This tutorial focuses on disabling windows features that can lead to you getting caught in a screen-share. This is not a 'How to bypass a screen-share' thread you can refer to Ryan's post for that.
Ryan's post: http://bit.ly/2zsvfLc
Stop windows storing data in the Compatibility Assistant\Store registry key.
1.) Press the windows key and R at the exact same time.
2.) Type services.msc
3.) Find the 'Program compatibility assistant service'.
4.) Right click on this service and under 'startup type' select disabled.
5.) Reboot your system.
You can find out if you did this correctly by going to the following registry key and checking if there are any new logs I suggest deleting all the current ones residing within this registry key.
Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store
Stop windows storing data in the user assist view registry key.
1.) Press the windows key and R at the exact same time.
2.) Type regedit.
3.) Navigate to the following registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
4.) right click on the UserAssist registry key then select 'New' then 'key' and rename the key you created to settings.
5.) Under this registry key create a new DWORD value rename this to NoLog.
6.) Double click the DWORD key and give it a value of '1'.
Stop windows storing data in prefetch.
1.) Press the windows key and R at the exact same time.
2.) Type regedit.
3.) Navigate to this registry key 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\Memory Management\PrefetchParameters'.
4.) Right-click on both EnablePrefetcher and EnableSuperfetch and choose modify on both of these and change the current value to 0.
Disabling memory compression.
1.) press your windows key and type in powershell right click on this and run it as administrator.
2.) Wait for the powershell to load and type the following command Disable-MMAgent -mc
Disabling MRU list's
1.) Press the windows key and R at the exact same time.
2.) type regedit
3.) Navigate to this registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
4.) Under this registry key create a new DWORD value rename this to
NoRecentDocsHistory.
5.) Right-click on the DWORD you just created 'NoRecentDocsHistory' and choose modify and change the current value to 1.
Disabling shell bags
1.) Press the windows key and R at the exact same time.
2.) type regedit.
3.) Navigate to this registry key.
HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell
5.) Under the Shell key you will find two subkeys 'Bags' and 'BagsMRU'. delete both of these.
6.) recreate the Bags subkey. Right click the Shell key and select 'New - Key'.
7.) Under the Bags sub-key you just created, create a new sub-key. Right click the Bags key and select "New - Key". Rename the new key to 'AllFolders'.
8.) Under the AllFolders key, create a new sub-key named Shell.
9.) Under the 'Shell' sub-key you created, create a new string value named FolderType and set it to NotSpecified.
Once you have done all this restart your system for the changes to take place.
Your system is now patched.
Ryan's post: http://bit.ly/2zsvfLc
Stop windows storing data in the Compatibility Assistant\Store registry key.
1.) Press the windows key and R at the exact same time.
2.) Type services.msc
3.) Find the 'Program compatibility assistant service'.
4.) Right click on this service and under 'startup type' select disabled.
5.) Reboot your system.
You can find out if you did this correctly by going to the following registry key and checking if there are any new logs I suggest deleting all the current ones residing within this registry key.
Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store
Stop windows storing data in the user assist view registry key.
1.) Press the windows key and R at the exact same time.
2.) Type regedit.
3.) Navigate to the following registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
4.) right click on the UserAssist registry key then select 'New' then 'key' and rename the key you created to settings.
5.) Under this registry key create a new DWORD value rename this to NoLog.
6.) Double click the DWORD key and give it a value of '1'.
Stop windows storing data in prefetch.
1.) Press the windows key and R at the exact same time.
2.) Type regedit.
3.) Navigate to this registry key 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\Memory Management\PrefetchParameters'.
4.) Right-click on both EnablePrefetcher and EnableSuperfetch and choose modify on both of these and change the current value to 0.
Disabling memory compression.
1.) press your windows key and type in powershell right click on this and run it as administrator.
2.) Wait for the powershell to load and type the following command Disable-MMAgent -mc
Disabling MRU list's
1.) Press the windows key and R at the exact same time.
2.) type regedit
3.) Navigate to this registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
4.) Under this registry key create a new DWORD value rename this to
NoRecentDocsHistory.
5.) Right-click on the DWORD you just created 'NoRecentDocsHistory' and choose modify and change the current value to 1.
Disabling shell bags
1.) Press the windows key and R at the exact same time.
2.) type regedit.
3.) Navigate to this registry key.
HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell
5.) Under the Shell key you will find two subkeys 'Bags' and 'BagsMRU'. delete both of these.
6.) recreate the Bags subkey. Right click the Shell key and select 'New - Key'.
7.) Under the Bags sub-key you just created, create a new sub-key. Right click the Bags key and select "New - Key". Rename the new key to 'AllFolders'.
8.) Under the AllFolders key, create a new sub-key named Shell.
9.) Under the 'Shell' sub-key you created, create a new string value named FolderType and set it to NotSpecified.
Once you have done all this restart your system for the changes to take place.
Your system is now patched.
Last edited:
