ServerFirstRun.ps1

Write-Host '==> Stopping Server Manager if running...' -ForegroundColor Cyan
Stop-Process -Name ServerManager -Force -ErrorAction SilentlyContinue

Write-Host '==> Configuring Edge policies for server use...' -ForegroundColor Cyan
# Set Policies to make Edge more suitable for server use
$EdgePolicyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Edge'
if (-not (Test-Path $EdgePolicyPath)) { New-Item -Path $EdgePolicyPath -Force | Out-Null }

# Allow feature recommendations and browser assistance notifications > Disabled
Set-ItemProperty -Path $EdgePolicyPath -Name 'ShowRecommendationsEnabled' -Type DWord -Value 0
Set-ItemProperty -Path $EdgePolicyPath -Name 'AutoImportAtFirstRun' -Type DWord -Value 4
Set-ItemProperty -Path $EdgePolicyPath -Name 'BrowserSignin' -Type DWord -Value 0
Set-ItemProperty -Path $EdgePolicyPath -Name 'BackgroundModeEnabled' -Type DWord -Value 0
Set-ItemProperty -Path $EdgePolicyPath -Name 'ExperimentationAndConfigurationServiceControl' -Type DWord -Value 0
Set-ItemProperty -Path $EdgePolicyPath -Name 'SyncDisabled' -Type DWord -Value 1
Set-ItemProperty -Path $EdgePolicyPath -Name 'NetworkPredictionOptions' -Type DWord -Value 2
Set-ItemProperty -Path $EdgePolicyPath -Name 'HideFirstRunExperience' -Type DWord -Value 1
Set-ItemProperty -Path $EdgePolicyPath -Name 'HideInternetExplorerRedirectUXForIncompatibleSitesEnabled' -Type DWord -Value 1
Set-ItemProperty -Path $EdgePolicyPath -Name 'StartupBoostEnabled' -Type DWord -Value 0
Set-ItemProperty -Path $EdgePolicyPath -Name 'RestoreOnStartup' -Type DWord -Value 5
Set-ItemProperty -Path $EdgePolicyPath -Name 'NewTabPageContentEnabled' -Type DWord -Value 0
Set-ItemProperty -Path $EdgePolicyPath -Name 'NewTabPageLocation' -Type String -Value 'about:blank'

Write-Host '==> Disabling Server Manager pop-up at logon and launch...' -ForegroundColor Cyan
# Disable Server Manager pop-up at logon and launch
if (-not (Test-Path 'HKLM:\SOFTWARE\Microsoft\ServerManager')) {
    New-Item -Path 'HKLM:\SOFTWARE\Microsoft\ServerManager' | Out-Null
}
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\ServerManager' -Name 'DoNotPopWACConsoleAtSMLaunch' -Value 1 -Type DWord

if (-not (Test-Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Server\ServerManager')) {
    New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Server\ServerManager' -Force | Out-Null
}
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Server\ServerManager' -Name 'DoNotOpenAtLogon' -Value 1 -Type DWord

Write-Host '==> Applying Explorer taskbar and file extension settings...' -ForegroundColor Cyan
$ExplorerAdvPath = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced'
if (-not (Test-Path $ExplorerAdvPath)) { New-Item -Path $ExplorerAdvPath -Force | Out-Null }
Set-ItemProperty -Path $ExplorerAdvPath -Name 'TaskbarAl' -Type DWord -Value 0
Set-ItemProperty -Path $ExplorerAdvPath -Name 'HideFileExt' -Type DWord -Value 0

Write-Host '==> Restarting Explorer...' -ForegroundColor Cyan
# Restart Explorer so the taskbar/registry changes take effect
Stop-Process -Name explorer -Force -ErrorAction SilentlyContinue
# Start-Process explorer.exe

Write-Host '==> Checking OS version...' -ForegroundColor Cyan
# Windows Server 2025 is build 26100; ProductType 1 = client, anything else = server
$OsInfo = Get-CimInstance -ClassName Win32_OperatingSystem
$IsServer2025OrLater = ($OsInfo.ProductType -ne 1) -and ([int]$OsInfo.BuildNumber -ge 26100)

if (-not $IsServer2025OrLater) {
    Write-Host '==> OS is not Windows Server 2025 or later; skipping winget and Evergreen app installs.' -ForegroundColor Yellow
}
else {
    Write-Host '==> Installing applications via winget...' -ForegroundColor Cyan
    winget install -e aria2.aria2 --accept-package-agreements --accept-source-agreements --source winget --scope machine
    winget install -e Notepad++.Notepad++ --accept-package-agreements --accept-source-agreements --source winget
    winget install -e Microsoft.VisualStudioCode --accept-package-agreements --accept-source-agreements --source winget
    # winget install -e Microsoft.Sysinternals.Suite --accept-package-agreements --accept-source-agreements

    Write-Host '==> Preparing download staging directory...' -ForegroundColor Cyan
    $StagingDir = Join-Path $Env:TEMP 'ServerFirstRun'
    if (-not (Test-Path $StagingDir)) { New-Item -Path $StagingDir -ItemType Directory | Out-Null }

    # Return the download URL of the first latest-release asset matching a name pattern
    function Get-GitHubLatestAsset {
        param(
            [Parameter(Mandatory)][string]$Repo,
            [Parameter(Mandatory)][string]$AssetPattern
        )
        $release = Invoke-RestMethod -Uri "https://api.github.com/repos/$Repo/releases/latest" -Headers @{ 'User-Agent' = 'ServerFirstRun' }
        ($release.assets | Where-Object { $_.name -like $AssetPattern } | Select-Object -First 1).browser_download_url
    }

    Write-Host '==> Downloading and installing Notepad++ from GitHub...' -ForegroundColor Cyan
    $NppUri = Get-GitHubLatestAsset -Repo 'notepad-plus-plus/notepad-plus-plus' -AssetPattern '*Installer.x64.exe'
    $NppInstaller = Split-Path -Path $NppUri -Leaf
    $InstallerPath = Join-Path $StagingDir $NppInstaller
    & 'C:\Program Files\WinGet\Links\aria2c.exe' -d $StagingDir -o $NppInstaller $NppUri

    Start-Process -FilePath $InstallerPath -ArgumentList "/S" -Wait

    Write-Host '==> Downloading and installing 7-Zip from GitHub...' -ForegroundColor Cyan
    $7zUri = Get-GitHubLatestAsset -Repo 'ip7z/7zip' -AssetPattern '7z*-x64.exe'
    $7zInstaller = Split-Path -Path $7zUri -Leaf
    $InstallerPath = Join-Path $StagingDir $7zInstaller
    & 'C:\Program Files\WinGet\Links\aria2c.exe' -d $StagingDir -o $7zInstaller $7zUri

    Start-Process -FilePath $InstallerPath -ArgumentList "/S" -Wait

    Write-Host '==> Downloading and installing latest LTS PowerShell from GitHub...' -ForegroundColor Cyan
    # buildinfo-lts resolves the current LTS (non-preview) release tag, e.g. v7.4.6
    $PwshTag = (Invoke-RestMethod -Uri 'https://aka.ms/pwsh-buildinfo-lts').ReleaseTag
    $PwshRelease = Invoke-RestMethod -Uri "https://api.github.com/repos/PowerShell/PowerShell/releases/tags/$PwshTag" -Headers @{ 'User-Agent' = 'ServerFirstRun' }
    $PwshMsiUri = ($PwshRelease.assets | Where-Object { $_.name -like '*win-x64.msi' } | Select-Object -First 1).browser_download_url
    $PwshMsi = Split-Path -Path $PwshMsiUri -Leaf
    $PwshMsiPath = Join-Path $StagingDir $PwshMsi
    & 'C:\Program Files\WinGet\Links\aria2c.exe' -d $StagingDir -o $PwshMsi $PwshMsiUri

    Start-Process -FilePath 'msiexec.exe' -ArgumentList '/i', "`"$PwshMsiPath`"", '/quiet', '/norestart' -Wait

    Write-Host '==> Downloading and extracting Sysinternals Suite to C:\tools\sysinternals...' -ForegroundColor Cyan
    if (-not (Test-Path 'C:\tools\sysinternals')) { New-Item -Path 'C:\tools\sysinternals' -ItemType Directory -Force | Out-Null }
    $SysinternalsZip = Join-Path $StagingDir 'SysinternalsSuite.zip'
    & 'C:\Program Files\WinGet\Links\aria2c.exe' -d $StagingDir -o SysinternalsSuite.zip "https://download.sysinternals.com/files/SysinternalsSuite.zip"
    Expand-Archive -Path $SysinternalsZip -DestinationPath "C:\tools\sysinternals" -Force
    Get-ChildItem C:\tools\sysinternals | Unblock-File

    Write-Host '==> Downloading and extracting Enterprise Defaults to C:\tools\defaults...' -ForegroundColor Cyan
    $DefaultsUri = Get-GitHubLatestAsset -Repo 'aaronparker/defaults' -AssetPattern 'defaults.zip'
    $DefaultsInstaller = Split-Path -Path $DefaultsUri -Leaf
    $DefaultsZip = Join-Path $StagingDir $DefaultsInstaller
    if (-not (Test-Path 'C:\tools\defaults')) { New-Item -Path 'C:\tools\defaults' -ItemType Directory | Out-Null }
    & 'C:\Program Files\WinGet\Links\aria2c.exe' -d $StagingDir -o $DefaultsInstaller $DefaultsUri
    Expand-Archive -Path $DefaultsZip -DestinationPath "C:\tools\defaults" -Force
    Get-ChildItem C:\tools\defaults | Unblock-File
}