Automate and customize the configuration of Windows.

Debloat, minimize telemetry, apps installation, general settings, and more.

🎯 Purpose

1. Install Windows (semi-unattended: see New-WindowsAnswerFile.ps1) + Updates.
2. Install MS Office365 if desired (run MsOffice365_Install.cmd).
3. Run the script (WindowsMize.ps1 or the condensed version WindowsMize.mini.ps1).
4. Finish some customization (see todo_manually.md).

📝 Characteristics

• Fully non-interactive script : make sure to review everything before running it.
• Designed for Windows 11 (most tweaks/settings also work on Windows 10).
• Works on both Administrator and Standard account (including domain account).
• 34 script files based on 26 Powershell modules.

💫 Features

🖥️ Windows settings

13 modules.
Equivalent of the Windows GUI settings app : Start > all apps > settings.
There are almost every settings, organized like the graphical's app.

📁 File Explorer

Every settings (general, view, search) + extra.
Extra: Show/Hide Home/Gallery, ShowRemovableDrivesOnlyInThisPC, AutoFolderTypeDetection, MaxIconCacheSize, UndoRedo, RecycleBin, ConfirmFileDelete.

⌛ System Properties

Equivalent of the Windows GUI System Properties.
Visual Effects, Virtual Memory (paging file), System failure, System Restore, Remote Assistance.

⚡ Power & Battery

Equivalent of the Windows GUI settings app "Power & Battery" + extra from Control Panel.
Extra: Fast startup, Hibernate, Battery settings, Modern standby (S0) Network connectivity.

🌐 Network & Internet

Configure the network settings. Improve security by disabling protocols and firewall rules (click to expand).

• Network & Internet:
  • equivalent of the Windows GUI settings app (start > all apps > settings > Network & Internet):
    Network profile, auto proxy setting, DNS, Network discovery, File and Printer Sharing.
• Firewall:
  • block some ports/programs shown as listening (locally):
    CDP, DCOM, NetBiosTcpIP, SMB, MiscProgSrv (lsass.exe, wininit.exe, Schedule, EventLog, services.exe)
  • default Defender rules:
    AllJoynRouter, CastToDevice, ConnectedDevicesPlatform, DeliveryOptimization, DIALProtocol, MicrosoftMediaFoundation, ProximitySharing, WifiDirectDiscovery, WirelessDisplay, WiFiDirectCoordinationProtocol, WiFiDirectKernelModeDriver
• Protocol:
  • IPv6 transition technologies (6to4, Teredo, IP-HTTPS, ISATAP).
  • Network adapter protocol (Equivalent of the GUI properties (more adapter options > edit)).
  • Miscellaneous (NetBiosOverTcpIP, IcmpRedirects, IPSourceRouting, LLMNR, LMHOSTS, mDNS, SMHNR, WPAD).

📊 Telemetry

Various Group Policies to minimize Windows telemetry (click to expand).

DotNetTelemetry, NvidiaTelemetry, PowerShellTelemetry, AppAndDeviceInventory, ApplicationCompatibility, Ceip, CloudContent, ConsumerExperience, DiagnosticLogAndDumpCollectionLimit, DiagnosticsAutoLogger, DiagnosticTracing, ErrorReporting, GroupPolicySettingsLogging, HandwritingPersonalization, KmsClientActivationDataSharing, MsrtDiagnosticReport, OneSettingsDownloads, UserInfoSharing.

The main telemetry configurations are in the Windows settings app.
See "Windows Settings App > Privacy & security > Windows permissions".

For Acrobat Reader & MS Office telemetry, see "Applications Settings".

🛠️ Tweaks

Various tweaks to improve and customize Windows. (click to expand).

• Security, privacy and networking:
  DisplayLastSignedinUserName, HomeGroup, Hotspot2, LocalAccountsSecurityQuestions, LockBatchFilesWhenInUse, LockScreenCameraAccess, MessagingCloudSync, NotificationsNetworkUsage, PasswordExpiration, PasswordRevealButton, PrinterDriversDownloadOverHttp, PrintingOverHttp, WifiSense, Wpbt.

• System and performance:
  FirstSigninAnimation, FullscreenOptimizations, NtfsLastAccessTime, NumLockAtStartup, ServiceHostSplitting, Short8Dot3FileName, StartMenuWebview2Version, StartupAppsDelay, StartupShutdownVerboseStatusMessages.

• User interface and experience:
  ActionCenterLayout, BackupYourPCBanners, CopyPasteDialogShowMoreDetails, GameBarLinks, HelpTips, MenuShowDelay, OnlineTips, ShortcutNameSuffix, SuggestedContent, TaskbarCalendarState, WindowsExperimentation, WindowsInputExperiencePreload, WindowsPrivacySettingsExperience, WindowsSettingsSearchAgent, WindowsSharedExperience, WindowsSpotlight.

• Windows features and settings:
  DisplayLockScreen, DisplayModeChangeAnimation, EaseOfAccessReadScanSection, EventLogLocation, FileHistory, FontProviders, HomeSettingPageVisibility, LocationPermission, LocationScriptingPermission, OpenWithDialogStoreAccess, SensorsPermission, TaskbarLastActiveClick, WindowsHelpSupport (F1Key & Feedback), WindowsMediaDrmOnlineAccess, WindowsUpdateSearchDrivers.

💿 Applications

2 modules.

Management (Removal | Installation ) & Configuration (click to expand)

• Uninstall unwanted default apps (bloatware).
  e.g. Edge, OneDrive, Start Menu sponsored apps, Widgets, BingSearch, ClipChamp, etc...

• Install applications via Winget.

  Predefined apps with short names (aliases for Winget package names):
  Git, VSCode, VLC, Bitwarden, KeePassXC, ProtonPass, AcrobatReader, SumatraPDF, 7zip, Notepad++, qBittorrent, ProtonVPN, MullVadVPN, Brave, Firefox, MullvadBrowser, VCRedist, DirectX9EndUserRuntime, DotNetDesktopRuntime.

  You can also install any apps with their Winget app Id (e.g. "Valve.Steam").

• Configure application settings.

  Apps: Acrobat Reader, Brave Browser, Git, KeePassXC, MS Office, qBittorrent, VLC, VSCode.
  UWP apps: MS Store, Notepad, Paint, Photos, Snipping Tool, Terminal.

💾 RamDisk

Configure a RamDisk for "Brave Browser" and "VSCode" (click to expand).

Brave Browser:
You can choose between 2 methods.
Moving the entire "User Data" folder or just the cache folders.

For the entire "User Data" folder (Windows Pro+ only):
Only few elements are either restored to or excluded from the RamDisk:

• Extensions and their settings (excluded. i.e. symlinked).
• Bookmarks and their favicons (saved and restored upon logoff/logon).
• Settings preferences (saved and restored upon logoff/logon).

e.g. By default, history and cookies are not restored across logoff/logon.

⚙️ Services & Scheduled Tasks

2 modules.
Configure (e.g. disable) Windows Services & Scheduled Tasks (grouped by categories).

There are a lot of comments about the services in "src > modules > services > private".
Make sure to review them to know which one to disable according to your usages.

📚 Usage

It's recommended to use Notepad++, VSCode or else to have the code highlighted.

Main script

WindowsMize.ps1 is the main script that executes the other scripts.
The settings are divided into six main categories across 31 script files.
These script files are located in the "scripts" folder.

You can uncomment or comment the script names to execute or not the corresponding script.
Example:
To execute only "Telemetry & Annoyances", "File Explorer settings" and some others:
comment everything except the script files you want to run.

$ScriptsToExecute = @(
    # --- Apps Management
    'apps_management\debloat'
    #'apps_management\install'

    # --- Apps Settings
    [...]

    # --- Network & Internet
    [...]

    # --- System & Tweaks
    'system_&_tweaks\file_explorer'
    [...]
    'system_&_tweaks\tweaks'

    # --- Telemetry & Annoyances
    'telemetry_&_annoyances\telemetry'
    'telemetry_&_annoyances\defender_security_center'
    'telemetry_&_annoyances\privacy_&_security'
    'telemetry_&_annoyances\notifications'
    'telemetry_&_annoyances\start_&_taskbar'

    # --- Win Settings App
    [...]
    #'win_settings_app\windows_update'
)

You can provide an optional User parameter to apply the settings for a specific user.
This user must have logged-in at least once.

.\WindowsMize.ps1 # logged-on User
.\WindowsMize.ps1 -User 'Groot'
.\WindowsMize.ps1 -User 'Domain\Groot'

Setting parameters

Mostly every functions have a -State and/or -GPO parameters.

The accepted values for these parameters are always the same if not specified.
There is a remember at the top of each script file:

# Parameters values (if not specified):
#   State: Disabled | Enabled
#   GPO:   Disabled | NotConfigured (default)

If the parameter accept more or different values than the above default, they are specified under the desccription.

# --- Recall
# GPO: Disabled | Enabled | NotConfigured
Set-Recall -GPO 'Disabled'

If there is a -State parameter, its default value is specified.

# --- Advertising ID (default: Enabled)
Set-WinPermissionsSetting -AdvertisingID 'Disabled' -AdvertisingIDGPO 'Disabled'
#Set-WinPermissionsSetting -AdvertisingID 'Enabled' -AdvertisingIDGPO 'NotConfigured'

If the parameter ends with "GPO", it is a -GPO parameter.
If it doesn't, it is the -State parameter.
If not specified, the default accepted values apply.

# --- Search
# State: Hide | IconOnly | Box (default) | IconAndLabel
# GPO: Hide | IconOnly | Box | IconAndLabel | NotConfigured
Set-TaskbarSetting -SearchBox 'Hide' -SearchBoxGPO 'NotConfigured'

Function execution

To don't run a function, comment it (i.e. add the # character before the function name).

#Disable-PowerShellTelemetry

To run a function, uncomment it (i.e. remove the # character before the function name).

Disable-PowerShellTelemetry

To comment an entire section : begin with <# and end with #>.
Example:
In "Win Settings app > Bluetooth & Devices.ps1" : "Touchpad" is commented by default.

<#
# --- Touchpad
...
settings
...
#>

📥 Download & Execution

This script requires PowerShell (aka PowerShell Core) and must be run as administrator.
For Windows Pro+, it also requires LGPO (Local Group Policy Object Utility).
LGPO is used to ensure that the policy settings appear in the Group Policy Editor.

Automated

1. Open a Windows PowerShell or PowerShell prompt.
   Right-click the Start menu and select Terminal.
2. Download and extract the WindowsMize archive to the Downloads folder.
   e.g. C:\Users\<User>\Downloads\WindowsMize_<current-date>.

   irm 'https://github.com/agadiffe/WindowsMize/raw/main/tools/Download_WindowsMize.ps1' | iex

3. Open the extracted WindowsMize folder.
4. Configure the settings according to your preferences.
5. Double-click the Run_WindowsMize.cmd file to run the script WindowsMize.ps1.
   Accept the Windows UAC prompt to run it as administrator (required).
   If PowerShell and/or LGPO are not installed, they will be installed automatically.
6. Restart your computer.
   Required for many tweaks and settings to take effect.

Manually

Details (Click to expand)

1. Download WindowsMize.
2. Open the directory where you downloaded the archive and extract it.
3. Configure the settings according to your preferences.
4. Open a Windows PowerShell or PowerShell prompt.
   Right-click the Start menu and select Terminal.
5. Install PowerShell (if not already installed) and LGPO (if required).

   winget install --exact --id 'Microsoft.PowerShell' --accept-source-agreements --accept-package-agreements
   winget install --exact --id 'Microsoft.SecurityComplianceToolkit.LGPO' --accept-source-agreements --accept-package-agreements

6. Open an elevated (i.e. administrator) PowerShell prompt.
   Right-click the Start menu and select Terminal (Admin).
   At the top of the Terminal window, click the down arrow and select PowerShell.
7. Navigate to the directory where you extracted WindowsMize (replace <User> with your username).
   Example:

   cd 'C:\Users\<User>\Downloads\WindowsMize-main\WindowsMize-main'

8. Unblock the script files (might not be necessary).

   Get-ChildItem -File -Recurse | Unblock-File

9. Set the PowerShell execution policy for the current session (enables PowerShell script execution).
   (This is not required for PowerShell, but may become necessary in a future Windows release)

   Set-ExecutionPolicy -ExecutionPolicy 'Bypass' -Scope 'Process' -Force

10. Run the script.

    .\WindowsMize.ps1

    or

    .\WindowsMize.mini.ps1

11. Restart your computer.
    Required for many tweaks and settings to take effect.

📌 Remarks

• The Powershell modules source code is designed to also serve as documention.
  PS1 file often includes header comments.
  The structure allows quick navigation to identify the registry values associated with any specific setting.
  All GPO settings include references to their corresponding paths, names, and registry values.

  # gpo\ computer config > administrative tpl > windows components > data collection and preview builds
  #   do not show feedback notifications
  # not configured: delete (default) | on: 1

• Some (very) few settings may still be in the dev/beta channels.

• Make sure to backup all of your data.
  e.g. browser bookmarks, apps settings, personal files, passwords database

• Make sure your Windows is fully updated.
  Settings > Windows Update > Check for updates
  Microsoft Store > Library (or Downloads) > Check for updates (run it at least twice)

♾️ Links

• Special thanks to ElevenForum. I made a post there : WindowsMize on ElevenForum.
• STIGs: https://www.stigviewer.com/stigs/microsoft-windows-11-security-technical-implementation-guide
• CIS: https://www.tenable.com/audits/search?q=%22windows+11%22

💙 Support

If you find a bug, open an issue.
If you like the project, leave a ⭐.
Thanks.