Windows/remove_activation.ps at main · SleepTheGod/Windows · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
# Force that stubborn sppsvc service - Admin only, no mercy

if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Host "Dude, run this as ADMIN or it does nothing." -ForegroundColor Red
    exit
}

Write-Host "Stealing ownership of sppsvc.exe and giving Full Control to the usual suspects..." -ForegroundColor Cyan
takeown /f "C:\Windows\System32\sppsvc.exe" /a
icacls "C:\Windows\System32\sppsvc.exe" /grant Administrators:F /T
icacls "C:\Windows\System32\sppsvc.exe" /grant SYSTEM:F /T
icacls "C:\Windows\System32\sppsvc.exe" /grant "NETWORK SERVICE:F" /T

Write-Host "Fixing the registry key permissions so the service can actually breathe..." -ForegroundColor Cyan
$reg = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform"
$acl = Get-Acl $reg
$acl.SetAccessRule( (New-Object System.Security.AccessControl.RegistryAccessRule("SYSTEM","FullControl","ContainerInherit,ObjectInherit","None","Allow")) )
$acl.SetAccessRule( (New-Object System.Security.AccessControl.RegistryAccessRule("NETWORK SERVICE","FullControl","ContainerInherit,ObjectInherit","None","Allow")) )
$acl.SetAccessRule( (New-Object System.Security.AccessControl.RegistryAccessRule("Administrators","FullControl","ContainerInherit,ObjectInherit","None","Allow")) )
Set-Acl $reg $acl

Write-Host "Trying to start the damn service..." -ForegroundColor Yellow
Set-Service sppsvc -StartupType Automatic -ErrorAction SilentlyContinue
try {
    Start-Service sppsvc -ErrorAction Stop
    Write-Host "It started! Finally." -ForegroundColor Green
} catch {
    Write-Host "Start-Service failed, using the nuclear sc.exe method..." -ForegroundColor Magenta
    sc.exe config sppsvc start= auto
    sc.exe start sppsvc
}

Write-Host "`nDone. Go check Services.msc. If it's still dead, reboot and run this again, then do DISM + SFC." -ForegroundColor Cyan
Write-Host "Taking the entire SPP folder by force..." -ForegroundColor Cyan
takeown /f "C:\Windows\System32\spp" /r /d y
icacls "C:\Windows\System32\spp" /grant Administrators:F /T
icacls "C:\Windows\System32\spp" /grant SYSTEM:F /T
icacls "C:\Windows\System32\spp" /grant "NETWORK SERVICE:F" /T

Write-Host "Resetting the service’s security descriptor so nothing can block it..." -ForegroundColor Yellow
sc.exe sdset sppsvc "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CR;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)"

Write-Host "Kicking it again..." -ForegroundColor Magenta
sc.exe config sppsvc start= auto
sc.exe start sppsvc

Get-Service sppsvc
# Take ownership of the entire SPP store folder (critical)
takeown /f "C:\Windows\System32\spp" /r /d y
icacls "C:\Windows\System32\spp" /grant Administrators:F /T
icacls "C:\Windows\System32\spp" /grant SYSTEM:F /T
icacls "C:\Windows\System32\spp" /grant "NETWORK SERVICE:F" /T

# Reset the service’s security descriptor to a working default
sc.exe sdset sppsvc "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CR;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)"

# Force start again
sc.exe config sppsvc start= auto
sc.exe start sppsvc
Get-Service sppsvc
sc.exe query sppsvc