@echo off

:: For unattended mode, run the script with /u parameter.






::========================================================================================================================================

: =================================================================
:  This script is a part of 'Microsoft Activation Scripts'
:  Maintained by @WindowsAddict
:  Homepage - https://www.nsaneforums.com/topic/316668--/
: =================================================================

::========================================================================================================================================


















::========================================================================================================================================

title Unprotect KMS38 Activation
if /i "%*" EQU "/u" (set Unattended=1) else (set Unattended=0)
for /f "tokens=6 delims=[]. " %%G in ('ver') do set winbuild=%%G
set "nul=>nul 2>&1"
set "ELine=echo. &call :Color 4F "==== ERROR ====" &echo:&echo."
set line=__________________________________________________________________________________________________
setlocal EnableDelayedExpansion
call :Color_Pre

::========================================================================================================================================

: ===========================================================
:  Check if the file path name contains special characters
:  https://stackoverflow.com/a/33626625
:  Written by @jeb (stackoverflow)
:  Thanks to @abbodi1406 (MDL) for the help.
: ===========================================================

setlocal
setlocal DisableDelayedExpansion
set "param=%~f0"
cmd /v:on /c echo(^^!param^^!| findstr /R "[| ` ~ ! @ %% \^ & ( ) \[ \] { } + = ; ' , |]*^"
endlocal
if %errorlevel% EQU 0 (
%ELine%
echo Disallowed special characters detected in file path name.
echo Make sure file path name do not have following special characters,
echo ^` ^~ ^! ^@ %% ^^ ^& ^( ^) [ ] { } ^+ ^= ^; ^' ^,
goto Done
)

::========================================================================================================================================

if %winbuild% LSS 10586 (
%ELine%
echo Unsupported OS version Detected.
echo Project is supported only for Windows 10 1511 [10586] and later builds.
goto Done
)

::========================================================================================================================================

: ================================================
:  Self-elevate passing args and preventing loop
:  Written by @AveYo aka @BAU
: ================================================

reg query HKEY_USERS\S-1-5-20 1>nul 2>nul && goto GotPrivileges
If "%ElevError%"=="Y" goto Elev_Err
set "args="%~f0" %*" & call set "args=%%args:"=\"%%"
echo Initializing...
powershell -c "start cmd -ArgumentList '/c set ElevError=Y& call %args%' -verb runas" && exit /b

:Elev_Err
%ELine%
echo Right click on this file and select 'Run as administrator'
goto Done

:GotPrivileges

::========================================================================================================================================

mode con: cols=98 lines=30
if %Unattended% EQU 1 goto Unprotect

cls
echo %line%
echo.
echo  Do you want to unprotect ^(set to default^) KMS38 Activation?
echo.
echo  Note - Activate Windows with KMS ^(if needed^) AFTER this process.
echo.
echo %line%
echo.
choice /C:UE /N /M "[U] Unprotect [E] Exit : "

if errorlevel 2 exit /b
if errorlevel 1 goto Unprotect

::========================================================================================================================================

:Unprotect

cls
set "SPPk=SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform"
reg query "HKLM\%SPPk%\55c92734-d682-4d71-983e-d6ec3f16059f" %nul% && (set exist_=1)

if defined exist_ (
call :reg_takeownership "HKLM\%SPPk%\55c92734-d682-4d71-983e-d6ec3f16059f" S-1-5-32-544 FullControl Allow recursive %nul%
cls
reg delete "HKLM\%SPPk%\55c92734-d682-4d71-983e-d6ec3f16059f" /f %nul%
reg delete "HKU\S-1-5-20\%SPPk%\55c92734-d682-4d71-983e-d6ec3f16059f" /f %nul%
)
reg query "HKLM\%SPPk%\55c92734-d682-4d71-983e-d6ec3f16059f" %nul% && (
%ELine%
echo Registry Key was not cleared successfully. Aborting...
goto Done
)

cls
echo %line%
echo.
if defined exist_ (
echo Registry item deleted successfully.
echo HKLM\%SPPk%\55c92734-d682-4d71-983e-d6ec3f16059f
echo.
call :Color 2F "KMS38 Activation is now unprotected [set to default]" &echo:
) else (
call :Color 2F "It's already unprotected [set to default]" &echo:
)
echo.
echo %line%

::========================================================================================================================================

:Done
echo.
if %Unattended% EQU 1 (
echo Exiting in 5 seconds...
if %winbuild% LSS 7600 (ping -n 5 127.0.0.1 > nul) else (timeout /t 5)
exit /b
)
echo Press any key to exit...
pause >nul
exit /b

::========================================================================================================================================

: ======================================================
:  Multicolor outputs without any external programs
:  https://stackoverflow.com/a/5344911
:  Written by @jeb (stackoverflow)
: ======================================================

:Color_Pre
for /F "tokens=1,2 delims=#" %%a in ('"prompt #$H#$E# & echo on & for %%b in (1) do rem"') do (set "DEL=%%a") &exit /b

:color
pushd "%temp%"
<nul set /p ".=%DEL%" > "%~2" &findstr /v /a:%1 /R "^$" "%~2" nul &del "%~2" > nul 2>&1 &popd &exit /b

::========================================================================================================================================

: ================================
:  Reg_takeownership snippet
:  pastebin.com/XTPt0JSC
:  Written by @AveYo aka @BAU
: ================================

:reg_takeownership 1:key[ex:"HKCU\Console"] 2:sid[def:S-1-5-32-544] 3:perm[def:FullControl] 4:allow[def:Allow] 4:rcsv[def:""]
set "s10=$ErrorActionPreference='silentlycontinue'; $rcsv=($recursive -ne ''); $rk=$regkey -split '\\\\',2; $key=$rk[1];"
set "s11=switch -regex ($rk[0]) { '[mM]'{$HK='LocalMachine'};'[uU]'{$HK='CurrentUser'}; default {$HK='ClassesRoot'}; }; $HK; $key;"
set "s12=if($sid -eq ''){$sid='S-1-5-32-544'}; [System.Security.Principal.SecurityIdentifier]$own=$sid;"  
set "s13=$dll0='[DllImport(''ntdll.dll'')]public static extern int RtlAdjustPrivilege(ulong a,bool b,bool c,ref bool d);'; $ntdll="
set "s14=Add-Type -Member $dll0 -Name NtDll -PassThru; foreach($i in @(9,17,18)){$null=$ntdll::RtlAdjustPrivilege($i,1,0,[ref]0)};"
set "s15=function Reg_TakeOwnership { param($hive, $key, $own, $perm='FullControl', $allow='Allow', $rcsv=$false);"
set "s16= $reg=[Microsoft.Win32.Registry]::$hive.OpenSubKey($key,'ReadWriteSubTree','TakeOwnership');$acl=$reg.GetAccessControl();"
set "s17= $acl.SetOwner($own); $acl.SetAccessRuleProtection($false,$false); $reg.SetAccessControl($acl);"
set "s18= $reg=$reg.OpenSubKey('','ReadWriteSubTree','ChangePermissions'); $rule=0,0; $x='Deny',$allow; for($i=0;$i -le 2;$i++){"
set "s19=    $rule[$i]=New-Object System.Security.AccessControl.RegistryAccessRule($own,$perm,'ContainerInherit','None',$x[$i])};"
set "s20= $acl.RemoveAccessRuleSpecific($rule[0]);$acl.ResetAccessRule($rule[1]);$reg.SetAccessControl($acl);$acl|fl;"
set "s21=} Reg_TakeOwnership $HK $key $own $perm $allow $true; if($rcsv){ $r=[Microsoft.Win32.Registry]::$HK.OpenSubKey($key);"
set "s22= foreach($sk in $r.GetSubKeyNames()){$sk; try{ Reg_TakeOwnership $HK $($key+'\\'+$sk) $own $perm $allow }catch{} }}"
setlocal & for /l %%# in (10,1,22) do call set "ps_RegTakeOwnership=%%ps_RegTakeOwnership%%%%s%%#:'=\"%%"
powershell.exe -c " $regkey='%~1';$sid='%~2';$perm='%~3';$allow='%~4';$recursive='%~5'; %ps_RegTakeOwnership%;"
endlocal & exit/b      pastebin.com/XTPt0JSC       AveYo: call :reg_takeownership "HKLM\MyKey" S-1-5-18 FullControl Allow recursive

::========================================================================================================================================