Reduce Windows 10 guest noise beyond the Edge updater

[ChrisThibodeaux]

Motivation

Removing Edge and the WebView2 Runtime from a Windows 10 guest only silences the MicrosoftEdgeUpdate.exe family. The rest of the processes that clutter a behavioural report and trigger signature false positives on an idle VM come from unrelated Windows features: the Windows Update stack, telemetry, ESU licence validation, error reporting, diagnostics, the Program Compatibility Assistant and a handful of per-user services.

installer/win10_disabler.ps1 previously covered only a small slice of this: it renamed MicrosoftEdgeUpdate.exe and disabled four Application Experience tasks. It was also not referenced anywhere in the docs, which only linked the Windows 7 batch script.

Changes

installer/win10_disabler.ps1

• Added Set-RegValue, Disable-GuestService and Disable-GuestTask helpers. The previous script assumed policy keys already existed, so New-ItemProperty/Set-ItemProperty would fail on a clean image; Disable-ScheduledTask would likewise throw on absent tasks. Services are disabled by writing Start=4 directly, because sc config/Set-Service is refused for protected services such as WaaSMedicSvc.
• Edge/WebView2 are now actually uninstalled (setup.exe --uninstall --force-uninstall, WebView2 first, plus the appx stub) rather than only having the updater renamed. -KeepEdge skips the uninstall while still neutering the updater.
• Added sections for each remaining noise source: Windows Update (wuauserv, UsoSvc, WaaSMedicSvc, PushToInstall, DoSvc, BITS, InstallService), telemetry/census/CLIP ESU, Windows Error Reporting, the Diagnostic Policy Service, the Program Compatibility Assistant, dmwappushservice/SmsRouter, the UnistackSvcGroup per-user template services (behind -KeepUserServices), and Automatic Maintenance.
• Edge paths now come from $env:ProgramFiles/${env:ProgramFiles(x86)} instead of a hardcoded C:\Program Files (x86).

docs/book/src/installation/guest/additional_configuration.rst

• Links win10_disabler.ps1 alongside the Windows 7 script and documents how to run it and what its two switches do.
• Adds a "Where the background processes come from" section with a table mapping each process family seen in a report to the service, policy or scheduled task responsible, plus notes on the parts that are easy to get wrong (WaaSMedicSvc undoing changes, TrustedInstaller-owned UpdateOrchestrator tasks, per-user service templates, Automatic Maintenance as the shared idle trigger, and the services that must stay enabled for the agent).

Verification

No CI covers PowerShell or the docs, so this was checked locally:

• Parsed with the PowerShell AST parser: clean.
• Invoke-ScriptAnalyzer -Severity Error: clean. The only remaining warnings are pre-existing Write-Host usage carried over from the original script.
• Executed end to end under mocked Windows cmdlets: 78 registry writes, 13 services disabled (absent ones correctly skipped), 28 task folders processed, no unhandled errors. Simulated Tamper Protection on Set-MpPreference and simulated Access denied on a protected scheduled task were both caught by the intended fallback paths.
• sphinx -b html builds the docs page with no new warnings.

The script itself has not been run against a real Windows 10 image in this environment.