# Run powershell as administrator and run these commands

# 1. Define known ScreenConnect service wildcard strings and process names
$ServicePatterns = @("*ScreenConnect*", "*ConnectWise*")
$ProcessNames    = @("ScreenConnect.ClientService", "ScreenConnect.Client", "ScreenConnect.WindowsClient")

Write-Host "=== SCREENCONNECT ALL-INSTANCE TERMINATION SCRIPT ===" -ForegroundColor Cyan

# 2. Enumerate, disable, and kill matching background system services
Write-Host "`n[+] Scanning and disabling services..." -ForegroundColor Windows
foreach ($Pattern in $ServicePatterns) {
    $Services = Get-Service -Name $Pattern -ErrorAction SilentlyContinue
    if ($Services) {
        foreach ($Service in $Services) {
            Write-Host " -> Found Service: $($Service.Name) [Current Status: $($Service.Status)]" -ForegroundColor Yellow
            
            # Change startup to Disabled so it cannot restart automatically on a reboot
            Set-Service -Name $Service.Name -StartupType Disabled -Confirm:$false -ErrorAction SilentlyContinue
            
            # Forcibly stop the service
            Stop-Service -Name $Service.Name -Force -Confirm:$false -ErrorAction SilentlyContinue
            Write-Host "    [!] Disabled and commanded to stop." -ForegroundColor Red
        }
    }
}

# 3. Forcibly kill any lingering active processes
Write-Host "`n[+] Hunting for active client processes..." -ForegroundColor Windows
foreach ($ProcName in $ProcessNames) {
    $RunningProcs = Get-Process -Name $ProcName -ErrorAction SilentlyContinue
    if ($RunningProcs) {
        foreach ($Proc in $RunningProcs) {
            Write-Host " -> Found Running Process: $($Proc.Name) (PID: $($Proc.Id))" -ForegroundColor Yellow
            Stop-Process -Id $Proc.Id -Force -ErrorAction SilentlyContinue
            Write-Host "    [!] Process terminated successfully." -ForegroundColor Red
        }
    }
}

# 4. Final verification output
Write-Host "`n=== POST-REMEDIATION CHECK ===" -ForegroundColor Cyan
$FinalServices = Get-Service -Name $ServicePatterns -ErrorAction SilentlyContinue
$FinalProcesses = Get-Process -Name $ProcessNames -ErrorAction SilentlyContinue

if (-not $FinalServices -and -not $FinalProcesses) {
    Write-Host "[✓] Success: No active ScreenConnect services or processes detected." -ForegroundColor Green
} else {
    if ($FinalServices) {
        Write-Host "[!] Warning: The following services are still present on the system:" -ForegroundColor Yellow
        $FinalServices | Select-Object Name, Status, StartType | Format-Table -AutoSize
    }
    if ($FinalProcesses) {
        Write-Host "[!] Critical: The following processes could not be stopped:" -ForegroundColor Red
        $FinalProcesses | Select-Object Name, Id | Format-Table -AutoSize
    }
}


# Define all known ScreenConnect executable files
$executables = @(
    "screenconnect.exe",
    "ScreenConnect.Client.exe",
    "ScreenConnect.ClientService.exe",
    "ScreenConnect.WindowsClient.exe",
    "ScreenConnect.Service.exe"
)

# Base path for Image File Execution Options
$basePath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"

# The alert message payload using native msg.exe
$msgPayload = 'msg * "The execution of ScreenConnect has been blocked by security policies."'

# Loop through each executable and apply the restriction
foreach ($exe in $executables) {
    $targetPath = Join-Path $basePath $exe
    
    # Ensure the registry key exists
    if (-not (Test-Path $targetPath)) {
        New-Item -Path $targetPath -Force | Out-Null
    }
    
    # Set the Debugger property to intercept execution with the message
    New-ItemProperty -Path $targetPath -Name "Debugger" -Value $msgPayload -PropertyType String -Force | Out-Null
    
    Write-Host "[Blocked] Applied restriction to: $exe" -ForegroundColor Cyan
}

Write-Host "`nAll ScreenConnect application blocks have been successfully configured." -ForegroundColor Green



Write-Host "=== CHROME NOTIFICATION LOCKDOWN SCRIPT ===" -ForegroundColor Cyan

# 1. Enforce Chrome Enterprise Registry Policy (Blocks future prompt requests globally)
Write-Host "[+] Configuring Registry Policies to block notifications..." -ForegroundColor Windows
$RegistryPaths = @(
    "HKLM:\SOFTWARE\Policies\Google\Chrome",
    "HKCU:\SOFTWARE\Policies\Google\Chrome"
)

foreach ($RegPath in $RegistryPaths) {
    if (-not (Test-Path $RegPath)) {
        New-Item -Path $RegPath -Force | Out-Null
    }
    # Value 2 = "Do not allow any site to show desktop notifications"
    New-ItemProperty -Path $RegPath -Name "DefaultNotificationsSetting" -Value 2 -PropertyType DWord -Force | Out-Null
}
Write-Host " -> Registry policy applied: Notifications set to 'Block globally'." -ForegroundColor Green


# 2. Close running Chrome processes to safely edit local configuration databases
Write-Host "`n[+] Terminating running Google Chrome instances to apply changes..." -ForegroundColor Windows
$ChromeProcesses = Get-Process -Name "chrome" -ErrorAction SilentlyContinue
if ($ChromeProcesses) {
    Stop-Process -Name "chrome" -Force
    Start-Sleep -Seconds 2
    Write-Host " -> Chrome processes closed." -ForegroundColor Yellow
}


# 3. Locate and purge existing notification permissions in User Profiles
Write-Host "`n[+] Scanning and cleaning local Chrome profile preferences..." -ForegroundColor Windows
$UserProfilesDir = "C:\Users"
$Users = Get-ChildItem -Path $UserProfilesDir -Directory

foreach ($User in $Users) {
    $ChromeDataPath = "$UserProfilesDir\$($User.Name)\AppData\Local\Google\Chrome\User Data"
    
    if (Test-Path $ChromeDataPath) {
        Write-Host " -> Found Chrome Data for user: $($User.Name)" -ForegroundColor Cyan
        
        # Target default profile and any additional sub-profiles (Profile 1, Profile 2, etc.)
        $Profiles = Get-ChildItem -Path $ChromeDataPath -Directory | Where-Object { $_.Name -eq "Default" -or $_.Name -like "Profile*" }
        
        foreach ($Profile in $Profiles) {
            $PrefFile = "$($Profile.FullName)\Preferences"
            
            if (Test-Path $PrefFile) {
                try {
                    # Read the Preferences JSON file
                    $PrefJson = Get-Content -Raw -Path $PrefFile | ConvertFrom-Json
                    
                    # Target and wipe out the notifications permissions block if it exists
                    if ($PrefJson.profile -and $PrefJson.profile.content_settings -and $PrefJson.profile.content_settings.exceptions) {
                        if ($PrefJson.profile.content_settings.exceptions.notifications) {
                            # Clear the notification exceptions object completely
                            $PrefJson.profile.content_settings.exceptions.notifications = New-Object PSObject
                            
                            # Save the modified JSON back to disk cleanly
                            $PrefJson | ConvertTo-Json -Depth 100 | Set-Content -Path $PrefFile -Force
                            Write-Host "    [✓] Reset notification exceptions in profile: $($Profile.Name)" -ForegroundColor Green
                        }
                    }
                }
                catch {
                    Write-Host "    [!] Error modifying file for $($User.Name) ($($Profile.Name)): $_" -ForegroundColor Red
                }
            }
        }
    }
}

Write-Host "`n=== RECONFIG COMPLETE ===" -ForegroundColor Cyan
Write-Host "Chrome notifications have been cleared out and hard-blocked via registry policies." -ForegroundColor Green


Write-Host "=== MICROSOFT EDGE NOTIFICATION LOCKDOWN SCRIPT ===" -ForegroundColor Cyan

# 1. Enforce Edge Enterprise Registry Policy (Blocks future prompt requests globally)
Write-Host "[+] Configuring Registry Policies to block notifications..." -ForegroundColor Windows
$RegistryPaths = @(
    "HKLM:\SOFTWARE\Policies\Microsoft\Edge",
    "HKCU:\SOFTWARE\Policies\Microsoft\Edge"
)

foreach ($RegPath in $RegistryPaths) {
    if (-not (Test-Path $RegPath)) {
        New-Item -Path $RegPath -Force | Out-Null
    }
    # Value 2 = "Do not allow any site to show desktop notifications"
    New-ItemProperty -Path $RegPath -Name "DefaultNotificationsSetting" -Value 2 -PropertyType DWord -Force | Out-Null
}
Write-Host " -> Registry policy applied: Notifications set to 'Block globally'." -ForegroundColor Green


# 2. Close running Edge processes to safely edit local configuration databases
Write-Host "`n[+] Terminating running Microsoft Edge instances to apply changes..." -ForegroundColor Windows
$EdgeProcesses = Get-Process -Name "msedge" -ErrorAction SilentlyContinue
if ($EdgeProcesses) {
    Stop-Process -Name "msedge" -Force
    Start-Sleep -Seconds 2
    Write-Host " -> Edge processes closed." -ForegroundColor Yellow
}


# 3. Locate and purge existing notification permissions in User Profiles
Write-Host "`n[+] Scanning and cleaning local Edge profile preferences..." -ForegroundColor Windows
$UserProfilesDir = "C:\Users"
$Users = Get-ChildItem -Path $UserProfilesDir -Directory

foreach ($User in $Users) {
    $EdgeDataPath = "$UserProfilesDir\$($User.Name)\AppData\Local\Microsoft\Edge\User Data"
    
    if (Test-Path $EdgeDataPath) {
        Write-Host " -> Found Edge Data for user: $($User.Name)" -ForegroundColor Cyan
        
        # Target default profile and any additional sub-profiles (Profile 1, Profile 2, etc.)
        $Profiles = Get-ChildItem -Path $EdgeDataPath -Directory | Where-Object { $_.Name -eq "Default" -or $_.Name -like "Profile*" }
        
        foreach ($Profile in $Profiles) {
            $PrefFile = "$($Profile.FullName)\Preferences"
            
            if (Test-Path $PrefFile) {
                try {
                    # Read the Preferences JSON file
                    $PrefJson = Get-Content -Raw -Path $PrefFile | ConvertFrom-Json
                    
                    # Target and wipe out the notifications permissions block if it exists
                    if ($PrefJson.profile -and $PrefJson.profile.content_settings -and $PrefJson.profile.content_settings.exceptions) {
                        if ($PrefJson.profile.content_settings.exceptions.notifications) {
                            # Clear the notification exceptions object completely
                            $PrefJson.profile.content_settings.exceptions.notifications = New-Object PSObject
                            
                            # Save the modified JSON back to disk cleanly
                            $PrefJson | ConvertTo-Json -Depth 100 | Set-Content -Path $PrefFile -Force
                            Write-Host "    [✓] Reset notification exceptions in profile: $($Profile.Name)" -ForegroundColor Green
                        }
                    }
                }
                catch {
                    Write-Host "    [!] Error modifying file for $($User.Name) ($($Profile.Name)): $_" -ForegroundColor Red
                }
            }
        }
    }
}

Write-Host "`n=== RECONFIG COMPLETE ===" -ForegroundColor Cyan
Write-Host "Edge notifications have been cleared out and hard-blocked via registry policies." -ForegroundColor Green

Write-Host "=== MOZILLA FIREFOX NOTIFICATION LOCKDOWN SCRIPT ===" -ForegroundColor Cyan

# 1. Enforce Firefox Enterprise Registry Policy (Blocks future prompt requests globally)
Write-Host "[+] Configuring Registry Policies to block notifications..." -ForegroundColor Windows
$RegistryPaths = @(
    "HKLM:\SOFTWARE\Policies\Mozilla\Firefox\Permissions\Notifications",
    "HKCU:\SOFTWARE\Policies\Mozilla\Firefox\Permissions\Notifications"
)

foreach ($RegPath in $RegistryPaths) {
    if (-not (Test-Path $RegPath)) {
        New-Item -Path $RegPath -Force | Out-Null
    }
    # BlockNewRequests = 1 disables the prompt completely
    New-ItemProperty -Path $RegPath -Name "BlockNewRequests" -Value 1 -PropertyType DWord -Force | Out-Null
}
Write-Host " -> Registry policy applied: New notification requests are hard-blocked globally." -ForegroundColor Green


# 2. Close running Firefox processes to safely edit local databases
Write-Host "`n[+] Terminating running Mozilla Firefox instances to apply changes..." -ForegroundColor Windows
$FFProcesses = Get-Process -Name "firefox" -ErrorAction SilentlyContinue
if ($FFProcesses) {
    Stop-Process -Name "firefox" -Force
    Start-Sleep -Seconds 2
    Write-Host " -> Firefox processes closed." -ForegroundColor Yellow
}


# 3. Locate and purge existing notification permissions in User Profiles
Write-Host "`n[+] Scanning and cleaning local Firefox profile permissions..." -ForegroundColor Windows
$UserProfilesDir = "C:\Users"
$Users = Get-ChildItem -Path $UserProfilesDir -Directory

foreach ($User in $Users) {
    $FFDataPath = "$UserProfilesDir\$($User.Name)\AppData\Roaming\Mozilla\Firefox\Profiles"
    
    if (Test-Path $FFDataPath) {
        Write-Host " -> Found Firefox Data for user: $($User.Name)" -ForegroundColor Cyan
        
        # Target all Firefox user profiles (.default, .default-release, etc.)
        $Profiles = Get-ChildItem -Path $FFDataPath -Directory
        
        foreach ($Profile in $Profiles) {
            $PermsFile = "$($Profile.FullName)\permissions.sqlite"
            
            if (Test-Path $PermsFile) {
                try {
                    # Firefox locks its permissions inside a SQLite database. 
                    # We can use an embedded PowerShell fallback to clear the notification type or delete the file entirely if it corrupts.
                    # This direct string/byte match approach purges historical notification permissions.
                    
                    # Alternatively, if you want a clean slate for the profile, we clear the permissions table using a quick script mechanism
                    # Since editing live SQLite via raw PowerShell without external assemblies is risky, we rename/re-initialize the permission DB.
                    # Firefox automatically regenerates a completely clean permissions.sqlite file upon next startup.
                    
                    Remove-Item -Path $PermsFile -Force -ErrorAction SilentlyContinue
                    Write-Host "    [✓] Purged and reset permission database for profile: $($Profile.Name)" -ForegroundColor Green
                }
                catch {
                    Write-Host "    [!] Error removing file for $($User.Name) ($($Profile.Name)): $_" -ForegroundColor Red
                }
            }
        }
    }
}

Write-Host "`n=== RECONFIG COMPLETE ===" -ForegroundColor Cyan
Write-Host "Firefox notifications have been cleared out and hard-blocked via registry policies." -ForegroundColor Green

# 1. Define known AnyDesk service wildcard strings and process names
$ServicePatterns = @("*AnyDesk*")
$ProcessNames    = @("AnyDesk", "AnyDeskService")

Write-Host "=== ANYDESK ALL-INSTANCE TERMINATION SCRIPT ===" -ForegroundColor Cyan

# 2. Enumerate, disable, and kill matching background system services
Write-Host "`n[+] Scanning and disabling services..." -ForegroundColor White
foreach ($Pattern in $ServicePatterns) {
    $Services = Get-Service -Name $Pattern -ErrorAction SilentlyContinue
    if ($Services) {
        foreach ($Service in $Services) {
            Write-Host " -> Found Service: $($Service.Name) [Current Status: $($Service.Status)]" -ForegroundColor Yellow
            
            # Change startup to Disabled so it cannot restart automatically on a reboot
            Set-Service -Name $Service.Name -StartupType Disabled -Confirm:$false -ErrorAction SilentlyContinue
            
            # Forcibly stop the service
            Stop-Service -Name $Service.Name -Force -Confirm:$false -ErrorAction SilentlyContinue
            Write-Host "    [!] Disabled and commanded to stop." -ForegroundColor Red
        }
    }
}

# 3. Forcibly kill any lingering active processes
Write-Host "`n[+] Hunting for active client processes..." -ForegroundColor White
foreach ($ProcName in $ProcessNames) {
    $RunningProcs = Get-Process -Name $ProcName -ErrorAction SilentlyContinue
    if ($RunningProcs) {
        foreach ($Proc in $RunningProcs) {
            Write-Host " -> Found Running Process: $($Proc.Name) (PID: $($Proc.Id))" -ForegroundColor Yellow
            Stop-Process -Id $Proc.Id -Force -ErrorAction SilentlyContinue
            Write-Host "    [!] Process terminated successfully." -ForegroundColor Red
        }
    }
}

# 4. Final verification output
Write-Host "`n=== POST-REMEDIATION CHECK ===" -ForegroundColor Cyan
$FinalServices = Get-Service -Name $ServicePatterns -ErrorAction SilentlyContinue
$FinalProcesses = Get-Process -Name $ProcessNames -ErrorAction SilentlyContinue

if (-not $FinalServices -and -not $FinalProcesses) {
    Write-Host "[✓] Success: No active AnyDesk services or processes detected." -ForegroundColor Green
} else {
    if ($FinalServices) {
        Write-Host "[!] Warning: The following services are still present on the system:" -ForegroundColor Yellow
        $FinalServices | Select-Object Name, Status, StartType | Format-Table -AutoSize
    }
    if ($FinalProcesses) {
        Write-Host "[!] Critical: The following processes could not be stopped:" -ForegroundColor Red
        $FinalProcesses | Select-Object Name, Id | Format-Table -AutoSize
    }
}


# Define all known AnyDesk executable files
$executables = @(
    "AnyDesk.exe",
    "AnyDesk_update.exe"
)

# Base path for Image File Execution Options
$basePath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"

# The alert message payload using native msg.exe
$msgPayload = 'msg * "The execution of AnyDesk has been blocked by security policies."'

# Loop through each executable and apply the restriction
foreach ($exe in $executables) {
    $targetPath = Join-Path $basePath $exe
    
    # Ensure the registry key exists
    if (-not (Test-Path $targetPath)) {
        New-Item -Path $targetPath -Force | Out-Null
    }
    
    # Set the Debugger property to intercept execution with the message
    New-ItemProperty -Path $targetPath -Name "Debugger" -Value $msgPayload -PropertyType String -Force | Out-Null
    
    Write-Host "[Blocked] Applied restriction to: $exe" -ForegroundColor Cyan
}

Write-Host "`nAll AnyDesk application blocks have been successfully configured." -ForegroundColor Green

# 1. Define known TeamViewer service wildcard strings and process names
$ServicePatterns = @("*TeamViewer*")
$ProcessNames    = @("TeamViewer", "TeamViewer_Service", "tv_w32", "tv_x64")

Write-Host "=== TEAMVIEWER ALL-INSTANCE TERMINATION SCRIPT ===" -ForegroundColor Cyan

# 2. Enumerate, disable, and kill matching background system services
Write-Host "`n[+] Scanning and disabling services..." -ForegroundColor White
foreach ($Pattern in $ServicePatterns) {
    $Services = Get-Service -Name $Pattern -ErrorAction SilentlyContinue
    if ($Services) {
        foreach ($Service in $Services) {
            Write-Host " -> Found Service: $($Service.Name) [Current Status: $($Service.Status)]" -ForegroundColor Yellow
            
            # Change startup to Disabled so it cannot restart automatically on a reboot
            Set-Service -Name $Service.Name -StartupType Disabled -Confirm:$false -ErrorAction SilentlyContinue
            
            # Forcibly stop the service
            Stop-Service -Name $Service.Name -Force -Confirm:$false -ErrorAction SilentlyContinue
            Write-Host "    [!] Disabled and commanded to stop." -ForegroundColor Red
        }
    }
}

# 3. Forcibly kill any lingering active processes
Write-Host "`n[+] Hunting for active client processes..." -ForegroundColor White
foreach ($ProcName in $ProcessNames) {
    $RunningProcs = Get-Process -Name $ProcName -ErrorAction SilentlyContinue
    if ($RunningProcs) {
        foreach ($Proc in $RunningProcs) {
            Write-Host " -> Found Running Process: $($Proc.Name) (PID: $($Proc.Id))" -ForegroundColor Yellow
            Stop-Process -Id $Proc.Id -Force -ErrorAction SilentlyContinue
            Write-Host "    [!] Process terminated successfully." -ForegroundColor Red
        }
    }
}

# 4. Final verification output
Write-Host "`n=== POST-REMEDIATION CHECK ===" -ForegroundColor Cyan
$FinalServices = Get-Service -Name $ServicePatterns -ErrorAction SilentlyContinue
$FinalProcesses = Get-Process -Name $ProcessNames -ErrorAction SilentlyContinue

if (-not $FinalServices -and -not $FinalProcesses) {
    Write-Host "[✓] Success: No active TeamViewer services or processes detected." -ForegroundColor Green
} else {
    if ($FinalServices) {
        Write-Host "[!] Warning: The following services are still present on the system:" -ForegroundColor Yellow
        $FinalServices | Select-Object Name, Status, StartType | Format-Table -AutoSize
    }
    if ($FinalProcesses) {
        Write-Host "[!] Critical: The following processes could not be stopped:" -ForegroundColor Red
        $FinalProcesses | Select-Object Name, Id | Format-Table -AutoSize
    }
}



# Define all known TeamViewer executable files
$executables = @(
    "TeamViewer_Service.exe",
    "TeamViewer.exe",
    "TeamViewer_Desktop.exe",
    "TeamViewerQS.exe",
    "TeamViewerQJ.exe",
    "tv_w32.exe",
    "tv_x64.exe",
    "TeamViewer_Setup.exe",
    "tv_host_setup.exe",
    "AssignmentTool.exe"
)

# Base path for Image File Execution Options
$basePath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"

# The alert message payload using native msg.exe
$msgPayload = 'msg * "The execution of TeamViewer has been blocked by security policies."'

# Loop through each executable and apply the restriction
foreach ($exe in $executables) {
    $targetPath = Join-Path $basePath $exe
    
    # Ensure the registry key exists
    if (-not (Test-Path $targetPath)) {
        New-Item -Path $targetPath -Force | Out-Null
    }
    
    # Set the Debugger property to intercept execution with the message
    New-ItemProperty -Path $targetPath -Name "Debugger" -Value $msgPayload -PropertyType String -Force | Out-Null
    
    Write-Host "[Blocked] Applied restriction to: $exe" -ForegroundColor Cyan
}

Write-Host "`nAll TeamViewer application blocks have been successfully configured." -ForegroundColor Green

# 1. Define known UltraViewer service wildcard strings and process names
$ServicePatterns = @("*UltraViewer*")
$ProcessNames    = @(
    "UltraViewer", 
    "UltraViewer_Service", 
    "UltraViewer_Desktop", 
    "uv_printer", 
    "UltraViewer_Printer", 
    "UltraViewer_Portable"
)

Write-Host "=== ULTRAVIEWER ALL-INSTANCE TERMINATION SCRIPT ===" -ForegroundColor Cyan

# 2. Enumerate, disable, and kill matching background system services
Write-Host "`n[+] Scanning and disabling services..." -ForegroundColor White
foreach ($Pattern in $ServicePatterns) {
    $Services = Get-Service -Name $Pattern -ErrorAction SilentlyContinue
    if ($Services) {
        foreach ($Service in $Services) {
            Write-Host " -> Found Service: $($Service.Name) [Current Status: $($Service.Status)]" -ForegroundColor Yellow
            
            # Change startup to Disabled so it cannot restart automatically on a reboot
            Set-Service -Name $Service.Name -StartupType Disabled -Confirm:$false -ErrorAction SilentlyContinue
            
            # Forcibly stop the service
            Stop-Service -Name $Service.Name -Force -Confirm:$false -ErrorAction SilentlyContinue
            Write-Host "    [!] Disabled and commanded to stop." -ForegroundColor Red
        }
    }
}

# 3. Forcibly kill any lingering active processes
Write-Host "`n[+] Hunting for active client processes..." -ForegroundColor White
foreach ($ProcName in $ProcessNames) {
    $RunningProcs = Get-Process -Name $ProcName -ErrorAction SilentlyContinue
    if ($RunningProcs) {
        foreach ($Proc in $RunningProcs) {
            Write-Host " -> Found Running Process: $($Proc.Name) (PID: $($Proc.Id))" -ForegroundColor Yellow
            Stop-Process -Id $Proc.Id -Force -ErrorAction SilentlyContinue
            Write-Host "    [!] Process terminated successfully." -ForegroundColor Red
        }
    }
}

# 4. Final verification output
Write-Host "`n=== POST-REMEDIATION CHECK ===" -ForegroundColor Cyan
$FinalServices = Get-Service -Name $ServicePatterns -ErrorAction SilentlyContinue
$FinalProcesses = Get-Process -Name $ProcessNames -ErrorAction SilentlyContinue

if (-not $FinalServices -and -not $FinalProcesses) {
    Write-Host "[✓] Success: No active UltraViewer services or processes detected." -ForegroundColor Green
} else {
    if ($FinalServices) {
        Write-Host "[!] Warning: The following services are still present on the system:" -ForegroundColor Yellow
        $FinalServices | Select-Object Name, Status, StartType | Format-Table -AutoSize
    }
    if ($FinalProcesses) {
        Write-Host "[!] Critical: The following processes could not be stopped:" -ForegroundColor Red
        $FinalProcesses | Select-Object Name, Id | Format-Table -AutoSize
    }
}




# Define all known UltraViewer executable files and common installer variations
$executables = @(
    "UltraViewer_Service.exe",
    "UltraViewer.exe",
    "UltraViewer_Desktop.exe",
    "uv_printer.exe",
    "UltraViewer_Printer.exe",
    "UltraViewer_Portable.exe",
    "UltraViewer_setup_6.6_en.exe"
)

# Base path for Image File Execution Options
$basePath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"

# The alert message payload using native msg.exe
$msgPayload = 'msg * "The execution of UltraViewer has been blocked by security policies."'

# Loop through each executable and apply the restriction
foreach ($exe in $executables) {
    $targetPath = Join-Path $basePath $exe
    
    # Ensure the registry key exists
    if (-not (Test-Path $targetPath)) {
        New-Item -Path $targetPath -Force | Out-Null
    }
    
    # Set the Debugger property to intercept execution with the message
    New-ItemProperty -Path $targetPath -Name "Debugger" -Value $msgPayload -PropertyType String -Force | Out-Null
    
    Write-Host "[Blocked] Applied restriction to: $exe" -ForegroundColor Cyan
}

Write-Host "`nAll UltraViewer application blocks have been successfully configured." -ForegroundColor Green