中国移动家庭云电脑window关闭所有安全脚本

关闭安全功能之后才可以dd脚本。刷磁盘，打开powerrshell 执行下面的脚本。或存文件执行文件

0.修改系统的执行策略

运行 PowerShell 脚本，可以永久修改这个策略。这需要管理员权限。

复制代码

点击电脑左下角的开始菜单，搜索 PowerShell。

在搜索结果上右键点击，选择 "以管理员身份运行"。

在弹出的管理员窗口中，输入以下命令并回车：
PowerShell

bash 复制代码

    Set-ExecutionPolicy RemoteSigned

1.关闭window所有的安全功能

disable_all_security.ps1

bash 复制代码

#Requires -RunAsAdministrator
# Disable ALL Windows and vendor security protections
# Target: Windows 10 Enterprise LTSC 10.0.17763 (Chuanyun Cloud Desktop)

$ErrorActionPreference = 'SilentlyContinue'
$LogFile = "C:\disable_security_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"

function Write-Log {
    param([string]$Message, [string]$Level = 'INFO')
    $line = "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] [$Level] $Message"
    Write-Host $line
    Add-Content -Path $LogFile -Value $line -Encoding UTF8
}

function Stop-AndDisableService {
    param([string[]]$ServiceNames)
    foreach ($name in $ServiceNames) {
        $svc = Get-Service -Name $name -ErrorAction SilentlyContinue
        if ($svc) {
            try {
                if ($svc.Status -eq 'Running') {
                    Stop-Service -Name $name -Force -ErrorAction Stop
                    Write-Log "Stopped service: $name"
                }
                Set-Service -Name $name -StartupType Disabled -ErrorAction Stop
                Write-Log "Disabled service: $name"
            } catch {
                Write-Log "Failed to disable $name : $_" 'WARN'
                $regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$name"
                if (Test-Path $regPath) {
                    Set-ItemProperty -Path $regPath -Name 'Start' -Value 4 -Force
                    Write-Log "Force-disabled via registry: $name"
                }
            }
        }
    }
}

function Kill-ProcessByPattern {
    param([string[]]$Patterns)
    # Protected process names - never kill even if path matches a pattern
    $protectedNames = @(
        'sc-alive','appQtEasyTier','IceDisplay','IceInput','IceMain','IceSound','IceTunnel',
        'qemu-ga','Vdservice','Vmbooster','VmQoE','MswitchWin','AssistantService'
    )
    foreach ($pat in $Patterns) {
        Get-Process -ErrorAction SilentlyContinue | Where-Object {
            ($_.Name -match $pat -or ($_.Path -and $_.Path -match $pat)) -and ($_.Name -notin $protectedNames)
        } | ForEach-Object {
            try {
                Stop-Process -Id $_.Id -Force
                Write-Log "Killed process: $($_.Name) (PID $($_.Id))"
            } catch {
                Write-Log "Failed to kill $($_.Name): $_" 'WARN'
            }
        }
    }
}

function Set-RegDword {
    param([string]$Path, [string]$Name, [int]$Value)
    if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null }
    Set-ItemProperty -Path $Path -Name $Name -Value $Value -Type DWord -Force
    Write-Log "Registry: $Path\$Name = $Value"
}

function Set-RegString {
    param([string]$Path, [string]$Name, [string]$Value)
    if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null }
    Set-ItemProperty -Path $Path -Name $Name -Value $Value -Type String -Force
    Write-Log "Registry: $Path\$Name = $Value"
}

Write-Log "========== START: Disable All Security =========="
Write-Log "OS: $((Get-CimInstance Win32_OperatingSystem).Caption) $((Get-CimInstance Win32_OperatingSystem).Version)"
Write-Log "User: $([System.Security.Principal.WindowsIdentity]::GetCurrent().Name)"

# [1] Windows Defender
Write-Log "--- [1/12] Windows Defender ---"
Set-RegDword -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name 'DisableAntiSpyware' -Value 1
Set-RegDword -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name 'DisableAntiVirus' -Value 1
Set-RegDword -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name 'DisableRealtimeMonitoring' -Value 1
Set-RegDword -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name 'DisableBehaviorMonitoring' -Value 1
Set-RegDword -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name 'DisableOnAccessProtection' -Value 1
Set-RegDword -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name 'DisableIOAVProtection' -Value 1
Set-RegDword -Path 'HKLM:\SOFTWARE\Microsoft\Windows Defender' -Name 'DisableAntiSpyware' -Value 1
Set-RegDword -Path 'HKLM:\SOFTWARE\Microsoft\Windows Defender\Features' -Name 'TamperProtection' -Value 0
try {
    Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableIOAVProtection $true -ErrorAction SilentlyContinue
    Write-Log "Set-MpPreference applied"
} catch { Write-Log "Set-MpPreference skipped" 'WARN' }
Stop-AndDisableService @('WinDefend','WdNisSvc','WdNisDrv','WdBoot','WdFilter','SecurityHealthService','Sense')

# [2] Firewall
Write-Log "--- [2/12] Firewall ---"
try {
    Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False -ErrorAction Stop
    Write-Log "Firewall disabled via Set-NetFirewallProfile"
} catch {
    netsh advfirewall set allprofiles state off 2>&1 | Out-Null
    Write-Log "Firewall disabled via netsh"
}
Stop-AndDisableService @('mpssvc','MpsSvc','BFE')
Set-RegDword -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile' -Name 'EnableFirewall' -Value 0
Set-RegDword -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile' -Name 'EnableFirewall' -Value 0
Set-RegDword -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile' -Name 'EnableFirewall' -Value 0

# [3] UAC / SmartScreen
Write-Log "--- [3/12] UAC / SmartScreen ---"
Set-RegDword -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'EnableLUA' -Value 0
Set-RegDword -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'ConsentPromptBehaviorAdmin' -Value 0
Set-RegDword -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'PromptOnSecureDesktop' -Value 0
Set-RegDword -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'EnableInstallerDetection' -Value 0
Set-RegDword -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'FilterAdministratorToken' -Value 0
Set-RegString -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer' -Name 'SmartScreenEnabled' -Value 'Off'
Set-RegDword -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name 'EnableSmartScreen' -Value 0

# [4] Sysmon
Write-Log "--- [4/12] Sysmon ---"
Stop-AndDisableService @('Sysmon64','Sysmon')
$sysmonPaths = @('C:\Windows\Sysmon64.exe','C:\Windows\Sysmon.exe')
foreach ($sp in $sysmonPaths) {
    if (Test-Path $sp) { & $sp -u force 2>&1 | Out-Null; Write-Log "Uninstalled Sysmon: $sp" }
}
try { fltmc unload SysmonDrv 2>&1 | Out-Null } catch {}
Kill-ProcessByPattern @('Sysmon')

# [5] Vendor security agents (Chuanyun cloud desktop)
# IMPORTANT: DO NOT touch display/input/network streaming stack!
# Protected (commented out below): Ice*, QtEasyTier, Vdservice, Vmbooster*, VmQoE*,
#   qemu-ga, USBIP Client, MswitchWin, sc-alive, AssistantService, BalloonService
Write-Log "--- [5/12] Vendor Security Agents (display stack protected) ---"
$vendorServices = @(
    'ChuanyunVault_drcService','chuanyun-metric-probe',
    # 'sc-alive',                    # DISABLED: cloud session keepalive, needed for desktop access
    'GuardAgent','PCAS Service','pcas_proc_svc',
    'SoftwareStoreAgent','SoftwarestoreService',
    'UpdateDaemon','USBIP Client Guard',
    # 'Vmbooster','VmBoosterMonitor','VmQoEAgent','Vdservice',  # DISABLED: VM display/QoE agent
    # 'qemu-ga',                     # DISABLED: QEMU guest agent, needed for VM management
    'AppIDSvc','DiagTrack','dmwappushservice',
    'wscsvc','EventCollectorService'
    # 'MswitchWin',                  # DISABLED: display channel switching
    # 'AssistantService'             # DISABLED: display helper on some images
)
Stop-AndDisableService $vendorServices
$vendorPatterns = @(
    'SysGuard','CloudEDR','GuardAgent',
    'pcagent','pcas','SoftwareStore','softwarestore','Sysmon',
    '360','jyrepaire','venus','lingxi',
    # 'Chuanyun','chuanyun',         # DISABLED: too broad, may match display stack
    # 'GuestTools',                  # DISABLED: VM guest tools
    'UpdateDaemon','cmccchuanyun','Kingsoft','OpenClaw',
    # 'QtEasyTier',                  # DISABLED: cloud desktop network tunnel
    # 'Vmbooster','VmQoE',           # DISABLED: VM performance for streaming
    # 'qemu-ga',                     # DISABLED: QEMU guest agent
    # 'IceDisplay','IceInput','IceMain',  # DISABLED: display/input streaming (ICE stack)
    # 'MswitchWin',                  # DISABLED: display channel switching
    # 'Vault',                         # DISABLED: too broad; use Vault_drc instead
    'Vault_drc','metric-probe','sc-guard'
)
Kill-ProcessByPattern $vendorPatterns

# Disable vendor startup entries
$runKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
)
$vendorKw = 'SysGuard|CloudEDR|GuardAgent|pcagent|pcas|SoftwareStore|360|jyrepaire|venus|lingxi|UpdateDaemon|Kingsoft|OpenClaw|Vault_drc|Sysmon|metric-probe|sc-guard'
# $vendorKw = 'SysGuard|CloudEDR|Chuanyun|GuardAgent|pcagent|pcas|SoftwareStore|360|jyrepaire|venus|lingxi|UpdateDaemon|Kingsoft|OpenClaw|QtEasyTier|Vmbooster|MswitchWin|Vault|Sysmon'  # OLD: too broad, breaks desktop
foreach ($rk in $runKeys) {
    if (Test-Path $rk) {
        $props = Get-ItemProperty $rk -ErrorAction SilentlyContinue
        $props.PSObject.Properties | Where-Object { $_.Name -notmatch '^PS' } | ForEach-Object {
            if ($_.Value -match $vendorKw) {
                Remove-ItemProperty -Path $rk -Name $_.Name -Force
                Write-Log "Removed startup: $rk\$($_.Name)"
            }
        }
    }
}

# [6] Windows Update
Write-Log "--- [6/12] Windows Update ---"
Stop-AndDisableService @('wuauserv','UsoSvc','WaaSMedicSvc','BITS','dosvc')
Set-RegDword -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name 'NoAutoUpdate' -Value 1
Set-RegDword -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' -Name 'DisableWindowsUpdateAccess' -Value 1

# [7] BitLocker / Write Filter
Write-Log "--- [7/12] BitLocker / Write Filter ---"
try { manage-bde -off C: 2>&1 | Out-Null; Write-Log "BitLocker off C:" } catch {}
Set-RegDword -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE' -Name 'DisableDeviceEncryption' -Value 1
try { uwfmgr filter disable 2>&1 | Out-Null } catch {}
Stop-AndDisableService @('UWF','fbwf')

# [8] Credential Guard / Device Guard
Write-Log "--- [8/12] Credential Guard ---"
Set-RegDword -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard' -Name 'EnableVirtualizationBasedSecurity' -Value 0
Set-RegDword -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name 'LsaCfgFlags' -Value 0
Set-RegDword -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name 'RunAsPPL' -Value 0
Set-RegDword -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard' -Name 'EnableVirtualizationBasedSecurity' -Value 0

# [9] Audit / Telemetry / Event Logs
Write-Log "--- [9/12] Audit / Telemetry ---"
& auditpol.exe /set /category:* /success:disable /failure:disable 2>&1 | Out-Null
Set-RegDword -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection' -Name 'AllowTelemetry' -Value 0
$eventLogs = @('Security','Microsoft-Windows-Sysmon/Operational')
foreach ($log in $eventLogs) {
    try { wevtutil cl $log 2>&1 | Out-Null; wevtutil sl $log /e:false 2>&1 | Out-Null; Write-Log "Cleared log: $log" } catch {}
}

# [10] AppLocker / Remote restrictions
Write-Log "--- [10/12] AppLocker ---"
Stop-AndDisableService @('AppIDSvc','Appinfo')
Set-RegDword -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'LocalAccountTokenFilterPolicy' -Value 1
Set-RegDword -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications' -Name 'DisableNotifications' -Value 1

# [11] Scheduled Tasks
Write-Log "--- [11/12] Scheduled Tasks ---"
$taskPatterns = @('*Defender*','*Sysmon*','*PCAS*','*SoftwareStore*','*360*','*CloudEDR*','*SysGuard*','*Vault_drc*','*WindowsUpdate*','*metric-probe*')
# $taskPatterns = @('*Defender*','*Security*','*Sysmon*','*Chuanyun*','*Guard*','*PCAS*','*SoftwareStore*','*360*','*CloudEDR*','*SysGuard*','*Vault*','*WindowsUpdate*')  # OLD: *Guard*/*Chuanyun* may hit display tasks
foreach ($pat in $taskPatterns) {
    Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.TaskName -like $pat } | ForEach-Object {
        try { Disable-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -ErrorAction Stop | Out-Null; Write-Log "Disabled task: $($_.TaskName)" } catch {}
    }
}

# [12] Exploit Guard / Rename vendor binaries
Write-Log "--- [12/12] Exploit Guard / Vendor binaries ---"
Set-RegDword -Path 'HKLM:\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access' -Name 'EnableControlledFolderAccess' -Value 0
Set-RegDword -Path 'HKLM:\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection' -Name 'EnableNetworkProtection' -Value 0
Set-RegDword -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR' -Name 'ExploitGuard_ASR_Rules' -Value 0
Stop-AndDisableService @('SgrmBroker','SgrmAgent')

$vendorDirs = @(
    'C:\Program Files\SysGuard',
    'C:\Program Files\CloudEDR',
    'C:\Program Files\Chuanyun Vault Service',
    'C:\Program Files (x86)\SysGuard',
    'C:\Program Files (x86)\CloudEDR',
    'C:\Program Files (x86)\pcagent',
    'C:\Program Files (x86)\pcas',
    'C:\Program Files (x86)\softwarestore',
    'C:\Program Files (x86)\softwarestoredaemon',
    'C:\Program Files (x86)\jyrepaire',
    'C:\Program Files (x86)\venusgroup',
    'C:\Program Files (x86)\360',
    'C:\Program Files\360'
)
foreach ($dir in $vendorDirs) {
    if (Test-Path $dir) {
        Get-ChildItem $dir -Recurse -Include '*.exe','*.dll','*.sys' -ErrorAction SilentlyContinue | ForEach-Object {
            try {
                $newName = $_.FullName + '.disabled'
                if (-not (Test-Path $newName)) {
                    Rename-Item $_.FullName -NewName ($_.Name + '.disabled') -Force
                    Write-Log "Renamed: $($_.FullName)"
                }
            } catch { Write-Log "Cannot rename $($_.FullName)" 'WARN' }
        }
    }
}

# Final report - also check display stack is still alive
Write-Log "========== DONE: Status Report =========="
try {
    $mp = Get-MpComputerStatus -ErrorAction SilentlyContinue
    if ($mp) { Write-Log "Defender RT: $($mp.RealTimeProtectionEnabled)" }
} catch {}
try {
    Get-NetFirewallProfile | ForEach-Object { Write-Log "Firewall $($_.Name): $($_.Enabled)" }
} catch {}
$keyServices = @('WinDefend','mpssvc','Sysmon64','ChuanyunVault_drcService','GuardAgent','SoftwareStoreAgent','AppIDSvc','wscsvc')
foreach ($s in $keyServices) {
    $svc = Get-Service $s -ErrorAction SilentlyContinue
    if ($svc) { Write-Log "Service ${s}: $($svc.Status) / $($svc.StartType)" }
}
# Display stack health check (should all be Running)
$displayServices = @('IceDisplayService','IceInputService','IceMainService','IceTunnelService','qtet-daemon.sock','Vdservice','USBIP Client','sc-alive','MswitchWin')
foreach ($s in $displayServices) {
    $svc = Get-Service $s -ErrorAction SilentlyContinue
    if ($svc) {
        $level = if ($svc.Status -eq 'Running') { 'INFO' } else { 'WARN' }
        Write-Log "Display ${s}: $($svc.Status) / $($svc.StartType)" $level
    }
}
Write-Log "Log file: $LogFile"
Write-Log "REBOOT recommended for full effect"
Write-Host ""
Write-Host "========================================" -ForegroundColor Green
Write-Host " ALL SECURITY DISABLED - REBOOT NOW!" -ForegroundColor Green
Write-Host " Log: $LogFile" -ForegroundColor Yellow
Write-Host "========================================" -ForegroundColor Green

仅仅上面的脚本应该就足够了

恢复远程桌面投影服务

restore_desktop_services.ps1

bash 复制代码

#Requires -RunAsAdministrator
# Restore cloud desktop display/input/network services
# Run this if desktop or mouse stops working after disable_all_security.ps1

$ErrorActionPreference = 'SilentlyContinue'

function Write-Log { param([string]$Message)
    $line = "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] $Message"
    Write-Host $line
}

function Enable-AndStartService {
    param([string]$Name)
    $regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$Name"
    if (Test-Path $regPath) {
        Set-ItemProperty -Path $regPath -Name 'Start' -Value 2 -Force
        Write-Log "Registry Start=2 (Automatic): $Name"
    }
    $svc = Get-Service -Name $Name -ErrorAction SilentlyContinue
    if ($svc) {
        try {
            Set-Service -Name $Name -StartupType Automatic -ErrorAction Stop
            Start-Service -Name $Name -ErrorAction Stop
            Write-Log "Started: $Name"
        } catch {
            Write-Log "WARN start $Name : $_"
        }
    } else {
        Write-Log "Service not found: $Name"
    }
}

Write-Log "========== Restore Desktop Services =========="

# Display / input / audio streaming (ICE stack)
$iceServices = @(
    'IceDisplayService',
    'IceInputService',
    'IceMainService',
    'IceSoundService',
    'IceTunnelService'
)
foreach ($s in $iceServices) { Enable-AndStartService $s }

# Network tunnel for cloud desktop
Enable-AndStartService 'qtet-daemon.sock'

# VM display agent / QoE / boost
$vmServices = @(
    'Vdservice',
    'Vmbooster',
    'VmBoosterMonitor',
    'VmQoEAgent',
    'qemu-ga',
    'BalloonService',
    'MswitchWin'
)
foreach ($s in $vmServices) { Enable-AndStartService $s }

# USB / mouse keyboard redirection (Client only, NOT Guard)
Enable-AndStartService 'USBIP Client'

# Cloud session keepalive (needed to stay connected)
Enable-AndStartService 'sc-alive'

# Assistant (display helper on some images)
Enable-AndStartService 'AssistantService'

# Restart QtEasyTier app if present
$qtPaths = @(
    'C:\Program Files\QtEasyTier\appQtEasyTier.exe',
    'C:\Program Files (x86)\QtEasyTier\appQtEasyTier.exe'
)
foreach ($p in $qtPaths) {
    if (Test-Path $p) {
        Start-Process -FilePath $p -ErrorAction SilentlyContinue
        Write-Log "Launched: $p"
    }
}

Write-Log "========== Status =========="
$check = @(
    'IceDisplayService','IceInputService','IceMainService','IceTunnelService',
    'qtet-daemon.sock','Vdservice','Vmbooster','VmQoEAgent','USBIP Client',
    'qemu-ga','MswitchWin','sc-alive'
)
foreach ($s in $check) {
    $svc = Get-Service $s -ErrorAction SilentlyContinue
    if ($svc) { Write-Log "$s : $($svc.Status) / $($svc.StartType)" }
}

Write-Log "Done. If mouse still broken, reboot the VM from cloud console."

2. 给window 安全ssh服务，并临时创建一个用户

bash 复制代码

# 1. 强制启用 TLS 1.2
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

# 2. 从 gh-proxy.org 加速下载官方 OpenSSH Win64 发行包
$DownloadUrl = "https://gh-proxy.org/https://github.com/PowerShell/Win32-OpenSSH/releases/download/v9.5.0.0p1-Beta/OpenSSH-Win64.zip"
$ZipPath = "$env:TEMP\OpenSSH-Win64.zip"
$TargetDir = "C:\Program Files\OpenSSH"

Write-Host "正在通过 gh-proxy.org 下载 OpenSSH..." -ForegroundColor Cyan
Invoke-WebRequest -Uri $DownloadUrl -OutFile $ZipPath -UseBasicParsing

# 3. 解压并移动到系统标准目录
Write-Host "正在解压并部署文件..." -ForegroundColor Cyan
if (Test-Path $TargetDir) { Remove-Item -Path $TargetDir -Recurse -Force }
Expand-Archive -Path $ZipPath -DestinationPath "$env:TEMP\OpenSSH_Temp" -Force
Move-Item -Path "$env:TEMP\OpenSSH_Temp\OpenSSH-Win64" -Destination $TargetDir -Force
Remove-Item -Path "$env:TEMP\OpenSSH_Temp", $ZipPath -Recurse -Force

# 4. 注册并配置 SSHD 系统服务
Write-Host "正在注册 SSH 系统服务..." -ForegroundColor Cyan
Set-Location -Path $TargetDir
powershell.exe -ExecutionPolicy Bypass -File .\install-sshd.ps1

# 5. 配置并启动 sshd 与 ssh-agent 服务
Set-Service -Name sshd -StartupType 'Automatic'
Start-Service sshd
Set-Service -Name "ssh-agent" -StartupType 'Automatic'
Start-Service "ssh-agent"

# 6. 配置系统环境变量 PATH
$CurrentPath = [Environment]::GetEnvironmentVariable("Path", "Machine")
if ($CurrentPath -notlike "*$TargetDir*") {
    [Environment]::SetEnvironmentVariable("Path", "$CurrentPath;$TargetDir", "Machine")
}

# 7. 设置登录后的默认终端为 PowerShell
New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force | Out-Null

Write-Host "`n=== OpenSSH 安装并启动完成 ===" -ForegroundColor Green
Get-Service sshd | Select-Object Name, DisplayName, Status, StartType
Write-Host "`n连接方式: ssh sshadmin@<你的IP>" -ForegroundColor Yellow
Write-Host "密码: Admin@123456" -ForegroundColor Yellow

帐号: sshadmin

密码：Admin@123456

下载QTEasytier window的版本

https://qtet.cn/en/docs-home

点击有上角，下载安装。然后ssh登录，方便操作