InputObject,

[Parameter(Mandatory)]

[string] $FilePath

)

begin {

$AppSettingsRegPath = 'HKEY_USERS\APP_SETTINGS'

$RegContent = "Windows Registry Editor Version 5.00`n"

reg.exe UNLOAD $AppSettingsRegPath 2>&1 | Out-Null

$max = 30

$attempts = 0

$ProcessToStop = @(

'AppActions'

'SearchHost'

'FESearchHost'

'msedgewebview2'

'TextInputHost'

'VisualAssistExe'

'WebExperienceHostApp'

'WindowsMigration'

'WindowsBackupClient'

'SoftLandingTask'

'DesktopStickerEditorWin32Exe'

'CrossDeviceResume'

'DiscoveryHubApp'

)

Stop-Process -Name $ProcessToStop -Force -ErrorAction SilentlyContinue

# do while is needed here because wait-process in this case is not working maybe cause its just a trash function lol

# using microsofts own example found in the docs does not work

# https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/wait-process?view=powershell-7.5#example-1-stop-a-process-and-wait

# since we are trying multiple times while the processes are stopping this will work as soon as the file is freed

do {

reg.exe LOAD $AppSettingsRegPath $FilePath *>$null

$attempts++

} while ($LASTEXITCODE -ne 0 -and $attempts -lt $max)

if ($LASTEXITCODE -ne 0) {

Write-Status -msg 'Unable to load settings.dat' -errorOutput

return

}

}

process {

$Value = $InputObject.Value

$Value = switch ($InputObject.Type) {

'5f5e10b' {

# Single byte for boolean

'{0:x2}' -f [byte][int]$Value

}

'5f5e10c' {

# Unicode string

$bytes = [System.Text.Encoding]::Unicode.GetBytes($Value + "`0")

($bytes | ForEach-Object { '{0:x2}' -f $_ }) -join ' '

}

'5f5e104' {

# Int32

$bytes = [BitConverter]::GetBytes([int]$Value)

($bytes | ForEach-Object { '{0:x2}' -f $_ }) -join ' '

}

'5f5e105' {

# UInt32

$bytes = [BitConverter]::GetBytes([uint32]$Value)

($bytes | ForEach-Object { '{0:x2}' -f $_ }) -join ' '

}

'5f5e106' {

# Int64

$bytes = [BitConverter]::GetBytes([int64]$Value)

($bytes | ForEach-Object { '{0:x2}' -f $_ }) -join ' '

}

}

$Value = $Value -replace '\s+', ','

# create timestamp for remaining bytes

$timestampBytes = [BitConverter]::GetBytes([int64](Get-Date).ToFileTime())

$Timestamp = ($timestampBytes | ForEach-Object { '{0:x2}' -f $_ }) -join ','

# build registry content

if ($InputObject.Path) {

$RegKey = "$($AppSettingsRegPath)\$($InputObject.Path)"

}

else {

try {

$RegKey = (Get-ChildItem "registry::$AppSettingsRegPath" -Recurse -ErrorAction Stop | Where-Object { $_.pschildname -like '*Evoke' }).Name

}

catch {

#early return when user has older version of photos app that doesnt have ai features

[gc]::Collect()

reg.exe UNLOAD $AppSettingsRegPath | Out-Null

return 1

}

}

$RegContent += "`n[$RegKey]

""$($InputObject.Name)""=hex($($InputObject.Type)):$Value,$Timestamp`n" -replace '(?m)^ *'

}

end {

[gc]::Collect()

$SettingRegFilePath = "$($tempDir)uwp_app_settings.reg"

$RegContent | Out-File -FilePath $SettingRegFilePath

reg.exe IMPORT $SettingRegFilePath 2>&1 | Out-Null

reg.exe UNLOAD $AppSettingsRegPath | Out-Null

Remove-Item -Path $SettingRegFilePath

}

}

#function to edit group policies's pol file that contains all policies found in group policy editor

#this will update the ui to properly reflect what policies have been set to via reg

function Edit-PolFile {

param(

[Parameter(Mandatory)]

[ValidateSet('HKLM', 'HKCU')]

[string]$Hive,

[Parameter(Mandatory)]

[ValidateSet('Add', 'Delete')]

[string]$Action,

[Parameter(Mandatory)]

[string]$Key,

[Parameter(Mandatory)]

[string]$ValueName,

[ValidateSet('DWORD', 'SZ')]

[string]$Type,

[string]$Value

)

if ($Hive -eq 'HKLM') {

$PolPath = "$env:SYSTEMROOT\System32\GroupPolicy\Machine\Registry.pol"

}

else {

$PolPath = "$env:SYSTEMROOT\System32\GroupPolicy\User\Registry.pol"

}

#C# pol file reader/writer

if (-not ([System.Management.Automation.PSTypeName]'PolHandler').Type) {

Add-Type -Language CSharp @'

using System;

using System.Collections.Generic;

using System.IO;

using System.Text;

public class PolRec {

public string Key;

public string ValueName;

public uint Type;

public byte[] Data;

}

public static class PolHandler {

public static List<PolRec> Read(string f) {

var l = new List<PolRec>();

if (!File.Exists(f) || new FileInfo(f).Length < 8) return l;

try {

using (var br = new BinaryReader(File.OpenRead(f), Encoding.Unicode)) {

if (br.ReadUInt32() != 0x67655250 || br.ReadUInt32() != 1) return l;

while (br.BaseStream.Position < br.BaseStream.Length) {

if (br.ReadChar() != '[') continue;

var r = new PolRec { Key = RS(br) };

if (br.ReadChar() != ';') break;

r.ValueName = RS(br);

if (br.ReadChar() != ';') break;

r.Type = br.ReadUInt32();

if (br.ReadChar() != ';') break;

uint sz = br.ReadUInt32();

if (br.ReadChar() != ';') break;

if (br.BaseStream.Position + sz > br.BaseStream.Length) break;

r.Data = br.ReadBytes((int)sz);

if (br.ReadChar() != ']') break;

l.Add(r);

}

}

} catch {}

return l;

}

public static void Write(string f, ICollection<PolRec> d) {

Directory.CreateDirectory(Path.GetDirectoryName(f));

using (var bw = new BinaryWriter(File.Open(f, FileMode.Create), Encoding.Unicode)) {

bw.Write((uint)0x67655250);

bw.Write((uint)1);

foreach (var r in d) {

bw.Write('[');

SS(bw, r.Key); bw.Write(';');

SS(bw, r.ValueName); bw.Write(';');

bw.Write(r.Type); bw.Write(';');

bw.Write((uint)r.Data.Length); bw.Write(';');

bw.Write(r.Data);

bw.Write(']');

}

}

}

private static string RS(BinaryReader br) {

var sb = new StringBuilder(); char c;

while ((c = br.ReadChar()) != 0) sb.Append(c);

return sb.ToString();

}

private static void SS(BinaryWriter bw, string v) {

bw.Write(v.ToCharArray());

bw.Write((char)0);

}

}

'@

}

#Load existing records into a dictionary to edit

$policies = [System.Collections.Generic.Dictionary[string, PolRec]]::new(

[StringComparer]::OrdinalIgnoreCase

)

[PolHandler]::Read($PolPath) | ForEach-Object {

$policies["$($_.Key);$($_.ValueName)"] = $_

}

$dictKey = "$Key;$ValueName"

switch ($Action) {

'Add' {

if (-not $Type) { throw "'-Type' is required when Action is 'Add'" }

if (-not $Value -and $Value -ne '0') { throw "'-Value' is required when Action is 'Add'" }

$rec = [PolRec]::new()

$rec.Key = $Key

$rec.ValueName = $ValueName

if ($Type -eq 'DWORD') {

$rec.Type = 4

$rec.Data = [BitConverter]::GetBytes([uint32]::Parse($Value))

}

else {

$rec.Type = 1

$rec.Data = [Text.Encoding]::Unicode.GetBytes($Value + [char]0)

}

$policies[$dictKey] = $rec

Write-Verbose "Added/updated: $dictKey"

}

'Delete' {

if ($policies.Remove($dictKey)) {

Write-Verbose "Deleted: $dictKey"

}

else {

Write-Warning "Entry not found in .pol file: $dictKey"

}

}

}

#add updated dictionary back to pol file

$final = [System.Collections.Generic.List[PolRec]]::new($policies.Values)

[PolHandler]::Write($PolPath, $final)

}

function Disable-Registry-Keys {

#maybe add params for particular parts

#disable ai registry keys

Write-Status -msg "$(@('Disabling', 'Enabling')[$revert]) Copilot and Recall..."

<#

#new keys related to windows ai schedled task

#npu check

Reg.exe add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsAI\LastConfiguration' /v 'HardwareCompatibility' /t REG_DWORD /d '0' /f

#dont know

Reg.exe add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsAI\LastConfiguration' /v 'ITManaged' /t REG_DWORD /d '0' /f

#enabled by windows ai schedled task

#set to 1 in the us

Reg.exe add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsAI\LastConfiguration' /v 'AllowedInRegion' /t REG_DWORD /d '0' /f

#enabled by windows ai schelded task

# policy enabled = 1 when recall is enabled in group policy

Reg.exe add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsAI\LastConfiguration' /v 'PolicyConfigured' /t REG_DWORD /d '0' /f

Reg.exe add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsAI\LastConfiguration' /v 'PolicyEnabled' /t REG_DWORD /d '0' /f

#dont know

Reg.exe add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsAI\LastConfiguration' /v 'FTDisabledState' /t REG_DWORD /d '0' /f

#prob the npu check failing

Reg.exe add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsAI\LastConfiguration' /v 'MeetsAdditionalDriverRequirements' /t REG_DWORD /d '0' /f

#sucess from last run

Reg.exe add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsAI\LastConfiguration' /v 'LastOperationKind' /t REG_DWORD /d '2' /f

#doesnt install recall for me so 0

Reg.exe add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsAI\LastConfiguration' /v 'AttemptedInstallCount' /t REG_DWORD /d '0' /f

#windows build

Reg.exe add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsAI\LastConfiguration' /v 'LastBuild' /t REG_DWORD /d '7171' /f

#5 for no good reason

Reg.exe add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsAI\LastConfiguration' /v 'MaxInstallAttemptsAllowed' /t REG_DWORD /d '5' /f

#>

if (!$revert) {

#removing it does not get remade on restart so we will just remove it for now

Reg.exe delete 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsAI\LastConfiguration' /f *>$null

Reg.exe delete 'HKCU\Software\Microsoft\Windows\Shell\Copilot' /v 'CopilotLogonTelemetryTime' /f *>$null

Reg.exe delete 'HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Copilot_8wekyb3d8bbwe\Copilot.StartupTaskId' /f *>$null

Reg.exe delete 'HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\WebViewHostStartupId' /f *>$null

Reg.exe delete 'HKCU\Software\Microsoft\Copilot' /v 'WakeApp' /f *>$null

}

$aiPolicies = @()

$valueNamesHKLM = @(

'DisableAIDataAnalysis'

'AllowRecallEnablement'

'DisableClickToDo'

'TurnOffSavingSnapshots'

'DisableSettingsAgent'

'DisableAgentConnectors'

'DisableAgentWorkspaces'

'DisableRemoteAgentConnectors'

)

foreach ($name in $valueNamesHKLM) {

$obj = [PSCustomObject]@{

Name = $name

Hive = 'HKLM'

Key = 'SOFTWARE\Policies\Microsoft\Windows\WindowsAI'

Value = if ($name -eq 'AllowRecallEnablement') { @('0', '1')[$revert] }else { @('1', '0')[$revert] } #value needs to be 0 for AllowRecallEnablement but 1 for the rest

}

$aiPolicies += $obj

}

$valueNamesHKCU = @(

'DisableAIDataAnalysis'

'DisableClickToDo'

)

foreach ($name in $valueNamesHKCU) {

$obj = [PSCustomObject]@{

Name = $name

Hive = 'HKCU'

Key = 'SOFTWARE\Policies\Microsoft\Windows\WindowsAI'

Value = @('1', '0')[$revert]

}

$aiPolicies += $obj

}

$obj = [PSCustomObject]@{

Name = 'TurnOffWindowsCopilot'

Hive = 'HKCU'

Key = 'SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot'

Value = @('1', '0')[$revert]

}

$aiPolicies += $obj

foreach ($policy in $aiPolicies) {

#apply each policy to registry and pol file (reflects exact behavior when doing these manually through gpedit)

Reg.exe add "$($policy.Hive)\$($policy.Key)" /v "$($policy.Name)" /t REG_DWORD /d $policy.Value /f *>$null

Edit-PolFile -Hive $policy.Hive -Key $policy.Key -Action Add -ValueName $policy.Name -Type DWORD -Value $policy.Value

}

#set for local machine and current user to be sure

$hives = @('HKLM', 'HKCU')

foreach ($hive in $hives) {

#only for insiders using enterprise or education as of right now (12/23/25)

#Reg.exe add "$hive\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" /v 'DisableRecallDataProviders' /t REG_DWORD /d @('1', '0')[$revert] /f *>$null

Reg.exe add "$hive\SOFTWARE\Microsoft\Windows\Shell\Copilot\BingChat" /v 'IsUserEligible' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

Reg.exe add "$hive\SOFTWARE\Microsoft\Windows\Shell\Copilot" /v 'IsCopilotAvailable' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

Reg.exe add "$hive\SOFTWARE\Microsoft\Windows\Shell\Copilot" /v 'CopilotDisabledReason' /t REG_SZ /d @('FeatureIsDisabled', ' ')[$revert] /f *>$null

}

Reg.exe add 'HKCU\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\Microsoft.Copilot_8wekyb3d8bbwe' /v 'Value' /t REG_SZ /d @('Deny', 'Prompt')[$revert] /f *>$null

Reg.exe add 'HKCU\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe' /v 'Value' /t REG_SZ /d @('Deny', 'Prompt')[$revert] /f *>$null

Reg.exe add 'HKCU\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\systemAIModels' /v 'Value' /t REG_SZ /d @('Deny', 'Prompt')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\Capabilities\systemAIModels' /v 'RecordUsageData' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

Reg.exe add 'HKCU\Software\Microsoft\Speech_OneCore\Settings\VoiceActivation\UserPreferenceForAllApps' /v 'AgentActivationEnabled' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

Reg.exe add 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' /v 'ShowCopilotButton' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

Reg.exe add 'HKCU\Software\Microsoft\input\Settings' /v 'InsightsEnabled' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

Reg.exe add 'HKCU\Software\Microsoft\Windows\Shell\ClickToDo' /v 'DisableClickToDo' /t REG_DWORD /d @('1', '0')[$revert] /f *>$null

#remove copilot from search

Write-Status -msg "$(@('Disabling', 'Enabling')[$revert]) Copilot In Windows Search..."

Reg.exe add 'HKCU\SOFTWARE\Policies\Microsoft\Windows\Explorer' /v 'DisableSearchBoxSuggestions' /t REG_DWORD /d @('1', '0')[$revert] /f *>$null

#disable copilot in edge

Write-Status -msg "$(@('Disabling', 'Enabling')[$revert]) Copilot In Edge..."

#keeping depreciated policies incase user has older versions of edge

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\Edge' /v 'CopilotCDPPageContext' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null #depreciated shows Unknown policy in edge://policy

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\Edge' /v 'CopilotPageContext' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\Edge' /v 'HubsSidebarEnabled' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\Edge' /v 'EdgeEntraCopilotPageContext' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\Edge' /v 'Microsoft365CopilotChatIconEnabled' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null #depreciated shows Unknown policy in edge://policy

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\Edge' /v 'EdgeHistoryAISearchEnabled' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\Edge' /v 'ComposeInlineEnabled' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\Edge' /v 'GenAILocalFoundationalModelSettings' /t REG_DWORD /d @('1', '0')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\Edge' /v 'BuiltInAIAPIsEnabled' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\Edge' /v 'AIGenThemesEnabled' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\Edge' /v 'DevToolsGenAiSettings' /t REG_DWORD /d @('2', '1')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\Edge' /v 'ShareBrowsingHistoryWithCopilotSearchAllowed' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

#disable edge copilot mode

# "enabled_labs_experiments":["edge-copilot-mode@2"]

# view flags at edge://flags

taskkill.exe /im msedge.exe /f *>$null

$config = "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Local State"

if (Test-Path $config) {

#powershell core bug where json that has empty strings will error

try {

$jsonContent = (Get-Content $config).Replace('""', '"_empty"') | ConvertFrom-Json -ErrorAction Stop

$fail = $false

}

catch {

Write-Status -msg 'Unable to set Edge flags to disable Copilot due to a different langauge being used' -errorOutput

Write-Status -msg 'You can manually disable the Copilot flags at [edge://flags] in the browser' -errorOutput

$fail = $true

}

if (!$fail) {

try {

if (($jsonContent.browser | Get-Member -MemberType NoteProperty enabled_labs_experiments -ErrorAction Stop) -eq $null) {

$jsonContent.browser | Add-Member -MemberType NoteProperty -Name enabled_labs_experiments -Value @()

}

$flags = @(

'edge-copilot-mode@2',

'edge-ntp-composer@2', #disables the copilot search in new tab page

'edge-compose@2' #disables the ai writing help

)

if ($revert) {

$jsonContent.browser.enabled_labs_experiments = $jsonContent.browser.enabled_labs_experiments | Where-Object { $_ -notin $flags }

}

else {

foreach ($flag in $flags) {

if ($jsonContent.browser.enabled_labs_experiments -notcontains $flag) {

$jsonContent.browser.enabled_labs_experiments += $flag

}

}

}

$newContent = $jsonContent | ConvertTo-Json -Compress -Depth 10

#add back the empty strings

$newContent = $newContent.replace('"_empty"', '""')

Set-Content $config -Value $newContent -Encoding UTF8 -Force

}

catch {

Write-Status -msg 'Edge Browser has never been opened on this machine unable to set flags...' -errorOutput

Write-Status -msg 'Open Edge once and run this tweak again' -errorOutput

}

}

}

#disable office ai with group policy

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\office\16.0\common\ai\training\general' /v 'disabletraining' /t REG_DWORD /d @('1', '0')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\office\16.0\common\ai\training\specific\adaptivefloatie' /v 'disabletrainingofadaptivefloatie' /t REG_DWORD /d @('1', '0')[$revert] /f *>$null

#disable connected experiences in office should prevent copilot from working

Reg.exe add 'HKCU\Software\Policies\Microsoft\office\16.0\common\privacy' /v 'controllerconnectedservicesenabled' /t REG_DWORD /d @('2', '1')[$revert] /f *>$null

Reg.exe add 'HKCU\Software\Policies\Microsoft\office\16.0\common\privacy' /v 'usercontentdisabled' /t REG_DWORD /d @('2', '1')[$revert] /f *>$null

#disable copilot in word

Reg.exe add 'HKCU\Software\Microsoft\Office\16.0\Word\Options' /v 'EnableCopilot' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

#disable copilot in excel

Reg.exe add 'HKCU\Software\Microsoft\Office\16.0\Excel\Options' /v 'EnableCopilot' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

#disable copilot in onenote

Reg.exe add 'HKCU\Software\Microsoft\Office\16.0\OneNote\Options\Copilot' /v 'CopilotEnabled' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

Reg.exe add 'HKCU\Software\Microsoft\Office\16.0\OneNote\Options\Copilot' /v 'CopilotNotebooksEnabled' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

Reg.exe add 'HKCU\Software\Microsoft\Office\16.0\OneNote\Options\Copilot' /v 'CopilotSkittleEnabled' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

#disable office ai content safety

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\office\16.0\common\ai\contentsafety\general' /v 'disablecontentsafety' /t REG_DWORD /d @('1', '0')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\office\16.0\common\ai\contentsafety\specific\alternativetext' /v 'disablecontentsafety' /t REG_DWORD /d @('1', '0')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\office\16.0\common\ai\contentsafety\specific\imagequestionandanswering' /v 'disablecontentsafety' /t REG_DWORD /d @('1', '0')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\office\16.0\common\ai\contentsafety\specific\promptassistance' /v 'disablecontentsafety' /t REG_DWORD /d @('1', '0')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\office\16.0\common\ai\contentsafety\specific\rewrite' /v 'disablecontentsafety' /t REG_DWORD /d @('1', '0')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\office\16.0\common\ai\contentsafety\specific\summarization' /v 'disablecontentsafety' /t REG_DWORD /d @('1', '0')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\office\16.0\common\ai\contentsafety\specific\summarizationwithreferences' /v 'disablecontentsafety' /t REG_DWORD /d @('1', '0')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\office\16.0\common\ai\contentsafety\specific\texttotable' /v 'disablecontentsafety' /t REG_DWORD /d @('1', '0')[$revert] /f *>$null

#disable additional keys

Reg.exe add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings' /v 'AutoOpenCopilotLargeScreens' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\generativeAI' /v 'Value' /t REG_SZ /d @('Deny', 'Allow')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\systemAIModels' /v 'Value' /t REG_SZ /d @('Deny', 'Allow')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy' /v 'LetAppsAccessGenerativeAI' /t REG_DWORD /d @('2', '1')[$revert] /f *>$null

Reg.exe add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy' /v 'LetAppsAccessSystemAIModels' /t REG_DWORD /d @('2', '1')[$revert] /f *>$null

Reg.exe add 'HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsCopilot' /v 'AllowCopilotRuntime' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

Reg.exe add 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband\AuxilliaryPins' /v 'CopilotPWAPin' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

Reg.exe add 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband\AuxilliaryPins' /v 'RecallPin' /t REG_DWORD /d @('0', '1')[$revert] /f *>$null

#disable copilot background app access

Reg.exe add 'HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications\Microsoft.Copilot_8wekyb3d8bbwe' /v 'DisabledByUser' /t REG_DWORD /d @('1', '0')[$revert] /f *>$null