|
|
本帖最后由 wuliyen 于 2026-8-8 10:26 编辑
PowerShell 命令 FAM 工具可让您检查你的 Windows 系统构建的各个方面。它包含众多测试模块,其中包括一个由 16 项独立检查组成的遥测测试情况。
运行完成,最后会给出评分,得分越高,说明遥测干掉的越彻底
遥测(Telemetry),通俗理解就是它会把机器内部看不见的运转状态,变成看得见的数字,实时报给微软
下载附件,去掉后缀svg
我的精简系统得分非常高
这段 PowerShell 代码是一个用于 Windows 系统深度审查和清理评估的脚本,主要用于检测系统中残留的“垃圾”应用、遥测组件、以及判断 Windows 版本是否为“伪造”或“精简”版本。
- 1. 代码检查或读取的文件/路径
- 这些是脚本在磁盘上进行读取或检查存在的文件/文件夹:
- 系统核心目录及文件:
- C:\Windows\Servicing\Packages (以及其中的 *.mum 文件)
- C:\Windows\System32\drivers\etc\hosts
- C:\Windows\System32\LogFiles\WMI\AutoLogger-Diagtrack-Listener.etl
- C:\Windows\System32\LogFiles\WMI\ (查找其他 Diagtrack 文件)
- C:\Windows\AppPatch\sysmain.sdb
- C:\Windows\AppPatch\PCW.sdb
- C:\Windows\AppPatch\CustomSDB
- C:\Windows\appcompat\appraiser\Appraiser_AlicenseHash.sdb
- C:\Windows\appcompat\appraiser\ (目录)
- 程序与二进制文件路径:
- C:\Windows\System32\OneDriveSetup.exe
- C:\Windows\SysWOW64\OneDriveSetup.exe
- C:\Program Files\Microsoft OneDrive\OneDrive.exe
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
- C:\Program Files\Windows Defender (目录)
- C:\Program Files\WindowsApps (目录)
- C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- C:\Windows\System32\MsSense.exe
- C:\Windows\System32\CompatTelRunner.exe
- C:\Windows\System32\DeviceCensus.exe
- C:\Windows\System32\diaghost.exe
- C:\Windows\System32\wsqmcons.exe
- C:\Windows\System32\TelemetryClient.exe
- 用户数据与日志目录:
- %ProgramData%\Microsoft\Diagnosis\ETLLogs\AutoLogger\ (以及其中的 *.etl 文件)
- %ProgramData%\Microsoft\Diagnosis\DownloadedSettings
- %ProgramData%\Microsoft\Diagnosis\FeedbackHub
- %ProgramData%\Microsoft\Diagnosis\Scenarios
- %ProgramData%\Microsoft\Diagnosis\Store
- %LOCALAPPDATA%\CoreAIPlatform.00\UKP (Windows Recall 快照存储)
- 2. 代码检查或读取的注册表项
- 脚本广泛读取了以下注册表路径及其下的键值,主要用于检测系统设置、版本信息和遥测策略:
- 系统版本信息:
- HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion (读取 EditionID, ProductName, CurrentBuild, DisplayVersion, CompositionEditionID, InstallationType, UBR)
- 组件服务 (CBS):
- HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages (枚举其下的子项)
- 服务配置 (Start 类型等):
- HKLM:\SYSTEM\ControlSet001\Services\DiagTrack
- HKLM:\SYSTEM\ControlSet001\Services\dmwappushservice
- HKLM:\SYSTEM\ControlSet001\Services\Dnscache
- HKLM:\SYSTEM\ControlSet001\Services\Sense
- HKLM:\SYSTEM\ControlSet001\Services\NlaSvc
- 策略与配置 (遥测、隐私、Defender):
- HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection (读取 AllowTelemetry, AllowDeviceNameInTelemetry, LimitDiagnosticLogCollection, DisableOneSettingsDownloads 等)
- HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection (读取 DoNotShowFeedbackNotifications)
- HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent (读取 DisableWindowsConsumerFeatures)
- HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting (读取 Disabled)
- HKLM:\SOFTWARE\Microsoft\SQMClient\Windows (读取 CEIPEnable)
- HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot (读取 TurnOffWindowsCopilot)
- HKLM:\SOFTWARE\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator (读取 NoActiveProbe)
- HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors (读取 DisableLocation)
- Windows 功能 (Recall, Copilot, AI):
- HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsAI (读取 EnableWindowsRecall)
- HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsAI (读取 SnapNowEnabled)
- HKLM:\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Teredo (读取 Type)
- 隐私与用户活动:
- HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\AdvertisingInfo (读取 Enabled)
- HKLM:\SOFTWARE\Policies\Microsoft\Windows\System (读取 PublishUserActivities, UploadUserActivities)
- HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Sensor\Overrides\{BFA794E4-F964-4FDB-90F6-51056BFE4B44} (读取 SensorPermissionState)
- 诊断与遥测控制器:
- HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController
- HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Appraiser\GwxTriggers
- Defender 相关:
- HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender (读取 DisableAntiSpyware, DisableAntiVirus, DisableRealtimeMonitoring)
- HKLM:\SOFTWARE\Microsoft\Windows Defender\Spynet (读取 SpynetReporting)
- 自动日志 (ETW):
- HKLM:\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DiagTrack-Listener (读取 Start)
复制代码
|
评分
-
查看全部评分
|