English | 日本語 | 中文 | 한국어 | Español

Edge Setup Guard

Japanese name: Edge 自動セットアップ監視ガード
Version: 1.0.1
Author: @S2OUnicus

Edge Setup Guard is a Windows 11 PowerShell utility that blocks unwanted automatic Edge browser setup through multiple independent layers and continuously reapplies the selected state with a watchdog. It also provides initialization, status inspection, selective removal, emergency recovery, and a browser-free Chromium bootstrap.

Supported environment

• Windows 11
• Windows PowerShell 5.1 or later
• Administrator privileges for system-changing operations
• AppLocker cmdlets are required only when the AppLocker layer is selected
• Windows Defender Firewall cmdlets are used by the firewall layers
• Internet access is required only for the optional Chromium download

The main script is saved as UTF-8 with BOM and CRLF line endings for Windows PowerShell 5.1 compatibility.

Usage

Before the first run: .ps1 execution policy

Some systems block PowerShell scripts before this project can start. This is an operating-system execution-policy setting, not a failure of Edge Setup Guard.

To allow scripts only in the current PowerShell process:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

If the downloaded file has an Internet-origin block marker:

Unblock-File -LiteralPath ".\Edge-Install-Blocker.ps1"

A one-time bypass launch is also available:

powershell.exe -NoProfile -ExecutionPolicy Bypass -File ".\Edge-Install-Blocker.ps1"

If MachinePolicy or UserPolicy is enforced by an organization, a process-level setting may not override it.

When the main script starts without administrator privileges, it requests elevation through the normal UAC confirmation window and relaunches itself after approval. It does not bypass UAC.

Normal start

.\Edge-Install-Blocker.ps1

With no parameters, the interactive index screen opens.

Index screen

1. Language
2. Initialize
3. Block all — maximum profile
4. Check status
5. Apply blocking rules
6. Remove blocking rules
7. Rule descriptions
8. Command help
9. Install Chromium
10. Exit

After an action or submenu operation completes, control returns to the index screen unless Exit was selected.

Languages

The menu supports:

• Japanese
• English
• Chinese
• Korean
• French
• German
• Spanish
• Sinhala

The initial language follows the system UI language when recognized. Otherwise English is used. The selected language is saved in the project configuration.

Blocking design

Base protection

Running Apply blocking rules or Block all applies the base layer:

• Blocks the Stable-channel install policy used by the Edge updater
• Blocks the Stable-channel update policy
• Creates outbound firewall rules for detected msedge.exe locations
• Stops currently running Edge browser processes

The base layer is always applied before optional blocking rules.

Optional rules

1. AppLocker execution block (EnableAppLockerBlock)

Blocks Edge executable paths with AppLocker.

Safety measures in v1.0.1:

• Existing unrelated AppLocker rules are detected and preserved; automatic AppLocker application is refused in that case
• Only exact project rule names and known legacy rule names are treated as project-owned
• A packaged-app allow rule equivalent to “allow all signed packaged apps” is included
• A preflight verifies the packaged-app compatibility rule and checks that critical recovery executables such as cmd.exe, classic PowerShell, reg.exe, and Explorer are not denied before the policy is applied
• The pre-project local AppLocker policy is saved as a baseline when possible

2. Strict shared-updater block (StrictSharedUpdaterBlock)

Adds stronger blocking to the updater shared by Edge and other components:

• Stops and disables detected updater services
• Disables detected updater scheduled tasks
• Blocks updater executables through the firewall
• Adds updater endpoints to the hosts block
• Disables periodic updater checks through policy

Impact: this can also prevent updates for components such as WebView2 Runtime and applications that depend on the shared update mechanism.

3. Shared-updater impact acceptance (AcceptSharedUpdaterImpact)

Records that the user accepts the impact described above. Strict shared-updater blocking is not applied unless this state is enabled.

This option is an acknowledgement flag; by itself it does not block software.

4. Remove existing Edge (AutoRemoveEdge)

Searches detected Edge application directories for the local setup.exe uninstaller and attempts a system-level removal. Removal is best effort and is not guaranteed on every Windows configuration.

The watchdog repeats the removal attempt when this option remains enabled.

Maximum profile

The maximum profile enables:

• Base protection
• AppLocker execution block
• Strict shared-updater block
• Shared-updater impact acceptance
• Existing Edge removal
• Persistent watchdog

Because the strict shared-updater layer has wider impact, read the rule description before using the maximum profile.

Persistent watchdog

Unless -NoWatchdog is used, the project copies the active script to:

C:\ProgramData\S2O\EdgeInstallBlocker\

It registers two SYSTEM scheduled tasks:

• At Windows startup
• Once per hour

The watchdog re-applies only the state saved in the project configuration.

Removing rules

The Remove blocking rules submenu supports multiple selections:

1. Remove AppLocker execution block (DisableAppLockerBlock)
2. Remove strict shared-updater block (DisableStrictSharedUpdaterBlock)
3. Withdraw shared-updater impact acceptance (ForbidAcceptSharedUpdaterImpact)
4. Open the Store Edge search/install page (InstallEdge)

Withdrawing impact acceptance also removes the strict shared-updater block if it is active.

Opening the Store page does not automatically install Edge.

Initialization

Initialize removes project blocking rules and restores saved pre-block state where a baseline is available. It removes the project watchdog and project configuration.

Initialization does not automatically install Edge.

For services or tasks created after the original baseline, the project avoids leaving them disabled by its own strict-block action: newly detected updater services are returned to Manual startup and newly detected updater tasks are enabled.

Status

From the menu, choose Check status, or run:

.\Edge-Install-Blocker.ps1 -Mode Status

The status view reports the saved state of:

• Base protection
• AppLocker block
• Strict shared-updater block
• Impact acceptance
• Automatic removal
• Watchdog

Chromium bootstrap

The interactive menu includes Install Chromium for systems that currently have no usable browser.

The script downloads directly from:

https://download-chromium.appspot.com/

No system browser is opened for the download.

The Chromium submenu provides:

1. Download, extract, create shortcut, and run
2. Download only
3. Specify paths
4. Back

Default paths:

• Download folder: current user's Downloads folder
• Installation base: current user's Documents folder
• Installed portable folder: Documents\Chromium
• Shortcut: Chromium.lnk on the current user's Desktop

If an existing Chromium folder is present, it is moved to a timestamped backup folder before replacement.

The source provides a current raw Chromium snapshot rather than a stable release, so the downloaded build can be unstable.

Chromium is not included in this repository or release ZIP. Its downloaded files are governed by their own licenses.

Command reference

Modes

-Mode Menu
-Mode Apply
-Mode Remove
-Mode Max
-Mode Initialize
-Mode Status
-Mode Explain
-Mode Help
-Mode Enforce

Enforce is primarily used by the watchdog.

Language

-Language auto|en|ja|zh|ko|fr|de|es|si

Apply switches

-EnableAppLockerBlock
-StrictSharedUpdaterBlock
-AcceptSharedUpdaterImpact
-AutoRemoveEdge
-NoWatchdog

Remove switches

-DisableAppLockerBlock
-DisableStrictSharedUpdaterBlock
-ForbidAcceptSharedUpdaterImpact
-InstallEdge

Examples

Open the interactive menu:

.\Edge-Install-Blocker.ps1

Check state:

.\Edge-Install-Blocker.ps1 -Mode Status

Apply the maximum profile:

.\Edge-Install-Blocker.ps1 -Mode Max

Apply only the AppLocker optional layer in addition to base protection:

.\Edge-Install-Blocker.ps1 -Mode Apply -EnableAppLockerBlock

Apply strict shared-updater blocking with explicit impact acceptance:

.\Edge-Install-Blocker.ps1 -Mode Apply -StrictSharedUpdaterBlock -AcceptSharedUpdaterImpact

Remove the project AppLocker block:

.\Edge-Install-Blocker.ps1 -Mode Remove -DisableAppLockerBlock

Initialize:

.\Edge-Install-Blocker.ps1 -Mode Initialize

Runtime data

The project stores runtime state under:

C:\ProgramData\S2O\EdgeInstallBlocker\

Important files can include:

• baseline.json — pre-block registry/service/task state
• applocker-baseline.xml — pre-project local AppLocker policy
• config.json — selected rule state, language, and Chromium paths
• Edge-Install-Blocker.ps1 — watchdog copy
• Edge-Install-Blocker.log — project log

Emergency response

• Built-in apps such as Notepad, Store, Calculator, or some PowerShell launch paths are blocked after an old AppLocker-based build: Emergency 0x01 — automatic recovery BAT

The v1.0.1 AppLocker implementation was redesigned specifically to prevent this failure mode.

Project files

Edge-Install-Blocker.ps1
Readme.md
Readme.ja.md
Readme.zh.md
Readme.kr.md
Readme.sp.md
Changelog.md
Changelog.ja.md
LICENSE
LICENSE.ja
Doc/
  Emergence/
    0x01-Fix.bat
    0x01.md
    0x01.ja.md
    0x01.zh.md
    0x01.kr.md
    0x01.fr.md
    0x01.de.md
    0x01.sp.md
    0x01.si.md

Changelog

See Changelog.md. Japanese: Changelog.ja.md.

License

Project-authored files are released under CC BY-SA 4.0. See LICENSE and LICENSE.ja.

Downloaded Chromium binaries are not part of this project distribution and are not covered by the project license.

Author

@S2OUnicus