Overhaul windows.ps1: fix breaking bugs, speed up run time, add answer-key-driven coverage

[Felipezwp]

Summary

Restructures windows/windows.ps1 end-to-end, keeping the original authorship/GPL header. Changes were driven by a review of past CyberPatriot answer keys (2024–2025 training/round keys) plus a line-by-line audit of the script. Three categories of change: critical fixes, performance, and new scored coverage.

Critical fixes (image-breaking / point-losing)

• Removed RpcSs from the service-disable list. Nearly everything in Windows depends on the RPC service; sc config RpcSs start= disabled renders the image unusable.
• No longer opens inbound TCP 80 unconditionally. Opening un-needed firewall ports can lose points; the rule is now gated behind a "does the README require a web server?" prompt.
• The keep-RDP answer is now honored. Previously the script asked about RDP, then unconditionally stopped/disabled TermService/SessionEnv/UmRdpService in the later services section.
• The logged-in user is exempt from the bulk password change (changing it can break auto-logon / lock you out mid-round). Passwords now use Set-LocalUser instead of net user, which fails on names with spaces or >20 chars.
• Administrator rename fixed: wmic is deprecated/removed on current Win11; the follow-up net localgroup /delete Administrator + net user Administrator /active:no ran after the rename so they always failed. Now Rename-LocalUser + Disable-LocalUser, and the new name is prompted rather than hardcoded.
• $input is a reserved PowerShell automatic variable — the Read-Host loops assigned to it; renamed.
• Safer defaults: pressing Enter no longer deletes users or force-restarts the machine; destructive actions require an explicit y. Unauthorized users are disabled (reversible) unless deletion is confirmed.
• IPv6 DisabledComponents set to the documented 0xFF instead of 0xFFFFFFFF (invalid; causes boot delays).
• secedit config files are written back as UTF-16 (secedit's export encoding) instead of ANSI, to a temp path instead of C:\.

Performance (run time cut substantially)

• All prompts moved to the start — after ~60s of questions the script runs unattended instead of stalling on scattered Read-Host calls between slow stages.
• One secedit export/apply pass instead of three (complexity, reversible encryption, URA now share it); redundant net accounts calls dropped.
• One recursive scan of C:\Users instead of two, classified into media/images/suspicious afterward.
• Removed the synchronous Windows Update COM search (IsInstalled=0, can take 5+ min); replaced with a background UsoClient StartScan. The registry settings are what score.
• Removed both gpupdate /force calls (~30–60s each).
• One wildcard auditpol call (/category:* /success:enable /failure:enable) replaces 18 calls plus an interactive prompt — setting both satisfies every Success/Failure variant seen in answer keys.
• Services/features are checked for existence first (one Get-Service / Get-WindowsOptionalFeature call) instead of ~50 blind sc.exe spawns and unconditional dism runs.
• ~55 hardcoded netsh firewall lines became a data-driven, idempotent New-NetFirewallRule loop, and LOLBin blocking is optional (it isn't scored in any reviewed key).

New coverage (items answer keys score that the script didn't touch)

• Installed-program audit: inventories registry uninstall keys and flags ~35 commonly prohibited apps (Wireshark, CCleaner, TeamViewer, netcat, ophcrack, AnyDesk, torrent clients, …) with uninstall strings. "Removed " appears in essentially every answer key.
• Persistence/backdoor report: Run/RunOnce keys, startup folders, non-Microsoft scheduled tasks, listening TCP ports with owning process, non-default SMB shares, hosts file entries — covers scored items like "netcat backdoor removed", "PowerShell script persistence removed", "File share X disabled".
• Suspicious-file flagging (files named password/credit, .pcap, loose .exes in profiles) — reported, not auto-deleted, since these are often forensics evidence.
• Added scored settings: prevent users installing printer drivers, disable print-driver download over HTTP, no shutdown without logon, shell protocol protected mode, FIPS algorithms, LmCompatibilityLevel=5 + NoLMHash, WDigest off, WinRM AllowRemoteShellAccess=0, PowerShell 2.0 removal, Defender cloud/network protection + PUA, RDP SecurityLayer=2 (SSL — was 1/Negotiate), account lockout duration, password history 24, missing-authorized-user creation, Xbox/Fax/Spooler service handling.
• Closing manual checklist for what a script can't do: forensics questions first, README groups, third-party app updates, Windows Update, reboot.

Testing

• Script parses clean under PowerShell 5.1 (Parser::ParseFile, zero errors).
• ⚠️ Not yet executed on a live competition image — please run on a practice VM before using in a scored round.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@Felipezwp, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 50 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e723b25f-43e9-4e61-a80f-35e6e4a1b305

📥 Commits

Reviewing files that changed from the base of the PR and between 5e1d4fe and c49718f.

📒 Files selected for processing (1)

• windows/windows.ps1

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted.

Error details

putComment timed out

[Felipezwp]

Pushed a second commit that makes round-specific decisions README-driven, since every round's README differs (e.g. one Server 2022 round required Wireshark, IIS, RDP, and MailEnable to stay, and forbade touching the IME_ADMIN/IME_USER accounts — the previous flagging/password logic would have cost points there):

• New up-front prompts for README exemptions: untouchable accounts (never removed/demoted/password-reset), critical services (never stopped, ensured running), and required software (excluded from prohibited-app flagging, with a reminder to update instead of remove).
• The script now refuses to touch any service matching CCS/CyberPatriot — tampering with the scoring client kills scoring feedback.
• Added sabotage checks informed by scoring-engine research and community guides: Defender exclusion paths/extensions/processes report, DisableCMD/DisableTaskMgr/DisableRegistryTools auto-fix, and a gpresult baseline snapshot before changes.
• Mail server split into its own question instead of being coupled to the web-server choice; Security Center (wscsvc) ensured running.

General policy items (password age/length/lockout, audit policy, UAC, SMB signing, etc.) stay unconditional since those score the same every round.

🤖 Generated with Claude Code