Remove Windows AI

0-3

Luti Build VirusTotal

Remove Windows AI

WAPT package that disables and removes all Windows AI features from Windows 10/11 systems.

Based on RemoveWindowsAI by zoicware.

What this package does

Install

Kills AI processes and services (WSAIFabricSvc, AarSvc, WorkloadsSessionHost, aihost, etc.)
Disables registry keys (HKLM & HKCU): Copilot, Recall, Click To Do, AI in Edge, Office, Paint, Notepad, Windows Search
Disables Copilot policies in IntegratedServicesRegionPolicySet.json and Visual Assist
Removes Recall optional feature via DISM
Removes Recall scheduled tasks and cleans the task cache registry
Removes AI Appx packages: Copilot, AIX, CoreAI, Office Hub, Writing Assistant, WindowsWorkload packages (Copilot+ PCs)
Removes hidden AI CBS packages: AIX, Recall, Copilot, CoreAI
Hides AI settings pages (aicomponents, appactions) from Windows Settings

Uninstall

Re-enables HKLM registry keys
Re-enables Copilot policies
Restores Appx package registry blocks (Deprovisioned/EndOfLife) using saved rollback data
Unhides AI settings pages
Note: Appx packages themselves will be restored by Windows Update after uninstall

Session setup / cleanup

Applies and reverts HKCU registry keys per user session

Audit

Verifies all registry keys, policies, Recall feature state, scheduled tasks, Appx packages, CBS packages, and settings visibility

Important warnings

Antivirus detection

This package uses TrustedInstaller service hijacking to execute commands with TrustedInstaller privileges. This technique temporarily modifies the binPath of the TrustedInstaller service to run PowerShell scripts, then restores it. Some antivirus or EDR solutions may flag this behavior as suspicious or malicious. You may need to add an exclusion for this package in your security solution.

Windows Update issues

Some users have reported that Windows Update may fail or be blocked after removing AI components, particularly CBS packages. This is because Windows Update may attempt to reinstall or service these components and fail when they are missing. If you experience Windows Update issues after installing this package:

Try uninstalling this package first
Run DISM /Online /Cleanup-Image /RestoreHealth
Run sfc /scannow

Copilot+ PCs

On Copilot+ PCs (ARM64 with NPU), this package also removes WindowsWorkload packages used by on-device AI features. These packages may be locked by running processes, which is why the package kills AI processes before removal.

Reversibility

Registry changes are fully reversible via uninstall/session_cleanup
Appx package removal is tracked in a rollback JSON file (persistent_dir/appx_rollback.json)
CBS package removal and Recall feature removal are not reversible without a Windows repair or reinstall

package: tis-remove-windows-ai
name: Remove Windows AI
version: 0-3
maintainer: WAPT Team,Tranquil IT,Flavien SCHELFAUT
target_os: windows
architecture: all
signature_date: 2026-02-23T10:07:18.000000
size: 17.32 Ko

package           : tis-remove-windows-ai
version           : 0-3
architecture      : all
section           : base
priority          : optional
name              : Remove Windows AI
categories        : 
maintainer        : WAPT Team,Tranquil IT,Flavien SCHELFAUT
description       : Disables and removes Windows AI features
depends           : 
conflicts         : 
maturity          : PROD
locale            : 
target_os         : windows
min_wapt_version  : 2.5
sources           : https://github.com/zoicware/RemoveWindowsAI
installed_size    : 
impacted_process  : 
description_fr    : Désactive et supprime les fonctionnalités IA de Windows
description_pl    : Wyłącza i usuwa funkcje AI systemu Windows
description_de    : Deaktiviert und entfernt Windows-KI-Funktionen
description_es    : Desactiva y elimina las funciones de IA de Windows
description_pt    : Desativa e remove as funcionalidades de IA do Windows
description_it    : Disattiva e rimuove le funzionalità IA di Windows
description_nl    : Schakelt Windows AI-functies uit en verwijdert deze
description_ru    : Отключает и удаляет функции ИИ Windows
audit_schedule    : 
editor            : 
keywords          : 
licence           : 
homepage          : 
package_uuid      : 1c52ce7e-a980-4a25-8632-abdec2267dc1
valid_from        : 
valid_until       : 
forced_install_on : 
changelog         : 
min_os_version    : 10.0.26100
max_os_version    : 
icon_sha256sum    : 7891f1ca19ac8a9e41cb2963c0833bb3424a1dcc3f89e6ae484b1841a67063b2
signer            : Tranquil IT
signer_fingerprint: 8c5127a75392be9cc9afd0dbae1222a673072c308c14d88ab246e23832e8c6bb
signature_date    : 2026-02-23T10:07:18.000000
signed_attributes : package,version,architecture,section,priority,name,categories,maintainer,description,depends,conflicts,maturity,locale,target_os,min_wapt_version,sources,installed_size,impacted_process,description_fr,description_pl,description_de,description_es,description_pt,description_it,description_nl,description_ru,audit_schedule,editor,keywords,licence,homepage,package_uuid,valid_from,valid_until,forced_install_on,changelog,min_os_version,max_os_version,icon_sha256sum,signer,signer_fingerprint,signature_date,signed_attributes
signature         : hDlhvwYgPI0DdHR/Ugou58lC7NJAdVCxx365KdHcmLc7q+65XDDrN47KUM8q/w2UTzdgZK2EtQR7IESBXi395RRNMrEuNxoinRvOeL1t++iaK0vD5j5OuErsMRN0T/mcWwgCJZjiczTxnuPNAyXpgZAT2cezzWQLzwOxY6zmRqH0xGqt8kyJnEPEp2I3Pg6g4aao2eOWkDWx1LXPISmwYV04vXU20lDHn4p+TVZqU3JSI5YTJIpmUK4dWV1H+ed90MTL0/YCABjA18rFyGl3+DXRWebNEH0TfBThiHeSMUgQvn50epUKRCd6mMoQBlujSt2x7VYFmGjvEjslVDhplQ==

# -*- coding: utf-8 -*-
from setuphelpers import *
from setupdevhelpers import *
import fnmatch
import json
import time
import tempfile
import re

"""
Inspired by https://github.com/zoicware/RemoveWindowsAI

Implemented feature :
- Disable Registry Keys
- Remove AI Appx Packages
- Disable Copilot policies
- Remove Recall Optional Feature
- Remove Recall Tasks
- Disable Rewrite AI Feature in Notepad
- Hide AI Components
- Remove AI Packages in CBS
"""

DEBUG = False

AI_PACKAGES = [
    'MicrosoftWindows.Client.AIX',
    'MicrosoftWindows.Client.CoPilot',
    'Microsoft.Windows.Ai.Copilot.Provider',
    'Microsoft.Copilot',
    'Microsoft.MicrosoftOfficeHub',
    'MicrosoftWindows.Client.CoreAI',
    'Microsoft.Edge.GameAssist',
    'Microsoft.Office.ActionsServer',
    'aimgr',
    'Microsoft.WritingAssistant',
    # AI component packages on Copilot+ PCs
    'MicrosoftWindows.*.Voiess',
    'MicrosoftWindows.*.Speion',
    'MicrosoftWindows.*.Livtop',
    'MicrosoftWindows.*.InpApp',
    'MicrosoftWindows.*.Filons',
    'WindowsWorkload.Data.Analysis.Stx.*',
    'WindowsWorkload.Manager.*',
    'WindowsWorkload.PSOnnxRuntime.Stx.*',
    'WindowsWorkload.PSTokenizer.Stx.*',
    'WindowsWorkload.QueryBlockList.*',
    'WindowsWorkload.QueryProcessor.Data.*',
    'WindowsWorkload.QueryProcessor.Stx.*',
    'WindowsWorkload.SemanticText.Data.*',
    'WindowsWorkload.SemanticText.Stx.*',
    'WindowsWorkload.Data.ContentExtraction.Stx.*',
    'WindowsWorkload.ScrRegDetection.Data.*',
    'WindowsWorkload.ScrRegDetection.Stx.*',
    'WindowsWorkload.TextRecognition.Stx.*',
    'WindowsWorkload.Data.ImageSearch.Stx.*',
    'WindowsWorkload.ImageContentModeration.*',
    'WindowsWorkload.ImageContentModeration.Data.*',
    'WindowsWorkload.ImageSearch.Data.*',
    'WindowsWorkload.ImageSearch.Stx.*',
    'WindowsWorkload.ImageTextSearch.Data.*',
    'WindowsWorkload.PSTokenizerShared.Data.*',
    'WindowsWorkload.PSTokenizerShared.Stx.*',
    'WindowsWorkload.ImageTextSearch.Stx.*',
]

AI_PROCESSES = [
    'ai.exe', 'aihost.exe', 'aicontext.exe', 'aimgr.exe',
    'Copilot.exe', 'ClickToDo.exe', 'aixhost.exe',
    'WorkloadsSessionHost.exe', 'WorkloadsSessionManager.exe',
    'WebViewHost.exe', 'AppActions.exe',
]

AI_SERVICES = ['WSAIFabricSvc', 'AarSvc']

AI_TASKS = [
    r'\Microsoft\Windows\WindowsAI\Recall\InitialConfiguration',
    r'\Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration',
    r'\Microsoft\Office\Office Actions Server',
]


def run_powershell(cmd, **kwargs):
    from setuphelpers_windows import run_powershell as _run_powershell
    cmd = "$ProgressPreference = 'SilentlyContinue'; " + cmd
    return _run_powershell(cmd, **kwargs)


def ensure_list_powershell(result):
    """Ensure run_powershell result is always a list"""
    if not result:
        return []
    return [result] if isinstance(result, dict) else result


def get_installed_appx():
    """Returns list of installed Appx packages (all users) with Name, PackageFullName, PackageFamilyName, UserSIDs"""
    return ensure_list_powershell(run_powershell(
        r'Get-AppxPackage -AllUsers | Select-Object Name, PackageFullName, PackageFamilyName, '
        r'@{N="UserSIDs";E={($_.PackageUserInformation | ForEach-Object { $_.UserSecurityId.Sid }) -join ","}}'
    ))


def get_provisioned_appx():
    """Returns list of provisioned Appx packages with DisplayName, PackageName"""
    return ensure_list_powershell(run_powershell(
        'Get-AppxProvisionedPackage -Online | Select-Object DisplayName, PackageName'
    ))


def find_matching_ai_packages(packages, key='PackageFullName'):
    """Returns packages matching any AI_PACKAGES pattern on the given key"""
    return [pkg for pkg in packages if any(fnmatch.fnmatch(pkg.get(key, ''), f'*{p}*') for p in AI_PACKAGES)]


def get_active_user_sids():
    """Returns list of active user SIDs from loaded HKU hives"""
    return [sid for sid in reg_enum_subkeys(reg_openkey_noredir(HKEY_USERS, ''))
            if sid.startswith('S-1-5-21') and '_Classes' not in sid]


def kill_ai_processes():
    """Kill AI processes and stop AI services to unlock packages"""
    for svc in AI_SERVICES:
        if service_is_running(svc):
            service_stop(svc)

    killalltasks(ensure_list(AI_PROCESSES))


def set_ai_settings_visibility(hide=True):
    """Hide or unhide AI components and App Actions pages in Windows Settings"""
    SETTINGS_PAGE_KEY = r'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer'
    AI_PAGES_TO_HIDE = 'aicomponents;appactions;'

    existing = registry_readstring(HKEY_LOCAL_MACHINE, SETTINGS_PAGE_KEY, 'SettingsPageVisibility')

    if hide:
        if existing and 'showonly' in existing:
            print('SettingsPageVisibility contains "showonly", skipping')
            return

        if not existing:
            registry_setstring(HKEY_LOCAL_MACHINE, SETTINGS_PAGE_KEY, 'SettingsPageVisibility', f'hide:{AI_PAGES_TO_HIDE}')
        elif AI_PAGES_TO_HIDE not in existing:
            sep = '' if existing.endswith(';') else ';'
            registry_setstring(HKEY_LOCAL_MACHINE, SETTINGS_PAGE_KEY, 'SettingsPageVisibility', f'{existing}{sep}{AI_PAGES_TO_HIDE}')
    else:
        if not existing:
            return
        if existing == f'hide:{AI_PAGES_TO_HIDE}':
            registry_delete(HKEY_LOCAL_MACHINE, SETTINGS_PAGE_KEY, 'SettingsPageVisibility')
        else:
            registry_setstring(HKEY_LOCAL_MACHINE, SETTINGS_PAGE_KEY, 'SettingsPageVisibility', existing.replace(AI_PAGES_TO_HIDE, ''))

    print(f'AI components {"hidden" if hide else "unhidden"} in Settings')


def run_as_trustedinstaller(command):
    """Execute a command as TrustedInstaller by hijacking the TI service binPath."""

    ti_service = 'TrustedInstaller'
    ti_default_bin = rf'{os.environ["SystemRoot"]}\servicing\TrustedInstaller.exe'

    # Stop TrustedInstaller if running
    try:
        if service_is_running(ti_service):
            service_stop(ti_service)
    except Exception:
        run('taskkill /im trustedinstaller.exe /f', accept_returncodes=[0, 128, 1])

    # Swap binPath to our command, start, then revert
    run(f'sc.exe config {ti_service} binPath="{command}"')
    run(f'sc.exe start {ti_service}', accept_returncodes=[0, 1056, 1053])
    time.sleep(2)
    run(f'sc.exe config {ti_service} binPath="{ti_default_bin}"')

    # Stop again to clean up
    try:
        if service_is_running(ti_service):
            service_stop(ti_service)
    except Exception:
        run('taskkill /im trustedinstaller.exe /f', accept_returncodes=[0, 128, 1])


def run_powershell_as_ti(ps_commands):
    """Run PowerShell command(s) as TrustedInstaller via a temp script file."""
    if isinstance(ps_commands, list):
        script_content = '\n'.join(ps_commands)
    else:
        script_content = ps_commands

    script_path = makepath(tempfile.gettempdir(), 'wapt_ti_script.ps1')
    log_path = makepath(tempfile.gettempdir(), 'wapt_ti_script.log')

    if DEBUG:
        script_content = re.sub(r'-E(?:rrorAction|A)\s+(?:SilentlyContinue|0)', '-EA Continue', script_content)
        print("Script RUN as Trusted Installer: \n" + script_content)
        script_content = f'Start-Transcript -Path "{log_path}" -Force\n{script_content}\nStop-Transcript'

    with open(script_path, 'w', encoding='utf-8') as f:
        f.write(script_content)

    try:
        run_as_trustedinstaller(f'cmd.exe /c powershell.exe -win hidden -nop -ep bypass -file "{script_path}"')
    finally:
        if isfile(log_path):
            with open(log_path, 'r', encoding='utf-8', errors='ignore') as f:
                log_content = f.read().strip()
            if log_content:
                print(f'TrustedInstaller output:\n{log_content}')
            remove_file(log_path)
        if isfile(script_path):
            remove_file(script_path)


def set_registry_keys_hklm(disable=True):
    """Apply or revert Windows AI registry keys in HKLM"""

    if disable:
        registry_deletekey(HKEY_LOCAL_MACHINE, r'SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsAI', 'LastConfiguration')

    # Windows Copilot and WindowsAI policies
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot', 'TurnOffWindowsCopilot', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI', 'DisableAIDataAnalysis', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI', 'AllowRecallEnablement', 0 if disable else 1)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI', 'DisableClickToDo', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI', 'TurnOffSavingSnapshots', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI', 'DisableSettingsAgent', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI', 'DisableAgentConnectors', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI', 'DisableAgentWorkspaces', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI', 'DisableRemoteAgentConnectors', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Microsoft\Windows\Shell\Copilot\BingChat', 'IsUserEligible', 0 if disable else 1)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Microsoft\Windows\Shell\Copilot', 'IsCopilotAvailable', 0 if disable else 1)
    registry_setstring(HKEY_LOCAL_MACHINE, r'SOFTWARE\Microsoft\Windows\Shell\Copilot', 'CopilotDisabledReason', 'FeatureIsDisabled' if disable else ' ')

    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\Capabilities\systemAIModels', 'RecordUsageData', 0 if disable else 1)

    # Copilot in Edge
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Edge', 'CopilotCDPPageContext', 0 if disable else 1)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Edge', 'CopilotPageContext', 0 if disable else 1)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Edge', 'HubsSidebarEnabled', 0 if disable else 1)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Edge', 'EdgeEntraCopilotPageContext', 0 if disable else 1)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Edge', 'Microsoft365CopilotChatIconEnabled', 0 if disable else 1)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Edge', 'EdgeHistoryAISearchEnabled', 0 if disable else 1)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Edge', 'ComposeInlineEnabled', 0 if disable else 1)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Edge', 'GenAILocalFoundationalModelSettings', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Edge', 'BuiltInAIAPIsEnabled', 0 if disable else 1)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Edge', 'AIGenThemesEnabled', 0 if disable else 1)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Edge', 'DevToolsGenAiSettings', 2 if disable else 1)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Edge', 'ShareBrowsingHistoryWithCopilotSearchAllowed', 0 if disable else 1)

    # AI in Office
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\office\16.0\common\ai\training\general', 'disabletraining', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\office\16.0\common\ai\training\specific\adaptivefloatie', 'disabletrainingofadaptivefloatie', 1 if disable else 0)

    # Office AI content safety
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\office\16.0\common\ai\contentsafety\general', 'disablecontentsafety', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\office\16.0\common\ai\contentsafety\specific\alternativetext', 'disablecontentsafety', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\office\16.0\common\ai\contentsafety\specific\imagequestionandanswering', 'disablecontentsafety', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\office\16.0\common\ai\contentsafety\specific\promptassistance', 'disablecontentsafety', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\office\16.0\common\ai\contentsafety\specific\rewrite', 'disablecontentsafety', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\office\16.0\common\ai\contentsafety\specific\summarization', 'disablecontentsafety', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\office\16.0\common\ai\contentsafety\specific\summarizationwithreferences', 'disablecontentsafety', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\office\16.0\common\ai\contentsafety\specific\texttotable', 'disablecontentsafety', 1 if disable else 0)

    # Additional keys
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings', 'AutoOpenCopilotLargeScreens', 0 if disable else 1)
    registry_setstring(HKEY_LOCAL_MACHINE, r'SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\generativeAI', 'Value', 'Deny' if disable else 'Allow')
    registry_setstring(HKEY_LOCAL_MACHINE, r'SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\systemAIModels', 'Value', 'Deny' if disable else 'Allow')
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Windows\AppPrivacy', 'LetAppsAccessGenerativeAI', 2 if disable else 1)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Windows\AppPrivacy', 'LetAppsAccessSystemAIModels', 2 if disable else 1)

    # AI actions (Feature Management)
    fm_base = r'SYSTEM\ControlSet001\Control\FeatureManagement\Overrides\8'
    fm_ids_state1 = ['1853569164', '4098520719', '929719951', '1546588812', '203105932', '2381287564',
                     '3189581453', '3552646797', '3389499533', '4027803789', '450471565', '2283032206', '502943886']
    for fm_id in fm_ids_state1:
        registry_set(HKEY_LOCAL_MACHINE, makepath(fm_base, fm_id), 'EnabledState', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, makepath(fm_base, '1646260367'), 'EnabledState', 2 if disable else 0)

    # Copilot ads in Settings
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\Microsoft\Windows\CloudContent', 'DisableConsumerAccountStateContent', 1 if disable else 0)

    # AI image creator in Paint
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Paint', 'DisableImageCreator', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Paint', 'DisableCocreator', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Paint', 'DisableGenerativeFill', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Paint', 'DisableGenerativeErase', 1 if disable else 0)
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Paint', 'DisableRemoveBackground', 1 if disable else 0)

    # Notepad AI
    registry_set(HKEY_LOCAL_MACHINE, r'SOFTWARE\Policies\WindowsNotepad', 'DisableAIFeatures', 1 if disable else 0)


def apply_hku_keys(sid, disable=True):
    """Apply HKU AI registry keys for a given user SID"""

    if disable:
        # Delete user Copilot keys
        registry_delete(HKEY_USERS, makepath(sid, r'Software\Microsoft\Windows\Shell\Copilot'), 'CopilotLogonTelemetryTime')
        registry_deletekey(HKEY_USERS, makepath(sid, r'Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Copilot_8wekyb3d8bbwe'), 'Copilot.StartupTaskId')
        registry_deletekey(HKEY_USERS, makepath(sid, r'Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe'), 'WebViewHostStartupId')
        registry_delete(HKEY_USERS, makepath(sid, r'Software\Microsoft\Copilot'), 'WakeApp')

    # Windows Copilot and WindowsAI policies
    registry_set(HKEY_USERS, makepath(sid, r'SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot'), 'TurnOffWindowsCopilot', 1 if disable else 0)
    registry_set(HKEY_USERS, makepath(sid, r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI'), 'DisableAIDataAnalysis', 1 if disable else 0)
    registry_set(HKEY_USERS, makepath(sid, r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI'), 'AllowRecallEnablement', 0 if disable else 1)
    registry_set(HKEY_USERS, makepath(sid, r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI'), 'DisableClickToDo', 1 if disable else 0)
    registry_set(HKEY_USERS, makepath(sid, r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI'), 'TurnOffSavingSnapshots', 1 if disable else 0)
    registry_set(HKEY_USERS, makepath(sid, r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI'), 'DisableSettingsAgent', 1 if disable else 0)
    registry_set(HKEY_USERS, makepath(sid, r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI'), 'DisableAgentConnectors', 1 if disable else 0)
    registry_set(HKEY_USERS, makepath(sid, r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI'), 'DisableAgentWorkspaces', 1 if disable else 0)
    registry_set(HKEY_USERS, makepath(sid, r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI'), 'DisableRemoteAgentConnectors', 1 if disable else 0)
    registry_set(HKEY_USERS, makepath(sid, r'SOFTWARE\Microsoft\Windows\Shell\Copilot\BingChat'), 'IsUserEligible', 0 if disable else 1)
    registry_set(HKEY_USERS, makepath(sid, r'SOFTWARE\Microsoft\Windows\Shell\Copilot'), 'IsCopilotAvailable', 0 if disable else 1)
    registry_setstring(HKEY_USERS, makepath(sid, r'SOFTWARE\Microsoft\Windows\Shell\Copilot'), 'CopilotDisabledReason', 'FeatureIsDisabled' if disable else ' ')

    # Microphone access to Copilot
    registry_setstring(HKEY_USERS, makepath(sid, r'Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\Microsoft.Copilot_8wekyb3d8bbwe'), 'Value', 'Deny' if disable else 'Prompt')
    registry_setstring(HKEY_USERS, makepath(sid, r'Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe'), 'Value', 'Deny' if disable else 'Prompt')
    registry_setstring(HKEY_USERS, makepath(sid, r'Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\systemAIModels'), 'Value', 'Deny' if disable else 'Prompt')

    # Voice activation and Copilot button
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\Speech_OneCore\Settings\VoiceActivation\UserPreferenceForAllApps'), 'AgentActivationEnabled', 0 if disable else 1)
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced'), 'ShowCopilotButton', 0 if disable else 1)
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\input\Settings'), 'InsightsEnabled', 0 if disable else 1)
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\Windows\Shell\ClickToDo'), 'DisableClickToDo', 1 if disable else 0)

    # Copilot in Windows Search
    registry_set(HKEY_USERS, makepath(sid, r'SOFTWARE\Policies\Microsoft\Windows\Explorer'), 'DisableSearchBoxSuggestions', 1 if disable else 0)

    # AI in Office (user settings)
    registry_set(HKEY_USERS, makepath(sid, r'Software\Policies\Microsoft\office\16.0\common\privacy'), 'controllerconnectedservicesenabled', 2 if disable else 1)
    registry_set(HKEY_USERS, makepath(sid, r'Software\Policies\Microsoft\office\16.0\common\privacy'), 'usercontentdisabled', 2 if disable else 1)

    # Copilot in Word, Excel, OneNote
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\Office\16.0\Word\Options'), 'EnableCopilot', 0 if disable else 1)
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\Office\16.0\Excel\Options'), 'EnableCopilot', 0 if disable else 1)
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\Office\16.0\OneNote\Options\Copilot'), 'CopilotEnabled', 0 if disable else 1)
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\Office\16.0\OneNote\Options\Copilot'), 'CopilotNotebooksEnabled', 0 if disable else 1)
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\Office\16.0\OneNote\Options\Copilot'), 'CopilotSkittleEnabled', 0 if disable else 1)

    # Additional keys
    registry_set(HKEY_USERS, makepath(sid, r'SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsCopilot'), 'AllowCopilotRuntime', 0 if disable else 1)
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband\AuxilliaryPins'), 'CopilotPWAPin', 0 if disable else 1)
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband\AuxilliaryPins'), 'RecallPin', 0 if disable else 1)

    # Copilot background access
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications\Microsoft.Copilot_8wekyb3d8bbwe'), 'DisabledByUser', 1 if disable else 0)
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications\Microsoft.Copilot_8wekyb3d8bbwe'), 'Disabled', 1 if disable else 0)
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications\Microsoft.Copilot_8wekyb3d8bbwe'), 'SleepDisabled', 1 if disable else 0)
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe'), 'DisabledByUser', 1 if disable else 0)
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe'), 'Disabled', 1 if disable else 0)
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe'), 'SleepDisabled', 1 if disable else 0)

    # Ask Copilot (taskbar search)
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced'), 'TaskbarCompanion', 0 if disable else 1)

    branded_choice = 'Search' if disable else 'App'
    branded_aumid = ' ' if disable else 'Microsoft.Copilot_8wekyb3d8bbwe!App'
    run_powershell_as_ti([
        f'Set-ItemProperty -Path "Registry::HKU\\{sid}\\Software\\Microsoft\\Windows\\Shell\\BrandedKey" -Name "BrandedKeyChoiceType" -Value "{branded_choice}" -Force -EA 0',
        f'Set-ItemProperty -Path "Registry::HKU\\{sid}\\Software\\Microsoft\\Windows\\Shell\\BrandedKey" -Name "AppAumid" -Value "{branded_aumid}" -Force -EA 0',
    ])

    registry_setstring(HKEY_USERS, makepath(sid, r'SOFTWARE\Policies\Microsoft\Windows\CopilotKey'), 'SetCopilotHardwareKey', ' ' if disable else 'Microsoft.Copilot_8wekyb3d8bbwe!App')

    # Recall customized homepage
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\Windows\CurrentVersion\SettingSync\WindowsSettingHandlers'), 'A9HomeContentEnabled', 0 if disable else 1)

    # Typing data harvesting for AI training
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\InputPersonalization'), 'RestrictImplicitInkCollection', 1 if disable else 0)
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\InputPersonalization'), 'RestrictImplicitTextCollection', 1 if disable else 0)
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\InputPersonalization\TrainedDataStore'), 'HarvestContacts', 0 if disable else 1)
    registry_set(HKEY_USERS, makepath(sid, r'Software\Microsoft\Windows\CurrentVersion\CPSS\Store\InkingAndTypingPersonalization'), 'Value', 0 if disable else 1)

    # Office Hub startup
    registry_set(HKEY_USERS, makepath(sid, r'Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\WebViewHostStartupId'), 'State', 1 if disable else 2)


def set_registry_keys_hku(disable=True):
    """Apply or revert HKU AI registry keys for all active users"""
    for sid in get_active_user_sids():
        print(f'{"Disabling" if disable else "Enabling"} HKU AI keys for {sid}')
        apply_hku_keys(sid, disable=disable)


def remove_ai_appx_packages():
    """Removes AI-related Appx packages (Copilot, AIX, CoreAI, etc.)"""

    store = r'SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore'
    user_sids = ['S-1-5-18']

    for profile in get_local_profiles():
        sid = profile.get('sid', '')
        if sid.startswith('S-1-5-21') and sid not in user_sids:
            user_sids.append(sid)

    # Get provisioned and installed packages
    provisioned = get_provisioned_appx()
    appx_all = get_installed_appx()

    appx_by_name = {pkg['Name']: pkg for pkg in appx_all if pkg.get('Name')}

    def ensure_reg_key(path):
        try:
            with reg_openkey_noredir(HKEY_LOCAL_MACHINE, path, create_if_missing=True):
                pass
        except Exception:
            pass

    rollback_file = makepath(persistent_dir, 'appx_rollback.json')
    if isfile(rollback_file):
        with open(rollback_file, 'r') as f:
            rollback = json.load(f)
    else:
        rollback = {
            'deprovisioned_keys': [],
            'endoflife_keys': [],
            'removed_packages': [],
            'deprovisioned_packages': [],
        }

    ti_commands = []

    print('Removing AI Appx packages...')

    # Remove provisioned packages
    for prov in find_matching_ai_packages(provisioned, key='PackageName'):
        pkg_name = prov.get('PackageName', '')
        display_name = prov.get('DisplayName', '')

        pkg_family = appx_by_name.get(display_name, {}).get('PackageFamilyName', '')
        if pkg_family:
            ensure_reg_key(makepath(store, 'Deprovisioned', pkg_family))
            rollback['deprovisioned_keys'].append(makepath(store, 'Deprovisioned', pkg_family))
            ti_commands.append(f'Set-NonRemovableAppsPolicy -Online -PackageFamilyName "{pkg_family}" -NonRemovable 0 -EA 0')

            for sid in user_sids:
                eol_key = makepath(store, 'EndOfLife', sid, pkg_name)
                ensure_reg_key(eol_key)
                rollback['endoflife_keys'].append(eol_key)

        ti_commands.append(f'Remove-AppxProvisionedPackage -PackageName "{pkg_name}" -Online -AllUsers -EA 0')
        rollback['deprovisioned_packages'].append({'PackageName': pkg_name, 'DisplayName': display_name})
        print(f'Deprovisioned: {display_name}')

    # Remove installed packages
    for pkg in find_matching_ai_packages(appx_all, key='PackageFullName'):
        full_name = pkg.get('PackageFullName', '')
        pkg_family = pkg.get('PackageFamilyName', '')
        
        if pkg_family:
            ensure_reg_key(makepath(store, 'Deprovisioned', pkg_family))
            rollback['deprovisioned_keys'].append(makepath(store, 'Deprovisioned', pkg_family))
            ti_commands.append(f'Set-NonRemovableAppsPolicy -Online -PackageFamilyName "{pkg_family}" -NonRemovable 0 -EA 0')

        # Remove from InboxApplications
        if reg_key_exists(HKEY_LOCAL_MACHINE, makepath(store, 'InboxApplications', full_name)):
            ti_commands.append(f'Remove-Item "HKLM:\\{makepath(store, "InboxApplications", full_name)}" -Recurse -Force -EA 0')

        # Mark EndOfLife and remove per user
        pkg_user_sids = [s for s in (pkg.get('UserSIDs', '')).split(',') if s]
        for sid in pkg_user_sids:

            if sid not in user_sids:
                user_sids.append(sid)

            eol_key = makepath(store, 'EndOfLife', sid, full_name)
            ensure_reg_key(eol_key)
            rollback['endoflife_keys'].append(eol_key)
            ti_commands.append(f'Remove-AppxPackage -Package "{full_name}" -User "{sid}" -EA 0')

        ti_commands.append(f'Remove-AppxPackage -Package "{full_name}" -AllUsers -EA 0')
        rollback['removed_packages'].append({'PackageFullName': full_name, 'PackageFamilyName': pkg_family, 'UserSIDs': pkg_user_sids})
        print(f'Removed: {full_name}')

    if ti_commands:
        run_powershell_as_ti(ti_commands)

    rollback['deprovisioned_keys'] = list(set(rollback['deprovisioned_keys']))
    rollback['endoflife_keys'] = list(set(rollback['endoflife_keys']))

    # Save rollback data
    with open(rollback_file, 'w') as f:
        json.dump(rollback, f, indent=2)
    print(f'Rollback data saved to {rollback_file}')


def disable_copilot_policies():
    """Disables CoPilot/Recall/AI policies in IntegratedServicesRegionPolicySet.json and VisualAssist"""

    # IntegratedServicesRegionPolicySet.json
    json_path = makepath(os.environ['SystemRoot'], 'System32', 'IntegratedServicesRegionPolicySet.json')
    if isfile(json_path):
        print(f'Disabling CoPilot policies in {json_path}')

        run_powershell_as_ti([
            f'takeown /f "{json_path}"',
            f'icacls "{json_path}" /grant *S-1-5-32-544:F /t',
        ])

        with open(json_path, 'r', encoding='utf-8') as f:
            data = json.load(f)

        modified = 0
        for policy in data.get('policies', []):
            comment = policy.get('$comment', '')
            if 'CoPilot' in comment:
                policy['defaultState'] = 'disabled'
                modified += 1
            elif 'A9' in comment:
                policy['defaultState'] = 'enabled'
                modified += 1
            elif 'Manage Recall' in comment:
                policy['defaultState'] = 'disabled'
                modified += 1
            elif 'Settings Agent' in comment:
                policy['defaultState'] = 'enabled'
                modified += 1

        with open(json_path, 'w', encoding='utf-8') as f:
            json.dump(data, f, indent=2, ensure_ascii=False)
        print(f'{modified} CoPilot policies disabled')

    # VisualAssist
    va_path = makepath(os.environ['SystemRoot'], 'SystemApps', 'MicrosoftWindows.Client.CBS_cw5n1h2txyewy', 'VisualAssist', 'VisualAssistActions.json')
    if isfile(va_path):
        print('Disabling Generative AI in Visual Assist...')
        run_powershell_as_ti([
            f'takeown /f "{va_path}"',
            f'icacls "{va_path}" /grant *S-1-5-32-544:F /t',
        ])

        with open(va_path, 'r', encoding='utf-8') as f:
            data = json.load(f)

        modified = False
        for action in data.get('actions', []):
            if isinstance(action, dict) and 'usesGenerativeAI' in action:
                action['usesGenerativeAI'] = False
                modified = True
        if modified:
            with open(va_path, 'w', encoding='utf-8') as f:
                json.dump(data, f, indent=2, ensure_ascii=False)
        print('Visual Assist Generative AI disabled')


def enable_copilot_policies():
    """Re-enables CoPilot/Recall/AI policies in IntegratedServicesRegionPolicySet.json and VisualAssist"""

    json_path = makepath(os.environ['SystemRoot'], 'System32', 'IntegratedServicesRegionPolicySet.json')
    if isfile(json_path):
        print(f'Re-enabling CoPilot policies in {json_path}')
        run_powershell_as_ti([
            f'takeown /f "{json_path}"',
            f'icacls "{json_path}" /grant *S-1-5-32-544:F /t',
        ])

        with open(json_path, 'r', encoding='utf-8') as f:
            data = json.load(f)

        for policy in data.get('policies', []):
            comment = policy.get('$comment', '')
            if 'CoPilot' in comment:
                policy['defaultState'] = 'enabled'
            elif 'A9' in comment:
                policy['defaultState'] = 'disabled'
            elif 'Manage Recall' in comment:
                policy['defaultState'] = 'enabled'
            elif 'Settings Agent' in comment:
                policy['defaultState'] = 'disabled'

        with open(json_path, 'w', encoding='utf-8') as f:
            json.dump(data, f, indent=2, ensure_ascii=False)
        print('CoPilot policies re-enabled')

    va_path = makepath(os.environ['SystemRoot'], 'SystemApps', 'MicrosoftWindows.Client.CBS_cw5n1h2txyewy', 'VisualAssist', 'VisualAssistActions.json')
    if isfile(va_path):
        print('Re-enabling Generative AI in Visual Assist...')
        run_powershell_as_ti([
            f'takeown /f "{va_path}"',
            f'icacls "{va_path}" /grant *S-1-5-32-544:F /t',
        ])

        with open(va_path, 'r', encoding='utf-8') as f:
            data = json.load(f)

        for action in data.get('actions', []):
            if isinstance(action, dict) and 'usesGenerativeAI' in action:
                action['usesGenerativeAI'] = True
        with open(va_path, 'w', encoding='utf-8') as f:
            json.dump(data, f, indent=2, ensure_ascii=False)
        print('Visual Assist Generative AI re-enabled')


def restore_ai_appx_packages():
    """Restores AI Appx packages by removing Deprovisioned/EndOfLife registry blocks"""

    rollback_file = makepath(persistent_dir, 'appx_rollback.json')
    if isfile(rollback_file):
        print('No rollback data found, skipping Appx restore')
        return

    with open(rollback_file, 'r') as f:
        rollback = json.load(f)

    # Remove Deprovisioned keys
    for key_path in rollback.get('deprovisioned_keys', []):
        try:
            parent, child = key_path.rsplit('\\', 1)
            registry_deletekey(HKEY_LOCAL_MACHINE, parent, child)
            print(f'Removed Deprovisioned key: {child}')
        except Exception:
            pass

    # Remove EndOfLife keys
    for key_path in rollback.get('endoflife_keys', []):
        try:
            parent, child = key_path.rsplit('\\', 1)
            registry_deletekey(HKEY_LOCAL_MACHINE, parent, child)
            print(f'Removed EndOfLife key: {child}')
        except Exception:
            pass

    remove_file(rollback_file)
    print('Appx rollback complete. Packages will be restored by Windows Update.')


def remove_recall_feature():
    """Removes the Recall optional feature from Windows"""
    print('Removing Recall Optional Feature...')
    try:
        state = run_powershell("(Get-WindowsOptionalFeature -Online -FeatureName 'Recall' -EA Stop).State", output_format='text')
        if state and state.strip() and 'DisabledWithPayloadRemoved' not in state:
            try:
                run_powershell("Disable-WindowsOptionalFeature -Online -FeatureName 'Recall' -Remove -NoRestart -EA Stop", output_format='text')
            except Exception:
                run('dism.exe /Online /Disable-Feature /FeatureName:Recall /Remove /NoRestart /Quiet', accept_returncodes=[0, 87])
        else:
            print('Recall already removed')
    except Exception:
        # Fallback to dism if PowerShell cmdlet not available
        result = run('dism.exe /Online /Get-FeatureInfo /FeatureName:Recall',accept_returncodes=[0, 87])
        if 'Disabled with Payload Removed' not in result:
            run('dism.exe /Online /Disable-Feature /FeatureName:Recall /Remove /NoRestart /Quiet', accept_returncodes=[0, 87])
        else:
            print('Recall already removed')


def remove_recall_tasks():
    """Removes and disables Recall and Office Actions Server scheduled tasks"""
    print('Removing Recall Scheduled Tasks...')

    ti_command = [
        f'Get-ScheduledTask -TaskPath "*WindowsAI*" -EA 0 | Disable-ScheduledTask -EA 0',
        f'Get-ScheduledTask -TaskName "*Office Actions Server*" -EA 0 | Disable-ScheduledTask -EA 0',
        rf'Remove-Item "{os.environ["SystemRoot"]}\System32\Tasks\Microsoft\Windows\WindowsAI" -Recurse -Force -EA 0',
        rf'Remove-Item "{os.environ["SystemRoot"]}\System32\Tasks\Microsoft\Office\Office Actions Server" -Force -EA 0',
    ]

    # Clean task cache registry entries
    cache_base = r'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache'
    for task_name in AI_TASKS:
        task_id = registry_readstring(HKEY_LOCAL_MACHINE, makepath(cache_base, 'Tree', task_name.lstrip('\\')), 'Id')
        if task_id:
            ti_command.append(f'Remove-Item "HKLM:\\{cache_base}\\Tasks\\{task_id}" -Recurse -Force -EA 0')

    tasks_to_delete = [
        r'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\WindowsAI',
        r'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Actions Server',
    ]
    for path in tasks_to_delete:
        ti_command.append(f'Remove-Item "{path}" -Recurse -Force -EA 0')

    run_powershell_as_ti(ti_command)
    print('Recall Scheduled Tasks removed')


def remove_ai_cbs_packages():
    """Removes hidden AI CBS packages (AIX, Recall, Copilot, CoreAI) via DISM"""

    CBS_AI_PATTERNS = ['AIX', 'Recall', 'Copilot', 'CoreAI']
    cbs_path = r'SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages'
    servicing_dir = makepath(os.environ['SystemRoot'], 'servicing', 'Packages')

    print('Removing Additional Hidden AI CBS Packages...')

    ti_commands = []
    subkeys = reg_enum_subkeys(reg_openkey_noredir(HKEY_LOCAL_MACHINE, cbs_path))
    for pkg_name in subkeys:
        # Check if package matches AI patterns
        if not any(p in pkg_name for p in CBS_AI_PATTERNS):
            continue

        pkg_key = makepath(cbs_path, pkg_name)
        visibility = registry_get(HKEY_LOCAL_MACHINE, pkg_key, 'Visibility')

        # Only process hidden packages
        if visibility != 2:
            continue

        # Unhide the package for removal
        registry_set(HKEY_LOCAL_MACHINE, pkg_key, 'Visibility', 1)
        registry_set(HKEY_LOCAL_MACHINE, pkg_key, 'DefVis', 2)

        # Remove Owners and Updates subkeys to allow removal
        if reg_key_exists(HKEY_LOCAL_MACHINE, makepath(pkg_key, 'Owners')):
            registry_deletekey(HKEY_LOCAL_MACHINE, pkg_key, 'Owners', force=True, recursive=True)
        if reg_key_exists(HKEY_LOCAL_MACHINE, makepath(pkg_key, 'Updates')):
            registry_deletekey(HKEY_LOCAL_MACHINE, pkg_key, 'Updates', force=True, recursive=True)

        ti_commands.append(f'dism.exe /Online /Remove-Package /PackageName:{pkg_name} /NoRestart /Quiet')
        ti_commands.append(f'Remove-Item "{makepath(servicing_dir, f"*{pkg_name}*")}" -Force -EA 0')

        print(f'Removed CBS: {pkg_name}')

    if ti_commands:
        run_powershell_as_ti(ti_commands)


def install():
    kill_ai_processes()
    set_registry_keys_hklm(disable=True)
    disable_copilot_policies()
    remove_recall_feature()
    remove_recall_tasks()
    remove_ai_appx_packages()
    remove_ai_cbs_packages()
    set_ai_settings_visibility(hide=True)
    set_registry_keys_hku(disable=True)


def uninstall():
    set_registry_keys_hklm(disable=False)
    enable_copilot_policies()
    restore_ai_appx_packages()
    set_ai_settings_visibility(hide=False)
    set_registry_keys_hku(disable=False)


def audit():

    audit_status = 'OK'

    # TrustedInstaller service binPath
    ti_expected = rf'{os.environ["SystemRoot"]}\servicing\TrustedInstaller.exe'
    ti_binpath = registry_readstring(HKEY_LOCAL_MACHINE, r'SYSTEM\CurrentControlSet\Services\TrustedInstaller', 'ImagePath')
    if ti_binpath and ti_binpath.strip() != ti_expected:
        print(f'TrustedInstaller binPath not restored: {ti_binpath}')
        audit_status = 'ERROR'

    # Registry keys HKLM
    registry_checks = [
        (r'SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot', 'TurnOffWindowsCopilot', 1),
        (r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI', 'DisableAIDataAnalysis', 1),
        (r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI', 'AllowRecallEnablement', 0),
        (r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI', 'DisableClickToDo', 1),
        (r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI', 'TurnOffSavingSnapshots', 1),
        (r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI', 'DisableSettingsAgent', 1),
        (r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI', 'DisableAgentConnectors', 1),
        (r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI', 'DisableAgentWorkspaces', 1),
        (r'SOFTWARE\Policies\Microsoft\Windows\WindowsAI', 'DisableRemoteAgentConnectors', 1),
        (r'SOFTWARE\Microsoft\Windows\Shell\Copilot', 'IsCopilotAvailable', 0),
        (r'SOFTWARE\Policies\Microsoft\Edge', 'HubsSidebarEnabled', 0),
        (r'SOFTWARE\Policies\Microsoft\Edge', 'CopilotCDPPageContext', 0),
        (r'SOFTWARE\Policies\Microsoft\Windows\AppPrivacy', 'LetAppsAccessGenerativeAI', 2),
        (r'SOFTWARE\Policies\Microsoft\Windows\AppPrivacy', 'LetAppsAccessSystemAIModels', 2),
        (r'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Paint', 'DisableImageCreator', 1),
        (r'SOFTWARE\Policies\WindowsNotepad', 'DisableAIFeatures', 1),
    ]

    for path, name, expected in registry_checks:
        val = registry_get(HKEY_LOCAL_MACHINE, path, name)
        if val != expected:
            print(f'{name} not configured (expected {expected}, got {val})')
            audit_status = 'ERROR'

    # Copilot policies in IntegratedServicesRegionPolicySet.json
    json_path = makepath(os.environ['SystemRoot'], 'System32', 'IntegratedServicesRegionPolicySet.json')
    if isfile(json_path):
        with open(json_path, 'r', encoding='utf-8') as f:
            data = json.load(f)
        for policy in data.get('policies', []):
            comment = policy.get('$comment', '')
            if 'CoPilot' in comment and policy.get('defaultState') != 'disabled':
                print(f'CoPilot policy still enabled: {comment}')
                audit_status = 'ERROR'
            elif 'Manage Recall' in comment and policy.get('defaultState') != 'disabled':
                print(f'Recall policy still enabled: {comment}')
                audit_status = 'ERROR'

    # Recall optional feature
    state = run_powershell("(Get-WindowsOptionalFeature -Online -FeatureName 'Recall' -EA Stop).State", output_format='text')
    if state and state.strip() and 'DisabledWithPayloadRemoved' not in state and 'Disabled' not in state:
        print(f'Recall feature still present: {state.strip()}')
        audit_status = 'ERROR'

    # Recall scheduled tasks
    for task_name in AI_TASKS:
        if task_exists(task_name):
            print(f'AI task still exists: {task_name}')
            audit_status = 'ERROR'

    # AI Appx packages
    remaining_installed = find_matching_ai_packages(get_installed_appx(), key='PackageFullName')
    for pkg in remaining_installed:
        print(f'AI package still installed: {pkg["PackageFullName"]}')
        audit_status = 'ERROR'

    remaining_provisioned = find_matching_ai_packages(get_provisioned_appx(), key='PackageName')
    for prov in remaining_provisioned:
        print(f'AI package still provisioned: {prov["PackageName"]}')
        audit_status = 'ERROR'

    # AI CBS packages
    CBS_AI_PATTERNS = ['AIX', 'Recall', 'Copilot', 'CoreAI']
    cbs_path = r'SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages'
    subkeys = reg_enum_subkeys(reg_openkey_noredir(HKEY_LOCAL_MACHINE, cbs_path))
    for pkg_name in subkeys:
        if any(p in pkg_name for p in CBS_AI_PATTERNS):
            visibility = registry_get(HKEY_LOCAL_MACHINE, makepath(cbs_path, pkg_name), 'Visibility')
            if visibility == 2:
                print(f'Hidden AI CBS package still present: {pkg_name}')
                audit_status = 'ERROR'

    # Settings visibility
    SETTINGS_PAGE_KEY = r'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer'
    AI_PAGES_TO_HIDE = 'aicomponents;appactions;'
    existing = registry_readstring(HKEY_LOCAL_MACHINE, SETTINGS_PAGE_KEY, 'SettingsPageVisibility')
    if not existing or AI_PAGES_TO_HIDE not in existing:
        print('AI settings pages not hidden')
        audit_status = 'ERROR'

    return audit_status

c84b1911368f715a4f5cc145ac034c80ff2446a8a600a79709062591f9b61441 : WAPT/README.md
67dda6ec6cde7b488fe89cd0df3fc267bc6f5a253b884e3e5113701fb0bc1d38 : WAPT/README_fr.md
38d056ab130f7bf7c481c12636a4e9959de36561d3dfcbe54c6e3571bc0c1dc3 : WAPT/certificate.crt
359d13a8c18f67efaa65f8b4dc5fb7ba22af195dffb141ba006c946c77d2fc90 : WAPT/control
7891f1ca19ac8a9e41cb2963c0833bb3424a1dcc3f89e6ae484b1841a67063b2 : WAPT/icon.png
4a078464913c49e588d192dd31779dd2eec4609859b02382eccb3b788699723a : luti.json
2da68a11fe50c990376600e895bc64d7c83a79b55c8c27fcd45e755c9108b464 : setup.py

Choose languages

Choose architectures

Choose operating systems

Choose Categories

Choose licenses

Remove Windows AI

Silent install package for Remove Windows AI

Remove Windows AI

What this package does

Install

Uninstall

Session setup / cleanup

Audit

Important warnings

Antivirus detection

Windows Update issues

Copilot+ PCs

Reversibility

Choose languages

Choose architectures

Choose operating systems

Choose Categories

Choose licenses

Remove Windows AI

Silent install package for Remove Windows AI

Usage & Notes

Remove Windows AI

What this package does

Install

Uninstall

Session setup / cleanup

Audit

Important warnings

Antivirus detection

Windows Update issues

Copilot+ PCs

Reversibility

Informations

Control

Setup.py

Manifest.sha256