Disable Parental Controls on Windows 10/11 Batch Script

ImAnOrphan.bat

@echo off
set "params=%*"
cd /d "%~dp0" && ( if exist "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs" ) && fsutil dirty query %systemdrive% 1>nul 2>nul || (  echo Set UAC = CreateObject^("Shell.Application"^) : UAC.ShellExecute "cmd.exe", "/k cd ""%~sdp0"" && %~s0 %params%", "", "runas", 1 >> "%temp%\getadmin.vbs" && "%temp%\getadmin.vbs" && exit /B )

echo This script completley removes Parental Controls from Windows 10 / 11
echo Press any key to disable parental controls

pause>nul

echo Blocking parental controls server ...

echo # Disable parental controls >> %WINDIR%\System32\drivers\etc\hosts
echo 0.0.0.0 rs3clients.timeusage.family.microsoft.com >> %WINDIR%\System32\drivers\etc\hosts
echo 0.0.0.0 clientfd.family.microsoft.com >> %WINDIR%\System32\drivers\etc\hosts
echo 0.0.0.0 family.microsoft.com >> %WINDIR%\System32\drivers\etc\hosts

echo Disabling parental controls service..

sc stop WpcMonSvc
sc config WpcMonSvc start= disabled

echo Deleting parental controls service...

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WpcMonSvc" /f

echo Deleting WpcDesktopMonSvc.dll ...

takeown /f %WINDIR%\System32\WpcDesktopMonSvc.dll
cacls %WINDIR%\System32\WpcDesktopMonSvc.dll /e /p %USERNAME%:F
del %WINDIR%\System32\WpcDesktopMonSvc.dll /Q /F

echo Deleting cached Parental Control Settings in ProgramData ...

takeown /f "%PROGRAMDATA%\Microsoft\Windows\Parental Controls"
cacls "%PROGRAMDATA%\Microsoft\Windows\Parental Controls" /e /p %USERNAME%:F
del "%PROGRAMDATA%\Microsoft\Windows\Parental Controls" /S /Q /F
rd "%PROGRAMDATA%\Microsoft\Windows\Parental Controls" /S /Q

echo Deleting cached Parental Control Settings in Registry ...
powershell -noprofile -noninteractive -command "function Take-Permissions { param($rootKey, $key, [System.Security.Principal.SecurityIdentifier]$sid = 'S-1-5-32-545', $recurse = $true); switch -regex ($rootKey) { 'HKCU|HKEY_CURRENT_USER'    { $rootKey = 'CurrentUser' } 'HKLM|HKEY_LOCAL_MACHINE'   { $rootKey = 'LocalMachine' } 'HKCR|HKEY_CLASSES_ROOT'    { $rootKey = 'ClassesRoot' } 'HKCC|HKEY_CURRENT_CONFIG'  { $rootKey = 'CurrentConfig' } 'HKU|HKEY_USERS'            { $rootKey = 'Users' } }; $import = '[DllImport(\"ntdll.dll\")] public static extern int RtlAdjustPrivilege(ulong a, bool b, bool c, ref bool d);'; $ntdll = Add-Type -Member $import -Name NtDll -PassThru; $privileges = @{ SeTakeOwnership = 9; SeBackup =  17; SeRestore = 18 }; foreach ($i in $privileges.Values) { $null = $ntdll::RtlAdjustPrivilege($i, 1, 0, [ref]0) }; function Take-KeyPermissions { param($rootKey, $key, $sid, $recurse, $recurseLevel = 0); $regKey = [Microsoft.Win32.Registry]::$rootKey.OpenSubKey($key, 'ReadWriteSubTree', 'TakeOwnership'); $acl = New-Object System.Security.AccessControl.RegistrySecurity; $acl.SetOwner($sid); $regKey.SetAccessControl($acl); $acl.SetAccessRuleProtection($false, $false); $regKey.SetAccessControl($acl); if ($recurseLevel -eq 0) { $regKey = $regKey.OpenSubKey('', 'ReadWriteSubTree', 'ChangePermissions'); $rule = New-Object System.Security.AccessControl.RegistryAccessRule($sid, 'FullControl', 'ContainerInherit', 'None', 'Allow'); $acl.ResetAccessRule($rule); $regKey.SetAccessControl($acl); }; if ($recurse) { foreach($subKey in $regKey.OpenSubKey('').GetSubKeyNames()) { Take-KeyPermissions $rootKey ($key+'\'+$subKey) $sid $recurse ($recurseLevel+1); } }; }; Take-KeyPermissions $rootKey $key $sid $recurse; };Take-Permissions 'HKLM' 'SOFTWARE\Microsoft\Windows\CurrentVersion\Parental Controls' 'S-1-5-32-544' $true;"
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Parental Controls" /f


echo Done! ..
pause>nul

it was a virus
…
On Sat, 15 Feb 2025 at 23:13, TheDolphinCoder11 @.> wrote: @.* commented on this gist. ------------------------------ This is the program that had 3 trogan horses This batch file killed my laptop Fuck you LiEnby could you please point to the part of the script that is the 'trojan' part i mean its a batch file something like that would be kind of impossible to hide. fair enough tbh, that guy must be a hater cause uhh i don't see any external links. and what you said. — Reply to this email directly, view it on GitHub https://gist.github.com/LiEnby/b95ffb5e2830aada2fa33d6cba6bd70a#gistcomment-5440862 or unsubscribe https://github.com/notifications/unsubscribe-auth/BKSBDWTC3VPJNSN6HVFOLUD2P7C2FBFKMF2HI4TJMJ2XIZLTSKBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJDHNFZXJJDOMFWWLK3UNBZGKYLEL52HS4DFVRZXKYTKMVRXIX3UPFYGLK2HNFZXIQ3PNVWWK3TUUZ2G64DJMNZZDAVEOR4XAZNEM5UXG5FFOZQWY5LFVEYTCOBRG4YTKOBVU52HE2LHM5SXFJTDOJSWC5DF . You are receiving this email because you commented on the thread. Triage notifications on the go with GitHub Mobile for iOS https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Android https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub .

hi there, I don't think you know what you are saying. it is a bat file. As you can see, there is nothing malicious going on there. All it does is it changes a few things in the system registry. It might get flagged by Windows Antivirus for trying to change things in the registry, but other than that, no. It will not infect your system. So next time, do your research before accusing someone of trying to spread a virus

This is a very messy script but its not a virus, i could see how people could assume so but its isnt,

This is a very messy script but its not a virus, i could see how people could assume so but its isnt,

is it possible to write batch code that isn't messy..? let alone powershell?