# 1. Define known ScreenConnect service wildcard strings
$ServicePatterns = @("*ScreenConnect*", "*ConnectWise*")

Write-Host "=== SCREENCONNECT ALL-INSTANCE RESTORATION SCRIPT ===" -ForegroundColor Cyan

# 2. Enumerate, enable, and start matching background system services
Write-Host "`n[+] Scanning and restoring services..." -ForegroundColor Windows
foreach ($Pattern in $ServicePatterns) {
    $Services = Get-Service -Name $Pattern -ErrorAction SilentlyContinue
    if ($Services) {
        foreach ($Service in $Services) {
            Write-Host " -> Found Service: $($Service.Name) [Current Status: $($Service.Status)]" -ForegroundColor Yellow
            
            # Change startup back to Automatic so it runs normally on reboot
            Set-Service -Name $Service.Name -StartupType Automatic -Confirm:$false -ErrorAction SilentlyContinue
            Write-Host "    [✓] Startup type restored to Automatic." -ForegroundColor Green
            
            # Start the service back up
            Start-Service -Name $Service.Name -ErrorAction SilentlyContinue
            Write-Host "    [✓] Service commanded to Start." -ForegroundColor Green
        }
    } else {
        Write-Host "No services matching '$Pattern' found to restore." -ForegroundColor Gray
    }
}

# 3. Final verification output
Write-Host "`n=== POST-RESTORATION CHECK ===" -ForegroundColor Cyan
$FinalServices = Get-Service -Name $ServicePatterns -ErrorAction SilentlyContinue

if ($FinalServices) {
    Write-Host "[+] Current status of restored services:" -ForegroundColor Quick
    $FinalServices | Select-Object Name, Status, StartType | Format-Table -AutoSize
} else {
    Write-Host "[!] No ScreenConnect or ConnectWise services were found on this system." -ForegroundColor Red
}

Write-Host "Script execution completed." -ForegroundColor Green



# Define all ScreenConnect executable files used in the previous steps
$executables = @(
    "screenconnect.exe",
    "ScreenConnect.Client.exe",
    "ScreenConnect.ClientService.exe",
    "ScreenConnect.WindowsClient.exe",
    "ScreenConnect.Service.exe"
)

# Base path for Image File Execution Options
$basePath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"

# Loop through each executable name and completely delete its IFEO block key
foreach ($exe in $executables) {
    $targetPath = Join-Path $basePath $exe
    
    # Check if the registry key exists before attempting deletion
    if (Test-Path $targetPath) {
        Remove-Item -Path $targetPath -Force -Recurse
        Write-Host "[Restored] Removed all blocks and payloads for: $exe" -ForegroundColor Green
    } else {
        Write-Host "[Clean] No registry block found for: $exe" -ForegroundColor Gray
    }
}

Write-Host "`nAll ScreenConnect registry blocks have been successfully removed." -ForegroundColor Green

Write-Host "=== CHROME NOTIFICATION RESTORATION SCRIPT ===" -ForegroundColor Cyan

# 1. Remove Chrome Enterprise Registry Policy (Restores user control over prompts)
Write-Host "[+] Removing Registry Policies to unblock notification settings..." -ForegroundColor Windows
$RegistryPaths = @(
    "HKLM:\SOFTWARE\Policies\Google\Chrome",
    "HKCU:\SOFTWARE\Policies\Google\Chrome"
)

foreach ($RegPath in $RegistryPaths) {
    if (Test-Path $RegPath) {
        # Check if the specific configuration value exists
        if (Get-ItemProperty -Path $RegPath -Name "DefaultNotificationsSetting" -ErrorAction SilentlyContinue) {
            Remove-ItemProperty -Path $RegPath -Name "DefaultNotificationsSetting" -Force -ErrorAction SilentlyContinue
            Write-Host " -> Removed 'DefaultNotificationsSetting' policy from: $RegPath" -ForegroundColor Green
        }
        
        # Clean up the Google\Chrome policy keys if they are now completely empty
        $SubKeys = Get-ChildItem -Path $RegPath -ErrorAction SilentlyContinue
        $Values = Get-ItemProperty -Path $RegPath -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty
        if (-not $SubKeys -and -not $Values) {
            Remove-Item -Path $RegPath -Force -ErrorAction SilentlyContinue
        }
    }
}


# 2. Close running Chrome processes to ensure settings apply cleanly
Write-Host "`n[+] Terminating running Google Chrome instances to apply changes..." -ForegroundColor Windows
$ChromeProcesses = Get-Process -Name "chrome" -ErrorAction SilentlyContinue
if ($ChromeProcesses) {
    Stop-Process -Name "chrome" -Force
    Start-Sleep -Seconds 2
    Write-Host " -> Chrome processes closed." -ForegroundColor Yellow
}

Write-Host "`n=== RECONFIG COMPLETE ===" -ForegroundColor Cyan
Write-Host "The global notification block has been removed. Chrome will now default back to asking the user for notification permissions." -ForegroundColor Green



Write-Host "=== MICROSOFT EDGE NOTIFICATION RESTORATION SCRIPT ===" -ForegroundColor Cyan

# 1. Remove Edge Enterprise Registry Policy (Restores user control over prompts)
Write-Host "[+] Removing Registry Policies to unblock notification settings..." -ForegroundColor Windows
$RegistryPaths = @(
    "HKLM:\SOFTWARE\Policies\Microsoft\Edge",
    "HKCU:\SOFTWARE\Policies\Microsoft\Edge"
)

foreach ($RegPath in $RegistryPaths) {
    if (Test-Path $RegPath) {
        # Check if the specific configuration value exists
        if (Get-ItemProperty -Path $RegPath -Name "DefaultNotificationsSetting" -ErrorAction SilentlyContinue) {
            Remove-ItemProperty -Path $RegPath -Name "DefaultNotificationsSetting" -Force -ErrorAction SilentlyContinue
            Write-Host " -> Removed 'DefaultNotificationsSetting' policy from: $RegPath" -ForegroundColor Green
        }
        
        # Clean up the Microsoft\Edge policy keys if they are now completely empty
        $SubKeys = Get-ChildItem -Path $RegPath -ErrorAction SilentlyContinue
        $Values = Get-ItemProperty -Path $RegPath -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty
        if (-not $SubKeys -and -not $Values) {
            Remove-Item -Path $RegPath -Force -ErrorAction SilentlyContinue
        }
    }
}


# 2. Close running Edge processes to ensure settings apply cleanly
Write-Host "`n[+] Terminating running Microsoft Edge instances to apply changes..." -ForegroundColor Windows
$EdgeProcesses = Get-Process -Name "msedge" -ErrorAction SilentlyContinue
if ($EdgeProcesses) {
    Stop-Process -Name "msedge" -Force
    Start-Sleep -Seconds 2
    Write-Host " -> Edge processes closed." -ForegroundColor Yellow
}

Write-Host "`n=== RECONFIG COMPLETE ===" -ForegroundColor Cyan
Write-Host "The global notification block has been removed. Edge will now default back to asking the user for notification permissions." -ForegroundColor Green


Write-Host "=== MOZILLA FIREFOX NOTIFICATION RESTORATION SCRIPT ===" -ForegroundColor Cyan

# 1. Remove Firefox Enterprise Registry Policy (Restores user control over prompts)
Write-Host "[+] Removing Registry Policies to unblock notification settings..." -ForegroundColor Windows
$RegistryPaths = @(
    "HKLM:\SOFTWARE\Policies\Mozilla\Firefox\Permissions\Notifications",
    "HKCU:\SOFTWARE\Policies\Mozilla\Firefox\Permissions\Notifications"
)

foreach ($RegPath in $RegistryPaths) {
    if (Test-Path $RegPath) {
        # Check if the specific configuration value exists
        if (Get-ItemProperty -Path $RegPath -Name "BlockNewRequests" -ErrorAction SilentlyContinue) {
            Remove-ItemProperty -Path $RegPath -Name "BlockNewRequests" -Force -ErrorAction SilentlyContinue
            Write-Host " -> Removed 'BlockNewRequests' policy from: $RegPath" -ForegroundColor Green
        }
        
        # Clean up empty parent policy keys recursively if they contain no other enterprise settings
        $CurrentPath = $RegPath
        while ($CurrentPath -ne "HKLM:\SOFTWARE\Policies" -and $CurrentPath -ne "HKCU:\SOFTWARE\Policies") {
            if (Test-Path $CurrentPath) {
                $SubKeys = Get-ChildItem -Path $CurrentPath -ErrorAction SilentlyContinue
                $Values = Get-ItemProperty -Path $CurrentPath -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty
                
                if (-not $SubKeys -and -not $Values) {
                    Remove-Item -Path $CurrentPath -Force -ErrorAction SilentlyContinue
                    # Move up one level to see if the parent is now also empty
                    $CurrentPath = Split-Path $CurrentPath
                } else {
                    break
                }
            } else {
                break
            }
        }
    }
}


# 2. Close running Firefox processes to ensure settings apply cleanly
Write-Host "`n[+] Terminating running Mozilla Firefox instances to apply changes..." -ForegroundColor Windows
$FFProcesses = Get-Process -Name "firefox" -ErrorAction SilentlyContinue
if ($FFProcesses) {
    Stop-Process -Name "firefox" -Force
    Start-Sleep -Seconds 2
    Write-Host " -> Firefox processes closed." -ForegroundColor Yellow
}

Write-Host "`n=== RECONFIG COMPLETE ===" -ForegroundColor Cyan
Write-Host "The global notification block has been removed. Firefox will now default back to asking the user for notification permissions." -ForegroundColor Green


# 1. Define known AnyDesk service wildcard strings
$ServicePatterns = @("*AnyDesk*")

Write-Host "=== ANYDESK ALL-INSTANCE RESTORATION SCRIPT ===" -ForegroundColor Cyan

# 2. Enumerate, enable, and start matching background system services
Write-Host "`n[+] Scanning and restoring services..." -ForegroundColor White
foreach ($Pattern in $ServicePatterns) {
    $Services = Get-Service -Name $Pattern -ErrorAction SilentlyContinue
    if ($Services) {
        foreach ($Service in $Services) {
            Write-Host " -> Found Service: $($Service.Name) [Current Status: $($Service.Status)]" -ForegroundColor Yellow
            
            # Change startup back to Automatic so it runs normally on reboot
            Set-Service -Name $Service.Name -StartupType Automatic -Confirm:$false -ErrorAction SilentlyContinue
            Write-Host "    [✓] Startup type restored to Automatic." -ForegroundColor Green
            
            # Start the service back up
            Start-Service -Name $Service.Name -ErrorAction SilentlyContinue
            Write-Host "    [✓] Service commanded to Start." -ForegroundColor Green
        }
    } else {
        Write-Host "No services matching '$Pattern' found to restore." -ForegroundColor Gray
    }
}

# 3. Final verification output
Write-Host "`n=== POST-RESTORATION CHECK ===" -ForegroundColor Cyan
$FinalServices = Get-Service -Name $ServicePatterns -ErrorAction SilentlyContinue

if ($FinalServices) {
    Write-Host "[+] Current status of restored services:" -ForegroundColor White
    $FinalServices | Select-Object Name, Status, StartType | Format-Table -AutoSize
} else {
    Write-Host "[!] No AnyDesk services were found on this system." -ForegroundColor Red
}

Write-Host "Script execution completed." -ForegroundColor Green



# Define all AnyDesk executable files used in the previous steps
$executables = @(
    "AnyDesk.exe",
    "AnyDesk_update.exe"
)

# Base path for Image File Execution Options
$basePath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"

# Loop through each executable name and completely delete its IFEO block key
foreach ($exe in $executables) {
    $targetPath = Join-Path $basePath $exe
    
    # Check if the registry key exists before attempting deletion
    if (Test-Path $targetPath) {
        Remove-Item -Path $targetPath -Force -Recurse
        Write-Host "[Restored] Removed all blocks and payloads for: $exe" -ForegroundColor Green
    } else {
        Write-Host "[Clean] No registry block found for: $exe" -ForegroundColor Gray
    }
}

Write-Host "`nAll AnyDesk registry blocks have been successfully removed." -ForegroundColor Green


# 1. Define known TeamViewer service wildcard strings
$ServicePatterns = @("*TeamViewer*")

Write-Host "=== TEAMVIEWER ALL-INSTANCE RESTORATION SCRIPT ===" -ForegroundColor Cyan

# 2. Enumerate, enable, and start matching background system services
Write-Host "`n[+] Scanning and restoring services..." -ForegroundColor White
foreach ($Pattern in $ServicePatterns) {
    $Services = Get-Service -Name $Pattern -ErrorAction SilentlyContinue
    if ($Services) {
        foreach ($Service in $Services) {
            Write-Host " -> Found Service: $($Service.Name) [Current Status: $($Service.Status)]" -ForegroundColor Yellow
            
            # Change startup back to Automatic so it runs normally on reboot
            Set-Service -Name $Service.Name -StartupType Automatic -Confirm:$false -ErrorAction SilentlyContinue
            Write-Host "    [✓] Startup type restored to Automatic." -ForegroundColor Green
            
            # Start the service back up
            Start-Service -Name $Service.Name -ErrorAction SilentlyContinue
            Write-Host "    [✓] Service commanded to Start." -ForegroundColor Green
        }
    } else {
        Write-Host "No services matching '$Pattern' found to restore." -ForegroundColor Gray
    }
}

# 3. Final verification output
Write-Host "`n=== POST-RESTORATION CHECK ===" -ForegroundColor Cyan
$FinalServices = Get-Service -Name $ServicePatterns -ErrorAction SilentlyContinue

if ($FinalServices) {
    Write-Host "[+] Current status of restored services:" -ForegroundColor White
    $FinalServices | Select-Object Name, Status, StartType | Format-Table -AutoSize
} else {
    Write-Host "[!] No TeamViewer services were found on this system." -ForegroundColor Red
}

Write-Host "Script execution completed." -ForegroundColor Green


# Define all TeamViewer executable files used in the previous steps
$executables = @(
    "TeamViewer_Service.exe",
    "TeamViewer.exe",
    "TeamViewer_Desktop.exe",
    "TeamViewerQS.exe",
    "TeamViewerQJ.exe",
    "tv_w32.exe",
    "tv_x64.exe",
    "TeamViewer_Setup.exe",
    "tv_host_setup.exe",
    "AssignmentTool.exe"
)

# Base path for Image File Execution Options
$basePath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"

# Loop through each executable name and completely delete its IFEO block key
foreach ($exe in $executables) {
    $targetPath = Join-Path $basePath $exe
    
    # Check if the registry key exists before attempting deletion
    if (Test-Path $targetPath) {
        Remove-Item -Path $targetPath -Force -Recurse
        Write-Host "[Restored] Removed all blocks and payloads for: $exe" -ForegroundColor Green
    } else {
        Write-Host "[Clean] No registry block found for: $exe" -ForegroundColor Gray
    }
}

Write-Host "`nAll TeamViewer registry blocks have been successfully removed." -ForegroundColor Green

# 1. Define the UltraViewer service wildcard pattern
$ServicePatterns = @("*UltraViewer*")

Write-Host "=== ULTRAVIEWER SERVICE RESTORATION SCRIPT ===" -ForegroundColor Cyan

# 2. Enumerate, re-enable, and start matching background system services
Write-Host "`n[+] Scanning and restoring services..." -ForegroundColor White
foreach ($Pattern in $ServicePatterns) {
    $Services = Get-Service -Name $Pattern -ErrorAction SilentlyContinue
    if ($Services) {
        foreach ($Service in $Services) {
            Write-Host " -> Found Service: $($Service.Name) [Current Status: $($Service.Status)]" -ForegroundColor Yellow
            
            # Change startup type back to Automatic so it persists through reboots
            Set-Service -Name $Service.Name -StartupType Automatic -Confirm:$false -ErrorAction SilentlyContinue
            Write-Host "    [✓] Startup type set to Automatic." -ForegroundColor Green
            
            # Start the background service back up
            if ($Service.Status -ne "Running") {
                Start-Service -Name $Service.Name -ErrorAction SilentlyContinue
                Write-Host "    [✓] Service started successfully." -ForegroundColor Green
            } else {
                Write-Host "    [-] Service was already running." -ForegroundColor Gray
            }
        }
    } else {
        Write-Host "[-] No matching UltraViewer services found to restore." -ForegroundColor Gray
    }
}

# 3. Final verification output
Write-Host "`n=== POST-RESTORATION CHECK ===" -ForegroundColor Cyan
$FinalServices = Get-Service -Name $ServicePatterns -ErrorAction SilentlyContinue

if ($FinalServices) {
    $FinalServices | Select-Object Name, Status, StartType | Format-Table -AutoSize
} else {
    Write-Host "[!] No UltraViewer services are present on this machine." -ForegroundColor Yellow
}




# Define all known UltraViewer executable files and common installer variations
$executables = @(
    "UltraViewer_Service.exe",
    "UltraViewer.exe",
    "UltraViewer_Desktop.exe",
    "uv_printer.exe",
    "UltraViewer_Printer.exe",
    "UltraViewer_Portable.exe",
    "UltraViewer_setup_6.6_en.exe"
)

# Base path for Image File Execution Options
$basePath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"

# The alert message payload using native msg.exe
$msgPayload = 'msg * "The execution of UltraViewer has been blocked by security policies."'

# Loop through each executable and apply the restriction
foreach ($exe in $executables) {
    $targetPath = Join-Path $basePath $exe
    
    # Ensure the registry key exists
    if (-not (Test-Path $targetPath)) {
        New-Item -Path $targetPath -Force | Out-Null
    }
    
    # Set the Debugger property to intercept execution with the message
    New-ItemProperty -Path $targetPath -Name "Debugger" -Value $msgPayload -PropertyType String -Force | Out-Null
    
    Write-Host "[Blocked] Applied restriction to: $exe" -ForegroundColor Cyan
}

Write-Host "`nAll UltraViewer application blocks have been successfully configured." -ForegroundColor Green


# Define all UltraViewer executable files and installer variations used in the previous steps
$executables = @(
    "UltraViewer_Service.exe",
    "UltraViewer.exe",
    "UltraViewer_Desktop.exe",
    "uv_printer.exe",
    "UltraViewer_Printer.exe",
    "UltraViewer_Portable.exe",
    "UltraViewer_setup_6.6_en.exe"
)

# Base path for Image File Execution Options
$basePath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"

# Loop through each executable name and completely delete its IFEO block key
foreach ($exe in $executables) {
    $targetPath = Join-Path $basePath $exe
    
    # Check if the registry key exists before attempting deletion
    if (Test-Path $targetPath) {
        Remove-Item -Path $targetPath -Force -Recurse
        Write-Host "[Restored] Removed all blocks and payloads for: $exe" -ForegroundColor Green
    } else {
        Write-Host "[Clean] No registry block found for: $exe" -ForegroundColor Gray
    }
}

Write-Host "`nAll UltraViewer registry blocks have been successfully removed." -ForegroundColor Green