To install Chocolatey via Powershell:

Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))

Or via Command prompt:

@"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "[System.Net.ServicePointManager]::SecurityProtocol = 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))" && SET "PATH=%PATH%;%ALLUSERSPROFILE%\chocolatey\bin"

Chocolatey apps to install:

Command prompt:

@echo off setlocal set “choco_path=%ProgramData%\chocolatey\bin\choco.exe” if not exist “%choco_path%” ( echo Chocolatey is not installed. Please install it first from https://chocolatey.org/install exit /b 1 ) “%choco_path%” install microsoft-edge notepadplusplus.install 7zip.install vlc greenshot bitwarden foxitreader vcredist-all directx dotnetfx dotnet3.5 dotnet4.5 microsoft-windows-terminal powershellhere-elevated treesizefree dismplusplus rufus.portable hashcheck path-copy-copy processhacker winaero-tweaker hwinfo.install open-shell nsudo geekuninstaller autoruns nvidia-display-driver cuda disable-nvidia-telemetry nvidia-profile-inspector ddu discord.install teamspeak obs-studio.install audacity avidemux jdk8 jre8 openvpn-connect wireguard vscode.install anydesk.install pycharm python3 libreoffice-fresh authy-desktop capture2text ea-app epicgameslauncher steam ubisoft-connect git netlimiter microsoft-teams youtube-dl-gui -y

Powershell:

$choco_path = “$env:ProgramData\chocolatey\bin\choco.exe” if (-not (Test-Path $choco_path)) { Write-Host “Chocolatey is not installed. Please install it first from https://chocolatey.org/install” exit 1 } & $choco_path install microsoft-edge notepadplusplus.install 7zip.install vlc greenshot bitwarden foxitreader vcredist-all directx dotnetfx dotnet3.5 dotnet4.5 microsoft-windows-terminal powershellhere-elevated treesizefree dismplusplus rufus.portable hashcheck path-copy-copy processhacker winaero-tweaker hwinfo.install open-shell nsudo geekuninstaller autoruns nvidia-display-driver cuda disable-nvidia-telemetry nvidia-profile-inspector ddu discord.install teamspeak obs-studio.install audacity avidemux jdk8 jre8 openvpn-connect wireguard vscode.install anydesk.install pycharm python3 libreoffice-fresh authy-desktop capture2text ea-app epicgameslauncher steam ubisoft-connect git netlimiter microsoft-teams youtube-dl-gui -y

Please note that you need to run this script with administrative privileges as changing network settings typically requires admin rights. It will change your MTU value to 1492. Make sure to eventually replace "Ethernet" with your actual adapter name.

# Open PowerShell with administrative privileges

Start-Process powershell -Verb runAs

# Show the IPv4 subinterface

netsh interface ipv4 show subinterface

# Set the MTU for the 'Ethernet' subinterface to 1492 and store the setting persistently

netsh interface ipv4 set subinterface "Ethernet" mtu=1492 store=persistent

This script cleans your cached memory every 10 minutes, if the cached memory is higher than 8GB.

Using Empty Standby List is a great alternative. Create SYSTEM task in your Task Schedular, that runs every 10 minutes, hidden and with highest privileges, indefinitely.

@echo off

:loop

set "free_memory="

for /f "tokens=2" %%a in ('typeperf "\Memory\Cache Bytes" -sc 1 ^| findstr /r /c:"[0-9][0-9]*\.[0-9][0-9]*"') do set "free_memory=%%a"

if defined free_memory (

    set /a "free_memory_gb=free_memory / 1024 / 1024 / 1024"

    if %free_memory_gb% gtr 8 (

        echo Clearing standby memory...

        wmic.exe /Namespace:\\root\cimv2 Path Win32_PerfFormattedData_PerfOS_Memory Call EmptyWorkingSet

        echo Standby memory cleared.

    )

)

timeout /t 600 /nobreak >nul

goto loop

I find it annoying, to do it manually, so I did create a script for this reason. Add it to your task schedular and let it run daily with system privileges.

@echo off

echo Deleting all restore points...

vssadmin delete shadows /all /quiet

if %errorlevel% == 0 (

    echo Restore points deleted successfully.

) else (

    echo Failed to delete restore points.

)

echo Creating a new restore point...

wmic.exe /Namespace:\\root\default Path SystemRestore Call CreateRestorePoint "Custom Restore Point", 100, 7

if %errorlevel% == 0 (

    echo Restore point created successfully.

) else (

    echo Failed to create restore point.

)

<?xml version="1.0"?>

<Settings component="StartMenu" version="4.4.142">

<MenuStyle value="Classic1"/>

<ShiftClick value="ClassicMenu"/>

<WinKey value="ClassicMenu"/>

<ShiftWin value="Nothing"/>

<ShiftRight value="1"/>

<Computer value="Show"/>

<Documents value="Hide"/>

<UserFiles value="Hide"/>

<UserDocuments value="Hide"/>

<UserPictures value="Hide"/>

<ControlPanel value="Show"/>

<ControlPanelCategories value="0"/>

<Shutdown value="Show"/>

<LogOff value="0"/>

<ConfirmLogOff value="1"/>

<Undock value="1"/>

<Search value="0"/>

<Help value="0"/>

<HideProgramsMetro value="0"/>

<RecentPrograms value="None"/>

<EnableJumplists value="0"/>

<HybridShutdown value="0"/>

<StartScreenShortcut value="0"/>

<HighlightNew value="0"/>

<CheckWinUpdates value="0"/>

<ExpandFolderLinks value="0"/>

<DelayIcons value="0"/>

<SearchBox value="Normal"/>

<SearchTrack value="0"/>

<SearchAutoComplete value="0"/>

<SearchInternet value="0"/>

<MenuShadow value="0"/>

<EnableGlass value="0"/>

<SkinC1 value="Classic Skin"/>

<SkinVariationC1 value=""/>

<SkinOptionsC1>

<Line>CAPTION=1</Line>

<Line>USER_IMAGE=0</Line>

<Line>USER_NAME=0</Line>

<Line>CENTER_NAME=0</Line>

<Line>SMALL_ICONS=0</Line>

<Line>THICK_BORDER=0</Line>

<Line>SOLID_SELECTION=0</Line>

</SkinOptionsC1>

<SkipMetro value="1"/>

<MenuItems1>

<Line>Items=ComputerItem,ControlPanelItem,PCSettingsItem,MenuSettingsItem,SEPARATOR,CustomItem4,CustomItem6,CustomItem3,CustomItem2,CustomItem,CustomItem5,RunItem,SEPARATOR,ShutdownBoxItem,SearchBoxItem</Line>

<Line>ComputerItem.Command=computer</Line>

<Line>ControlPanelItem.Command=control_panel</Line>

<Line>ControlPanelItem.Label=$Menu.ControlPanel</Line>

<Line>ControlPanelItem.Tip=$Menu.ControlPanelTip</Line>

<Line>ControlPanelItem.Icon=shell32.dll,137</Line>

<Line>ControlPanelItem.Settings=TRACK_RECENT</Line>

<Line>PCSettingsItem.Command=pc_settings</Line>

<Line>PCSettingsItem.Label=$Menu.PCSettings</Line>

<Line>PCSettingsItem.Icon=%windir%\ImmersiveControlPanel\SystemSettings.exe,10</Line>

<Line>PCSettingsItem.Settings=TRACK_RECENT</Line>

<Line>MenuSettingsItem.Command=menu_settings</Line>

<Line>MenuSettingsItem.Label=$Menu.ClassicSettings</Line>

<Line>MenuSettingsItem.Tip=$Menu.SettingsTip</Line>

<Line>MenuSettingsItem.Icon=,1</Line>

<Line>CustomItem4.Link=%windir%\system32\services.msc</Line>

<Line>CustomItem4.Label=SERV</Line>

<Line>CustomItem6.Link=C:\Windows\system32\devmgmt.msc</Line>

<Line>CustomItem6.Label=DM</Line>

<Line>CustomItem3.Link=C:\Windows\regedit.exe</Line>

<Line>CustomItem3.Label=REG</Line>

<Line>CustomItem2.Command=%windir%\system32\taskschd.msc /s</Line>

<Line>CustomItem2.Label=TS</Line>

<Line>CustomItem2.Icon=%windir%\system32\miguiresource.dll, 600</Line>

<Line>CustomItem.Link=C:\Windows\System32\cmd.exe</Line>

<Line>CustomItem.Label=CMD</Line>

<Line>CustomItem5.Link=%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe</Line>

<Line>CustomItem5.Label=PS</Line>

<Line>RunItem.Command=RUN</Line>

<Line>RunItem.Label=$Menu.Run</Line>

<Line>RunItem.Tip=$Menu.RunTip</Line>

<Line>RunItem.Icon=shell32.dll,328</Line>

<Line>ShutdownBoxItem.Command=shutdown_box</Line>

<Line>ShutdownBoxItem.Label=$Menu.ShutdownBox</Line>

<Line>ShutdownBoxItem.Icon=shell32.dll,329</Line>

<Line>ShutdownBoxItem.Settings=SPLIT</Line>

<Line>SearchBoxItem.Command=search_box</Line>

<Line>SearchBoxItem.Label=$Menu.SearchBox</Line>

<Line>SearchBoxItem.Icon=none</Line>

<Line>SearchBoxItem.Settings=OPEN_UP|TRACK_RECENT</Line>

</MenuItems1>

</Settings>

Aside from the build-in option in Windows, apps do it sometimes anyways, even when you disable it via app directly. Here is a workaround for that.

1. Download these files here and extract them

2. In the file lock_mic_vol.bat the default value is 65536 which equals 100%, so if you want to make the volume lock onto 50% then just do some simple math ((65536/100)*50) which will give you 32768, so replace 65536 with 32768, to lock it permanent on 50% volume.

3. Go to the directory C:\Windows and paste the files hide_cmd_window2.vbs, lock_mic_vol.bat & nircmdc.exe

4. Then you can run the file start_lock_mic_vol.bat

5. Optional: If you want to make this run automatically at startup then paste this file in the directory C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

Source here.

Error message: Detected NVIDIA GeForce driver version xxx.yy. The required driver version is xxx.yy or later.

To bypass it, navigate to the system32 path and relocate the file "nvapi64.dll" to your desktop or an alternative location.

You can also use me two scripts below for this. The first one moves it to your desktop, with admin rights, the second one reverts it. Run both as admin with PowerShell (ps script).

NOTE: You won't be able to OBS anymore, without the original file in the location.

#Requires -RunAsAdministrator

$source = "$env:windir\System32\nvapi64.dll"

$destination = "$env:userprofile\Desktop\nvapi64.dll"

if (Test-Path $source) {

    Move-Item -Path $source -Destination $destination

    Write-Output "File moved successfully to $destination"

} else {

    Write-Output "File does not exist at $source"

}```

And to revert the same action:

```

#Requires -RunAsAdministrator

$source = "$env:userprofile\Desktop\nvapi64.dll"

$destination = "$env:windir\System32\nvapi64.dll"

if (Test-Path $source) {

    Move-Item -Path $source -Destination $destination

    Write-Output "File moved successfully to $destination"

} else {

    Write-Output "File does not exist at $source"

}

Below you find two powershell scripts. Running them will create a Logging file in your Download folder and in that file you will find it more easy whatever error you're searching for. Basically, they go through every logged event in your Windows Event Logger and make it easy to read what's happening or what just happened.

This first version is more "normal" and doesn't include bluescreens etc. The second is more aggressive and sorts out more.

# Pfad zur Logdatei

$logFile = "$env:USERPROFILE\Downloads\eventlog_errors.txt"

# Abrufen von Fehlern und Warnungen aus dem Eventlog

$events = Get-EventLog -LogName Application -EntryType Error, Warning

# Schreiben der Ereignisse in die Logdatei

$events | Format-List -Property TimeGenerated, EntryType, Source, InstanceId, Message | Out-File -FilePath $logFile

Write-Host "Die Fehler und Warnungen wurden in der Datei $logFile gespeichert."

# Pfad zur Logdatei

$logFile = "$env:USERPROFILE\Downloads\eventlog_critical_errors.txt"

# Versuch, kritische Fehler aus dem System-Eventlog abzurufen

try {

    $events = Get-WinEvent -FilterHashTable @{LogName='System'; Level=1} -ErrorAction Stop

    # Schreiben der Ereignisse in die Logdatei

    $events | Format-List -Property TimeCreated, LevelDisplayName, ProviderName, Id, Message | Out-File -FilePath $logFile

    Write-Host "Die kritischen Fehler wurden in der Datei $logFile gespeichert."

} catch {

    # Schreiben einer Nachricht in die Logdatei, wenn keine kritischen Fehler gefunden werden

    "Keine kritischen Fehler gefunden. Falls Sie doch einen Fehler vermuten oder Ihnen einer bewusst ist, nutzen Sie bitte den EventLog direkt!" | Out-File -FilePath $logFile

    Write-Host "Keine kritischen Fehler gefunden. Eine entsprechende Nachricht wurde in der Datei $logFile gespeichert."

}

What it does:

1. Stops the services (wuauserv, bits)

2. Clears the update cache (SoftwareDistribution\Download)

3. Restarts the services

4. Installs the PSWindowsUpdate module (if not present)

5. Permanently and reliably hides the specific KB updates

Make sure you have set the right policy to able to run it: Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process

Run in PS.ISE or with .\name.ps1 as admin

#Requires -RunAsAdministrator

# Definition der zu blockierenden KBs

$KBsToBlock = @("KB5063878", "KB5062660") # KB-Nummern mit "KB"

# 1. Windows Update und BITS-Dienst stoppen

Write-Host "Stoppe Windows Update und BITS Dienste..." -ForegroundColor Yellow

Stop-Service -Name "wuauserv" -Force -ErrorAction SilentlyContinue

Stop-Service -Name "bits" -Force -ErrorAction SilentlyContinue

Write-Host "Dienste erfolgreich gestoppt." -ForegroundColor Green

# Kurze Pause um sicherzugehen, dass die Dienste down sind

Start-Sleep -Seconds 2

# 2. Inhalt des SoftwareDistribution\Download Ordners löschen

$DownloadPath = "C:\Windows\SoftwareDistribution\Download"

Write-Host "Lösche Inhalte von: $DownloadPath" -ForegroundColor Yellow

if (Test-Path $DownloadPath) {

    try {

        Get-ChildItem -Path $DownloadPath -Recurse | Remove-Item -Force -Recurse -ErrorAction Stop

        Write-Host "Download-Ordner erfolgreich geleert." -ForegroundColor Green

    }

    catch {

        Write-Host "WARNUNG: Konnte nicht alle Dateien löschen. Möglicherweise sind einige noch gesperrt." -ForegroundColor Red

        Write-Host "Fehlermeldung: $($_.Exception.Message)" -ForegroundColor Red

    }

} else {

    Write-Host "WARNUNG: Der Pfad $DownloadPath wurde nicht gefunden." -ForegroundColor Red

}

# 3. Dienste wieder starten

Write-Host "Starte Windows Update und BITS Dienste neu..." -ForegroundColor Yellow

Start-Service -Name "bits" -ErrorAction SilentlyContinue

Start-Service -Name "wuauserv" -ErrorAction SilentlyContinue

Write-Host "Dienste erfolgreich gestartet." -ForegroundColor Green

# 4. PSWindowsUpdate Modul installieren und konfigurieren

Write-Host "`nÜberprüfe PSWindowsUpdate Modul..." -ForegroundColor Cyan

if (Get-Module -ListAvailable -Name PSWindowsUpdate) {

    Write-Host "Modul ist bereits installiert." -ForegroundColor Green

    # Modul importieren

    Import-Module PSWindowsUpdate -Force -Verbose:$false

} else {

    Write-Host "Modul ist nicht installiert. Installiere es jetzt..." -ForegroundColor Yellow

    try {

        # Repository vertrauen und Modul installieren

        Set-PSRepository -Name "PSGallery" -InstallationPolicy Trusted -ErrorAction Stop

        Install-Module -Name PSWindowsUpdate -Force -AllowClobber -ErrorAction Stop

        Import-Module PSWindowsUpdate -Force -Verbose:$false

        Write-Host "Modul erfolgreich installiert und importiert." -ForegroundColor Green

    }

    catch {

        Write-Host "FEHLER: Konnte das PSWindowsUpdate-Modul nicht installieren." -ForegroundColor Red

        Write-Host "Stellen Sie sicher, dass Sie eine Internetverbindung haben." -ForegroundColor Red

        Write-Host "Fehlermeldung: $($_.Exception.Message)" -ForegroundColor Red

        exit 1

    }

}

# Temporäre Ausführungsrichtlinie für diese Sitzung setzen

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process -Force

# 5. Spezifische Updates verstecken

Write-Host "`nVersuche, die folgenden Updates zu verstecken: $($KBsToBlock -join ', ')" -ForegroundColor Cyan

foreach ($KB in $KBsToBlock) {

    try {

        Write-Host "Verstecke Update $KB..." -ForegroundColor Yellow

        # Prüfen, ob das Update bereits versteckt ist

        $IsHidden = Get-WindowsUpdate -IsHidden | Where-Object { $_.KB -contains $KB.Replace('KB', '') }

        if (-not $IsHidden) {

            Hide-WindowsUpdate -KBArticleID $KB -Verbose -ErrorAction Stop

            Write-Host "Erfolg: $KB wurde versteckt." -ForegroundColor Green

        } else {

            Write-Host "Info: $KB war bereits versteckt." -ForegroundColor Blue

        }

    }

    catch {

        Write-Host "FEHLER: Konnte $KB nicht verstecken." -ForegroundColor Red

        Write-Host "Fehlermeldung: $($_.Exception.Message)" -ForegroundColor Red

    }

}

# 6. Erfolgsüberprüfung

Write-Host "`n--- Überprüfung ---" -ForegroundColor Cyan

Write-Host "Liste aller aktuell versteckten Updates:" -ForegroundColor White

try {

    $HiddenUpdates = Get-WindowsUpdate -IsHidden | Select-Object Title, KB, Size

    if ($HiddenUpdates) {

        $HiddenUpdates | Format-Table -AutoSize

    } else {

        Write-Host "Keine versteckten Updates gefunden." -ForegroundColor Yellow

    }

    # Prüfen, ob unsere Ziele-KBs in der Liste der Versteckten sind

    $SuccessfulBlocks = @()

    foreach ($KB in $KBsToBlock) {

        $KBNumber = $KB.Replace('KB', '')

        if ($HiddenUpdates.KB -contains $KBNumber) {

            $SuccessfulBlocks += $KB

        }

    }

    if ($SuccessfulBlocks) {

        Write-Host "`nErfolg: Folgende Updates wurden blockiert: $($SuccessfulBlocks -join ', ')" -ForegroundColor Green

    } else {

        Write-Host "`nWarnung: Keines der Ziel-Updates konnte in der Liste der versteckten Updates gefunden werden." -ForegroundColor Red

    }

}

catch {

    Write-Host "Fehler bei der Überprüfung der versteckten Updates." -ForegroundColor Red

}

Write-Host "`nSkript abgeschlossen." -ForegroundColor Cyan

After restarting your PC or turning it on, Windows 11 seems to ignore the actual plan set, so high performance will be shown, but saver or balanced is set internally. To fix this, use the reg file first and after that, the cmd command.

CMD: powercfg /setactive SCHEME_MIN 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power\EnergyMode]

"EnergyModeEnabled"=dword:00000000

"EnergyModePolicy"=dword:00000000

Enable BitLocker with TPM and a Startup PIN

This configuration protects an encrypted Windows installation against offline password reset methods such as replacing utilman.exe with cmd.exe.

It applies mainly to Windows 11 Pro, Enterprise, and Education. Windows Home normally does not include gpedit.msc.

1. Back up the BitLocker recovery key

Before changing any protector, confirm that a recovery password exists.

Open Windows Terminal or Command Prompt as administrator and run:

manage-bde -protectors -get C:

You should see an entry named

Numerical Password

It contains a 48-digit recovery key.

Store that key outside the computer:

• On a separate USB drive

• Printed on paper

• In a secure password manager

• In your Microsoft account, provided nobody else controls that account

Do not store the only copy on the same Windows partition.

2. Verify that BitLocker is fully active

Run:

manage-bde -status C:

The important lines should show:

Conversion Status: Fully Encrypted

Percentage Encrypted: 100%

Protection Status: Protection On

The volume will show as unlocked while Windows is running. That is normal.

3. Enable the startup PIN policy

Press:

Win + R

Enter:

gpedit.msc

Navigate to:

Computer Configuration

> Administrative Templates

> Windows Components

> BitLocker Drive Encryption

> Operating System Drives

Open:

Require additional authentication at startup

Set it to:

Enabled

Configure the available options as follows:

Allow BitLocker without a compatible TPM:

Unchecked

For the TPM options, use:

Configure TPM startup:

Allow TPM

Configure TPM startup PIN:

Require startup PIN with TPM

The wording may vary slightly between Windows builds. The important setting is that a startup PIN with TPM is allowed or required.

The startup-key options can remain disabled unless you specifically intend to use a USB startup key.

Click:

Apply

OK

4. Apply the Group Policy change

Open Command Prompt as Administrator and run:

gpupdate /force

A restart is normally not required before adding the protector, but restarting once can help if Windows still reports policy error 0x80310060.

5. Add the TPM and PIN protector

Run:

manage-bde -protectors -add C: -TPM and PIN

Windows will ask you to enter and confirm a startup PIN.

Use a PIN that is:

• Different from your Windows Hello, PIN.

• Different from your Windows password

• Not based on a birthday or simple sequence

• Known only to you

By default, BitLocker startup PINs are numeric.

6. Verify the new protector

Run:

manage-bde -protectors -get C:

The result should contain:

Numerical Password

TPM And PIN

The numerical password is the recovery key. Do not delete it.

7. Remove any remaining TPM-only protector

Check whether the output also contains a separate entry named only:

TPM

A separate TPM-only protector would allow Windows to unlock without requiring the startup PIN.

Each protector has an ID similar to the following:

{12345678-1234-1234-1234-123456789ABC}

Delete only the ID belonging to the plain TPM entry:

manage-bde -protectors -delete C: -id {ID-OF-THE-TPM-ONLY-PROTECTOR}

Do not delete:

TPM And PIN

Numerical Password

Check again:

manage-bde -protectors -get C:

The final protector list should normally be

Numerical Password

TPM And PIN

8. Test the configuration

Perform a full shutdown:

shutdown /s /t 0

Turn the computer on again.

Before Windows loads, BitLocker should request the startup PIN.

After entering the BitLocker PIN, Windows should continue to the normal Windows login screen.

Your browser sessions, saved tabs, and website logins normally remain stored. Shutting down Windows does not automatically sign you out of websites.

9. Verify the final state

After logging into Windows, run:

manage-bde -status C:

manage-bde -protectors -get C:

The correct final state is

Fully Encrypted

100%

Protection On

Protectors:

Numerical Password

TPM And PIN

10. Verify Secure Boot

Press:

Win + R

Enter:

msinfo32

Check:

BIOS Mode: UEFI

Secure Boot State: On

Secure Boot strengthens the integrity checks used by the TPM. It does not replace BitLocker.

11. Change the BitLocker startup PIN later

Open Command Prompt as Administrator and run:

manage-bde -changepin C:

Enter the current PIN and then the new PIN when requested.

12. Security result

With the computer fully shut down, BitLocker fully encrypted, and TPM and PIN enabled, an attacker cannot normally modify the encrypted Windows files offline to perform the utilman.exe command-prompt password-reset method.

This configuration does not prevent someone with physical access from:

• Deleting or damaging the encrypted partition

• Replacing hardware

• Installing a physical keylogger

• Accessing Windows while it is already unlocked

• Observing the startup PIN directly

For the encrypted Windows installation itself, however, TPM and PIN are the correct protection against the offline CMD and local-password-reset technique.

# Definition der Pfade für die Registry

$registryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"

# Prüfen, ob der Pfad existiert, andernfalls erstellen

if (-not (Test-Path $registryPath)) {

    New-Item -Path $registryPath -Force | Out-Null

}

# Aktiviert die Zielversions-Richtlinie

Set-ItemProperty -Path $registryPath -Name "TargetReleaseVersion" -Value 1 -Type DWord

# Ermittelt die aktuell installierte Windows-Version (z.B. 22H2, 23H2)

$currentVersion = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").DisplayVersion

# Fixiert Windows auf die aktuelle Versionsnummer

Set-ItemProperty -Path $registryPath -Name "TargetReleaseVersionInfo" -Value $currentVersion -Type String

# Startet den Windows Update-Dienst neu, um Änderungen anzuwenden

Restart-Service -Name "wuauserv" -Force

Write-Host "Erfolgreich! Windows bleibt dauerhaft auf Version: $currentVersion" -ForegroundColor Green