Add option to show & undo applied tweaks + more (#599)

* Remove RemoveCommApps and RemoveW11Outlook presets. These are largely redundant. Use -RemoveApps parameter instead

* Add additional options to change the `All Apps` view in the start menu (Hide, Grid, Category, List)

* Add clean start menu backup validation to start menu restore function

* Resolve nested quoting bug in Run.bat when path has spaces, see #583

* Fix desync issue when toggling "Only Show Installed" checkbox too fast

* Fix: add missing keys in Sysprep/Undo regfiles for Disabling Recall and Windows Suggested content

* Fix 'Disable Animations' Sysprep settings not being set for new users

* Update README.md

* Update CONTRIBUTING.md

Scripts/Features/BackupRegistryFeatureSelection.ps1

@@ -14,8 +14,7 @@ function Get-FeatureId {
 
 function Get-RegistryBackedFeatures {
     param(
-        [Parameter(Mandatory)]
-        [object[]]$Features
+        [object[]]$Features = @()
     )
 
     return @($Features | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_.RegistryKey) })

Scripts/Features/BackupRegistrySnapshotCapture.ps1

@@ -1,47 +1,44 @@
 function Get-RegistryBackupCapturePlans {
     param(
-        [Parameter(Mandatory)]
-        [object[]]$SelectedRegistryFeatures,
+        [object[]]$SelectedRegistryFeatures = @(),
+        [object[]]$UndoRegistryFeatures = @(),
         [switch]$UseSysprepRegFiles
     )
 
     $planMap = @{}
+
     foreach ($feature in $SelectedRegistryFeatures) {
-        $regFilePath = Get-RegistryFilePathForFeature -Feature $feature -UseSysprepRegFiles:$UseSysprepRegFiles
+        $regFilePath = Get-RegistryFilePathForFeature -RegistryKey $feature.RegistryKey -UseSysprepRegFiles:$UseSysprepRegFiles
         if (-not (Test-Path $regFilePath)) {
             throw "Unable to find registry file for backup: $($feature.RegistryKey) ($regFilePath)"
         }
 
         foreach ($operation in @(Get-RegFileOperations -regFilePath $regFilePath)) {
             if (-not $operation.KeyPath) { continue }
+            Add-RegistryPlanOperation -PlanMap $planMap -Operation $operation
+        }
+    }
 
-            $mapKey = $operation.KeyPath.ToLowerInvariant()
-            if (-not $planMap.ContainsKey($mapKey)) {
-                $planMap[$mapKey] = [PSCustomObject]@{
-                    Path = $operation.KeyPath
-                    IncludeSubKeys = $false
-                    CaptureAllValues = $false
-                    ValueNames = New-Object 'System.Collections.Generic.HashSet[string]' ([System.StringComparer]::OrdinalIgnoreCase)
-                }
+    foreach ($feature in $UndoRegistryFeatures) {
+        $regFilePath = Resolve-RegistryBackupUndoFilePath -Feature $feature
+        if ([string]::IsNullOrWhiteSpace($regFilePath)) {
+            continue
+        }
+
+        if (-not (Test-Path $regFilePath)) {
+            $undoKeyDescription = if (-not [string]::IsNullOrWhiteSpace([string]$feature.RegistryUndoKey)) {
+                [string]$feature.RegistryUndoKey
+            }
+            else {
+                [string]$feature.RegistryKey
             }
 
-            $plan = $planMap[$mapKey]
-            switch ($operation.OperationType) {
-                'DeleteKey' {
-                    $plan.IncludeSubKeys = $true
-                    $plan.CaptureAllValues = $true
-                }
-                'SetValue' {
-                    if (-not $plan.CaptureAllValues) {
-                        $null = $plan.ValueNames.Add([string]$operation.ValueName)
-                    }
-                }
-                'DeleteValue' {
-                    if (-not $plan.CaptureAllValues) {
-                        $null = $plan.ValueNames.Add([string]$operation.ValueName)
-                    }
-                }
-            }
+            throw "Unable to find registry undo file for backup: $undoKeyDescription ($regFilePath)"
+        }
+
+        foreach ($operation in @(Get-RegFileOperations -regFilePath $regFilePath)) {
+            if (-not $operation.KeyPath) { continue }
+            Add-RegistryPlanOperation -PlanMap $planMap -Operation $operation
         }
     }
 
@@ -57,10 +54,68 @@ function Get-RegistryBackupCapturePlans {
     )
 }
 
-function Get-RegistrySnapshotsForBackup {
+function Add-RegistryPlanOperation {
+    param(
+        [hashtable]$PlanMap,
+        [PSCustomObject]$Operation
+    )
+
+    $mapKey = $Operation.KeyPath.ToLowerInvariant()
+    if (-not $PlanMap.ContainsKey($mapKey)) {
+        $PlanMap[$mapKey] = [PSCustomObject]@{
+            Path = $Operation.KeyPath
+            IncludeSubKeys = $false
+            CaptureAllValues = $false
+            ValueNames = New-Object 'System.Collections.Generic.HashSet[string]' ([System.StringComparer]::OrdinalIgnoreCase)
+        }
+    }
+
+    $plan = $PlanMap[$mapKey]
+    switch ($Operation.OperationType) {
+        'DeleteKey' {
+            $plan.IncludeSubKeys = $true
+            $plan.CaptureAllValues = $true
+        }
+        'SetValue' {
+            if (-not $plan.CaptureAllValues) {
+                $null = $plan.ValueNames.Add([string]$Operation.ValueName)
+            }
+        }
+        'DeleteValue' {
+            if (-not $plan.CaptureAllValues) {
+                $null = $plan.ValueNames.Add([string]$Operation.ValueName)
+            }
+        }
+    }
+}
+
+function Resolve-RegistryBackupUndoFilePath {
     param(
         [Parameter(Mandatory)]
-        [object[]]$CapturePlans
+        $Feature
+    )
+
+    $undoRegistryKey = [string]$Feature.RegistryUndoKey
+    if (-not [string]::IsNullOrWhiteSpace($undoRegistryKey)) {
+        $resolvedUndoPath = Resolve-UndoRegFilePath -FileName $undoRegistryKey
+        return Join-Path $script:RegfilesPath $resolvedUndoPath
+    }
+
+    $resolvedRegistryKey = [string]$Feature.RegistryKey
+    if ([string]::IsNullOrWhiteSpace($resolvedRegistryKey)) {
+        return $null
+    }
+
+    if ([System.IO.Path]::IsPathRooted($resolvedRegistryKey)) {
+        return $resolvedRegistryKey
+    }
+
+    return Join-Path $script:RegfilesPath $resolvedRegistryKey
+}
+
+function Get-RegistrySnapshotsForBackup {
+    param(
+        [object[]]$CapturePlans = @()
     )
 
     if ($CapturePlans.Count -eq 0) {

Scripts/Features/BackupRegistryState.ps1

@@ -1,11 +1,14 @@
 function New-RegistrySettingsBackup {
     param(
-        [string[]]$ActionableKeys
+        [string[]]$ActionableKeys,
+        [object[]]$ExtraFeatures = @()
     )
 
     $ActionableKeys = @($ActionableKeys)
-    $selectedFeatures = Get-SelectedFeatures -ActionableKeys $ActionableKeys
-    if (@($selectedFeatures | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_.RegistryKey) }).Count -eq 0) {
+    $selectedFeatures = @(Get-SelectedFeatures -ActionableKeys $ActionableKeys)
+    $undoFeatures = @($ExtraFeatures | Where-Object { $_ -ne $null })
+    $allFeatures = @($selectedFeatures) + @($undoFeatures)
+    if (@($allFeatures | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_.RegistryKey) }).Count -eq 0) {
         return $null
     }
 
@@ -18,7 +21,7 @@ function New-RegistrySettingsBackup {
     $backupFileName = 'Win11Debloat-RegistryBackup-{0}.json' -f $timestamp.ToString('yyyyMMdd_HHmmss')
     $backupFilePath = Join-Path $backupDirectory $backupFileName
 
-    $backupConfig = Get-RegistryBackupPayload -SelectedFeatures $selectedFeatures -CreatedAt $timestamp
+    $backupConfig = Get-RegistryBackupPayload -SelectedFeatures $selectedFeatures -UndoFeatures $undoFeatures -CreatedAt $timestamp
     if (-not (SaveToFile -Config $backupConfig -FilePath $backupFilePath -MaxDepth 25)) {
         throw "Failed to save registry backup to '$backupFilePath'"
     }
@@ -55,8 +58,8 @@ function Get-SelectedFeatures {
 
 function Get-RegistryBackupPayload {
     param(
-        [Parameter(Mandatory)]
-        [object[]]$SelectedFeatures,
+        [object[]]$SelectedFeatures = @(),
+        [object[]]$UndoFeatures = @(),
         [Parameter(Mandatory)]
         [datetime]$CreatedAt
     )
@@ -71,11 +74,24 @@ function Get-RegistryBackupPayload {
         }
     }
 
-    $selectedRegistryFeatures = Get-RegistryBackedFeatures -Features $SelectedFeatures
-    $capturePlans = Get-RegistryBackupCapturePlans -SelectedRegistryFeatures $SelectedRegistryFeatures
+    $selectedUndoFeatureIds = New-Object System.Collections.Generic.List[string]
+    $seenUndoFeatureIds = New-Object 'System.Collections.Generic.HashSet[string]' ([System.StringComparer]::OrdinalIgnoreCase)
+    foreach ($feature in $UndoFeatures) {
+        $featureId = Get-FeatureId -Feature $feature
+
+        if ($seenUndoFeatureIds.Add($featureId)) {
+            $selectedUndoFeatureIds.Add($featureId)
+        }
+    }
+
+    $selectedRegistryFeatures = @(Get-RegistryBackedFeatures -Features $SelectedFeatures)
+    $undoRegistryFeatures = @($UndoFeatures | Where-Object { 
+        -not [string]::IsNullOrWhiteSpace([string]$_.RegistryUndoKey) -or -not [string]::IsNullOrWhiteSpace([string]$_.RegistryKey)
+    })
+    $capturePlans = @(Get-RegistryBackupCapturePlans -SelectedRegistryFeatures $selectedRegistryFeatures -UndoRegistryFeatures $undoRegistryFeatures)
     $registryKeys = @(Get-RegistrySnapshotsForBackup -CapturePlans $capturePlans)
 
-    return @{
+    $backupPayload = @{
         Version = '1.0'
         BackupType = 'RegistryState'
         CreatedAt = $CreatedAt.ToString('o')
@@ -85,4 +101,10 @@ function Get-RegistryBackupPayload {
         SelectedFeatures = @($selectedFeatureIds)
         RegistryKeys = @($registryKeys)
     }
+
+    if ($selectedUndoFeatureIds.Count -gt 0) {
+        $backupPayload['SelectedUndoFeatures'] = @($selectedUndoFeatureIds)
+    }
+
+    return $backupPayload
 }

Scripts/Features/DisableStoreSearchSuggestions.ps1

@@ -49,4 +49,137 @@ function DisableStoreSearchSuggestions {
     Set-Acl -Path $StoreAppsDatabase -AclObject $Acl | Out-Null
 
     Write-Host "Disabled Microsoft Store search suggestions for user $userName"
+}
+
+function EnableStoreSearchSuggestionsForAllUsers {
+    # Get path to Store app database for all users
+    $userPathString = GetUserDirectory -userName "*" -fileName "AppData\Local\Packages"
+    $usersStoreDbPaths = Get-ChildItem -Path $userPathString -ErrorAction SilentlyContinue
+
+    # Go through all users and re-enable start search suggestions
+    ForEach ($storeDbPath in $usersStoreDbPaths) {
+        EnableStoreSearchSuggestions ($storeDbPath.FullName + "\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\store.db")
+    }
+
+    # Also re-enable for the default user profile
+    $defaultStoreDbPath = GetUserDirectory -userName "Default" -fileName "AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\store.db" -exitIfPathNotFound $false
+    EnableStoreSearchSuggestions $defaultStoreDbPath
+}
+
+function EnableStoreSearchSuggestions {
+    param (
+        $StoreAppsDatabase = "$env:LocalAppData\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\store.db"
+    )
+
+    # Change path to correct user if a user was specified
+    if ($script:Params.ContainsKey("User")) {
+        $StoreAppsDatabase = GetUserDirectory -userName "$(GetUserName)" -fileName "AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\store.db" -exitIfPathNotFound $false
+    }
+
+    $userName = [regex]::Match($StoreAppsDatabase, '(?:Users\\)([^\\]+)(?:\\AppData)').Groups[1].Value
+    if (-not $userName) { $userName = '<unknown>' }
+
+    if (-not (Test-Path -Path $StoreAppsDatabase)) {
+        Write-Host "Store app database not found for user $userName, nothing to undo"
+        return
+    }
+
+    # Ensure we can modify/delete the file even if restrictive ACLs were set.
+    $global:LASTEXITCODE = 0
+    takeown /F "$StoreAppsDatabase" /A | Out-Null
+    icacls "$StoreAppsDatabase" /grant *S-1-5-32-544:F /C | Out-Null
+
+    $everyoneSid = [System.Security.Principal.SecurityIdentifier]::new('S-1-1-0') # 'EVERYONE' group
+
+    try {
+        $acl = Get-Acl -Path $StoreAppsDatabase
+        $denyRules = @(
+            $acl.Access | Where-Object {
+                $_.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Deny -and
+                (($_.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -ne 0) -and
+                (try { $_.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]) -eq $everyoneSid } catch { $false })
+            }
+        )
+
+        foreach ($denyRule in $denyRules) {
+            $null = $acl.RemoveAccessRuleSpecific($denyRule)
+        }
+
+        Set-Acl -Path $StoreAppsDatabase -AclObject $acl | Out-Null
+    }
+    catch {
+        Write-Warning "Failed to normalize ACL for store database '$StoreAppsDatabase': $($_.Exception.Message)"
+    }
+
+    try {
+        Remove-Item -Path $StoreAppsDatabase -Force -ErrorAction Stop
+        Write-Host "Re-enabled Microsoft Store search suggestions for user $userName"
+    }
+    catch {
+        throw "Failed to remove '$StoreAppsDatabase' while undoing Microsoft Store search suggestions for user $userName. $($_.Exception.Message)"
+    }
+}
+
+function Test-StoreSearchSuggestionsDisabled {
+    param(
+        [Parameter(Mandatory)]
+        [string]$StoreAppsDatabase
+    )
+
+    if (-not (Test-Path -Path $StoreAppsDatabase)) {
+        return $false
+    }
+
+    try {
+        $acl = Get-Acl -Path $StoreAppsDatabase
+    }
+    catch {
+        return $false
+    }
+
+    $everyoneSid = [System.Security.Principal.SecurityIdentifier]::new('S-1-1-0')
+
+    foreach ($accessRule in @($acl.Access)) {
+        $isDenyFullControl = $accessRule.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Deny -and
+            (($accessRule.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -ne 0)
+        if (-not $isDenyFullControl) { continue }
+
+        $isEveryone = $false
+        try {
+            $isEveryone = $accessRule.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]) -eq $everyoneSid
+        } catch { }
+
+        if ($isEveryone) {
+            return $true
+        }
+    }
+
+    return $false
+}
+
+function Test-StoreSearchSuggestionsDisabledForAllUsers {
+    $paths = @()
+
+    $userPathString = GetUserDirectory -userName "*" -fileName "AppData\Local\Packages"
+    $usersStoreDbPaths = Get-ChildItem -Path $userPathString -ErrorAction SilentlyContinue
+    foreach ($storeDbPath in $usersStoreDbPaths) {
+        $paths += ($storeDbPath.FullName + "\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\store.db")
+    }
+
+    $defaultStoreDbPath = GetUserDirectory -userName "Default" -fileName "AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\store.db" -exitIfPathNotFound $false
+    if ($defaultStoreDbPath) {
+        $paths += $defaultStoreDbPath
+    }
+
+    if ($paths.Count -eq 0) {
+        return $false
+    }
+
+    foreach ($path in $paths) {
+        if (-not (Test-StoreSearchSuggestionsDisabled -StoreAppsDatabase $path)) {
+            return $false
+        }
+    }
+
+    return $true
 }

Scripts/Features/EnableWindowsFeature.ps1

@@ -1,16 +0,0 @@
-# Enables a Windows optional feature and pipes its output to the console
-function EnableWindowsFeature {
-    param (
-        [string]$FeatureName
-    )
-
-    $result = Invoke-NonBlocking -ScriptBlock {
-        param($name)
-        Enable-WindowsOptionalFeature -Online -FeatureName $name -All -NoRestart
-    } -ArgumentList $FeatureName
-
-    $dismResult = @($result) | Where-Object { $_ -is [Microsoft.Dism.Commands.ImageObject] }
-    if ($dismResult) {
-        Write-Host ($dismResult | Out-String).Trim()
-    }
-}

Scripts/Features/ExecuteChanges.ps1

@@ -20,11 +20,11 @@ function ExecuteParameter {
         switch ($paramKey) {
             'DisableBing' {
                 # Also remove the app package for Bing search
-                RemoveApps 'Microsoft.BingSearch'
+                RemoveApps @('Microsoft.BingSearch')
             }
             'DisableCopilot' {
                 # Also remove the app package for Copilot
-                RemoveApps 'Microsoft.Copilot'
+                RemoveApps @('Microsoft.Copilot')
             }
         }
         return
@@ -33,7 +33,7 @@ function ExecuteParameter {
     # Handle features without RegistryKey or with special logic
     switch ($paramKey) {
         'RemoveApps' {
-            Write-Host "> Removing selected apps for $(GetFriendlyTargetUserName)..."
+            Write-Host "> $($feature.ApplyText) for $(GetFriendlyTargetUserName)..."
             $appsList = GenerateAppsList
 
             if ($appsList.Count -eq 0) {
@@ -46,7 +46,7 @@ function ExecuteParameter {
             RemoveApps $appsList
         }
         'RemoveAppsCustom' {
-            Write-Host "> Removing selected apps..."
+            Write-Host "> $($feature.ApplyText)..."
             $appsList = LoadAppsFromFile $script:CustomAppsListFilePath
 
             if ($appsList.Count -eq 0) {
@@ -58,58 +58,46 @@ function ExecuteParameter {
             Write-Host "$($appsList.Count) apps selected for removal"
             RemoveApps $appsList
         }
-        'RemoveCommApps' {
-            $appsList = 'Microsoft.windowscommunicationsapps', 'Microsoft.People'
-            Write-Host "> Removing Mail, Calendar and People apps..."
-            RemoveApps $appsList
-            return
-        }
-        'RemoveW11Outlook' {
-            $appsList = 'Microsoft.OutlookForWindows'
-            Write-Host "> Removing new Outlook for Windows app..."
-            RemoveApps $appsList
-            return
-        }
         'RemoveGamingApps' {
-            $appsList = 'Microsoft.GamingApp', 'Microsoft.XboxGameOverlay', 'Microsoft.XboxGamingOverlay'
-            Write-Host "> Removing gaming related apps..."
+            $appsList = @('Microsoft.GamingApp', 'Microsoft.XboxGameOverlay', 'Microsoft.XboxGamingOverlay')
+            Write-Host "> $($feature.ApplyText)..."
             RemoveApps $appsList
             return
         }
         'RemoveHPApps' {
-            $appsList = 'AD2F1837.HPAIExperienceCenter', 'AD2F1837.HPJumpStarts', 'AD2F1837.HPPCHardwareDiagnosticsWindows', 'AD2F1837.HPPowerManager', 'AD2F1837.HPPrivacySettings', 'AD2F1837.HPSupportAssistant', 'AD2F1837.HPSureShieldAI', 'AD2F1837.HPSystemInformation', 'AD2F1837.HPQuickDrop', 'AD2F1837.HPWorkWell', 'AD2F1837.myHP', 'AD2F1837.HPDesktopSupportUtilities', 'AD2F1837.HPQuickTouch', 'AD2F1837.HPEasyClean', 'AD2F1837.HPConnectedMusic', 'AD2F1837.HPFileViewer', 'AD2F1837.HPRegistration', 'AD2F1837.HPWelcome', 'AD2F1837.HPConnectedPhotopoweredbySnapfish', 'AD2F1837.HPPrinterControl'
-            Write-Host "> Removing HP apps..."
+            $appsList = @('AD2F1837.HPAIExperienceCenter', 'AD2F1837.HPJumpStarts', 'AD2F1837.HPPCHardwareDiagnosticsWindows', 'AD2F1837.HPPowerManager', 'AD2F1837.HPPrivacySettings', 'AD2F1837.HPSupportAssistant', 'AD2F1837.HPSureShieldAI', 'AD2F1837.HPSystemInformation', 'AD2F1837.HPQuickDrop', 'AD2F1837.HPWorkWell', 'AD2F1837.myHP', 'AD2F1837.HPDesktopSupportUtilities', 'AD2F1837.HPQuickTouch', 'AD2F1837.HPEasyClean', 'AD2F1837.HPConnectedMusic', 'AD2F1837.HPFileViewer', 'AD2F1837.HPRegistration', 'AD2F1837.HPWelcome', 'AD2F1837.HPConnectedPhotopoweredbySnapfish', 'AD2F1837.HPPrinterControl')
+            Write-Host "> $($feature.ApplyText)..."
             RemoveApps $appsList
             return
         }
         'DisableWidgets' {
-            Write-Host "> Disabling widgets on the taskbar & lock screen..."
+            Write-Host "> $($feature.ApplyText)..."
             # Stop widgets related processes before removing the app packages to prevent potential issues
-            Get-Process *Widget* | Stop-Process
-            
-            RemoveApps 'Microsoft.StartExperiencesApp','MicrosoftWindows.Client.WebExperience','Microsoft.WidgetsPlatformRuntime'
+            Get-Process *Widget* -ErrorAction SilentlyContinue | Stop-Process
+
+            RemoveApps @('Microsoft.StartExperiencesApp','MicrosoftWindows.Client.WebExperience','Microsoft.WidgetsPlatformRuntime')
         }
-        "EnableWindowsSandbox" {
-            Write-Host "> Enabling Windows Sandbox..."
+        'EnableWindowsSandbox' {
+            Write-Host "> $($feature.ApplyText)..."
             EnableWindowsFeature "Containers-DisposableClientVM"
             Write-Host ""
             return
         }
-        "EnableWindowsSubsystemForLinux" {
-            Write-Host "> Enabling Windows Subsystem for Linux..."
+        'EnableWindowsSubsystemForLinux' {
+            Write-Host "> $($feature.ApplyText)..."
             EnableWindowsFeature "VirtualMachinePlatform"
             EnableWindowsFeature "Microsoft-Windows-Subsystem-Linux"
             Write-Host ""
             return
         }
         'ClearStart' {
-            Write-Host "> Removing all pinned apps from the start menu for user $(GetUserName)..."
+            Write-Host "> $($feature.ApplyText) for user $(GetUserName)..."
             ReplaceStartMenu
             Write-Host ""
             return
         }
         'ReplaceStart' {
-            Write-Host "> Replacing the start menu for user $(GetUserName)..."
+            Write-Host "> $($feature.ApplyText) for user $(GetUserName)..."
             ReplaceStartMenu $script:Params.Item("ReplaceStart")
             Write-Host ""
             return
@@ -169,8 +157,15 @@ function ExecuteAllChanges {
             break
         }
     }
+    # Undo operations that write registry values also require a backup
+    if (-not $hasRegistryBackedFeature) {
+        foreach ($featureId in $script:UndoParams.Keys) {
+            $f = if ($script:Features.ContainsKey($featureId)) { $script:Features[$featureId] } else { $null }
+            if ($f -and $f.RegistryUndoKey) { $hasRegistryBackedFeature = $true; break }
+        }
+    }
     
-    $totalSteps = $actionableKeys.Count
+    $totalSteps = $actionableKeys.Count + $script:UndoParams.Count
     if ($hasRegistryBackedFeature) { $totalSteps++ }
     if ($script:Params.ContainsKey("CreateRestorePoint")) { $totalSteps++ }
     $currentStep = 0
@@ -183,7 +178,13 @@ function ExecuteAllChanges {
 
         Write-Host "> Creating registry backup..."
         try {
-            New-RegistrySettingsBackup -ActionableKeys $actionableKeys | Out-Null
+            $undoSyntheticFeatures = @($script:UndoParams.Keys | ForEach-Object {
+                $f = if ($script:Features.ContainsKey($_)) { $script:Features[$_] } else { $null }
+                if ($f -and $f.RegistryUndoKey) {
+                    [PSCustomObject]@{ FeatureId = $_; RegistryKey = (Resolve-UndoRegFilePath $f.RegistryUndoKey) }
+                }
+            } | Where-Object { $_ })
+            New-RegistrySettingsBackup -ActionableKeys $actionableKeys -ExtraFeatures $undoSyntheticFeatures | Out-Null
         }
         catch {
             throw "Registry backup failed before applying changes. $($_.Exception.Message)"
@@ -203,9 +204,7 @@ function ExecuteAllChanges {
     
     # Execute all parameters
     foreach ($paramKey in $actionableKeys) {
-        if ($script:CancelRequested) { 
-            return
-        }
+        if ($script:CancelRequested) { return }
 
         $currentStep++
         
@@ -229,8 +228,82 @@ function ExecuteAllChanges {
         ExecuteParameter -paramKey $paramKey
     }
 
+    # Execute all undo operations
+    foreach ($featureId in $script:UndoParams.Keys) {
+        if ($script:CancelRequested) { return }
+
+        $f = if ($script:Features.ContainsKey($featureId)) { $script:Features[$featureId] } else { $null }
+        $undoLabel = if ($f -and $f.UndoLabel) { $f.UndoLabel } else { $featureId }
+        $applyUndoText = if ($f -and $f.ApplyUndoText) { $f.ApplyUndoText } else { $undoLabel }
+
+        $currentStep++
+        if ($script:ApplyProgressCallback) {
+            & $script:ApplyProgressCallback $currentStep $totalSteps $applyUndoText
+        }
+
+        if ($f -and $f.RegistryUndoKey) {
+            ImportRegistryFile "> $applyUndoText" (Resolve-UndoRegFilePath $f.RegistryUndoKey)
+        } else {
+            Invoke-UndoFeatureAction -FeatureId $featureId
+        }
+    }
+
     if ($script:RegistryImportFailures -gt 0) {
         Write-Host ""
         Write-Host "$($script:RegistryImportFailures) registry import change(s) failed. See output above for details." -ForegroundColor Yellow
     }
-}
+}
+
+# Resolves the path of an undo reg file relative to $script:RegfilesPath.
+# Checks the Undo/ subfolder first, then falls back to the root Regfiles/ folder.
+function Resolve-UndoRegFilePath {
+    param ([string]$FileName)
+    $undoSubPath = Join-Path 'Undo' $FileName
+    if (Test-Path (Join-Path $script:RegfilesPath $undoSubPath)) {
+        return $undoSubPath
+    }
+    return $FileName
+}
+
+function Invoke-UndoFeatureAction {
+    param(
+        [Parameter(Mandatory)]
+        [string]$FeatureId
+    )
+
+    $feature = if ($script:Features.ContainsKey($FeatureId)) { $script:Features[$FeatureId] } else { $null }
+
+    switch ($FeatureId) {
+        'DisableStoreSearchSuggestions' {
+            if ($script:Params.ContainsKey('Sysprep')) {
+                Write-Host "> Re-enabling Microsoft Store search suggestions in the start menu for all users..."
+                EnableStoreSearchSuggestionsForAllUsers
+                Write-Host ""
+                return
+            }
+
+            Write-Host "> Re-enabling Microsoft Store search suggestions for user $(GetUserName)..."
+            EnableStoreSearchSuggestions
+            Write-Host ""
+            return
+        }
+        'EnableWindowsSandbox' {
+            Write-Host "> $($feature.ApplyUndoText)..."
+            DisableWindowsFeature 'Containers-DisposableClientVM'
+            Write-Host ""
+            return
+        }
+        'EnableWindowsSubsystemForLinux' {
+            Write-Host "> $($feature.ApplyUndoText)..."
+            DisableWindowsFeature 'Microsoft-Windows-Subsystem-Linux'
+            DisableWindowsFeature 'VirtualMachinePlatform'
+            Write-Host ""
+            return
+        }
+        default {
+            Write-Host "> No undo action defined for $FeatureId, skipping..." -ForegroundColor Yellow
+            Write-Host ""
+            return
+        }
+    }
+}

Scripts/Features/GetCurrentTweakState.ps1

@@ -0,0 +1,175 @@
+# Tests whether the registry operations in a feature's .reg file currently match the live registry.
+# Returns $true if ALL operations in the apply reg file match current system state.
+# Returns $false if the feature has no RegistryKey, the file is missing, or any operation mismatches.
+function Get-ExpectedRegistryValueKind {
+    param(
+        [Parameter(Mandatory)]
+        $Operation
+    )
+
+    switch ([string]$Operation.ValueType) {
+        'DWord' { return [Microsoft.Win32.RegistryValueKind]::DWord }
+        'QWord' { return [Microsoft.Win32.RegistryValueKind]::QWord }
+        'String' { return [Microsoft.Win32.RegistryValueKind]::String }
+        'Binary' { return [Microsoft.Win32.RegistryValueKind]::Binary }
+        'Hex2' { return [Microsoft.Win32.RegistryValueKind]::ExpandString }
+        'Hex7' { return [Microsoft.Win32.RegistryValueKind]::MultiString }
+        default { return $null }
+    }
+}
+
+function Test-FeatureApplied {
+    param (
+        [Parameter(Mandatory)]
+        [string]$FeatureId
+    )
+
+    if (-not $script:Features.ContainsKey($FeatureId)) { return $false }
+    $feature = $script:Features[$FeatureId]
+
+    switch ($FeatureId) {
+        'DisableWidgets' {
+            # Widgets packages cannot be reinstalled automatically, so we treat their
+            # absence as the applied state (checked) and presence as not-yet-applied.
+            $widgetAppIds = @(
+                'Microsoft.StartExperiencesApp',
+                'MicrosoftWindows.Client.WebExperience',
+                'Microsoft.WidgetsPlatformRuntime'
+            )
+
+            foreach ($appId in $widgetAppIds) {
+                if (Get-AppxPackage -Name $appId -AllUsers -ErrorAction SilentlyContinue) {
+                    return $false
+                }
+            }
+
+            return $true
+        }
+        'DisableStoreSearchSuggestions' {
+            if ($script:Params.ContainsKey('Sysprep')) {
+                return (Test-StoreSearchSuggestionsDisabledForAllUsers)
+            }
+
+            $storeDbPath = "$env:LocalAppData\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\store.db"
+            if ($script:Params.ContainsKey('User')) {
+                $storeDbPath = GetUserDirectory -userName "$(GetUserName)" -fileName "AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\store.db" -exitIfPathNotFound $false
+            }
+
+            return (Test-StoreSearchSuggestionsDisabled -StoreAppsDatabase $storeDbPath)
+        }
+        'EnableWindowsSandbox' {
+            return (Test-WindowsOptionalFeatureEnabled -FeatureName 'Containers-DisposableClientVM')
+        }
+        'EnableWindowsSubsystemForLinux' {
+            $wslEnabled = Test-WindowsOptionalFeatureEnabled -FeatureName 'Microsoft-Windows-Subsystem-Linux'
+            $vmpEnabled = Test-WindowsOptionalFeatureEnabled -FeatureName 'VirtualMachinePlatform'
+            return ($wslEnabled -and $vmpEnabled)
+        }
+    }
+
+    if (-not $feature.RegistryKey) { return $false }
+
+    $regFilePath = Join-Path $script:RegfilesPath $feature.RegistryKey
+    if (-not (Test-Path $regFilePath)) { return $false }
+
+    try {
+        $operations = @(Get-RegFileOperations -regFilePath $regFilePath)
+    }
+    catch { return $false }
+
+    if ($operations.Count -eq 0) { return $false }
+
+    foreach ($op in $operations) {
+        $parts = Split-RegistryPath -path $op.KeyPath
+        if (-not $parts) { return $false }
+
+        $rootKey = Get-RegistryRootKey -hiveName $parts.Hive
+        if (-not $rootKey) { return $false }
+
+        $key = $null
+        try {
+            $key = $rootKey.OpenSubKey($parts.SubKey, $false)
+
+            switch ($op.OperationType) {
+                'DeleteKey' {
+                    if ($null -ne $key) { return $false }
+                }
+                'DeleteValue' {
+                    if ($null -ne $key) {
+                        $names = @($key.GetValueNames())
+                        if ($names -icontains $op.ValueName) { return $false }
+                    }
+                    # key missing = value also gone = operation matches
+                }
+                'SetValue' {
+                    if ($null -eq $key) { return $false }
+                    $names = @($key.GetValueNames())
+                    if (-not ($names -icontains $op.ValueName)) { return $false }
+
+                    $actualKind = $key.GetValueKind($op.ValueName)
+                    $expectedKind = Get-ExpectedRegistryValueKind -Operation $op
+                    if ($null -eq $expectedKind -or $actualKind -ne $expectedKind) { return $false }
+                    $actualRaw  = $key.GetValue($op.ValueName, $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
+
+                    $actual = switch ($actualKind) {
+                        ([Microsoft.Win32.RegistryValueKind]::DWord) {
+                            [BitConverter]::ToUInt32([BitConverter]::GetBytes([int32]$actualRaw), 0)
+                        }
+                        ([Microsoft.Win32.RegistryValueKind]::QWord) {
+                            [BitConverter]::ToUInt64([BitConverter]::GetBytes([int64]$actualRaw), 0)
+                        }
+                        ([Microsoft.Win32.RegistryValueKind]::Binary) {
+                            @($actualRaw | ForEach-Object { [int]$_ })
+                        }
+                        ([Microsoft.Win32.RegistryValueKind]::MultiString) {
+                            @($actualRaw)
+                        }
+                        default {
+                            if ($null -ne $actualRaw) { [string]$actualRaw } else { $null }
+                        }
+                    }
+
+                    $expected = $op.ValueData
+
+                    $match = if (($actual -is [array]) -and ($expected -is [array])) {
+                        (Compare-Object $actual $expected).Count -eq 0
+                    } else {
+                        $actual -eq $expected
+                    }
+
+                    if (-not $match) { return $false }
+                }
+            }
+        }
+        catch { return $false }
+        finally {
+            if ($null -ne $key) { $key.Close() }
+        }
+    }
+
+    return $true
+}
+
+# Returns the 1-based index of the UiGroup option whose features all match current system state,
+# or 0 if no option fully matches (meaning the current state is unknown / "No Change").
+function Get-CurrentGroupActiveIndex {
+    param (
+        [Parameter(Mandatory)]
+        [object]$Group
+    )
+
+    $i = 1
+    foreach ($val in $Group.Values) {
+        $allApplied = $true
+        foreach ($fid in $val.FeatureIds) {
+            if (-not (Test-FeatureApplied -FeatureId $fid)) {
+                $allApplied = $false
+                break
+            }
+        }
+        if ($allApplied) { return $i }
+        $i++
+    }
+
+    return 0
+}

Scripts/Features/ImportRegistryFile.ps1

@@ -8,13 +8,7 @@ function ImportRegistryFile {
     Write-Host $message
 
     $usesOfflineHive = $script:Params.ContainsKey("Sysprep") -or $script:Params.ContainsKey("User")
-    $regFileDirectory = if ($usesOfflineHive) {
-        Join-Path $script:RegfilesPath "Sysprep"
-    }
-    else {
-        $script:RegfilesPath
-    }
-    $regFilePath = Join-Path $regFileDirectory $path
+    $regFilePath = Get-RegistryFilePathForFeature -RegistryKey $path
 
     if (-not (Test-Path $regFilePath)) {
         $errorMessage = "Unable to find registry file: $path ($regFilePath)"

Scripts/Features/RegistryBackupValidation.ps1

@@ -33,12 +33,49 @@ function Get-NormalizedSelectedFeatureIdsFromBackup {
         $errors.Add('SelectedFeatures must contain non-empty string feature IDs.')
     }
 
-    if ($selectedFeatures.Count -eq 0) {
-        $errors.Add('SelectedFeatures must contain at least one feature ID.')
+    return [PSCustomObject]@{
+        SelectedFeatures = $selectedFeatures.ToArray()
+        Errors = $errors.ToArray()
+    }
+}
+
+function Get-NormalizedSelectedUndoFeatureIdsFromBackup {
+    param(
+        [Parameter(Mandatory)]
+        $Backup
+    )
+
+    $selectedUndoFeatures = New-Object System.Collections.Generic.List[string]
+    $selectedUndoFeatureIds = New-Object 'System.Collections.Generic.HashSet[string]' ([System.StringComparer]::OrdinalIgnoreCase)
+    $errors = New-Object System.Collections.Generic.List[string]
+
+    # SelectedUndoFeatures is optional - only process if present
+    if (-not $Backup.PSObject.Properties['SelectedUndoFeatures']) {
+        return [PSCustomObject]@{
+            SelectedUndoFeatures = $selectedUndoFeatures.ToArray()
+            Errors = $errors.ToArray()
+        }
+    }
+
+    $hasInvalidSelectedUndoFeatureId = $false
+    foreach ($featureId in @($Backup.SelectedUndoFeatures)) {
+        if ($featureId -isnot [string] -or [string]::IsNullOrWhiteSpace([string]$featureId)) {
+            $hasInvalidSelectedUndoFeatureId = $true
+            continue
+        }
+
+        $normalizedFeatureId = [string]$featureId
+        if ($selectedUndoFeatureIds.Add($normalizedFeatureId)) {
+            $selectedUndoFeatures.Add($normalizedFeatureId)
+        }
+    }
+
+    if ($hasInvalidSelectedUndoFeatureId) {
+        $errors.Add('SelectedUndoFeatures must contain non-empty string feature IDs.')
     }
 
     return [PSCustomObject]@{
-        SelectedFeatures = $selectedFeatures.ToArray()
+        SelectedUndoFeatures = $selectedUndoFeatures.ToArray()
         Errors = $errors.ToArray()
     }
 }
@@ -96,6 +133,9 @@ function Test-RegistryBackupMatchesSelectedFeatures {
         [AllowEmptyCollection()]
         [string[]]$SelectedFeatureIds,
         [Parameter(Mandatory)]
+        [AllowEmptyCollection()]
+        [string[]]$SelectedUndoFeatureIds,
+        [Parameter(Mandatory)]
         [string]$Target,
         [Parameter(Mandatory)]
         [AllowEmptyCollection()]
@@ -109,18 +149,19 @@ function Test-RegistryBackupMatchesSelectedFeatures {
         return $errors.ToArray()
     }
 
-    $selectedRegistryFeatures = @(Get-SelectedRegistryFeaturesForBackupValidation -SelectedFeatureIds @($SelectedFeatureIds) -Errors $errors)
+    $selectedRegistryFeatures = @(Get-SelectedRegistryFeaturesForBackupValidation -SelectedFeatureIds @($SelectedFeatureIds) -IsUndoFeature:$false -Errors $errors)
+    $undoRegistryFeatures = @(Get-SelectedRegistryFeaturesForBackupValidation -SelectedFeatureIds @($SelectedUndoFeatureIds) -IsUndoFeature:$true -Errors $errors)
     $useSysprepRegFiles = ($Target -eq 'DefaultUserProfile') -or ($Target -like 'User:*')
 
     $capturePlans = @()
-    if ($errors.Count -eq 0 -and $selectedRegistryFeatures.Count -gt 0) {
-        $capturePlans = @(Get-RegistryBackupCapturePlans -SelectedRegistryFeatures @($selectedRegistryFeatures) -UseSysprepRegFiles:$useSysprepRegFiles)
+    if ($errors.Count -eq 0 -and ($selectedRegistryFeatures.Count -gt 0 -or $undoRegistryFeatures.Count -gt 0)) {
+        $capturePlans = @(Get-RegistryBackupCapturePlans -SelectedRegistryFeatures @($selectedRegistryFeatures) -UndoRegistryFeatures @($undoRegistryFeatures) -UseSysprepRegFiles:$useSysprepRegFiles)
     }
 
     $planMap = New-RegistryBackupAllowListPlanMap -CapturePlans @($capturePlans)
 
     if ($planMap.Count -eq 0 -and @($RegistryKeys).Count -gt 0) {
-        $errors.Add('Backup contains registry snapshots but no allowed registry paths were derived from SelectedFeatures.')
+        $errors.Add('Backup contains registry snapshots but no allowed registry paths were derived from the selected features.')
     }
 
     foreach ($rootSnapshot in @($RegistryKeys)) {
@@ -136,6 +177,8 @@ function Get-SelectedRegistryFeaturesForBackupValidation {
         [AllowEmptyCollection()]
         [string[]]$SelectedFeatureIds,
         [Parameter(Mandatory)]
+        [bool]$IsUndoFeature,
+        [Parameter(Mandatory)]
         [AllowEmptyCollection()]
         $Errors
     )
@@ -152,7 +195,26 @@ function Get-SelectedRegistryFeaturesForBackupValidation {
         }
 
         $feature = $script:Features[$featureId]
-        if ($feature -and -not [string]::IsNullOrWhiteSpace([string]$feature.RegistryKey)) {
+        if (-not $feature) {
+            continue
+        }
+
+        # For undo features, check RegistryUndoKey if present (real features)
+        # Otherwise check RegistryKey (for synthetic features from backup capture)
+        $registryKeyToUse = if ($IsUndoFeature) {
+            $key = [string]$feature.RegistryUndoKey
+            if (-not [string]::IsNullOrWhiteSpace($key)) {
+                $key
+            }
+            else {
+                [string]$feature.RegistryKey
+            }
+        }
+        else {
+            [string]$feature.RegistryKey
+        }
+
+        if (-not [string]::IsNullOrWhiteSpace($registryKeyToUse)) {
             $selectedRegistryFeatures.Add($feature)
         }
     }

Scripts/Features/ReplaceStartMenu.ps1

@@ -39,7 +39,7 @@ function ReplaceStartMenuForAllUsers {
 }
 
 
-# Replace the startmenu for all users, when using the default startmenuTemplate this clears all pinned apps
+# Replace the startmenu at the specified location, when using the default startmenuTemplate this clears all pinned apps
 # Credit: https://lazyadmin.nl/win-11/customize-windows-11-start-menu-layout/
 function ReplaceStartMenu {
     param (

Scripts/Features/RestoreRegistryBackup.ps1

@@ -87,7 +87,17 @@ function Normalize-RegistryBackup {
         $errors.Add([string]$selectedFeatureParseError)
     }
 
-    $allowListValidationErrors = @(Test-RegistryBackupMatchesSelectedFeatures -SelectedFeatureIds @($selectedFeatures) -Target $normalizedTarget -RegistryKeys @($normalizedKeys))
+    $selectedUndoFeatureParseResult = Get-NormalizedSelectedUndoFeatureIdsFromBackup -Backup $Backup
+    $selectedUndoFeatures = @($selectedUndoFeatureParseResult.SelectedUndoFeatures)
+    foreach ($selectedUndoFeatureParseError in @($selectedUndoFeatureParseResult.Errors)) {
+        $errors.Add([string]$selectedUndoFeatureParseError)
+    }
+
+    $allSelectedFeatures = @($selectedFeatures) + @($selectedUndoFeatures)
+    if ($allSelectedFeatures.Count -eq 0) {
+        $errors.Add('Backup must contain at least one feature ID in SelectedFeatures or SelectedUndoFeatures.')
+    }
+    $allowListValidationErrors = @(Test-RegistryBackupMatchesSelectedFeatures -SelectedFeatureIds @($selectedFeatures) -SelectedUndoFeatureIds @($selectedUndoFeatures) -Target $normalizedTarget -RegistryKeys @($normalizedKeys))
     foreach ($allowListValidationError in $allowListValidationErrors) {
         $errors.Add([string]$allowListValidationError)
     }
@@ -110,6 +120,7 @@ function Normalize-RegistryBackup {
         ComputerName = [string]$Backup.ComputerName
         Target = $normalizedTarget
         SelectedFeatures = @($selectedFeatures)
+        SelectedUndoFeatures = @($selectedUndoFeatures)
         RegistryKeys = @($normalizedKeys)
     }
 }

Scripts/Features/WindowsOptionalFeatures.ps1

@@ -0,0 +1,49 @@
+# Enables a Windows optional feature and pipes its output to the console
+function EnableWindowsFeature {
+    param (
+        [string]$FeatureName
+    )
+
+    $result = Invoke-NonBlocking -ScriptBlock {
+        param($name)
+        Enable-WindowsOptionalFeature -Online -FeatureName $name -All -NoRestart
+    } -ArgumentList $FeatureName
+
+    $dismResult = @($result) | Where-Object { $_ -is [Microsoft.Dism.Commands.ImageObject] }
+    if ($dismResult) {
+        Write-Host ($dismResult | Out-String).Trim()
+    }
+}
+
+# Disables a Windows optional feature and pipes its output to the console
+function DisableWindowsFeature {
+    param (
+        [string]$FeatureName
+    )
+
+    $result = Invoke-NonBlocking -ScriptBlock {
+        param($name)
+        Disable-WindowsOptionalFeature -Online -FeatureName $name -NoRestart
+    } -ArgumentList $FeatureName
+
+    $dismResult = @($result) | Where-Object { $_ -is [Microsoft.Dism.Commands.ImageObject] }
+    if ($dismResult) {
+        Write-Host ($dismResult | Out-String).Trim()
+    }
+}
+
+function Test-WindowsOptionalFeatureEnabled {
+    param (
+        [Parameter(Mandatory)]
+        [string]$FeatureName
+    )
+
+    try {
+        $feature = Get-WindowsOptionalFeature -Online -FeatureName $FeatureName -ErrorAction Stop
+    }
+    catch {
+        return $false
+    }
+
+    return ($feature.State -eq 'Enabled')
+}