@echo off
setlocal EnableDelayedExpansion
color 0A
title Network Repair Tool - Orchid Technologies

:: ============================================================
::  RepairNetwork.bat  v2.0
::  Purpose : Full network stack reset
::            Set all profiles to Private
::            Enable Network Discovery
::            Create D:\Share and share for Everyone
::  Run As  : Administrator (mandatory)
::  Author  : Orchid Technologies
:: ============================================================

:: ── 0. Elevation guard ──────────────────────────────────────
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo.
    echo  [ERROR] This script must be run as Administrator.
    echo          Right-click and choose "Run as administrator".
    echo.
    pause
    exit /b 1
)

:: ── Banner ───────────────────────────────────────────────────
cls
echo.
echo  =====================================================
echo   Network Repair Tool v2.0  ^|  Orchid Technologies
echo  =====================================================
echo.
echo  This script will:
echo    [1]  Flush DNS, release ^& renew IP
echo    [2]  Reset Winsock + TCP/IP + IPv6 stacks
echo    [3]  Reset Windows Firewall to defaults
echo    [4]  Clear ARP cache and routing table
echo    [5]  Set ALL network profiles to PRIVATE
echo    [6]  Enable Network Discovery (Private profile)
echo    [7]  Enable File and Printer Sharing
echo    [8]  Start all discovery-dependent services
echo    [9]  Enable Classic sharing security model
echo    [10] Create D:\Share and share for Everyone
echo.
echo  WARNING: Active connections will be briefly interrupted.
echo.
set /p CONFIRM=  Proceed? (Y/N): 
if /i "!CONFIRM!" neq "Y" (
    echo.
    echo  Cancelled. No changes made.
    pause
    exit /b 0
)

:: ── Log file setup ──────────────────────────────────────────
set "LOGFILE=%TEMP%\NetRepair_%DATE:~-4,4%%DATE:~-7,2%%DATE:~-10,2%_%TIME:~0,2%%TIME:~3,2%%TIME:~6,2%.log"
set "LOGFILE=%LOGFILE: =0%"
(
    echo Network Repair Log v2.0 - %DATE% %TIME%
    echo ================================================
    echo Computer: %COMPUTERNAME%
    echo User    : %USERNAME%
    echo ================================================
) > "%LOGFILE%"

echo.
echo  Log: %LOGFILE%
echo  ─────────────────────────────────────────────────
echo.

:: ════════════════════════════════════════════════════
::  STEP 1 — Flush DNS
:: ════════════════════════════════════════════════════
echo [Step  1/10] Flushing DNS cache...
echo [Step  1/10] Flushing DNS cache... >> "%LOGFILE%"
ipconfig /flushdns >> "%LOGFILE%" 2>&1
echo   Done.

:: ════════════════════════════════════════════════════
::  STEP 2 — Release IP
:: ════════════════════════════════════════════════════
echo [Step  2/10] Releasing IP lease...
echo [Step  2/10] Releasing IP lease... >> "%LOGFILE%"
ipconfig /release >> "%LOGFILE%" 2>&1
echo   Done.

:: ════════════════════════════════════════════════════
::  STEP 3 — Reset Winsock
:: ════════════════════════════════════════════════════
echo [Step  3/10] Resetting Winsock catalog...
echo [Step  3/10] Resetting Winsock catalog... >> "%LOGFILE%"
netsh winsock reset >> "%LOGFILE%" 2>&1
if %errorlevel% equ 0 ( echo   OK ) else ( echo   WARN: Winsock reset returned non-zero )

:: ════════════════════════════════════════════════════
::  STEP 4 — Reset TCP/IP + IPv6
:: ════════════════════════════════════════════════════
echo [Step  4/10] Resetting TCP/IP stack...
echo [Step  4/10] Resetting TCP/IP stack... >> "%LOGFILE%"
netsh int ip reset "%TEMP%\tcpip_reset.log" >> "%LOGFILE%" 2>&1
if %errorlevel% equ 0 ( echo   OK ) else ( echo   WARN: TCP/IP reset returned non-zero )

echo [Step  4/10] Resetting IPv6 stack...
echo [Step  4/10] Resetting IPv6 stack... >> "%LOGFILE%"
netsh int ipv6 reset >> "%LOGFILE%" 2>&1
echo   Done.

:: ════════════════════════════════════════════════════
::  STEP 5 — Reset Firewall
:: ════════════════════════════════════════════════════
echo [Step  5/10] Resetting Windows Firewall to defaults...
echo [Step  5/10] Resetting Windows Firewall... >> "%LOGFILE%"
netsh advfirewall reset >> "%LOGFILE%" 2>&1
if %errorlevel% equ 0 ( echo   OK ) else ( echo   WARN: Firewall reset returned non-zero )

:: ════════════════════════════════════════════════════
::  STEP 6 — Clear ARP + routes, renew IP
:: ════════════════════════════════════════════════════
echo [Step  6/10] Clearing ARP cache and routing table...
echo [Step  6/10] Clearing ARP + route cache... >> "%LOGFILE%"
arp -d *    >> "%LOGFILE%" 2>&1
route -f    >> "%LOGFILE%" 2>&1
echo   Done.

echo [Step  6/10] Renewing IP lease...
echo [Step  6/10] Renewing IP lease... >> "%LOGFILE%"
ipconfig /renew >> "%LOGFILE%" 2>&1
echo   Done.

:: ════════════════════════════════════════════════════
::  STEP 7 — Set all profiles to PRIVATE
:: ════════════════════════════════════════════════════
echo [Step  7/10] Setting all network profiles to PRIVATE...
echo [Step  7/10] Setting profiles to Private... >> "%LOGFILE%"

powershell -NoProfile -ExecutionPolicy Bypass -Command ^
    "Get-NetConnectionProfile | ForEach-Object { " ^
    "  $n = $_.Name; " ^
    "  Set-NetConnectionProfile -Name $n -NetworkCategory Private -ErrorAction SilentlyContinue; " ^
    "  $r = (Get-NetConnectionProfile -Name $n).NetworkCategory; " ^
    "  Write-Host ('   [' + $r + ']  ' + $n) " ^
    "}" 2>&1 | tee -a "%LOGFILE%" 2>nul

:: Fallback if tee not available
powershell -NoProfile -ExecutionPolicy Bypass -Command ^
    "Get-NetConnectionProfile | ForEach-Object { " ^
    "  $n = $_.Name; " ^
    "  Set-NetConnectionProfile -Name $n -NetworkCategory Private -ErrorAction SilentlyContinue; " ^
    "  $r = (Get-NetConnectionProfile -Name $n).NetworkCategory; " ^
    "  Write-Host ('   [' + $r + ']  ' + $n) " ^
    "}"

:: ════════════════════════════════════════════════════
::  STEP 8 — Enable Network Discovery
:: ════════════════════════════════════════════════════
echo [Step  8/10] Enabling Network Discovery...
echo [Step  8/10] Enabling Network Discovery... >> "%LOGFILE%"

:: Firewall rules — netsh
netsh advfirewall firewall set rule group="Network Discovery"        new enable=Yes profile=private >> "%LOGFILE%" 2>&1
netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes profile=private >> "%LOGFILE%" 2>&1

:: Firewall rules — PowerShell (Win 11 persistence fix)
powershell -NoProfile -ExecutionPolicy Bypass -Command ^
    "Set-NetFirewallRule -DisplayGroup 'Network Discovery'        -Enabled True -Profile Private -ErrorAction SilentlyContinue" >> "%LOGFILE%" 2>&1
powershell -NoProfile -ExecutionPolicy Bypass -Command ^
    "Set-NetFirewallRule -DisplayGroup 'File and Printer Sharing' -Enabled True -Profile Private -ErrorAction SilentlyContinue" >> "%LOGFILE%" 2>&1

echo   Firewall rules set.

:: ════════════════════════════════════════════════════
::  STEP 9 — Start discovery services
:: ════════════════════════════════════════════════════
echo [Step  9/10] Starting Network Discovery services...
echo [Step  9/10] Starting discovery services... >> "%LOGFILE%"

:: Function Discovery Resource Publication (advertises this PC)
sc config FDResPub  start= auto   >> "%LOGFILE%" 2>&1
sc start  FDResPub                >> "%LOGFILE%" 2>&1

:: Function Discovery Provider Host (finds other devices)
sc config fdPHost   start= auto   >> "%LOGFILE%" 2>&1
sc start  fdPHost                 >> "%LOGFILE%" 2>&1

:: SSDP Discovery (UPnP)
sc config SSDPSRV   start= auto   >> "%LOGFILE%" 2>&1
sc start  SSDPSRV                 >> "%LOGFILE%" 2>&1

:: UPnP Device Host
sc config upnphost  start= demand >> "%LOGFILE%" 2>&1
sc start  upnphost                >> "%LOGFILE%" 2>&1

:: DNS Client (name resolution)
sc config dnscache  start= auto   >> "%LOGFILE%" 2>&1
sc start  dnscache                >> "%LOGFILE%" 2>&1

:: Server service (SMB file sharing)
sc config LanmanServer start= auto >> "%LOGFILE%" 2>&1
sc start  LanmanServer             >> "%LOGFILE%" 2>&1

:: Workstation service (SMB client)
sc config LanmanWorkstation start= auto >> "%LOGFILE%" 2>&1
sc start  LanmanWorkstation             >> "%LOGFILE%" 2>&1

echo   Services started.

:: ── Classic sharing security model ──────────────────
echo   Setting Classic sharing security model...
echo   Setting Classic sharing security model... >> "%LOGFILE%"
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "forceguest" /t REG_DWORD /d 0 /f >> "%LOGFILE%" 2>&1
reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" /v "AutoShareWks" /t REG_DWORD /d 1 /f >> "%LOGFILE%" 2>&1

:: Enable and start Guest account (needed for anonymous share access)
net user Guest /active:yes >> "%LOGFILE%" 2>&1

:: Remove Guest from "Deny access from network" policy
powershell -NoProfile -ExecutionPolicy Bypass -Command ^
    "$p = 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'; " ^
    "Set-ItemProperty -Path $p -Name 'restrictanonymous' -Value 0 -ErrorAction SilentlyContinue; " ^
    "Set-ItemProperty -Path $p -Name 'restrictanonymoussam' -Value 0 -ErrorAction SilentlyContinue" >> "%LOGFILE%" 2>&1

echo   Done.

:: ════════════════════════════════════════════════════
::  STEP 10 — Create D:\Share and share for Everyone
:: ════════════════════════════════════════════════════
echo [Step 10/10] Creating D:\Share and sharing for Everyone...
echo [Step 10/10] Creating D:\Share... >> "%LOGFILE%"

:: ── Check D: drive exists ────────────────────────────
if not exist "D:\" (
    echo.
    echo   [WARN] Drive D:\ not found. Creating share on C:\Share instead.
    echo   [WARN] Drive D:\ not found. Using C:\Share. >> "%LOGFILE%"
    set "SHAREPATH=C:\Share"
) else (
    set "SHAREPATH=D:\Share"
)

:: ── Create folder ────────────────────────────────────
if not exist "!SHAREPATH!" (
    mkdir "!SHAREPATH!" >> "%LOGFILE%" 2>&1
    echo   Folder created: !SHAREPATH!
    echo   Folder created: !SHAREPATH! >> "%LOGFILE%"
) else (
    echo   Folder already exists: !SHAREPATH!
    echo   Folder already exists: !SHAREPATH! >> "%LOGFILE%"
)

:: ── Remove existing share if present (clean slate) ───
net share Share >nul 2>&1
if %errorlevel% equ 0 (
    echo   Removing existing 'Share' share for clean setup...
    net share Share /delete /y >> "%LOGFILE%" 2>&1
)

:: ── Create SMB share with Everyone full access ───────
net share Share="!SHAREPATH!" /GRANT:Everyone,FULL /REMARK:"Orchid Technologies Shared Folder" >> "%LOGFILE%" 2>&1
if %errorlevel% equ 0 (
    echo   SMB share created: \\%COMPUTERNAME%\Share
    echo   SMB share created: \\%COMPUTERNAME%\Share >> "%LOGFILE%"
) else (
    echo   [WARN] net share returned non-zero. Check log.
    echo   [WARN] net share error >> "%LOGFILE%"
)

:: ── Set NTFS permissions — Everyone Full Control ─────
echo   Setting NTFS permissions...
echo   Setting NTFS permissions... >> "%LOGFILE%"
icacls "!SHAREPATH!" /grant "Everyone:(OI)(CI)F" /T /Q >> "%LOGFILE%" 2>&1
icacls "!SHAREPATH!" /grant "CREATOR OWNER:(OI)(CI)F" /T /Q >> "%LOGFILE%" 2>&1
if %errorlevel% equ 0 (
    echo   NTFS permissions set: Everyone Full Control
) else (
    echo   [WARN] icacls returned non-zero. Check log.
)

:: ── Open SMB port 445 in firewall ────────────────────
echo   Opening firewall port 445 (SMB)...
netsh advfirewall firewall add rule ^
    name="SMB Inbound - Orchid Share" ^
    protocol=TCP dir=in localport=445 ^
    action=allow profile=private ^
    enable=yes >> "%LOGFILE%" 2>&1

:: ── Verify share ─────────────────────────────────────
echo.
echo   Share verification:
net share Share >> "%LOGFILE%" 2>&1
net share Share
echo.

:: ════════════════════════════════════════════════════
::  FINAL SUMMARY
:: ════════════════════════════════════════════════════
echo.
echo  =====================================================
echo   Current IP Configuration
echo  =====================================================
ipconfig | findstr /i "adapter ipv4 ipv6 default gateway"
echo.
echo  =====================================================
echo   Network Profile Summary
echo  =====================================================
powershell -NoProfile -ExecutionPolicy Bypass -Command ^
    "Get-NetConnectionProfile | Select-Object Name,InterfaceAlias,NetworkCategory,IPv4Connectivity | Format-Table -AutoSize"

echo  =====================================================
echo   Shared Folder Summary
echo  =====================================================
echo   Path      : !SHAREPATH!
echo   Share name: Share
echo   UNC path  : \\%COMPUTERNAME%\Share
echo   Access    : Everyone - Full Control
echo.
echo  =====================================================
echo   Service Status
echo  =====================================================
for %%S in (FDResPub fdPHost SSDPSRV LanmanServer LanmanWorkstation) do (
    for /f "tokens=4" %%A in ('sc query %%S ^| findstr /i "STATE"') do (
        echo   %%S : %%A
    )
)

echo.
echo  =====================================================
echo   Log saved to:
echo   %LOGFILE%
echo  =====================================================
echo.
echo  A REBOOT is recommended to finalise all changes.
echo  (Winsock + TCP/IP stack resets require a restart)
echo.

set /p REBOOT=  Reboot now? (Y/N): 
if /i "!REBOOT!" equ "Y" (
    echo.
    echo  Rebooting in 15 seconds... Press Ctrl+C to abort.
    shutdown /r /t 15 /c "Orchid NetRepair v2.0 - Applying network stack changes"
) else (
    echo.
    echo  Skipping reboot. Some changes take effect only after restart.
)

echo.
pause
exit /b 0