#Requires -Version 5.1
<#  SilverMetal Enhanced - Windows | Domain A: Provisioning baseline
    De-cloud, debloat, telemetry -> Security floor. Idempotent.
    Spec: ../hardening-spec.md (A)   |   SCAFFOLD (M1): verify on the unit.
#>
[CmdletBinding()] param()
Set-StrictMode -Version Latest; $ErrorActionPreference = 'Stop'
Write-Host '[A] Provisioning baseline'

# Telemetry floor (level 0 'Security' is honoured only on Enterprise/Education/LTSC).
$dc = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection'
New-Item -Path $dc -Force | Out-Null
Set-ItemProperty $dc -Name AllowTelemetry        -Type DWord -Value 0
Set-ItemProperty $dc -Name DoNotShowFeedbackNotifications -Type DWord -Value 1

# Kill connected-experience / advertising / activity surfaces.
$svc = 'DiagTrack','dmwappushservice'
foreach ($s in $svc) { Get-Service $s -EA SilentlyContinue | Set-Service -StartupType Disabled -PassThru | Stop-Service -Force -EA SilentlyContinue }

# Advertising ID, Tailored experiences, Activity feed (machine policies).
$adv = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo'
New-Item $adv -Force | Out-Null; Set-ItemProperty $adv -Name DisabledByGroupPolicy -Type DWord -Value 1

# TODO-M1: Recall/Copilot/Cortana off; remove residual provisioned appx (Enterprise prototype);
#          confirm no MSA bound (OOBE handled this via autounattend).

Write-Host '   [A] applied (telemetry=0, DiagTrack disabled, ad-ID off)'
