fix: harden services-stage indexing and file-sharing scripts

jacksyrm · jacksyrm · commit ea0b8fbb1fab · 2026-02-28T20:50:35.000Z
diff --git a/src/playbook/Configuration/atlas/appx.yml b/src/playbook/Configuration/atlas/appx.yml
@@ -91,6 +91,8 @@ actions:
   # Clear caches of Client.CBS and more
   # Start menu cache is cleared later
   - !writeStatus: {status: 'Clearing AppX caches'}
+  - !taskKill: {name: 'SearchHost*', ignoreErrors: true}
+  - !taskKill: {name: 'SearchApp*', ignoreErrors: true}
   - !appx: {operation: clearCache, name: '*MicrosoftWindows.Client.CBS*'}
   - !appx: {operation: clearCache, name: '*Microsoft.Windows.Search*'}
   - !appx: {operation: clearCache, name: '*Microsoft.Windows.SecHealthUI*'}
diff --git a/src/playbook/Configuration/atlas/default.yml b/src/playbook/Configuration/atlas/default.yml
@@ -4,7 +4,7 @@ description: Run default AtlasFolder scripts
 actions:
   - !writeStatus: {status: 'Applying default Atlas Folder settings'}
   - !cmd:
-    command: 'reg import .\DEFAULT.reg'
+    command: 'cmd /c "reg import .\DEFAULT.reg > nul 2>&1"'
     exeDir: true
     wait: true
     onUpgrade: false
diff --git a/src/playbook/Configuration/atlas/services.yml b/src/playbook/Configuration/atlas/services.yml
@@ -30,15 +30,17 @@ actions:
     runas: currentUserElevated
 
   - !writeStatus: {status: 'Disabling Location'}
-  - !cmd:
-    command: '"AtlasDesktop\3. General Configuration\Location\Disable Location (default).cmd" /silent'
+  - !powerShell:
+    command: |
+      & "$env:windir\AtlasDesktop\3. General Configuration\Location\Disable Location (default).cmd" /silent
     exeDir: true
     wait: true
     runas: currentUserElevated
 
   - !writeStatus: {status: 'Configuring Indexing'}
-  - !cmd:
-    command: '"AtlasDesktop\3. General Configuration\Search Indexing\Minimal Search Indexing (default).cmd" /silent'
+  - !powerShell:
+    command: |
+      & "$env:windir\AtlasDesktop\3. General Configuration\Search Indexing\Minimal Search Indexing (default).cmd" /silent
     exeDir: true
     wait: true
     runas: currentUserElevated
@@ -57,7 +59,7 @@ actions:
 
     # ------ Microsoft recommendation - 'Do not disable' -----
   - !service: {name: 'diagnosticshub.standardcollector.service', operation: change, startup: 4}
-  - !service: {name: 'WerSvc', operation: change, startup: 4} 
+  - !service: {name: 'WerSvc', operation: change, startup: 4}
 
     # ------- Microsoft recommendation - 'No guidance' ------
   - !service: {name: 'wercplsupport', operation: change, startup: 4}
diff --git a/src/playbook/Executables/AtlasDesktop/3. General Configuration/File Sharing/Disable File Sharing (default).cmd b/src/playbook/Executables/AtlasDesktop/3. General Configuration/File Sharing/Disable File Sharing (default).cmd
@@ -25,7 +25,7 @@ fltmc > nul 2>&1 || (
 reg add "HKLM\SOFTWARE\AtlasOS\Services\%settingName%" /v state /t REG_DWORD /d %stateValue% /f > nul
 reg add "HKLM\SOFTWARE\AtlasOS\Services\%settingName%" /v path /t REG_SZ /d "%scriptPath%" /f > nul
 
-powershell -EP Bypass -NoP -File "%script%"
+powershell -EP RemoteSigned -NoP -File "%script%"
 if "%~1"=="/silent" exit /b
 
 choice /c:yn /n /m "Finished, would you like to restart now to apply the changes? [Y/N] "
diff --git a/src/playbook/Executables/AtlasDesktop/3. General Configuration/File Sharing/Enable File Sharing.cmd b/src/playbook/Executables/AtlasDesktop/3. General Configuration/File Sharing/Enable File Sharing.cmd
@@ -25,7 +25,7 @@ fltmc > nul 2>&1 || (
 reg add "HKLM\SOFTWARE\AtlasOS\Services\%settingName%" /v state /t REG_DWORD /d %stateValue% /f > nul
 reg add "HKLM\SOFTWARE\AtlasOS\Services\%settingName%" /v path /t REG_SZ /d "%scriptPath%" /f > nul
 
-powershell -EP Bypass -NoP -File "%script%"
+powershell -EP RemoteSigned -NoP -File "%script%"
 if "%~1"=="/silent" exit /b
 
 choice /c:yn /n /m "Finished, would you like to restart now to apply the changes? [Y/N] "
diff --git a/src/playbook/Executables/AtlasDesktop/3. General Configuration/File Sharing/Give Access To Menu/Enable Give Access To Menu.cmd b/src/playbook/Executables/AtlasDesktop/3. General Configuration/File Sharing/Give Access To Menu/Enable Give Access To Menu.cmd
@@ -26,6 +26,8 @@ reg add "HKLM\SOFTWARE\AtlasOS\Services\%settingName%" /v path /t REG_SZ /d "%sc
     reg add "HKEY_CLASSES_ROOT\UserLibraryFolder\shellex\ContextMenuHandlers\Sharing" /ve /t REG_SZ /d "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}" /f
 ) > nul 2>&1
 
+if "%~1"=="/silent" exit /b
+
 echo Finished, 'Give Access To' menu is now enabled.
 pause > nul
 exit /b
diff --git a/src/playbook/Executables/AtlasDesktop/3. General Configuration/Power-saving/Default Power-saving (default).cmd b/src/playbook/Executables/AtlasDesktop/3. General Configuration/Power-saving/Default Power-saving (default).cmd
@@ -25,7 +25,7 @@ if not exist "%script%" (
 reg add "HKLM\SOFTWARE\AtlasOS\Services\%settingName%" /v state /t REG_DWORD /d %stateValue% /f > nul
 reg add "HKLM\SOFTWARE\AtlasOS\Services\%settingName%" /v path /t REG_SZ /d "%scriptPath%" /f > nul
 
-powershell -EP Bypass -NoP -File "%script%" %* -Silent
+powershell -EP RemoteSigned -NoP -File "%script%" %* -Silent
 
 if "%~1"=="/silent" exit /b
 
diff --git a/src/playbook/Executables/AtlasDesktop/3. General Configuration/Search Indexing/Disable Search Indexing.cmd b/src/playbook/Executables/AtlasDesktop/3. General Configuration/Search Indexing/Disable Search Indexing.cmd
@@ -3,10 +3,20 @@ set "settingName=Indexing"
 set "stateValue=0"
 set "scriptPath=%~f0"
 set indexConfPath="%windir%\AtlasModules\Scripts\indexConf.cmd"
+set "silentMode=0"
 
-whoami /user | find /i "S-1-5-18" > nul 2>&1 || (
-    call RunAsTI.cmd "%~f0" %*
-    exit /b
+echo %* | findstr /i /c:"/silent" /c:"-silent" /c:"/quiet" > nul 2>&1 && set "silentMode=1"
+
+if "%silentMode%"=="1" (
+    fltmc > nul 2>&1 || (
+        call RunAsTI.cmd "%~f0" %*
+        exit /b
+    )
+) else (
+    whoami /user | find /i "S-1-5-18" > nul 2>&1 || (
+        call RunAsTI.cmd "%~f0" %*
+        exit /b
+    )
 )
 
 if not exist "%indexConfPath%" (
@@ -23,6 +33,8 @@ echo.
 echo Disabling search indexing...
 %indexConf% /stop
 
+if "%silentMode%"=="1" exit /b
+
 echo.
 echo Search Indexing has been disabled.
 echo Press any key to exit...
diff --git a/src/playbook/Executables/AtlasDesktop/3. General Configuration/Search Indexing/Enable Search Indexing.cmd b/src/playbook/Executables/AtlasDesktop/3. General Configuration/Search Indexing/Enable Search Indexing.cmd
@@ -3,10 +3,20 @@ set "settingName=Indexing"
 set "stateValue=2"
 set "scriptPath=%~f0"
 set indexConfPath="%windir%\AtlasModules\Scripts\indexConf.cmd"
+set "silentMode=0"
 
-whoami /user | find /i "S-1-5-18" > nul 2>&1 || (
-    call RunAsTI.cmd "%~f0" %*
-    exit /b
+echo %* | findstr /i /c:"/silent" /c:"-silent" /c:"/quiet" > nul 2>&1 && set "silentMode=1"
+
+if "%silentMode%"=="1" (
+    fltmc > nul 2>&1 || (
+        call RunAsTI.cmd "%~f0" %*
+        exit /b
+    )
+) else (
+    whoami /user | find /i "S-1-5-18" > nul 2>&1 || (
+        call RunAsTI.cmd "%~f0" %*
+        exit /b
+    )
 )
 
 if not exist "%indexConfPath%" (
@@ -41,7 +51,7 @@ for /f "usebackq delims=" %%a in (`dir /b /a:d "%SystemDrive%\Users"`) do (
 reg add "HKLM\SOFTWARE\Microsoft\Windows Search" /v SetupCompletedSuccessfully /t REG_DWORD /d 0 /f > nul
 
 set regCmd=^>nul reg add "HKLM\Software\Microsoft\Windows Search\Gather\Windows\SystemIndex" /v "RespectPowerModes" /t REG_DWORD /d 
-if "%~1"=="/silent" (%regCmd% "0" /f & exit /b)
+if "%silentMode%"=="1" (%regCmd% "0" /f & exit /b)
 
 echo.
 :: Respect Power Settings when Search Indexing to prevent performance loss during gaming or battery drain
diff --git a/src/playbook/Executables/AtlasDesktop/3. General Configuration/Search Indexing/Minimal Search Indexing (default).cmd b/src/playbook/Executables/AtlasDesktop/3. General Configuration/Search Indexing/Minimal Search Indexing (default).cmd
@@ -3,14 +3,25 @@ set "settingName=Indexing"
 set "stateValue=1"
 set "scriptPath=%~f0"
 set indexConfPath="%windir%\AtlasModules\Scripts\indexConf.cmd"
-
-whoami /user | find /i "S-1-5-18" > nul 2>&1 || (
-    call RunAsTI.cmd "%~f0" %*
-    exit /b
+set "silentMode=0"
+
+echo %* | findstr /i /c:"/silent" /c:"-silent" /c:"/quiet" > nul 2>&1 && set "silentMode=1"
+
+if "%silentMode%"=="1" (
+    fltmc > nul 2>&1 || (
+        call RunAsTI.cmd "%~f0" %*
+        exit /b
+    )
+) else (
+    whoami /user | find /i "S-1-5-18" > nul 2>&1 || (
+        call RunAsTI.cmd "%~f0" %*
+        exit /b
+    )
 )
 
 if not exist "%indexConfPath%" (
     echo The 'indexConf.cmd' script wasn't found in AtlasModules.
+    if "%silentMode%"=="1" exit /b 1
     pause
     exit /b 1
 )
@@ -19,8 +30,10 @@ set "indexConf=call %indexConfPath%"
 reg add "HKLM\SOFTWARE\AtlasOS\Services\%settingName%" /v state /t REG_DWORD /d %stateValue% /f > nul
 reg add "HKLM\SOFTWARE\AtlasOS\Services\%settingName%" /v path /t REG_SZ /d "%scriptPath%" /f > nul
 
-echo.
-echo Configuring minimal search indexing...
+if "%silentMode%"=="0" (
+    echo.
+    echo Configuring minimal search indexing...
+)
 %indexConf% /stop
 %indexConf% /cleanpolicies
 %indexConf% /include "%programdata%\Microsoft\Windows\Start Menu\Programs"
@@ -32,7 +45,7 @@ reg add "HKLM\Software\Microsoft\Windows Search\Gather\Windows\SystemIndex" /v "
 %indexConf% /start
 reg add "HKLM\SOFTWARE\Microsoft\Windows Search" /v SetupCompletedSuccessfully /t REG_DWORD /d 0 /f > nul
 
-if "%~1"=="/silent" exit /b
+if "%silentMode%"=="1" exit /b
 
 echo.
 echo Minimal Search Indexing has been configured.
diff --git a/src/playbook/Executables/AtlasModules/Scripts/ScriptWrappers/DisableFileSharing.ps1 b/src/playbook/Executables/AtlasModules/Scripts/ScriptWrappers/DisableFileSharing.ps1
@@ -4,6 +4,8 @@ param (
     [switch]$Silent
 )
 
+Set-StrictMode -Version 3.0
+
 $fileSharingConfigPath = "$([Environment]::GetFolderPath('Windows'))\AtlasDesktop\3. General Configuration\File Sharing"
 
 # Disable network items
@@ -24,16 +26,18 @@ Get-NetConnectionProfile | Set-NetConnectionProfile -NetworkCategory Public
 # Disable network discovery firewall rules
 Get-NetFirewallRule | Where-Object {
     # File and Printer Sharing, Network Discovery
-    ($_.Group -eq "@FirewallAPI.dll,-28502" -or $_.Group -eq "@FirewallAPI.dll,-32752") -or
-    ($_.DisplayGroup -eq "File and Printer Sharing" -or $_.DisplayGroup -eq "Network Discovery") -and
-    $_.Profile -like "*Private*"
+    (
+        ($_.Group -eq "@FirewallAPI.dll,-28502" -or $_.Group -eq "@FirewallAPI.dll,-32752") -or
+        ($_.DisplayGroup -eq "File and Printer Sharing" -or $_.DisplayGroup -eq "Network Discovery")
+    ) -and
+    ($_.Profile -like "*Private*")
 } | Disable-NetFirewallRule
 
-reg import "$fileSharingConfigPath\Network Navigation Pane\Disable Network Navigation Pane (default).reg" | Out-Null
-reg import "$fileSharingConfigPath\Give Access To Menu\Disable Give Access To Menu (default).reg" | Out-Null
+& "$fileSharingConfigPath\Network Navigation Pane\Disable Network Navigation Pane (default).cmd" /silent
+& "$fileSharingConfigPath\Give Access To Menu\Disable Give Access To Menu (default).cmd" /silent
 
 if ($Silent) { exit }
 
 Write-Host "`nCompleted! " -ForegroundColor Green -NoNewLine
 Write-Host "You'll need to restart to apply the changes." -ForegroundColor Yellow
-exit
+exit
diff --git a/src/playbook/Executables/AtlasModules/Scripts/ScriptWrappers/EnableFileSharing.ps1 b/src/playbook/Executables/AtlasModules/Scripts/ScriptWrappers/EnableFileSharing.ps1
@@ -1,12 +1,15 @@
 #Requires -RunAsAdministrator
 
+Set-StrictMode -Version 3.0
+
 $networkDiscoveryConfigPath = "$([Environment]::GetFolderPath('Windows'))\AtlasDesktop\6. Advanced Configuration\Services\Network Discovery"
+$fileSharingConfigPath = "$([Environment]::GetFolderPath('Windows'))\AtlasDesktop\3. General Configuration\File Sharing"
 
 # Enable network items
 Enable-NetAdapterBinding -Name "*" -ComponentID ms_msclient, ms_server, ms_lltdio, ms_rspndr | Out-Null
 
 # Enable Network Discovery services and its dependencies
-Start-Process -FilePath "$networkDiscoveryConfigPath\Enable Network Discovery Services (default).cmd" -ArgumentList "/silent" -WindowStyle Hidden
+& "$networkDiscoveryConfigPath\Enable Network Discovery Services (default).cmd" /silent
 
 # Enable NetBios over TCP/IP
 $interfaces = Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces" -Recurse | Where-Object { $_.GetValue("NetbiosOptions") -ne $null }
@@ -25,9 +28,11 @@ if ($LASTEXITCODE -eq 1) {
     # Disable network discovery firewall rules
     Get-NetFirewallRule | Where-Object {
         # File and Printer Sharing, Network Discovery
-        ($_.Group -eq "@FirewallAPI.dll,-28502" -or $_.Group -eq "@FirewallAPI.dll,-32752") -or
-        ($_.DisplayGroup -eq "File and Printer Sharing" -or $_.DisplayGroup -eq "Network Discovery") -and
-        $_.Profile -like "*Private*"
+        (
+            ($_.Group -eq "@FirewallAPI.dll,-28502" -or $_.Group -eq "@FirewallAPI.dll,-32752") -or
+            ($_.DisplayGroup -eq "File and Printer Sharing" -or $_.DisplayGroup -eq "Network Discovery")
+        ) -and
+        ($_.Profile -like "*Private*")
     } | Enable-NetFirewallRule
 
     # Set up network connected devices automatically
@@ -37,14 +42,14 @@ if ($LASTEXITCODE -eq 1) {
 
 choice /c:yn /n /m "Would you like to add the Network Navigation Pane to the Explorer sidebar? [Y/N] "
 if ($LASTEXITCODE -eq 1) {
-    reg import "$([Environment]::GetFolderPath('Windows'))\AtlasDesktop\3. General Configuration\File Sharing\Network Navigation Pane\User Network Navigation Pane choice.reg" | Out-Null
+    & "$fileSharingConfigPath\Network Navigation Pane\User Network Navigation Pane choice.cmd" /silent
 }
 
 choice /c:yn /n /m "Would you like to restore the 'Give access to' context menu in Explorer? [Y/N] "
 if ($LASTEXITCODE -eq 1) {
-    reg import "$([Environment]::GetFolderPath('Windows'))\AtlasDesktop\3. General Configuration\File Sharing\Give Access To Menu\Enable Give Access To Menu.reg" | Out-Null
+    & "$fileSharingConfigPath\Give Access To Menu\Enable Give Access To Menu.cmd" /silent
 }
 
 Write-Host "`nCompleted! " -ForegroundColor Green -NoNewLine
 Write-Host "You'll need to restart to apply the changes." -ForegroundColor Yellow
-exit
+exit
