title: Configuration
privilege: TrustedInstaller
actions:
  - !writeStatus: {status: 'Cleaning user interface'}
  - !service:
    name: "WpnService"
    operation: stop
    ignoreErrors: true
  - !service:
    name: "WpnUserService*"
    operation: stop
    ignoreErrors: true
  - !run:
    exeDir: true
    exe: "CLEANUP.bat"
    weight: 30

  - !run: {exe: "NSudoLC.exe", args: '-U:C explorer.exe', baseDir: true}

  - !writeStatus: {status: 'Configuring permissions', option: "security-enhanced"}
  - !registryValue: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System', value: 'ConsentPromptBehaviorAdmin', type: REG_DWORD, data: '5', option: "security-enhanced"}
  - !registryValue: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System', value: 'ConsentPromptBehaviorUser', type: REG_DWORD, data: '3', option: "security-enhanced"}
  - !registryValue: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System', value: 'EnableInstallerDetection', type: REG_DWORD, data: '1', option: "security-enhanced"}
  - !registryValue: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System', value: 'EnableLUA', type: REG_DWORD, data: '1', option: "security-enhanced"}
  - !registryValue: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System', value: 'EnableVirtualization', type: REG_DWORD, data: '1', option: "security-enhanced"}
  - !registryValue: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System', value: 'PromptOnSecureDesktop', type: REG_DWORD, data: '1', option: "security-enhanced"}
  - !registryValue: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System', value: 'ValidateAdminCodeSignatures', type: REG_DWORD, data: '0', option: "security-enhanced"}
  - !registryValue: {path: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System', value: 'FilterAdministratorToken', type: REG_DWORD, data: '0', option: "security-enhanced"}

  - !run:
    exeDir: true
    exe: "ADMIN.bat"
    weight: 10
    option: "security-enhanced"

  - !writeStatus: {status: 'Implementing SFC mitigation', option: "ame-tools"}
  - !run:
    exeDir: true
    exe: "SFCDEPLOY.bat"
    weight: 5
    option: "ame-tools"

  - !writeStatus: {status: 'Modifying login screen', option: "ui"}
  - !run:
    exeDir: true
    exe: "LOGIN.bat"
    option: "ui"