# Consurgam Schutz fuer Windows entfernen / Remove Consurgam protection for Windows (version 1)
# Undoes exactly what consurgam-windows.ps1 set. Run in "Terminal (Admin)". Sends nothing, downloads nothing.

& {
  $ErrorActionPreference = 'Stop'
  $dns = @('1.1.1.3', '1.0.0.3', '2606:4700:4700::1113', '2606:4700:4700::1003')

  $ich = [Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
  if (-not $ich.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Host 'Bitte als Administrator starten / Please run as administrator.' -ForegroundColor Yellow
    return
  }

  # 1. Adapters back to automatic DNS (DHCP), only where our servers are set
  foreach ($n in @(Get-NetAdapter)) {
    $jetzt = @(Get-DnsClientServerAddress -InterfaceIndex $n.ifIndex -ErrorAction SilentlyContinue | ForEach-Object ServerAddresses)
    if ($jetzt | Where-Object { $dns -contains $_ }) { Set-DnsClientServerAddress -InterfaceIndex $n.ifIndex -ResetServerAddresses }
  }
  # 2. DNS over HTTPS entries for Cloudflare for Families
  if (Get-Command Remove-DnsClientDohServerAddress -ErrorAction SilentlyContinue) {
    foreach ($a in $dns) {
      if (Get-DnsClientDohServerAddress -ServerAddress $a -ErrorAction SilentlyContinue) { Remove-DnsClientDohServerAddress -ServerAddress $a | Out-Null }
    }
  }
  Clear-DnsClientCache

  # 3. Only the policy values we set (other policies stay)
  function Entferne([string]$pfad, [string[]]$namen) {
    if (Test-Path $pfad) { foreach ($k in $namen) { Remove-ItemProperty -Path $pfad -Name $k -ErrorAction SilentlyContinue } }
  }
  Entferne 'HKLM:\SOFTWARE\Policies\Microsoft\Edge' @('InPrivateModeAvailability', 'BrowserGuestModeEnabled', 'ForceGoogleSafeSearch', 'ForceBingSafeSearch', 'DnsOverHttpsMode', 'DnsOverHttpsTemplates')
  Entferne 'HKLM:\SOFTWARE\Policies\Google\Chrome' @('IncognitoModeAvailability', 'BrowserGuestModeEnabled', 'SafeSitesFilterBehavior', 'ForceGoogleSafeSearch', 'DnsOverHttpsMode', 'DnsOverHttpsTemplates')
  Entferne 'HKLM:\SOFTWARE\Policies\BraveSoftware\Brave' @('IncognitoModeAvailability', 'BrowserGuestModeEnabled', 'SafeSitesFilterBehavior', 'ForceGoogleSafeSearch', 'DnsOverHttpsMode', 'DnsOverHttpsTemplates')
  Entferne 'HKLM:\SOFTWARE\Policies\Mozilla\Firefox' @('DisablePrivateBrowsing', 'PrivateBrowsingModeAvailability')
  if (Test-Path 'HKLM:\SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS') { Remove-Item -Path 'HKLM:\SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS' -Recurse -Force }

  Write-Host 'Consurgam-Schutz entfernt. Browser neu starten. / Consurgam protection removed. Restart your browsers.' -ForegroundColor Green
}