Provisioning: Disable or delete unneeded tasks and services

Windows have lot's of tasks and services running which are slowing
the performance of build machine. Also 'windows' and 'windows
defender' updates need's to be "permanently" disabled.

Task-number: QTQAINFRA-3182
Change-Id: I8f6b237fcdc6e38fa9a06836d349821d86c58afc
(cherry picked from commit a3136bdbfef242339c002630f51b4bc0f5c05503)
Reviewed-by: Tony Sarajärvi <tony.sarajarvi@qt.io>

12 files changed, 211 insertions, 0 deletions

diff --git a/coin/provisioning/common/windows/disable-schedule-tasks.ps1 b/coin/provisioning/common/windows/disable-schedule-tasks.ps1
new file mode 100644
index 00000000..86c08e01
--- /dev/null
+++ b/coin/provisioning/common/windows/disable-schedule-tasks.ps1
@@ -0,0 +1,84 @@
+. "$PSScriptRoot\helpers.ps1"
+
+# This script will remove unneeded Tasks from Task Scheduler
+
+# Application Experience 'Microsoft Compatibility Appraiser' - "Collects program telemetry information if opted-in to the Microsoft Customer Experience Improvement Program."
+DisableSchedulerTask "Application Experience\Microsoft Compatibility Appraiser"
+
+# Application Experience 'ProgramDataUpdater' - "Collects program telemetry information if opted-in to the Microsoft Customer Experience Improvement Program"
+DisableSchedulerTask "Application Experience\ProgramDataUpdater"
+
+# Autochk 'Proxy' - "This task collects and uploads autochk SQM data if opted-in to the Microsoft Customer Experience Improvement Program."
+DisableSchedulerTask "Autochk\Proxy"
+
+# Chkdsk 'ProactiveScan' - "NTFS Volume Health Scan"
+DisableSchedulerTask "Chkdsk\ProactiveScan"
+
+# Chkdsk 'SyspartRepair'
+DeleteSchedulerTask "Chkdsk\SyspartRepair"
+
+# Customer Experience Improvement Program 'Consolidator' - "If the user has consented to participate in the Windows Customer Experience Improvement Program, this job collects and sends usage data to Microsoft."
+DisableSchedulerTask "Customer Experience Improvement Program\Consolidator"
+
+# Customer Experience Improvement Program 'sbCeip' - "The USB CEIP (Customer Experience Improvement Program) task collects Universal Serial Bus related statistics and information about your machine and sends it to the Windows Device Connectivity engineering group at Microsoft.  The information received is used to help improve the reliability, stability, and overall functionality of USB in Windows.  If the user has not consented to participate in Windows CEIP, this task does not do anything."
+DisableSchedulerTask "Customer Experience Improvement Program\UsbCeip"
+
+# Device Information 'Device'
+DisableSchedulerTask "Device Information\Device"
+
+# Diagnosis 'Scheduled' - "The Windows Scheduled Maintenance Task performs periodic maintenance of the computer system by fixing problems automatically or reporting them through Security and Maintenance."
+DisableSchedulerTask "Diagnosis\Scheduled"
+
+# DiskDiagnostic 'Microsoft-Windows-DiskDiagnosticDataCollector' - "The Windows Disk Diagnostic reports general disk and system information to Microsoft for users participating in the Customer Experience Program."
+DisableSchedulerTask "DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector"
+
+# ExploitGuard 'ExploitGuard MDM policy Refresh' - "Task for applying changes to the machine's Exploit Protection settings."
+DisableSchedulerTask "ExploitGuard\ExploitGuard MDM policy Refresh"
+
+# Feedback/Siuf 'DmClient'
+DisableSchedulerTask "Feedback\Siuf\DmClient"
+
+# Feedback/Siuf 'DmClient'OnScenarioDownload'
+DisableSchedulerTask "Feedback\Siuf\DmClientOnScenarioDownload"
+
+# File Classification Infrastructure 'Property Definition Sync'
+DisableSchedulerTask "File Classification Infrastructure\Property Definition Sync"
+
+# InstallService 'ScanForUpdates'
+DisableSchedulerTask "InstallService\ScanForUpdates"
+
+# InstallService 'ScanForUpdatesAsUser'
+DisableSchedulerTask "InstallService\ScanForUpdatesAsUser"
+
+# LanguageComponentsInstaller  'Installation' - "Install language components that match the user's language list."
+DisableSchedulerTask "LanguageComponentsInstaller\Installation"
+
+# LanguageComponentsInstaller 'ReconcileLanguageResources' - "Install language components that match the user's language list."
+DisableSchedulerTask "LanguageComponentsInstaller\ReconcileLanguageResources"
+
+# PI 'Secure-Boot-Update' - "This task updates the Secure Boot variables."
+DisableSchedulerTask "PI\Secure-Boot-Update"
+
+# PI 'Sqm-Tasks' - "This task gathers information about the Trusted Platform Module (TPM), Secure Boot, and Measured Boot."
+DisableSchedulerTask "PI\Sqm-Tasks"
+
+# Power Efficiency Diagnotics 'AnalyzeSystem' - "This task analyzes the system looking for conditions that may cause high energy use."
+DisableSchedulerTask "PushToInstall\Registration"
+
+# Servicing 'StartComponentCleanup'
+DisableSchedulerTask "Servicing\StartComponentCleanup"
+
+# SettingSync 'BackgroundUploadTask'
+DeleteSchedulerTask "SettingSync\BackgroundUploadTask"
+
+# SoftwareProtectionPlatform 'SvcRestartTask' - "This task restarts the Software Protection Platform service at the specified time"
+DeleteSchedulerTask "SoftwareProtectionPlatform\SvcRestartTask"
+
+# SoftwareProtectionPlatform 'SvcRestartTaskLogon' - "This task restarts the Software Protection Platform service at the specified time"
+DisableSchedulerTask "SoftwareProtectionPlatform\SvcRestartTaskLogon"
+
+# SoftwareProtectionPlatform 'SvcRestartTaskNetwork' - "This task restarts the Software Protection Platform service when a new network is detected"
+DisableSchedulerTask "SoftwareProtectionPlatform\SvcRestartTaskNetwork"
+
+# UNP 'RunUpdateNotificationMgr'
+DeleteSchedulerTask "UNP\RunUpdateNotificationMgr"
diff --git a/coin/provisioning/common/windows/disable-update-orchestrator.ps1 b/coin/provisioning/common/windows/disable-update-orchestrator.ps1
new file mode 100644
index 00000000..95922d47
--- /dev/null
+++ b/coin/provisioning/common/windows/disable-update-orchestrator.ps1
@@ -0,0 +1,19 @@
+# Disable UpdateOrchestrator
+
+$name = "UpdateOrchestrator"
+$path = "C:\Windows\System32\Tasks\Microsoft\Windows\$name"
+
+takeown /F $path /A /R
+icacls $path /grant Administrators:F /T
+SCHTASKS /Change /TN "Microsoft\Windows\$name\Reboot" /DISABLE
+del "$path\Combined Scan Download Install"
+del "$path\Maintenance Install"
+del "$path\Reboot"
+del "$path\Policy Install"
+del "$path\Refresh Settings"
+del "$path\Resume On Boot"
+del "$path\USO_UxBroker_Display"
+del "$path\USO_UxBroker_ReadyToReboot"
+
+# Disable Update orchestrator service
+reg.exe ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsoSvc" /V Start /T REG_dWORD /D 4 /F
diff --git a/coin/provisioning/common/windows/disable-windefender.ps1 b/coin/provisioning/common/windows/disable-windefender.ps1
index e508641e..02ed54da 100644
--- a/coin/provisioning/common/windows/disable-windefender.ps1
+++ b/coin/provisioning/common/windows/disable-windefender.ps1
@@ -1,3 +1,36 @@
+###########################################################################
+##
+## Copyright (C) 2019 The Qt Company Ltd.
+## Contact: http://www.qt.io/licensing/
+##
+## This file is part of the provisioning scripts of the Qt Toolkit.
+##
+## $QT_BEGIN_LICENSE:LGPL21$
+## Commercial License Usage
+## Licensees holding valid commercial Qt licenses may use this file in
+## accordance with the commercial license agreement provided with the
+## Software or, alternatively, in accordance with the terms contained in
+## a written agreement between you and The Qt Company. For licensing terms
+## and conditions see http://www.qt.io/terms-conditions. For further
+## information use the contact form at http://www.qt.io/contact-us.
+##
+## GNU Lesser General Public License Usage
+## Alternatively, this file may be used under the terms of the GNU Lesser
+## General Public License version 2.1 or version 3 as published by the Free
+## Software Foundation and appearing in the file LICENSE.LGPLv21 and
+## LICENSE.LGPLv3 included in the packaging of this file. Please review the
+## following information to ensure the GNU Lesser General Public License
+## requirements will be met: https://www.gnu.org/licenses/lgpl.html and
+## http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+##
+## As a special exception, The Qt Company gives you certain additional
+## rights. These rights are described in The Qt Company LGPL Exception
+## version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+##
+## $QT_END_LICENSE$
+##
+#############################################################################
+
 # Turning off win defender.
 #
 # If disabled manually, windows will automatically enable it after
@@ -6,3 +39,21 @@
 . "$PSScriptRoot\helpers.ps1"
 
 Run-Executable "reg.exe" "ADD `"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender`" /V DisableAntiSpyware /T REG_dWORD /D 1 /F"
+
+# 'Windows Defender Cache Maintenance' - "Periodic maintenance task."
+DisableSchedulerTask "Windows Defender\Windows Defender Cache Maintenance"
+
+# 'Windows Defender Cleanup' - "Periodic cleanup task."
+DisableSchedulerTask "Windows Defender\Windows Defender Cleanup"
+
+# 'Windows Defender Scheduled Scan' - "Periodic scan task."
+DisableSchedulerTask "Windows Defender\Windows Defender Scheduled Scan"
+
+# 'Windows Defender Verification' - "Periodic verification task."
+DisableSchedulerTask "Windows Defender\Windows Defender Verification"
+
+# Disable 'QueueReporting' - "Windows Error Reporting task to process queued reports."
+DisableSchedulerTask "Windows Error Reporting\QueueReporting"
+
+# Disable WindowsUpdate from Task Scheduler
+DisableSchedulerTask "WindowsUpdate\Scheduled Start"
diff --git a/coin/provisioning/common/windows/disable-windows-file-protector.ps1 b/coin/provisioning/common/windows/disable-windows-file-protector.ps1
new file mode 100644
index 00000000..f1d09fb5
--- /dev/null
+++ b/coin/provisioning/common/windows/disable-windows-file-protector.ps1
@@ -0,0 +1,4 @@
+# Disable Windows File Protection
+# Windows File Protection feature in Microsoft Windows prevents programs from replacing critical Windows system files.
+
+reg.exe ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /V SFCDisable /T REG_dWORD /D 0xffffff9d /F
diff --git a/coin/provisioning/common/windows/disable-windows-module-installer.ps1 b/coin/provisioning/common/windows/disable-windows-module-installer.ps1
new file mode 100644
index 00000000..c7f85ff7
--- /dev/null
+++ b/coin/provisioning/common/windows/disable-windows-module-installer.ps1
@@ -0,0 +1,4 @@
+# Disable Windows Module Installer (Trusted Installer).
+# Trusted Installe enables installation, modification, and removal of Windows updates and optional components.
+# If this service is disabled, install or uninstall of Windows updates might fail for this computer.
+sc.exe config TrustedInstaller start=disabled
diff --git a/coin/provisioning/common/windows/disable-windows-update-assessment.ps1 b/coin/provisioning/common/windows/disable-windows-update-assessment.ps1
new file mode 100644
index 00000000..8cf6d6fe
--- /dev/null
+++ b/coin/provisioning/common/windows/disable-windows-update-assessment.ps1
@@ -0,0 +1,23 @@
+# The Windows as a Service (WaaS) Update Assessment Platform provides information on a device's Windows updates.
+
+$limit = (Get-Date).AddMinutes(20)
+$path = "C:\Windows\System32\WaaSAssessment.dll"
+
+DO {
+    takeown /F $path
+    icacls  $path /grant Administrators:f
+    Write-host "Deleting $path"
+
+    Try {
+        del $path
+    }
+    Catch [System.UnauthorizedAccessException] {
+        Write-host "Access to the path '$path' is denied."
+        Continue
+    }
+
+    if ((Get-Date) -gt $limit) {
+        exit 1
+    }
+
+}while (Test-Path -Path "$path")
diff --git a/coin/provisioning/common/windows/helpers.ps1 b/coin/provisioning/common/windows/helpers.ps1
index ba35f6b5..0f39beed 100644
--- a/coin/provisioning/common/windows/helpers.ps1
+++ b/coin/provisioning/common/windows/helpers.ps1
@@ -222,3 +222,23 @@ function Remove {
         }
     }
 }
+
+function DisableSchedulerTask {
+
+    Param (
+        [string]$Task = $(BadParam("a task"))
+    )
+
+    Write-Host "Disabling $Task from Task Scheduler"
+    SCHTASKS /Change /TN "Microsoft\Windows\$Task" /DISABLE
+}
+
+function DeleteSchedulerTask {
+
+   Param (
+        [string]$Task = $(BadParam("a task"))
+    )
+
+    Write-Host "Disabling $Task from Task Scheduler"
+    SCHTASKS /DELETE /TN "Microsoft\Windows\$Task" /F
+}
diff --git a/coin/provisioning/qtci-windows-10-x86_64/98-disable-file-protector.ps1 b/coin/provisioning/qtci-windows-10-x86_64/98-disable-file-protector.ps1
new file mode 100644
index 00000000..79802f24
--- /dev/null
+++ b/coin/provisioning/qtci-windows-10-x86_64/98-disable-file-protector.ps1
@@ -0,0 +1 @@
+. "$PSScriptRoot\..\common\windows\disable-windows-file-protector.ps1"
diff --git a/coin/provisioning/qtci-windows-10-x86_64/98-disable-schedule-tasks.ps1 b/coin/provisioning/qtci-windows-10-x86_64/98-disable-schedule-tasks.ps1
new file mode 100644
index 00000000..9134a735
--- /dev/null
+++ b/coin/provisioning/qtci-windows-10-x86_64/98-disable-schedule-tasks.ps1
@@ -0,0 +1 @@
+. "$PSScriptRoot\..\common\windows\disable-schedule-tasks.ps1"
diff --git a/coin/provisioning/qtci-windows-10-x86_64/98-disable-update-orchestrator.ps1 b/coin/provisioning/qtci-windows-10-x86_64/98-disable-update-orchestrator.ps1
new file mode 100644
index 00000000..67dcce60
--- /dev/null
+++ b/coin/provisioning/qtci-windows-10-x86_64/98-disable-update-orchestrator.ps1
@@ -0,0 +1 @@
+. "$PSScriptRoot\..\common\windows\disable-update-orchestrator.ps1"
diff --git a/coin/provisioning/qtci-windows-10-x86_64/98-disable-windows-module-installer.ps1 b/coin/provisioning/qtci-windows-10-x86_64/98-disable-windows-module-installer.ps1
new file mode 100644
index 00000000..fb8ec541
--- /dev/null
+++ b/coin/provisioning/qtci-windows-10-x86_64/98-disable-windows-module-installer.ps1
@@ -0,0 +1 @@
+. "$PSScriptRoot\..\common\windows\disable-windows-module-installer.ps1"
diff --git a/coin/provisioning/qtci-windows-10-x86_64/98-disable-windows-update-assessment.ps1 b/coin/provisioning/qtci-windows-10-x86_64/98-disable-windows-update-assessment.ps1
new file mode 100644
index 00000000..e54081fd
--- /dev/null
+++ b/coin/provisioning/qtci-windows-10-x86_64/98-disable-windows-update-assessment.ps1
@@ -0,0 +1,2 @@
+. "$PSScriptRoot\..\common\windows\disable-windows-update-assessment.ps1"
+