aveyo / leanandmean Goto Github PK

Can you come back to mydigitallife and help us?
I'm sure you are one of the rare people who can write the uupdump module as a powershell script.

System privileges are enough to perform most Windows OS editing, but unlike running as TI, running as System does not require debugging privileges to be enabled for administrators. It makes running as system a more limited, but also a safer option compared to running as TI. I'd appreciate a RunAsSystem context menu script that works when debugging is disabled for administrators.

When opening the Windows 11 Explorer with RunAsTI (e.g. right clicking on a folder and clicking 'Open as TrustedInstaller'), there's now quite a few issues in the latest versions.

• Right clicking crashes
• Resizing the window doesn't resize the elements inside (like the folder view)
• Closing the ribbon doesn't work

However, running control with RunAsTI and then pressing the up arrow in the toolbar completely fixes this, and you can use Explorer as normal.

Right now I can't see whether the script was successful or not.

Command Prompt (using the script provided)

PowerShell (using the script provided)

Batch Script (using call :RunAsTI)

?

This script was used in a ransomware attack at a company my brother works for.

Is there a 'reverse' script, one that undoes everything that's been done?

Hello,

downloaded and placed RunAsTI.bat file in to %windir%/system32
restarting computer, open a cmd elevated:

call RunAsTI.bat mybatchfile.cmd or
call %windir%/system32/RunAsTI.bat mybatchfile.cmd

`@echo off
setlocal EnableDelayedExpansion

whoami /user | find /i "S-1-5-18" > nul 2>&1 || (
call RunAsTI.cmd "%~f0" "%*"
exit /b
)

del /q/f/s !windir!\temp*.*`

file are not deleted.

if opening a cmd and execute the command, it work fine
del /q/f/s !windir!\temp\*.*

Hey, made a cool hybrid and thought about you, it's got some aspects still rusty, feel free to have fun with it 👍

<# : @couleurm on github
@echo off & set a=%* &REM to join multiple strings as arrays
::set a=%a:" "=","%
set a=%a:"=\^"%
PowerShell "& (& {[Scriptblock]::Create((Get-Content \"%~f0\" -Raw))}) %a%" & exit /b
#>
param(
    $argument,
    [Parameter(ValueFromRemainingArguments = $true)]
    [System.Collections.Arraylist]
    $rest
    )
"argument"
$argument
"rest"
$rest

Toggle Defender Not Working on Windows 10/11

1

Similar to the more common "open command prompt here" or "open command prompt here as admin".

(for directories & directory background)

Thanks.