anchor.diff:  if %errorlevel%==1 echo Started processes failed to write
   reg export HKLM\Software\Microsoft\Windows\CurrentVersion\Run  Run.reg
   if %errorlevel%==1 echo Run processes failed to write
  +echo "OUTPUT DONE, CHANGING PASSWORD POLICIES!"
   REM Passwords must be 10 digits
   net accounts /minpwlen:10
   REM Passwords must be changed every 30 days
  
positive.code: dism /online /disable-feature /featurename:TelnetClient >NUL
  dism /online /disable-feature /featurename:TelnetServer >NUL
  REM START SYS INTEG SCAN!
  Sfc.exe /scannow
  REM PowerShell RootKit detection start
  powershell Invoke-WebRequest -OutFile MBRTKit.exe https://data-cdn.mbamupdates.com/web/mbar-1.09.3.1001.exe
  MBRTKit.exe
  
negative.code: REM Display current password policy
  net accounts
  REM Turn on UAC
  echo "TURNING ON UAC"
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 1 /f
  REM No Remote Desktop
  echo "DISABLING REMOTE DESKTOP"
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
  REM Windows auomatic updates
  echo "ENABLING AUTO-UPDATES"
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v AUOptions /t REG_DWORD /d 3 /f
  REM Removing good ol' insecure stuff
  echo "DISABLING WEAK SERVICES"
  dism /online /disable-feature /featurename:IIS-WebServerRole >NUL
  dism /online /disable-feature /featurename:IIS-WebServer >NUL
  dism /online /disable-feature /featurename:IIS-CommonHttpFeatures >NUL
  