DiagTrack、WinSAT、Application Experience、Diagnostic等服务或计划任务可能影响系统性能

1、在运行框或者cmd命令行里执行2种提权模式
提权有2种模式，可以2个级别都试试
【提权到trustedinstaller】
cmd命令行
cmd命令行
cmd命令行
AdvancedRun.exe /Clear /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /StartDirectory "C:\" /CommandLine "" /RunAs 8 /Run
【提权到system】
cmd命令行
cmd命令行
cmd命令行
AdvancedRun.exe /Clear /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /StartDirectory "C:\" /CommandLine "" /RunAs 4 /Run

2、提权打开的那个powershell窗口就是最高权限窗口，在这个窗口里执行命令
Get-ScheduledTask -TaskPath "\Microsoft\Windows\Power Efficiency Diagnostics\","\Microsoft\Windows\ApplicationData\","\Microsoft\Windows\Customer Experience Improvement Program\","\Microsoft\Windows\CloudExperienceHost\","\Microsoft\Windows\DiskFootprint\","\Microsoft\Windows\StateRepository\","\Microsoft\Windows\Application Experience\","\Microsoft\Windows\DiskDiagnostic\","\Microsoft\Windows\MemoryDiagnostic\","\Microsoft\Windows\WDI\","\Microsoft\Windows\UpdateOrchestrator\","\Microsoft\Windows\WindowsUpdate\","\Microsoft\Windows\Diagnosis\","\Microsoft\Windows\Network Controller\","\Microsoft\Windows\PI\","\Microsoft\Windows\DiskCleanup\","\Microsoft\Windows\TPM\","\Microsoft\Windows\Windows Defender\","\Microsoft\Windows\Maintenance\" 2>$null | Disable-ScheduledTask 2>$null | Sort-Object -Property State | ft -auto

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v DisablePCA /t REG_DWORD /d 1 /f
Stop-Service -Name PcaSvc 2>$null
Set-Service -Name PcaSvc -StartupType Disabled 2>$null
Get-ScheduledTask | Where-Object { $_.TaskName -like "*ProgramDataUpdater*"}| Disable-ScheduledTask 2>$null

if((Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").ProductName -match "2012 R2|Windows 8.1"){
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration" /v "PreventPlatformUpdate" /t REG_DWORD /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "FallbackOrder" /d "FileShares" /t REG_SZ /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleDay" /t REG_DWORD /d 8 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ForceUpdateFromMU" /d 0 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /d 1 /t REG_DWORD /f
}

if([System.Environment]::OSVersion.Version.Major -eq 10){
New-Item 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Force 2>&1 >$null
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Scan" /v "ScheduleQuickScanTime" /f 2>$null
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleQuickScanTime" /f 2>$null

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Signature Updates" /v "DefinitionUpdateFileSharesSources" /f 2>$null
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DefinitionUpdateFileSharesSources" /f 2>$null

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /f 2>$null
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /va /f 2>&1 >$null

$registryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"
Get-ItemProperty -Path $registryPath | Remove-ItemProperty -Name * -ErrorAction SilentlyContinue
Get-ChildItem -Path $registryPath | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue

reg add "HKLM\Software\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications " /t REG_DWORD /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "SignatureDisableNotification" /d 0 /t REG_DWORD /f

#Restart-Service WinDefend -Force -ErrorAction SilentlyContinue
#Restart-Service WdNisSvc -Force -ErrorAction SilentlyContinue
Start-Service WinDefend -ErrorAction SilentlyContinue
Start-Service WdNisSvc -ErrorAction SilentlyContinue

Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f

Set-MpPreference -DisableIOAVProtection $true -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f

Set-MpPreference -DisableArchiveScanning $true -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableArchiveScanning" /d 1 /t REG_DWORD /f

Set-MpPreference -MAPSReporting 0 -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpynetReporting" /d 0 /t REG_DWORD /f

Set-MpPreference -SubmitSamplesConsent 2 -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /d 2 /t REG_DWORD /f

Set-MpPreference -EnableControlledFolderAccess Disabled -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access" /v "EnableControlledFolderAccess" /d 0 /t REG_DWORD /f

Set-MpPreference -PUAProtection Disabled -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /d 0 /t REG_DWORD /f

Set-MpPreference -SignatureFallbackOrder FileShares -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "FallbackOrder" /d "FileShares" /t REG_SZ /f

Set-MpPreference -SignatureScheduleDay Never -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleDay" /t REG_DWORD /d 8 /f

Set-MpPreference -SharedSignaturesPath c:\dummyPath -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "SharedSignatureRoot" /d "c:\dummyPath" /t REG_SZ /f

Set-MpPreference -SignatureDefinitionUpdateFileSharesSources "\\unc1 | \\unc2" -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DefinitionUpdateFileSharesSources" /d "\\unc1 | \\unc2" /t REG_SZ /f

Set-MpPreference -CheckForSignaturesBeforeRunningScan $false -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "CheckForSignaturesBeforeRunningScan" /d 0 /t REG_DWORD /f

Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableRealtimeMonitoring" /d 0 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /d 1 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "RealtimeSignatureDelivery" /d 0 /t REG_DWORD /f


Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DisableUpdateOnStartupWithoutEngine" /d 1 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "UpdateOnStartUp" /d 0 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DisableScanOnUpdate" /d 1 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ForceUpdateFromMU" /d 0 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration" /v "PreventPlatformUpdate" /t REG_DWORD /d 1 /f

Set-MpPreference -HighThreatDefaultAction 6 -Force -ErrorAction SilentlyContinue
Set-MpPreference -ModerateThreatDefaultAction 6 -Force -ErrorAction SilentlyContinue
Set-MpPreference -LowThreatDefaultAction 6 -Force -ErrorAction SilentlyContinue
Set-MpPreference -SevereThreatDefaultAction 6 -Force -ErrorAction SilentlyContinue
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRoutinelyTakingAction" /d 1 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /d 1 /t REG_DWORD /f
Set-Service -Name MDCoreSvc -StartupType Disabled -ErrorAction SilentlyContinue 2>$null
}

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance" /v "MaintenanceDisabled" /t REG_DWORD /d 1 /f
Get-ScheduledTask -TaskPath "\Microsoft\Windows\Customer Experience Improvement Program\","\Microsoft\Windows\Data Integrity Scan\","\Microsoft\Windows\ApplicationData\","\Microsoft\Windows\Application Experience\","\Microsoft\Windows\Defrag\","\Microsoft\Windows\DiskCleanup\","\Microsoft\Windows\DiskDiagnostic\","\Microsoft\Windows\DiskFootprint\","\Microsoft\Windows\Windows Defender\","\Microsoft\Windows\Maintenance\" 2>$null | Disable-ScheduledTask 2>$null

Get-ScheduledTask | Where-Object { $_.TaskName -like "OneDrive*"}| Disable-ScheduledTask 2>$null

Get-Service MicrosoftEdge*, edgeupdate*|ft -auto
Get-Service GoogleChrome*, gupdate* | ft -auto
Get-Service MicrosoftEdge*, edgeupdate* | Set-Service -StartupType Disabled
Get-Service GoogleChrome*, gupdate* | Set-Service -StartupType Disabled
Get-ScheduledTask | Where-Object { $_.TaskName -like "MicrosoftEdgeUpdateTaskMachine*"} | Disable-ScheduledTask 2>&1 >$null
Get-ScheduledTask | Where-Object { $_.TaskName -like "GoogleUpdateTaskMachine*"} | Disable-ScheduledTask 2>$null


$services = @("*ssh*","*cron*","gse*","Tsys","tatsvc", "win-agent", "WinAgent", "YDLive", "YDService", "BaradAgentSvc", "StargateSvc", "WinDefend", "WdNisSvc", "MDCoreSvc")
Get-Service -Name $services 2>$null | Select-Object Name, DisplayName, Status


#$services = @("gse*","tatsvc", "win-agent", "WinAgent", "YDLive", "YDService", "BaradAgentSvc", "StargateSvc", "WinDefend", "WdNisSvc", "MDCoreSvc")
$services = @("win-agent", "WinAgent", "YDLive", "YDService", "BaradAgentSvc", "StargateSvc", "WinDefend", "WdNisSvc", "MDCoreSvc")
foreach ($service in $services) {
    $currentService = Get-Service -Name $service -ErrorAction SilentlyContinue
    if ($currentService -ne $null -and $currentService.Status -eq "Running") {
        Stop-Service -Name $service 2>$null
        Write-Host "已停止服务：$service"
    } elseif ($currentService -eq $null) {
        Write-Host "未找到服务：$service"
    } else {
        Write-Host "服务已停止：$service"
    }

}

$services = @("win-agent", "WinAgent", "YDLive", "YDService", "BaradAgentSvc", "StargateSvc", "WinDefend", "WdNisSvc", "MDCoreSvc")
foreach ($service in $services) {
    Set-Service -Name $service -StartupType Disabled -ErrorAction SilentlyContinue
}

$services = @("*ssh*","*cron*","gse*","Tsys","tatsvc", "win-agent", "WinAgent", "YDLive", "YDService", "BaradAgentSvc", "StargateSvc", "WinDefend", "WdNisSvc", "MDCoreSvc")
Get-Service -Name $services 2>$null | Select-Object Name, DisplayName, Status


Get-Process | Where-Object {$_.company -notlike '*Microsoft*' }|select Name,Description,Company|ft -auto

[System.Diagnostics.FileVersionInfo]::GetVersionInfo("C:\Windows\System32\drivers\viostor.sys")
[System.Diagnostics.FileVersionInfo]::GetVersionInfo("C:\Windows\System32\drivers\netkvm.sys")

reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management"  /v "ClearPageFileAtShutdown"
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management"  /v "ClearPageFileAtShutdown" /d 0 /t REG_DWORD /f
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management"  /v "ClearPageFileAtShutdown"

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v DisablePCA /t REG_DWORD /d 1 /f
Set-Service -Name PcaSvc -StartupType Disabled 2>$null
Get-ScheduledTask | Where-Object { $_.TaskName -like "*ProgramDataUpdater*"}| Disable-ScheduledTask 2>$null

Set-Service -Name DiagTrack -StartupType Disabled 2>$null
Set-Service -Name SysMain -StartupType Disabled 2>$null
Set-Service -Name WSearch -StartupType Disabled 2>$null
Set-Service -Name UsoSvc -StartupType Disabled -ErrorAction SilentlyContinue
Set-Service -Name WUAUSERV -StartupType Disabled -ErrorAction SilentlyContinue
Set-Service -Name WaaSMedicSvc -StartupType Disabled -ErrorAction SilentlyContinue 2>$null

Get-ScheduledTask | Where-Object { $_.TaskName -like "*BackgroundDownload*"}| Disable-ScheduledTask 2>$null
Get-Service MicrosoftEdge*, edgeupdate* | Set-Service -StartupType Disabled
Get-Service GoogleChrome*, gupdate* | Set-Service -StartupType Disabled
Get-ScheduledTask | Where-Object { $_.TaskName -like "MicrosoftEdgeUpdateTaskMachine*"} | Disable-ScheduledTask 2>&1 >$null
Get-ScheduledTask | Where-Object { $_.TaskName -like "GoogleUpdateTaskMachine*"} | Disable-ScheduledTask 2>$null

Get-ScheduledTask -TaskPath "\Microsoft\Windows\Power Efficiency Diagnostics\","\Microsoft\Windows\ApplicationData\","\Microsoft\Windows\Customer Experience Improvement Program\","\Microsoft\Windows\CloudExperienceHost\","\Microsoft\Windows\DiskFootprint\","\Microsoft\Windows\StateRepository\","\Microsoft\Windows\Application Experience\","\Microsoft\Windows\DiskDiagnostic\","\Microsoft\Windows\MemoryDiagnostic\","\Microsoft\Windows\WDI\","\Microsoft\Windows\UpdateOrchestrator\","\Microsoft\Windows\WindowsUpdate\","\Microsoft\Windows\Diagnosis\","\Microsoft\Windows\Network Controller\","\Microsoft\Windows\PI\","\Microsoft\Windows\DiskCleanup\","\Microsoft\Windows\TPM\","\Microsoft\Windows\Windows Defender\","\Microsoft\Windows\Maintenance\" 2>$null | Disable-ScheduledTask 2>$null | Sort-Object -Property State | ft -auto

Set-Service -Name BaradAgentSvc -StartupType Automatic 2>$null
Set-Service -Name StargateSvc -StartupType Automatic 2>$null

(1)检查开机耗时是否在30秒内（差个几秒没事，如果超过35秒太多就得考虑是否要优化下了）
$event12 =Get-WinEvent -FilterHashtable @{logname='System';id=@(12);StartTime=(Get-Date).AddDays(-10) } -EA 0 | Where-Object {$_.ProviderName -eq "Microsoft-Windows-Kernel-General" -or $_.ProviderName -eq "User32" -or $_.ProviderName -eq "EventLog" } | Sort-Object -Property TimeCreated -Descending:$true|Select-Object -First 1
$event6005 =Get-WinEvent -FilterHashtable @{logname='System';id=@(6005);StartTime=(Get-Date).AddDays(-10) } -EA 0 | Where-Object {$_.ProviderName -eq "Microsoft-Windows-Kernel-General" -or $_.ProviderName -eq "User32" -or $_.ProviderName -eq "EventLog" } | Sort-Object -Property TimeCreated -Descending:$true|Select-Object -First 1
$event12
$event6005
($event6005.TimeCreated - $event12.TimeCreated).TotalSeconds

(2)检查计划任务和Defender、DiagTrack状态全是Disabled和Stopped就行
顺便也看下云监控组件（"BaradAgentSvc", "StargateSvc"）和自动化助手TAT（"tatsvc"）的状态是否正常
Get-ScheduledTask -TaskPath "\Microsoft\Windows\Power Efficiency Diagnostics\","\Microsoft\Windows\ApplicationData\","\Microsoft\Windows\Customer Experience Improvement Program\","\Microsoft\Windows\CloudExperienceHost\","\Microsoft\Windows\DiskFootprint\","\Microsoft\Windows\StateRepository\","\Microsoft\Windows\Application Experience\","\Microsoft\Windows\DiskDiagnostic\","\Microsoft\Windows\MemoryDiagnostic\","\Microsoft\Windows\WDI\","\Microsoft\Windows\UpdateOrchestrator\","\Microsoft\Windows\WindowsUpdate\","\Microsoft\Windows\Diagnosis\","\Microsoft\Windows\Network Controller\","\Microsoft\Windows\PI\","\Microsoft\Windows\DiskCleanup\","\Microsoft\Windows\TPM\","\Microsoft\Windows\Windows Defender\","\Microsoft\Windows\Maintenance\" 2>$null | Sort-Object -Property State
Get-Service "BaradAgentSvc", "StargateSvc", "tatsvc" -ErrorAction SilentlyContinue
Get-Service "YDLive", "YDService", "WinDefend", "WdNisSvc", "DiagTrack" -ErrorAction SilentlyContinue

(3)检查驱动不低于58005就行
[System.Diagnostics.FileVersionInfo]::GetVersionInfo("C:\Windows\System32\drivers\viostor.sys")
[System.Diagnostics.FileVersionInfo]::GetVersionInfo("C:\Windows\System32\drivers\netkvm.sys")

Get-Service | Where-Object { $_.DisplayName.StartsWith('Diag') -or $_.Name.StartsWith('Diag') }

$services = Get-Service | Where-Object { $_.DisplayName.StartsWith('Diag') -or $_.Name.StartsWith('Diag') }
foreach ($service in $services) {
    $description = (Get-WmiObject -Class Win32_Service -Filter "Name='$($service.Name)'").Description
    Write-Host "Name: $($service.Name)"
    Write-Host "DisplayName: $($service.DisplayName)"
    Write-Host "Description: $description"
    Write-Host "---------"
}