[CmdletBinding(SupportsShouldProcess = $true)]
param(
    # Packages to remove completely (per-user and provisioned)
    [string[]] $Packages = @(
        "Microsoft.Print3D",
        "Microsoft.Microsoft3DViewer",
        "Microsoft.WebMediaExtensions",
        "Microsoft.VP9VideoExtensions",
        "Microsoft.MSPaint",
        "Microsoft.Winget.Source",
        "Microsoft.HEIFImageExtension",
        "MSTeams"   # Microsoft Teams (AppX version from WindowsApps)
    )
)

function Test-Admin {
    $currentUser = [Security.Principal.WindowsIdentity]::GetCurrent()
    $principal = New-Object Security.Principal.WindowsPrincipal($currentUser)
    return $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
}

if (-not (Test-Admin)) {
    Write-Error "This script must be run in an elevated PowerShell session (Run as Administrator)."
    exit 1
}

Write-Verbose "Starting removal of Appx packages for all users and deprovisioning from the OS image..."

foreach ($name in $Packages) {
    Write-Verbose "Processing package name: '$name'"

    # 1) Remove per-user installs for ALL users
    try {
        $apps = Get-AppxPackage -AllUsers -Name $name -ErrorAction SilentlyContinue
        if ($apps) {
            foreach ($app in $apps) {
                if ($PSCmdlet.ShouldProcess("$($app.PackageFullName)", "Remove-AppxPackage (per-user/all users)")) {
                    try {
                        Remove-AppxPackage -Package $app.PackageFullName -AllUsers -ErrorAction Stop
                        Write-Host "Removed per-user package: $($app.PackageFullName)"
                    } catch {
                        try {
                            Remove-AppxPackage -Package $app.PackageFullName -ErrorAction Stop
                            Write-Host "Removed package in current context: $($app.PackageFullName)"
                        } catch {
                            Write-Warning "Failed to remove per-user package $($app.PackageFullName): $($_.Exception.Message)"
                        }
                    }
                }
            }
        } else {
            Write-Verbose "No per-user installs found for '$name'."
        }
    } catch {
        Write-Warning "Error enumerating per-user installs for '$name': $($_.Exception.Message)"
    }

    # 2) Deprovision from the image so NEW users don't get it
    try {
        $provMatches = Get-AppxProvisionedPackage -Online |
            Where-Object { $_.DisplayName -eq $name }

        if ($provMatches) {
            foreach ($prov in $provMatches) {
                if ($PSCmdlet.ShouldProcess("$($prov.PackageName)", "Remove-AppxProvisionedPackage -Online -AllUsers")) {
                    try {
                        Remove-AppxProvisionedPackage -Online -PackageName $prov.PackageName -AllUsers | Out-Null
                        Write-Host "Deprovisioned: $($prov.DisplayName) | $($prov.PackageName)"
                    } catch {
                        Write-Warning "Failed to deprovision $($prov.PackageName): $($_.Exception.Message)"
                    }
                }
            }
        } else {
            Write-Verbose "No provisioned package found for '$name'."
        }
    } catch {
        Write-Warning "Error enumerating provisioned packages for '$name': $($_.Exception.Message)"
    }
}

Write-Host "Done. A reboot is recommended to ensure all removals complete and shell caches refresh."