THIS IS NOT A BYPASSNRO SCRIPT

[andreaci]

This script does WAY more than bypassingNRO, that is not acceptable given the description of the repository.
This is borderline malicious and can lead to RCE.

[ioannedelea]

Actually it is and it's not malicious. This does not remove any package, as "C:\Windows\Setup\Scripts\RemovePackages.ps1" does not exist. Granted, Chris should remove that part altogether, but it doesn't do anything. I think what Chris did, was pull the xml from the microwin project and he forgot to edit those lines.

[andreaci]

the script creates the file and then executes it.
rows 111, 196, 258
multiple files:
C:\Windows\Setup\Scripts\RemoveCapabilities.ps1
C:\Windows\Setup\Scripts\RemovePackages.ps1
C:\Windows\Setup\Scripts\RemoveFeatures.ps1

[ioannedelea]

Oh, you're absolutely right. I missed the ExtractScript part. Good catch!

[Boxersteavee]

I'd argue it is malicious. It is never stated (to my knowledge) that it removes all of these apps and features, it's just advertised as a simple bypass script and nothing more.

Removing 40 windows apps, at least a 3rd of which I can see many users using daily, any disabling many features, without the user's knowledge or consent, IS in my eyes malicious, so I do see this script as malware.

[jeeneo]

Comprehensive Analysis: This is NOT Just a Bypass NRO Script

can we please not pollute this with AI slop? granted it may be correct as for the some of the scripts functions but that comment is unnecessarily long winded for something that can be said shorter

[mannotcool]

I don’t think it’s purposely malicious just heavily misleading. Probably needs to be renamed with a better readme and someone will probably (or has already) make a fork without the other changes.

[xnmrph]

It doesnt actually run those scripts, and it takes very little effort to actually test that

[andreaci]

RunSynchronousCommand wcm:action="add">
2
powershell.exe -WindowStyle Normal -NoProfile -Command "Get-Content -LiteralPath 'C:\Windows\Setup\Scripts\Specialize.ps1' -Raw | Invoke-Expression;"

And at line 317, specialize.PS1 runs these files

[xnmrph]

Ok so you have ran this and confirmed that it actually removes packages as one of the scripts say it does?

[Felitendo]

Hey, I've forked the repo and removed all of the "debloat" functionality. If you want, you can use my script in the meantime until this hopefully gets fixed, but always make sure to double check the code to verify there is nothing suspicious going on:
https://github.com/Felitendo/bypassnro

[therealturtlegod855]

he should at least allow you to in a window choose what he removes from your system...

[ethanjansen]

Sorry to necro, but this script does not actually debloat windows. If running from the OOBE, as instructed, only the "oobeSystem" pass and later sections of the unattend.xml will execute. This is because sysprep is used without the /generalize argument. FirstLogon.ps1 is still called, however it does not exist as it is created during the "specialize" pass (which does not run).

That said, the unattend.xml is unnecessarily complicated for what it is actually doing.