[New script]: Clear Windows Registry FeatureUsage
enhancement
### Operating system
Windows
### Name of the script
Clear Windows Registry FeatureUsage
### Documentation/References
FeatureUsage may be used to study user behavior and activity.
https://www.crowdstrike.com/en-us/blog/how-to-employ-featureusage-for-windows-10-taskbar-forensics/
### Code
```
:: Modification of example script "Clear Windows Search history":
$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage';
function Clear-RegistryKeyProperties {
$currentRegistryKeyPath = $args[0];
Write-Output "^""Clearing all Properties from Registry Key `"^""$currentRegistryKeyPath`"^""."^"";
$formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:';
try {
if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) {
Write-Output "^""Skipping: Registry Key not found: `"^""$formattedRegistryKeyPath`"^""."^"";
return;
};
$directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property);
if (-Not $directValueNames) {
Write-Output 'Skipping: Registry Key has no direct values.';
} else {
foreach ($valueName in $directValueNames) {
Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop;
Write-Output "^""Successfully deleted value: `"^""$valueName`"^"" from `"^""$formattedRegistryKeyPath`"^""."^"";
};
Write-Output "^""Successfully cleared all direct values in `"^""$formattedRegistryKeyPath`"^""."^"";
};
} catch { Write-Error "^""Failed to clear all Properties from Registry Key `"^""$formattedRegistryKeyPath`"^"". Error: $_"^""; Exit 1; };
};
function Clear-RegistrySubkeysProperties {
$currentRegistryKeyPath = $args[0];
Write-Output "^""Clearing all Properties from Subkeys of Registry Key `"^""$currentRegistryKeyPath`"^""."^"";
$formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:';
try {
if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) {
Write-Output "^""Skipping: Registry Key not found: `"^""$formattedRegistryKeyPath`"^""."^"";
return;
};
$subkeys = Get-ChildItem -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop;
if (!$subkeys) {
Write-Output 'Skipping: no Subkeys available.';
return;
};
foreach ($subkey in $subkeys) {
$subkeyName = $($subkey.PSChildName);
Write-Output "^""Processing Subkey: `"^""$subkeyName`"^"""^"";
$subkeyPath = Join-Path -Path $currentRegistryKeyPath -ChildPath $subkeyName;
Clear-RegistryKeyProperties $subkeyPath;
};
Write-Output "^""Successfully cleared all Properties from Subkeys of Registry Key `"^""$formattedRegistryKeyPath`"^""."^"";
} catch { Write-Error "^""Failed to clear all Properties from Subkeys of Registry Key `"^""$formattedRegistryKeyPath`"^"". Error: $_"^""; Exit 1; };
};
Clear-RegistrySubkeysProperties $rootRegistryKeyPath;
:: As One-liner:
:: ----------------------------------------------------------
:: -----------Clear Windows Registry FeatureUsage------------
:: ----------------------------------------------------------
echo --- Clear Windows Registry FeatureUsage
:: Clear registry values from subkeys of "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage"
PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage'; function Clear-RegistryKeyProperties { $currentRegistryKeyPath = $args[0]; Write-Output "^""Clearing all Properties from Registry Key `"^""$currentRegistryKeyPath`"^""."^""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; try { if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output "^""Skipping: Registry Key not found: `"^""$formattedRegistryKeyPath`"^""."^""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry Key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output "^""Successfully deleted value: `"^""$valueName`"^"" from `"^""$formattedRegistryKeyPath`"^""."^""; }; Write-Output "^""Successfully cleared all direct values in `"^""$formattedRegistryKeyPath`"^""."^""; }; } catch { Write-Error "^""Failed to clear all Properties from Registry Key `"^""$formattedRegistryKeyPath`"^"". Error: $_"^""; Exit 1; }; }; function Clear-RegistrySubkeysProperties { $currentRegistryKeyPath = $args[0]; Write-Output "^""Clearing all Properties from Subkeys of Registry Key `"^""$currentRegistryKeyPath`"^""."^""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; try { if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output "^""Skipping: Registry Key not found: `"^""$formattedRegistryKeyPath`"^""."^""; return; }; $subkeys = Get-ChildItem -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop; if (!$subkeys) { Write-Output 'Skipping: no Subkeys available.'; return; }; foreach ($subkey in $subkeys) { $subkeyName = $($subkey.PSChildName); Write-Output "^""Processing Subkey: `"^""$subkeyName`"^"""^""; $subkeyPath = Join-Path -Path $currentRegistryKeyPath -ChildPath $subkeyName; Clear-RegistryKeyProperties $subkeyPath; }; Write-Output "^""Successfully cleared all Properties from Subkeys of Registry Key `"^""$formattedRegistryKeyPath`"^""."^""; } catch { Write-Error "^""Failed to clear all Properties from Subkeys of Registry Key `"^""$formattedRegistryKeyPath`"^"". Error: $_"^""; Exit 1; }; }; Clear-RegistrySubkeysProperties $rootRegistryKeyPath"
:: ----------------------------------------------------------
```
### Revert code
_No response_
### Suggested category
Privacy Cleanup > Clear Windows Registry
### Recommendation level
Standard
### Additional information
The proposed "Clear Windows Registry FeatureUsage" script deletes the Values of the Subkeys of "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage", but does not delete the Subkeys.
To list Properties/Values (before deleting):
`Get-ChildItem -LiteralPath "Registry::HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\" | ForEach-Object {$_ | Get-ItemProperty}`
To list the paths of Subkeys of FeatureUsage:
`Get-ChildItem -LiteralPath "Registry::HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\" | ForEach-Object {$_.PSPath}`
To delete Properties/Values without deleting Subkeys of FeatureUsage (as in the proposed script above):
`Get-ChildItem -LiteralPath "Registry::HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\" | ForEach-Object {Remove-ItemProperty -Path $_.PSPath *}`
As an alternative, to delete the entire Subkeys of FeatureUsage instead of just the Properties of the Subkeys appears to work as well, without any side effect problems.
TO DO: Consider setting `KeyCreationTime` to a value such as '1'.
0 条评论