Add branded default provider and enforced enrollment

scripts/Uninstall-CredentialProvider.ps1

@@ -8,14 +8,37 @@ $providerClassId = '{D789CFD8-5AD4-489F-9B83-7EB5D9D09335}'
 $installPath = Join-Path $env:ProgramFiles 'SGU\CredentialProvider'
 $providerRegistryPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\$providerClassId"
 $classRegistryPath = "HKLM:\SOFTWARE\Classes\CLSID\$providerClassId"
+$defaultProviderPolicyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System'
+$enrollmentTaskName = 'SGU-CredentialProvider-EnrollmentGuard'
+$enrollmentPath = Join-Path $env:ProgramData 'SGU\Enrollment'
 
 if ($PSCmdlet.ShouldProcess($providerClassId, 'Unregister the SGU Credential Provider')) {
+    if (Get-ScheduledTask -TaskName $enrollmentTaskName -ErrorAction SilentlyContinue) {
+        Unregister-ScheduledTask -TaskName $enrollmentTaskName -Confirm:$false
+    }
+
     Remove-Item -LiteralPath $providerRegistryPath -Recurse -Force -ErrorAction SilentlyContinue
     Remove-Item -LiteralPath $classRegistryPath -Recurse -Force -ErrorAction SilentlyContinue
+
+    $configuredDefault = $null
+    try {
+        $configuredDefault = Get-ItemPropertyValue `
+            -LiteralPath $defaultProviderPolicyPath `
+            -Name DefaultCredentialProvider `
+            -ErrorAction Stop
+    }
+    catch {
+        # Nothing to remove when the policy is absent.
+    }
+    if ($configuredDefault -eq $providerClassId) {
+        Remove-ItemProperty -LiteralPath $defaultProviderPolicyPath `
+            -Name DefaultCredentialProvider -Force
+    }
 }
 
 if ($RemoveFiles -and $PSCmdlet.ShouldProcess($installPath, 'Remove Credential Provider files')) {
     Remove-Item -LiteralPath $installPath -Recurse -Force -ErrorAction SilentlyContinue
+    Remove-Item -LiteralPath $enrollmentPath -Recurse -Force -ErrorAction SilentlyContinue
 }
 
 Write-Output 'The built-in Windows password Credential Provider was not changed.'