[CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'High')]
param(
    [switch]$RemoveFiles
)

$ErrorActionPreference = 'Stop'
$providerClassId = '{D789CFD8-5AD4-489F-9B83-7EB5D9D09335}'
$installPath = Join-Path $env:ProgramFiles 'SGU\CredentialProvider'
$providerRegistryPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\$providerClassId"
$classRegistryPath = "HKLM:\SOFTWARE\Classes\CLSID\$providerClassId"
$defaultProviderPolicyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System'
$enrollmentTaskName = 'SGU-CredentialProvider-EnrollmentGuard'
$enrollmentPath = Join-Path $env:ProgramData 'SGU\Enrollment'

if ($PSCmdlet.ShouldProcess($providerClassId, 'Unregister the SGU Credential Provider')) {
    if (Get-ScheduledTask -TaskName $enrollmentTaskName -ErrorAction SilentlyContinue) {
        Unregister-ScheduledTask -TaskName $enrollmentTaskName -Confirm:$false
    }

    Remove-Item -LiteralPath $providerRegistryPath -Recurse -Force -ErrorAction SilentlyContinue
    Remove-Item -LiteralPath $classRegistryPath -Recurse -Force -ErrorAction SilentlyContinue

    $configuredDefault = $null
    try {
        $configuredDefault = Get-ItemPropertyValue `
            -LiteralPath $defaultProviderPolicyPath `
            -Name DefaultCredentialProvider `
            -ErrorAction Stop
    }
    catch {
        # Nothing to remove when the policy is absent.
    }
    if ($configuredDefault -eq $providerClassId) {
        Remove-ItemProperty -LiteralPath $defaultProviderPolicyPath `
            -Name DefaultCredentialProvider -Force
    }
}

if ($RemoveFiles -and $PSCmdlet.ShouldProcess($installPath, 'Remove Credential Provider files')) {
    Remove-Item -LiteralPath $installPath -Recurse -Force -ErrorAction SilentlyContinue
    Remove-Item -LiteralPath $enrollmentPath -Recurse -Force -ErrorAction SilentlyContinue
}

Write-Output 'The built-in Windows password Credential Provider was not changed.'