I gave Claude Code a single PowerShell prompt and let it debloat and configure a fresh Windows 11 25H2 virtual machine from start to finish. It created a restore point, removed bloatware apps, installed my software through WinGet, applied my taskbar, Start menu, and privacy preferences, and saved a reusable setup script I can run on any new install.

Applies to: Windows 11 (24H2, 25H2) | Last updated: May 28, 2026

Key Takeaways

• Claude Code can run PowerShell, not just write code — that means an AI command-line tool can debloat and configure Windows directly, without you clicking through Settings.
• One detailed prompt did the whole job — bloatware removal, WinGet app installs, dark mode, taskbar and Start menu layout, and privacy/telemetry changes on Windows 11 25H2.
• It created a System Restore point first and asked before deleting anything — Claude paused to confirm how aggressive the bloatware removal should be before touching the system.
• The best output is a reusable script — a complete PowerShell setup script (included in this guide) that reproduces the entire configuration on any fresh install in about five minutes.
• This is an experiment, not a recommendation — run it only in a virtual machine, because bypass-permissions mode lets the AI execute system commands without asking.

Quick Steps:

1. Set up a Windows 11 virtual machine — never test this on your main PC.
2. Install Claude Code in the VM and enable bypass-permissions mode.
3. Paste the setup prompt (below), describing exactly how you want the machine configured.
4. Answer Claude’s clarifying question about how aggressively to remove bloatware.
5. Let it research the registry settings, install your apps via WinGet, and apply the tweaks.
6. Have it save the steps as a reusable PowerShell script on the Desktop.
7. Run that script on any fresh install to get the same result in minutes.

The Exact Prompt I Gave Claude Code

Everything started with one prompt. I told Claude Code it was on a fresh Windows 11 25H2 install on an admin account, then listed exactly what I wanted done. Here is the full prompt, ready to copy and adapt for your own setup:

You are on a fresh Windows 11 25H2 installation on an Admin account and I want you to do the following using PowerShell/CMD.

1. Set up this new machine for me by:
1.1 Removing Bloatware Windows Apps (I only use Calculator, Notepad and Terminal - The rest can be removed)
1.2 Installing software I will use via winget (Brave Browser, Nilesoft Shell, Notepad++)
1.3 Enabling Dark Mode
1.4 Left Aligning the Taskbar and having only File Explorer pinned, no Search or Task View buttons.
1.5 Setting File Explorer default location to This PC and showing file extensions.
1.6 Disabling or turning off all Privacy settings in Privacy & Security to disable all telemetry in Windows.
1.7 Turning off all background apps or processes that don't need to be running all the time.
1.8 Unpin all tiles from the Start Menu and set the All Apps View Mode to List.
1.9 Anything else I might be missing to have this machine running optimally.

Before you start:
Create a restore point
In case there is commands you can't run inline and you need to save scripts, you can save them on the Desktop and run it from there.
You have internet access if you need to research any registry entries etc. from Microsoft docs to complete this task.

Tell me when you're done.

The key to a result like this is being specific. Each numbered item is a concrete instruction, and the “anything else I might be missing” line gives Claude room to apply sensible extras — it ended up disabling telemetry scheduled tasks I never explicitly asked for. The “create a restore point” line is the most important one, because it gives you a clean rollback if anything goes wrong.

What Is Claude Code, and Why Use It to Set Up Windows?

Claude Code is a command-line tool from Anthropic that runs AI models in your terminal. It is normally used to write code and build projects, but it can also execute PowerShell commands and scripts directly on your machine. That second ability is what makes it interesting for Windows setup.

Instead of clicking through dozens of Settings pages after every clean install, you describe the end state once and let the tool do the work. In my test it did not just run blind commands — it researched the correct registry entries from Microsoft’s documentation before changing anything it was unsure about, which is exactly what I hoped to see.

Important: Only Do This in a Virtual Machine

The safety part matters, so I want to be clear about it. I ran this entire test inside a virtual machine that is completely separate from my main computer, and I turned on bypass permissions so Claude could run commands without stopping to ask each time. That combination is powerful but risky — you are handing an AI the ability to make system-level changes automatically.

Treat this as an experiment, not a daily-driver workflow. Do not run it on a PC with data or settings you care about. A virtual machine gives you a contained, throwaway environment where you can let the AI work, watch what it does, and test the resulting script safely.

Tip: Always include “create a restore point” as the first instruction. Even in a VM, a restore point lets you undo the changes instantly if a tweak breaks something.

How Claude Set Up the PC, Step by Step

Claude worked through the task methodically rather than firing off commands at random. The first thing it did was configure System Restore and create a restore point named “before Claude setup,” which I confirmed in the Windows UI before it continued.

Next, it paused and asked a clarifying question: how aggressive should the bloatware removal be? It offered a balanced option (keep genuinely useful apps like Photos, Snipping Tool, and Paint), a strict/minimal option (remove everything except Calculator, Notepad, and Terminal plus required system frameworks), and a balanced option that also removed the Microsoft Store. I chose the strict option for this test, and it correctly refused to remove critical system frameworks or shell components that would break Windows itself.

From there it researched the registry mappings it was unsure about — the Start menu list view, unpinning all tiles, and the taskbar layout — by reading Microsoft’s documentation. Then it ran through the rest of the work:

• Installed my apps via WinGet first, while the system was still intact
• Removed the bloatware apps based on my strict selection
• Enabled dark mode and applied a dark wallpaper
• Left-aligned the taskbar, pinned only File Explorer, and removed the Search and Task View buttons
• Set File Explorer to open to This PC and enabled file extensions
• Disabled the privacy and telemetry settings in Privacy & Security — and went a step further by disabling the telemetry scheduled tasks too
• Turned off unnecessary background apps
• Unpinned all Start menu tiles and set the All Apps view to list mode

If you would rather handle bloatware removal manually, I have a separate guide on the official Windows 11 25H2 bloatware removal method that does not involve any AI at all.

The Software Claude Installed via WinGet

WinGet is the package manager built into Windows, so Claude could install everything from the command line without downloading a single installer by hand. The apps I asked for in the prompt were:

• Brave Browser — a privacy-focused Chromium browser
• Nilesoft Shell — a powerful, customizable right-click context menu
• Notepad++ — a lightweight code and text editor

After the first pass I had Claude add two more to the script so a fresh install would include them automatically: FastStone Image Viewer for viewing images and Media Player Classic – Black Edition for media playback. Because they were added to the script, they install on any machine I run it on.

The Reusable Setup Script (Copy, Paste, Run)

The single best outcome was not the configured VM — it was the script. Claude bundled every step into one PowerShell file, just over 300 lines long, that handles the WinGet installs, the app removals, the registry tweaks, the Start and taskbar layout, the telemetry and background-app changes, the wallpaper, and an Explorer restart. It also creates a restore point before it does anything and writes a log to your Desktop.

I do not host the file anywhere, so the full script is included below. To use it, copy everything in the box, paste it into Notepad, and save it as Setup-Windows.ps1 — in the Save dialog, change “Save as type” to “All Files” so it does not save as a .txt file.

Read this before you run it: This is my personal, deliberately strict setup. It removes apps many people want to keep — including the Microsoft Store, Photos, Paint, Snipping Tool, and Camera — and it installs my chosen apps (Brave, Nilesoft Shell, Notepad++, FastStone, MPC-BE). Open the script and edit the $apps and $removeApps lists to match your own preferences first. Always test it in a virtual machine before running it on a real PC, and remember it creates a restore point so you can roll back.

<#
    Setup-Windows.ps1
    Fresh Windows 11 25H2 (build 26200) setup / debloat / privacy hardening.
    Run elevated (Admin). The script creates a system restore point before making changes.

    Sections:
      *. Create a system restore point (pre-flight)
      0. Install applications via winget (Brave, Nilesoft Shell, Notepad++, FastStone, MPC-BE)
      1. Remove bloatware Appx apps (keep Calculator, Notepad, Terminal + system frameworks)
      2. Dark mode + dark wallpaper
      3. Taskbar: left align, hide Search / Task View / Widgets, pin only File Explorer
      4. File Explorer: open to This PC, show file extensions
      5. Privacy & telemetry hardening
      6. Disable background apps
      7. Telemetry services + scheduled tasks
      8. Start menu: unpin all, All Apps = List view
      9. Extra "run optimally" tweaks
     10. Restart Explorer
#>

$ErrorActionPreference = 'Continue'
$log = "$env:USERPROFILE\Desktop\Setup-Windows.log"
Start-Transcript -Path $log -Force | Out-Null
Write-Host "==== Windows setup started $(Get-Date) ====" -ForegroundColor Cyan

# --- helper: set a registry value, creating the key path if needed ---
function Set-Reg {
    param([string]$Path,[string]$Name,$Value,[string]$Type = 'DWord')
    try {
        if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null }
        New-ItemProperty -Path $Path -Name $Name -Value $Value -PropertyType $Type -Force | Out-Null
    } catch {
        Write-Host "  ! Set-Reg failed: $Path\$Name -> $($_.Exception.Message)" -ForegroundColor Yellow
    }
}

#region Pre-flight: System Restore point
Write-Host "`n[*] Creating a system restore point..." -ForegroundColor Cyan
try {
    # Remove the 24h throttle so a checkpoint is always created
    New-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore' -Name 'SystemRestorePointCreationFrequency' -Value 0 -PropertyType DWord -Force | Out-Null
    Enable-ComputerRestore -Drive 'C:\' -ErrorAction SilentlyContinue
    Set-Service -Name VSS -StartupType Manual -ErrorAction SilentlyContinue
    Start-Service -Name VSS -ErrorAction SilentlyContinue
    Checkpoint-Computer -Description 'Before Windows setup script' -RestorePointType 'MODIFY_SETTINGS' -ErrorAction Stop
    Write-Host "  - Restore point 'Before Windows setup script' created." -ForegroundColor Green
} catch {
    Write-Host "  ! Could not create restore point: $($_.Exception.Message)" -ForegroundColor Yellow
    Write-Host "    Continuing anyway - you can create one manually (System Protection)." -ForegroundColor Yellow
}
#endregion

#region 0. Install applications (winget)
Write-Host "`n[0] Installing applications via winget..." -ForegroundColor Cyan
$apps = @(
    'Brave.Brave',
    'Nilesoft.Shell',
    'Notepad++.Notepad++',
    'FastStone.Viewer',
    'MPC-BE.MPC-BE'
)
foreach ($id in $apps) {
    Write-Host "  Installing $id ..." -ForegroundColor Gray
    winget install --id $id --exact --silent --accept-package-agreements --accept-source-agreements --disable-interactivity
    if ($LASTEXITCODE -eq 0) { Write-Host "  - Installed: $id" -ForegroundColor Green }
    else { Write-Host "  ! winget exit $LASTEXITCODE for $id (may already be installed)" -ForegroundColor Yellow }
}
#endregion

#region 1. Remove bloatware Appx apps
Write-Host "`n[1] Removing bloatware apps..." -ForegroundColor Cyan
$removeApps = @(
    'Clipchamp.Clipchamp','Microsoft.BingNews','Microsoft.BingSearch','Microsoft.BingWeather',
    'Microsoft.GamingApp','Microsoft.GetHelp','Microsoft.MicrosoftOfficeHub',
    'Microsoft.MicrosoftSolitaireCollection','Microsoft.MicrosoftStickyNotes','Microsoft.Paint',
    'Microsoft.PowerAutomateDesktop','Microsoft.ScreenSketch','Microsoft.StorePurchaseApp',
    'Microsoft.Todos','Microsoft.Windows.DevHome','Microsoft.Windows.Photos','Microsoft.WindowsAlarms',
    'Microsoft.WindowsCamera','Microsoft.WindowsFeedbackHub','Microsoft.WindowsSoundRecorder',
    'Microsoft.WindowsStore','Microsoft.Xbox.TCUI','Microsoft.XboxGameOverlay','Microsoft.XboxGamingOverlay',
    'Microsoft.XboxIdentityProvider','Microsoft.XboxSpeechToTextOverlay','Microsoft.YourPhone',
    'Microsoft.ZuneMusic','Microsoft.ZuneVideo','MicrosoftCorporationII.QuickAssist',
    'MicrosoftWindows.CrossDevice','Microsoft.549981C3F5F10','Microsoft.People','Microsoft.WindowsMaps',
    'microsoft.windowscommunicationsapps','Microsoft.OutlookForWindows','Microsoft.MicrosoftJournal',
    'MSTeams','MicrosoftTeams','Microsoft.Copilot'
)
# Apps we explicitly KEEP (never touch): Calculator, Notepad, Terminal, Edge, and all frameworks/runtimes.
foreach ($app in $removeApps) {
    $pkg = Get-AppxPackage -AllUsers -Name $app -ErrorAction SilentlyContinue
    if ($pkg) {
        try {
            $pkg | Remove-AppxPackage -AllUsers -ErrorAction Stop
            Write-Host "  - Removed (installed): $app" -ForegroundColor Green
        } catch {
            Write-Host "  ! Could not remove $app : $($_.Exception.Message)" -ForegroundColor Yellow
        }
    }
    $prov = Get-AppxProvisionedPackage -Online | Where-Object { $_.DisplayName -eq $app }
    if ($prov) {
        try {
            $prov | Remove-AppxProvisionedPackage -Online -ErrorAction Stop | Out-Null
            Write-Host "  - Removed (provisioned): $app" -ForegroundColor DarkGreen
        } catch {
            Write-Host "  ! Could not deprovision $app : $($_.Exception.Message)" -ForegroundColor Yellow
        }
    }
}
#endregion

#region 2. Dark mode
Write-Host "`n[2] Enabling dark mode + dark wallpaper..." -ForegroundColor Cyan
$theme = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize'
Set-Reg $theme 'AppsUseLightTheme' 0
Set-Reg $theme 'SystemUsesLightTheme' 0
# Apply the default Windows 11 dark wallpaper (img19.jpg = dark variant of the default 'bloom')
$darkWall = 'C:\Windows\Web\Wallpaper\Windows\img19.jpg'
if (Test-Path $darkWall) {
    Set-ItemProperty 'HKCU:\Control Panel\Desktop' -Name WallPaper      -Value $darkWall
    Set-ItemProperty 'HKCU:\Control Panel\Desktop' -Name WallpaperStyle -Value 10   # 10 = Fill
    Set-ItemProperty 'HKCU:\Control Panel\Desktop' -Name TileWallpaper  -Value 0
    if (-not ('WpApply' -as [type])) {
        Add-Type @"
using System.Runtime.InteropServices;
public class WpApply { [DllImport("user32.dll", SetLastError=true, CharSet=CharSet.Auto)] public static extern bool SystemParametersInfo(int a,int b,string c,int d); }
"@
    }
    [WpApply]::SystemParametersInfo(20,0,$darkWall,3) | Out-Null   # SPI_SETDESKWALLPAPER, update + broadcast
    Write-Host "  - Dark wallpaper applied" -ForegroundColor Green
} else {
    Write-Host "  ! Dark wallpaper not found at $darkWall" -ForegroundColor Yellow
}
#endregion

#region 3. Taskbar
Write-Host "`n[3] Configuring taskbar..." -ForegroundColor Cyan
$adv = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced'
Set-Reg $adv 'TaskbarAl' 0            # 0 = left align
Set-Reg $adv 'ShowTaskViewButton' 0   # hide Task View button
Set-Reg $adv 'TaskbarMn' 0            # hide Chat/Copilot button  (Widgets is disabled via the AllowNewsAndInterests policy in section 9 - the Advanced\TaskbarDa value is system-protected on 25H2 and rejects writes)
Set-Reg 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Search' 'SearchboxTaskbarMode' 0  # hide search box/icon

# Pin ONLY File Explorer to the taskbar (replace default Edge/Store pins) via Start Layout policy XML.
$cfgDir = 'C:\ProgramData\ClaudeSetup'
if (-not (Test-Path $cfgDir)) { New-Item -ItemType Directory -Path $cfgDir -Force | Out-Null }
$taskbarXml = @'
<?xml version="1.0" encoding="utf-8"?>
<LayoutModificationTemplate
    xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification"
    xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout"
    xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout"
    xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout"
    Version="1">
  <CustomTaskbarLayoutCollection PinListPlacement="Replace">
    <defaultlayout:TaskbarLayout>
      <taskbar:TaskbarPinList>
        <taskbar:DesktopApp DesktopApplicationID="Microsoft.Windows.Explorer" />
      </taskbar:TaskbarPinList>
    </defaultlayout:TaskbarLayout>
  </CustomTaskbarLayoutCollection>
</LayoutModificationTemplate>
'@
$taskbarFile = Join-Path $cfgDir 'TaskbarLayout.xml'
Set-Content -Path $taskbarFile -Value $taskbarXml -Encoding UTF8
$expPol = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer'
Set-Reg $expPol 'LockedStartLayout' 1
Set-Reg $expPol 'StartLayoutFile' $taskbarFile 'ExpandString'
#endregion

#region 4. File Explorer
Write-Host "`n[4] Configuring File Explorer..." -ForegroundColor Cyan
Set-Reg $adv 'LaunchTo' 1     # 1 = This PC
Set-Reg $adv 'HideFileExt' 0  # show file extensions
#endregion

#region 5. Privacy & telemetry
Write-Host "`n[5] Hardening privacy / disabling telemetry..." -ForegroundColor Cyan
# Diagnostic data / telemetry (Pro honours AllowTelemetry=0 = Security/Off)
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection' 'AllowTelemetry' 0
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection' 'DoNotShowFeedbackNotifications' 1
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection' 'AllowDeviceNameInTelemetry' 0
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection' 'LimitDiagnosticLogCollection' 1
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection' 'LimitDumpCollection' 1
Set-Reg 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection' 'AllowTelemetry' 0
# Advertising ID
Set-Reg 'HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo' 'Enabled' 0
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo' 'DisabledByGroupPolicy' 1
# Tailored experiences with diagnostic data
Set-Reg 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Privacy' 'TailoredExperiencesWithDiagnosticDataEnabled' 0
# Let websites access language list
Set-Reg 'HKCU:\Control Panel\International\User Profile' 'HttpAcceptLanguageOptOut' 1
# Let Windows track app launches
Set-Reg $adv 'Start_TrackProgs' 0
# Feedback frequency = never
Set-Reg 'HKCU:\Software\Microsoft\Siuf\Rules' 'NumberOfSIUFInPeriod' 0
# Speech online recognition
Set-Reg 'HKCU:\Software\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy' 'HasAccepted' 0
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization' 'AllowInputPersonalization' 0
# Inking & typing personalization
Set-Reg 'HKCU:\Software\Microsoft\InputPersonalization' 'RestrictImplicitInkCollection' 1
Set-Reg 'HKCU:\Software\Microsoft\InputPersonalization' 'RestrictImplicitTextCollection' 1
Set-Reg 'HKCU:\Software\Microsoft\InputPersonalization\TrainedDataStore' 'HarvestContacts' 0
Set-Reg 'HKCU:\Software\Microsoft\Personalization\Settings' 'AcceptedPrivacyPolicy' 0
# Activity history / Timeline
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' 'EnableActivityFeed' 0
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' 'PublishUserActivities' 0
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' 'UploadUserActivities' 0
# Location
Set-Reg 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location' 'Value' 'Deny' 'String'
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors' 'DisableLocation' 1
# Find My Device
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\FindMyDevice' 'AllowFindMyDevice' 0
# Suggested content / consumer features / Spotlight ads
$cdm = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'
foreach ($v in 'SubscribedContent-338388Enabled','SubscribedContent-338389Enabled','SubscribedContent-338393Enabled',
    'SubscribedContent-353694Enabled','SubscribedContent-353696Enabled','SubscribedContent-310093Enabled',
    'SubscribedContent-88000326Enabled','SubscribedContent-338387Enabled','SystemPaneSuggestionsEnabled',
    'SilentInstalledAppsEnabled','PreInstalledAppsEnabled','OemPreInstalledAppsEnabled','ContentDeliveryAllowed',
    'FeatureManagementEnabled','RotatingLockScreenOverlayEnabled','SubscribedContentEnabled','SoftLandingEnabled') {
    Set-Reg $cdm $v 0
}
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent' 'DisableWindowsConsumerFeatures' 1
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent' 'DisableCloudOptimizedContent' 1
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent' 'DisableSoftLanding' 1
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent' 'DisableConsumerAccountStateContent' 1
# Search: no Bing/web/cloud, no history
Set-Reg 'HKCU:\Software\Microsoft\Windows\CurrentVersion\SearchSettings' 'IsAADCloudSearchEnabled' 0
Set-Reg 'HKCU:\Software\Microsoft\Windows\CurrentVersion\SearchSettings' 'IsMSACloudSearchEnabled' 0
Set-Reg 'HKCU:\Software\Microsoft\Windows\CurrentVersion\SearchSettings' 'IsDeviceSearchHistoryEnabled' 0
Set-Reg 'HKCU:\Software\Policies\Microsoft\Windows\Explorer' 'DisableSearchBoxSuggestions' 1
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search' 'AllowCortana' 0
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search' 'ConnectedSearchUseWeb' 0
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search' 'DisableWebSearch' 1
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search' 'AllowSearchToUseLocation' 0
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search' 'AllowCloudSearch' 0
# Windows Error Reporting
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting' 'Disabled' 1
# Windows Recall / AI data analysis
Set-Reg 'HKCU:\Software\Policies\Microsoft\Windows\WindowsAI' 'DisableAIDataAnalysis' 1
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI' 'DisableAIDataAnalysis' 1
# Copilot
Set-Reg 'HKCU:\Software\Policies\Microsoft\Windows\WindowsCopilot' 'TurnOffWindowsCopilot' 1
#endregion

#region 6. Background apps
Write-Host "`n[6] Disabling background apps..." -ForegroundColor Cyan
Set-Reg 'HKCU:\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications' 'GlobalUserDisabled' 1
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy' 'LetAppsRunInBackground' 2  # 2 = Force Deny
Set-Reg 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Search' 'BackgroundAppGlobalToggle' 0
#endregion

#region 7. Telemetry services + scheduled tasks
Write-Host "`n[7] Disabling telemetry services and tasks..." -ForegroundColor Cyan
foreach ($svc in 'DiagTrack','dmwappushservice') {
    $s = Get-Service -Name $svc -ErrorAction SilentlyContinue
    if ($s) {
        try { Stop-Service -Name $svc -Force -ErrorAction SilentlyContinue } catch {}
        try { Set-Service -Name $svc -StartupType Disabled -ErrorAction Stop; Write-Host "  - Disabled service: $svc" -ForegroundColor Green } catch {}
    }
}
$tasks = @(
    '\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser',
    '\Microsoft\Windows\Application Experience\ProgramDataUpdater',
    '\Microsoft\Windows\Application Experience\StartupAppTask',
    '\Microsoft\Windows\Customer Experience Improvement Program\Consolidator',
    '\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip',
    '\Microsoft\Windows\Autochk\Proxy',
    '\Microsoft\Windows\Feedback\Siuf\DmClient',
    '\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload'
)
foreach ($t in $tasks) {
    $name = Split-Path $t -Leaf
    $path = (Split-Path $t -Parent) + '\'
    try {
        Disable-ScheduledTask -TaskName $name -TaskPath $path -ErrorAction Stop | Out-Null
        Write-Host "  - Disabled task: $t" -ForegroundColor Green
    } catch {}
}
#endregion

#region 8. Start menu (unpin all + All Apps = List)
Write-Host "`n[8] Configuring Start menu..." -ForegroundColor Cyan
# Unpin all pinned items via the 25H2 "Configure Start Pins" policy (empty list, applyOnce so user can re-pin)
$startJson = '{ "applyOnce": true, "pinnedList": [] }'
$startFile = Join-Path $cfgDir 'StartPins.json'
Set-Content -Path $startFile -Value $startJson -Encoding UTF8
Set-Reg $expPol 'ConfigureStartPins' 1
Set-Reg $expPol 'ConfigureStartPinsJSON' $startFile 'ExpandString'
# All Apps view = List  (0 = Category, 1 = Grid, 2 = List)
Set-Reg 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Start' 'AllAppsViewMode' 2
# Hide Start "Recommended" recommendations / tips
Set-Reg $adv 'Start_IrisRecommendations' 0
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer' 'HideRecommendedSection' 1
Set-Reg 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' 'Start_Layout' 1
#endregion

#region 9. Extra optimal tweaks
Write-Host "`n[9] Applying extra tweaks..." -ForegroundColor Cyan
# Disable News & Interests / Widgets feature at machine level
Set-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Dsh' 'AllowNewsAndInterests' 0
# Enable 'End Task' on taskbar right-click (handy for power users)
Set-Reg 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\TaskbarDeveloperSettings' 'TaskbarEndTask' 1
# Lock screen: disable Windows spotlight 'fun facts/tips'
Set-Reg 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' 'RotatingLockScreenEnabled' 0
#endregion

#region 10. Restart Explorer
Write-Host "`n[10] Restarting Explorer to apply changes..." -ForegroundColor Cyan
Stop-Process -Name explorer -Force -ErrorAction SilentlyContinue
Start-Sleep -Seconds 2
if (-not (Get-Process -Name explorer -ErrorAction SilentlyContinue)) { Start-Process explorer.exe }
#endregion

Write-Host "`n==== Windows setup finished $(Get-Date) ====" -ForegroundColor Cyan
Stop-Transcript | Out-Null

Once the file is saved, open an admin terminal (right-click Start > Terminal (Admin)) and run it with this command, replacing the path with wherever you saved the file:

powershell.exe -ExecutionPolicy Bypass -File "C:\Users\YourName\Desktop\Setup-Windows.ps1"

On a second, completely fresh install, that script took the machine from default to exactly how I like it in about five minutes. It created the restore point, installed the apps, removed the bloatware, and applied every customization in quick succession. The result is predictable: you know precisely what state the machine will be in when it finishes.

What Didn’t Work (and What I Fixed)

No automation is perfect, and being honest about the gaps is the whole point of a test like this. Three things needed correcting:

• All Apps view: Claude set the registry value for list view, but Windows kept showing the grid until the value was corrected. I had it fix this at the root in the script so I never have to set it manually.
• A taskbar registry value: one taskbar write did not stick because that value is system-protected on 25H2, so I had Claude remove the broken line and hide Widgets through a policy instead.
• Microsoft Edge: Edge was not removed in this session — it is deeply integrated and resists command-line removal. If you want it gone, see my guide on how to uninstall Microsoft Edge.

A Simpler Way to Debloat Windows (No AI Required)

If handing system control to an AI sounds like more risk than you want, you do not need Claude Code to get a clean, debloated Windows install. I build two free tools that do this safely and predictably.

Winhance is my Windows enhancement utility — a point-and-click app that debloats, optimizes, and customizes Windows 10 and 11, with changes that are easy to reverse. It covers most of what I asked Claude to do here, but through a GUI and without running unsupervised commands. For the install side, UnattendedWinstall lets you automate the Windows installation itself with an answer file, so the machine arrives debloated from first boot.

Going Further: AI for PC Maintenance

Setting up a fresh install is only the beginning. The same approach — an AI command-line tool that can run commands and read its own output — could run diagnostics, dig through Event Viewer logs, or handle routine maintenance on a machine. Claude Code is one option for this; OpenCode is an open-source command-line tool that works in a similar way if you prefer an alternative.

Frequently Asked Questions

Is it safe to let Claude Code control Windows?

Only in a controlled environment. Run it inside a virtual machine, not on your main PC, and always have it create a restore point first. Bypass-permissions mode lets the AI execute system commands without asking each time, which is convenient but means you should never point it at a machine with data or settings you cannot afford to lose.

Do I need to know PowerShell to do this?

No. You describe what you want in plain English and Claude writes and runs the PowerShell for you. That said, you should still review the script it produces before running it on a real machine, so you understand what each section changes.

What does “bypass permissions” do in Claude Code?

It tells Claude Code to run commands automatically without prompting you to approve each one. It makes a start-to-finish setup possible without babysitting every step, but it also removes your chance to stop a command before it runs — which is exactly why it belongs in a virtual machine.

Can I reuse the setup on other PCs?

Yes — that is the main benefit. Claude saves the entire configuration as a single PowerShell script. Copy that script to any fresh Windows install, run it from an admin terminal, and it reproduces the same apps, removals, and tweaks in a few minutes without needing the AI again.

Is there a way to debloat Windows without using AI?

Absolutely. Winhance gives you a GUI to debloat, optimize, and customize Windows with reversible changes, and UnattendedWinstall automates the install itself with an answer file. If you prefer Microsoft’s built-in approach, the official Windows 11 25H2 bloatware removal method works without any third-party tools.

This post I Let Claude Take FULL Control of a Fresh Windows 11 PC (Debloat + Setup) first appeared on Memory's Tech Tips and is written by memory

Winhance Release 26 rebuilds the Software & Apps section around a new card view that gives every app a real icon, so you can see exactly what you are removing at a glance. This release also adds system instability warnings for risky removals, a system restore point toggle, an App Installer entry for updating WinGet, and a fix for the refresh button that used to hang.

Applies to: Windows 10 (22H2) and Windows 11 (23H2, 24H2, 25H2) | Last updated: May 22, 2026

Key Takeaways

• The Software & Apps section now has three view modes — card, table, and compact — and the new card view is the default in Release 26.
• Every app now shows its real icon, sourced from your installed apps, the Microsoft Store, or the app’s official site, and cached to disk after a one-time download.
• Microsoft Edge and the App Installer now show an instability warning before removal, because a small number of systems can become unstable without them.
• A new system restore point toggle in the Optimize section lets Windows create automatic restore points for the C drive, so you can roll back changes if something goes wrong.
• The refresh button bug is fixed — it no longer hangs indefinitely on “refreshing installation status.”

Quick Steps — Get Release 26:

1. Download the latest installer from winhance.net, or run the install command below in PowerShell.
2. Run Winhance.Installer.exe and pick the Installable or Portable version during setup.
3. Open the Software & Apps section to see the new card view.
4. Switch between card, table, and compact views at any time using the view buttons.
5. Check the GitHub release page for the complete list of fixes.

The New Card View: Three Ways to See Your Apps

Release 26 adds a card view to both the Windows Apps & Features list and the External Software list in Winhance, my free Windows enhancement utility. The Software & Apps section now has three layouts in total: card view, table view, and compact view. The card view is the default going forward.

If you have used Winhance before, you will recognize the compact view — the dense text-row layout from earlier releases. That layout is still available, so nothing is taken away from you. If you prefer the compact rows or the table, switch to them with the view buttons and Winhance will keep showing them.

The reason for the change is readability. The compact view identified each item by name only, which made it harder to tell at a glance what you were about to remove. The card view gives each app room for an icon, a short description, and its status badges, so the whole list is easier to scan. Whichever view you pick, every item shows the same information — the choice is purely personal preference.

App Icons: A Real Picture for Every App

Every app in the Software & Apps section now shows its real icon. This applies to both the Windows Apps & Features list and the External Software list. A visual cue like the actual app icon makes it much faster to recognize what an item is, instead of reading down a column of names.

Winhance gets these icons from a few different sources depending on the app:

• Installed apps — the icon is read from the app already installed on your PC. These items also show an Installed badge.
• Apps that are not installed — for items like the 3D Viewer or Copilot that are not present on your system, the icon is downloaded once from the Microsoft Store, which stores that information.
• External software — icons come from Wikimedia or from the app’s own website or distribution platform.

These downloads only ever happen once. After the first fetch, each icon is saved to disk as part of the Winhance program data. The next time you launch Winhance, it loads the icons straight from your disk instead of downloading them again.

The App Installer Entry: Update WinGet From Inside Winhance

Release 26 adds a new App Installer item to the Windows Apps & Features list. The App Installer is Microsoft’s MSIX/AppX installer, and WinGet — the Windows package manager — is part of it. Adding it to Winhance gives you a way to install or update the App Installer package on both Windows 10 and Windows 11.

If you ever need to update WinGet itself, you can now do that through Winhance. Select the App Installer item and choose to install it. In most cases you would not want to uninstall the App Installer, but it remains possible to do so if you have a specific reason.

Instability Warnings and the New “Permanent” Badge

Some packages are riskier to remove than others. In Release 26, the App Installer and Microsoft Edge both display a warning label stating that removing the package may cause system instability. This was requested by people in the community.

To be clear about what the warning means: the majority of people will not see any instability after removing Microsoft Edge. But it is true that some systems do experience problems, so the warning exists to let you make that decision with the full picture before you click. Most other apps in the list do not need a warning, because they can simply be reinstalled if you change your mind.

Warning: If you remove Microsoft Edge or the App Installer, do it knowing that a small number of systems can become unstable. If you are setting up a machine for someone else, weigh that risk before you ship it.

Some items genuinely cannot be brought back. Those now carry a Permanent badge. In earlier releases this badge said “not reinstallable,” but that wording did not fit on a badge, so it is now a single word. If an item has the Permanent removal badge, you cannot reinstall it once it has been uninstalled — the only way to get it back is a clean install of Windows.

Updated Status Indicators Across Every View

The installation status indicator has changed. The old green ellipse is now a desktop tower icon — green when an item is installed, and grayed out when it is not. The warning icon and the installable-versus-permanent indicators also appear in the table view and the compact view, not just the card view.

The point of that consistency is simple: it does not matter which view you use. Card, table, or compact, you get the same information for every item — whether it is installed, whether it carries a warning, and whether removal is permanent.

Optimize and Customize: Restore Points, Graphics, DNS, and AutoPlay

Release 26 also brings several changes to the Optimize and Customize sections, and most of them came directly from requests on GitHub.

System Restore Point Toggle

The Gaming and Performance area of the Optimize section now has a system protection toggle for restore points. When enabled, it allows Windows to automatically create restore points for the C drive, which makes it possible to undo system changes if something goes wrong. The toggle applies to the C drive specifically, and all it does is enable or disable system restore on that drive.

Tip: Turn this toggle on before you make a batch of system changes. If a tweak causes a problem, a restore point gives you a clean way back.

MPO and Hardware Overlay Settings Split

In the Graphics part of the Optimize section, the Multi-Plane Overlay (MPO) and hardware overlay settings used to share combined registry entries. Release 26 splits them into two separate settings so you have more granular control over each one. These settings are the ones people often disable when they run into flickering or black-screen issues on certain multi-monitor setups, and separating them means you can target the exact one you need.

DNS over HTTPS Entries

The DNS server selection setting in the Network section now includes DNS over HTTPS entries. These were missing in earlier releases, so if you want an encrypted DNS option, you can now select it directly in Winhance.

AutoPlay Toggle

Over in the Customize section, under Explorer and the Devices and Peripherals area, there is a new AutoPlay toggle. AutoPlay is the Windows feature that opens a dialog or runs programs automatically when you insert a USB drive, DVD, or SD card. It is on by default in Windows, and I recommend leaving it on for most people.

Someone requested a way to turn it off, usually for security reasons — disabling AutoPlay stops a program from running automatically off an untrusted USB drive. If that is you, you can now disable AutoPlay from inside Winhance.

Bug Fixes in Release 26

A few visible bugs are fixed in this release. In the Windows Apps & Features section, the refresh button used to hang indefinitely — it would get stuck on “refreshing installation status” and never finish. In my testing, that is fixed, and the refresh now completes the task properly.

There were also fixes behind the scenes. One bug affected external software: some items were not detected as installed even though they were. This happened specifically when you installed an item from the Microsoft Store and then launched Winhance — it would not show as installed. That is fixed, along with a number of smaller inconsistencies.

If you want the exact, complete list of what changed, the Winhance GitHub releases page has the full changelog for every release. For context on how the project has grown, you can also look back at the previous Winhance update and the Release 24 settings update.

How to Update to Winhance Release 26

Winhance is free, and updating is the same as installing it. Download the latest Winhance.Installer.exe from winhance.net, or paste this command into PowerShell to download and run the installer automatically:

irm "https://get.winhance.net" | iex

The installer lets you choose between an Installable version and a Portable version during setup. Once it is done, open the Software & Apps section and you will land straight in the new card view. Watch the full walkthrough above to see every change in action.

Almost every change in Release 26 came from a GitHub request or a bug report — the warnings, the restore point toggle, the DNS over HTTPS entries, and the AutoPlay toggle were all community asks. If there is something you would like to see in Winhance, reporting a bug or suggesting a feature on GitHub is the way it gets onto the list.

Frequently Asked Questions

Is Winhance free?

Yes. Winhance is completely free to download and use. You can get it from winhance.net or install it through the PowerShell command above. If you find it useful, there is an optional support dialog inside the app, but nothing is locked behind it.

How do I update to Winhance Release 26?

Updating Winhance means running the latest installer. Download Winhance.Installer.exe from winhance.net, or run irm "https://get.winhance.net" | iex in PowerShell. There is no separate update step — installing the new version replaces the old one.

Can I still use the old compact view?

Yes. The compact view and the table view are both still available in Release 26. The card view is the new default, but you can switch back to either of the other layouts at any time using the view buttons, and Winhance will keep your choice.

Is it safe to remove Microsoft Edge with Winhance?

For most systems, removing Microsoft Edge causes no problems. A small number of systems can experience instability without it, which is why Release 26 adds a warning label on Edge before you remove it. If you are unsure, leave Edge in place — and remember that Edge can be reinstalled, unlike items that carry the Permanent badge.

Does Winhance work on Windows 10?

Yes. Winhance works on both Windows 10 and Windows 11. The new App Installer entry in Release 26 also lets you install or update the App Installer package and WinGet on either version of Windows.

This post What’s NEW in Winhance Release 26 — Card View, App Icons & More first appeared on Memory's Tech Tips and is written by memory

These seven PowerShell commands cover the things most Windows users end up needing — full system specs, bulk app updates, killing runaway processes, removing Microsoft bloatware, restarting the print spooler, checking active network connections, and chaining DISM with SFC and an automatic restart. Every command works on Windows 10 and Windows 11 with the built-in Windows PowerShell 5.1 — no install, no PowerShell 7 required.

Applies to: Windows 10 (22H2) and Windows 11 (23H2, 24H2, 25H2) | Last updated: May 13, 2026

Key Takeaways

• Get-ComputerInfo returns full system specs (CPU, RAM, BIOS, Windows edition, install date) without installing a third-party tool.
• winget upgrade –all –accept-package-agreements –accept-source-agreements updates every winget-managed app on the system in one command, with no Y/N prompts.
• Get-Process | Sort-Object CPU -Descending | Select-Object -First 5 shows the top five CPU hogs even when Task Manager is too slow to open.
• Get-AppxPackage piped to Remove-AppxPackage removes built-in Microsoft apps (including the Microsoft Store) that the Settings app refuses to uninstall.
• Restart-Service spooler restarts the print spooler in one line — much faster than opening the Services panel.
• Get-NetTCPConnection -State Established and netstat -nob together show every active network connection and which app owns it — useful for privacy checks and malware detection.
• Chaining commands with semicolons (DISM ; SFC ; shutdown /r /t 0) runs DISM, then SFC, then auto-restarts the PC — no manual steps between each phase.

Quick Steps

1. Right-click the Start button and pick Terminal (Admin) on Windows 11, or search for Windows PowerShell and run as administrator on Windows 10.
2. Run Get-ComputerInfo for full system specs.
3. Run winget upgrade --all --accept-package-agreements --accept-source-agreements to update everything at once.
4. Run Get-Process | Sort-Object CPU -Descending | Select-Object -First 5 to find the top CPU consumers, then Stop-Process -Name "ProcessName" to kill one.
5. Run Get-AppxPackage -Name "Microsoft.WindowsStore" | Remove-AppxPackage to uninstall built-in apps Settings won’t remove.
6. Run Restart-Service spooler to fix print spooler problems instantly.
7. Run Get-NetTCPConnection -State Established and netstat -nob to see every active network connection and which app owns it.
8. Chain DISM, SFC, and a restart in one shot: DISM /Online /Cleanup-Image /RestoreHealth ; SFC /scannow ; shutdown /r /t 0.

A Quick Note on PowerShell 5.1 vs PowerShell 7

Windows 10 and Windows 11 both ship with Windows PowerShell 5.1 built in. Every command in this guide runs in that version — you do not need to install PowerShell 7. PowerShell 7+ is a newer, cross-platform release of the same shell, and it is worth having for advanced scripting, but it is a separate install.

If you do want PowerShell 7, the official Microsoft documentation on installing PowerShell on Windows walks through the supported install methods, and the latest builds live on the PowerShell GitHub releases page. For everything below, the built-in shell is enough.

How to Open Windows PowerShell as Administrator

On Windows 11, right-click the Start button and choose Terminal (Admin). Windows Terminal opens to a Windows PowerShell tab by default, already elevated. On Windows 10, search for Windows PowerShell in the Start menu (not Windows PowerShell ISE), right-click it, and pick Run as administrator.

If you don’t see Terminal or PowerShell in the Start button menu, the search method works on every supported version of Windows 10 and Windows 11. Hold Ctrl and scroll up on the mouse wheel inside the window to enlarge the font — small thing, but it makes a real difference if you’re working through a long output.

Command 1: Get-ComputerInfo — Full System Specs in One Line

When you need a full breakdown of a PC — CPU, RAM, BIOS version, Windows edition, install date, OS language, architecture — and you don’t want to install Speccy or another third-party tool, run this:

Get-ComputerInfo

The command dumps everything in one long block. You’ll see the Windows Edition ID (Professional, Home, Enterprise), the OS display version (e.g. 25H2), BIOS information, OS architecture (64-bit or 32-bit), and the OS language. On a virtual machine you’ll see VM-reported hardware; on bare metal you’ll see the real CPU and motherboard details.

Tip: The output is long. Pipe it into more (Get-ComputerInfo | more) to page through it, or filter to specific properties — for example Get-ComputerInfo | Select-Object OsName, OsVersion, CsTotalPhysicalMemory — when you only want a few fields.

Command 2: winget upgrade — Update Every App Without the Prompts

winget is Microsoft’s built-in package manager — it ships pre-installed and works out of the box on Windows 11. To list every app on the system that has a winget update available:

winget upgrade

That just shows the list. To actually install all of them in one shot, with no Y/N prompts, run:

winget upgrade --all --accept-package-agreements --accept-source-agreements

The two --accept flags are what make this hands-off. Without them, winget pauses at every package and waits for you to type Y. With them, it just downloads and installs the lot one after another, and reports back when it is done.

Note: winget only updates apps that exist in the winget repository. Anything you installed manually from a vendor’s site that isn’t in winget will be invisible to this command. On a fresh Windows 10 install, winget may not be present yet — Windows 11 has it ready by default.

Command 3: Find the Top CPU Hogs (and Kill One) Without Task Manager

When the PC is so slow that Task Manager won’t even open, PowerShell can still tell you what is eating the CPU. This command grabs every process, sorts by CPU usage descending, and shows the top five:

Get-Process | Sort-Object CPU -Descending | Select-Object -First 5

Once you have a process name from that output, end it without going anywhere near Task Manager:

Stop-Process -Name "msedge"

Replace msedge with the process name shown by Get-Process. Run the get-process command again afterwards to confirm it is gone. In a computer repair context this combination is gold — when a system is so loaded that the GUI is unresponsive, you can still free resources from the shell.

Command 4: Remove Built-in Microsoft Apps (Even the Ones Settings Won’t Touch)

The Microsoft Store, Xbox Game Bar, and several other built-in apps don’t expose an Uninstall option in Settings > Apps > Installed apps. PowerShell does. First, find the exact package name with a wildcard search — the example below looks for anything with “store” in the name:

Get-AppxPackage -Name "*store*"

That returns full package details for every match. Copy the exact Name field of the package you want to remove (for example Microsoft.WindowsStore), then pipe it into Remove-AppxPackage:

Get-AppxPackage -Name "Microsoft.WindowsStore" | Remove-AppxPackage

That removes the package for the current user. To remove it for every user account on the machine, add -AllUsers:

Get-AppxPackage -Name "Microsoft.WindowsStore" -AllUsers | Remove-AppxPackage -AllUsers

Heads-up: Some system packages are protected and won’t remove no matter what. If a removal fails, leave that one alone — forcing it usually breaks more than it fixes. The Store example above is for demonstration; do not uninstall the Microsoft Store unless you have a specific reason and know how to get it back.

This is exactly how debloating tools work under the hood — they build a list of package names and run the same Get-AppxPackage / Remove-AppxPackage pair against each one. If you’d rather not type these out for every app you want gone, my Winhance app wraps this whole process in a UI, with the option to keep removed apps from coming back after Windows updates. There’s also a written walkthrough of removing Windows bloatware without third-party software if you want to stay fully manual.

Command 5: Restart-Service spooler — Fix Printer Problems in One Line

Anyone who has supported printers knows the routine: search for “services,” wait for the Services panel to open, scroll to Print Spooler, right-click, restart. PowerShell collapses all of that into:

Restart-Service spooler

It runs silently — no confirmation message — so to verify the service came back up, check its state:

Get-Service spooler

If a print job is stuck in the queue, restarting alone usually isn’t enough — you need to stop the spooler, clear the stuck jobs from C:\Windows\System32\spool\PRINTERS, then start it again:

Stop-Service spooler
# clear stuck files in C:\Windows\System32\spool\PRINTERS
Start-Service spooler

The same Get-Service, Restart-Service, Stop-Service, and Start-Service cmdlets work for any Windows service — replace spooler with the service name. Hours of repair-shop time would have been saved if I’d known about these earlier.

Command 6: See Every Active Network Connection and Who Owns It

For privacy checks, malware investigation, or just curiosity about what your PC is talking to, this PowerShell-native command lists every established TCP connection along with the local and remote address, ports, and the owning process ID:

Get-NetTCPConnection -State Established

That gives you process IDs, but not the friendly app name. The older netstat command fills that gap — run it alongside the PowerShell version to see exactly which executable owns each connection:

netstat -nob

The -nob flags display addresses numerically and show the owning executable for each connection. You’ll see entries like msedge.exe, svchost.exe, and the start menu host process, each tied to specific connections. For some lower-level connections Windows may not surface the owning process — that’s normal and not a sign of anything wrong.

Used together, these two commands are pure gold for diagnosing whether a system is reaching out to anything it shouldn’t. If you suspect malware, pair them with the steps in my Windows troubleshooting guide and a full system scan.

Command 7: Chain DISM, SFC, and an Auto-Restart in One Shot

The classic Windows repair flow is well known: run DISM to repair the component store, then run SFC to repair system files using that good source, then restart. The annoying part is that you have to babysit it — wait for DISM to finish, run SFC, wait again, then remember to restart.

You can chain all three with semicolons in PowerShell so the next command runs automatically as soon as the previous one finishes:

DISM /Online /Cleanup-Image /RestoreHealth ; SFC /scannow ; shutdown /r /t 30

The ; tells PowerShell “when this command finishes, run the next one.” DISM goes first because it repairs the source files SFC pulls from. SFC then uses that repaired source to fix damaged system files. Once both finish, shutdown /r /t 30 reboots the PC after a 30-second countdown so you can read the scan results before the restart.

Set the /t value to whatever fits your workflow:

• /t 0 — restart immediately when both scans finish
• /t 30 — 30-second window to glance at the scan output
• /t 300 — five-minute window if you want to read the full SFC report

If you’d rather kick off the chain and walk away, /t 0 is the cleanest option. For a deeper walkthrough on what these commands actually fix, see my guide on fixing the Blue Screen of Death on Windows 10 and 11, which uses the same DISM and SFC flow.

Want a UI Instead of Typing Commands?

If the bloatware-removal command is what you came for and you’d rather not maintain a list of package names by hand, my free open-source app Winhance handles it at scale through a proper interface. You can pick which apps to remove, save the removal scripts so apps stay gone after Windows updates reinstall them, and apply optimizations the same way. The full project (and downloads) lives at winhance.net.

For a broader collection of “every Windows user should know” tools that pair well with these PowerShell commands, my PowerToys guide covers Microsoft’s official utility set — different category, similar spirit.

Frequently Asked Questions

Do I need PowerShell 7 to run these commands?

No. Every command in this guide runs in Windows PowerShell 5.1, which is built into Windows 10 and Windows 11 by default. PowerShell 7 is a newer cross-platform release and worth installing for advanced scripting, but it is not required for any of these commands.

Why does Stop-Process or Remove-AppxPackage say “access denied”?

You’re running PowerShell as a standard user. Both commands need elevated rights. Close the window, right-click the Start button on Windows 11 and pick Terminal (Admin), or right-click Windows PowerShell in the Start menu on Windows 10 and pick Run as administrator.

Can I undo Remove-AppxPackage if I uninstalled the wrong app?

Most built-in apps can be reinstalled from the Microsoft Store. The Microsoft Store itself is the trickiest case — if you removed it, the recovery path is documented in my guide on reinstalling the Microsoft Store on Windows 10 and 11. Always test removal commands on a virtual machine or a non-critical install first.

Does winget upgrade –all update everything on my PC?

It updates every app that has a winget package and an available newer version. Apps you installed by downloading an installer from the vendor’s website are not tracked by winget unless they ship a winget package, so those won’t be updated by this command. For Windows itself, use Windows Update — winget does not handle OS updates.

Is it safe to chain DISM, SFC, and a restart in one command?

Yes. The semicolon chain runs each command sequentially — the next one only starts when the previous one exits cleanly. DISM and SFC are Microsoft’s own repair tools, designed to be run together in this exact order. The auto-restart at the end simply applies any fixes that need a reboot, which is the same step you’d run manually.

This post 7 PowerShell Commands EVERY Windows User Should Know! first appeared on Memory's Tech Tips and is written by memory

Rufus and Ventoy both create bootable USB flash drives, but they solve different problems. Use Rufus when you need a single-purpose Windows installer with a customized setup experience (skip Microsoft account, remove Copilot, automate the install). Use Ventoy when you want one USB drive that holds multiple ISOs — Windows, Linux, Hiren’s Boot CD — and boots in both UEFI and Legacy/CSM modes. The honest answer for most repair and IT work is to use both.

Applies to: Windows 10 (22H2) and Windows 11 (23H2, 24H2, 25H2) | Last updated: May 7, 2026

Key Takeaways

• Rufus is single-purpose, Ventoy is multi-purpose — Rufus flashes one ISO to one USB drive; Ventoy turns the USB into a container that holds many ISOs you can pick from at boot
• Ventoy boots both UEFI and Legacy/CSM from the same drive — Rufus forces you to pick UEFI or CSM at creation time; Ventoy shows both options at boot from a single USB
• Rufus has built-in Windows customization — version 4.14 can skip the Microsoft account, disable BitLocker auto-encryption, remove Copilot/OneDrive/Outlook, and silently wipe the disk during install
• Ventoy can match those customizations using an autounattend XML file — drop the answer file next to the ISO on the Ventoy partition and it applies during install
• Use Rufus for repeatable single-PC installs, use Ventoy as your everyday IT toolbox — most repair work needs both

Quick Steps:

1. Pick Rufus if you need to install a single Windows version with custom setup options on one machine
2. Pick Ventoy if you want one USB drive that boots multiple ISOs (Windows, Linux, recovery tools)
3. For Rufus, select your USB drive, click Select, choose your ISO, set partition scheme (GPT for UEFI, MBR for CSM), and start
4. For Ventoy, select your USB drive and click Install — it formats the drive and creates the Ventoy boot partition
5. Copy any ISOs you want directly onto the Ventoy partition; pick which one to boot at startup
6. To get Rufus-style customization on Ventoy, place an autounattend.xml answer file alongside your Windows ISO on the drive

What’s the Difference Between Rufus and Ventoy?

For 10 years I co-owned and ran a computer repair business, and I used Rufus and Ventoy every single day — but for completely different jobs. The two tools both create bootable USB flash drives, and that surface-level overlap is what confuses people. They are not trying to do the same thing.

Rufus takes one ISO file and burns it onto one USB drive. That drive then has exactly one purpose — boot the operating system or recovery tool you flashed onto it. If you want a different ISO on that drive, you have to wipe it and start over.

Ventoy works completely differently. It installs a small bootloader onto the USB drive, and that bootloader can boot any ISO file you copy onto the drive afterwards. You drag a Windows 11 ISO, a Linux ISO, and a Hiren’s Boot CD onto the same drive, and at boot time you pick which one to launch. The drive becomes a toolbox instead of a single-purpose installer.

Both tools are free and open source, and both have download links you can grab right now:

• Download Rufus from the official Rufus website
• Download Ventoy from the official Ventoy website or the Ventoy GitHub releases page (I find the GitHub page easier to navigate)

UEFI vs Legacy/CSM: The Boot Mode Difference That Matters

This is one of the most important differentiators between Rufus and Ventoy, and it catches a lot of people out when they are trying to install Windows on an older machine.

UEFI is the modern firmware standard your motherboard uses to boot. CSM (Compatibility Support Module), also called Legacy Boot, is the older BIOS-style boot mode. Plenty of older machines in businesses still rely on CSM, so it is far from extinct.

With Rufus, you commit to one or the other at creation time. If you set the partition scheme to GPT, the target system can only be UEFI. Switch to MBR and you unlock the BIOS or UEFI-CSM option. The tooltip in Rufus is explicit about this — selecting BIOS/UEFI-CSM means the device will only boot in BIOS emulation mode, not native UEFI. So if you make a Rufus drive for a UEFI machine and then need to install Windows on a Legacy/CSM machine, that drive will not work — you have to remake it.

Ventoy handles both from a single drive. The same Ventoy USB stick boots in UEFI mode and Legacy/CSM mode. When you select a boot device on the target machine, you will see two Ventoy entries — one for each mode. Pick whichever your target machine needs. This is huge if you service a mix of old and new hardware.

Tip: If you are not sure whether the target machine is UEFI or Legacy, Ventoy is the safer choice — it removes the guesswork because the same drive boots both ways.

Why People Love Rufus: Windows Customization Built In

Rufus’s biggest strength is what happens after you click Select on a Windows ISO. The Windows User Experience dialog gives you a checklist of customizations that get baked into the installer:

• Remove Windows 11 hardware requirements — bypass the TPM, Secure Boot, and RAM checks
• Remove the Microsoft account requirement — note: your network must be disconnected during installation for this to work, which Rufus tells you when you hover the option
• Skip the entire account creation — provide a username and Windows logs straight in after install
• Set regional options to match the machine you are creating the drive on
• Disable data collection — skips the privacy questions during the OOBE
• Disable BitLocker automatic device encryption
• Quality of life improvements (Rufus 4.14) — uninstalls Copilot, OneDrive, and Outlook and disables most of the unwanted features Microsoft pushes during setup
• Silently erase the disk and install a specific Windows version

If you want a deeper walkthrough of every option in this dialog, I covered the full Rufus 4.14 update in my previous post on the Rufus update for Windows 11 with free customizations.

Working in IT or a repair business means installing Windows on a lot of machines, and clicking through the same setup screens on 10 different computers a day will drive you insane. Rufus fixes that. The customizations save real time and stop you from making mistakes when you are tired. This is its biggest strength — for a targeted install on a single PC where rinse-and-repeat is the workflow, Rufus is hard to beat.

Why Ventoy Is My Daily-Driver USB

Ventoy installs in seconds. Select your USB drive in the Ventoy app, click Install, accept the format prompt, and the tool wipes the drive and writes its bootloader. After it finishes, your drive will have two partitions — a small Ventoy EFI partition (the boot partition for UEFI) and a larger Ventoy partition where you copy your files.

Open This PC, double-click the Ventoy drive, and copy any ISO files you want onto it — Windows 10, Windows 11, Linux distros, Hiren’s Boot CD, recovery tools, anything. The drive will hold as many ISOs as it has space for.

When you boot from the Ventoy drive, you will see two boot entries (UEFI and Legacy/CSM). Pick the one your target machine supports, and Ventoy presents a menu of every ISO on the drive. Pick the one you want and it boots straight into that installer or live environment.

The Ventoy partition is also a regular drive — you can drop installers, scripts, repair utilities, or any other files alongside the ISOs. In my repair business, I always carried a Ventoy drive when I went to clients because I had every tool I needed in one device. For a complete walkthrough on building a recovery-focused Ventoy drive, see my Ventoy USB rescue disk guide.

How to Get Rufus-Style Customization on Ventoy

Out of the box, Ventoy does not offer the customization checkbox dialog that Rufus has. But the underlying mechanism Rufus uses is the same one you can use on Ventoy — an autounattend.xml answer file. Rufus writes one for you based on the boxes you tick. With Ventoy, you write the file yourself and place it on the drive.

You have several ways to generate that answer file:

• UnattendedWinstall — my own pre-configured autounattend.xml project. Drop it on the drive and it applies a curated set of debloat and personalization tweaks during install
• Winhance WIM Utility — under Advanced Tools in Winhance, the Windows Installation Media Utility generates an autounattend file based on your current Winhance selections. The feature is basic at the time of this writing, but I am actively working on expanding it
• Schneegans Windows unattended generator — the Schneegans unattend-generator is a free web tool with the most settings of any generator I have seen. It is the most flexible option if you want fine-grained control
• An AI assistant — Claude, ChatGPT, or Gemini can write an autounattend.xml for you if you describe what you want. If you go this route, expect some back-and-forth troubleshooting; the XML schema is unforgiving

For a deep dive on the answer-file format and what every section does, read my full Windows answer file guide for debloating and optimizing your installation.

The exact procedure for placing the autounattend.xml on a Ventoy drive (and a few gotchas around file naming and folder structure) is covered in this walkthrough — the dedicated Ventoy section is in the second half:

Other approaches I have covered in dedicated tutorials on the UnattendedWinstall GitHub page include creating a customized bootable Rufus drive (see my Rufus bootable USB guide for Windows 11), building a custom ISO with AnyBurn (anyburn.com), and the Ventoy auto-install plugin.

When to Choose Rufus vs Ventoy

Use Rufus when:

• You are installing one specific Windows version on one specific machine
• You want the customization options without writing an answer file yourself
• You know which boot mode (UEFI or CSM) the target machine uses
• You are setting up a fleet of similar machines with identical settings

Use Ventoy when:

• You service a mix of hardware and want one drive that boots everything
• You need both UEFI and Legacy/CSM support from the same USB
• You want to carry multiple recovery and install tools on a single device
• You are willing to pair it with an autounattend.xml for Windows customization

For most of the work I did in the repair shop, the answer was both. Rufus came out for one-off, single-machine Windows installs where the customization checklist saved time. Ventoy lived in my pocket for everything else — house calls, mixed-hardware environments, and any job where I did not know exactly what I would need until I got there.

Frequently Asked Questions

Is Rufus or Ventoy better for installing Windows 11?

For a single Windows 11 install on a known machine, Rufus is faster because the built-in Windows User Experience options (skip Microsoft account, remove Copilot, disable BitLocker) are one-click. For a USB drive that has to install Windows 11 on multiple different machines or sit alongside Linux ISOs and recovery tools, Ventoy is better. Many repair techs use Rufus for targeted installs and Ventoy as their everyday toolbox.

Can a Ventoy USB boot in both UEFI and Legacy/CSM modes?

Yes. A single Ventoy drive supports both UEFI and Legacy/CSM boot from the same partition layout. When you bring up the boot menu on a target machine, you will see two Ventoy entries — pick whichever matches the firmware mode the machine uses. Rufus does not do this — it forces you to choose UEFI or CSM at creation time.

Can I customize Windows installation with Ventoy like Rufus does?

Yes, by adding an autounattend.xml answer file alongside your Windows ISO on the Ventoy drive. Rufus generates this file for you behind the scenes; with Ventoy you supply your own. The easiest options are UnattendedWinstall for a pre-configured file, the Winhance WIM Utility for a Winhance-flavored file, or the Schneegans unattend-generator for full control.

Will Ventoy erase everything on my USB drive?

Yes — installing Ventoy formats the entire drive and creates two new partitions (Ventoy and Ventoy EFI). Back up anything important on that USB before installing. After Ventoy is installed, copying ISOs to the drive is non-destructive — you can add and remove ISOs freely without re-running the installer.

Are Rufus and Ventoy free?

Both are free and open source. Rufus is available from rufus.ie and Ventoy from the official Ventoy site or the Ventoy GitHub releases page. Neither has a paid tier or in-app purchases.

This post Rufus vs Ventoy: When to Use Each for Bootable USB Drives first appeared on Memory's Tech Tips and is written by memory

Rufus 4.14 (currently in beta) adds new built-in customizations that let you remove Windows 11 bloat, disable Copilot and OneDrive, and skip the Microsoft account requirement during installation — all from a single screen when creating a bootable USB drive. Download the beta from the official Rufus downloads page, select your Windows 11 ISO, and check the new “Quality of Life Enhancements” box to apply the customizations automatically.

Applies to: Windows 11 (23H2, 24H2, 25H2) | Last updated: April 30, 2026

Key Takeaways

• Rufus 4.14 beta adds new “Quality of Life Enhancements” — a single checkbox that removes Copilot, OneDrive, the new Outlook app, fast startup, and other unwanted Windows 11 features during installation
• Existing options still work — bypass Windows 11 hardware requirements, skip the Microsoft account requirement, disable telemetry, and disable BitLocker automatic device encryption
• You must be disconnected from the internet during the first-boot setup for the local account bypass to actually take effect, even with Rufus’s customization enabled
• Rufus works by injecting an unattend.xml file into the sources\$OEM$\$$\Panther folder of the USB drive — this is what applies the registry tweaks and removes the apps during Windows setup
• For deeper, fully-automated Windows installations, use Winhance‘s built-in autounattend.xml generator — it produces a roughly 2,000-line setup file with every debloat and customization applied before you reach the desktop

Quick Steps:

1. Download Rufus 4.14 beta from rufus.ie
2. Select your USB flash drive under Device
3. Click SELECT and choose your Windows 11 ISO file
4. Set a recognizable volume label, then click START
5. On the Windows User Experience screen, check Quality of Life Enhancements along with the other customizations you want
6. Click OK to flash the drive, then boot from it on the target PC
7. During the first-boot setup, disconnect from the internet so the local account screen appears

What’s New in Rufus 4.14 for Windows 11

Rufus is the most popular tool for creating bootable Windows USB drives, and the 4.14 beta release adds a meaningful set of Windows 11 customization options that previously required a separate unattended setup file. The headline addition is a checkbox called Quality of Life Enhancements, which according to the Rufus team “disables most of the unwanted features Microsoft is trying to force onto end users.”

That single checkbox covers a lot of ground. When enabled, the resulting Windows 11 install will have Copilot, OneDrive, the new Outlook app, Microsoft Teams, fast startup, the Bing search box in the taskbar, news and interests, and several other annoyances either removed or disabled by default. It is a sensible debloat — not aggressive, just the most commonly removed items.

The previously-existing options are still there too: bypass Windows 11 hardware requirements, remove the Microsoft account requirement during setup, disable data collection, and disable BitLocker automatic device encryption. Combined with the new quality-of-life option, you can get a much cleaner Windows 11 install without touching a single registry key yourself.

How to Create a Customized Windows 11 USB with Rufus

The flashing process is the same as it has always been — only the customization options at the end are new. Open Rufus 4.14 and you will see four main fields to fill in.

1. Device: Select the USB flash drive you want to flash. A 16 GB drive is plenty for a Windows 11 ISO.
2. Boot selection: Click SELECT and choose the Windows 11 ISO file from your computer.
3. Partition scheme and target system: The defaults work for almost everyone — leave them alone unless you know you need a specific configuration.
4. Volume label: Change this to something recognizable (for example, Windows 11 25H2). It is what the drive will be called once flashed.

Click START, and Rufus will display the Windows User Experience screen. This is where the new customization options live.

Windows User Experience: Every Customization Option Explained

The Windows User Experience screen is where you choose what gets stripped out of the Windows 11 installation. Each checkbox writes a corresponding entry into the unattend.xml file that Rufus injects into your USB drive.

• Remove requirement for Windows 11 hardware checks — bypasses the TPM 2.0, Secure Boot, and CPU compatibility checks. Useful for older PCs that are otherwise capable.
• Remove requirement for an online Microsoft account — lets you create a local account during setup, but you must be disconnected from the internet during the first-boot screens for it to work.
• Disable data collection (Skip privacy questions) — sets diagnostic data to “required only” and turns off the advertising ID.
• Disable BitLocker automatic device encryption — prevents Windows 11 from auto-encrypting your drive with BitLocker after install.
• Quality of Life Enhancements (NEW) — disables Copilot, OneDrive, the new Outlook app, Teams, fast startup, the search box, Bing search, news and interests, the widgets, and the Microsoft Edge first-run experience.
• Silently erase disk and install [edition] (NEW) — skips the partition selection screen and automatically installs the chosen Windows 11 edition. This option may be greyed out depending on the ISO; in my testing it was unavailable.
• Use only fully up-to-date Secure Boot certificates — for systems with current Secure Boot certificates only.
• Revoke additional potentially unsafe Windows boot loaders — security hardening, but can prevent standard Windows media from booting. Most people should leave this unchecked.

For a cleaner Windows 11 install I would recommend checking the first five options. Skip the last two unless you specifically know why you need them.

Note: Rufus does not currently remove Microsoft 365 Copilot, the standalone Copilot app that Microsoft bundles into newer Windows 11 builds. The “Quality of Life Enhancements” option only handles the integrated Copilot. A future update will likely add the M365 Copilot package to the removal list.

Why You Must Disconnect from the Internet During Setup

Even with the “Remove requirement for an online Microsoft account” option enabled in Rufus, the local account screen will not appear if your PC is connected to the internet during the first-boot setup. I found this out the hard way during testing — I was online when Windows finished installing, and the setup process took me straight to the “Unlock Your Microsoft Experience” sign-in screen.

The fix is simple: disconnect the network cable or skip the Wi-Fi setup, then restart the PC. On the next boot, the setup process will detect that there is no connection and present the local account creation screen instead. You can enter any username, leave the password blank, and continue into a clean offline account.

Tip: If you are setting up a Windows 11 PC for someone else and want to guarantee a local account, unplug the Ethernet cable before starting the install. There is no in-OS way to force the local account screen once you have signed into a Microsoft account.

What Rufus Removes from a Fresh Windows 11 Install

Once you reach the desktop on a Rufus-customized install, you will notice immediately that the experience is cleaner than a stock Windows 11 setup. Copilot is gone from the taskbar. OneDrive does not auto-install on first launch. The new Outlook app is missing. Microsoft Teams is uninstalled. Fast startup is disabled.

Looking at Settings > Privacy & security, the advertising ID is disabled, and under Diagnostics & feedback only required diagnostic data is being sent — optional telemetry is off. The general privacy toggles for website tracking, locally-relevant info, and app-launch tracking are not all flipped off, but the most invasive telemetry pipeline is disabled.

This is a solid baseline Windows 11 install for most home users. It is not as deeply customized as what you would get from a fully unattended setup, but it removes the most commonly complained-about additions in modern Windows 11.

How Rufus Customizes Windows: The unattend.xml File

If you have followed my channel for any length of time, you know I am into the autounattend.xml world for fully-automated Windows installations. Rufus uses the same underlying mechanism, just with a smaller scope. The customizations are applied via an unattend.xml file that gets written to the USB drive during the flashing process.

The file location is slightly different from the standard approach. Tools like Winhance and the Schneegans autounattend.xml generator place the file in the root of the USB drive as autounattend.xml. Rufus instead places it inside sources\$OEM$\$$\Panther\unattend.xml.

Both autounattend.xml and unattend.xml do exactly the same thing — they are different filenames for the same Windows answer file format. Windows Setup picks them up automatically during installation and applies their contents.

Inspecting the unattend.xml that Rufus generates, the file is roughly 150 lines of XML. It contains:

• Registry entries that bypass the Windows 11 hardware requirements
• The BypassNRO registry key to skip the online Microsoft account requirement
• Removal commands for OneDrive, Outlook, and Teams
• Toggles to disable Windows Copilot, fast startup, the search box taskbar mode, Bing search, news and interests, and widgets
• Settings to hide the Microsoft Edge first-run experience and define a default Start menu layout
• Locale settings matched to the system you used to flash the drive

If you want a more comprehensive answer file with deeper customization, the Schneegans unattended answer file generator is a great browser-based tool I have covered before.

Rufus vs. Winhance: Which One Should You Use?

The new Rufus customization options are great for removing the most annoying defaults from Windows 11, but if you want a fully-automated installation with every debloat, every optimization, and every customization applied before you reach the desktop, Winhance is built specifically for that.

I created Winhance to give people a simple way to enhance their Windows experience by debloating, optimizing, and customizing the system, with full control over how Windows performs. At the time of writing, Winhance has been downloaded more than 1.1 million times — a huge thank you to everyone who has been using it. It has also been featured by tech outlets like PCWorld and XDA Developers.

Inside Winhance, under Advanced Tools, there is an autounattend.xml generator that writes a complete answer file based on your current Winhance selections. The generated file is roughly 2,000 lines and includes every setting Winhance can apply — registry tweaks, app removals, service tweaks, telemetry toggles, and customization defaults.

The result is a Windows 11 install that arrives at the desktop already configured exactly the way you want it. No post-install scripting, no manual settings tweaking — your custom configuration is applied during Windows Setup itself.

• Use Rufus 4.14 if you want a quick, mostly-clean Windows 11 install with the most annoying defaults removed and zero configuration time.
• Use Winhance if you want full control over every setting and a one-click setup where Windows boots ready-to-use with your exact configuration.

For a complete walkthrough of the Winhance autounattend.xml generator, watch my dedicated tutorial:

You can also read the full written guide on UnattendedWinstall and customizing Windows installations.

Frequently Asked Questions

Is Rufus 4.14 stable enough to use right now?

Rufus 4.14 is currently in beta, which means there may be small bugs that have not been ironed out yet. The core flashing process is rock solid (Rufus has been mature for years), and the new customization options worked correctly in my testing aside from one greyed-out option. If you need the new Windows 11 customization features today, the beta is fine to use — just keep an eye on the Rufus releases page for the stable 4.14 release.

Will Rufus’s customizations work on the official Windows 11 ISO?

Yes. Rufus customizations work with the standard Windows 11 ISO downloaded directly from Microsoft. You do not need a modified or custom ISO — Rufus injects the unattend.xml file into the bootable USB drive itself, so the source ISO can be any official Windows 11 build (23H2, 24H2, or 25H2).

Why is the “Silently erase disk” option greyed out for me?

This option was unavailable in my testing as well, and at the time of recording it was not clear why. It may be tied to specific ISO versions, or it may be a beta-stage limitation that will be resolved in the stable 4.14 release. If the option is greyed out, you can still flash the drive normally and will only need to click through the standard Windows partition selection screen during install.

Does Rufus remove Microsoft 365 Copilot too?

Not currently. Rufus 4.14’s “Quality of Life Enhancements” option removes the integrated Windows Copilot, but the separate Microsoft 365 Copilot app that ships with newer Windows 11 builds is left in place. A future Rufus release will likely add it to the removal list. If you need to remove Microsoft 365 Copilot today, Winhance handles it as part of its standard debloat.

Can I still get a local account if I am connected to the internet during setup?

No. Even with Rufus’s “Remove requirement for an online Microsoft account” option enabled, modern Windows 11 builds will still try to force a Microsoft sign-in if the PC has internet access during first-boot setup. The cleanest fix is to disconnect the network cable or skip Wi-Fi during the install, then restart — the local account screen will appear automatically once Windows detects there is no connection.

This post Rufus Just Got a HUGE Update for Windows 11 (FREE Customizations) first appeared on Memory's Tech Tips and is written by memory

Microsoft has pushed a new Windows 11 build to the Release Preview channel for Windows Insiders, and it introduces a full-screen Xbox mode, several File Explorer fixes, Copilot agents on the taskbar, tighter driver trust rules, and a handful of performance improvements. These changes are still in testing — they are not yet rolling out through regular Windows Update — but they give a clear picture of where Windows 11 is heading next.

Applies to: Windows 11 (25H2 Release Preview channel) | Last updated: April 24, 2026

Key Takeaways

• A new full-screen Xbox mode is being added to all Windows 11 PCs — laptops, desktops, and tablets — giving the system a console-style home screen.
• File Explorer gets real fixes, including the long-standing white flash in dark mode when launching to This PC, faster launch performance, and consistent folder view settings across apps.
• Copilot agents are coming to the taskbar, starting with the Microsoft 365 Copilot researcher agent — Windows will show live progress on the taskbar while an agent is working.
• Dynamic app removal lists are being added to the existing “Remove default Microsoft Store packages” policy, but this remains an Enterprise and Education feature only.
• Cross-signed drivers lose default trust, and a new registry mode prevents batch files from being modified during execution — both are aimed at closing common malware paths.

Quick Summary of What’s New:

1. Full-screen Xbox mode for all Windows 11 devices
2. File Explorer dark mode flash fix, faster launch, and consistent folder views
3. “Preview anyway” button for files downloaded from the internet
4. Expanded archive format support in File Explorer
5. Copilot agents displayed on the taskbar with live progress
6. Dynamic app removal list for Enterprise and Education
7. Default trust removed for cross-signed drivers
8. Security mode that blocks batch files from changing during execution
9. Memory and reliability improvements for the taskbar and startup apps

A Quick Note on the Release Preview Channel

Everything covered here is currently locked to the Release Preview channel of the Windows Insider Program. That means these features are still being tested, and they can change or be pulled before they reach the version of Windows 11 most people are running. If you are not enrolled as a Windows Insider, you will not see any of these changes yet through normal Windows Update.

I treat release preview builds as a preview of intent rather than a guarantee. Some of these features will ship more or less as-is, others will get reworked, and a few may disappear entirely. I will update this post as these changes move into the mainstream Windows 11 release.

Full-Screen Xbox Mode on Every Windows 11 PC

The first thing in this build is a new Xbox mode that gives Windows 11 a full-screen, console-style interface. Microsoft is rolling it out to all PCs — laptops, desktops, and tablets — not just handhelds. The home screen picks up where you left off with recent games and surfaces featured titles, similar to the Xbox console dashboard.

I personally do not use the Xbox app on Windows, so I cannot say how much of an improvement this is over what was already there. If you do a lot of gaming on your PC and want the Xbox app without going through the Microsoft Store, I covered that in a separate guide on installing the Xbox app on Windows without the Microsoft Store.

File Explorer Changes (The Ones I’m Actually Excited About)

The File Explorer changes are the part of this build I care about the most. There are five notable improvements, and most of them target long-standing annoyances rather than new features.

Consistent Folder View Settings Across Apps

Custom folder settings — like sorting files by name — now persist across every way you open that folder. If you set a folder to sort by name in File Explorer, then open the same folder from a web browser or another app, the sort order carries over automatically. This has been a small but persistent inconsistency for years.

Faster File Explorer Launch

Microsoft says they have improved the speed and performance of launching File Explorer. This covers both the general launch time and the specific case of opening to This PC or resizing the details pane. On systems where File Explorer sometimes takes a second or two to appear, this should feel noticeably snappier.

The Dark Mode White Flash Is Fixed

If you run Windows in dark mode and have File Explorer set to launch to This PC, you have almost certainly seen the white flash when File Explorer opens. It is a brief but genuinely annoying flash of bright white before the dark theme kicks in. Microsoft has finally fixed that in this build. For anyone who sets File Explorer to open directly to This PC, I have a separate guide on setting File Explorer to launch to This PC via the registry.

“Preview Anyway” Button for Downloaded Files

For files downloaded from the internet, the preview pane in File Explorer now shows a viewing warning first. Once you acknowledge it, a “Preview anyway” button lets you see the file contents. It is a small usability improvement on top of the existing Mark of the Web (MOTW) protection, which already restricts downloaded files from running without a prompt.

Expanded Archive Format Support

File Explorer now recognises and works with a wider list of archive formats natively. This is a continuation of the archive handling Microsoft started adding in Windows 11 — you get more formats supported without needing a third-party tool for common extracts. For power users, I still recommend using a dedicated archive tool for heavy work, but for one-off extracts, the built-in support is now much more complete.

Explorer.exe Process Cleanup

Microsoft has also improved the reliability of explorer.exe processes stopping after you close File Explorer windows. There was a bug where these processes were not being cleaned up, which left background processes running and eating system resources for no reason. If you have ever noticed Task Manager showing multiple Windows Explorer entries after closing all your File Explorer windows, this is the fix for that.

Copilot Agents on the Taskbar

This is the one that is going to be controversial. Windows is adding a new way to monitor AI agents directly from the taskbar. The feature supports agents across both first-party and third-party apps, with the researcher agent in the Microsoft 365 Copilot app as the first adopter.

Here is how it works in practice. When the researcher agent is working on a report, Windows shows the progress on the taskbar, so you can glance down and see where it is at. Hovering over the Microsoft 365 Copilot icon displays real-time progress, and when the report finishes, Windows notifies you. The mechanism itself is not limited to Microsoft — third-party apps can plug into the same taskbar progress surface for their own agents.

My take: I am not anti-AI. I use Claude and Claude Code every day for my work, and I am actively setting up a personal AI assistant — just on a separate machine on my network, not on my main PC where all my personal data lives. My concern is not AI itself, it is Microsoft bundling Copilot into the operating system in a way that is hard to opt out of. If you feel the same way, you may want to disable Copilot in Windows 11 and 10, or remove AI apps from Windows 11 entirely.

Microsoft has also said in a previous post that they want to change the way AI is integrated into Windows. How that actually plays out with the taskbar agents feature will tell us a lot. I will update this post once it is clearer whether this stays opt-in or quietly becomes default behaviour.

Policy-Based Removal of Preinstalled Microsoft Apps

Microsoft has updated the existing policy that lets administrators remove default Microsoft Store packages. The update adds support for a dynamic app removal list, meaning administrators can add an AppX package name and have it removed automatically when the policy is applied. In practice, this makes it easier to remove default Microsoft Store bloatware across a managed fleet of PCs.

The catch is that this is still limited to Windows 11 Enterprise and Education. Pro and Home users do not get this policy. I would genuinely like to see Microsoft extend it to Pro — there is no good reason an advanced home user or small business on Pro should have fewer tools to manage bloatware than an Enterprise admin. I covered the original version of this policy in my guide on the official bloatware removal method in Windows 11 25H2.

If you are on Home or Pro: you do not need to wait for Microsoft. Winhance, the customization utility I built, already lets you remove preinstalled Microsoft Store apps, disable telemetry, and customize Windows 11 without needing Enterprise policies or the command line.

Driver Trust and Security Changes

There are two security-focused changes worth knowing about: a driver policy update and a new batch file protection mode.

Cross-Signed Drivers Lose Default Trust

Windows 11 is removing the default trust for cross-signed drivers. Drivers from the Windows Hardware Compatibility Program and an allow-list of trusted legacy drivers are still permitted, but the blanket acceptance of cross-signed drivers is going away. This is a straightforward security hardening — cross-signed drivers have been a common vector for malicious or abusable kernel code for years.

Batch File Execution Protection

There is a new registry-based mode that prevents batch files from being modified during execution. If a batch file tries to change itself mid-run — for example, to call another script that gets swapped in at runtime — it will be blocked. This closes off a known technique used by some malware that rewrites scripts on the fly to evade detection.

Note: This is an opt-in mode set via a registry key. It is not enabled by default, and most everyday scripts will not be affected, but administrators running hardened environments will want to turn it on.

Microsoft Store, Taskbar, and Performance Fixes

The rest of the build is a collection of smaller reliability and performance improvements. They are not headline features, but a few are worth noting:

• Fewer unexpected Microsoft Store download errors — Microsoft has cleaned up a set of common failure cases when pulling apps from the Store.
• Taskbar system tray reliability — the system tray area now loads more consistently for Windows Update when Delivery Optimization is in use.
• Lower taskbar memory usage — reducing the likelihood of the taskbar allocating an unexpectedly large chunk of RAM.
• Faster startup app launches — the apps that load when Windows boots should start up faster after login.
• General reliability work on Explorer, taskbar flyouts, and File Explorer’s Quick Access.

I personally disable Delivery Optimization on every machine I set up, so the taskbar system tray fix does not affect me. If you do use Delivery Optimization, this should at least make the experience lighter on memory.

What This Build Tells Us About Windows 11’s Direction

A lot of this build is Microsoft delivering — or starting to deliver — on things they promised in earlier Windows 11 posts. Some of that delivery is solid: the File Explorer fixes, the driver trust changes, the batch file protection. Other parts feel off-direction: Copilot agents on the taskbar is not what most of the people I talk to are asking for in Windows. It is an early release preview build, so things will change before anything reaches production, but it is a useful signal for where Microsoft’s focus currently sits.

If you want full control over how much of Microsoft’s ecosystem is active on your PC, I would strongly recommend checking out Winhance. It is free, open source, and built specifically to give Windows users the removal and customization options Microsoft does not ship by default.

Frequently Asked Questions

When will these Windows 11 features reach the public?

There is no fixed date. Features in the Release Preview channel typically ship to the public within a few weeks to a few months, but Microsoft can pull, delay, or rework any feature before general release. Cumulative quality updates from the Release Preview channel usually roll out fastest; larger feature additions like Xbox mode or Copilot agents tend to be tied to broader Windows 11 feature updates.

How do I join the Release Preview channel to try these features now?

Open Settings, go to Windows Update, then Windows Insider Program. Sign in with a Microsoft account, pick the Release Preview channel, and reboot. Release Preview is the most stable of the Insider channels and only receives builds close to production, so it is generally safe on a daily-driver PC. I still recommend a full backup before enrolling any machine.

Can I disable Copilot agents on the taskbar?

The exact opt-out controls are not fully documented in this preview build yet, so the final answer depends on what ships. If you want to remove Copilot entirely today, follow my guide on enabling or disabling Copilot in Windows 10 and 11. For broader AI and bloat removal, Winhance is the cleanest path.

Does the dynamic app removal policy work on Windows 11 Home or Pro?

No. The “Remove default Microsoft Store packages” policy — including the new dynamic list — is limited to Windows 11 Enterprise and Education. Home and Pro users need to remove preinstalled apps another way. Winhance does this cleanly, or you can follow my written guide on the official bloatware removal method in Windows 11 25H2.

Is the batch file execution protection enabled by default?

No. The new mode that blocks batch files from changing during execution is opt-in through a registry key, so existing scripts and automation will continue to work as they do today. It is intended for hardened and managed environments, not general consumer use.

This post Windows 11 Is Getting THESE NEW Features! (Release Preview) first appeared on Memory's Tech Tips and is written by memory

Winhance Release 24 adds over 50 new settings across Optimizations and Customize, makes system restore optional on first launch, and introduces a new badge system so you can see at a glance which settings are recommended, at Windows defaults, or customized. Major additions include dedicated controls for Windows AI, Microsoft Edge AI, Microsoft Office AI, expanded taskbar behaviors, and new File Explorer context menu tools for SFC, DISM, and Check Disk.

Applies to: Windows 10 (22H2) and Windows 11 (23H2, 24H2, 25H2) | Last updated: April 17, 2026

Key Takeaways

• System restore is now optional on first launch — a prompt lets you skip it, and you can still create a restore point later from the Settings page
• A new badge system shows whether each setting is at its Recommended, Default, Custom, or Personal Preference value, and a NEW badge highlights settings added in this release
• Privacy & Security gained 45 new settings, including dedicated Windows AI, Microsoft Edge AI, and Microsoft Office AI subgroups for controlling Copilot, Recall, Click to Do, and more
• File Explorer gained 21 new settings, including context menu entries for SFC, DISM, and Check Disk, plus a legacy Notepad file association toggle and expanded navigation pane controls
• Release 24 is available now at winhance.net, and the full changelog lives on the Winhance Release 24 GitHub page

Quick Summary of What’s New:

1. System restore point creation is now optional on first launch
2. New Quick Actions menu for applying all recommended or default values per page
3. New View menu to toggle technical details, info badges, and NEW badges
4. 45 new settings in Privacy & Security (with three AI subgroups)
5. 13 new settings in Gaming & Performance (DNS, VBS, MPO, SVCHost split threshold, and more)
6. 1 new setting in Windows Update (block driver co-installers)
7. 15 new settings in Taskbar customization
8. 21 new settings in File Explorer (context menu tools, file associations, navigation pane)
9. Quality of life improvements to Config Review Mode

System Restore Points Are Now Optional on First Launch

In earlier releases, Winhance would automatically enable System Restore and create a restore point the first time you launched the app. A lot of people gave me feedback asking for this to be optional rather than forced, so from Release 24 onward, you now get a prompt on first launch asking whether you want to create a system restore point or skip it.

Winhance still automatically creates a backup config file with all of your current Winhance settings the first time you run it, so you can use that as a backup and restore function regardless of whether you create a system restore point.

If you skip the restore point on first launch, you can create one later by navigating to Settings inside Winhance. That said, I still recommend creating a restore point the first time you use Winhance — it gives you a known-good rollback point before any changes are applied to your system.

The New Badge System, Quick Actions, and View Menu

The Optimize and Customize pages now have two new buttons at the top: Quick Actions and View. Quick Actions lets you apply all recommended settings — or reset everything to Windows defaults — for the page you are currently on. The View menu lets you toggle technical details, info badges, and the new badges added in Release 24.

Every setting card now shows up to four info badges so you can see its current state at a glance:

• Recommended — the setting is at the value Winhance recommends
• Default — the setting is at its Windows factory value
• Custom — the setting has been changed to something other than Recommended or Default
• Personal Preference — Winhance may suggest a value, but there is no objectively correct answer for this setting

There is overlap between Recommended and Default, because some Windows defaults are also what Winhance recommends. In those cases, both badges are lit up at the same time. A good example of a Personal Preference setting is User Account Control — I recommend Never Notify because I do not want a UAC prompt every time I run an application, but that is a personal call, and the setting makes that clear.

Each setting card also has individual Recommended and Default buttons next to it, so you can apply either value to just that one setting without affecting the whole page. If the badge clutter is too much, open the View menu and toggle the info badges and NEW badges off — the UI returns to a cleaner layout with just the settings themselves.

Tip: The NEW badges are how you can quickly find every setting added in Release 24. Open the View menu, make sure NEW badges are on, and scan each feature for the red NEW markers — the landing page of every feature also shows a count of how many new settings are in that section.

45 New Settings in Privacy, Security, and AI Controls

Privacy & Security received the largest expansion in Release 24, with 45 new settings. The first batch covers core Windows security toggles: Smart App Control, Developer Mode (allows app installation from any source), and a PowerShell Execution Policy setting that lets you pick any of the standard Windows execution policies.

Windows AI Subgroup

A new Windows AI subgroup consolidates every AI feature baked into Windows into one place. This includes Windows Copilot toggles, AI data analysis, Recall enablement, Recall saving snapshots, Click to Do, and more. Most of these are only relevant if you are running a Copilot+ PC or a system where Recall can be enabled, but the toggles work for Copilot, Bing Chat, and generative AI access regardless of hardware.

The Windows AI subgroup also covers AI features baked into Microsoft Paint — the AI image creator, co-creator, and generative fill — so you can disable those from Winhance without opening Paint. Microsoft appears to be rolling out native controls for these in a future Windows update, but at the time of this writing they are not available in stable Windows.

Microsoft Edge AI and Microsoft Office AI Subgroups

There is a dedicated Microsoft Edge AI subgroup for all of the AI integrated into the Edge browser, and a Microsoft Office AI subgroup for Copilot and AI features baked into the Microsoft Office suite. If you do not use Edge or Office, you can ignore these subgroups — they only apply when those applications are installed.

13 New Gaming and Performance Tweaks

Gaming & Performance picked up 13 new settings, covering input responsiveness, background process management, networking, and security-performance trade-offs. The most notable additions:

• Mouse Hover Time — controls how long you must hover over a UI element before it activates. Setting this to 1 millisecond makes tooltips, menus, and hover effects appear faster. Requires a restart.
• Background App Permissions — previously a simple toggle, now a three-option combo box: User in Control, Force Allow, or Force Deny. Force Deny removes background permissions from Windows Settings entirely, which also disables background activity for apps that depend on it (Teams, Zoom, WhatsApp, etc.). Set it back to User in Control if you need those apps to run normally.
• WebView 2 in Windows Search — disables Windows Search using WebView 2 or Edge for rendering results. This removes Edge processes spawned by SearchHost.exe and reduces resource usage, but it uses an undocumented Windows feature management override that may change in future updates.
• SVCHost Split Threshold — sets the memory threshold Windows uses to decide when to split services into separate SVCHost.exe processes. Match this to your system RAM for the safest result (check Task Manager > Performance > Memory to confirm how much RAM you have). The setting also allows values above your physical RAM by request, but use that with caution.
• Multi-Plane Overlay (MPO) — composites display layers in hardware using the GPU. Recommended on, but disabling it can fix screen flickering, black screens, and stuttering on multi-monitor setups.
• MPO Minimum Frame Rate Requirement — related to MPO. Disabling this can resolve stuttering in browsers and Discord without fully disabling MPO itself.
• DNS Server — previously not configurable from Winhance. You can now pick Automatic (DHCP) or presets for Cloudflare, Cloudflare Malware Blocking, Google, Quad9, or OpenDNS. The setting applies to every network adapter on the system — Wi-Fi and Ethernet both.

Security Subgroup for Gaming Performance

A Security subgroup was added inside Gaming & Performance because these specific security features have a direct impact on gaming performance on some systems. This subgroup lets you toggle Virtualization-Based Security (VBS) and Memory Integrity.

The recommended values here are off, because the context is gaming performance — not security. Disabling VBS and Memory Integrity has been known to improve gaming frame rates on some systems, but it does reduce overall system security. If you do not play games on the machine and you are security-conscious, leave these enabled.

Services and Input Management

The Connected Devices Platform Service can now be disabled or set to manual from Winhance, which reduces background activity and device interaction logging. The Touch Keyboard and Handwriting Panel Service setting was also updated — this service handles the Windows Input Experience, including the touch keyboard, pen and stylus input, handwriting panel, and the emoji panel.

On a normal Windows 11 desktop, opening the emoji panel (Windows key + period) spawns a background process that can use up to 20% of the CPU briefly and 80 MB of RAM, and that process stays running even after you close the panel. Disabling this service kills the process for good, and the emoji panel stops working — but the on-screen keyboard continues to function. If you never use the emoji panel or a touch input method, this is safe to disable.

One New Setting in Windows Update: Block Driver Co-Installers

The Windows Update section picked up one new setting: Block Driver Co-Installers. When this is on (the default behavior), Windows allows hardware vendors to install companion software alongside device drivers — things like Razer Synapse, printer utilities, and other bundled vendor applications.

Disabling this prevents that bloatware from installing automatically when you plug in a peripheral. Your hardware continues to work normally with the standard drivers — you just do not get the extra vendor software pushed in through Windows Update.

15 New Taskbar Settings and 21 New File Explorer Settings

Over in Customize, the Taskbar feature gained 15 new settings and File Explorer gained 21. Many of these were requested directly through issues on the Winhance GitHub page, and the goal is the same as always — let you pre-configure every setting in Winhance, then deploy it to new systems using a Winhance config file or an autounattend XML.

Taskbar: Copilot Pins, Behaviors, and System Tray

The Taskbar section now includes controls for the Copilot companion button, Copilot WPA pin, and Recall pin (most relevant on Copilot+ PCs). Toggling these off removes the associated pins from the taskbar. On a regular Windows 11 Pro installation, the Copilot button may still appear — to fully remove it from the taskbar on those systems, you have to uninstall Copilot itself from Apps & Features.

Every Windows taskbar behavior is now mirrored in Winhance: auto-hide, taskbar auto-hover delay, show badges, show on all displays, end task in taskbar, show all system tray icons, and more. This makes it possible to pre-configure the exact taskbar behavior you want in a config file or autounattend XML, so the setting is already in the right state on a fresh install. If you are new to deploying Windows with an answer file, I have a full guide on how to create an unattended answer file for Windows 10 and 11.

File Explorer: Shortcut Arrows and Context Menu Tools

The File Explorer section starts with a setting many of you requested: Remove Shortcut Arrow Icon. Turning this on writes a transparent icon file to Windows and hides the arrow overlay on every desktop shortcut, which makes the desktop look cleaner without changing the underlying shortcut behavior.

The bigger addition is a context menu subgroup with the following new entries:

• SFC Scan Now — adds a right-click option to run sfc /scannow in an elevated terminal
• DISM (Repair Windows Image) — adds a right-click option to run DISM /Online /Cleanup-Image /RestoreHealth
• Check Disk — adds a right-click option with three variants: scan only, fix errors, or locate bad sectors. Prompts for a drive letter when you run it.
• Edit or Run with PS1 — adds right-click options on PowerShell files for opening with Windows PowerShell, PowerShell 7, PowerShell ISE, or Notepad. Each target must be installed on the system for that menu entry to work.
• Compressed To — adds right-click compression options for any file or folder (ZIP, 7Z, and other formats). This one is based on ThioJoe’s Compressed To tweak — full credit to him for the original script.

These context menu entries only appear in the classic Windows context menu, not the Windows 11 default menu. If you have not already switched, see how to enable the classic context menu in Windows 11 — Winhance can also make that change for you.

Note: I originally considered adding SFC, DISM, and Check Disk as action buttons inside the Optimizations feature, but that does not fit my vision for the app. Winhance is an enhancement and deployment tool, not a system repair utility. Adding the same commands as context menu entries keeps them accessible to IT professionals without turning Winhance into something it is not.

File Associations, Navigation Pane, and Regional Settings

A new Use Legacy Notepad for Text Files setting changes the default handler for .txt files from the new Windows 11 Notepad to the legacy Notepad. This requires the Notepad Legacy optional feature to be installed on the system (it still ships by default on Windows 11 at the time of writing, but Microsoft may remove it in a future release).

The Navigation Pane settings expand on the existing Show All Folders toggle — you can now individually control which folders appear in the navigation pane (Desktop, Documents, Downloads, Music, Pictures, Videos), hide libraries, and disable the duplicate removable drives behavior that shows each USB drive twice in This PC.

There is also a Show Auto Login Option in User Accounts setting that restores the classic “Users must enter a username and password to use this computer” checkbox in netplwiz. Windows removed this by default, so enabling this setting is the only way to get that checkbox back without manual registry edits.

Finally, a Regional Settings group lets you pre-configure date format, first day of the week, number format, currency symbol, and measurement system. These have no recommended values — they are entirely preference or locale-based — but they are very useful in deployment scenarios. I used to spend real time in my repair shop setting these manually on every client machine, and having them in Winhance means you can bake them into a config file and never touch them again.

Config Review Mode — Quality of Life Improvements

Config Review Mode is not new — it is what Winhance enters when you import a config file, so you can review each setting change before applying it. Release 24 makes two clarifications that were requested by users who ran into confusion here:

• The Advanced Tools section is now fully disabled during Config Review Mode. You cannot build a custom ISO or toggle settings from scratch while reviewing a config — Config Review Mode is specifically for reviewing and accepting or rejecting changes, not for normal editing. The disabled state makes this explicit.
• Quick Actions in Config Review Mode now offers Accept All Changes and Reject All Changes on the current page, and the View menu gains a Show Only Changes toggle so you do not have to scroll through settings the config is not touching.

Once you accept or reject every change, the final Apply Config button pushes the reviewed changes to your live system. If you decide not to continue, Cancel exits Config Review Mode without applying anything.

How to Get Winhance Release 24

Release 24 is available now. The fastest way to install or update is the PowerShell one-liner on the Winhance website:

irm "https://get.winhance.net" | iex

Run that in an elevated PowerShell window and it handles the install or update automatically. You can also download installable or portable builds directly from the Winhance Release 24 GitHub page, which is also where the complete changelog lives — I did not cover every single change in this walkthrough, so check the release notes for the full list.

If you are brand new to Winhance, start with the main Winhance guide — it walks through the full app, what each feature does, and the recommended workflow. And if your end goal is a clean, pre-configured Windows install rather than tweaking an existing system, UnattendedWinstall and the Winhance WIMUtil both let you bake these settings into a bootable ISO from the start.

Coming next: I have more updates planned for the Autounattend feature, plus a Config Creation Mode and Autounattend Creation Mode — modes where you can configure settings in the Winhance UI without applying them to your live system, so you can build a config or answer file cleanly. No release date yet, but it is on the list.

Frequently Asked Questions

Is Winhance still free?

Yes. Winhance is completely free and open source, and I rely on community support to keep building it. If you have found it useful, sharing it or supporting development helps a lot. The download counter is sitting at nearly 1 million downloads at the time of Release 24.

Will my existing Winhance config file still work in Release 24?

Yes. Existing config files continue to work — the new settings simply will not be present in an older config, so they will stay at their current values on your system. If you want to include the new settings, open the config in Release 24, configure the new options, and export a fresh config file.

Do I need a Copilot+ PC to use the Windows AI settings?

No. Many of the Windows AI toggles — Copilot, Bing Chat, generative AI access, Paint AI — apply to any Windows 11 system where those features are installed. Recall and Click to Do are primarily aimed at Copilot+ PCs, but the settings in Winhance still work safely on non-Copilot+ systems; they just have no effect if the feature is not available on that hardware.

Why are some security settings inside the Gaming & Performance section?

Because disabling features like Virtualization-Based Security and Memory Integrity has been shown to improve gaming performance on some systems. They live in Gaming & Performance with a recommended off value for that reason. If you do not game on the machine, it is safer to leave both enabled — they are there for users who have prioritized frame rate over the small security cost.

What is the difference between Winhance and the autounattend XML?

Winhance configures settings on a live, already-installed Windows system. An autounattend XML is an answer file that configures settings during the Windows installation process — before you even reach the desktop. Winhance’s WIMUtil can generate an autounattend XML based on your current selections, so you can use the same settings both ways: on existing installs through the app, and on fresh installs through a custom ISO. See my unattended answer file guide for the full walkthrough of that workflow.

This post I Added 50+ NEW Settings to Winhance — Full Walkthrough! first appeared on Memory's Tech Tips and is written by memory

You can remove every AI app Microsoft has quietly installed on Windows 11 — Copilot, Clipchamp, Recall, and more — using Winhance, a free open-source tool I built specifically for this. Run a single PowerShell command to install it, check the AI apps you want gone, and enable continuous removal to block Windows Update from sneaking them back. Here’s exactly how.

Applies to: Windows 11 (23H2, 24H2, 25H2) | Last updated: April 2, 2026

Key Takeaways

• Windows 11 now ships with at least 7 AI-powered apps installed or pre-loaded, including Copilot, Clipchamp, and AI features baked into Paint and Notepad.
• Winhance can remove all of them at once — select the apps you want gone, hit apply, and they’re uninstalled in seconds.
• Continuous removal keeps them off permanently — Winhance creates scheduled tasks that automatically re-remove any AI app that Windows Update tries to reinstall.
• You can proactively block apps you don’t even have yet — select apps like Recall before they appear on your system, and Winhance will prevent them from ever installing.
• If you reinstall an app through Winhance later, it’s smart enough to remove that app from the continuous removal list so it won’t get deleted again.

Quick Steps

1. Open PowerShell and run irm winhance.net | iex to install Winhance.
2. Open the Application Management section in Winhance.
3. Select the AI apps you want to remove (Copilot, Clipchamp, Paint, Notepad, Edge, Recall, etc.).
4. Check “Save removal scripts to ensure continuous removal” to keep them off permanently.
5. Click Apply to remove the selected apps.
6. Optionally, go to External Software in Winhance to install replacements like Notepad++.

Which AI Apps Does Windows 11 Install?

Microsoft has been aggressively pushing AI into Windows 11 over the past year. What started with Copilot has expanded into a full suite of AI-powered apps that appear on your system — often without you asking for them. Here’s what’s currently being installed or pre-loaded on Windows 11 machines.

• Microsoft Copilot — The standalone AI assistant app. It pins itself to the taskbar and Start menu after feature updates.
• Microsoft 365 Copilot — A separate app from regular Copilot, tied to the Microsoft 365 ecosystem.
• Clipchamp — Microsoft’s AI-powered video editor, pre-installed on all Windows 11 systems.
• Paint — The classic app now has Copilot AI image generation features baked in.
• Notepad — Even Notepad now includes Copilot AI text rewriting capabilities.
• Microsoft Edge — Packed with Copilot AI features throughout the browser.
• Recall — Available on Copilot+ PCs, this app takes continuous screenshots of everything you do and uses AI to make it searchable.

The problem isn’t just that these apps exist — it’s that Windows Update regularly reinstalls them even after you remove them manually. That’s the exact problem I built Winhance to solve.

How to Install Winhance

Winhance is free, open-source, and installs with a single PowerShell command. There’s no installer wizard, no bundled software, and no account required. You can also choose a portable version if you prefer not to install anything.

1. Right-click the Start button and select Terminal (Admin) or PowerShell (Admin).
2. Paste the following command and press Enter:

irm "https://get.winhance.net" | iex

1. The installer will ask if you want a normal install or portable install. Choose whichever you prefer — both work the same way.
2. Once installed, Winhance opens automatically and you’re ready to start removing apps.

Tip: If you’ve never used Winhance before, check out my full Winhance guide for a complete overview of everything it can do beyond just removing AI apps.

How to Remove AI Apps with Winhance

Once Winhance is open, removing AI apps takes about 30 seconds. The interface groups removable apps into clear categories, so you can pick exactly what you want gone.

1. In Winhance, navigate to the Application Management section.
2. You’ll see a list of installed Microsoft apps, including all the AI-powered ones. Select the ones you want to remove:
   • Clipchamp
   • Microsoft Copilot
   • Microsoft 365 Copilot
   • Notepad (AI version)
   • Paint (AI version)
   • Microsoft Edge
   • Recall (Copilot+ PCs only)
3. Click Apply to remove all selected apps at once.

One thing I specifically designed into Winhance: you can select apps that aren’t currently installed on your system. This is useful for apps like Recall that may not be on your PC yet but could appear after a future Windows Update. By selecting them now, you’re telling Winhance to block them proactively.

If you want to disable Copilot without fully uninstalling it, you can do that through Windows settings instead. But if you want it completely gone, Winhance is the fastest option.

How to Keep AI Apps Off Your PC Permanently

This is the feature that makes Winhance different from manually uninstalling apps. Windows Update has a habit of reinstalling apps you’ve already removed — especially Copilot. The continuous removal feature stops that from happening.

Before you click Apply, check the box labeled “Save removal scripts to ensure continuous removal”. This tells Winhance to create scheduled tasks in Windows Task Scheduler that monitor for reinstalled apps. If Windows Update sneaks an app back onto your system, the scheduled task detects it and removes it again automatically.

I tested this on camera to prove it works. I manually reinstalled Copilot through the Microsoft Store after it had been removed by Winhance. After a restart, the continuous removal script detected the unauthorized reinstall and removed Copilot again within about 15 seconds. No manual intervention needed.

Tip: The continuous removal scripts only target apps that were removed through Winhance. If you later decide you want an app back and install it through Winhance’s External Software section, the tool automatically updates the removal list so it won’t delete that app again.

This smart behavior is important. If you install an app through Winhance that was previously removed, Winhance recognizes it as an intentional install and removes it from the continuous removal list. It only catches reinstalls that happen outside of Winhance — like when Windows Update puts Copilot back without your permission.

How to Replace Removed Apps

After removing AI-heavy apps like Notepad and Paint, you’ll probably want replacements. Winhance has a built-in External Software section that lets you install popular alternatives directly — no need to hunt for download links.

For example, after removing the AI version of Notepad, you can install Notepad++ straight from Winhance. It’s a far more capable text editor without any AI features forced on you.

Some popular replacements available through Winhance’s External Software section:

• Notepad++ — Lightweight, powerful text editor with syntax highlighting and tabs.
• Alternative browsers — Replace Microsoft Edge with your preferred browser.
• Classic Paint alternatives — If you used Paint for basic image editing, lightweight alternatives are available without the AI overhead.

Remember: any app you install through Winhance is automatically excluded from the continuous removal list. So you don’t need to worry about Winhance fighting against itself.

Why Microsoft Keeps Reinstalling AI Apps

If you’re wondering why you need a tool like Winhance in the first place — it’s because Microsoft treats AI app removal as temporary. Every major Windows Update can reset your app selections and reinstall things you’ve already removed. This is by design, not a bug.

Microsoft’s business strategy increasingly relies on AI integration across Windows. Copilot, Recall, and the AI features in everyday apps like Paint and Notepad are central to that strategy. When you remove them, Windows Update sees them as “missing components” and reinstalls them during the next feature update.

That’s exactly why I added the continuous removal feature to Winhance. A one-time uninstall isn’t enough anymore. You need something actively watching for unauthorized reinstalls and cleaning them up automatically. The scheduled tasks Winhance creates run with minimal system resources and only activate when needed.

What About Copilot+ PCs and Recall?

If you have a Copilot+ PC (a device with an NPU chip meeting Microsoft’s requirements), you may also have Recall installed or queued for installation. Recall continuously takes screenshots of everything on your screen and uses AI to make that history searchable.

Even if Recall isn’t on your system yet, you can select it in Winhance and enable continuous removal. This ensures that if a future Windows Update tries to install Recall, it gets blocked immediately. This proactive approach is the safest way to handle apps you don’t want anywhere near your PC.

For standard Windows 11 PCs without an NPU, Recall won’t install on its own. But selecting it in Winhance as a precaution costs nothing and takes one extra checkbox.

Frequently Asked Questions

Is Winhance safe to use?

Yes. Winhance is open-source, meaning anyone can inspect the code on GitHub. I built it as a transparent tool for the Windows community. It doesn’t modify system files or break Windows Update — it only removes apps and creates standard scheduled tasks in Task Scheduler.

Will removing these apps break anything in Windows 11?

No. All the AI apps listed here are standalone applications, not core Windows components. Removing Copilot, Clipchamp, or the AI features in Paint and Notepad does not affect system stability. Windows 11 continues to function normally without them.

Can I get the apps back after removing them?

Absolutely. If you change your mind, you can reinstall any removed app through Winhance’s External Software section or through the Microsoft Store. If you install an app through Winhance, it automatically removes that app from the continuous removal list so it won’t be deleted again.

Does the continuous removal feature use a lot of system resources?

No. The continuous removal scripts run as lightweight scheduled tasks in Windows Task Scheduler. They only activate when triggered (such as after a Windows Update) and use negligible CPU and memory. You won’t notice any performance impact.

Do I need to run Winhance as administrator?

Yes. Since Winhance removes system-installed apps and creates scheduled tasks, it requires administrator privileges. The PowerShell install command (irm winhance.net | iex) should be run in an elevated (admin) PowerShell window.

This post How to Remove AI Apps from Windows 11 (Copilot, Recall, and More) first appeared on Memory's Tech Tips and is written by memory

To fix the blue screen of death (BSOD) in Windows 10 or 11, start by identifying what changed recently — new hardware, software, or driver updates are the most common causes. Then work through driver rollbacks, RAM testing, disk health checks, and system file repair to resolve the issue.

Applies to: Windows 10 (22H2) and Windows 11 (23H2, 24H2, 25H2) | Last updated: March 31, 2026

Key Takeaways

• Drivers cause 70% of all blue screens — graphics and network drivers are the most common culprits
• Most BSODs are fixable without replacing hardware — driver rollbacks, system file repair, and Windows updates resolve the vast majority of cases
• Use BlueScreenView (free) to read your crash dump and identify the exact driver or process that caused the crash
• Work through fixes in order: undo recent changes, fix drivers, test RAM, check disk health, repair system files, Safe Mode, clean install
• If BSODs persist after a clean install, you are looking at faulty hardware — RAM, SSD/HDD, GPU, or motherboard

Quick Steps:

1. Undo any recent hardware or software changes
2. Roll back or update problematic drivers in Device Manager
3. Test your RAM with Windows Memory Diagnostic or MemTest86
4. Check disk health with Check Disk and manufacturer tools
5. Run DISM /Online /Cleanup-Image /RestoreHealth then sfc /scannow to repair corrupt system files
6. Boot into Safe Mode or use System Restore if Windows won’t start normally
7. Clean install Windows as a last resort

What Causes the Blue Screen of Death in Windows?

A blue screen of death (BSOD) means Windows encountered a critical error that prevents it from running safely. Rather than risk corrupting your files, Windows stops everything and displays an error screen with a stop code that identifies the problem. On newer versions of Windows 11 (24H2 and later), this screen appears black instead of blue, but the troubleshooting process is identical.

I spent over 10 years fixing blue screens in my computer repair shop, and the good news is that 90% of them are caused by the same few things. Here is the breakdown of the most common causes:

• Drivers (70% of all BSODs) — Bad, outdated, or recently updated drivers, especially graphics and network drivers. Common stop codes: IRQL_NOT_LESS_OR_EQUAL, DRIVER_IRQL_NOT_LESS_OR_EQUAL
• RAM/Memory (15%) — Faulty, failing, or incompatible RAM sticks you might not know about. Common stop codes: PAGE_FAULT_IN_NONPAGED_AREA, KERNEL_SECURITY_CHECK_FAILURE
• Disk/Storage (10%) — Failing hard drive or SSD with bad sectors or file system corruption. Common stop codes: KERNEL_DATA_INPAGE_ERROR, CRITICAL_PROCESS_DIED
• Software (5%) — Antivirus conflicts, bad Windows updates, unstable overclocks, or software that corrupts system files. Common stop codes: SYSTEM_SERVICE_EXCEPTION, DPC_WATCHDOG_VIOLATION

Despite the name, a blue screen of death usually does not mean your computer is dying. In most cases, it is a software issue that is completely fixable.

How to Identify What Caused Your Blue Screen

Windows saves a crash dump file every time a blue screen occurs, and a free tool called BlueScreenView by NirSoft can read these dumps and tell you exactly what went wrong. Download the zip file from the official NirSoft page, extract it, and launch the application.

BlueScreenView displays a list of every blue screen your computer has experienced. The two most important columns are the Bug Check String (the stop code, like CRITICAL_PROCESS_DIED) and the Caused By Driver column, which identifies the exact driver or executable that failed critically.

With this information, you can search for the specific stop code or driver name online, or ask an AI assistant to help you troubleshoot. But if you would rather skip the crash dump analysis, the fixes below are organized from most common to least common cause and will work regardless of your specific stop code.

Fix 1: Undo Recent Hardware or Software Changes

In my computer repair shop, the first question I always asked customers was: what changed recently? This single question solved the majority of blue screen cases because the answer almost always points directly to the cause.

New hardware: If you recently installed a new graphics card, RAM, SSD, hard drive, or even a USB peripheral and the blue screens started right after, remove or disconnect what you added and boot up again. If the blue screens stop, the hardware is either faulty, incompatible with your system, or was not installed properly. Try reinstalling it once more — if the blue screens return, replace it or return it.

New software: If you recently installed a new program, antivirus, VPN, or overclocking utility and the blue screens began right after, uninstall that software and see if the problem goes away.

Windows Update: If the blue screens started after a Windows update, navigate to Settings > Windows Update > Update History > Uninstall Updates and remove the most recent update. This is more common than most people think — bad Windows updates have caused widespread blue screen issues multiple times, including as recently as January 2026.

This is usually the quickest and easiest fix, and it normally does not require any special tools.

Fix 2: Roll Back or Update Problematic Drivers

Drivers account for nearly 70% of all blue screens in Windows, making them the single most common cause. Graphics drivers and network drivers are the most frequent culprits, but any driver that was recently updated or corrupted can trigger a BSOD.

To troubleshoot drivers, right-click the Start button and open Device Manager. Here you can see every driver category — display adapters (GPU), network adapters, disk drives, and more.

If you know or suspect which driver is causing the issue (BlueScreenView can tell you this), navigate to that device in Device Manager, right-click it, select Properties, go to the Driver tab, and click Roll Back Driver. You will be prompted for a reason — select any option and click Yes. This reverts to the previous driver version, which is often more stable.

If the Roll Back Driver option is grayed out, use Update Driver > Search automatically for drivers instead. Windows will check for a newer, potentially more stable driver and install it if available.

Tip: Windows Update can install driver updates without your knowledge. Check Settings > Windows Update > Update History to see if any drivers were recently updated. If they were, you can roll them back in Device Manager using the steps above.

I have dedicated tutorials that show you exactly how to install or update drivers. Check them out if you need more help:

You can also read my written guides on how to install drivers on Windows 10/11 and how to install missing drivers using Snappy Driver Installer Origin.

Fix 3: Test Your RAM for Errors

Faulty RAM is the second most common cause of blue screens, and your computer could have a bad memory stick without showing any obvious symptoms other than occasional crashes. Windows includes a built-in tool called the Windows Memory Diagnostic that can test for memory errors.

Search for “Windows Memory Diagnostic” in the Start menu and open it. Select Restart now and check for problems. Your computer will restart and display a diagnostic screen that tests your RAM for errors. This process can take quite a while depending on how much memory you have — just be patient and let it complete.

If the diagnostic tool crashes during the test, that is a strong indicator that your RAM is faulty. If you have multiple RAM sticks, you will need to remove all but one and test each stick individually to identify which one is bad.

Once the test completes and the computer restarts, if you do not see results automatically, open Event Viewer (search for it in the Start menu), navigate to Windows Logs > System, click Find, and search for MemoryDiagnostics-Results (this is case sensitive — type it exactly). The results entry will tell you whether any errors were detected.

The built-in Windows Memory Diagnostic is a decent starting point, but it is not the most thorough test available. For a definitive RAM test, I always recommend MemTest86, which runs outside of Windows and catches errors the built-in tool can miss. I have an in-depth tutorial on how to use it:

Read the full written guide on how to test RAM for errors with MemTest86.

Fix 4: Check Your Hard Drive or SSD Health

If your RAM tests come back clean, the next thing to check is your storage drives. A failing hard drive or SSD with bad sectors or file system corruption can cause blue screens with stop codes like KERNEL_DATA_INPAGE_ERROR or CRITICAL_PROCESS_DIED.

To run a disk check, right-click the Start button and open Terminal or PowerShell as Admin. Run the following command:

chkdsk C: /f /r

Replace C: with whatever drive letter you want to test. If you have multiple drives, test each one. When prompted, type Y and press Enter to schedule the check for the next restart. Restart your computer, and when you see the message about skipping disk checking — do not press any key. Let it run the full check.

If your computer crashes during the Check Disk process, that is a strong sign that the drive is failing and may need to be replaced.

Check Disk is a good start, but it can only detect certain types of errors — it cannot check for physical issues or predict drive failure. For a more thorough test, I recommend using your SSD manufacturer’s diagnostic software, or the SeaTools desktop edition which works with any hard drive or SSD brand:

Read the full guide on how to test your hard drive or SSD health.

Fix 5: Repair Corrupt Windows System Files

Corrupt Windows system files can cause blue screens even when your hardware is perfectly healthy. Windows includes two built-in repair tools — DISM and SFC — that can scan for and fix corrupted files automatically. Run these commands in order from an Admin Terminal or PowerShell (right-click the Start button to open it).

First, run the DISM command:

DISM /Online /Cleanup-Image /RestoreHealth

This scans the Windows component store for corruption and repairs it using Windows Update as a source for clean files. It can take 10-30 minutes depending on your system — be patient and let it finish completely.

Then, run the SFC command:

sfc /scannow

This performs a second verification pass on all protected system files. It is faster than DISM and will tell you if it found and repaired any corrupt files. After running both commands, restart your computer and check if the blue screens have stopped.

Fix 6: Boot into Safe Mode and Use System Restore

If you have reached this point, your system probably will not boot normally and you are stuck in a blue screen loop during startup. When this happens, Windows should automatically bring you to the Windows Recovery Environment after a few failed boot attempts.

To enter Safe Mode: From the Recovery screen, go to Troubleshoot > Advanced Options > Startup Settings, click Restart, then press 4 on your keyboard to enable Safe Mode. Safe Mode starts Windows with only the most essential drivers and services, which lets you troubleshoot without the problematic driver or software interfering.

Once in Safe Mode, you can perform all the fixes from earlier in this guide — uninstall recently added software, uninstall Windows updates, roll back drivers in Device Manager, and run the DISM and SFC commands. After making changes, restart and see if Windows boots normally.

To use System Restore: If Safe Mode does not help, go back to the Recovery screen and navigate to Troubleshoot > Advanced Options > System Restore. Click Next, and you will see a list of available restore points — previous snapshots of your system from when it was working properly. Click “Show more restore points” if needed, select one from before the blue screens started, and click Finish to begin the restore.

Note: System Restore only works if your computer had restore points enabled. If no restore points are available, you will need to move on to the next fix.

Fix 7: Clean Install Windows (Last Resort)

If nothing else has worked, your last software-based option is a fresh Windows installation. This wipes everything and gives you a clean slate, which eliminates any software-related cause of the blue screens. There are two ways to do this.

Option 1 — Reset this PC: From the Recovery screen, go to Troubleshoot > Reset this PC. Choose Keep my files (removes apps and settings but preserves personal files), then select Cloud download to get a fresh copy of the Windows system files directly from Microsoft.

Option 2 — Full clean install (recommended): For the most reliable result, do a complete clean install using a USB drive with a fresh Windows ISO. I have a full tutorial on how to use Winhance’s Windows Installation Media Utility to create a custom ISO that is already debloated and optimized from the moment you reach the desktop:

Important: Before doing a clean install, back up all of your important files to a separate drive. A clean install completely wipes the drive you are installing Windows to — everything on it will be permanently deleted.

What If Windows Still Blue Screens After a Clean Install?

If you are still getting blue screens after a completely fresh Windows installation, you are almost certainly dealing with faulty hardware. At this point, the problem is either failing RAM, a dying hard drive or SSD, a faulty graphics card, or in rare cases a failing motherboard or CPU.

If you have already tested your RAM and drives using the methods above and they passed, the next step is to stress test your graphics card for errors:

If the GPU also passes, I would recommend taking your computer to a professional repair shop or contacting your system manufacturer. Motherboard and CPU failures are difficult to diagnose without specialized equipment.

Secure Your Connection with ProtonVPN

While troubleshooting your PC, it is worth securing your internet connection too. I personally use ProtonVPN — they have a genuinely free tier with unlimited bandwidth and no logs, which is rare for a VPN provider. The free version auto-connects to the fastest available server, making it great for everyday private browsing.

If you need to pick a specific country (like for streaming), you will need their paid plan. This video is not sponsored by ProtonVPN, but the links below are affiliate links — if you decide to upgrade, I earn a small commission at no extra cost to you, and it helps support the channel.

• ProtonVPN Free (Unlimited Data)
• ProtonVPN Plus (Special Deal)

Frequently Asked Questions

Does a blue screen of death mean my computer is broken?

Not usually. The majority of blue screens are caused by software issues — bad drivers, corrupt system files, or problematic Windows updates — all of which can be fixed without replacing any hardware. You should only suspect faulty hardware if blue screens continue after a clean install of Windows.

What is the most common cause of BSOD in Windows?

Drivers are responsible for approximately 70% of all blue screens in Windows 10 and 11. Graphics card drivers (NVIDIA, AMD, Intel) and network adapter drivers are the most frequent culprits. Rolling back a recently updated driver or installing the latest stable version from the manufacturer’s website usually resolves the issue.

How do I find out what caused my blue screen?

Download the free tool BlueScreenView by NirSoft. It reads the crash dump files that Windows automatically saves each time a blue screen occurs and displays the exact stop code and the specific driver or process that triggered the crash. You can then search for that stop code or driver name to find a targeted fix.

Can a Windows update cause a blue screen?

Yes, this happens more often than you would expect. Windows updates can install new drivers or change system components in ways that cause instability on certain hardware configurations. If your blue screens started right after an update, go to Settings > Windows Update > Update History > Uninstall Updates and remove the most recent update to see if that resolves it.

Will I lose my files if I get a blue screen?

In most cases, no. The blue screen is actually Windows protecting your data — it halts everything before file corruption can occur, and your files should be intact after a restart. However, if the blue screens are being caused by a failing hard drive or SSD, there is a real risk of data loss over time. This is why I always recommend having regular backups of your important files on a separate drive.

This post SOLVED: Blue Screen of Death in Windows 10/11 (EVERY Fix!) first appeared on Memory's Tech Tips and is written by memory

Secure Boot certificates on Windows 10 and Windows 11 that were issued in 2011 are expiring in June 2026. Your PC will not stop booting — existing software keeps running — but the device enters a degraded security state and stops receiving boot-level protections. Most systems will get the new Windows UEFI CA 2023 certificate automatically through Windows Update. You can verify yours in 60 seconds with two PowerShell commands, and install the new certificates manually with a single registry-and-scheduled-task command if needed.

Applies to: Windows 10 (22H2), Windows 11 (23H2, 24H2, 25H2), Windows Server 2022 and 2025 with Secure Boot enabled | Last updated: April 19, 2026

Key Takeaways

• Two Secure Boot certificates signed in 2011 expire in June 2026, with a third expiring in October 2026. Microsoft announced this in June 2025 and has been rolling the replacement certificates out since early 2026.
• Every Windows 10, Windows 11, Windows Server 2022/2025, and LTSC device released since 2012 with Secure Boot enabled is affected. Copilot+ PCs from 2025 are not — they shipped with the new certificates already.
• If your PC has Secure Boot disabled in BIOS/UEFI, none of this applies — Secure Boot is not checking any certificates to begin with.
• Devices that miss the deadline do not stop booting. They enter a degraded security state until the new certificates are installed. The fix still works after the deadline — it just leaves a gap of unprotected time.
• Old Windows installation USB drives signed with the 2011 certificates may fail to boot on Secure Boot systems after June 2026. Re-create them from a fresh ISO before the deadline.

Quick Steps

1. Right-click the Start button and open Terminal (Admin).
2. Run Confirm-SecureBootUEFI. If it returns False, Secure Boot is disabled and you can stop here.
3. If it returns True, run the “Windows UEFI CA 2023” check command (below). True = already patched, nothing to do. False = keep going.
4. Install the new certificate by running Windows Update, or by running the manual reg add + Start-ScheduledTask command below.
5. Restart your PC twice, then re-run the check command to confirm the result is now True.

In This Guide

• Why the Secure Boot certificates need to be updated
• Who is affected by the June 2026 expiry
• What happens if you do not update in time
• Check and update your certificates (PowerShell)
• Recreate old Windows installation USBs

Why the Secure Boot Certificates Need to Be Updated

Secure Boot is a firmware-level security feature. Before Windows loads, Secure Boot checks that the bootloader and early boot components are signed by a trusted certificate. Think of it as a bouncer at the door checking IDs — a valid signature gets in, an invalid one does not. If the signature fails, the system refuses to boot.

The certificates Secure Boot relies on were issued in 2011. Fifteen years later, those certificates are reaching their expiry date. Per Microsoft’s “Act Now” Windows IT Pro blog post, two certificates expire in June 2026 and a third in October 2026. The replacements — including Windows UEFI CA 2023 — need to be provisioned into the UEFI firmware’s db variable before the old ones lapse.

Who Is Affected by the Secure Boot Certificate Expiry

Every device with Secure Boot enabled and Windows installed since 2012 is in scope. Per Microsoft’s “Refreshing the Root of Trust” blog post, this includes:

• Windows 10 (all supported versions, including LTSC)
• Windows 11 (all supported versions)
• Windows Server 2022 and 2025, plus earlier supported server versions
• Virtual machines on any of the above

Not affected:

• Copilot+ PCs released in 2025 — they shipped with the new certificates pre-provisioned.
• Systems with Secure Boot disabled — nothing is being checked, so nothing can expire.

If you dual-boot Windows and Linux, Windows will update the certificates Linux relies on (specifically shim). macOS is technically affected but falls outside Microsoft’s support scope.

What Happens If You Do Not Update in Time

Microsoft is clear on this point, and a lot of the panicky coverage online overstates it. Quoting directly from the Windows Experience blog: if a device does not receive the new Secure Boot certificates before the 2011 certificates expire, the PC will continue to function normally and existing software will keep running.

What you do lose is the ability to receive future boot-level protections, and over time you may run into hardware, firmware, or software that expects the new certificates to be present. I think of it like driving with an expired license — the car still drives, but you are not covered if anything goes wrong.

The practical risk is the Black Lotus bootkit (CVE-2022-21894). Per Microsoft’s own security write-up, Black Lotus can only be deployed against a device where the attacker already has privileged or physical access — it is not a drive-by exploit. For most home users the immediate risk is low, but keeping Secure Boot current is still good security practice.

Important: Missing the June 2026 deadline does not permanently lock you out of updating. It just means there is a window of degraded security between the old certificates expiring and the new ones being installed. Installing the update at any later point still brings the system back to a protected state.

Check and Update Your Secure Boot Certificates

Here are the exact commands I use. Run them in order and stop at the first point that says you are done.

Step 1: Open Terminal (Admin)

Right-click the Start button and choose Terminal (Admin) (on Windows 11) or Windows PowerShell (Admin) (on Windows 10). Accept the UAC prompt.

Step 2: Check if Secure Boot Is Enabled

Confirm-SecureBootUEFI

• True — Secure Boot is enabled. Continue to Step 3.
• False — Secure Boot is off. None of this applies. Stop here.

Tip: If you want Secure Boot on, enable it in the BIOS/UEFI firmware — it is not a Windows setting. Reboot into your firmware, find the Secure Boot option, and set it to Enabled. Save and exit.

Step 3: Check for the Windows UEFI CA 2023 Certificate

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

• True — The new certificate is already in your firmware’s db variable. You are done.
• False — The new certificate is not installed yet. Continue to Step 4.

Step 4a: Install via Windows Update (Recommended)

Go to Settings > Windows Update and install every pending update. For most home and business PCs that let Windows manage updates, the new Secure Boot certificates roll out automatically as part of the regular monthly patch cycle — no extra action needed.

If you use my Winhance utility, check the Windows Update policy setting. If you set it to Paused for a Long Time or Disabled, you likely have not received the new certificates. Switch the policy back to Security Updates Only or Normal, then run Windows Update. Once the certificates are in place you can switch the policy back if you want.

Tip: If you previously locked Windows to a specific version or disabled automatic updates, temporarily re-enable Security Updates and run Windows Update before the June 2026 deadline so the Secure Boot update flight can reach you.

Step 4b: Install Manually via Registry + Scheduled Task

If you would rather trigger the certificate install directly, run this in the elevated terminal. The first part sets the AvailableUpdates registry flag that tells Windows a Secure Boot update is pending; the second part runs the scheduled task that applies it:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f; Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

You should see “The operation completed successfully.” The command is safe to run even if the new certificates are already installed — it simply reports success either way.

Important: Restart your PC twice after running the manual command. The first reboot applies the certificate update to firmware; the second clears the boot manager cache and finalises the change. Both restarts are required — one is not enough.

Step 5: Verify

After both restarts, open Terminal (Admin) again and re-run the Step 3 command:

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

It should now return True. If it still returns False after two restarts, your OEM firmware may require a BIOS update to accept the new certificates — check your motherboard or laptop vendor’s support page for a 2026 BIOS/UEFI release.

Recreate Old Windows Installation USB Drives

This one gets overlooked. If you have an old Windows installation USB sitting in a drawer, its bootloader was signed with the 2011 certificates. After June 2026, Secure Boot-enabled systems may refuse to boot from it.

Create a fresh USB using a current Windows ISO before the deadline. My guides on downloading the Windows 11 ISO and creating a bootable USB with Rufus walk through the full process. If you prefer my own tools, WimUtil handles the ISO download and USB creation in a single app.

Related Guides

• Winhance — my Windows enhancement utility
• How to Disable Automatic Updates on Windows 10/11
• Create a Bootable USB With Rufus (Windows 10/11)
• WimUtil — Windows Installation Media Utility

Frequently Asked Questions

Will my PC stop working when Secure Boot certificates expire in June 2026?

No. Microsoft has confirmed the PC will continue to function normally and existing software will keep running. What happens is the device enters a degraded security state and loses the ability to receive future boot-level protections. It is not an emergency for most home users, but you should still get the update applied.

Do I need to do anything if Secure Boot is disabled on my PC?

No. If Confirm-SecureBootUEFI returns False, Secure Boot is not checking any certificates, so the expiry does not affect you. You only need to act if Secure Boot is enabled.

How do I know if the update is already applied?

Run [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023' in an admin PowerShell window. True means the new certificate is in your firmware’s db. False means you still need to install it.

What is Black Lotus and should I be worried about it?

Black Lotus is a bootkit that Secure Boot is designed to defend against (CVE-2022-21894). Per Microsoft’s security write-up, it can only be deployed on a system where the attacker already has privileged or physical access — it is not a drive-by threat. For most home users the direct risk is low, but keeping Secure Boot certificates current is still the right call.

What if I miss the June 2026 deadline?

You do not permanently lose the ability to update. There will simply be a gap — from the day the old certificates expire until you install the new ones — where your system is in a degraded security state. Running the install command after the deadline still works and still brings you back to a protected state.

Will this break my dual-boot Linux install?

No. Microsoft has said that on Windows + Linux dual-boot systems, Windows will update the certificates Linux relies on (the shim bootloader chain) at the same time. Your Linux install keeps booting after the update.

This post Windows Secure Boot Certificates Expire in June 2026 – What to Do first appeared on Memory's Tech Tips and is written by memory