Installer updates (#306)

* Update 3.1

---------

Co-authored-by: Alex | NoSecurity <[email protected]>

Docs/Changelog.md

@@ -1,4 +1,18 @@
 # Changelog
+## 2023.3 - September 4 2023
+- Update to coincide with installer rearchitecture detailed in [this PR](https://github.com/mandiant/VM-Packages/pull/656)
+  - Changes include modularity of debloat and config functions which will aid in our support for Win11 and Win11ARM
+- Removed all debloater functions and moved into [common.vm](https://github.com/mandiant/VM-Packages/tree/main/packages/common.vm)
+- Added logic to detect OS and profile settings and move appropriate config file to expected location
+- renamed "config.xml" in install script to "packages.xml" to avoid confusion with new install features
+- Added "config.xml" as the OS customizations
+- Moved `Images\Docs\*` to `Docs\img\*`
+- Removed blue text output as Win10 default powershell has blue background and is very hard to read
+- Changed console prompt from red font to green
+- Disabled automatic malware sample sending in Victim profile
+- Created new low-priv user for Victim profile
+- Enabled Light Mode for Victim machine for easy visibility
+- Added blue logo for Victim machine for easy visibility
 
 ## 3.0 - August 9 2023
 - Completely rebuilt everything

Docs/Troubleshooting.md

@@ -34,7 +34,7 @@ Windows itself takes up significant space on disk and CommandoVM installs a larg
 
 CommandoVM uses Chocolatey and Boxstarter to install its packages. Installing packages requires Administrator rights, so you must run your terminal as Administrator as shown on the image below.
 
-![run terminal as administrator](../Images/Docs/runasadmin.png)
+![run terminal as administrator](img/runasadmin.png)
 
 ### PowerShell Execution Policy
 
@@ -72,15 +72,15 @@ The pre-install checks menu will open. Make sure you go through the [Pre-Install
 
 > **WARNING:** Do not override the checks if you have no idea why they are failing
 
-![gui step 1 - pre-checks](../Images/Docs/gui_step1.png)
+![gui step 1 - pre-checks](img/gui_step1.png)
 
 Once you pass all the pre-install checks, the main installer window will open. If you wish to customize your install and change what packages are installed, see the [Customization](Customization.md) documentation page. Otherwise, select a profile from the dropdown menu and click "Install".
 
-![gui step 2 - installer](../Images/Docs/gui_step2.png)
+![gui step 2 - installer](img/gui_step2.png)
 
 You will get a password prompt for Boxstarter. If you do not have a password set or your password is blank, click "OK" without entering anything. Otherwise, enter your password into the textbox and click "OK".
 
-![gui step 3 - password](../Images/Docs/gui_step3.png)
+![gui step 3 - password](img/gui_step3.png)
 
 The installer GUI will now close and the installation will start. You may monitor its progress inside the terminal window you used to launch the install script. During this time your system will restart multiple times. You will know that installation is finished when your background image gets changed to the Commando logo. 
 

Modules/configureVM.psm1

@@ -1,357 +0,0 @@
-# COMMANDO-VM CONFIG
-$global:helpersExecuted = $false
-
-function Commando-Remove-App {
-# Function for removing Apps
-    param(
-        [Parameter(Mandatory=$true)]
-        [ValidateNotNullOrEmpty()]
-        [string]$appName
-    )
-
-    try {
-        # Check if the app is installed
-        $installedPackage = Get-AppxPackage -Name $appName -ErrorAction SilentlyContinue
-        
-        if ($installedPackage) {
-            $packageFullName = $installedPackage.PackageFullName
-            $result = Remove-AppxPackage -Package $packageFullName -ErrorAction Stop
-
-            if ($null -eq $result) {
-                Write-Output "[+] Installed $appName has been successfully removed."
-            } else {
-                Write-Output "[+] Failed to remove installed app $appName."
-            }
-        }
-        else {
-            Write-Output "[+] Installed $appName not found on the system."
-        }
-        # Check if the app is provisioned
-        $provisionedPackage = Get-AppxProvisionedPackage -Online | Where-Object { $_.DisplayName -eq $appName } -ErrorAction SilentlyContinue
-        if ($provisionedPackage) {
-            $result = Remove-AppxProvisionedPackage -PackageName $provisionedPackage.PackageName -Online  
-
-            if ($result) {
-                Write-Output "[+] Provisioned $appName has been successfully removed."
-            } else {
-                Write-Output "[+] Failed to remove porvisioned app $appName."
-            }
-        } else {
-            Write-Output "[+] Provisioned $appName not found on the system."
-        }
-    } 
-    catch {
-        Write-Error "An error occurred while removing the app or provisioned package. Error: $_"
-    }
-}
-
-
-function Commando-Remove-Service {
-# Function for removing Services
-    param(
-        [Parameter(Mandatory=$true)]
-        [ValidateNotNullOrEmpty()]
-        [string]$serviceName
-    )
-
-    try {
-        $service = Get-Service -Name $serviceName -ErrorAction Stop
-
-        if ($service) {
-            $service | Set-Service -StartupType Manual -ErrorAction Stop
-            Write-Output "[+] Service $serviceName has been disabled."
-        } else {
-            Write-Output "[+] Service $serviceName not found."
-        }
-    }
-    catch {
-        Write-Error "An error occurred while setting the service startup type. Error: $_"
-    }
-}
-
-function Commando-Delete-Task {
-# Function for disabling scheduled tasks
-    param(
-        [Parameter(Mandatory=$true)]
-        [ValidateNotNullOrEmpty()]
-        [string]$name,
-
-        [Parameter(Mandatory=$true)]
-        [ValidateNotNullOrEmpty()]
-        [string]$value
-    )
-
-    try {
-        $output = Disable-ScheduledTask -TaskName $value -ErrorAction SilentlyContinue
-        if ($output){
-            Write-Output "[+] Scheduled task '$name' has been disabled."
-        }
-        else{
-            Write-Output "[+] Scheduled task '$name' not found."
-        }
-    
-    }
-    catch {
-        Write-Error "An error occurred while disabling the scheduled task. Error: $_"
-    }
-}
-
-function Commando-Remove-RegistryValue {
-# Function for setting Registry items
-    param(
-        [Parameter(Mandatory=$true)]
-        [ValidateNotNullOrEmpty()]
-        [string] $name,
-
-        [Parameter(Mandatory=$true)]
-        [ValidateNotNullOrEmpty()]
-        [string] $path,
-
-        [Parameter(Mandatory=$true)]
-        [ValidateNotNullOrEmpty()]
-        [string] $value,
-
-        [Parameter(Mandatory=$true)]
-        [ValidateSet("String", "ExpandString", "Binary", "DWord", "QWord", "MultiString", "Unknown")]
-        [string] $type,
-
-        [Parameter(Mandatory=$true)]
-        [ValidateNotNullOrEmpty()]
-        [string] $data
-    )
-
-    try {
-        # Validate the value based on the type parameter
-        if ($type -eq "DWord" -or $type -eq "QWord") {
-            $validatedData = [int64]::Parse($data)
-        }
-        elseif ($type -eq "Binary") {
-            $validatedData = [byte[]]::new(($data -split '(.{2})' | Where-Object { $_ -match '..' } | ForEach-Object { [convert]::ToByte($_, 16) }))
-
-        }
-        else {
-            $validatedData = $data
-        }
-
-        # check if path exists. If not, create the path for the registry value
-        if (!(Test-Path -Path $path)) {
-            # Create the registry key
-            New-Item -Path $path -Force | Out-Null
-            Write-Output "`t[+] Registry key created: $path"
-        }
-        else {
-            Write-Output "`t[+] Registry key already exists: $path"
-        }
-
-        Set-ItemProperty -Path $path -Name $value -Value $validatedData -Type $type -Force | Out-Null
-        Write-Output "[+] $name has been successful"
-    }
-    catch {
-        Write-Error "Failed to update the registry value. Error: $_"
-    }
-}
-
-function Commando-Remove-Path {
-# Function for removing Paths/Programs
-    param(
-        [Parameter(Mandatory=$true)]
-        [ValidateNotNullOrEmpty()]
-        [string]$name,
-
-        [Parameter(Mandatory=$true)]
-        [ValidateSet("file", "dir")]
-        [string]$type,
-
-        [Parameter(Mandatory=$true)]
-        [ValidateNotNullOrEmpty()]
-        [string]$path
-    )
-
-    try {
-        if ($type -eq "file") {
-            if (Test-Path -Path $path -PathType Leaf) {
-                Remove-Item -Path $path -Force
-                Write-Output "[+] $name has been successfully removed."
-            } else {
-                Write-Output "[+] $path does not exist."
-            }
-        }
-        elseif ($type -eq "dir") {
-            if (Test-Path -Path $path -PathType Container) {
-                Remove-Item -Path $path -Recurse -Force
-                Write-Output "[+] $name has been successfully removed."
-            } else {
-                Write-Output "[+] $path does not exist."
-            }
-        }
-    }
-    catch {
-        Write-Error "An error occurred while removing the $type $path. Error: $_"
-    }
-}
-
-
-function Commando-Remove-Custom{
-# Function for removing items in need of custom code.
-    param(
-        [Parameter(Mandatory=$true)]
-        [ValidateNotNullOrEmpty()]
-        [string]$name,
-
-        [Parameter(Mandatory=$true)]
-        [ValidateNotNullOrEmpty()]
-        [string[]]$cmds
-    )
-
-    try {
-        Write-Output "[+] Executing commands for '$name':"
-        foreach ($cmd in $cmds) {
-            Write-Output "`t[+] Executing command: $cmd"
-            start-process powershell -ArgumentList "-WindowStyle","Hidden","-Command",$cmd -Wait
-            Write-Host "`t[+] Process completed. Moving to next."
-        }
-        Write-Output "[+] All commands for '$name' have been executed successfully."
-    }
-    catch {
-        Write-Error "An error occurred while executing commands for '$name'. Error: $_"
-    }
-}
-
-function Commando-Prompt {
-    $psprompt = @"
-        function prompt {
-            Write-Host ("COMMANDO " + `$(Get-Date)) -ForegroundColor Red
-            Write-Host ("PS " + `$(Get-Location) + " >") -NoNewLine -ForegroundColor White
-            return " "
-        }
-"@
-
-    # Ensure profile file exists and append new content to it, not overwriting old content
-    if (!(Test-Path $profile)) {
-        New-Item -ItemType File -Path $profile -Force | Out-Null
-    }
-    Add-Content -Path $profile -Value $psprompt
-
-    # Add timestamp to cmd prompt
-    Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("Y21kIC9jICdzZXR4IFBST01QVCBDT01NQU5ETyRTJGQkcyR0JF8kcCQrJGcn"))) | Out-Null
-
-    Write-Host "[+] Timestamps added to cmd prompt and PowerShell" -ForegroundColor Green
-}
-
-function Commando-Logging {
-    if ($PSVersionTable -And $PSVersionTable.PSVersion.Major -ge 5) {
-        Write-Host "[+] Enabling PowerShell Script Block Logging" -ForegroundColor Green
-
-        $psLoggingPath = 'HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell'
-        if (-Not (Test-Path $psLoggingPath)) {
-            New-Item -Path $psLoggingPath -Force | Out-Null
-        }
-
-        $psLoggingPath = 'HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\Transcription'
-        if (-Not (Test-Path $psLoggingPath)) {
-            New-Item -Path $psLoggingPath -Force | Out-Null
-        }
-        New-ItemProperty -Path $psLoggingPath -Name "EnableInvocationHeader" -Value 1 -PropertyType DWORD -Force | Out-Null
-        New-ItemProperty -Path $psLoggingPath -Name "EnableTranscripting" -Value 1 -PropertyType DWORD -Force | Out-Null
-        New-ItemProperty -Path $psLoggingPath -Name "OutputDirectory" -Value (Join-Path ${Env:UserProfile} "Desktop\PS_Transcripts") -PropertyType String -Force | Out-Null
-
-        $psLoggingPath = 'HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
-        if (-Not (Test-Path $psLoggingPath)) {
-            New-Item -Path $psLoggingPath -Force | Out-Null
-        }
-        New-ItemProperty -Path $psLoggingPath -Name "EnableScriptBlockLogging" -Value 1 -PropertyType DWORD -Force | Out-Null
-        Write-Host "`t[i] PowerShell transcripts will be saved to the desktop." -ForegroundColor Green
-    }
-}
-
-# WORKER MAIN
-function Commando-Configure {
-    param(
-        [Parameter(Position = 0)]
-        [string]$configFile = (Join-Path -Path $PSScriptRoot -ChildPath "debloatConfig.xml")
-    )
-
-    try {
-        # Load and parse the XML config file
-        $config = [xml](Get-Content $configFile)
-
-        # Process the apps
-        if ($config.config.apps.app) {
-            $config.config.apps.app | ForEach-Object {
-                $appName = $_.name
-                Commando-Remove-App -appName $appName
-            }
-        }
-
-
-        # Process the services
-        if ($config.config.services.service) {
-            $config.config.services.service | ForEach-Object {
-                $serviceName = $_.name
-                Commando-Remove-Service -serviceName $serviceName
-            }
-        }
-
-        # Process the services
-        if ($config.config.tasks.task) {
-            $config.config.tasks.task | ForEach-Object {
-                $descName = $_.name
-                $taskName = $_.value
-                Commando-Delete-Task -name $descName -value $taskName
-            }
-        }
-
-        # Process the registry items
-        if ($config.config."registry-items"."registry-item") {
-            $config.config."registry-items"."registry-item" | ForEach-Object {
-                $name = $_.name
-                $path = $_.path
-                $value = $_.value
-                $type = $_.type
-                $data = $_.data
-                Commando-Remove-RegistryValue -name $name -path $path -value $value -type $type -data $data
-            }
-        }
-
-        # Process the path items
-        if ($config.config."path-items"."path-item") {
-            $config.config."path-items"."path-item" | ForEach-Object {
-                $name = $_.name
-                $type = $_.type
-                $path = $_.path
-                Commando-Remove-Path -name $name -type $type -path $path
-            }
-        }
-
-        # Process the custom items
-        if ($config.config."custom-items"."custom-item") {
-            $config.config."custom-items"."custom-item" | ForEach-Object {
-                $name = $_.name
-                $cmds = @($_.cmd | ForEach-Object { $_.value })
-                Commando-Remove-Custom -name $name -cmds $cmds
-            }
-        }
-
-        if (!$global:helpersExecuted) {
-            # TODO Needs to not run twice -- maybe global variable (?) but thats ugly
-            # Unpinning all Start Tiles
-            Write-Output "[+] Unpinning all Start Menu Tiles."
-            $key = Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\*start.tilegrid`$windows.data.curatedtilecollection.tilecollection\Current"
-            $data = $key.Data[0..25] + ([byte[]](202,50,0,226,44,1,1,0,0))
-            Set-ItemProperty -Path $key.PSPath -Name "Data" -Type Binary -Value $data
-            Stop-Process -Name "ShellExperienceHost" -Force -ErrorAction SilentlyContinue
-
-            Commando-Prompt
-            Commando-Logging
-
-            # Set the flag to indicate the operation has been executed
-            $global:helpersExecuted = $true
-        }
-    }
-    catch {
-        Write-Error "An error occurred while applying config. Error: $_"
-    }
-}
-
-# Export Function
-Export-ModuleMember -Function Commando-Configure

Modules/debloatConfig.xml

@@ -1,154 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<config> 
-    <apps>
-        <!--
-        FORMAT: 
-        <app name="APP_NAME"/>
-        -->
-        <app name="Microsoft.549981C3F5F10"/>
-        <app name="Microsoft.BingWeather"/>
-        <app name="Microsoft.GetHelp"/>
-        <app name="Microsoft.Getstarted"/>
-        <app name="Microsoft.Microsoft3DViewer"/>
-        <app name="Microsoft.MicrosoftOfficeHub"/>
-        <app name="Microsoft.MicrosoftSolitaireCollection"/>
-        <app name="Microsoft.MicrosoftStickyNotes"/>
-        <app name="Microsoft.MixedReality.Portal"/>
-        <app name="Microsoft.MSPaint"/>
-        <app name="Microsoft.Office.OneNote"/>
-        <app name="Microsoft.People"/>
-        <app name="Microsoft.ScreenSketch"/>
-        <app name="Microsoft.SkypeApp"/>
-        <app name="Microsoft.Wallet"/>
-        <app name="Microsoft.Windows.Photos"/>
-        <app name="Microsoft.WindowsAlarms"/>
-        <app name="Microsoft.WindowsCalculator"/>
-        <app name="Microsoft.WindowsCamera"/>
-        <app name="microsoft.windowscommunicationsapps"/>
-        <app name="Microsoft.WindowsFeedbackHub"/>
-        <app name="Microsoft.WindowsMaps"/>
-        <app name="Microsoft.WindowsSoundRecorder"/>
-        <app name="Microsoft.Xbox.TCUI"/>
-        <app name="Microsoft.XboxApp"/>
-        <app name="Microsoft.XboxGameOverlay"/>
-        <app name="Microsoft.XboxGamingOverlay"/>
-        <app name="Microsoft.XboxIdentityProvider"/>
-        <app name="Microsoft.XboxSpeechToTextOverlay"/>
-        <app name="Microsoft.YourPhone"/>
-        <app name="Microsoft.ZuneMusic"/>
-        <app name="Microsoft.ZuneVideo"/>
-        <app name="SpotifyAB.SpotifyMusic"/>
-        <app name="Disney.37853FC22B2CE"/>
-    </apps>
-    <services>
-        <!--
-        FORMAT: 
-        <service name="SERVICE_NAME"/>
-        -->
-        <service name="XboxGipSvc"/>
-        <service name="XblAuthManager"/>
-        <service name="XblGameSave"/>
-        <service name="XboxNetApiSvc"/>
-        <service name="WMPNetworkSvc"/>
-        <service name="WerSvc"/>
-        <service name="SysMain"/>
-        <service name="RetailDemo"/>
-        <service name="Fax"/>
-        <service name="WdiSystemHost"/>
-        <service name="WdiServiceHost"/>
-        <service name="DPS"/>
-        <service name="BITS"/>
-        <service name="WpcMonSvc"/>
-        <service name="wmiApSrv"/>
-        <service name="WbioSrvc"/>
-        <service name="WalletService"/>
-        <service name="TabletInputService"/>
-        <service name="MapsBroker"/>
-        <service name="lfsvc"/>
-    </services>
-    <tasks>
-        <!--
-        FORMAT: 
-        <task name="DESCRIPTIVE_NAME" value="TASK_NAME"/> 
-        -->
-        <task name="Microsoft Compatibility Appraiser" value="Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser"/>
-        <task name="ProgramDataUpdater" value="Microsoft\Windows\Application Experience\ProgramDataUpdater"/>
-        <task name="Proxy" value="Microsoft\Windows\Autochk\Proxy"/>
-        <task name="Consolidator" value="Microsoft\Windows\Customer Experience Improvement Program\Consolidator"/>
-        <task name="UsbCeip" value="Microsoft\Windows\Customer Experience Improvement Program\UsbCeip"/>
-        <task name="Microsoft-Windows-DiskDiagnosticDataCollector" value="Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector"/>
-    </tasks>
-    <registry-items>
-        <!--
-        FORMAT: 
-        <registry-item name="DESCRIPTIVE_NAME" path="REG_PATH" value="REG_VALUE" type="TYPE" data="NEW_DATA"/> 
-        -->
-        <registry-item name="DisableBingSearch" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" value="BingSearchEnabled" type="DWord" data="0"/>
-        <registry-item name="Disable Cortana Privacy Policy" path="HKCU:\Software\Microsoft\Personalization\Settings" value="AcceptedPrivacyPolicy" type="DWord" data="0" />
-        <registry-item name="Restrict Implicit Text Collection" path="HKCU:\Software\Microsoft\InputPersonalization" value="RestrictImplicitTextCollection" type="DWord" data="1" />
-        <registry-item name="Restrict Implicit Ink Collection" path="HKCU:\Software\Microsoft\InputPersonalization" value="RestrictImplicitInkCollection" type="DWord" data="1" />
-        <registry-item name="Disable Cortana Contact Harvesting" path="HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore" value="HarvestContacts" type="DWord" data="0" />
-        <registry-item name="Hide Cortana Button" path="HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" value="ShowCortanaButton" type="DWord" data="0" />
-        <registry-item name="Disable Cortana through Policy Manager" path="HKLM:\SOFTWARE\Microsoft\PolicyManager\default\Experience\AllowCortana" value="Value" type="DWord" data="0" />
-        <registry-item name="Disable Cortana through Windows Search Policy" path="HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" value="AllowCortana" type="DWord" data="0" />
-        <registry-item name="Disable Input Personalization" path="HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization" value="AllowInputPersonalization" type="DWord" data="0" />
-        <registry-item name="Disable SmartScreen" path="HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" value="EnableSmartScreen" type="DWord" data="0" />
-        <registry-item name="Disable Microsoft Edge Phishing Filter" path="HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" value="EnabledV9" type="DWord" data="0" />
-        <registry-item name="Disable Tailored Experiences with Diagnostic Data" path="HKCU:\Software\Policies\Microsoft\Windows\CloudContent" value="DisableTailoredExperiencesWithDiagnosticData" type="DWord" data="1" />
-        <registry-item name="Disable Tailored Experiences with Diagnostic Data" path="HKCU:\Software\Policies\Microsoft\Windows\CloudContent" value="DisableTailoredExperiencesWithDiagnosticData" type="DWord" data="1" />
-        <registry-item name="Disable Windows Firewall (Standard Profile)" path="HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" value="EnableFirewall" type="DWord" data="0" />
-        <registry-item name="Disable UAC Consent Prompt for Administrators" path="HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" value="ConsentPromptBehaviorAdmin" type="DWord" data="0" />
-        <registry-item name="Disable UAC Prompt on Secure Desktop" path="HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" value="PromptOnSecureDesktop" type="DWord" data="0" />
-        <registry-item name="Disable OneDrive Files On-Demand" path="HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" value="DisableFileSyncNGSC" type="DWord" data="1" />
-        <registry-item name="Disable Advertising ID" path="HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo" value="DisabledByGroupPolicy" type="DWord" data="1" />
-        <registry-item name="Disable Telemetry" path="HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" value="AllowTelemetry" type="DWord" data="0" />
-        <registry-item name="Disable Telemetry Wow6432Node" path="HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\DataCollection" value="AllowTelemetry" type="DWord" data="0" />
-        <registry-item name="Disable Data Collection" path="HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" value="AllowTelemetry" type="DWord" data="0" />
-        <registry-item name="Disable PreviewBuilds" path="HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" value="AllowBuildPreview" type="DWord" data="0" />
-        <registry-item name="Enable NoGenTicket" path="HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" value="NoGenTicket" type="DWord" data="1" />
-        <registry-item name="Disable SQM" path="HKLM:\SOFTWARE\Policies\Microsoft\SQMClient\Windows" value="CEIPEnable" type="DWord" data="0" />
-        <registry-item name="Disable AppCompat AIT" path="HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat" value="AITEnable" type="DWord" data="0" />
-        <registry-item name="Disable AppCompat Inventory" path="HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat" value="DisableInventory" type="DWord" data="1" />
-        <registry-item name="Disable AppV CEIP" path="HKLM:\SOFTWARE\Policies\Microsoft\AppV\CEIP" value="CEIPEnable" type="DWord" data="0" />
-        <registry-item name="Disable PreventHandwritingDataSharing" path="HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC" value="PreventHandwritingDataSharing" type="DWord" data="1" />
-        <registry-item name="Disable AllowLinguisticDataCollection" path="HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\TextInput" value="AllowLinguisticDataCollection" type="DWord" data="0" />
-        <registry-item name="Disable Automatic Server Share" path="HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" value="AutoShareServer" type="DWord" data="0" />
-        <registry-item name="Disable Automatic Workstation Share" path="HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" value="AutoShareWks" type="DWord" data="0" />
-        <registry-item name="Hide Taskbar Search" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" value="SearchboxTaskbarMode" type="DWord" data="0" />
-        <registry-item name="Hide Task View" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" value="ShowTaskViewButton" type="DWord" data="0" />
-        <registry-item name="Remove MeetNow User" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" value="HideSCAMeetNow" type="DWord" data="1" />
-        <registry-item name="Remove MeetNow Machine" path="HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" value="HideSCAMeetNow" type="DWord" data="1" />
-        <registry-item name="Remove Bing Tab in Taksbar" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Feeds" value="ShellFeedsTaskbarViewMode" type="DWord" data="2" />
-        <registry-item name="Remove Bing Desktop Search Bar" path="HKLM:\SOFTWARE\Policies\Microsoft\Edge" value="WebWidgetAllowed" type="DWord" data="0" />
-        <registry-item name="Disable LLMNR" path="HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" value="EnableMulticast" type="DWord" data="0" />
-        <registry-item name="Disable Windows Update Automatic Download" path="HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" value="AUOptions" type="DWord" data="2" />
-        <registry-item name="Disable Windows Update Automatic Restart" path="HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MusNotification.exe" value="Debugger" type="String" data="cmd.exe" />
-        <registry-item name="Enable .NET Strong Crypto" path="HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" value="SchUseStrongCrypto" type="DWord" data="1" />
-        <registry-item name="Enable .NET Strong Crypto Wow6432Node" path="HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319" value="SchUseStrongCrypto" type="DWord" data="1" />
-        <registry-item name="Enable NTFS Long Paths" path="HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem" value="LongPathsEnabled" type="DWord" data="1" />
-    </registry-items>
-
-    <path-items>
-        <!--
-        FORMAT: 
-        <path-item name="DESCRIPTIVE_NAME" type="dir/file" path="DIR_PATH/FILE_PATH"/>
-        -->
-    </path-items>
-    <custom-items>
-        <!--FORMAT: 
-        <custom-item name="DESCRIPTIVE_NAME"> <cmd value="PS_COMMAND"/> ... </custom-item>
-        -->
-        <custom-item name="Remove OneDrive">
-            <cmd value="taskkill /f /im OneDrive.exe"/>
-            <cmd value="C:\Windows\SysWOW64\OneDriveSetup.exe /uninstall"/>
-        </custom-item>
-        <custom-item name="Unpin Taskbar Icons">
-            <cmd value='Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband" -Name "Favorites" -Type Binary -Value ([byte[]](255))'/>
-            <cmd value='Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband" -Name "FavoritesResolve" -ErrorAction SilentlyContinue'/>
-        </custom-item>
-        <custom-item name="Remove Desktop Links">
-            <cmd value="del $(Join-Path $env:USERPROFILE 'Desktop\*.lnk')" />
-            <cmd value="del $(Join-Path $env:PUBLIC 'Desktop\*.lnk')" />
-        </custom-item>
-    </custom-items>
-</config>

Profiles/Configs/win10config.xml

@@ -2,53 +2,71 @@
 <config> 
     <apps>
         <!--
+        INFO:
+        Removes installed AppX packages. Try:
+        $packages = Get-AppxPackage
+        $packages.Name
         FORMAT: 
         <app name="APP_NAME"/>
         -->
     </apps>
     <services>
         <!--
+        INFO:
+        Sets Services to "Manual" startup type. Try:
+        $services = Get-WmiObject -Query "SELECT * FROM Win32_Service WHERE StartMode='Auto'" | Get-Service
+        $services.Name
         FORMAT: 
         <service name="SERVICE_NAME"/>
         -->
     </services>
     <tasks>
         <!--
+        INFO:
+        Disables Scheduled Tasks. Try:
+        $tasks = Get-ScheduledTask
+        $tasks.TaskName
         FORMAT: 
         <task name="DESCRIPTIVE_NAME" value="TASK_NAME"/> 
         -->
     </tasks>
     <registry-items>
         <!--
+        INFO:
+        Makes custom edits to the registry
         FORMAT: 
         <registry-item name="DESCRIPTIVE_NAME" path="REG_PATH" value="REG_VALUE" type="TYPE" data="NEW_DATA"/> 
         -->
         <registry-item name="Set Dark Mode on System" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" value="SystemUsesLightTheme" type="DWord" data="0"/>
         <registry-item name="Set Dark Mode on Apps" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" value="AppsUseLightTheme" type="DWord" data="0"/>
-        <registry-item name="Enable Fast Startup" path="HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power" value="HiberbootEnabled" type="DWord" data="1"/>
-        <registry-item name="[1 of 9] Optimize visual effects for performance" path="HKCU:\Control Panel\Desktop" value="DragFullWindows" type="DWord" data="0"/>
-        <registry-item name="[2 of 9] Optimize visual effects for performance" path="HKCU:\Control Panel\Desktop" value="MenuShowDelay" type="DWord" data="0"/>
-        <registry-item name="[3 of 9] Optimize visual effects for performance" path="HKCU:\Control Panel\Desktop\WindowMetrics" value="MinAnimate" type="String" data="0"/>
-        <registry-item name="[4 of 9] Optimize visual effects for performance" path="HKCU:\Control Panel\Keyboard" value="KeyboardDelay" type="DWord" data="0"/>
-        <registry-item name="[5 of 9] Optimize visual effects for performance" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" value="ListviewAlphaSelect" type="DWord" data="0"/>
-        <registry-item name="[6 of 9] Optimize visual effects for performance" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" value="ListviewShadow" type="DWord" data="0"/>
-        <registry-item name="[7 of 9] Optimize visual effects for performance" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" value="TaskbarAnimations" type="DWord" data="0"/>
-        <registry-item name="[8 of 9] Optimize visual effects for performance" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects" value="VisualFXSetting" type="DWord" data="3"/>
-        <registry-item name="[9 of 9] Optimize visual effects for performance" path="HKCU:\Software\Microsoft\Windows\DWM" value="EnableAeroPeek" type="DWord" data="0"/>
         <registry-item name="Show full directory path in Explorer title bar" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState" value="FullPath" type="DWord" data="1"/>
         <registry-item name="Show known file extensions" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" value="HideFileExt" type="DWord" data="0"/>
         <registry-item name="Show hidden files" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" value="Hidden" type="DWord" data="1"/>
         <registry-item name="Show super hidden files" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" value="ShowSuperHidden" type="DWord" data="1"/>
-    </registry-items>
+        <registry-item name="Enable .NET Strong Crypto" path="HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" value="SchUseStrongCrypto" type="DWord" data="1" />
+        <registry-item name="Enable .NET Strong Crypto Wow6432Node" path="HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319" value="SchUseStrongCrypto" type="DWord" data="1" />
+        <registry-item name="Enable NTFS Long Paths" path="HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem" value="LongPathsEnabled" type="DWord" data="1" />
+        <registry-item name="Disable SmartScreen" path="HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" value="EnableSmartScreen" type="DWord" data="0" />
+        <registry-item name="Disable Microsoft Edge Phishing Filter" path="HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" value="EnabledV9" type="DWord" data="0" />
+        <registry-item name="Disable Windows Firewall (Standard Profile)" path="HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" value="EnableFirewall" type="DWord" data="0" />
+        <registry-item name="Disable UAC Consent Prompt for Administrators" path="HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" value="ConsentPromptBehaviorAdmin" type="DWord" data="0" />
+        <registry-item name="Disable UAC Prompt on Secure Desktop" path="HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" value="PromptOnSecureDesktop" type="DWord" data="0" />
+        <registry-item name="Disable LLMNR" path="HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" value="EnableMulticast" type="DWord" data="0" />
 
+    </registry-items>
     <path-items>
         <!--
+        INFO:
+        Removes files and folders from the system
         FORMAT: 
         <path-item name="DESCRIPTIVE_NAME" type="dir/file" path="DIR_PATH/FILE_PATH"/>
         -->
     </path-items>
     <custom-items>
-        <!--FORMAT: 
+        <!--
+        INFO:
+        Performs custom commands
+        FORMAT: 
         <custom-item name="DESCRIPTIVE_NAME"> <cmd value="PS_COMMAND"/> ... </custom-item>
         -->
         <custom-item name="Renaming Computer to 'commando'">
@@ -57,11 +75,5 @@
         <custom-item name="Disabling Windows Firewall">
             <cmd value="Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False" />
         </custom-item>
-        <custom-item name="Disabling display and sleep mode timeouts">
-            <cmd value="powercfg /X monitor-timeout-ac 0" />
-            <cmd value="powercfg /X monitor-timeout-dc 0" />
-            <cmd value="powercfg /X standby-timeout-ac 0" />
-            <cmd value="powercfg /X standby-timeout-dc 0" />
-        </custom-item>
     </custom-items>
 </config>

Profiles/Configs/win10victimconfig.xml

@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<config> 
+    <apps>
+        <!--
+        INFO:
+        Removes installed AppX packages. Try:
+        $packages = Get-AppxPackage
+        $packages.Name
+        FORMAT: 
+        <app name="APP_NAME"/>
+        -->
+    </apps>
+    <services>
+        <!--
+        INFO:
+        Sets Services to "Manual" startup type. Try:
+        $services = Get-WmiObject -Query "SELECT * FROM Win32_Service WHERE StartMode='Auto'" | Get-Service
+        $services.Name
+        FORMAT: 
+        <service name="SERVICE_NAME"/>
+        -->
+    </services>
+    <tasks>
+        <!--
+        INFO:
+        Disables Scheduled Tasks. Try:
+        $tasks = Get-ScheduledTask
+        $tasks.TaskName
+        FORMAT: 
+        <task name="DESCRIPTIVE_NAME" value="TASK_NAME"/> 
+        -->
+    </tasks>
+    <registry-items>
+        <!--
+        INFO:
+        Makes custom edits to the registry
+        FORMAT: 
+        <registry-item name="DESCRIPTIVE_NAME" path="REG_PATH" value="REG_VALUE" type="TYPE" data="NEW_DATA"/> 
+        -->
+        <registry-item name="Set Light Mode on System" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" value="SystemUsesLightTheme" type="DWord" data="1"/>
+        <registry-item name="Set Light Mode on Apps" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" value="AppsUseLightTheme" type="DWord" data="1"/>
+        <registry-item name="Show full directory path in Explorer title bar" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState" value="FullPath" type="DWord" data="1"/>
+        <registry-item name="Show known file extensions" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" value="HideFileExt" type="DWord" data="0"/>
+        <registry-item name="Show hidden files" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" value="Hidden" type="DWord" data="1"/>
+        <registry-item name="Show super hidden files" path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" value="ShowSuperHidden" type="DWord" data="1"/>
+    </registry-items>
+    <path-items>
+        <!--
+        INFO:
+        Removes files and folders from the system
+        FORMAT: 
+        <path-item name="DESCRIPTIVE_NAME" type="dir/file" path="DIR_PATH/FILE_PATH"/>
+        -->
+    </path-items>
+    <custom-items>
+        <!--
+        INFO:
+        Performs custom commands
+        FORMAT: 
+        <custom-item name="DESCRIPTIVE_NAME"> <cmd value="PS_COMMAND"/> ... </custom-item>
+        -->
+        <custom-item name="Renaming Computer to 'commando'">
+            <cmd value="Rename-Computer -NewName 'commando'" />
+        </custom-item>
+        <custom-item name="Create Exclusions folder">
+            <cmd value="Set-MpPreference -ExclusionPath $Env:RAW_TOOLS_DIR" />
+        </custom-item>
+        <custom-item name="Disable Defender Automatic Sample Submission">
+            <cmd value="Set-MpPreference -SubmitSamplesConsent 2" />
+        </custom-item>
+        <custom-item name="Create low-priv user account">
+            <cmd name="Generate random password, create user, save password to logfile" value="$userPassword = -join ((97..122) | Get-Random -Count 20 | ForEach-Object {[char]$_}); $securePassword = ConvertTo-SecureString -String $userPassword -AsPlainText -Force; New-LocalUser -Name 'prometheus' -Description 'Created by Commando Installer' -Password $securePassword; VM-Write-Log 'INFO' $('Created new user prometheus with password ' + $userPassword)" />
+        </custom-item>
+    </custom-items>
+</config>

Profiles/Configs/win11armconfig.xml

@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="utf-8"?>
+<config> 
+    <apps>
+        <!--
+        INFO:
+        Removes installed AppX packages. Try:
+        $packages = Get-AppxPackage
+        $packages.Name
+        FORMAT: 
+        <app name="APP_NAME"/>
+        -->
+    </apps>
+    <services>
+        <!--
+        INFO:
+        Sets Services to "Manual" startup type. Try:
+        $services = Get-WmiObject -Query "SELECT * FROM Win32_Service WHERE StartMode='Auto'" | Get-Service
+        $services.Name
+        FORMAT: 
+        <service name="SERVICE_NAME"/>
+        -->
+    </services>
+    <tasks>
+        <!--
+        INFO:
+        Disables Scheduled Tasks. Try:
+        $tasks = Get-ScheduledTask
+        $tasks.TaskName
+        FORMAT: 
+        <task name="DESCRIPTIVE_NAME" value="TASK_NAME"/> 
+        -->
+    </tasks>
+    <registry-items>
+        <!--
+        INFO:
+        Makes custom edits to the registry
+        FORMAT: 
+        <registry-item name="DESCRIPTIVE_NAME" path="REG_PATH" value="REG_VALUE" type="TYPE" data="NEW_DATA"/> 
+        -->
+    </registry-items>
+    <path-items>
+        <!--
+        INFO:
+        Removes files and folders from the system
+        FORMAT: 
+        <path-item name="DESCRIPTIVE_NAME" type="dir/file" path="DIR_PATH/FILE_PATH"/>
+        -->
+    </path-items>
+    <custom-items>
+        <!--
+        INFO:
+        Performs custom commands
+        FORMAT: 
+        <custom-item name="DESCRIPTIVE_NAME"> <cmd value="PS_COMMAND"/> ... </custom-item>
+        -->
+        <custom-item name="Renaming Computer to 'commando'">
+            <cmd value="Rename-Computer -NewName 'commando'" />
+        </custom-item>
+    </custom-items>
+</config>

Profiles/Configs/win11armvictimconfig.xml

@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="utf-8"?>
+<config> 
+    <apps>
+        <!--
+        INFO:
+        Removes installed AppX packages. Try:
+        $packages = Get-AppxPackage
+        $packages.Name
+        FORMAT: 
+        <app name="APP_NAME"/>
+        -->
+    </apps>
+    <services>
+        <!--
+        INFO:
+        Sets Services to "Manual" startup type. Try:
+        $services = Get-WmiObject -Query "SELECT * FROM Win32_Service WHERE StartMode='Auto'" | Get-Service
+        $services.Name
+        FORMAT: 
+        <service name="SERVICE_NAME"/>
+        -->
+    </services>
+    <tasks>
+        <!--
+        INFO:
+        Disables Scheduled Tasks. Try:
+        $tasks = Get-ScheduledTask
+        $tasks.TaskName
+        FORMAT: 
+        <task name="DESCRIPTIVE_NAME" value="TASK_NAME"/> 
+        -->
+    </tasks>
+    <registry-items>
+        <!--
+        INFO:
+        Makes custom edits to the registry
+        FORMAT: 
+        <registry-item name="DESCRIPTIVE_NAME" path="REG_PATH" value="REG_VALUE" type="TYPE" data="NEW_DATA"/> 
+        -->
+    </registry-items>
+    <path-items>
+        <!--
+        INFO:
+        Removes files and folders from the system
+        FORMAT: 
+        <path-item name="DESCRIPTIVE_NAME" type="dir/file" path="DIR_PATH/FILE_PATH"/>
+        -->
+    </path-items>
+    <custom-items>
+        <!--
+        INFO:
+        Performs custom commands
+        FORMAT: 
+        <custom-item name="DESCRIPTIVE_NAME"> <cmd value="PS_COMMAND"/> ... </custom-item>
+        -->
+        <custom-item name="Renaming Computer to 'commando'">
+            <cmd value="Rename-Computer -NewName 'commando'" />
+        </custom-item>
+    </custom-items>
+</config>

Profiles/Configs/win11config.xml

@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="utf-8"?>
+<config> 
+    <apps>
+        <!--
+        INFO:
+        Removes installed AppX packages. Try:
+        $packages = Get-AppxPackage
+        $packages.Name
+        FORMAT: 
+        <app name="APP_NAME"/>
+        -->
+    </apps>
+    <services>
+        <!--
+        INFO:
+        Sets Services to "Manual" startup type. Try:
+        $services = Get-WmiObject -Query "SELECT * FROM Win32_Service WHERE StartMode='Auto'" | Get-Service
+        $services.Name
+        FORMAT: 
+        <service name="SERVICE_NAME"/>
+        -->
+    </services>
+    <tasks>
+        <!--
+        INFO:
+        Disables Scheduled Tasks. Try:
+        $tasks = Get-ScheduledTask
+        $tasks.TaskName
+        FORMAT: 
+        <task name="DESCRIPTIVE_NAME" value="TASK_NAME"/> 
+        -->
+    </tasks>
+    <registry-items>
+        <!--
+        INFO:
+        Makes custom edits to the registry
+        FORMAT: 
+        <registry-item name="DESCRIPTIVE_NAME" path="REG_PATH" value="REG_VALUE" type="TYPE" data="NEW_DATA"/> 
+        -->
+    </registry-items>
+    <path-items>
+        <!--
+        INFO:
+        Removes files and folders from the system
+        FORMAT: 
+        <path-item name="DESCRIPTIVE_NAME" type="dir/file" path="DIR_PATH/FILE_PATH"/>
+        -->
+    </path-items>
+    <custom-items>
+        <!--
+        INFO:
+        Performs custom commands
+        FORMAT: 
+        <custom-item name="DESCRIPTIVE_NAME"> <cmd value="PS_COMMAND"/> ... </custom-item>
+        -->
+        <custom-item name="Renaming Computer to 'commando'">
+            <cmd value="Rename-Computer -NewName 'commando'" />
+        </custom-item>
+    </custom-items>
+</config>

Profiles/Configs/win11victimconfig.xml

@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="utf-8"?>
+<config> 
+    <apps>
+        <!--
+        INFO:
+        Removes installed AppX packages. Try:
+        $packages = Get-AppxPackage
+        $packages.Name
+        FORMAT: 
+        <app name="APP_NAME"/>
+        -->
+    </apps>
+    <services>
+        <!--
+        INFO:
+        Sets Services to "Manual" startup type. Try:
+        $services = Get-WmiObject -Query "SELECT * FROM Win32_Service WHERE StartMode='Auto'" | Get-Service
+        $services.Name
+        FORMAT: 
+        <service name="SERVICE_NAME"/>
+        -->
+    </services>
+    <tasks>
+        <!--
+        INFO:
+        Disables Scheduled Tasks. Try:
+        $tasks = Get-ScheduledTask
+        $tasks.TaskName
+        FORMAT: 
+        <task name="DESCRIPTIVE_NAME" value="TASK_NAME"/> 
+        -->
+    </tasks>
+    <registry-items>
+        <!--
+        INFO:
+        Makes custom edits to the registry
+        FORMAT: 
+        <registry-item name="DESCRIPTIVE_NAME" path="REG_PATH" value="REG_VALUE" type="TYPE" data="NEW_DATA"/> 
+        -->
+    </registry-items>
+    <path-items>
+        <!--
+        INFO:
+        Removes files and folders from the system
+        FORMAT: 
+        <path-item name="DESCRIPTIVE_NAME" type="dir/file" path="DIR_PATH/FILE_PATH"/>
+        -->
+    </path-items>
+    <custom-items>
+        <!--
+        INFO:
+        Performs custom commands
+        FORMAT: 
+        <custom-item name="DESCRIPTIVE_NAME"> <cmd value="PS_COMMAND"/> ... </custom-item>
+        -->
+        <custom-item name="Renaming Computer to 'commando'">
+            <cmd value="Rename-Computer -NewName 'commando'" />
+        </custom-item>
+    </custom-items>
+</config>

README.md

@@ -17,6 +17,9 @@
 * 2 network adapters
 
 # Install Instructions
+Deploy a Windows Virtual Machine
+   > [Where can I find a Windows 10 Virtual Machine?](https://www.microsoft.com/en-us/software-download/windows10ISO)
+
 ## Pre-Install Procedures
 **You MUST disable Windows Defender for a smooth install**. The best way to accomplish this is through Group Policy.
 
@@ -50,9 +53,6 @@ To permanently disable Microsoft Defender:
   [1]: https://stackoverflow.com/questions/62174426/how-to-permanently-disable-windows-defender-real-time-protection-with-gpo
 
 ## Installation 
-
-1. Deploy a Windows Virtual Machine
-   > [Where can I find a Windows Virtual Machine?](https://www.microsoft.com/en-us/software-download/windows10ISO)
 1. Complete the pre-install procedures by disabling Defender
 1. Download and extract the zip of the Commando-VM repo
 1. Run PowerShell as Administrator

install.ps1

@@ -1046,12 +1046,11 @@ function Check-BoxstarterConfig {
     $Boxstarter.AutoLogin = $true
     $Boxstarter.SuppressLogging = $True
     $global:VerbosePreference = "SilentlyContinue"
-    Set-BoxstarterConfig -NugetSources "$desktopPath;.;https://www.myget.org/F/vm-packages/api/v2;https://chocolatey.org/api/v2"
-    Set-WindowsExplorerOptions -EnableShowHiddenFilesFoldersDrives -EnableShowProtectedOSFiles -EnableShowFileExtensions -EnableShowFullPathInTitleBar
+    Set-BoxstarterConfig -NugetSources "$env:USERPROFILE\Desktop;.;https://www.myget.org/F/vm-packages/api/v2;https://chocolatey.org/api/v2"
 }
 
 function Check-ChocoConfig {
-    choco sources add -n="vm-packages" -s "$desktopPath;.;https://www.myget.org/F/vm-packages/api/v2;https://myget.org/F/vm-packages/api/v2" --priority 1
+    choco sources add -n="vm-packages" -s "$env:USERPROFILE\Desktop;.;https://www.myget.org/F/vm-packages/api/v2;https://chocolatey.org/api/v2" --priority 1
     choco feature enable -n allowGlobalConfirmation
     choco feature enable -n allowEmptyChecksums
     $cache = "${Env:LocalAppData}\ChocoCache"
@@ -1059,17 +1058,6 @@ function Check-ChocoConfig {
     choco config set cacheLocation $cache
 }
 
-function Check-PowerOptions {
-    powercfg -change -monitor-timeout-ac 0 | Out-Null
-    powercfg -change -monitor-timeout-dc 0 | Out-Null
-    powercfg -change -disk-timeout-ac 0 | Out-Null
-    powercfg -change -disk-timeout-dc 0 | Out-Null
-    powercfg -change -standby-timeout-ac 0 | Out-Null
-    powercfg -change -standby-timeout-dc 0 | Out-Null
-    powercfg -change -hibernate-timeout-ac 0 | Out-Null
-    powercfg -change -hibernate-timeout-dc 0 | Out-Null
-}
-
 ################################# Functions that Get Profiles and Packages #################################
 
 function Get-ProfileData {
@@ -1116,7 +1104,7 @@ function Get-PackagesFromProfile {
 function Get-AvailablePackages {
     $apiUrl = "https://www.myget.org/F/vm-packages/Packages"
     $destination = Join-Path $PSScriptRoot "./available_packages.xml"
-    $blockList = @("flarevm.installer.vm", "common.vm")
+    $blockList = @("flarevm.installer.vm", "common.vm", "debloat.vm", "installer.vm")
 
     $packages = @()
 
@@ -1399,53 +1387,101 @@ function Install-Profile {
         [Parameter(Mandatory = $false)]
         [string]$ProfilePath
     )
-
+    Write-Host "[+] Settings updated, beginning install. Please wait for a popup letting you know the installation is complete!" -ForegroundColor Green
     if (-not $ProfileName -and -not $ProfilePath) {
         throw "Either ProfileName or ProfilePath must be specified."
     }
 
     try {
         if (Check-ChocoBoxstarterVersions) {
+            Write-Host "[+] Setting Boxstarter config"
             Check-BoxstarterConfig
+            Write-Host "[+] Setting Chocolatey config"
             Check-ChocoConfig
         } else {
+            Write-Host "[+] Installing Boxstarter"
             Check-ChocoBoxstarterInstalls
+            Write-Host "[+] Setting Boxstarter config"
             Check-BoxstarterConfig
+            Write-Host "[+] Setting Chocolatey config"
             Check-ChocoConfig
         }
-        Check-PowerOptions
-        Commando-Configure -configFile $debloatConfig
-        Commando-Configure -configFile $userConfig
+
+        # Set environment variable for Commando VM
+        [Environment]::SetEnvironmentVariable('VMname', 'Commando VM', [EnvironmentVariableTarget]::Machine)
 
         Import-Module "${Env:ProgramData}\boxstarter\boxstarter.chocolatey\boxstarter.chocolatey.psd1" -Force
-
-        Write-Host "Installing the common.vm shared module" -ForegroundColor Yellow
+        
+        # Install base packages
+        Write-Host "[+] Installing the common.vm shared module" -ForegroundColor Yellow
         choco install common.vm -y --force
         refreshenv
+        Import-Module "$Env:ProgramData\_VM\vm.common\vm.common.psm1" -DisableNameChecking -Force
+        VM-Write-Log "INFO" "Common libraries installed."
 
-        $PackageName = "flarevm.installer.vm"
+        Write-Host "[+] Installing the debloat.vm debloater and performance package"
+        choco install debloat.vm -y --force
+        VM-Write-Log "INFO" "Debloating and performance enhancements completed"
 
+        # Set profile to be installed
         if (-not $ProfilePath) {
             $ProfilePath = Join-Path $PSScriptRoot ("\Profiles\" + $ProfileName + ".xml")
         }
         
-        $destinationPath = Join-Path ${Env:VM_COMMON_DIR} "config.xml"
+        $destinationPath = Join-Path ${Env:VM_COMMON_DIR} "packages.xml"
 
         if (Test-Path $ProfilePath) {
             Copy-Item $ProfilePath $destinationPath -Force
-            Write-Host "[+] Profile copied to desktop: $ProfileName" -ForegroundColor Green
+            VM-Write-Log "INFO" "Copied profile $ProfilePath to $destinationPath"
+            Write-Host "[+] Profile copied to %VM_COMMON_DIR%: $ProfileName" -ForegroundColor Green
         } else {
             Write-Host "[!] Error: Profile not found: $ProfileName" -ForegroundColor Red
         }
-
-        $backgroundImage = "${Env:VM_COMMON_DIR}\background.png"
-        $sourceImage = Join-Path $PSScriptRoot "Images\background.png"
-
-        if (-not (Test-Path $backgroundImage)) {
-            Copy-Item -Path $sourceImage -Destination $backgroundImage
+        
+        # Set Windows OS VM configuration file
+        $configPath = Join-Path ${Env:VM_COMMON_DIR} "config.xml"
+        $configSource = Join-Path $PSScriptRoot "Profiles\Configs"
+        $osVersion = VM-Get-WindowsVersion
+        if ($osVersion -eq "Win10" -and -not $victim.IsPresent){
+            VM-Write-Log "INFO" "Windows 10 detected, setting win10config.xml for configuration file."
+            Copy-Item $(Join-Path $configSource "win10config.xml") $configPath -Force
+        } elseif ($osVersion -eq "Win10" -and $victim.IsPresent){
+            VM-Write-Log "INFO" "Windows 10 Victim detected, setting win10victimconfig.xml for configuration file."
+            Copy-Item $(Join-Path $configSource "win10victimconfig.xml") $configPath -Force
+        } elseif ($osVersion -eq "Win11" -and -not $victim.IsPresent) {
+            VM-Write-Log "INFO" "Windows 11 detected, setting win11config.xml for configuration file."
+            Copy-Item $(Join-Path $configSource "win11config.xml") $configPath -Force
+        } elseif ($osVersion -eq "Win11" -and $victim.IsPresent) {
+            VM-Write-Log "INFO" "Windows 11 Victim detected, setting win11victimconfig.xml for configuration file."
+            Copy-Item $(Join-Path $configSource "win11victimconfig.xml") $configPath -Force
+        } elseif ($osVersion -eq "Win11ARM" -and -not $victim.IsPresent) {
+            VM-Write-Log "INFO" "Windows 11 ARM detected, setting win11armconfig.xml for configuration file."
+            Copy-Item $(Join-Path $configSource "win11armconfig.xml") $configPath -Force
+        } elseif ($osVersion -eq "Win11" -and -not $victim.IsPresent) {
+            VM-Write-Log "INFO" "Windows 11 ARM Victim detected, setting win11armvictimconfig.xml for configuration file."
+            Copy-Item $(Join-Path $configSource "win11armvictimconfig.xml") $configPath -Force
+        } else {
+            VM-Write-Log "WARN" "Unknown OS, choosing win10config.xml for configuration file."
+            Copy-Item $(Join-Path $configSource "win10config.xml") $configPath -Force
         }
 
+        # Set background file
+        $backgroundImage = "${Env:VM_COMMON_DIR}\background.png"
+        if ($victim.IsPresent){
+            $sourceImage = Join-Path $PSScriptRoot "Images\background-victim.png"
+        } else {
+            $sourceImage = Join-Path $PSScriptRoot "Images\background.png"
+        }
+        Copy-Item $sourceImage $backgroundImage -Force
+
+        # Set ico file
+        $icoImage = "${Env:VM_COMMON_DIR}\vm.ico"
+        $sourceIco = Join-Path $PSScriptRoot "Images\commando.ico"
+        Copy-Item -Path $sourceIco -Destination $icoImage
+        
+        # Begin the package install
         Write-Host "Installing profile: $ProfileName" -ForegroundColor Yellow
+        $PackageName = "installer.vm"
         if ($noPassword.IsPresent -or ($global:credentials -eq "")) {
             $Boxstarter.NoPassword = $true
             Install-BoxstarterPackage -PackageName $PackageName
@@ -1548,11 +1584,6 @@ function Open-PasswordEntry {
 Set-ItemProperty -Path 'HKCU:\Console' -Name 'QuickEdit' -Value 0
 Set-ItemProperty -Path 'HKCU:\Console' -Name 'InsertMode' -Value 0
 
-# Load debloating and configuration modules
-Import-Module (Join-Path $PSScriptRoot "Modules\configureVM.psm1") -Force
-$debloatConfig = Join-Path $PSScriptRoot "Modules\debloatConfig.xml"
-$userConfig = Join-Path $PSScriptRoot "Modules\userConfig.xml"
-
 # Setting global variables
 $global:checksPassed = $true
 $global:selectedProfile = "Default"
@@ -1631,10 +1662,12 @@ if (-not $cli.IsPresent) {
     if ($global:checksPassed -or $skipChecks.IsPresent) {
 
         # Fetch profiles and packages
-        Write-Host "[i] Retrieving available packages. Please wait." -ForegroundColor Blue
+        Write-Host "[+] Retrieving available packages from MyGet. Please wait."
         $global:profileData = Get-ProfileData
         $global:packageData = Get-AvailablePackages
 
+        Write-Host "[+] Beginning graphical install"
+
         Open-Installer
     }
 }
@@ -1648,7 +1681,7 @@ if ($cli.IsPresent) {
     Write-Host "`t`t`t[email protected]" -ForegroundColor DarkYellow
 
     if ($customProfile -eq "") {
-        Write-Host "[i] No profile specified, selecting default" -ForegroundColor Blue
+        Write-Host "[+] No profile specified, selecting default"
         $customProfile = Join-Path $PSScriptRoot "Profiles/Default.xml"
     }
 
@@ -1657,7 +1690,7 @@ if ($cli.IsPresent) {
         if ([string]::IsNullOrEmpty($password)) {
             Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\PowerShell\1\ShellIds" -Name "ConsolePrompting" -Value $True
             Start-Sleep -Milliseconds 500
-            Write-Host "[i] No password provided. Enter it now or use -noPassword if blank." -ForegroundColor Blue
+            Write-Host "[+] No password provided. Enter it now or use -noPassword if blank."
             $global:credentials = Get-Credential ${Env:username}
         } else {
             $securePassword = ConvertTo-SecureString -String $password -AsPlainText -Force
@@ -1691,7 +1724,7 @@ if ($cli.IsPresent) {
                 Write-Host "`t[-] Windows Defender and Tamper Protection are enabled" -ForegroundColor Red
             }
         } else {
-            Write-Host "`t[i] Skipping Windows Defender checks" -ForegroundColor Blue
+            Write-Host "`t[+] Skipping Windows Defender checks"
         }
         if (-not $victim.IsPresent) {
             if (Check-DefenderAndTamperProtection) {
@@ -1701,7 +1734,7 @@ if ($cli.IsPresent) {
                 Write-Host "`t[-] Windows Defender and Tamper Protection are enabled" -ForegroundColor Red
             }
         } else {
-            Write-Host "`t[i] Skipping Windows Defender checks" -ForegroundColor Blue
+            Write-Host "`t[+] Skipping Windows Defender checks"
         }
 
         if (Check-SupportedOS) {
@@ -1730,6 +1763,6 @@ if ($cli.IsPresent) {
         Write-Host "===================== Installing CommandoVM ====================="
         Install-Profile -ProfileName $customProfile
     } else {
-        Write-Host "`n[i] Some checks failed. Use the -skipChecks flag if you know what you are doing" -ForegroundColor Blue
+        Write-Host "`n[+] Some checks failed. Use the -skipChecks flag if you know what you are doing"
     }
 }