一个安全中心的右键菜单（能实时开启和关闭 Win defender实时防护和防篡改） - 无忧启动论坛

#Requires -RunAsAdministrator
# WinDefCtl.ps1 - Windows Defender Automation & Control Utility
# PowerShell Edition - Real-Time Protection and Tamper Protection Management
# Author: Marek Wesolowski - WESMAR - 2025
param(
[Parameter(Mandatory=$true, Position=0)]
[ValidateSet('rtp', 'tp', 'all')]
[string]$Command,
[Parameter(Mandatory=$false, Position=1)]
[ValidateSet('on', 'off', 'status')]
[string]$Action = 'status'
)
# ============================================================================
# UI Automation Setup
# ============================================================================
Add-Type -AssemblyName UIAutomationClient
Add-Type -AssemblyName UIAutomationTypes
Add-Type @"
using System;
using System.Runtime.InteropServices;
using System.Text;
public class WinAPI {
[DllImport("user32.dll")]
public static extern bool EnumWindows(EnumWindowsProc enumProc, IntPtr lParam);
[DllImport("user32.dll")]
public static extern int GetClassName(IntPtr hWnd, StringBuilder text, int count);
[DllImport("user32.dll")]
public static extern bool IsWindowVisible(IntPtr hWnd);
[DllImport("user32.dll")]
public static extern bool SetForegroundWindow(IntPtr hWnd);
[DllImport("user32.dll")]
public static extern IntPtr SendMessage(IntPtr hWnd, uint Msg, IntPtr wParam, IntPtr lParam);
[DllImport("user32.dll")]
public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);
[DllImport("user32.dll")]
public static extern bool IsWindow(IntPtr hWnd);
public delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam);
public const uint WM_SYSCOMMAND = 0x0112;
public const uint SC_CLOSE = 0xF060;
public const uint WM_CLOSE = 0x0010;
public const int SW_SHOWMINNOACTIVE = 7;
}
"@
# ============================================================================
# Registry Helper Functions
# ============================================================================
$UAC_REG_PATH = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"
$VOLATILE_KEY_PATH = "HKCU:\Software\Temp"
$KEY_NOT_EXISTED = 0xFF
function Read-RegistryDword {
param(
[string]$Path,
[string]$Name
)
try {
if (Test-Path $Path) {
$value = Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue
if ($null -ne $value) {
return @{
Value = $value.$Name
Existed = $true
}
}
}
}
catch { }
return @{
Value = 0
Existed = $false
}
}
function Write-RegistryDword {
param(
[string]$Path,
[string]$Name,
[int]$Value
)
try {
if (-not (Test-Path $Path)) {
New-Item -Path $Path -Force | Out-Null
}
Set-ItemProperty -Path $Path -Name $Name -Value $Value -Type DWord -Force
return $true
}
catch {
return $false
}
}
function Remove-RegistryValue {
param(
[string]$Path,
[string]$Name
)
try {
if (Test-Path $Path) {
Remove-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue
}
return $true
}
catch {
return $false
}
}
# ============================================================================
# UAC Management Functions
# ============================================================================
function Encode-UACStatus {
param(
[int]$CPBA,
[bool]$CPBAExisted,
[int]$POSD,
[bool]$POSDExisted
)
$cpbaValue = if ($CPBAExisted) { $CPBA -band 0xFF } else { $KEY_NOT_EXISTED }
$posdValue = if ($POSDExisted) { $POSD -band 0xFF } else { $KEY_NOT_EXISTED }
$encoded = $cpbaValue -bor ($posdValue -shl 8)
return $encoded
}
function Decode-UACStatus {
param([int]$Encoded)
$cpbaByte = $Encoded -band 0xFF
$posdByte = ($Encoded -shr 8) -band 0xFF
return @{
CPBA = if ($cpbaByte -ne $KEY_NOT_EXISTED) { $cpbaByte } else { 0 }
CPBAExisted = ($cpbaByte -ne $KEY_NOT_EXISTED)
POSD = if ($posdByte -ne $KEY_NOT_EXISTED) { $posdByte } else { 0 }
POSDExisted = ($posdByte -ne $KEY_NOT_EXISTED)
}
}
function Backup-UAC {
Write-Host " [*] Backing up and disabling UAC prompts..."
$cpba = Read-RegistryDword -Path $UAC_REG_PATH -Name "ConsentPromptBehaviorAdmin"
$posd = Read-RegistryDword -Path $UAC_REG_PATH -Name "PromptOnSecureDesktop"
$encoded = Encode-UACStatus -CPBA $cpba.Value -CPBAExisted $cpba.Existed -POSD $posd.Value -POSDExisted $posd.Existed
if (-not (Write-RegistryDword -Path $UAC_REG_PATH -Name "UACStatus" -Value $encoded)) {
return $false
}
$success = $true
$success = $success -and (Write-RegistryDword -Path $UAC_REG_PATH -Name "ConsentPromptBehaviorAdmin" -Value 0)
$success = $success -and (Write-RegistryDword -Path $UAC_REG_PATH -Name "PromptOnSecureDesktop" -Value 0)
return $success
}
function Restore-UAC {
Write-Host " [*] Restoring original UAC settings..."
$backup = Read-RegistryDword -Path $UAC_REG_PATH -Name "UACStatus"
if (-not $backup.Existed) {
return $false
}
$decoded = Decode-UACStatus -Encoded $backup.Value
if ($decoded.CPBAExisted) {
Write-RegistryDword -Path $UAC_REG_PATH -Name "ConsentPromptBehaviorAdmin" -Value $decoded.CPBA | Out-Null
}
else {
Remove-RegistryValue -Path $UAC_REG_PATH -Name "ConsentPromptBehaviorAdmin" | Out-Null
}
if ($decoded.POSDExisted) {
Write-RegistryDword -Path $UAC_REG_PATH -Name "PromptOnSecureDesktop" -Value $decoded.POSD | Out-Null
}
else {
Remove-RegistryValue -Path $UAC_REG_PATH -Name "PromptOnSecureDesktop" | Out-Null
}
Remove-RegistryValue -Path $UAC_REG_PATH -Name "UACStatus" | Out-Null
return $true
}
function Test-UACBackupExists {
$backup = Read-RegistryDword -Path $UAC_REG_PATH -Name "UACStatus"
return $backup.Existed
}
function Recover-UACIfNeeded {
if (Test-UACBackupExists) {
Write-Host " [RECOVERY] Found incomplete UAC backup, restoring..."
return Restore-UAC
}
return $true
}
# ============================================================================
# Cold Boot Detection (Volatile Registry Marker)
# ============================================================================
function Test-ColdBoot {
# Volatile key in HKCU:\Software\Temp - disappears on logout/reboot
try {
$marker = Get-ItemProperty -Path "$VOLATILE_KEY_PATH" -Name "WinDefCtl_Warmed" -ErrorAction SilentlyContinue
return ($null -eq $marker)
}
catch {
return $true
}
}
function Set-WarmMarker {
try {
# Create volatile registry key - will disappear on session end
if (-not (Test-Path $VOLATILE_KEY_PATH)) {
New-Item -Path $VOLATILE_KEY_PATH -Force | Out-Null
}
# Unfortunately PowerShell doesn't support REG_OPTION_VOLATILE directly
# We'll use reg.exe for true volatile key creation
& reg add "HKCU\Software\Temp" /v "WinDefCtl_Warmed" /t REG_DWORD /d 1 /f | Out-Null
return $true
}
catch {
return $false
}
}
# ============================================================================
# Window Management Functions
# ============================================================================
function Find-SecurityWindow {
param([int]$MaxRetries = 10)
$script:foundWindow = $null
for ($i = 0; $i -lt $MaxRetries; $i++) {
$callback = [WinAPI+EnumWindowsProc] {
param($hwnd, $lParam)
$className = New-Object System.Text.StringBuilder 256
[WinAPI]::GetClassName($hwnd, $className, 256) | Out-Null
if ($className.ToString() -eq "ApplicationFrameWindow" -and [WinAPI]::IsWindowVisible($hwnd)) {
$script:foundWindow = $hwnd
return $false
}
return $true
}
[WinAPI]::EnumWindows($callback, [IntPtr]::Zero) | Out-Null
if ($script:foundWindow) {
return $script:foundWindow
}
Start-Sleep -Milliseconds 100
}
return $null
}
function Close-SecurityWindow {
param([IntPtr]$WindowHandle)
if ($WindowHandle -eq [IntPtr]::Zero -or -not [WinAPI]::IsWindow($WindowHandle)) {
return
}
# Try SetForegroundWindow + SC_CLOSE
[WinAPI]::SetForegroundWindow($WindowHandle) | Out-Null
Start-Sleep -Milliseconds 100
[WinAPI]::SendMessage($WindowHandle, [WinAPI]::WM_SYSCOMMAND, [IntPtr][WinAPI]::SC_CLOSE, [IntPtr]::Zero) | Out-Null
# Wait for window to close
$closed = $false
for ($i = 0; $i -lt 30; $i++) {
if (-not [WinAPI]::IsWindow($WindowHandle)) {
$closed = $true
break
}
Start-Sleep -Milliseconds 100
}
# Fallback to WM_CLOSE if needed
if (-not $closed) {
[WinAPI]::SendMessage($WindowHandle, [WinAPI]::WM_CLOSE, [IntPtr]::Zero, [IntPtr]::Zero) | Out-Null
Start-Sleep -Milliseconds 1000
}
}
# ============================================================================
# Pre-Warming for Cold Boot
# ============================================================================
function Invoke-PreWarmDefender {
Write-Host " [*] Cold boot detected - pre-warming Windows Defender..."
Start-Process "windowsdefender://threatsettings" -WindowStyle Hidden
Start-Sleep -Milliseconds 800
$hwnd = Find-SecurityWindow -MaxRetries 10
if ($hwnd) {
Write-Host " [*] Pre-warm window found, waiting for full initialization..."
Start-Sleep -Milliseconds 800
Write-Host " [*] Closing pre-warm window..."
Close-SecurityWindow -WindowHandle $hwnd
Set-WarmMarker | Out-Null
Write-Host " [*] Pre-warm complete"
return $true
}
Write-Host " [WARN] Pre-warm window not found, continuing anyway..."
return $false
}
# ============================================================================
# UI Automation Functions
# ============================================================================
function Wait-UILoaded {
param(
[System.Windows.Automation.AutomationElement]$RootElement,
[int]$MaxRetries = 50
)
for ($i = 0; $i -lt $MaxRetries; $i++) {
try {
$descendants = $RootElement.FindAll(
[System.Windows.Automation.TreeScope]::Descendants,
[System.Windows.Automation.Condition]::TrueCondition
)
if ($descendants.Count -gt 10) {
return $true
}
}
catch { }
Start-Sleep -Milliseconds 100
}
return $false
}
function Get-ElementCount {
param([System.Windows.Automation.AutomationElement]$RootElement)
try {
$descendants = $RootElement.FindAll(
[System.Windows.Automation.TreeScope]::Descendants,
[System.Windows.Automation.Condition]::TrueCondition
)
return $descendants.Count
}
catch {
return 0
}
}
function Wait-StructureChange {
param(
[System.Windows.Automation.AutomationElement]$RootElement,
[int]$BaselineCount,
[bool]$ExpectIncrease,
[int]$TimeoutSeconds = 10
)
Write-Host " [*] Waiting for UI update..." -NoNewline
$maxLoops = $TimeoutSeconds * 10
for ($i = 0; $i -lt $maxLoops; $i++) {
$currentCount = Get-ElementCount -RootElement $RootElement
$structureChanged = if ($ExpectIncrease) {
$currentCount -gt $BaselineCount
} else {
$currentCount -lt $BaselineCount
}
if ($structureChanged) {
Start-Sleep -Milliseconds 200
$recheckCount = Get-ElementCount -RootElement $RootElement
$stable = if ($ExpectIncrease) {
$recheckCount -gt $BaselineCount
} else {
$recheckCount -lt $BaselineCount
}
if ($stable) {
Write-Host " [OK]"
return $true
}
}
Start-Sleep -Milliseconds 100
}
Write-Host " [WARN] Timeout."
return $false
}
function Find-FirstToggleSwitch {
param([System.Windows.Automation.AutomationElement]$RootElement)
$condition = New-Object System.Windows.Automation.PropertyCondition(
[System.Windows.Automation.AutomationElement]::ControlTypeProperty,
[System.Windows.Automation.ControlType]::Button
)
$buttons = $RootElement.FindAll([System.Windows.Automation.TreeScope]::Descendants, $condition)
foreach ($button in $buttons) {
try {
$togglePattern = $button.GetCurrentPattern([System.Windows.Automation.TogglePattern]::Pattern)
if ($togglePattern) {
return $button
}
}
catch { }
}
return $null
}
function Find-LastToggleSwitch {
param([System.Windows.Automation.AutomationElement]$RootElement)
$condition = New-Object System.Windows.Automation.PropertyCondition(
[System.Windows.Automation.AutomationElement]::ControlTypeProperty,
[System.Windows.Automation.ControlType]::Button
)
$buttons = $RootElement.FindAll([System.Windows.Automation.TreeScope]::Descendants, $condition)
$lastToggle = $null
foreach ($button in $buttons) {
try {
$togglePattern = $button.GetCurrentPattern([System.Windows.Automation.TogglePattern]::Pattern)
if ($togglePattern) {
$lastToggle = $button
}
}
catch { }
}
return $lastToggle
}
# ============================================================================
# Real-Time Protection Functions
# ============================================================================
function Get-RTPStatus {
param([System.Windows.Automation.AutomationElement]$RootElement)
$button = Find-FirstToggleSwitch -RootElement $RootElement
if (-not $button) {
return $null
}
try {
$togglePattern = $button.GetCurrentPattern([System.Windows.Automation.TogglePattern]::Pattern)
$state = $togglePattern.Current.ToggleState
$isEnabled = ($state -eq [System.Windows.Automation.ToggleState]::On)
Write-Host " [*] RTP Status: $(if ($isEnabled) { 'ENABLED' } else { 'DISABLED' })"
return $isEnabled
}
catch {
return $null
}
}
function Enable-RTP {
param([System.Windows.Automation.AutomationElement]$RootElement)
if (-not (Backup-UAC)) {
return $false
}
$button = Find-FirstToggleSwitch -RootElement $RootElement
if (-not $button) {
Restore-UAC | Out-Null
return $false
}
try {
$togglePattern = $button.GetCurrentPattern([System.Windows.Automation.TogglePattern]::Pattern)
$state = $togglePattern.Current.ToggleState
if ($state -eq [System.Windows.Automation.ToggleState]::Off) {
$baseline = Get-ElementCount -RootElement $RootElement
$togglePattern.Toggle()
$result = Wait-StructureChange -RootElement $RootElement -BaselineCount $baseline -ExpectIncrease $false
}
else {
Write-Host " [*] RTP already enabled"
$result = $true
}
Restore-UAC | Out-Null
return $result
}
catch {
Restore-UAC | Out-Null
return $false
}
}
function Disable-RTP {
param([System.Windows.Automation.AutomationElement]$RootElement)
if (-not (Backup-UAC)) {
return $false
}
$button = Find-FirstToggleSwitch -RootElement $RootElement
if (-not $button) {
Restore-UAC | Out-Null
return $false
}
try {
$togglePattern = $button.GetCurrentPattern([System.Windows.Automation.TogglePattern]::Pattern)
$state = $togglePattern.Current.ToggleState
if ($state -eq [System.Windows.Automation.ToggleState]::On) {
$baseline = Get-ElementCount -RootElement $RootElement
$togglePattern.Toggle()
$result = Wait-StructureChange -RootElement $RootElement -BaselineCount $baseline -ExpectIncrease $true
}
else {
Write-Host " [*] RTP already disabled"
$result = $true
}
Restore-UAC | Out-Null
return $result
}
catch {
Restore-UAC | Out-Null
return $false
}
}
# ============================================================================
# Tamper Protection Functions
# ============================================================================
function Get-TPStatus {
param([System.Windows.Automation.AutomationElement]$RootElement)
$button = Find-LastToggleSwitch -RootElement $RootElement
if (-not $button) {
return $null
}
try {
$togglePattern = $button.GetCurrentPattern([System.Windows.Automation.TogglePattern]::Pattern)
$state = $togglePattern.Current.ToggleState
$isEnabled = ($state -eq [System.Windows.Automation.ToggleState]::On)
Write-Host " [*] Tamper Protection Status: $(if ($isEnabled) { 'ENABLED' } else { 'DISABLED' })"
return $isEnabled
}
catch {
return $null
}
}
function Enable-TP {
param([System.Windows.Automation.AutomationElement]$RootElement)
if (-not (Backup-UAC)) {
return $false
}
$button = Find-LastToggleSwitch -RootElement $RootElement
if (-not $button) {
Restore-UAC | Out-Null
return $false
}
try {
$togglePattern = $button.GetCurrentPattern([System.Windows.Automation.TogglePattern]::Pattern)
$state = $togglePattern.Current.ToggleState
if ($state -eq [System.Windows.Automation.ToggleState]::Off) {
$baseline = Get-ElementCount -RootElement $RootElement
$togglePattern.Toggle()
$result = Wait-StructureChange -RootElement $RootElement -BaselineCount $baseline -ExpectIncrease $false
}
else {
Write-Host " [*] Tamper Protection already enabled"
$result = $true
}
Restore-UAC | Out-Null
return $result
}
catch {
Restore-UAC | Out-Null
return $false
}
}
function Disable-TP {
param([System.Windows.Automation.AutomationElement]$RootElement)
if (-not (Backup-UAC)) {
return $false
}
$button = Find-LastToggleSwitch -RootElement $RootElement
if (-not $button) {
Restore-UAC | Out-Null
return $false
}
try {
$togglePattern = $button.GetCurrentPattern([System.Windows.Automation.TogglePattern]::Pattern)
$state = $togglePattern.Current.ToggleState
if ($state -eq [System.Windows.Automation.ToggleState]::On) {
$baseline = Get-ElementCount -RootElement $RootElement
$togglePattern.Toggle()
$result = Wait-StructureChange -RootElement $RootElement -BaselineCount $baseline -ExpectIncrease $true
}
else {
Write-Host " [*] Tamper Protection already disabled"
$result = $true
}
Restore-UAC | Out-Null
return $result
}
catch {
Restore-UAC | Out-Null
return $false
}
}
# ============================================================================
# Process Single Command
# ============================================================================
function Process-SingleCommand {
param(
[string]$Cmd,
[string]$Act
)
Write-Host ""
Write-Host "=== Windows Defender $(if ($Cmd -eq 'rtp') { 'RTP' } else { 'Tamper Protection' }) Control ===" -ForegroundColor Cyan
Write-Host ""
# Check for incomplete UAC backup from previous crash
Recover-UACIfNeeded | Out-Null
Write-Host " [*] Opening Windows Defender..."
# Pre-warming on cold boot
if (Test-ColdBoot) {
Invoke-PreWarmDefender | Out-Null
Start-Sleep -Milliseconds 800
}
# Open Windows Security
Start-Process "windowsdefender://threatsettings" -WindowStyle Hidden
$hwndSecurity = Find-SecurityWindow -MaxRetries 10
if (-not $hwndSecurity) {
Write-Host " [ERROR] Failed to find Windows Security window" -ForegroundColor Red
return $false
}
# Get UI Automation root element
try {
$rootElement = [System.Windows.Automation.AutomationElement]::FromHandle($hwndSecurity)
}
catch {
Write-Host " [ERROR] Failed to get automation element" -ForegroundColor Red
Close-SecurityWindow -WindowHandle $hwndSecurity
return $false
}
# Wait for UI to load
if (-not (Wait-UILoaded -RootElement $rootElement -MaxRetries 50)) {
Write-Host " [ERROR] Failed to load UI (Timeout on slow system)" -ForegroundColor Red
Close-SecurityWindow -WindowHandle $hwndSecurity
return $false
}
# Execute requested action
$result = $false
if ($Cmd -eq 'rtp') {
switch ($Act) {
'status' {
$result = (Get-RTPStatus -RootElement $rootElement) -ne $null
}
'on' {
$result = Enable-RTP -RootElement $rootElement
}
'off' {
$result = Disable-RTP -RootElement $rootElement
}
}
}
elseif ($Cmd -eq 'tp') {
switch ($Act) {
'status' {
$result = (Get-TPStatus -RootElement $rootElement) -ne $null
}
'on' {
$result = Enable-TP -RootElement $rootElement
}
'off' {
$result = Disable-TP -RootElement $rootElement
}
}
}
# Close security window
Close-SecurityWindow -WindowHandle $hwndSecurity
return $result
}
# ============================================================================
# Main Execution Flow
# ============================================================================
$overallResult = $true
if ($Command -eq 'all') {
Write-Host ""
Write-Host "=== Windows Defender ALL Control ($Action) ===" -ForegroundColor Cyan
Write-Host ""
if ($Action -eq 'status') {
# Process RTP status
$rtpResult = Process-SingleCommand -Cmd 'rtp' -Act 'status'
Write-Host ""
Write-Host "---" -ForegroundColor DarkGray
# Process TP status
$tpResult = Process-SingleCommand -Cmd 'tp' -Act 'status'
$overallResult = $rtpResult -and $tpResult
}
else {
# Process RTP action
Write-Host "[1/2] Processing RTP ($Action)..." -ForegroundColor Cyan
$rtpResult = Process-SingleCommand -Cmd 'rtp' -Act $Action
Write-Host ""
Write-Host "--- Waiting 1 second ---" -ForegroundColor DarkGray
Start-Sleep -Seconds 1
# Process TP action
Write-Host "[2/2] Processing Tamper Protection ($Action)..." -ForegroundColor Cyan
$tpResult = Process-SingleCommand -Cmd 'tp' -Act $Action
$overallResult = $rtpResult -and $tpResult
Write-Host ""
Write-Host "=== Summary ===" -ForegroundColor Cyan
Write-Host " [*] RTP ($Action): $(if ($rtpResult) { 'SUCCESS' } else { 'FAILED' })" -ForegroundColor $(if ($rtpResult) { 'Green' } else { 'Red' })
Write-Host " [*] Tamper Protection ($Action): $(if ($tpResult) { 'SUCCESS' } else { 'FAILED' })" -ForegroundColor $(if ($tpResult) { 'Green' } else { 'Red' })
}
}
else {
$overallResult = Process-SingleCommand -Cmd $Command -Act $Action
}
Write-Host ""
Write-Host " [*] Operation completed." -ForegroundColor $(if ($overallResult) { 'Green' } else { 'Yellow' })
Write-Host ""
exit $(if ($overallResult) { 0 } else { 1 })

复制代码

@ECHO OFF
PUSHD %~dp0
TITLE Hello World
>nul reg add hkcu\software\classes\.Admin\shell\runas\command /f /ve /d "cmd /x /d /r set "f0=%%2" &call "%%2" %%3" & set "_= %*"
>nul fltmc || if "%f0%" neq "%~f0" ( cd.>"%tmp%\runas.Admin" & start "%~n0" /high "%tmp%\runas.Admin" "%~f0" "%_:"=""%" &exit /b )
cd /d "%~dp0"
if "%PROCESSOR_ARCHITECTURE%"=="x86" set bits=32
if "%PROCESSOR_ARCHITECTURE%"=="AMD64" set bits=64
REM 检查命令行参数
if "%~1"=="install" (
goto install
)
if "%~1"=="uninstall" (
goto uninstall
)
Rem 设置程序路径
SET "_file_path=%~dp0"
Rem 设置命令行
SET "_cmd_cmd_enable=powershell Start-Process cmd -Verb RunAs -ArgumentList '/S /K pushd "%%V" &"%~dp0WinDefCtl.exe" rtp on &"%~dp0WinDefCtl.exe" tp on &exit'"
SET "_cmd_cmd_disabled=powershell Start-Process cmd -Verb RunAs -ArgumentList '/S /K pushd "%%V" &"%~dp0WinDefCtl.exe" rtp off &"%~dp0WinDefCtl.exe" tp off &exit'"
SET "_cmd_scripts_enable="powershell.exe" "-Command" ""& {Start-Process PowerShell.exe -ArgumentList '-ExecutionPolicy RemoteSigned -File "%~dp0WinDefCtl.ps1" all on' -Verb RunAs}""
SET "_cmd_scripts_disabled="powershell.exe" "-Command" ""& {Start-Process PowerShell.exe -ArgumentList '-ExecutionPolicy RemoteSigned -File "%~dp0WinDefCtl.ps1" all off' -Verb RunAs}""
Rem 设置注册表初始值
SET "_regkey1=HKCR\*\Shell\WindowsSecurity"
SET "_regkey2=HKCR\Directory\Shell\WindowsSecurity"
SET "_regkey3=HKCR\Directory\background\Shell\WindowsSecurity"
SET "_regkey4=HKCR\Drive\Shell\WindowsSecurity"
SET "_regkey5=HKCR\DesktopBackground\Shell\WindowsSecurity"
:Menu
SET Options=
ECHO.&ECHO. 1.安装 WinDefCtl 鼠标右键菜单
ECHO.&ECHO. 2.卸载 WinDefCtl 鼠标右键菜单
ECHO.&ECHO. 3.退出
ECHO.
SET /P Options=[92m请输入选择项目序号并按回车确认：[0m
IF /I "%Options%"=="1" GOTO install
IF /I "%Options%"=="2" GOTO uninstall
IF /I "%Options%"=="3" GOTO OUT
ECHO.&ECHO.序号无效，请重新输入！
PING -n 2 127.1>NUL
CLS
GOTO Menu
:install
REM 删除残留注册项
reg delete "%_regkey1%" /f
for %%i in ("%_regkey2%" "%_regkey3%" "%_regkey4%" "%_regkey5%") do reg delete %%i /f
Rem 单独处理 HKCR\*\Shell\WindowsSecurity(for循环直接导入通配符*会失败)
Reg.exe add "%_regkey1%" /v "Icon" /t REG_SZ /d "%%ProgramFiles%%\Windows Defender\EppManifest.dll,-101" /f
Reg.exe add "%_regkey1%" /v "MUIVerb" /t REG_SZ /d "Windows 安全中心" /f
Reg.exe add "%_regkey1%" /v "Position" /t REG_SZ /d "Bottom" /f
Reg.exe add "%_regkey1%" /v "SubCommands" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%" /v "SeparatorBefore" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%" /v "SeparatorAfter" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\001flyout" /v "Icon" /t REG_SZ /d "%%ProgramFiles%%\Windows Defender\EppManifest.dll,-101" /f
Reg.exe add "%_regkey1%\shell\001flyout" /v "MUIVerb" /t REG_SZ /d "&安全中心主页" /f
Reg.exe add "%_regkey1%\shell\001flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\001flyout" /v "SeparatorBefore" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\001flyout" /v "SeparatorAfter" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\001flyout" /v "CommandFlags" /t REG_DWORD /d "64" /f
Reg.exe add "%_regkey1%\shell\001flyout\command" /ve /t REG_SZ /d "explorer windowsdefender:" /f
Reg.exe add "%_regkey1%\shell\002flyout" /v "MUIVerb" /t REG_SZ /d "&病毒和威胁防护" /f
Reg.exe add "%_regkey1%\shell\002flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\002flyout" /v "Position" /t REG_SZ /d "Bottom" /f
Reg.exe add "%_regkey1%\shell\002flyout" /v "SubCommands" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell" /v "SubCommands" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\001" /v "MUIVerb" /t REG_SZ /d "病毒和威胁防护设置主页" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\001" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\001" /v "SeparatorBefore" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\001" /v "SeparatorAfter" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\001" /v "CommandFlags" /t REG_DWORD /d "64" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\001\command" /ve /t REG_SZ /d "explorer windowsdefender://threat" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\002" /v "MUIVerb" /t REG_SZ /d "启用实时防护和防篡改" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\002" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\002\command" /ve /t REG_SZ /d "%_cmd_scripts_enable%" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\003" /v "MUIVerb" /t REG_SZ /d "禁用实时防护和防篡改" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\003" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\003\command" /ve /t REG_SZ /d "%_cmd_scripts_disabled%" /f
Reg.exe add "%_regkey1%\shell\003flyout" /v "MUIVerb" /t REG_SZ /d "&账户保护" /f
Reg.exe add "%_regkey1%\shell\003flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\003flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://account" /f
Reg.exe add "%_regkey1%\shell\004flyout" /v "MUIVerb" /t REG_SZ /d "&防火墙和网络保护" /f
Reg.exe add "%_regkey1%\shell\004flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\004flyout" /v "Position" /t REG_SZ /d "Bottom" /f
Reg.exe add "%_regkey1%\shell\004flyout" /v "SubCommands" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell" /v "SubCommands" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\001" /v "MUIVerb" /t REG_SZ /d "防火墙和网络保护设置主页" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\001" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\001" /v "SeparatorBefore" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\001" /v "SeparatorAfter" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\001" /v "CommandFlags" /t REG_DWORD /d "64" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\001\command" /ve /t REG_SZ /d "explorer windowsdefender://network" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\002" /v "MUIVerb" /t REG_SZ /d "启用 Windows 防火墙" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\002" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\002\command" /ve /t REG_SZ /d "powershell.exe -windowstyle hidden -command "Start-Process cmd -ArgumentList '/s,/c,netsh advfirewall set allprofiles state on' -Verb runAs"" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\003" /v "MUIVerb" /t REG_SZ /d "禁用 Windows 防火墙" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\003" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\003\command" /ve /t REG_SZ /d "powershell.exe -windowstyle hidden -command "Start-Process cmd -ArgumentList '/s,/c,netsh advfirewall set allprofiles state off' -Verb runAs"" /f
Reg.exe add "%_regkey1%\shell\005flyout" /v "MUIVerb" /t REG_SZ /d "应用和浏览器控制" /f
Reg.exe add "%_regkey1%\shell\005flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\005flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://appbrowser" /f
Reg.exe add "%_regkey1%\shell\006flyout" /v "MUIVerb" /t REG_SZ /d "&设备安全性" /f
Reg.exe add "%_regkey1%\shell\006flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\006flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://devicesecurity" /f
Reg.exe add "%_regkey1%\shell\007flyout" /v "MUIVerb" /t REG_SZ /d "&设备性能和运行状况" /f
Reg.exe add "%_regkey1%\shell\007flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\007flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://perfhealth" /f
Reg.exe add "%_regkey1%\shell\008flyout" /v "MUIVerb" /t REG_SZ /d "&家庭选项" /f
Reg.exe add "%_regkey1%\shell\008flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\008flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://family" /f
Reg.exe add "%_regkey1%\shell\009flyout" /v "MUIVerb" /t REG_SZ /d "&保护历史记录" /f
Reg.exe add "%_regkey1%\shell\009flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\009flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://history" /f
Reg.exe add "%_regkey1%\shell\010flyout" /v "MUIVerb" /t REG_SZ /d "&安全提供程序" /f
Reg.exe add "%_regkey1%\shell\010flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\010flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://providers" /f
Reg.exe add "%_regkey1%\shell\011flyout" /v "MUIVerb" /t REG_SZ /d "&通知" /f
Reg.exe add "%_regkey1%\shell\011flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\011flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://settings" /f
Rem Windows安全中心菜单总项
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add %%k /v "Icon" /t REG_SZ /d "%ProgramFiles%\Windows Defender\EppManifest.dll,-101" /f
Reg.exe add %%k /v "MUIVerb" /t REG_SZ /d "Windows 安全中心" /f
Reg.exe add %%k /v "Position" /t REG_SZ /d "Bottom" /f
Reg.exe add %%k /v "SeparatorAfter" /t REG_SZ /d "" /f
Reg.exe add %%k /v "SeparatorBefore" /t REG_SZ /d "" /f
Reg.exe add %%k /v "SubCommands" /t REG_SZ /d "" /f
)
Rem 二级菜单安全中心主页
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\001flyout" /v "Icon" /t REG_SZ /d "%ProgramFiles%\Windows Defender\EppManifest.dll,-101" /f
Reg.exe add "%%k\shell\001flyout" /v "MUIVerb" /t REG_SZ /d "&安全中心主页" /f
Reg.exe add "%%k\shell\001flyout" /v "SeparatorAfter" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\001flyout" /v "SeparatorBefore" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\001flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\001flyout" /v "CommandFlags" /t REG_DWORD /d "64" /f
Reg.exe add "%%k\shell\001flyout\command" /ve /t REG_SZ /d "explorer windowsdefender:" /f
)
Rem 二级菜单病毒和威胁防护
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\002flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\002flyout" /v "MUIVerb" /t REG_SZ /d "&病毒和威胁防护" /f
Reg.exe add "%%k\shell\002flyout" /v "Position" /t REG_SZ /d "Bottom" /f
Reg.exe add "%%k\shell\002flyout" /v "SubCommands" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\002flyout\shell" /v "SubCommands" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\002flyout\shell\001" /v "MUIVerb" /t REG_SZ /d "病毒和威胁防护设置主页" /f
Reg.exe add "%%k\shell\002flyout\shell\001" /v "SeparatorAfter" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\002flyout\shell\001" /v "SeparatorBefore" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\002flyout\shell\001" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\002flyout\shell\001" /v "CommandFlags" /t REG_DWORD /d "64" /f
Reg.exe add "%%k\shell\002flyout\shell\001\command" /ve /t REG_SZ /d "explorer windowsdefender://threat" /f
Reg.exe add "%%k\shell\002flyout\shell\002" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\002flyout\shell\002" /v "MUIVerb" /t REG_SZ /d "启用实时防护和防篡改" /f
Reg.exe add "%%k\shell\002flyout\shell\002\command" /ve /t REG_SZ /d "%_cmd_scripts_enable%" /f
Reg.exe add "%%k\shell\002flyout\shell\003" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\002flyout\shell\003" /v "MUIVerb" /t REG_SZ /d "禁用实时防护和防篡改" /f
Reg.exe add "%%k\shell\002flyout\shell\003\command" /ve /t REG_SZ /d "%_cmd_scripts_disabled%" /f
)
Rem 二级菜单账户保护
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\003flyout" /v "MUIVerb" /t REG_SZ /d "&账户保护" /f
Reg.exe add "%%k\shell\003flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\003flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://account" /f
)
Rem 二级菜单防火墙和网络保护
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\004flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\004flyout" /v "MUIVerb" /t REG_SZ /d "&防火墙和网络保护" /f
Reg.exe add "%%k\shell\004flyout" /v "Position" /t REG_SZ /d "Bottom" /f
Reg.exe add "%%k\shell\004flyout" /v "SubCommands" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\004flyout\shell" /v "SubCommands" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\004flyout\shell\001" /v "MUIVerb" /t REG_SZ /d "防火墙和网络保护设置主页" /f
Reg.exe add "%%k\shell\004flyout\shell\001" /v "SeparatorAfter" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\004flyout\shell\001" /v "SeparatorBefore" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\004flyout\shell\001" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\004flyout\shell\001" /v "CommandFlags" /t REG_DWORD /d "64" /f
Reg.exe add "%%k\shell\004flyout\shell\001\command" /ve /t REG_SZ /d "explorer windowsdefender://network" /f
Reg.exe add "%%k\shell\004flyout\shell\002" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\004flyout\shell\002" /v "MUIVerb" /t REG_SZ /d "启用 Windows 防火墙" /f
Reg.exe add "%%k\shell\004flyout\shell\002\command" /ve /t REG_SZ /d "powershell.exe -windowstyle hidden -command "Start-Process cmd -ArgumentList '/s,/c,netsh advfirewall set allprofiles state on' -Verb runAs"" /f
Reg.exe add "%%k\shell\004flyout\shell\003" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\004flyout\shell\003" /v "MUIVerb" /t REG_SZ /d "禁用 Windows 防火墙" /f
Reg.exe add "%%k\shell\004flyout\shell\003\command" /ve /t REG_SZ /d "powershell.exe -windowstyle hidden -command "Start-Process cmd -ArgumentList '/s,/c,netsh advfirewall set allprofiles state off' -Verb runAs"" /f
)
Rem 二级菜单应用和浏览器控制
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\005flyout" /v "MUIVerb" /t REG_SZ /d "&应用和浏览器控制" /f
Reg.exe add "%%k\shell\005flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\005flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://appbrowser" /f
)
Rem 二级菜单设备安全性
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\006flyout" /v "MUIVerb" /t REG_SZ /d "&设备安全性" /f
Reg.exe add "%%k\shell\006flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\006flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://devicesecurity" /f
)
Rem 二级菜单设备性能和运行状况
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\007flyout" /v "MUIVerb" /t REG_SZ /d "&设备性能和运行状况" /f
Reg.exe add "%%k\shell\007flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\007flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://perfhealth" /f
)
Rem 二级菜单家庭选项
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\008flyout" /v "MUIVerb" /t REG_SZ /d "&家庭选项" /f
Reg.exe add "%%k\shell\008flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\008flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://family" /f
)
Rem 二级菜单保护历史记录
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\009flyout" /v "MUIVerb" /t REG_SZ /d "&保护历史记录" /f
Reg.exe add "%%k\shell\009flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\009flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://history" /f
)
Rem 二级菜单安全提供程序
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\010flyout" /v "MUIVerb" /t REG_SZ /d "&安全提供程序" /f
Reg.exe add "%%k\shell\010flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\010flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://providers" /f
)
Rem 二级菜单通知
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\011flyout" /v "MUIVerb" /t REG_SZ /d "&通知" /f
Reg.exe add "%%k\shell\011flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\011flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://settings" /f
)
REM 添加排除WinDefCtl件夹限制访问及白名单
powershell -ExecutionPolicy Bypass -NoProfile -Command "Add-MpPreference -ExclusionProcess '%~dp0WinDefCtl.exe'"
powershell -ExecutionPolicy Bypass -NoProfile -Command "Add-MpPreference -ControlledFolderAccessAllowedApplications '%ComSpec%'"
powershell -ExecutionPolicy Bypass -NoProfile -Command "Add-MpPreference -ControlledFolderAccessAllowedApplications 'C:\Windows\System32\cmd.exe'"
powershell -ExecutionPolicy Bypass -NoProfile -Command "Add-MpPreference -ControlledFolderAccessAllowedApplications '%~dp0WinDefCtl.exe'"
exit
:uninstall
REM 删除残留注册项
reg delete "%_regkey1%" /f
for %%i in ("%_regkey2%" "%_regkey3%" "%_regkey4%" "%_regkey5%") do reg delete %%i /f
REM 移除排除WinDefCtl文件夹限制访问及白名单
powershell -ExecutionPolicy Bypass -NoProfile -Command "Remove-MpPreference -ExclusionProcess '%~dp0WinDefCtl.exe'"
powershell -ExecutionPolicy Bypass -NoProfile -Command "Remove-MpPreference -ControlledFolderAccessAllowedApplications '%ComSpec%'"
powershell -ExecutionPolicy Bypass -NoProfile -Command "Remove-MpPreference -ControlledFolderAccessAllowedApplications 'C:\Windows\System32\cmd.exe'"
powershell -ExecutionPolicy Bypass -NoProfile -Command "Remove-MpPreference -ControlledFolderAccessAllowedApplications '%~dp0WinDefCtl.exe'"
exit
:OUT
exit

复制代码