Blocking Cortana Without App locker

[philellis]

Hi,

 

We are pretty much all set to deploy our new windows 10 image with policies. The last piece of the puzzle is trying to block Cortana completely without the use of app locker as blocking cortana with app locker is causing the start menu to freeze on first use. I'm just curious as to what others are doing to prevent Cortana from running and being able to search UNC paths (although users cant do anything malicious to shares due to security settings).

 

Any suggestions would be greatly appreciated!

 

Thanks in advance

[Rob_D]

We use Decrapifier to remove cortana and the other junk from Windows 10. It turns the cortana button into a dumb program and file/folder search.

[Oaktech]

Hi,

 

We are pretty much all set to deploy our new windows 10 image with policies. The last piece of the puzzle is trying to block Cortana completely without the use of app locker as blocking cortana with app locker is causing the start menu to freeze on first use. I'm just curious as to what others are doing to prevent Cortana from running and being able to search UNC paths (although users cant do anything malicious to shares due to security settings).

 

Any suggestions would be greatly appreciated!

 

Thanks in advance

 

Access Based Enumeration on the servers and then these GPO settings:

 

Computer Config/Admin Templates/Windows Components/Search

 

Allow Cortana: Disabled

Allow Cortana above lock screen: Disabled

Allow search and Cortana to use location: Disabled

Do not allow web search: Enabled

Don't search the web or display web results in Search: Enabled

Don't search the web or display web results in Search over metered connections: Enabled

 

You can Banjax cortana completely but this also breaks start menu search...

 

Import-Module -DisableNameChecking \\dc1\netlogon\take-own.psm1 # Update this with the location you have placed the psm1 module

do {} until (Elevate-Privileges SeTakeOwnershipPrivilege)

$packages = @(
   # "Browser" # Removes edge browser
   # "ContactSupport" # Removes contact support
   # "Xbox" # Removes remaining xbox information not removed by remove apps
   # "Microsoft-PPIProjection-Package" # Removes miracast
   # "Microsoft-Windows-Holographic-Desktop" # Removes VR Viewer
   #"cortana" #this removes Cortana, but also the ability to search the start menu
   
  
)

foreach ($package in $packages) {
   $pkgs = (ls "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages" |
       where Name -Like "*$package*")

   foreach ($pkg in $pkgs) {
       $pkgname = $pkg.Name.split('\')[-1]

       Takeown-Registry($pkg.Name)
       Takeown-Registry($pkg.Name + "\Owners")

       Set-ItemProperty -Path ("HKLM:" + $pkg.Name.Substring(18)) -Name Visibility -Value 1
       New-ItemProperty -Path ("HKLM:" + $pkg.Name.Substring(18)) -Name DefVis -PropertyType DWord -Value 2
       Remove-Item      -Path ("HKLM:" + $pkg.Name.Substring(18) + "\Owners")

       dism.exe /Online /Remove-Package /PackageName:$pkgname /NoRestart
   }
}

 

Takeown Module referenced above (save as .psm1):

 

function Takeown-Registry($key) {
   # TODO does not work for all root keys yet
   switch ($key.split('\')[0]) {
       "HKEY_CLASSES_ROOT" {
           $reg = [Microsoft.Win32.Registry]::ClassesRoot
           $key = $key.substring(18)
       }
       "HKEY_CURRENT_USER" {
           $reg = [Microsoft.Win32.Registry]::CurrentUser
           $key = $key.substring(18)
       }
       "HKEY_LOCAL_MACHINE" {
           $reg = [Microsoft.Win32.Registry]::LocalMachine
           $key = $key.substring(19)
       }
   }

   # get administraor group
   $admins = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
   $admins = $admins.Translate([system.Security.Principal.NTAccount])

   # set owner
   $key = $reg.OpenSubKey($key, "ReadWriteSubTree", "TakeOwnership")
   $acl = $key.GetAccessControl()
   $acl.SetOwner($admins)
   $key.SetAccessControl($acl)

   # set FullControl
   $acl = $key.GetAccessControl()
   $rule = New-Object System.Security.AccessControl.RegistryAccessRule($admins, "FullControl", "Allow")
   $acl.SetAccessRule($rule)
   $key.SetAccessControl($acl)
}

function Takeown-File($path) {
   takeown.exe /A /F $path
   $acl = Get-Acl $path

   # get administraor group
   $admins = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
   $admins = $admins.Translate([system.Security.Principal.NTAccount])

   # add NT Authority\SYSTEM
   $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($admins, "FullControl", "None", "None", "Allow")
   $acl.AddAccessRule($rule)

   Set-Acl -Path $path -AclObject $acl
}

function Takeown-Folder($path) {
   Takeown-File $path
   foreach ($item in Get-ChildItem $path) {
       if (Test-Path $item -PathType Container) {
           Takeown-Folder $item.FullName
       } else {
           Takeown-File $item.FullName
       }
   }
}

function Elevate-Privileges {
   param($Privilege)
   $Definition = @"
   using System;
   using System.Runtime.InteropServices;
   public class AdjPriv {
       [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
           internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall, ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr rele);
       [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
           internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok);
       [DllImport("advapi32.dll", SetLastError = true)]
           internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid);
       [structLayout(LayoutKind.Sequential, Pack = 1)]
           internal struct TokPriv1Luid {
               public int Count;
               public long Luid;
               public int Attr;
           }
       internal const int SE_PRIVILEGE_ENABLED = 0x00000002;
       internal const int TOKEN_QUERY = 0x00000008;
       internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
       public static bool EnablePrivilege(long processHandle, string privilege) {
           bool retVal;
           TokPriv1Luid tp;
           IntPtr hproc = new IntPtr(processHandle);
           IntPtr htok = IntPtr.Zero;
           retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok);
           tp.Count = 1;
           tp.Luid = 0;
           tp.Attr = SE_PRIVILEGE_ENABLED;
           retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid);
           retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
           return retVal;
       }
   }
"@
   $ProcessHandle = (Get-Process -id $pid).Handle
   $type = Add-Type $definition -PassThru
   $type[0]::EnablePrivilege($processHandle, $Privilege)
}

[gmonks]

I've used group policy to disable Cortana:

 

Computer Configuration – Policies – Administrative Templates – Windows Components – Search – Allow Cortana - Disabled

[chazzy2501]

@gmonks This worked great! if you click on Cortana it just does a straight search, no options to turn on audio, etc.

[gmonks]

@gmonks This worked great! if you click on Cortana it just does a straight search, no options to turn on audio, etc.

 

Glad to have helped!

[philellis]

Hi,

 

None of these resolutions seem to work on 1803

[Arthur]

None of these resolutions seem to work on 1803

Which edition of Windows 10 are you deploying? Education?

[philellis]

yes we use education 1803

[chazzy2501]

I'm using 1803 edu edition and the group policy works. it's a computer policy not a user policy but that's ok.