# 驱动加载失败
事件查看器中显示错误：
Event ID: 3076
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\drivers\incompatible_driver.sys) attempted to load non-Microsoft signed code that failed the HVCI policy check.

# 设置下载路径
$downloadPath = "$env:USERPROFILE\Downloads"
$downloadUrl = "https://download.microsoft.com/download/6/4/1/641C3FAF-2C49-45D6-8E8A-C8FD93B2F7C3/dgreadiness_v3.6.zip"
$destination = "$downloadPath\dgreadiness_v3.6.zip"

# 创建WebClient对象并下载
$webClient = New-Object System.Net.WebClient
$webClient.DownloadFile($downloadUrl, $destination)

Write-Host "下载完成，文件保存在: $destination" -ForegroundColor Green

curl -L -o "$env:USERPROFILE\Downloads\dgreadiness_v3.6.zip" https://download.microsoft.com/download/6/4/1/641C3FAF-2C49-45D6-8E8A-C8FD93B2F7C3/dgreadiness_v3.6.zip

# 定义源路径和目标路径
$sourcePath = "$env:USERPROFILE\Downloads\dgreadiness_v3.6.zip"
$destinationPath = "C:\Tools\dgreadiness_v3.6"

# 创建目标目录（如果不存在）
if (-not (Test-Path $destinationPath)) {
    New-Item -ItemType Directory -Path $destinationPath -Force
}

# 解压文件
Expand-Archive -Path $sourcePath -DestinationPath $destinationPath -Force

Write-Host "解压完成，文件保存在: $destinationPath" -ForegroundColor Green

# 查看文件列表
Get-ChildItem "C:\Tools\dgreadiness_v3.6" -Recurse

# 验证主脚本文件
$scriptPath = "C:\Tools\dgreadiness_v3.6\DG_Readiness_Tool_v3.6.ps1"
if (Test-Path $scriptPath) {
    Write-Host "✓ 主脚本文件存在" -ForegroundColor Green
    $fileInfo = Get-Item $scriptPath
    Write-Host "  文件大小: $($fileInfo.Length) 字节" -ForegroundColor Gray
    Write-Host "  修改时间: $($fileInfo.LastWriteTime)" -ForegroundColor Gray
} else {
    Write-Host "✗ 主脚本文件不存在" -ForegroundColor Red
}

# 在记事本中打开
notepad "C:\Tools\dgreadiness_v3.6\readme.txt"

# 或在PowerShell中查看内容
Get-Content "C:\Tools\dgreadiness_v3.6\readme.txt"

.\DG_Readiness_Tool_v3.6.ps1 -Capable -DG

.\DG_Readiness_Tool_v3.6.ps1 -Capable -CG

.\DG_Readiness_Tool_v3.6.ps1 -Capable -HVCI

.\DG_Readiness_Tool_v3.6.ps1 -Ready -DG

.\DG_Readiness_Tool_v3.6.ps1 -Ready -DG -CG -HVCI

.\DG_Readiness_Tool_v3.6.ps1 -Enable -DG -AutoReboot

.\DG_Readiness_Tool_v3.6.ps1 -Enable -CG -AutoReboot

.\DG_Readiness_Tool_v3.6.ps1 -Enable -HVCI -AutoReboot

.\DG_Readiness_Tool_v3.6.ps1 -Disable -DG -AutoReboot

.\DG_Readiness_Tool_v3.6.ps1 -Disable -CG -AutoReboot

.\DG_Readiness_Tool_v3.6.ps1 -Disable -HVCI -AutoReboot

.\DG_Readiness_Tool_v3.6.ps1 -Enable -DG -Path "C:\Policies\MyCIPolicy.p7b"

.\DG_Readiness_Tool_v3.6.ps1 -Capable -HLK

$computers = @("PC01", "PC02", "PC03")
foreach ($computer in $computers) {
    Write-Host "Checking $computer..." -ForegroundColor Cyan
    Invoke-Command -ComputerName $computer -ScriptBlock {
        & "C:\Tools\dgreadiness_v3.6\DG_Readiness_Tool_v3.6.ps1" -Ready -HVCI
    }
}

# 方法1：检查当前用户是否是管理员
$currentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
$isAdmin = $currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

if ($isAdmin) {
    Write-Host "✓ 当前具有管理员权限" -ForegroundColor Green
} else {
    Write-Host "✗ 需要管理员权限，请以管理员身份重新运行PowerShell" -ForegroundColor Red
    Write-Host "提示：右键点击PowerShell，选择'以管理员身份运行'" -ForegroundColor Yellow
    exit
}

# 自动请求管理员权限
if (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
    Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs
    exit
}

Get-ExecutionPolicy -List

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
Write-Host "✓ 执行策略已设置为Bypass（仅当前会话）" -ForegroundColor Green

Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned -Force
Write-Host "✓ 执行策略已设置为RemoteSigned" -ForegroundColor Green

# 检查是否启用系统保护
$systemProtection = Get-ComputerRestorePoint
if ($systemProtection) {
    Write-Host "✓ 系统保护已启用" -ForegroundColor Green
} else {
    Write-Host "✗ 系统保护未启用，跳过还原点创建" -ForegroundColor Yellow
}

# 创建还原点
$description = "Before disabling VBS with dgreadiness"
try {
    Checkpoint-Computer -Description $description -RestorePointType "MODIFY_SETTINGS"
    Write-Host "✓ 系统还原点创建成功: $description" -ForegroundColor Green
} catch {
    Write-Host "✗ 创建还原点失败: $_" -ForegroundColor Red
}

# 创建备份目录
$backupDir = "C:\DGReadiness_Backup_$(Get-Date -Format 'yyyyMMdd_HHmmss')"
New-Item -ItemType Directory -Path $backupDir -Force | Out-Null

# 导出Device Guard相关注册表项
$regPaths = @(
    "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard",
    "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa",
    "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"
)

foreach ($path in $regPaths) {
    $backupFile = "$backupDir\$($path.Replace('\', '_').Replace(':', '')).reg"
    try {
        reg export $path $backupFile /y
        Write-Host "✓ 已备份: $path" -ForegroundColor Green
    } catch {
        Write-Host "✗ 备份失败: $path" -ForegroundColor Red
    }
}

Write-Host "注册表备份完成，保存在: $backupDir" -ForegroundColor Cyan

$bcdBackupFile = "$backupDir\BCD_Backup.txt"
try {
    bcdedit /enum all > $bcdBackupFile
    Write-Host "✓ BCD配置已备份: $bcdBackupFile" -ForegroundColor Green
} catch {
    Write-Host "✗ BCD备份失败: $_" -ForegroundColor Red
}

# 启动系统信息工具
Start-Process msinfo32

# 或使用PowerShell查询
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | 
    Select-Object @{N="基于虚拟化的安全性";E={$_.VirtualizationBasedSecurityStatus}},
                  @{N="安全服务运行中";E={$_.SecurityServicesConfigured}},
                  @{N="HVCI状态";E={$_.SecurityServicesRunning}} | 
    Format-List

# 查询VBS状态
$vbsStatus = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard

Write-Host "当前VBS状态报告：" -ForegroundColor Cyan
Write-Host "================================" -ForegroundColor Gray
Write-Host "基于虚拟化的安全性状态: $($vbsStatus.VirtualizationBasedSecurityStatus)" -ForegroundColor White
Write-Host "已配置的安全服务: $($vbsStatus.SecurityServicesConfigured)" -ForegroundColor White
Write-Host "正在运行的安全服务: $($vbsStatus.SecurityServicesRunning)" -ForegroundColor White

# 检查HVCI是否启用
if ($vbsStatus.SecurityServicesRunning -band 1) {
    Write-Host "HVCI（内存完整性）: 启用" -ForegroundColor Green
} else {
    Write-Host "HVCI（内存完整性）: 禁用" -ForegroundColor Red
}

# 检查Credential Guard是否启用
if ($vbsStatus.SecurityServicesRunning -band 2) {
    Write-Host "Credential Guard: 启用" -ForegroundColor Green
} else {
    Write-Host "Credential Guard: 禁用" -ForegroundColor Red
}

# 打开Windows安全中心 - 核心隔离页面
Start-Process "ms-settings:windowssecurity-coreisolation"

Write-Host "请检查'核心隔离'页面中的'内存完整性'设置" -ForegroundColor Yellow

# 切换到工具目录
Set-Location "C:\Tools\dgreadiness_v3.6"

# 验证当前位置
Write-Host "当前工作目录: $(Get-Location)" -ForegroundColor Cyan

# 定义工具路径
$dgToolPath = "C:\Tools\dgreadiness_v3.6"

# 切换目录
Set-Location $dgToolPath

# 检查脚本文件是否存在
$scriptPath = Join-Path $dgToolPath "DG_Readiness_Tool_v3.6.ps1"
if (Test-Path $scriptPath) {
    Write-Host "✓ 工具脚本文件存在" -ForegroundColor Green
} else {
    Write-Host "✗ 工具脚本文件不存在，请检查路径" -ForegroundColor Red
    exit
}

# 查看帮助信息
Get-Help .\DG_Readiness_Tool_v3.6.ps1 -Full

# 或查看参数说明
Get-Help .\DG_Readiness_Tool_v3.6.ps1 -Parameter *

Write-Host "开始HVCI就绪性检查..." -ForegroundColor Cyan
.\DG_Readiness_Tool_v3.6.ps1 -Capable -HVCI

Write-Host "开始全面就绪性检查..." -ForegroundColor Cyan
.\DG_Readiness_Tool_v3.6.ps1 -Capable -DG -CG -HVCI -HLK

# 使用PowerShell查找不兼容驱动
Get-CimInstance -ClassName Win32_PnPSignedDriver | 
    Where-Object { $_.DriverVersion -lt "2.0.0.0" } |
    Select-Object DeviceName, DriverVersion, DriverDate, InfName |
    Format-Table -AutoSize

Write-Host "开始禁用虚拟化安全（VBS）..." -ForegroundColor Cyan
Write-Host "警告：此操作将禁用以下功能：" -ForegroundColor Yellow
Write-Host "  - Device Guard" -ForegroundColor Gray
Write-Host "  - Credential Guard" -ForegroundColor Gray
Write-Host "  - HVCI（内存完整性）" -ForegroundColor Gray
Write-Host ""

# 请求确认
$confirmation = Read-Host "是否继续？(Y/N)"
if ($confirmation -ne 'Y' -and $confirmation -ne 'y') {
    Write-Host "操作已取消" -ForegroundColor Yellow
    exit
}

# 执行禁用命令
Write-Host "执行禁用命令..." -ForegroundColor Cyan
.\DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot

Write-Host "命令执行完成，系统将自动重启" -ForegroundColor Green

Write-Host "开始禁用HVCI（内存完整性）..." -ForegroundColor Cyan
Write-Host "注意：Credential Guard等其他VBS功能将保持启用状态" -ForegroundColor Yellow
Write-Host ""

# 请求确认
$confirmation = Read-Host "是否继续？(Y/N)"
if ($confirmation -ne 'Y' -and $confirmation -ne 'y') {
    Write-Host "操作已取消" -ForegroundColor Yellow
    exit
}

# 执行禁用命令
Write-Host "执行禁用命令..." -ForegroundColor Cyan
.\DG_Readiness_Tool_v3.6.ps1 -Disable -HVCI -AutoReboot

Write-Host "命令执行完成，系统将自动重启" -ForegroundColor Green

# 步骤1：禁用Credential Guard
Write-Host "[1/3] 禁用Credential Guard..." -ForegroundColor Cyan
.\DG_Readiness_Tool_v3.6.ps1 -Disable -CG

# 步骤2：禁用HVCI
Write-Host "[2/3] 禁用HVCI..." -ForegroundColor Cyan
.\DG_Readiness_Tool_v3.6.ps1 -Disable -HVCI

# 步骤3：禁用Device Guard
Write-Host "[3/3] 禁用Device Guard..." -ForegroundColor Cyan
.\DG_Readiness_Tool_v3.6.ps1 -Disable -DG -AutoReboot

Write-Host "所有步骤完成，系统将自动重启" -ForegroundColor Green

# 如果使用了-AutoReboot参数，系统会自动重启
# 无需手动操作

# 查看当前时间，给用户准备时间
Write-Host "当前时间: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor Cyan
Write-Host "系统将在30秒后重启，请保存所有工作..." -ForegroundColor Yellow

# 30秒倒计时
for ($i = 30; $i -gt 0; $i--) {
    Write-Host "`r重启倒计时: $i 秒" -NoNewline
    Start-Sleep -Seconds 1
}

Write-Host "`n正在重启系统..." -ForegroundColor Green
Restart-Computer -Force

# 检查是否有重要进程运行
$importantProcesses = @("excel", "winword", "powerpnt", "notepad", "code")
$runningProcesses = Get-Process | Where-Object { $importantProcesses -contains $_.ProcessName }

if ($runningProcesses) {
    Write-Host "检测到以下程序正在运行：" -ForegroundColor Yellow
    $runningProcesses | Select-Object ProcessName, MainWindowTitle | Format-Table
    
    $response = Read-Host "是否继续重启？(Y/N)"
    if ($response -ne 'Y' -and $response -ne 'y') {
        Write-Host "重启已取消，请手动关闭程序后重新运行脚本" -ForegroundColor Yellow
        exit
    }
}

# 执行重启
Write-Host "正在重启系统..." -ForegroundColor Green
Restart-Computer -Force

# 查看当前执行策略
Write-Host "当前执行策略：" -ForegroundColor Cyan
Get-ExecutionPolicy -List | Format-Table -AutoSize

# 临时设置为Bypass（仅当前会话）
Write-Host "`n设置执行策略为Bypass（当前会话）..." -ForegroundColor Yellow
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force

# 验证设置
Write-Host "当前会话执行策略: $(Get-ExecutionPolicy -Scope Process)" -ForegroundColor Green

# 现在可以运行脚本了
Write-Host "`n现在可以运行脚本了" -ForegroundColor Green

# 设置为RemoteSigned（允许本地脚本和已签名的远程脚本）
Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned -Force

# 或设置为Unrestricted（不推荐，安全风险高）
# Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy Unrestricted -Force

# 创建自动提升脚本
$selfElevateScript = @'
# 检查是否具有管理员权限
$currentUser = [Security.Principal.WindowsIdentity]::GetCurrent()
$principal = New-Object Security.Principal.WindowsPrincipal($currentUser)
$isAdmin = $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

if (-not $isAdmin) {
    # 重新启动脚本，使用管理员权限
    $arguments = "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`""
    Start-Process powershell.exe -Verb RunAs -ArgumentList $arguments
    exit
}

# 这里放置实际的脚本代码
Write-Host "✓ 已获得管理员权限" -ForegroundColor Green
'@

# 保存为临时文件
$tempScript = "$env:TEMP\SelfElevate.ps1"
$selfElevateScript | Out-File -FilePath $tempScript -Encoding UTF8

# 执行脚本
& $tempScript

# 方法1：临时关闭实时保护（需要管理员权限）
# 打开Windows安全中心
Start-Process "ms-settings:windowssecurity"

# 或使用PowerShell添加排除项
$scriptPath = "C:\Tools\dgreadiness_v3.6"
Add-MpPreference -ExclusionPath $scriptPath
Write-Host "已将工具目录添加到Windows Defender排除项" -ForegroundColor Green

# 方法2：使用Set-MpPreference（需要管理员权限）
Set-MpPreference -DisableRealtimeMonitoring $true
Write-Host "已临时关闭实时保护" -ForegroundColor Yellow
Write-Host "警告：请在操作完成后重新启用实时保护" -ForegroundColor Red

# 操作完成后重新启用
# Set-MpPreference -DisableRealtimeMonitoring $false

# 检查相关组策略设置
$policyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard"
if (Test-Path $policyPath) {
    Write-Host "检测到Device Guard组策略设置：" -ForegroundColor Yellow
    Get-ItemProperty -Path $policyPath | Format-List
}

# 检查LsaCfgFlags设置
$lsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"
$lsaFlags = (Get-ItemProperty -Path $lsaPath -ErrorAction SilentlyContinue).LsaCfgFlags
if ($lsaFlags) {
    Write-Host "LSA隔离配置: $lsaFlags" -ForegroundColor Yellow
    Write-Host "  0 = 未启用" -ForegroundColor Gray
    Write-Host "  1 = 启用并使用UEFI锁" -ForegroundColor Gray
    Write-Host "  2 = 启用但不使用UEFI锁" -ForegroundColor Gray
}

# 临时禁用组策略限制（需要管理员权限）
if (Test-Path $policyPath) {
    Write-Host "`n尝试临时禁用Device Guard组策略..." -ForegroundColor Cyan
    
    # 备份当前设置
    $backupPath = "$backupDir\GroupPolicy_Backup.reg"
    reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" $backupPath /y
    
    # 禁用Device Guard
    Set-ItemProperty -Path $policyPath -Name "EnableDeviceGuard" -Value 0 -ErrorAction SilentlyContinue
    Set-ItemProperty -Path $policyPath -Name "ConfigureSystemGuardLaunch" -Value 0 -ErrorAction SilentlyContinue
    
    Write-Host "组策略设置已临时修改" -ForegroundColor Green
}

# 正确处理启动菜单
Write-Host "系统重启后会出现启动选择菜单：" -ForegroundColor Cyan
Write-Host "====================================" -ForegroundColor Gray
Write-Host "Credential Guard退出工具" -ForegroundColor White
Write-Host "" -ForegroundColor White
Write-Host "是否要禁用Credential Guard？" -ForegroundColor Yellow
Write-Host "禁用此功能可能会允许恶意软件读取所有登录Windows" -ForegroundColor Yellow
Write-Host "用户的密码和其他凭据。在禁用保护之前，请与您的" -ForegroundColor Yellow
Write-Host "管理员联系以采取适合您组织的操作。" -ForegroundColor Yellow
Write-Host "" -ForegroundColor White
Write-Host "按Windows键或F3禁用Credential Guard，ESC跳过此步骤。" -ForegroundColor Green
Write-Host "====================================" -ForegroundColor Gray
Write-Host ""

Write-Host "操作步骤：" -ForegroundColor Cyan
Write-Host "1. 按 F3 或 Windows键 选择禁用" -ForegroundColor White
Write-Host "2. 等待系统完成配置" -ForegroundColor White
Write-Host "3. 系统将再次重启并进入Windows" -ForegroundColor White
Write-Host ""

Write-Host "如果看到'基于虚拟化的安全性退出工具'：" -ForegroundColor Cyan
Write-Host "1. 同样按 F3 或 Windows键 选择禁用" -ForegroundColor White
Write-Host "2. 按任意键继续" -ForegroundColor White
Write-Host "3. 系统将完成禁用操作并重启" -ForegroundColor White

# 检查EFI系统分区
Write-Host "检查EFI系统分区..." -ForegroundColor Cyan

# 临时挂载ESP分区
$espDrive = "X:"
mountvol $espDrive /s

if (Test-Path "${espDrive}\EFI\Microsoft\Boot") {
    Write-Host "✓ EFI分区已挂载到 $espDrive" -ForegroundColor Green
    
    # 检查SecConfig.efi是否存在
    $secConfigPath = "${espDrive}\EFI\Microsoft\Boot\SecConfig.efi"
    if (Test-Path $secConfigPath) {
        Write-Host "✓ SecConfig.efi 存在" -ForegroundColor Green
        
        # 创建启动项
        $guid = "{0cb3b571-2f2e-4343-a879-d86a476d7215}"
        bcdedit /create $guid /d "Disable VBS Tool" /application osloader
        bcdedit /set $guid path "\EFI\Microsoft\Boot\SecConfig.efi"
        bcdedit /set $guid device partition=$espDrive
        bcdedit /set $guid loadoptions DISABLE-VBS
        bcdedit /set {bootmgr} bootsequence $guid
        
        Write-Host "✓ 已创建VBS禁用启动项" -ForegroundColor Green
    } else {
        Write-Host "✗ SecConfig.efi 不存在" -ForegroundColor Red
    }
    
    # 卸载ESP分区
    mountvol $espDrive /d
    Write-Host "✓ EFI分区已卸载" -ForegroundColor Green
} else {
    Write-Host "✗ 无法挂载EFI分区" -ForegroundColor Red
}

# 启动系统信息
Start-Process msinfo32

Write-Host "在系统信息窗口中查找以下内容：" -ForegroundColor Cyan
Write-Host "1. 滚动到底部" -ForegroundColor White
Write-Host "2. 查找'基于虚拟化的安全性'项目" -ForegroundColor White
Write-Host "3. 确认状态为'未运行'（Not Running）" -ForegroundColor Green

Write-Host "VBS状态验证结果：" -ForegroundColor Cyan
Write-Host "================================" -ForegroundColor Gray

# 获取Device Guard状态
$dgStatus = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard

# 基于虚拟化的安全性
$vbsStatus = $dgStatus.VirtualizationBasedSecurityStatus
Write-Host "基于虚拟化的安全性: " -NoNewline
if ($vbsStatus -eq 0) {
    Write-Host "未运行 ✓" -ForegroundColor Green
} else {
    Write-Host "正在运行 ✗" -ForegroundColor Red
}

# 安全服务配置
$servicesConfigured = $dgStatus.SecurityServicesConfigured
Write-Host "已配置的安全服务: $servicesConfigured" -ForegroundColor White

# 安全服务运行
$servicesRunning = $dgStatus.SecurityServicesRunning
Write-Host "正在运行的安全服务: $servicesRunning" -ForegroundColor White

# 详细服务状态
Write-Host "`n详细服务状态：" -ForegroundColor Cyan
Write-Host "--------------------------------" -ForegroundColor Gray

# HVCI状态
if ($servicesRunning -band 1) {
    Write-Host "HVCI（内存完整性）: 启用 ✗" -ForegroundColor Red
} else {
    Write-Host "HVCI（内存完整性）: 禁用 ✓" -ForegroundColor Green
}

# Credential Guard状态
if ($servicesRunning -band 2) {
    Write-Host "Credential Guard: 启用 ✗" -ForegroundColor Red
} else {
    Write-Host "Credential Guard: 禁用 ✓" -ForegroundColor Green
}

# 写入保护状态
if ($dgStatus.Locked -eq 1) {
    Write-Host "写入保护: 启用 ✗" -ForegroundColor Red
} else {
    Write-Host "写入保护: 禁用 ✓" -ForegroundColor Green
}

# 打开核心隔离设置
Start-Process "ms-settings:windowssecurity-coreisolation"

Write-Host "在核心隔离页面中检查：" -ForegroundColor Cyan
Write-Host "1. 点击'核心隔离详细信息'" -ForegroundColor White
Write-Host "2. 确认'内存完整性'开关为'关闭'" -ForegroundColor Green
Write-Host "3. 如果显示'需要重启'，请点击'立即重启'" -ForegroundColor Yellow

Write-Host "BCD启动配置验证：" -ForegroundColor Cyan
Write-Host "================================" -ForegroundColor Gray

# 查看hypervisor启动类型
$hypervisorType = bcdedit /enum | Select-String "hypervisorlaunchtype"
Write-Host "Hypervisor启动类型: " -NoNewline
if ($hypervisorType -match "Off") {
    Write-Host "关闭 ✓" -ForegroundColor Green
} else {
    Write-Host "开启 ✗" -ForegroundColor Red
}

# 查看VSM启动类型
$vsmType = bcdedit /enum | Select-String "vsmlaunchtype"
Write-Host "VSM启动类型: " -NoNewline
if ($vsmType -match "Off") {
    Write-Host "关闭 ✓" -ForegroundColor Green
} else {
    Write-Host "开启 ✗" -ForegroundColor Red
}

Write-Host "虚拟化功能验证：" -ForegroundColor Cyan
Write-Host "================================" -ForegroundColor Gray

# 方法1：使用系统信息
$systemInfo = systeminfo
if ($systemInfo -match "Hyper-V Requirements:.*A hypervisor has been detected") {
    Write-Host "Hyper-V Hypervisor: 检测到 ✗" -ForegroundColor Red
    Write-Host "说明：VBS可能未完全禁用" -ForegroundColor Yellow
} else {
    Write-Host "Hyper-V Hypervisor: 未检测到 ✓" -ForegroundColor Green
    Write-Host "说明：虚拟化功能已释放" -ForegroundColor Green
}

# 方法2：检查WMI
$hypervisor = Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object HypervisorPresent
Write-Host "HypervisorPresent: $($hypervisor.HypervisorPresent)" -ForegroundColor White

# 方法3：使用CoreInfo工具（如果已安装）
$coreInfoPath = "C:\Tools\CoreInfo.exe"
if (Test-Path $coreInfoPath) {
    Write-Host "`n运行CoreInfo工具..." -ForegroundColor Cyan
    & $coreInfoPath
}

# 检查是否安装了Intel Processor Identification Utility
$intelUtil = Get-ChildItem -Path "C:\Program Files", "C:\Program Files (x86)" -Recurse -Filter "IntelProcessorIdentificationUtility.exe" -ErrorAction SilentlyContinue

if ($intelUtil) {
    Write-Host "找到Intel处理器识别工具" -ForegroundColor Green
    Write-Host "路径: $($intelUtil.FullName)" -ForegroundColor Gray
    
    $response = Read-Host "是否启动工具查看虚拟化支持？(Y/N)"
    if ($response -eq 'Y' -or $response -eq 'y') {
        Start-Process $intelUtil.FullName
    }
}

# 创建验证报告
$reportPath = "C:\DGReadiness_Verification_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"
$reportContent = @()
$reportContent += "dgreadiness工具禁用VBS操作验证报告"
$reportContent += "=" * 50
$reportContent += "生成时间: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
$reportContent += ""

# 添加系统信息
$reportContent += "系统信息："
$reportContent += "-" * 30
$computerInfo = Get-CimInstance -ClassName Win32_ComputerSystem
$reportContent += "计算机名: $($computerInfo.Name)"
$reportContent += "操作系统: $((Get-CimInstance Win32_OperatingSystem).Caption)"
$reportContent += "版本: $((Get-CimInstance Win32_OperatingSystem).Version)"
$reportContent += ""

# 添加VBS状态
$reportContent += "VBS状态："
$reportContent += "-" * 30
$dgStatus = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard
$reportContent += "基于虚拟化的安全性: $($dgStatus.VirtualizationBasedSecurityStatus)"
$reportContent += "已配置的安全服务: $($dgStatus.SecurityServicesConfigured)"
$reportContent += "正在运行的安全服务: $($dgStatus.SecurityServicesRunning)"
$reportContent += "HVCI状态: $(if ($dgStatus.SecurityServicesRunning -band 1) { '启用' } else { '禁用' })"
$reportContent += "Credential Guard状态: $(if ($dgStatus.SecurityServicesRunning -band 2) { '启用' } else { '禁用' })"
$reportContent += ""

# 添加BCD配置
$reportContent += "BCD配置："
$reportContent += "-" * 30
$hypervisorType = bcdedit /enum | Select-String "hypervisorlaunchtype"
$vsmType = bcdedit /enum | Select-String "vsmlaunchtype"
$reportContent += $hypervisorType.Line
$reportContent += $vsmType.Line
$reportContent += ""

# 添加总结
$reportContent += "操作总结："
$reportContent += "-" * 30
if ($dgStatus.VirtualizationBasedSecurityStatus -eq 0 -and 
    $dgStatus.SecurityServicesRunning -eq 0) {
    $reportContent += "✓ VBS已成功禁用"
    $reportContent += "✓ 所有安全服务已停止"
    $reportContent += "✓ 虚拟化功能已释放"
} else {
    $reportContent += "✗ VBS可能未完全禁用"
    $reportContent += "✗ 请检查日志文件或重新运行工具"
}

# 保存报告
$reportContent | Out-File -FilePath $reportPath -Encoding UTF8

Write-Host "验证报告已生成: $reportPath" -ForegroundColor Green
Write-Host "报告内容：" -ForegroundColor Cyan
Get-Content $reportPath

# 检查VMware是否安装
$vmwarePath = "${env:ProgramFiles(x86)}\VMware\VMware Workstation\vmware.exe"
if (Test-Path $vmwarePath) {
    Write-Host "检测到VMware Workstation" -ForegroundColor Green
    
    $response = Read-Host "是否启动VMware进行测试？(Y/N)"
    if ($response -eq 'Y' -or $response -eq 'y') {
        Start-Process $vmwarePath
        
        Write-Host "VMware已启动" -ForegroundColor Green
        Write-Host "请尝试启动虚拟机，查看是否正常工作" -ForegroundColor Yellow
        Write-Host "如果虚拟机可以正常启动，说明VBS已成功禁用" -ForegroundColor Green
    }
} else {
    Write-Host "未检测到VMware Workstation" -ForegroundColor Gray
}

# 检查VirtualBox是否安装
$virtualBoxPath = "${env:ProgramFiles}\Oracle\VirtualBox\VirtualBox.exe"
if (Test-Path $virtualBoxPath) {
    Write-Host "检测到VirtualBox" -ForegroundColor Green
    
    $response = Read-Host "是否启动VirtualBox进行测试？(Y/N)"
    if ($response -eq 'Y' -or $response -eq 'y') {
        Start-Process $virtualBoxPath
        
        Write-Host "VirtualBox已启动" -ForegroundColor Green
        Write-Host "请尝试启动虚拟机，查看是否正常工作" -ForegroundColor Yellow
        Write-Host "如果虚拟机可以正常启动，说明VBS已成功禁用" -ForegroundColor Green
    }
} else {
    Write-Host "未检测到VirtualBox" -ForegroundColor Gray
}

# 通用虚拟化功能测试
Write-Host "虚拟化功能测试：" -ForegroundColor Cyan
Write-Host "================================" -ForegroundColor Gray

# 测试1：检查Hyper-V服务
Write-Host "`n[测试1] Hyper-V服务状态" -ForegroundColor Cyan
$hyperVServices = @("hvboot", "HvHost", "vmickvpexchange", "vmicguestinterface", 
                   "vmicshutdown", "vmicheartbeat", "vmicvmsession", "vmicrdv")
foreach ($service in $hyperVServices) {
    $svc = Get-Service -Name $service -ErrorAction SilentlyContinue
    if ($svc) {
        Write-Host "$service : $($svc.Status)" -ForegroundColor White
    }
}

# 测试2：检查虚拟机监控程序
Write-Host "`n[测试2] 虚拟机监控程序状态" -ForegroundColor Cyan
$hypervisor = Get-CimInstance -ClassName Win32_ComputerSystem
Write-Host "HypervisorPresent: $($hypervisor.HypervisorPresent)" -ForegroundColor $(if ($hypervisor.HypervisorPresent) { "Red" } else { "Green" })

# 测试3：检查CPU虚拟化支持
Write-Host "`n[测试3] CPU虚拟化支持" -ForegroundColor Cyan
$cpu = Get-CimInstance -ClassName Win32_Processor
Write-Host "处理器: $($cpu.Name)" -ForegroundColor White

# 检查虚拟化功能
$virtualizationEnabled = $false
if ($cpu.SecondLevelAddressTranslationExtensions) {
    Write-Host "SLAT（二级地址转换）: 支持" -ForegroundColor Green
    $virtualizationEnabled = $true
} else {
    Write-Host "SLAT（二级地址转换）: 不支持" -ForegroundColor Red
}

if ($cpu.VirtualizationFirmwareEnabled) {
    Write-Host "虚拟化固件: 启用" -ForegroundColor Green
} else {
    Write-Host "虚拟化固件: 禁用" -ForegroundColor Red
}

# 总结
Write-Host "`n测试总结：" -ForegroundColor Cyan
Write-Host "================================" -ForegroundColor Gray
if (-not $hypervisor.HypervisorPresent -and $virtualizationEnabled) {
    Write-Host "✓ 虚拟化功能已成功释放" -ForegroundColor Green
    Write-Host "✓ 可以正常使用第三方虚拟化软件" -ForegroundColor Green
} else {
    Write-Host "✗ 虚拟化功能可能未完全释放" -ForegroundColor Red
    Write-Host "✗ 建议重新运行dgreadiness工具" -ForegroundColor Yellow
}

# 导航到工具目录
Set-Location "C:\Tools\dgreadiness_v3.6"

# 重新启用VBS
Write-Host "开始重新启用虚拟化安全..." -ForegroundColor Cyan
.\DG_Readiness_Tool_v3.6.ps1 -Enable -AutoReboot

Write-Host "命令执行完成，系统将自动重启" -ForegroundColor Green

# 仅启用HVCI（内存完整性）
Write-Host "开始重新启用HVCI（内存完整性）..." -ForegroundColor Cyan
.\DG_Readiness_Tool_v3.6.ps1 -Enable -HVCI -AutoReboot

Write-Host "命令执行完成，系统将自动重启" -ForegroundColor Green

# 打开核心隔离设置
Start-Process "ms-settings:windowssecurity-coreisolation"

Write-Host "在核心隔离页面中：" -ForegroundColor Cyan
Write-Host "1. 点击'核心隔离详细信息'" -ForegroundColor White
Write-Host "2. 打开'内存完整性'开关" -ForegroundColor White
Write-Host "3. 点击'立即重启'" -ForegroundColor White

# 查找最新的备份目录
$backupDirs = Get-ChildItem -Path "C:\" -Filter "DGReadiness_Backup_*" | 
              Sort-Object LastWriteTime -Descending

if ($backupDirs.Count -gt 0) {
    $latestBackup = $backupDirs[0].FullName
    Write-Host "找到最新备份: $latestBackup" -ForegroundColor Green
    
    $response = Read-Host "是否恢复注册表备份？(Y/N)"
    if ($response -eq 'Y' -or $response -eq 'y') {
        # 导入所有.reg文件
        $regFiles = Get-ChildItem -Path $latestBackup -Filter "*.reg"
        foreach ($regFile in $regFiles) {
            Write-Host "正在恢复: $($regFile.Name)" -ForegroundColor Cyan
            reg import $regFile.FullName
        }
        
        Write-Host "注册表备份已恢复，需要重启系统" -ForegroundColor Green
        $response = Read-Host "是否立即重启？(Y/N)"
        if ($response -eq 'Y' -or $response -eq 'y') {
            Restart-Computer
        }
    }
} else {
    Write-Host "未找到备份目录" -ForegroundColor Yellow
}

# 在禁用VBS后，建议加强其他安全措施
Write-Host "建议采取的补充安全措施：" -ForegroundColor Cyan
Write-Host "1. 确保Windows Defender实时保护始终启用" -ForegroundColor White
Write-Host "2. 定期更新系统和驱动程序" -ForegroundColor White
Write-Host "3. 仅从可信来源安装软件" -ForegroundColor White
Write-Host "4. 使用强密码和多因素认证" -ForegroundColor White
Write-Host "5. 定期备份重要数据" -ForegroundColor White
Write-Host "6. 限制管理员账户使用" -ForegroundColor White
Write-Host "7. 启用网络防火墙" -ForegroundColor White

Write-Host "禁用VBS后，以下功能可能无法使用：" -ForegroundColor Yellow
Write-Host "================================" -ForegroundColor Gray
Write-Host "✗ Windows Defender Credential Guard" -ForegroundColor Red
Write-Host "✗ Windows Defender Application Guard" -ForegroundColor Red
Write-Host "✗ Windows Sandbox（Windows沙盒）" -ForegroundColor Red
Write-Host "✗ WSL2（Windows子系统 for Linux 2）" -ForegroundColor Red
Write-Host "✗ 某些Windows Hello功能" -ForegroundColor Red
Write-Host "✗ 内存完整性保护" -ForegroundColor Red
Write-Host "✗ 内核隔离功能" -ForegroundColor Red

# 检查Windows功能状态
Write-Host "检查Windows功能状态：" -ForegroundColor Cyan
$features = @(
    @{Name="Containers-DisposableClientVM"; Desc="Windows Sandbox"},
    @{Name="Microsoft-Hyper-V-All"; Desc="Hyper-V"},
    @{Name="VirtualMachinePlatform"; Desc="虚拟机平台"},
    @{Name="Windows-Defender-ApplicationGuard"; Desc="Application Guard"}
)

foreach ($feature in $features) {
    $state = Get-WindowsOptionalFeature -Online -FeatureName $feature.Name -ErrorAction SilentlyContinue
    if ($state -and $state.State -eq "Enabled") {
        Write-Host "$($feature.Desc): 启用" -ForegroundColor Yellow
        Write-Host "  注意：此功能可能受影响" -ForegroundColor Gray
    }
}

# 监控驱动加载错误
Write-Host "监控驱动加载错误（事件查看器）：" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    ProviderName = 'Microsoft-Windows-DriverFrameworks-UserMode'
    Level = 2
} -MaxEvents 10 | Format-List TimeCreated, Message

# 检查Windows更新状态
Write-Host "检查Windows更新历史：" -ForegroundColor Cyan
Get-WindowsUpdateLog | Select-String "Error", "Failed" | Select-Object -First 10

# 性能基准测试建议
Write-Host "建议进行性能基准测试：" -ForegroundColor Cyan
Write-Host "1. 使用PCMark 10进行综合性能测试" -ForegroundColor White
Write-Host "2. 使用CrystalDiskMark测试磁盘性能" -ForegroundColor White
Write-Host "3. 使用3DMark测试图形性能" -ForegroundColor White
Write-Host "4. 记录禁用前后的性能数据对比" -ForegroundColor White

# 硬件兼容性检查脚本
Write-Host "硬件兼容性检查：" -ForegroundColor Cyan
Write-Host "================================" -ForegroundColor Gray

# 1. 检查CPU
$cpu = Get-CimInstance -ClassName Win32_Processor
Write-Host "处理器信息：" -ForegroundColor Yellow
Write-Host "  名称: $($cpu.Name)" -ForegroundColor White
Write-Host "  架构: $($cpu.Architecture)" -ForegroundColor White
Write-Host "  核心数: $($cpu.NumberOfCores)" -ForegroundColor White
Write-Host "  虚拟化: $(if ($cpu.VirtualizationFirmwareEnabled) { '启用' } else { '禁用' })" -ForegroundColor $(if ($cpu.VirtualizationFirmwareEnabled) { "Green" } else { "Red" })
Write-Host "  SLAT: $(if ($cpu.SecondLevelAddressTranslationExtensions) { '支持' } else { '不支持' })" -ForegroundColor $(if ($cpu.SecondLevelAddressTranslationExtensions) { "Green" } else { "Red" })

# 2. 检查内存
$memory = Get-CimInstance -ClassName Win32_PhysicalMemory
$totalMemory = ($memory | Measure-Object -Property Capacity -Sum).Sum / 1GB
Write-Host "`n内存信息：" -ForegroundColor Yellow
Write-Host "  总容量: $([math]::Round($totalMemory, 2)) GB" -ForegroundColor White

if ($totalMemory -lt 4) {
    Write-Host "  警告：内存低于最低要求" -ForegroundColor Red
} elseif ($totalMemory -lt 8) {
    Write-Host "  提示：建议升级到8GB或更多" -ForegroundColor Yellow
} else {
    Write-Host "  状态：满足推荐配置" -ForegroundColor Green
}

# 3. 检查TPM
$tpm = Get-CimInstance -ClassName Win32_Tpm -Namespace root\cimv2\security\microsofttpm -ErrorAction SilentlyContinue
if ($tpm) {
    Write-Host "`nTPM信息：" -ForegroundColor Yellow
    Write-Host "  版本: $($tpm.SpecVersion)" -ForegroundColor White
    Write-Host "  状态: $(if ($tpm.IsEnabled_InitialValue) { '启用' } else { '禁用' })" -ForegroundColor $(if ($tpm.IsEnabled_InitialValue) { "Green" } else { "Red" })
    
    if ($tpm.SpecVersion -match "2\.0") {
        Write-Host "  状态：支持Credential Guard" -ForegroundColor Green
    } else {
        Write-Host "  提示：建议升级到TPM 2.0" -ForegroundColor Yellow
    }
} else {
    Write-Host "`nTPM信息：未检测到TPM" -ForegroundColor Red
}

# 4. 检查UEFI和Secure Boot
$firmware = Get-CimInstance -ClassName Win32_BIOS
Write-Host "`n固件信息：" -ForegroundColor Yellow
Write-Host "  版本: $($firmware.SMBIOSBIOSVersion)" -ForegroundColor White
Write-Host "  日期: $($firmware.ReleaseDate)" -ForegroundColor White

# 检查Secure Boot状态（需要管理员权限）
try {
    $secureBoot = Confirm-SecureBootUEFI
    Write-Host "  Secure Boot: 启用" -ForegroundColor Green
} catch {
    Write-Host "  Secure Boot: 禁用或无法检测" -ForegroundColor Yellow
}

# 5. 检查可用磁盘空间
$systemDrive = Get-PSDrive -Name C
$freeSpaceGB = $systemDrive.Free / 1GB
Write-Host "`n磁盘空间（C盘）：" -ForegroundColor Yellow
Write-Host "  可用空间: $([math]::Round($freeSpaceGB, 2)) GB" -ForegroundColor White

if ($freeSpaceGB -lt 20) {
    Write-Host "  警告：可用空间不足20GB" -ForegroundColor Red
} elseif ($freeSpaceGB -lt 50) {
    Write-Host "  提示：建议保持至少50GB可用空间" -ForegroundColor Yellow
} else {
    Write-Host "  状态：满足要求" -ForegroundColor Green
}

# 系统版本检查
Write-Host "系统版本检查：" -ForegroundColor Cyan
Write-Host "================================" -ForegroundColor Gray

$os = Get-CimInstance -ClassName Win32_OperatingSystem
Write-Host "操作系统： $($os.Caption)" -ForegroundColor White
Write-Host "版本： $($os.Version)" -ForegroundColor White
Write-Host "构建号： $($os.BuildNumber)" -ForegroundColor White
Write-Host "服务包： $($os.ServicePackMajorVersion).$($os.ServicePackMinorVersion)" -ForegroundColor White

# 解析版本号
$buildNumber = [int]$os.BuildNumber
Write-Host "`n版本分析：" -ForegroundColor Yellow

if ($os.Caption -match "Windows 11") {
    if ($buildNumber -ge 26100) {
        Write-Host "  Windows 11 24H2/25H2 - 最新版本" -ForegroundColor Green
    } elseif ($buildNumber -ge 22631) {
        Write-Host "  Windows 11 23H2" -ForegroundColor Green
    } elseif ($buildNumber -ge 22000) {
        Write-Host "  Windows 11 21H2/22H2" -ForegroundColor Green
    }
} elseif ($os.Caption -match "Windows 10") {
    if ($buildNumber -ge 19045) {
        Write-Host "  Windows 10 22H2" -ForegroundColor Green
    } elseif ($buildNumber -ge 19044) {
        Write-Host "  Windows 10 21H2" -ForegroundColor Green
    } elseif ($buildNumber -ge 14393) {
        Write-Host "  Windows 10 1607-21H1" -ForegroundColor Yellow
    }
} elseif ($os.Caption -match "Windows Server") {
    if ($buildNumber -ge 20348) {
        Write-Host "  Windows Server 2022" -ForegroundColor Green
    } elseif ($buildNumber -ge 17763) {
        Write-Host "  Windows Server 2019" -ForegroundColor Green
    } elseif ($buildNumber -ge 14393) {
        Write-Host "  Windows Server 2016" -ForegroundColor Yellow
    }
}

# 检查PowerShell版本
Write-Host "`nPowerShell版本：" -ForegroundColor Yellow
$psVersion = $PSVersionTable.PSVersion
Write-Host "  版本： $($psVersion.Major).$($psVersion.Minor).$($psVersion.Build)" -ForegroundColor White
Write-Host "  版本： $($PSVersionTable.PSEdition)" -ForegroundColor White

if ($psVersion.Major -ge 7) {
    Write-Host "  状态：使用PowerShell 7+，推荐" -ForegroundColor Green
} else {
    Write-Host "  提示：建议升级到PowerShell 7" -ForegroundColor Yellow
}

# 检查.NET Framework版本
Write-Host "`n.NET Framework版本：" -ForegroundColor Yellow
$netVersions = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" -ErrorAction SilentlyContinue
if ($netVersions) {
    $release = (Get-ItemProperty $netVersions.PSPath).Release
    Write-Host "  Release： $release" -ForegroundColor White
    
    if ($release -ge 528040) {
        Write-Host "  版本：4.8或更新 - 满足要求" -ForegroundColor Green
    } elseif ($release -ge 461808) {
        Write-Host "  版本：4.7.2 - 满足最低要求" -ForegroundColor Yellow
    } else {
        Write-Host "  版本：低于4.7.2 - 不满足要求" -ForegroundColor Red
    }
} else {
    Write-Host "  状态：未检测到.NET Framework 4.x" -ForegroundColor Red
}

# 导航到工具目录
Set-Location "C:\Tools\dgreadiness_v3.6"

# 重新启用VBS
Write-Host "开始重新启用虚拟化安全功能..." -ForegroundColor Cyan
Write-Host "此操作将恢复以下功能：" -ForegroundColor Yellow
Write-Host "  - Device Guard" -ForegroundColor Gray
Write-Host "  - Credential Guard" -ForegroundColor Gray
Write-Host "  - HVCI（内存完整性）" -ForegroundColor Gray
Write-Host ""

# 请求确认
$confirmation = Read-Host "是否继续？(Y/N)"
if ($confirmation -ne 'Y' -and $confirmation -ne 'y') {
    Write-Host "操作已取消" -ForegroundColor Yellow
    exit
}

# 执行启用命令
Write-Host "执行启用命令..." -ForegroundColor Cyan
.\DG_Readiness_Tool_v3.6.ps1 -Enable -AutoReboot

Write-Host "命令执行完成，系统将自动重启" -ForegroundColor Green

# 仅启用HVCI
Write-Host "开始重新启用HVCI（内存完整性）..." -ForegroundColor Cyan
Write-Host "注意：仅恢复内存完整性保护" -ForegroundColor Yellow
Write-Host ""

# 请求确认
$confirmation = Read-Host "是否继续？(Y/N)"
if ($confirmation -ne 'Y' -and $confirmation -ne 'y') {
    Write-Host "操作已取消" -ForegroundColor Yellow
    exit
}

# 执行启用命令
Write-Host "执行启用命令..." -ForegroundColor Cyan
.\DG_Readiness_Tool_v3.6.ps1 -Enable -HVCI -AutoReboot

Write-Host "命令执行完成，系统将自动重启" -ForegroundColor Green

# 启动组策略编辑器
Start-Process gpedit.msc

Write-Host "在组策略编辑器中：" -ForegroundColor Cyan
Write-Host "1. 导航到：计算机配置 → 管理模板 → 系统 → Device Guard" -ForegroundColor White
Write-Host "2. 找到'启用基于虚拟化的安全性'" -ForegroundColor White
Write-Host "3. 设置为'未配置'或'已启用'" -ForegroundColor White
Write-Host "4. 点击'应用'和'确定'" -ForegroundColor White
Write-Host "5. 运行以下命令更新组策略：" -ForegroundColor Yellow
Write-Host "   gpupdate /force" -ForegroundColor Gray

# 强制更新组策略
Write-Host "正在更新组策略..." -ForegroundColor Cyan
gpupdate /force

Write-Host "组策略已更新，建议重启系统" -ForegroundColor Green

# 恢复Device Guard注册表配置
Write-Host "恢复Device Guard注册表配置..." -ForegroundColor Cyan

$deviceGuardPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard"

# 设置基本配置
Set-ItemProperty -Path $deviceGuardPath -Name "EnableVirtualizationBasedSecurity" -Value 1 -Type DWord -ErrorAction SilentlyContinue
Set-ItemProperty -Path $deviceGuardPath -Name "RequirePlatformSecurityFeatures" -Value 1 -Type DWord -ErrorAction SilentlyContinue

# 启用HVCI
$hvciPath = "$deviceGuardPath\Scenarios\HypervisorEnforcedCodeIntegrity"
Set-ItemProperty -Path $hvciPath -Name "Enabled" -Value 1 -Type DWord -ErrorAction SilentlyContinue

# 启用Credential Guard
$lsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"
Set-ItemProperty -Path $lsaPath -Name "LsaCfgFlags" -Value 1 -Type DWord -ErrorAction SilentlyContinue

Write-Host "注册表配置已恢复" -ForegroundColor Green
Write-Host "需要重启系统以使更改生效" -ForegroundColor Yellow

# 恢复BCD配置以启用VBS
Write-Host "恢复BCD配置..." -ForegroundColor Cyan

# 启用hypervisor启动
bcdedit /set hypervisorlaunchtype auto
bcdedit /set vsmlaunchtype auto

Write-Host "BCD配置已恢复" -ForegroundColor Green
Write-Host "需要重启系统以使更改生效" -ForegroundColor Yellow

# 查找最新的备份目录
$backupDirs = Get-ChildItem -Path "C:\" -Filter "DGReadiness_Backup_*" | 
              Sort-Object LastWriteTime -Descending

if ($backupDirs.Count -gt 0) {
    $latestBackup = $backupDirs[0].FullName
    Write-Host "找到最新备份: $latestBackup" -ForegroundColor Green
    
    # 显示备份内容
    Write-Host "`n备份内容：" -ForegroundColor Cyan
    Get-ChildItem -Path $latestBackup | Format-Table Name, Length, LastWriteTime -AutoSize
    
    $response = Read-Host "是否恢复此备份？(Y/N)"
    if ($response -eq 'Y' -or $response -eq 'y') {
        # 恢复注册表文件
        $regFiles = Get-ChildItem -Path $latestBackup -Filter "*.reg"
        Write-Host "`n正在恢复注册表备份..." -ForegroundColor Cyan
        
        foreach ($regFile in $regFiles) {
            Write-Host "恢复: $($regFile.Name)" -ForegroundColor White
            reg import $regFile.FullName
        }
        
        Write-Host "注册表备份已恢复" -ForegroundColor Green
        
        # 恢复BCD配置
        $bcdBackup = Get-ChildItem -Path $latestBackup -Filter "BCD_Backup.txt"
        if ($bcdBackup) {
            Write-Host "`nBCD配置备份内容：" -ForegroundColor Cyan
            Get-Content $bcdBackup.FullName | Select-Object -First 20
            
            $response = Read-Host "是否手动恢复BCD配置？(Y/N)"
            if ($response -eq 'Y' -or $response -eq 'y') {
                Write-Host "请根据备份内容手动执行BCD命令" -ForegroundColor Yellow
            }
        }
        
        Write-Host "`n备份恢复完成，需要重启系统" -ForegroundColor Green
        $response = Read-Host "是否立即重启？(Y/N)"
        if ($response -eq 'Y' -or $response -eq 'y') {
            Restart-Computer
        }
    }
} else {
    Write-Host "未找到备份目录" -ForegroundColor Yellow
}

# 列出可用的还原点
Write-Host "可用的系统还原点：" -ForegroundColor Cyan
Write-Host "================================" -ForegroundColor Gray

$restorePoints = Get-ComputerRestorePoint | Sort-Object CreationTime -Descending
$restorePoints | Select-Object @{N="序号";E={$global:i=0}{$global:i++;$global:i}}, 
                              SequenceNumber, 
                              Description, 
                              CreationTime, 
                              @{N="类型";E={$_.RestorePointType}} | 
                              Format-Table -AutoSize

if ($restorePoints.Count -gt 0) {
    Write-Host "`n输入要恢复的还原点序号（0取消）：" -NoNewline
    $selection = Read-Host
    
    if ($selection -match "^\d+$" -and [int]$selection -gt 0 -and [int]$selection -le $restorePoints.Count) {
        $selectedPoint = $restorePoints[[int]$selection - 1]
        
        Write-Host "`n选中的还原点：" -ForegroundColor Cyan
        Write-Host "  描述: $($selectedPoint.Description)" -ForegroundColor White
        Write-Host "  时间: $($selectedPoint.CreationTime)" -ForegroundColor White
        
        $confirmation = Read-Host "`n确认恢复到此还原点？此操作不可撤销(Y/N)"
        if ($confirmation -eq 'Y' -or $confirmation -eq 'y') {
            Write-Host "正在系统还原..." -ForegroundColor Cyan
            Restore-Computer -RestorePoint $selectedPoint.SequenceNumber
            
            Write-Host "系统还原已启动，计算机将重启" -ForegroundColor Green
            Start-Sleep -Seconds 5
            Restart-Computer
        }
    } else {
        Write-Host "操作已取消" -ForegroundColor Yellow
    }
} else {
    Write-Host "没有可用的系统还原点" -ForegroundColor Yellow
}

# 创建完整备份脚本
Write-Host "创建完整备份..." -ForegroundColor Cyan

# 1. 创建备份目录
$backupRoot = "C:\DGReadiness_Backup_$(Get-Date -Format 'yyyyMMdd_HHmmss')"
New-Item -ItemType Directory -Path $backupRoot -Force | Out-Null
Write-Host "备份目录: $backupRoot" -ForegroundColor Green

# 2. 备份注册表
Write-Host "`n[1/5] 备份注册表..." -ForegroundColor Cyan
$regBackupDir = "$backupRoot\Registry"
New-Item -ItemType Directory -Path $regBackupDir -Force | Out-Null

$regPaths = @(
    "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard",
    "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa",
    "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Guard",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"
)

foreach ($path in $regPaths) {
    $fileName = $path.Replace('\', '_').Replace(':', '') + ".reg"
    $filePath = Join-Path $regBackupDir $fileName
    reg export $path $filePath /y
    Write-Host "  已备份: $path" -ForegroundColor Green
}

# 3. 备份BCD配置
Write-Host "`n[2/5] 备份BCD配置..." -ForegroundColor Cyan
$bcdBackup = "$backupRoot\BCD_Configuration.txt"
bcdedit /enum all > $bcdBackup
Write-Host "  已备份: BCD配置" -ForegroundColor Green

# 4. 备份系统信息
Write-Host "`n[3/5] 备份系统信息..." -ForegroundColor Cyan
$sysInfoBackup = "$backupRoot\System_Info.txt"
systeminfo > $sysInfoBackup
Write-Host "  已备份: 系统信息" -ForegroundColor Green

# 5. 备份当前VBS状态
Write-Host "`n[4/5] 备份VBS状态..." -ForegroundColor Cyan
$vbsBackup = "$backupRoot\VBS_Status.txt"
$vbsStatus = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard
$vbsStatus | Out-File -FilePath $vbsBackup
Write-Host "  已备份: VBS状态" -ForegroundColor Green

# 6. 创建系统还原点
Write-Host "`n[5/5] 创建系统还原点..." -ForegroundColor Cyan
$restorePointDesc = "Before DGReadiness Operation - $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
try {
    Checkpoint-Computer -Description $restorePointDesc -RestorePointType "MODIFY_SETTINGS"
    Write-Host "  已创建系统还原点" -ForegroundColor Green
} catch {
    Write-Host "  系统还原点创建失败: $_" -ForegroundColor Red
}

# 7. 生成备份清单
Write-Host "`n生成备份清单..." -ForegroundColor Cyan
$manifestPath = "$backupRoot\Backup_Manifest.txt"
$manifestContent = @"
dgreadiness操作备份清单
================================
备份时间: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')
备份目录: $backupRoot

备份内容：
--------
1. 注册表备份: $(Join-Path $backupRoot "Registry")
2. BCD配置: $bcdBackup
3. 系统信息: $sysInfoBackup
4. VBS状态: $vbsBackup
5. 系统还原点: $restorePointDesc

备份文件列表：
--------
"@

Get-ChildItem -Path $backupRoot -Recurse | ForEach-Object {
    $manifestContent += "$($_.FullName)`r`n"
}

$manifestContent | Out-File -FilePath $manifestPath
Write-Host "  已生成备份清单" -ForegroundColor Green

# 完成
Write-Host "`n================================" -ForegroundColor Gray
Write-Host "备份完成！" -ForegroundColor Green
Write-Host "备份目录: $backupRoot" -ForegroundColor Cyan
Write-Host "备份清单: $manifestPath" -ForegroundColor Cyan
Write-Host ""
Write-Host "建议：将备份目录复制到外部存储设备" -ForegroundColor Yellow

# 创建每日自动备份脚本
$backupScript = @'
# 自动备份脚本
$backupRoot = "C:\DGReadiness_AutoBackup_$(Get-Date -Format 'yyyyMMdd')"
New-Item -ItemType Directory -Path $backupRoot -Force | Out-Null

# 备份注册表
$regBackupDir = "$backupRoot\Registry"
New-Item -ItemType Directory -Path $regBackupDir -Force | Out-Null

$regPaths = @(
    "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard",
    "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"
)

foreach ($path in $regPaths) {
    $fileName = $path.Replace('\', '_').Replace(':', '') + ".reg"
    $filePath = Join-Path $regBackupDir $fileName
    reg export $path $filePath /y
}

# 备份VBS状态
$vbsBackup = "$backupRoot\VBS_Status.txt"
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Out-File -FilePath $vbsBackup

# 清理30天前的旧备份
$oldBackups = Get-ChildItem -Path "C:\" -Filter "DGReadiness_AutoBackup_*" | 
               Where-Object { $_.LastWriteTime -lt (Get-Date).AddDays(-30) }

foreach ($oldBackup in $oldBackups) {
    Remove-Item -Path $oldBackup.FullName -Recurse -Force
}
'@

# 保存脚本
$scriptPath = "C:\Scripts\AutoBackup_DGReadiness.ps1"
New-Item -ItemType Directory -Path (Split-Path $scriptPath) -Force | Out-Null
$backupScript | Out-File -FilePath $scriptPath -Encoding UTF8

Write-Host "自动备份脚本已创建: $scriptPath" -ForegroundColor Green

# 创建计划任务
$action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-NoProfile -ExecutionPolicy Bypass -File `"$scriptPath`""
$trigger = New-ScheduledTaskTrigger -Daily -At "02:00"
$settings = New-ScheduledTaskSettingsSet -StartWhenAvailable -DontStopOnIdleEnd
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest

Register-ScheduledTask -TaskName "AutoBackup DGReadiness" -Action $action -Trigger $trigger -Settings $settings -Principal $Principal -Force

Write-Host "计划任务已创建：AutoBackup DGReadiness" -ForegroundColor Green
Write-Host "执行时间：每天凌晨02:00" -ForegroundColor Yellow

# 临时解决方案（推荐）
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
Write-Host "✓ 执行策略已临时设置为Bypass" -ForegroundColor Green

# 验证设置
Write-Host "当前执行策略: $(Get-ExecutionPolicy -Scope Process)" -ForegroundColor Cyan

# 现在可以运行脚本了
.\DG_Readiness_Tool_v3.6.ps1 -Disable -HVCI

# 查看所有执行策略
Get-ExecutionPolicy -List

# 为当前用户设置RemoteSigned
Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned -Force

# 或设置为Unsecured（不推荐，安全风险高）
Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy Unrestricted -Force

# 方法1：自动提升权限（添加到脚本开头）
if (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
    Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs
    exit
}

# 方法2：检查当前权限
$currentUser = [Security.Principal.WindowsIdentity]::GetCurrent()
$principal = New-Object Security.Principal.WindowsPrincipal($currentUser)
$isAdmin = $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

if (-not $isAdmin) {
    Write-Host "✗ 需要管理员权限" -ForegroundColor Red
    Write-Host "请右键点击PowerShell，选择'以管理员身份运行'" -ForegroundColor Yellow
    exit
} else {
    Write-Host "✓ 已获得管理员权限" -ForegroundColor Green
}

# 检查文件是否存在
$toolPath = "C:\Tools\dgreadiness_v3.6\DG_Readiness_Tool_v3.6.ps1"

if (Test-Path $toolPath) {
    Write-Host "✓ 工具脚本存在" -ForegroundColor Green
} else {
    Write-Host "✗ 工具脚本不存在" -ForegroundColor Red
    Write-Host "请检查路径是否正确" -ForegroundColor Yellow
    
    # 搜索可能的文件位置
    Write-Host "`n正在搜索工具脚本..." -ForegroundColor Cyan
    $possiblePaths = @(
        "$env:USERPROFILE\Downloads\dgreadiness_v3.6",
        "C:\Tools\dgreadiness_v3.6",
        "D:\Tools\dgreadiness_v3.6"
    )
    
    foreach ($path in $possiblePaths) {
        if (Test-Path $path) {
            Write-Host "找到目录: $path" -ForegroundColor Green
            $files = Get-ChildItem -Path $path -Filter "*.ps1"
            foreach ($file in $files) {
                Write-Host "  - $($file.Name)" -ForegroundColor Gray
            }
        }
    }
}

# 正确的执行方式
if (Test-Path $toolPath) {
    Set-Location (Split-Path $toolPath)
    .\DG_Readiness_Tool_v3.6.ps1 -Disable -HVCI
}

# 综合解决方案：完整清理VBS配置
Write-Host "开始完整清理VBS配置..." -ForegroundColor Cyan

# 1. 禁用Windows Hello VBS（Windows 11 24H2/25H2关键修复）
Write-Host "`n[1/6] 禁用Windows Hello VBS..." -ForegroundColor Cyan
$windowsHelloPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello"
if (Test-Path $windowsHelloPath) {
    Set-ItemProperty -Path $windowsHelloPath -Name "Enabled" -Value 0 -Type DWord -Force
    Write-Host "  ✓ Windows Hello VBS已禁用" -ForegroundColor Green
} else {
    Write-Host "  - Windows Hello VBS路径不存在" -ForegroundColor Gray
}

# 2. 禁用Device Guard相关注册表项
Write-Host "`n[2/6] 清理Device Guard注册表..." -ForegroundColor Cyan
$deviceGuardPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard"
if (Test-Path $deviceGuardPath) {
    # 设置基本配置为禁用
    Set-ItemProperty -Path $deviceGuardPath -Name "EnableVirtualizationBasedSecurity" -Value 0 -Type DWord -Force
    Set-ItemProperty -Path $deviceGuardPath -Name "RequirePlatformSecurityFeatures" -Value 0 -Type DWord -Force
    
    # 禁用所有场景
    $scenarios = @("HypervisorEnforcedCodeIntegrity", "WindowsHello", "DeviceGuard")
    foreach ($scenario in $scenarios) {
        $scenarioPath = "$deviceGuardPath\Scenarios\$scenario"
        if (Test-Path $scenarioPath) {
            Set-ItemProperty -Path $scenarioPath -Name "Enabled" -Value 0 -Type DWord -Force
            Write-Host "  ✓ 已禁用: $scenario" -ForegroundColor Green
        }
    }
}

# 3. 清理LSA配置
Write-Host "`n[3/6] 清理LSA配置..." -ForegroundColor Cyan
$lsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"
if (Test-Path $lsaPath) {
    # 删除或禁用LsaCfgFlags
    Remove-ItemProperty -Path $lsaPath -Name "LsaCfgFlags" -ErrorAction SilentlyContinue
    Set-ItemProperty -Path $lsaPath -Name "LsaCfgFlags" -Value 0 -Type DWord -ErrorAction SilentlyContinue
    Write-Host "  ✓ LSA配置已清理" -ForegroundColor Green
}

# 4. 修改BCD配置
Write-Host "`n[4/6] 修改BCD配置..." -ForegroundColor Cyan
bcdedit /set hypervisorlaunchtype off
bcdedit /set vsmlaunchtype off
bcdedit /set `{current`} hypervisorlaunchtype off
bcdedit /set `{current`} vsmlaunchtype off
Write-Host "  ✓ BCD配置已修改" -ForegroundColor Green

# 5. 禁用Windows功能
Write-Host "`n[5/6] 禁用Windows功能..." -ForegroundColor Cyan
$featuresToDisable = @(
    "Microsoft-Hyper-V-All",
    "Microsoft-Hyper-V",
    "HypervisorPlatform",
    "VirtualMachinePlatform",
    "Containers-DisposableClientVM",
    "Windows-Defender-ApplicationGuard"
)

foreach ($feature in $featuresToDisable) {
    $state = Get-WindowsOptionalFeature -Online -FeatureName $feature -ErrorAction SilentlyContinue
    if ($state -and $state.State -eq "Enabled") {
        Disable-WindowsOptionalFeature -Online -FeatureName $feature -NoRestart
        Write-Host "  ✓ 已禁用: $feature" -ForegroundColor Green
    }
}

# 6. 使用dgreadiness工具确认
Write-Host "`n[6/6] 使用dgreadiness工具确认..." -ForegroundColor Cyan
$dgToolPath = "C:\Tools\dgreadiness_v3.6\DG_Readiness_Tool_v3.6.ps1"
if (Test-Path $dgToolPath) {
    Set-Location (Split-Path $dgToolPath)
    .\DG_Readiness_Tool_v3.6.ps1 -Disable
    Write-Host "  ✓ dgreadiness工具已执行" -ForegroundColor Green
}

Write-Host "`n================================" -ForegroundColor Gray
Write-Host "配置清理完成！" -ForegroundColor Green
Write-Host "请立即重启系统" -ForegroundColor Yellow
Write-Host "重启后如出现SecConfig菜单，请按F3确认禁用" -ForegroundColor Yellow

# 检查是否有UEFI锁
$deviceGuardPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard"
$locked = (Get-ItemProperty -Path $deviceGuardPath -ErrorAction SilentlyContinue).Locked

if ($locked -eq 1) {
    Write-Host "检测到UEFI锁" -ForegroundColor Yellow
    Write-Host "需要在BIOS/UEFI中手动禁用以下选项：" -ForegroundColor Cyan
    Write-Host "1. Virtualization Based Security (VBS)" -ForegroundColor White
    Write-Host "2. Secure Boot" -ForegroundColor White
    Write-Host "3. Intel SGX / AMD PSP" -ForegroundColor White
    Write-Host ""
    Write-Host "具体步骤：" -ForegroundColor Cyan
    Write-Host "1. 重启电脑" -ForegroundColor White
    Write-Host "2. 进入BIOS/UEFI设置（通常按F2、Del、F10等）" -ForegroundColor White
    Write-Host "3. 找到Security或Advanced选项" -ForegroundColor White
    Write-Host "4. 禁用VBS相关选项" -ForegroundColor White
    Write-Host "5. 保存并退出" -ForegroundColor White
    Write-Host "6. 重新运行此脚本" -ForegroundColor White
}

# 安全模式下修复
Write-Host "系统蓝屏修复方案：" -ForegroundColor Cyan
Write-Host "================================" -ForegroundColor Gray
Write-Host "步骤1：进入安全模式" -ForegroundColor Yellow
Write-Host "  - 强制关机3次，进入Windows恢复环境" -ForegroundColor White
Write-Host "  - 选择'高级选项' → '启动设置' → '重启'" -ForegroundColor White
Write-Host "  - 按4或F4进入安全模式" -ForegroundColor White
Write-Host ""

Write-Host "步骤2：运行修复命令" -ForegroundColor Yellow
Write-Host "  在安全模式下打开PowerShell（管理员），执行：" -ForegroundColor White
Write-Host ""
Write-Host "  # 禁用VBS" -ForegroundColor Gray
Write-Host "  bcdedit /set hypervisorlaunchtype off" -ForegroundColor Cyan
Write-Host "  bcdedit /set vsmlaunchtype off" -ForegroundColor Cyan
Write-Host ""
Write-Host "  # 修复系统文件" -ForegroundColor Gray
Write-Host "  sfc /scannow" -ForegroundColor Cyan
Write-Host ""
Write-Host "  # 修复映像" -ForegroundColor Gray
Write-Host "  DISM /Online /Cleanup-Image /RestoreHealth" -ForegroundColor Cyan
Write-Host ""
Write-Host "  # 恢复注册表" -ForegroundColor Gray
Write-Host "  reg import C:\DGReadiness_Backup_*.reg" -ForegroundColor Cyan
Write-Host ""

Write-Host "步骤3：正常重启" -ForegroundColor Yellow
Write-Host "  重启系统，看是否正常启动" -ForegroundColor White
Write-Host ""

Write-Host "步骤4：使用系统还原" -ForegroundColor Yellow
Write-Host "  如果仍然蓝屏，使用系统还原点恢复" -ForegroundColor White
Write-Host "  或使用'重置此电脑'功能" -ForegroundColor White

# 系统修复脚本（需在安全模式下运行）
Write-Host "开始系统修复..." -ForegroundColor Cyan

# 1. 修复系统文件
Write-Host "[1/4] 修复系统文件..." -ForegroundColor Cyan
sfc /scannow

# 2. 修复Windows映像
Write-Host "[2/4] 修复Windows映像..." -ForegroundColor Cyan
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

# 3. 修复BCD
Write-Host "[3/4] 修复BCD配置..." -ForegroundColor Cyan
bcdedit /set hypervisorlaunchtype off
bcdedit /set vsmlaunchtype off
bcdedit /set {default} safeboot minimal

# 4. 修复注册表
Write-Host "[4/4] 恢复默认注册表配置..." -ForegroundColor Cyan
$deviceGuardPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard"
if (Test-Path $deviceGuardPath) {
    Set-ItemProperty -Path $deviceGuardPath -Name "EnableVirtualizationBasedSecurity" -Value 0 -Type DWord -Force
    Set-ItemProperty -Path $deviceGuardPath -Name "RequirePlatformSecurityFeatures" -Value 0 -Type DWord -Force
}

Write-Host "修复完成！重启系统" -ForegroundColor Green
Write-Host "重启后按F8进入启动菜单，选择'正常启动'" -ForegroundColor Yellow