undergroundwires / privacy.sexy

Open-source tool to enforce privacy & security best-practices on Windows, macOS and Linux, because privacy is sexy
https://privacy.sexy
GNU Affero General Public License v3.0
4.02k stars 170 forks source link

build in Disk Cleanup #35

Closed sopla4ever closed 3 years ago

sopla4ever commented 3 years ago

Can you add option to clean Previous Windows instalations?

undergroundwires commented 3 years ago

Hi @sopla4ever, thanks for the suggestion. Would deleting Windows.old be sufficient? Thinking about something like:

if exist "%SystemDrive%\Windows.old" (
    takeown /f "%SystemDrive%\Windows.old" /a /r /d y
    icacls "%SystemDrive%\Windows.old" /grant administrators:F /t
    rd /s /q "%SystemDrive%\Windows.old"
    echo Deleted previous installation from "%SystemDrive%\Windows.old\"
)  else (
    echo No previous Windows installation has been found
)
sopla4ever commented 3 years ago

I thought more about this method:


REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Previous Installations" /V StateFlags10 /T REG_DWORD /D 2 /F >nul 2>&1
cleanmgr /sagerun:10
sopla4ever commented 3 years ago

StateFlagsXXXXX is just parameter with which we start cleanmgr

You can do the same with many registry keys that contain your StateFlagsXXXXX DWORD value and clean it with one command "cleanmgr /sagerun:XXXXX" So for full cleaning should add StateFlagsXXXXX to all subkeys.

There are following subkeys (tick boxes in gui cleanmgr): Be carefully DownloadsFolder is your Downloads


HKLM\SOFTWARE\[...]\VolumeCaches\Active Setup Temp Folders
HKLM\SOFTWARE\[...]\VolumeCaches\Content Indexer Cleaner
HKLM\SOFTWARE\[...]\VolumeCaches\D3D Shader Cache
HKLM\SOFTWARE\[...]\VolumeCaches\Delivery Optimization Files
HKLM\SOFTWARE\[...]\VolumeCaches\Device Driver Packages
HKLM\SOFTWARE\[...]\VolumeCaches\Diagnostic Data Viewer database files
HKLM\SOFTWARE\[...]\VolumeCaches\Downloaded Program Files
HKLM\SOFTWARE\[...]\VolumeCaches\DownloadsFolder
HKLM\SOFTWARE\[...]\VolumeCaches\Feedback Hub Archive log files
HKLM\SOFTWARE\[...]\VolumeCaches\Internet Cache Files
HKLM\SOFTWARE\[...]\VolumeCaches\Language Pack
HKLM\SOFTWARE\[...]\VolumeCaches\Offline Pages Files
HKLM\SOFTWARE\[...]\VolumeCaches\Old ChkDsk Files
HKLM\SOFTWARE\[...]\VolumeCaches\Previous Installations
HKLM\SOFTWARE\[...]\VolumeCaches\Recycle Bin
HKLM\SOFTWARE\[...]\VolumeCaches\RetailDemo Offline Content
HKLM\SOFTWARE\[...]\VolumeCaches\Setup Log Files
HKLM\SOFTWARE\[...]\VolumeCaches\System error memory dump files
HKLM\SOFTWARE\[...]\VolumeCaches\System error minidump files
HKLM\SOFTWARE\[...]\VolumeCaches\Temporary Files
HKLM\SOFTWARE\[...]\VolumeCaches\Temporary Setup Files
HKLM\SOFTWARE\[...]\VolumeCaches\Thumbnail Cache
HKLM\SOFTWARE\[...]\VolumeCaches\Update Cleanup
HKLM\SOFTWARE\[...]\VolumeCaches\Upgrade Discarded Files
HKLM\SOFTWARE\[...]\VolumeCaches\User file versions
HKLM\SOFTWARE\[...]\VolumeCaches\Windows Defender
HKLM\SOFTWARE\[...]\VolumeCaches\Windows Error Reporting Files
HKLM\SOFTWARE\[...]\VolumeCaches\Windows ESD installation files
HKLM\SOFTWARE\[...]\VolumeCaches\Windows Upgrade Log Files
undergroundwires commented 3 years ago

Thanks for the pretty nice explanation.

I love the idea of using OS-tool instead of reinventing the wheel. It allows reusing existing & tested functionality while minimizing the maintenance.

We can add all of the settings to privacy.sexy as the cleanup increases the privacy. But we need to think more about the implementation.

API design by Microsoft allows too much room for errors.

1. I believe we should do reg delete before doing reg add for the number we choose for each key to ensure that nothing else will be cleaned up. Because user may have that state flag in another key somehow (e.g. if privacy.sexy got terminated after reg add). A pseudo code would look like:

foreach cleanmgr key in registry
    reg delete key <state-flag>
reg add key <state-flag>
cleanmgr /sagerun:<state-flag>

2. Another issue is taking over a state flag in use. Let's say that user runs an automated script that also uses state flag 10 for cleanmgr. When we also use 10 then we mess up user settings.

3. One other problem is that it does not wait, it introduces an an unintented paralellism. I see that we can solve 2 by running start /w cleanmgr /sagerun:5 or Start-Process -Wait "$env:SystemRoot\System32\cleanmgr.exe" -ArgumentList "/sagerun:5"

4. It would be nice to hide window it's creating. I tried -WindowStyle Hidden and -NoNewWindow parameters on PowerShell without success.

Let's wait for the implementation. I'll first add functions support in the yaml file so that the tweaks that 'll do cleanup can share some code (such as cleaning the state flag). It would also be nice to be able to solve 2. and 4. meanwhile 🤔

sopla4ever commented 3 years ago

2. The XXXXX "number" can be any value from 0 to 65535 so there is little chance of the same value by other scripts. Number 10 was just example.

dennyamarojr commented 3 years ago

I have the right commands will add into the list, I'm testing a few things like Hardening processes and also make browser more secure, so with time I will update the application.yaml and this option will be available.

undergroundwires commented 3 years ago

I've started looking at it but I read that:

I'm sorry but cleanmgr is deprecated and will eventually be deleted 😒

The Disk Cleanup experience (“cleanmgr.exe”) is being deprecated. We’re retaining the Disk Cleanup tool for compatibility reasons. There's no need to worry since Storage Sense’s functionality is a superset of what the legacy Disk Cleanup provides! Microsoft

At the end building the functionality upon cleanmgr would be dead investment that'd cause a maintainance burden as we know it will eventually be deleted. It would be not trust it anymore to do the right job. Unfortunately Storage sense lack any API that we can call to trigger a clean up job.

So I just added your request using the batch way. It will be live on next release.

necros2k7 commented 3 years ago

Hm, stumbled upon start command , can we use it to speedup script execution like for some long dism operations in parallel? If so how can we make it`s window to stay and show it completed OK.

undergroundwires commented 3 years ago

You're right @necros2k7 . It would be sad to run everything with start and wait until they're done. 🤔 Unsure how to solve this one. I'm leaving this issue to you guys. I'd approve PRs and a potential solution, but I won't be implementing this.

undergroundwires commented 3 years ago

Cleanmgr.exe makes outbound connections to Microsoft on 20.49.150.241. Community is suspicious of its telemetry. Not a good tool that should be used by privacy.sexy. Closing this, and PRs will not be accepted if they do not disable its telemetry somehow.