Harden Windows support scripts with preview-first workflows

.gitattributes

@@ -0,0 +1,6 @@
+*.cmd text eol=crlf
+*.ps1 text eol=crlf
+*.py text eol=lf
+*.yml text eol=lf
+*.md text eol=lf
+*.MD text eol=lf

.github/workflows/script-checks.yml

@@ -0,0 +1,55 @@
+name: Windows script safety checks
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: windows-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - name: Run static safety tests
+        run: python -m unittest discover -s tests -v
+      - name: Parse PowerShell helpers
+        shell: powershell
+        run: |
+          $hasErrors = $false
+          Get-ChildItem -Path scripts -Filter *.ps1 -Recurse | ForEach-Object {
+            $tokens = $null
+            $parseErrors = $null
+            $null = [System.Management.Automation.Language.Parser]::ParseFile(
+              $_.FullName, [ref]$tokens, [ref]$parseErrors
+            )
+            foreach ($parseError in $parseErrors) {
+              Write-Host "FAILED: $($_.Name): $($parseError.Message)"
+              $hasErrors = $true
+            }
+          }
+          if ($hasErrors) { exit 1 }
+      - name: Smoke-test non-mutating previews
+        shell: powershell
+        run: |
+          $scripts = @(
+            'active-directory\launch-ad-console-as-user.cmd',
+            'adobe-acrobat\disable-javascript.cmd',
+            'ms-teams\clear-teams-login.cmd',
+            'ms-teams\full-clear-teams-cache.cmd',
+            'onedrive\disable-onedrive.cmd',
+            'outlook\fix-outlook-crashes-june-2025-update.cmd',
+            'outlook\hide-new-outlook-button.cmd',
+            'windows\remove-bloatware.cmd'
+          )
+          foreach ($script in $scripts) {
+            Write-Host "PREVIEW: $script"
+            & cmd.exe /d /c $script /preview
+            if ($LASTEXITCODE -ne 0) { throw "Preview failed for $script (exit $LASTEXITCODE)" }
+          }

AGENTS.md

@@ -0,0 +1,13 @@
+# Repository agent instructions
+
+This repository contains Windows administrative scripts. Treat it as a **high-impact support toolkit**, not a general-purpose cleanup collection.
+
+- All code, comments, commit messages, branches, PR titles and PR descriptions must be in English.
+- Keep the existing CMD entry points and `/preview`, `/apply` and `/help` interface. Preview must never change a user profile, registry, apps or files.
+- Never silently delete `%UserProfile%\OneDrive`, shared Microsoft identity stores, user documents or arbitrary package matches. Changes with data-loss potential require a specific target list, explicit opt-in and a documented backup/recovery path.
+- Never force-close Teams, Outlook or OneDrive during preview. An apply operation should require the user to close applications and acknowledge data or sync risks.
+- Respect current-user versus elevated administrator context. Prefer checking prerequisites and refusing unsupported installations over guessing registry paths.
+- Use exact package names instead of wildcards or broad regular expressions when removing Appx applications. Do not claim that deprovisioning permanently prevents Store reinstalls.
+- Preserve previous policy settings when possible; offer reversible changes. Do not remove organization-managed GPO/MDM settings or add credential logging.
+- For all code changes, update README documentation and regression checks; run the Windows workflow. CI must never execute any apply/restore action.
+- Open a task branch and PR for review; do not push directly to `main`, merge or deploy without explicit approval. Report checks not run and remaining assumptions.

README.MD

@@ -1,70 +1,68 @@
-# 🛠️ Sysadmin Scripts
+# Sysadmin Scripts
 
-A collection of Windows **batch scripts** for system administrators to quickly **fix**, **clean**, and **configure** common issues in Microsoft Office, Teams, Adobe Acrobat, and Windows itself.
+A small collection of **Windows** support scripts for Active Directory, Acrobat/Reader, Microsoft Teams, OneDrive, classic Outlook and optional Windows apps. All eight CMD entry points default to **preview only**. No script downloads or executes remote code.
 
-These scripts are designed to save time and reduce troubleshooting effort for **IT professionals**, **Helpdesk technicians**, and **power users**.
+> **Read this before using the scripts on a user's PC.** `/apply` changes the current machine or account, sometimes irreversibly. Test in an isolated VM, review the proposed targets, keep backups and verify the affected account. The repository is MIT-licensed and provided without warranty.
 
----
+## Quick start
 
-## 📄 Script Overview
+Open a terminal in the repository and run a script without arguments, or explicitly pass `/preview`:
 
-### 📂 Adobe Acrobat
-- [`adobe-acrobat/disable-javascript.cmd`](adobe-acrobat/disable-javascript.cmd)  
-  🔒 Disables JavaScript and trusted folders in Adobe Acrobat Reader DC for enhanced security using registry keys.
+```cmd
+ms-teams\full-clear-teams-cache.cmd /preview
+```
 
----
+Review its output. To carry out the operation, use `/apply`:
 
-### 💬 Microsoft Teams
-- [`ms-teams/clear-teams-login.cmd`](ms-teams/clear-teams-login.cmd)  
-  🧹 Clears cached login folders for Microsoft Teams to ensure credentials must be re-entered.
+```cmd
+ms-teams\full-clear-teams-cache.cmd /apply
+```
 
-- [`ms-teams/full-clear-teams-cache.cmd`](ms-teams/full-clear-teams-cache.cmd)  
-  🧼 Completely removes all Teams cache and login data to fix lag, crashes, or syncing issues.
+Destructive or machine-wide helpers also require a typed confirmation. `/help` prints usage. A successful preview does **not** establish that applying the change will succeed. Scripts return exit code `0` for success or a safe skip, `1` for an operational failure and `2` for invalid usage or a cancelled operation.
 
----
+**Account context matters:** Run Teams, Outlook and per-user Appx tasks as the **affected user**. Starting them through an alternate administrator account changes the administrator's own profile/HKCU instead. Use an elevated terminal for machine-wide Adobe/OneDrive policy changes and Appx deprovisioning, preferably by elevating the intended account rather than switching accounts.
 
-### 📧 Outlook
-- [`outlook/fix-outlook-crashes-june-2025-update.cmd`](outlook/fix-outlook-crashes-june-2025-update.cmd)  
-  🛠️ Fixes crashes caused by the June 2025 Outlook Classic update by creating the missing `FORMS2` folder in `%APPDATA%`.  
-  🔗 [Microsoft Support Article](https://support.microsoft.com/en-us/office/classic-outlook-crashes-opening-or-starting-a-new-email-1b413573-7dfc-4147-9c53-c2f1183b89b8)
+The PowerShell helpers use Windows PowerShell 5.1 and the built-in Windows utilities. CMD launchers set the execution policy only for their own PowerShell process; organization-enforced policies still apply. Inspect the local, trusted scripts before execution.
 
-- [`outlook/hide-new-outlook-button.cmd`](outlook/hide-new-outlook-button.cmd)  
-  🙈 Hides the "Try the New Outlook" toggle in Outlook 2016/2019/365 using registry configuration.  
-  🔗 [Microsoft Learn: Control Install](https://learn.microsoft.com/de-de/microsoft-365-apps/outlook/get-started/control-install)
+## Scripts
 
----
+| Entry point | Preview / apply behavior | Scope and recovery |
+| --- | --- | --- |
+| [Launch AD console](active-directory/launch-ad-console-as-user.cmd) | `/apply` securely prompts for a domain, account and password, then starts `dsa.msc` with alternate credentials. | Requires RSAT Active Directory tools and a simple DNS/NetBIOS domain and sAMAccountName. No password is stored. Closing the console undoes the action. |
+| [Disable Adobe JavaScript](adobe-acrobat/disable-javascript.cmd) | Detects supported Reader/Acrobat DC installations before setting `bDisableJavaScript=1` and `bDisableTrustedFolders=1`. | Machine-wide Adobe policy. Existing target keys are exported to a timestamped REG backup in `%TEMP%` before modification. Review managed policies before restoring a backup. |
+| [Reset Teams login cache](ms-teams/clear-teams-login.cmd) | Only clears the **new Teams-specific cache** after Teams is closed and you type `RESET`. | Does **not** delete OneAuth, TokenBroker, IdentityCache or AAD BrokerPlugin. It cannot guarantee sign-out with Windows SSO; use Teams' own Sign out if account separation is required. |
+| [Reset full Teams caches](ms-teams/full-clear-teams-cache.cmd) | Clears new Teams' cache and known classic Teams cache subfolders after confirmation. | Preserves shared M365 identity stores and classic diagnostic logs outside the listed caches. Some personalization may be lost; restart Teams. |
+| [Disable/remove OneDrive](onedrive/disable-onedrive.cmd) | After confirmation, sets the documented `DisableFileSyncNGSC=1` machine policy and invokes an available OneDrive uninstaller. | **Never deletes `%UserProfile%\OneDrive` or its contents.** Verify sync and backup status manually before applying. An existing policy key is exported to `%TEMP%`. Reverting requires changing the policy, and reinstalling OneDrive if removed. |
+| [Classic Outlook FORMS2 workaround](outlook/fix-outlook-crashes-june-2025-update.cmd) | Only creates the quoted `%LOCALAPPDATA%\Microsoft\FORMS2` folder when missing and Outlook is closed. | For the specific June 2025 classic Outlook forms-library crash. Microsoft has fixed the issue in subsequent builds: update Office first. |
+| [Hide New Outlook toggle](outlook/hide-new-outlook-button.cmd) | `/apply` sets the current user's `HideNewOutlookToggle=1`; `/restore` removes the local value after confirmation. | Only affects the classic Outlook toggle, not installation of the new app. Do not override organization-managed settings. |
+| [Remove selected Appx apps](windows/remove-bloatware.cmd) | Shows **exact package names** first; `/apply` requires admin rights and typed `REMOVE`. | Only removes matching installed apps from the current user and deprovisions matching packages for future accounts. Does not affect every existing user and does **not** permanently block Store/Windows reinstallation. |
 
-### ☁️ Windows / OneDrive
-- [`onedrive/disable-onedrive.cmd`](onedrive/disable-onedrive.cmd)  
-  🚫 Uninstalls OneDrive, removes leftover files and disables the sync client via registry settings.
+### Microsoft Teams troubleshooting
 
-- [`windows/remove-bloatware.cmd`](windows/remove-bloatware.cmd)  
-  🧽 Removes pre-installed bloatware apps (e.g. Xbox, Candy Crush, Paint 3D) and blocks their future installation using PowerShell.
+Microsoft does **not** recommend cache deletion as a general fix for missing chats, channels or notifications: it can remove diagnostics that support needs. Use the cache scripts only for a targeted local-client problem after checking network, service and account status. Official procedure: [Clear the Teams client cache](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/teams-administration/clear-teams-cache).
 
----
+### OneDrive and managed devices
 
-### 🧑‍💼 Active Directory
-- [`active-directory/launch-ad-console-as-user.cmd`](active-directory/launch-ad-console-as-user.cmd)  
-  🔐 Prompts for domain credentials and launches the Active Directory Users and Computers console (`dsa.msc`) as another user without switching sessions.
+`DisableFileSyncNGSC` is the Windows policy that prevents OneDrive sync; it affects the machine and may be re-applied or controlled by Group Policy/MDM. See [Microsoft's OneDrive policy guidance](https://support.microsoft.com/en-us/onedrive/onedrive-won-t-start). Do not use the uninstaller until you have independently checked the user's sync queue and backups. The script cannot prove that cloud files are fully synchronized.
 
----
+### Adobe scope
 
-> ⚠️ **Note:** Most scripts require **administrator privileges**. Always review scripts before running in production environments. Use at your own risk.
+The script supports detected DC registry footprints for Reader/Acrobat and their 32-/64-bit policy paths. If installation detection fails, it makes no changes. Confirm your Adobe package's registry layout and deploy managed policy through GPO/MDM where appropriate. The keys disable JavaScript and trusted folders; they do not promise to disable every other trust mechanism. See [Adobe's enterprise registry guidance](https://helpx.adobe.com/business/enterprise/deploy-apps-updates/deploy-packages/acrobat-64-bit-for-enterprises.html).
 
----
+### Outlook scope
 
-## 📌 Planned / To-Do
+Microsoft documents the `FORMS2` workaround for a **fixed** June 2025 crash. Check [the known-issue article](https://support.microsoft.com/en-us/support/known-issues/classic-outlook-crashes-opening-or-starting-a-new-email) and installed build before applying it. The [New Outlook toggle setting](https://learn.microsoft.com/en-us/microsoft-365-apps/outlook/get-started/control-install) does not remove the new Outlook application.
 
-- [ ] Office license cleanup  
-- [ ] Reset network stack (DNS/Winsock/IP)  
-- [ ] Fix printer spooler issues  
-- [ ] Systeminfo export and log collection  
-- [ ] Startup entry report  
-- [ ] Enable dark mode via registry  
-- [ ] Reset Outlook profile  
+## Validation
 
----
+GitHub Actions parses every PowerShell helper, runs static safety tests and smoke-tests every CMD launcher in `/preview` mode on Windows. The workflow intentionally never calls `/apply` or `/restore`. Follow [the VM test plan](docs/TESTING.md) for manual changes that cannot safely be exercised in CI.
 
-## 📜 License
+## Planned additions
 
-This project is licensed under the [MIT License](LICENSE).
+- Non-destructive Office licensing diagnostics and report export
+- Network, print spooler and system information collection (preview-first)
+- A targeted Outlook profile diagnostic, without deleting a user's profile
+
+## License
+
+[MIT](LICENSE).

active-directory/launch-ad-console-as-user.cmd

@@ -1,25 +1,26 @@
-:: =============================================
-:: Launch Active Directory Console as Domain Admin
-:: =============================================
-:: This script prompts for a domain and username, then launches the
-:: Active Directory Users and Computers console (dsa.msc) using those credentials.
-:: Useful for admins who are logged in with a non-privileged account.
-::
-:: Requires: Domain credentials with AD permissions
-::
 @echo off
 setlocal
-
-:: Prompt for domain and username
-set /p domain=Enter domain name (e.g. mydomain.local): 
-set /p username=Enter username (e.g. adminuser): 
-
-:: Build full user string
-set fulluser=%domain%\%username%
-
-:: Launch MMC with dsa.msc under different credentials
-echo.
-echo You will now be prompted for the password of %fulluser%
-runas /user:%fulluser% "mmc dsa.msc"
-
-endlocal
+if not "%~2"=="" goto usage
+set "apply="
+if "%~1"=="" goto run
+if /i "%~1"=="/preview" goto run
+if /i "%~1"=="/apply" (
+    set "apply=-Apply"
+    goto run
+)
+if /i "%~1"=="/help" goto help
+goto usage
+:run
+set "ps=%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe"
+if exist "%SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exe" set "ps=%SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exe"
+"%ps%" -NoProfile -ExecutionPolicy Bypass -File "%~dp0..\scripts\Launch-ADConsole.ps1" %apply%
+exit /b %errorlevel%
+:help
+echo Launch AD Users and Computers with separately prompted credentials.
+echo Usage: %~nx0 [/preview ^| /apply ^| /help]
+echo Default: preview only; /apply may require interactive confirmation.
+exit /b 0
+:usage
+echo ERROR: Invalid arguments.
+echo Usage: %~nx0 [/preview ^| /apply ^| /help]
+exit /b 2

adobe-acrobat/disable-javascript.cmd

@@ -1,11 +1,26 @@
-:: =============================================
-:: Disable JavaScript in Adobe Acrobat Reader DC
-:: =============================================
-:: This script fully disables JavaScript and trusted folders in Adobe Acrobat Reader DC
-:: by setting the appropriate registry keys for FeatureLockDown policies.
-:: Requires administrative privileges.
-::
-:: Usage: Run as administrator
-::
-reg add "HKLM\SOFTWARE\WOW6432Node\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v "bDisableJavaScript" /t REG_DWORD /d "0x00000001" /f
-reg add "HKLM\SOFTWARE\WOW6432Node\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v "bDisableTrustedFolders" /t REG_DWORD /d "0x00000001" /f
+@echo off
+setlocal
+if not "%~2"=="" goto usage
+set "apply="
+if "%~1"=="" goto run
+if /i "%~1"=="/preview" goto run
+if /i "%~1"=="/apply" (
+    set "apply=-Apply"
+    goto run
+)
+if /i "%~1"=="/help" goto help
+goto usage
+:run
+set "ps=%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe"
+if exist "%SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exe" set "ps=%SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exe"
+"%ps%" -NoProfile -ExecutionPolicy Bypass -File "%~dp0..\scripts\Set-AcrobatJavaScriptPolicy.ps1" %apply%
+exit /b %errorlevel%
+:help
+echo Disable Acrobat/Reader JavaScript and trusted folders for detected DC installations.
+echo Usage: %~nx0 [/preview ^| /apply ^| /help]
+echo Default: preview only; /apply may require interactive confirmation.
+exit /b 0
+:usage
+echo ERROR: Invalid arguments.
+echo Usage: %~nx0 [/preview ^| /apply ^| /help]
+exit /b 2

docs/TESTING.md

@@ -0,0 +1,22 @@
+# Manual Windows VM test plan
+
+Use a disposable, snapshotted Windows 11 VM and a separate test account. **Never use real user files or active corporate accounts as test data.** GitHub Actions covers PowerShell parsing, static safety rules and non-mutating previews only.
+
+## Preparation
+
+1. Take a VM snapshot, create a test user's profile and document the Windows, Teams, OneDrive, Office, Acrobat and PowerShell versions.
+2. If testing OneDrive, use a disposable test account and put uniquely named **backed-up** sample files in the test OneDrive directory. Verify which files are cloud-only, locally available, unsynchronized or synced; do not claim the script can determine this.
+3. Run all eight `/preview` commands from the affected account; record exit codes and verify file timestamps, registry values and installed package lists do not change.
+4. Run each script with `/help` and invalid arguments. The invalid-usage exit code should be 2.
+5. Test operations with missing applications, missing RSAT, already-applied policies, non-ASCII or spaced profile paths and a different admin account.
+
+## Apply cases
+
+- **Teams:** Keep Teams open and verify `/apply` refuses the deletion. Quit Teams, run `/apply`, decline confirmation and check that no files changed. Repeat with confirmation on disposable local cache data. Verify that shared M365 identity paths still exist.
+- **OneDrive:** Verify a declined confirmation is a no-op. With a disposable synchronized profile, confirm that the OneDrive user directory and its files are byte-for-byte unchanged after applying policy/uninstall. Inspect policy backup and `DisableFileSyncNGSC`; verify the app uninstall result separately. Restore the VM snapshot.
+- **Appx:** Run as the intended admin test account, compare preview package IDs with the exact allowlist and provisioned package IDs. Decline, then confirm; verify only listed packages changed. Check that an unrelated Xbox/Windows dependency remains installed. Restore the snapshot.
+- **Acrobat:** With a supported Reader/Acrobat install, verify a declined confirmation changes nothing. After confirmation, inspect both DWORD values and the exported REG backup. Repeat on a device without the product and verify a safe skip.
+- **Outlook:** Verify the toggle only changes the current user's HKCU key; test `/restore` with and without a pre-existing override. For `FORMS2`, verify Outlook-open refusal, idempotent creation and correct behavior with a spaced user-profile path.
+- **AD console:** Verify missing RSAT, invalid account input and canceling the credential prompt. With a non-production test domain, verify the console uses the intended credentials. Never record passwords.
+
+Record results, failed/unsupported combinations and a screenshot or log excerpt that contains no secrets. Do not mark live system behavior as tested based only on a green CI run.