Cover Click to Do, Settings agent and Paint AI in the extended AI purge

CHANGELOG.md

@@ -4,6 +4,12 @@ Document all notable Winnow changes in this file. Releases before 4.0.0 were pub
 
 Follow [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Added
+
+- Extended AI purge now covers the AI features Microsoft added across the 24H2/25H2 cycle: Click to Do (`DisableClickToDo`), the agentic Settings search (`DisableSettingsAgent`), and the Paint AI features Cocreator, generative fill, and Image Creator (`DisableCocreator`, `DisableGenerativeFill`, `DisableImageCreator` under the Paint policy key). `DisableAIDataAnalysis` and `DisableClickToDo` are written in both HKLM and HKCU, matching their machine-and-user policy scope. The update watchdog re-asserts the two new machine-wide WindowsAI policies after an update. Registry paths and scopes are from the WindowsAI policy CSP. Not yet verified against a real 24H2/25H2 Copilot+ device; the values and rollback coverage are unit-tested.
+
 ## [4.2.3] - 2026-09-18
 
 ### Added

Scripts/Features/ExtendedAIPurge.ps1

@@ -76,13 +76,26 @@ function Disable-ExtendedAIPurge {
         Write-Host "  [OK] Cloud clipboard sync disabled"
     }
 
-    # 6. Disable Recall snapshot folder (Copilot+ PC)
-    if ($PSCmdlet.ShouldProcess("Registry", "Disable Recall")) {
+    # 6. Disable Recall, Click to Do and the Settings agent (WindowsAI policies).
+    # Per the WindowsAI policy CSP, DisableAIDataAnalysis and DisableClickToDo are
+    # both machine and user scoped, so set them in HKLM and HKCU; AllowRecallEnablement
+    # and DisableSettingsAgent are machine scoped only. Click to Do (screen analysis)
+    # and the agentic Settings search are 24H2/25H2 additions not covered before.
+    if ($PSCmdlet.ShouldProcess("Registry", "Disable Recall, Click to Do and Settings agent")) {
+        $windowsAiKeys = @(
+            "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI",
+            "HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI"
+        )
+        foreach ($aiKey in $windowsAiKeys) {
+            if (-not (Test-Path $aiKey)) { New-Item -Path $aiKey -Force | Out-Null }
+            Set-ItemProperty -Path $aiKey -Name "DisableAIDataAnalysis" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue
+            Set-ItemProperty -Path $aiKey -Name "DisableClickToDo" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue
+        }
+        # Machine-scoped only.
         $recallPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI"
-        if (-not (Test-Path $recallPath)) { New-Item -Path $recallPath -Force | Out-Null }
-        Set-ItemProperty -Path $recallPath -Name "DisableAIDataAnalysis" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue
         Set-ItemProperty -Path $recallPath -Name "AllowRecallEnablement" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue
-        Write-Host "  [OK] Windows Recall snapshots fully disabled"
+        Set-ItemProperty -Path $recallPath -Name "DisableSettingsAgent" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue
+        Write-Host "  [OK] Recall snapshots, Click to Do and Settings agent disabled"
     }
 
     # 6b. Remove the Recall optional component where present. Since KB5041865
@@ -164,6 +177,18 @@ function Disable-ExtendedAIPurge {
         Write-Host "  [OK] Narrator AI online voices disabled"
     }
 
+    # 14. Disable the Paint AI features (Cocreator, generative fill, Image Creator).
+    # These are the documented WindowsAI/Paint policies at the Paint policy key,
+    # separate from the Photos generative-fill key handled in step 7.
+    if ($PSCmdlet.ShouldProcess("Registry", "Disable Paint AI features")) {
+        $paintPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Paint"
+        if (-not (Test-Path $paintPath)) { New-Item -Path $paintPath -Force | Out-Null }
+        Set-ItemProperty -Path $paintPath -Name "DisableCocreator" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue
+        Set-ItemProperty -Path $paintPath -Name "DisableGenerativeFill" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue
+        Set-ItemProperty -Path $paintPath -Name "DisableImageCreator" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue
+        Write-Host "  [OK] Paint AI features (Cocreator, generative fill, Image Creator) disabled"
+    }
+
     Write-Host ""
     Write-Host "Extended AI purge complete." -ForegroundColor Green
     Write-Host ""
@@ -205,8 +230,15 @@ function Get-ExtendedAIPurgeRegistryTargets {
         @{ Path = 'HKCU:\Software\Microsoft\Clipboard'; Name = 'EnableCloudClipboard' }
         @{ Path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System'; Name = 'AllowCrossDeviceClipboard' }
         @{ Path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI'; Name = 'DisableAIDataAnalysis' }
+        @{ Path = 'HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI'; Name = 'DisableAIDataAnalysis' }
+        @{ Path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI'; Name = 'DisableClickToDo' }
+        @{ Path = 'HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI'; Name = 'DisableClickToDo' }
         @{ Path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI'; Name = 'AllowRecallEnablement' }
+        @{ Path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI'; Name = 'DisableSettingsAgent' }
         @{ Path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Photos'; Name = 'DisableGenerativeFill' }
+        @{ Path = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Paint'; Name = 'DisableCocreator' }
+        @{ Path = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Paint'; Name = 'DisableGenerativeFill' }
+        @{ Path = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Paint'; Name = 'DisableImageCreator' }
         @{ Path = 'HKCU:\Software\Microsoft\Clipboard'; Name = 'EnableSuggestedClipboardActions' }
         @{ Path = 'HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\Common'; Name = 'PreventProductInstall' }
         @{ Path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot'; Name = 'TurnOffWindowsCopilot' }

Scripts/Watchdog/WatchdogPayload.ps1

@@ -141,6 +141,8 @@ function Get-WinnowWatchdogDesiredState {
             @{ Path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot'; Name = 'TurnOffWindowsCopilot'; Value = 1 }
             @{ Path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI'; Name = 'DisableAIDataAnalysis'; Value = 1 }
             @{ Path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI'; Name = 'AllowRecallEnablement'; Value = 0 }
+            @{ Path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI'; Name = 'DisableClickToDo'; Value = 1 }
+            @{ Path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI'; Name = 'DisableSettingsAgent'; Value = 1 }
             @{ Path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Photos'; Name = 'DisableGenerativeFill'; Value = 1 }
             @{ Path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System'; Name = 'AllowCrossDeviceClipboard'; Value = 0 }
             @{ Path = 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace'; Name = 'AllowWindowsInkWorkspace'; Value = 0 }

Tests/Unit/Test-ModuleRollback.ps1

@@ -227,6 +227,20 @@ Describe 'Module registry targets' {
         $names = @((Get-ExtendedAIPurgeRegistryTargets).Name)
         $names | Should -Contain 'TurnOffWindowsCopilot'
         $names | Should -Contain 'AllowRecallEnablement'
+        # 24H2/25H2 additions.
+        $names | Should -Contain 'DisableClickToDo'
+        $names | Should -Contain 'DisableSettingsAgent'
+        $names | Should -Contain 'DisableCocreator'
+        $names | Should -Contain 'DisableImageCreator'
+    }
+
+    It 'ExtendedAIPurge declares both scopes for the user-and-machine AI policies' {
+        $targets = @(Get-ExtendedAIPurgeRegistryTargets)
+        $clickToDo = @($targets | Where-Object { $_.Name -eq 'DisableClickToDo' })
+        ($clickToDo | Where-Object { $_.Path -like 'HKLM:*' }) | Should -Not -BeNullOrEmpty
+        ($clickToDo | Where-Object { $_.Path -like 'HKCU:*' }) | Should -Not -BeNullOrEmpty
+        $paint = @($targets | Where-Object { $_.Path -like '*\Policies\Paint' -and $_.Name -eq 'DisableGenerativeFill' })
+        $paint | Should -Not -BeNullOrEmpty
     }
 
     It 'every Set-ItemProperty name in each module is declared by its provider (drift guard)' {

Tests/Unit/Test-UpdateWatchdog.ps1

@@ -90,6 +90,8 @@ Describe 'Winnow update watchdog desired-state floor' {
         $names | Should -Contain 'AllowTelemetry'
         $names | Should -Contain 'TurnOffWindowsCopilot'
         $names | Should -Contain 'DisableAIDataAnalysis'
+        $names | Should -Contain 'DisableClickToDo'
+        $names | Should -Contain 'DisableSettingsAgent'
     }
 }