Recovering from Attack Surface Reduction rule shortcut deletions

Matt Rouse Having suffered like others with shortcuts suddenly disappearing from taskbar, start menu and desktop, and having also used Shadow Explorer to tediously restore the .lnk files from the various locations of a pre-13/01/2023 Shadow Copy, I was inspired by your idea of a script to do this. So this morning I wrote https://gist.github.com/Jimadine/537f1ac86ef6ffcf182bfb7ca99178e3.

It builds on your script, with an option to additionally restore shortcuts from a user profile folder. By default my script doesn't actually restore any files, as I wanted to give the user a chance to see what would be restored first (using robocopy's /L option).

Other noteworthy changes:

• I've put the various commands in a FOR loop, to avoid repetition.
• I've also tightened it up so that it copies specifically *.lnk files.
• I've changed the /E for a /S (I presume that we wouldn't be interested in copying empty directories from the source).
• I've added /XO (exclude older) so if a .lnk file is found in both source and destination, it keeps the one in the destination (say, if the user had updated the shortcut in some way, since the Shadow Copy was made, they'd likely want the newer file).

I haven't tested it very well, and I'm sure improvements can be made. But hopefully it's useful.

Thanks for the inspiration - it was just enough to get me started!