GeezerVison

param(
    [Parameter(Mandatory)] [string] $CollectorPsd1,
    [Parameter(Mandatory)] [string] $OutDir
)

$ErrorActionPreference = 'Stop'

# Stock Windows PATH only, so per-user and third-party executables stay out of NativeCommands
$env:PATH = @(
    "$env:SystemRoot\system32"
    "$env:SystemRoot"
    "$env:SystemRoot\System32\Wbem"
    "$env:SystemRoot\System32\WindowsPowerShell\v1.0\"
    "$env:SystemRoot\System32\OpenSSH\"
    # A portable (zip) PowerShell is not on a stock PATH, and its location would leak into the profile
    if ($PSHOME.StartsWith($env:ProgramFiles, 'OrdinalIgnoreCase')) { $PSHOME }
) -join ';'

$sys32Modules = "$env:SystemRoot\System32\WindowsPowerShell\v1.0\Modules"
$pfWinPSModules = "$env:ProgramFiles\WindowsPowerShell\Modules"
$stockPfModules = 'PackageManagement', 'PowerShellGet', 'Pester', 'PSReadLine', 'Microsoft.PowerShell.Operation.Validation'

# Modules from RSAT, Hyper-V/Containers and other optional features that a stock Windows 11 install does not have
$nonStockSys32Modules = @(
    'ActiveDirectory', 'BestPractices', 'GroupPolicy', 'RemoteDesktop', 'ServerManager', 'ServerManagerTasks',
    'IscsiTarget', 'NFS', 'Microsoft.ReFsDedup.Commands', 'HgsClient', 'HgsDiagnostics',
    'Hyper-V', 'VMDirectStorage', 'HostComputeService', 'HostNetworkingService'
)

$exclude = @(
    Join-Path ([Environment]::GetFolderPath('MyDocuments')) 'PowerShell'
    Join-Path ([Environment]::GetFolderPath('MyDocuments')) 'WindowsPowerShell'
    "$env:ProgramFiles\PowerShell\Modules"
    Split-Path -Parent (Split-Path -Parent $CollectorPsd1)
)
$exclude += $nonStockSys32Modules | ForEach-Object { Join-Path $sys32Modules $_ }
$exclude += Get-ChildItem $pfWinPSModules -Directory | Where-Object Name -notin $stockPfModules | ForEach-Object FullName

Import-Module $CollectorPsd1

$name = Get-PSCompatibilityPlatformName
$outFile = Join-Path $OutDir "$name.json"
Write-Host "Profile name: $name"
Write-Host "Excluded module path prefixes:"
$exclude | ForEach-Object { Write-Host "  $_" }

New-PSCompatibilityProfile -OutFile $outFile -ExcludeModulePathPrefix $exclude -Validate -WarningAction Continue

# Native commands come from System32, which also holds executables from drivers, OEM tools, RSAT,
# Hyper-V/Containers and other optional features. Drop those so only stock Windows 11 commands remain.
$nonStockNativeCommands = @(
    # Not signed as part of Windows: drivers, OEM utilities and third-party software
    'DbxSvc.exe', 'EEURestart.exe', 'GigabyteDownloadAssistant.exe', 'GigabyteUpdateService.exe', 'KOBDrvAPIW64.EXE',
    'MCU.exe', 'NpcapHelper.exe', 'NvContainerRecovery.bat', 'RtkAudUService64.exe', 'WlanHelper.exe', 'amdlogum.exe',
    'app-refresh-reset.bat', 'app-upgrade-reset.bat', 'appverif.exe', 'atieah64.exe', 'atieclxx.exe', 'clinfo.exe',
    'dgtrayicon.exe', 'dns-sd.exe', 'microsoft.windows.softwarelogo.showdesktop.exe', 'nvdebugdump.exe',
    'nvidia-pcc.exe', 'nvidia-smi.exe', 'pwNative.exe', 'py.exe', 'pyw.exe', 'vsjitdebugger.exe',
    'vulkaninfo-1-999-0-0-0.exe', 'vulkaninfo.exe', 'wpbbin.exe', 'xgamecontrol.exe', 'xgamehelper.exe'
    # RSAT: AD DS, Group Policy and Server Manager tools
    'adsiedit.msc', 'csvde.exe', 'dcdiag.exe', 'domain.msc', 'dsa.msc', 'dsac.exe', 'dsacls.exe', 'dsadd.exe',
    'dsdbutil.exe', 'dsget.exe', 'dsmgmt.exe', 'dsmod.exe', 'dsmove.exe', 'dsquery.exe', 'dsrm.exe', 'dssite.msc',
    'gpfixup.exe', 'gpmc.msc', 'gpme.msc', 'gptedit.msc', 'ISM.exe', 'ldifde.exe', 'ldp.exe', 'mtedit.exe',
    'ntdsutil.exe', 'redircmp.exe', 'redirusr.exe', 'rendom.exe', 'repadmin.exe', 'netdom.exe', 'ServerManager.exe',
    'LbfoAdmin.exe'
    # Hyper-V and Containers
    'CCG.exe', 'hcsdiag.exe', 'hnsdiag.exe', 'hvc.exe', 'nmbind.exe', 'nmscrub.exe', 'nvspinfo.exe', 'vfpctrl.exe',
    'virtmgmt.msc', 'vmcompute.exe', 'vmconnect.exe', 'vmms.exe', 'vmplatformca.exe', 'vmsp.exe', 'vmwp.exe'
    # Graphics Tools optional feature, and ReFS dedup (matches the excluded module)
    'DXCap.exe', 'DXCpl.exe', 'd3dconfig.exe', 'VsGraphicsDesktopEngine.exe', 'VsGraphicsRemoteEngine.exe',
    'ReFsDedupSvc.exe'
)
# Round-trip through the collector's own serializer so the file format is unchanged
$serializer = [Microsoft.PowerShell.CrossCompatibility.Retrieval.JsonProfileSerializer]::Create()
$profileData = $serializer.DeserializeFromFile([string]$outFile)
$removed = foreach ($c in $nonStockNativeCommands) { if ($profileData.Runtime.NativeCommands.Remove($c)) { $c } }
Write-Host "Removed $(@($removed).Count) non-stock native commands"

$serializer.SerializeToFile($profileData, [string]$outFile)
Get-Item $outFile