# Haven — revert DNS changes on this Windows device. Run as Administrator.
$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $isAdmin) {
  Write-Host 'Haven needs an administrator window. Right-click Start, choose "Terminal (Admin)", and run this again.'
  exit 1
}
# Revert must never stop early. If it throws on one adapter, every adapter
# after it stays on Haven's DNS and the safe-search block below is never
# removed — which is precisely the state a parent who changed their mind
# must not be left in.
Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | ForEach-Object {
  $adapter = $_.Name
  try {
    Set-DnsClientServerAddress -InterfaceIndex $_.ifIndex -ResetServerAddresses -ErrorAction Stop
    Write-Host "Reset: $adapter"
  } catch {
    Write-Host "Skipped $adapter - it had no DNS settings of ours to remove"
  }
}

# Remove the SafeSearch pins, leaving any other hosts entries untouched.
$hostsFile = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $hostsFile) {
  $kept = @(); $skipping = $false
  foreach ($line in Get-Content $hostsFile) {
    if ($line -eq '# BEGIN HAVEN SAFE SEARCH') { $skipping = $true; continue }
    if ($line -eq '# END HAVEN SAFE SEARCH') { $skipping = $false; continue }
    if (-not $skipping) { $kept += $line }
  }
  Set-Content -Path $hostsFile -Value $kept -Encoding ASCII
  Write-Host 'Search and video safety locks removed.'
}

Clear-DnsClientCache
Write-Host 'Done. This device now uses the network default DNS again.'