@rem Install PosApp cashdesk application

@rem Check for admin rights
@fsutil dirty query %systemdrive% >nul 2>&1
@IF ERRORLEVEL 1 goto adminerror
@goto adminok

:adminerror
@echo The script must be run by an administrator
@pause
@goto end

:adminok
rem @echo off

set SRC=%~dp0

rem Create link for autostart
set "StartPage=c:\windows\system32\startpage"
set MakeSymLink=
fsutil reparsepoint query "%StartPage%" >nul 2>&1
if %errorlevel% == 0 set MakeSymLink=N
if %errorlevel% == 1 set MakeSymLink=Y
if "%MakeSymLink%" == "Y" (
  if exist "%StartPage%" (
    attrib -H "%StartPage%"\*
    del /Q "%StartPage%"\*
    rmdir "%StartPage%"
  )
  mklink /J "%StartPage%" c:\posapp\startpage
)

@rem see https://support.microsoft.com/en-gb/help/883260/information-about-the-attachment-manager-in-microsoft-windows
echo Disable downloaded files blocking
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v SaveZoneInformation /t REG_DWORD /d 1 /f

rem Disable edge swipe to prevent the user from returning to Windows without the keyboard
regedit -s %SRC%\Disable_Screen_Edge_Swipe.reg

rem Disable autoplay when usb device is connected
regedit -s %SRC%\Disable_Autoplay.reg

rem Install application signing certificate
Certutil -addStore TrustedPublisher "%SRC%\MyKey.cer"

rem Install event log decoding information
call %SRC%\install_eventlog.bat

rem Force MR800 to be available at all time
call %SRC%\smartcard_autostart.bat

rem Make sure the troublesome services are stopped for good
call %SRC%\stop_services.bat

rem Do stuff that can only be done with a powershell
C:\WINDOWS\System32\WindowsPowerShell\v1.0\PowerShell.exe -command "Set-ExecutionPolicy RemoteSigned -force"
C:\WINDOWS\System32\WindowsPowerShell\v1.0\PowerShell.exe -command "Unblock-file %SRC%\install-sub.ps1"
C:\WINDOWS\System32\WindowsPowerShell\v1.0\PowerShell.exe -file %SRC%\install-sub.ps1

if not exist "%SRC%\vc_redist.x64.exe" goto no_vcredist
echo Install VC x64 redistribuable
%SRC%\vc_redist.x64.exe /quiet
:no_vcredist

rem Give emisys and POS users the permissions to start and stop the SCardSvr service
%SRC%\GrantSCardPermission.exe

echo Disabling Remote Desktop Configuration
sc stop SessionEnv
sc config "SessionEnv" start=disabled
echo Disabling Remote Desktop Services
sc stop TermService
sc config "TermService" start=disabled
echo Disabling Remote Desktop Services UserMode Port Redirector
sc stop UmRdpService
sc config "UmRdpService" start=disabled
echo Disabling SSDP
sc stop SSDPSRV
sc config "SSDPSRV" start=disabled
echo Disabling Function Discovery Provider Host
sc stop fdPHost
sc config "fdPHost" start=disabled
echo Disabling Function Discovery Resource Publication
sc stop FDResPub
sc config "FDResPub" start=disabled

echo create POS user
net user /ADD POS POS!2017
rem Following command results in "command echo not found" but it creates the user's profile
rem PsExec64 is from PsTools from Sysinternals
%SRC%\PsExec64.exe -u POS -p POS!2017 -accepteula echo

echo AutoLogon Settings
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_SZ /d 1 /f
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /t REG_SZ /d POS /f
rem reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName /t REG_SZ /d yourdomain /f
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /t REG_SZ /d POS!2017 /f
echo Disable LockSreen
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization" /v NoLockScreen /t REG_DWORD /d 1 /f
echo Lock screen rotation
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AutoRotation" /v Enable /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AutoRotation" /v LastOrientation /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AutoRotation" /v SensorPresent /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AutoRotation" /v SlateEnable /t REG_DWORD /d 0 /f
echo Never expire password
net accounts /maxpwage:unlimited

echo Disable cortana
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v AllowCortana /t REG_DWORD /d 0 /f

echo Set display scaling to 96DPI (100%)
reg add "HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current\Software\Fonts" /v LogPixels /t REG_DWORD /d 96 /f

echo Disable Hibernation
powercfg /h off
echo Turn off when power button is pressed and on battery
powercfg -setdcvalueindex SCHEME_CURRENT SUB_BUTTONS PBUTTONACTION 3
echo Turn off when power button is pressed and plugged in
powercfg -setacvalueindex SCHEME_CURRENT SUB_BUTTONS PBUTTONACTION 3
echo Sleep when lid is closed and on battery
powercfg -setdcvalueindex SCHEME_CURRENT SUB_BUTTONS LIDACTION 1
echo Do nothing when lid is closed and plugged in
powercfg -setacvalueindex SCHEME_CURRENT SUB_BUTTONS LIDACTION 0
echo Activate the new Power settings
powercfg -SetActive SCHEME_CURRENT
echo Disable Sleep Mode when connected to power supply
powercfg /x standby-timeout-ac 0
echo Disable Sleep Mode on Battery
powercfg /x standby-timeout-dc 0
echo Disable Screen Sleep Mode when connected to power supply
powercfg /x monitor-timeout-ac 0
echo Disable Screen Sleep Mode on Battery
powercfg /x monitor-timeout-dc 0
echo Disable Disk Sleep Mode when connected to power supply
powercfg /x disk-timeout-ac 0
echo Disable Disk Sleep Mode on Battery
powercfg /x disk-timeout-dc 0

echo Activate the metered feature per byte (very restrictive) on PAYEM17 and PAYEM17_BCKP
if not exist c:\posapp\wifi goto noOldWifi
rmdir /S /Q c:\posapp\wifi
:noOldWifi
rem Create xml file with: Netsh wlan export profile folder=c:\posapp\wifi
for %%f in (c:\posapp\wifi2\*.xml) do (
netsh wlan add profile filename="%%f"
netsh wlan set profileparameter name="%%~nf" cost=variable
)

echo Whitelist POSAPP in Windows Firewall
netsh advfirewall firewall delete rule name="POSAPP - allow outgoing"
netsh advfirewall firewall delete rule name="POSAPP - allow ingoing"
netsh advfirewall firewall delete rule name="Allow outgoing TCP/9000"
netsh advfirewall firewall delete rule name="Allow incoming TCP/9000"
netsh advfirewall firewall delete rule name="Allow outgoing UDP/9000"
netsh advfirewall firewall delete rule name="Allow incoming UDP/9000"
netsh advfirewall firewall delete rule name="POS application"
netsh advfirewall firewall delete rule name="POS application TCP"
netsh advfirewall firewall delete rule name="POS application UDP"
netsh advfirewall firewall delete rule name="ICMP Allow incoming V4 echo request"
netsh advfirewall firewall add rule name="POS application" dir=out action=allow program="C:\posapp\posapp.exe"
netsh advfirewall firewall add rule name="POS application" dir=in action=allow program="C:\posapp\posapp.exe"
echo Whitelist Outgoing/incoming TCP/9000 in Windows Firewall
netsh advfirewall firewall add rule name="POS application TCP" dir=out action=allow protocol=tcp remoteport=9000
netsh advfirewall firewall add rule name="POS application TCP" dir=in action=allow protocol=tcp localport=9000
echo Whitelist Outgoing/incoming UDP/9000 in Windows Firewall
netsh advfirewall firewall add rule name="POS application UDP" dir=out action=allow protocol=udp remoteport=9000
netsh advfirewall firewall add rule name="POS application UDP" dir=in action=allow protocol=udp localport=9000
netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=allow

echo ####### Restore admin #######
echo Activate Desktop Mode
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell" /v TabletMode /t REG_DWORD /d 0 /f
echo Activate Desktop Mode at SignIn
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell" /v SignInMode /t REG_DWORD /d 1 /f
echo Auto Hide Taskbar in Tablet Mode
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Shell /f
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v HideFileExt /t REG_DWORD /d 0 /f
reg add HKCU\Software\Policies\Microsoft\Windows\Explorer /v DisableNotificationCenter /t REG_DWORD /d 0 /f

echo ####### Restore default user #######
echo Restore Default user Registry
reg load HKU\DefUser C:\users\Default\NTUSER.DAT
reg delete "HKU\DefUser\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Shell /f
reg unload HKU\DefUser

echo ####### Tablet Mode #######
echo Load POS user Registry
reg load HKU\DefUser C:\users\POS\NTUSER.DAT
echo Activate Tablet Mode
reg add "HKU\DefUser\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell" /v TabletMode /t REG_DWORD /d 0 /f
echo Activate Tablet Mode at SignIn
reg add "HKU\DefUser\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell" /v SignInMode /t REG_DWORD /d 0 /f
echo Auto Hide Taskbar in Tablet Mode
reg add "HKU\DefUser\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v TaskbarAutoHideInTabletMode /t REG_DWORD /d 1 /f
echo Disable the Notification Center
reg add "HKU\DefUser\Software\Policies\Microsoft\Windows\Explorer" /v DisableNotificationCenter /t REG_DWORD /d 1 /f
echo Disable Ballon Tips
reg add "HKU\DefUser\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
echo Disable Toast Notifications
reg add "HKU\DefUser\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" /v NoToastApplicationNotification /t REG_DWORD /d 1 /f
echo Disable "Tips, trick, and suggestions as youuse Windows"
reg add "HKU\DefUser\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SoftLandingEnabled /t REG_DWORD /d 0 /f
echo Set a Custom Shell
reg add "HKU\DefUser\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Shell /t REG_SZ /d "C:\posapp\posapp.exe --disable-pinch" /f
echo Unload Default user Registry
reg unload HKU\DefUser

echo Install SNMP
dism /online /enable-feature /featurename:snmp
echo Configure SNMP
reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SNMP\Parameters\PermittedManagers" /v 1 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SNMP\Parameters\ValidCommunities" /v emisys /t REG_DWORD /d 4 /f

if not exist "%SRC%\zabbix agent" goto no_zabbix

echo Install zabbix agent
set "ZA=c:\Program Files (x86)\zabbix agent\"
mkdir "%ZA%"
sc stop "Zabbix Agent"
xcopy /S /I /Y "%SRC%zabbix agent\"* "%ZA%"
"C:\Program Files (x86)\zabbix agent\bin\win64\zabbix_agentd.exe" --config "C:\Program Files (x86)\zabbix agent\conf\zabbix_agentd.win.conf" --install
netsh advfirewall firewall delete rule name="Zabbix agent"
netsh advfirewall firewall add rule name="Zabbix agent" dir=in action=allow protocol=tcp localport=10050
schtasks /delete /tn "posApp\Ping8888" /F
SCHTASKS /CREATE /TN "posApp\Ping8888" /NP /XML "C:\Program Files (x86)\zabbix agent\conf\pingtask.xml"
mkdir c:\temp
sc start "Zabbix Agent"


:no_zabbix

C:\WINDOWS\System32\WindowsPowerShell\v1.0\PowerShell.exe -command "Unblock-file %SRC%\install-xampp.ps1"
C:\WINDOWS\System32\WindowsPowerShell\v1.0\PowerShell.exe -file %SRC%\install-xampp.ps1

:end
