#region Environment
    
        # Set UAC to Low
	    Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Type DWord -Value 0 -ErrorAction SilentlyContinue | Out-Null
	    Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "PromptOnSecureDesktop" -Type DWord -Value 0 -ErrorAction SilentlyContinue | Out-Null

        # Licence Windows Products with key present
        try{
        Get-CimInstance -ClassName SoftwareLicensingProduct -Filter “PartialProductKey IS NOT NULL” |
        Invoke-CimMethod -MethodName Activate -ErrorAction SilentlyContinue | out-null} catch{}
    
        # Set Windows 10 Active Hours to not interfere with work time. 
        $activeHoursRegPath = "HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings"

        if (Test-Path -Path "${activeHoursRegPath}") {

          $activeHoursStart = 8
          $activeHoursEnd = 17

          Set-ItemProperty -Path "${activeHoursRegPath}" -Name "ActiveHoursStart" -Value "${activeHoursStart}" -ErrorAction SilentlyContinue | Out-Null
          Set-ItemProperty -Path "${activeHoursRegPath}" -Name "ActiveHoursEnd" -Value "${activeHoursEnd}" -ErrorAction SilentlyContinue | Out-Null
        }     

        # Check for Windows Image Errors
        Dism /Online /NoRestart /Cleanup-Image /RestoreHealth /LimitAccess

        # Remove System Restore Point 24 Hour Cooldown
        Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" -Name "SystemRestorePointCreationFrequency" -Type DWord -Value 0 -ErrorAction SilentlyContinue | Out-Null

    #endregion Environment 


    #region Local
        # Configure Localization Settings.

        Set-TimeZone “GMT Standard Time”
        Set-Culture en-GB
        Set-WinSystemLocale en-GB
        Set-WinHomeLocation  -GeoId 0xf2
        Set-WinUserLanguageList -LanguageList en-GB -Force
        # Set BIOS time to local time
        Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\TimeZoneInformation" -Name "RealTimeIsUniversal" -ErrorAction SilentlyContinue

    #endregion Local


    #region Power Settings
        # Configure Power Settings.

        powercfg.exe -restoredefaultschemes
        # https://www.symantec.com/connect/articles/tweaking-windows-7-power-plans-using-powercfg-command-line-options
        # Switch Off Display Setting (0-4294967295) =Seconds
        powercfg /SETDCVALUEINDEX SCHEME_CURRENT 7516b95f-f776-4464-8c53-06167f40cc99 3c0bc021-c8a8-4e07-a973-6b14cbcb2b7e 300   
        powercfg /SETACVALUEINDEX SCHEME_CURRENT 7516b95f-f776-4464-8c53-06167f40cc99 3c0bc021-c8a8-4e07-a973-6b14cbcb2b7e 3600
        # Display Brighness Setting (percent): 0-100 
        powercfg /SETDCVALUEINDEX SCHEME_CURRENT 7516b95f-f776-4464-8c53-06167f40cc99 aded5e82-b909-4619-9949-f5d71dac0bcb 50 
        powercfg /SETACVALUEINDEX SCHEME_CURRENT 7516b95f-f776-4464-8c53-06167f40cc99 aded5e82-b909-4619-9949-f5d71dac0bcb 100
        # Graphics Quality
        powercfg /SETDCVALUEINDEX SCHEME_CURRENT 44f3beca-a7c0-460e-9df2-bb8b99e0cba6 3619c3f2-afb2-4afc-b0e9-e7fef372de36 0     
        powercfg /SETACVALUEINDEX SCHEME_CURRENT 44f3beca-a7c0-460e-9df2-bb8b99e0cba6 3619c3f2-afb2-4afc-b0e9-e7fef372de36 2 
        # Sleep Timeout Setting (seconds) =Seconds after which sleep to occur
        powercfg /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 29f6c1db-86da-48c5-9fdb-f2b67b1f44da 900     
        powercfg /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 29f6c1db-86da-48c5-9fdb-f2b67b1f44da 3600
        # DC - On Battery | Wireless Adapter Settings -> Power Saving Mode -> Maximum Performance 
        powercfg /SETDCVALUEINDEX SCHEME_CURRENT 19cbb8fa-5279-450e-9fac-8a3d5fedd0c1 12bbebe6-58d6-4636-95bb-3217ef867c1a 0
        # AC - Power Adapter | Wireless Adapter Settings -> Power Saving Mode -> Maximum Performance
        powercfg /SETACVALUEINDEX SCHEME_CURRENT 19cbb8fa-5279-450e-9fac-8a3d5fedd0c1 12bbebe6-58d6-4636-95bb-3217ef867c1a 0      

    #endregion Power Settings


    #region Certificates

        # Add Certificate to Local Trusted Root CA

        $CertString = "blahblahcertificateasstringhereblahblah"

        $Cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
        $Cert.Import([Convert]::FromBase64String($CertString))


        $store = new-object System.Security.Cryptography.X509Certificates.X509Store(
            [System.Security.Cryptography.X509Certificates.StoreName]::Root,
            "localmachine"
        )

        $store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::"ReadWrite")
        $store.Add($Cert)
        $store.Close()
	
    #endregion Certificates

    #region Bitlocker
        # Allow Bitlocker Without a Compatible TPM

        $gpopath= "HKLM:\SOFTWARE\Policies\Microsoft"
        New-Item –Path "$gpopath" –Name FVE -Force -ErrorAction SilentlyContinue | out-null
        New-ItemProperty -Path "$gpopath\FVE" -Name 'UseAdvancedStartup' -Value '1' -PropertyType DWORD -Force -ErrorAction SilentlyContinue | out-null
        New-ItemProperty -Path "$gpopath\FVE" -Name 'EnableBDEWithNoTPM' -Value '1' -PropertyType DWORD -Force -ErrorAction SilentlyContinue | out-null
        New-ItemProperty -Path "$gpopath\FVE" -Name 'UseTPM' -Value '2' -PropertyType DWORD -Force -ErrorAction SilentlyContinue | out-null
        New-ItemProperty -Path "$gpopath\FVE" -Name 'UseTPMPIN' -Value '2' -PropertyType DWORD -Force -ErrorAction SilentlyContinue | out-null
        New-ItemProperty -Path "$gpopath\FVE" -Name 'UseTPMKEY' -Value '2' -PropertyType DWORD -Force -ErrorAction SilentlyContinue | out-null
        New-ItemProperty -Path "$gpopath\FVE" -Name 'UseTPMKeyPIN' -Value '2' -PropertyType DWORD -Force -ErrorAction SilentlyContinue | out-null

    #endregion Bitlocker


    #region Network
    

        # Prevent Mapped Drives From Auto Disconnecting
        net config server /autodisconnect:-1 | Out-Null

    #endregion Network

    #region Firewall
    
       # Configure Firewall Rules

        # Allow WMI

        netsh advfirewall firewall set rule group="windows management instrumentation (wmi)" new enable=yes | out-null
        New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Wbem\CIMOM" -Name "AllowAnonymousCallback" -Type DWord -Value 1  -Force | out-null 
   
        # Allow NetBIOS

        if (-not $(Get-NetFirewallRule –DisplayName 'NetBIOS' | Get-NetFirewallPortFilter | Where { $_.LocalPort -eq '137' })){
            netsh advfirewall firewall add rule name="NetBIOS" dir=in action=allow protocol=TCP localport=137 | out-null 
        }
        if (-not $(Get-NetFirewallRule –DisplayName 'NetBIOS_1NetBIOS_2' | Get-NetFirewallPortFilter | Where { $_.LocalPort -eq '138' })){
            netsh advfirewall firewall add rule name="NetBIOS_1NetBIOS_2" dir=in action=allow protocol=UDP localport=138 | out-null
        }
        if (-not $(Get-NetFirewallRule –DisplayName 'NetBIOS_2' | Get-NetFirewallPortFilter | Where { $_.LocalPort -eq '139' })){
            netsh advfirewall firewall add rule name="NetBIOS_2" dir=in action=allow protocol=UDP localport=139 | out-null
        }

        # Allow ICMP - http://shouldiblockicmp.com/
   
        if (-not $(Get-NetFirewallRule –DisplayName 'All ICMP V4' | Where {$_.Enabled -eq $true})){
            netsh advfirewall firewall add rule name="All ICMP V4" protocol=icmpv4:any,any dir=in action=allow | out-null 
        }       
        if (-not $(Get-NetFirewallRule –DisplayName 'All ICMP V6' | Where {$_.Enabled -eq $true})){
            netsh advfirewall firewall add rule name="All ICMP V6" protocol=icmpv6:any,any dir=in action=allow | out-null
        }

        # Allow Remote Administration
    
        netsh advfirewall firewall set rule group="Remote Administration" new enable=yes | out-null 
        New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "AllowRemoteRPC" -Type DWord -Value 1  -Force | out-null
        New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Type DWord -Value 0  -Force | out-null
    
        # Allow File Printer Sharing

        netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=yes | out-null 
   
        # Allow Network Discovery

        netsh advfirewall firewall set rule group="network discovery" new enable=yes | out-null

        # Allow SQL

        if (-not $(Get-NetFirewallRule –DisplayName 'SQL Port 1433' | Get-NetFirewallPortFilter | Where { $_.LocalPort -eq '1433' })){
            netsh advfirewall firewall add rule name="SQL Port 1433" dir=in action=allow protocol=TCP localport=1433 | out-null
        }
        if (-not $(Get-NetFirewallRule –DisplayName 'SQL Port 1434' | Get-NetFirewallPortFilter | Where { $_.LocalPort -eq '1434' })){
            netsh advfirewall firewall add rule name="SQL Port 1434" dir=in action=allow protocol=UDP localport=1434 | out-null
        }

    #endregion Firewall

    #region Accessibility

        # Mouse Acceleration Settings
        Set-ItemProperty "HKCU:\Control Panel\Mouse" "MouseSensitivity" "15" -ErrorAction SilentlyContinue | Out-Null
        Set-ItemProperty "HKCU:\Control Panel\Mouse" "MouseSpeed" "0" -ErrorAction SilentlyContinue | Out-Null
        Set-ItemProperty "HKCU:\Control Panel\Mouse" "MouseThreshold1" "0" -ErrorAction SilentlyContinue | Out-Null
        Set-ItemProperty "HKCU:\Control Panel\Mouse" "MouseThreshold2" "0" -ErrorAction SilentlyContinue | Out-Null
        Set-ItemProperty "HKCU:\Control Panel\Mouse" "SmoothMouseXCurve" ([byte[]](0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0xCC, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x80, 0x99, 0x19, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x66, 0x26, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x33, 0x33, 0x00, 0x00, 0x00, 0x00, 0x00)) -ErrorAction SilentlyContinue | Out-Null
        Set-ItemProperty "HKCU:\Control Panel\Mouse" "SmoothMouseYCurve" ([byte[]](0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x38, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x70, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xA8, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0xE0, 0x00, 0x00, 0x00, 0x00, 0x00)) -ErrorAction SilentlyContinue | Out-Null
        Set-ItemProperty "HKCU:\Control Panel\Desktop" "UserPreferencesMask" ([byte[]](0x9e,
        0x1e, 0x06, 0x80, 0x12, 0x00, 0x00, 0x00)) -ErrorAction SilentlyContinue | Out-Null

        $MethodDefinition = @"
       [DllImport("user32.dll", EntryPoint = "SystemParametersInfo")]
       public static extern bool SystemParametersInfo(uint uiAction, uint uiParam, uint pvParam, uint fWinIni);
    "@
        $User32Set = Add-Type -MemberDefinition $MethodDefinition -Name "User32Set" -Namespace Win32Functions -PassThru
        $User32Set::SystemParametersInfo(0x0071,0,15,0) | Out-Null


    # endregion Accessibility


    #region Choco
        # Chocolatey Package Manager."
        $env:chocolateyUseWindowsCompression = 'true'
        $packages = @(
            "choco install choco-upgrade-all-at-startup"
            "anydesk"
            "winrar"
            "google-drive-file-stream"
            "adobereader"
            "audacity"
            "google-chrome-x64"
            "sysinternals"
            "vlc"
            "everything"
            "youtube-dl-gui.install"
            "pdfsam.install"
            "adwcleaner"
            "bulkrenameutility.install"
        )


        If(Test-Path -Path "$env:ProgramData\Chocolatey") {

            choco feature enable -n=allowglobalconfirmation
            choco feature enable -n=allowemptychecksums
            choco upgrade chocolatey
            choco upgrade all --ignore-checksums -y
        }
        Else {

          [System.Net.WebRequest]::DefaultWebProxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))  

          choco feature enable -n=allowglobalconfirmation
          choco feature enable -n=allowemptychecksums
          $packages | %{choco install $_  --ignore-checksums --force -y}
        }


    #endregion Choco