Eclipse Community

My two newest computers both "came with" Win11.
But I intentionally "upgraded" to Win10 (available through work).

My Win10 is tweaked via WinReducer EX-100.
While I love that route, not many other users have any interest in tackling the small learning curve.

So I figured I'd create a thread on "debloating" a 'normal install' of Win11.

I am using 22H2. A "semi-official" download is available from here:
https://learn.microsoft.com/en-us/answers/questions/5491345/has-anyone-got-the-windows-11-22h2-old-iso-file

Another source is from here:
https://uupdump.net/known.php?q=category:w11-22h2

I used the UUP Dump as my source for 22H2 (22621.1) *and* for 22H2 (22621.6060) [for curiosity of very first versus very last].
For this exercise, I excluded .NET 3.5 (operating under the assumption that I can add it later as a standalone install if needed).

Win11 22H2 (22621.1) "normal install" (privacy settings during install set to 'no').
RAM did drop to 1.8 GB after 35 minutes of idle time.

After a reboot but before any "debloats":

Obtain Windows Defender Remover from here:
https://sourceforge.net/projects/windows-defender-remove.mirror/files/release13/

Run it and select to Remove Windows Defender AntiVirus + Windows Security App
Note that it will force a reboot so run it at a time you aren't multi-tasking.
Saves over 300 MB of RAM !!! (and hours of headaches when it deletes files from two decades ago that it doesn't recognize)
(and... um... if you feel that Windows Defender is an "essential" [ie, "not bloat"] part of Windows, then stop here, this guide is likely not for you...)

Obtain Windows Update Blocker from here:
https://github.com/Hudrig0/Windows-Update-Blocker

EDIT the Wub.ini file [Service_List] section as follows:
[Service_List]
; 2=Auto
; 3=Manual
; 4=Disabled
wuauserv=2,4
dosvc=2,4
WaaSMedicSvc=3,4
UsoSvc=2,4
BITS=3,3
InstallService=3,4
mpssvc=2,4
BFE=2,4
Sense=3,4
WdNisDrv=3,4
WdNisSvc=3,4
WdBoot=0,4
WinDefend=2,4
WdFilter=0,4
TimeBrokerSvc=3,4

This will disable Windows Updates, Defender Firewall, and Defender AntiVirus.
Some of the Defender items only exist in newer versions of Win11, I have included here for completeness.
For additional details, see here:
https://windowsreport.com/disable-windows-defender-windows-11/
https://revertservice.com/11/<name-of-service>/ (edit link to contain actual name of service)

Save edited Wub.ini and run Wub_x64.exe as administrator.

For users of 25H2 or higher, this is where we would disable/remove AI Features:
https://github.com/zoicware/RemoveWindowsAI

I may visit this in the future.
But for now, all of my computers run either Win10 2016 LTSB, Win10 21H2 LTSC, or Win11 22H2 Pro.

Disable smartscreen.exe and UserOOBEBroker.exe.

Save below as <pick-a-name>.bat and run as administrator:

takeown /f "%systemroot%\System32\smartscreen.exe" /a
icacls "%systemroot%\System32\smartscreen.exe" /reset
taskkill /im smartscreen.exe /f
icacls "%systemroot%\System32\smartscreen.exe" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18

takeown /s %computername% /u %username% /f "%WINDIR%\System32\oobe\UserOOBEBroker.exe"
icacls "%WINDIR%\System32\oobe\UserOOBEBroker.exe" /inheritance:r /grant:r %username%:F
taskkill /im UserOOBEBroker.exe /f
del "%WINDIR%\System32\oobe\UserOOBEBroker.exe" /s /f /q

By default, Windows does not allow running unsigned PowerShell scripts.

To enable, right-click on the Start button and select Terminal (Admin).

Run the below command (select "Y" if confirmation prompt appears):
Set-ExecutionPolicy RemoteSigned


Note: If you wish to revert to default policy, you can run the below command AFTER going through all the steps of this debloat guide:
Set-ExecutionPolicy Restricted

Disable Web Experience (Widgets.exe and its multiple msedgeview2.exe child processes).

Save below as <pick-a-name>.ps1 and run (top half is just a trick to force it to self-elevate and run as admin):
// Source - https://stackoverflow.com/a/27872686
// Posted by Andrew Odri, modified by community. See post 'Timeline' for change history
// Retrieved 2026-02-17, License - CC BY-SA 4.0

# Get the ID and security principal of the current user account
$myWindowsID = [System.Security.Principal.WindowsIdentity]::GetCurrent();
$myWindowsPrincipal = New-Object System.Security.Principal.WindowsPrincipal($myWindowsID);

# Get the security principal for the administrator role
$adminRole = [System.Security.Principal.WindowsBuiltInRole]::Administrator;

# Check to see if we are currently running as an administrator
if ($myWindowsPrincipal.IsInRole($adminRole))
{
# We are running as an administrator, so change the title and background colour to indicate this
$Host.UI.RawUI.WindowTitle = $myInvocation.MyCommand.Definition + "(Elevated)";
$Host.UI.RawUI.BackgroundColor = "DarkBlue";
Clear-Host;
}
else {
# We are not running as an administrator, so relaunch as administrator

# Create a new process object that starts PowerShell
$newProcess = New-Object System.Diagnostics.ProcessStartInfo "PowerShell";

# Specify the current script path and name as a parameter with added scope and support for scripts with spaces in it's path
$newProcess.Arguments = "& '" + $script:MyInvocation.MyCommand.Path + "'"

# Indicate that the process should be elevated
$newProcess.Verb = "runas";

# Start the new process
[System.Diagnostics.Process]::Start($newProcess);

# Exit from the current, unelevated, process
Exit;
}

# Run your code that needs to be elevated here...

# Write-Host -NoNewLine "Press any key to continue...";
# $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown");


# Your script here
Get-AppxPackage -AllUsers | Where-Object {$_.Name -like "*WebExperience*"} | Remove-AppxPackage -AllUsers -ErrorAction SilentlyContinue
Get-AppxProvisionedPackage -online | Where-Object {$_.Name -like "*WebExperience*"} | Remove-AppxProvisionedPackage -online -Verbose

Obtain Remove OneDrive.ps1 from here:
https://github.com/ionuttbara/one-drive-uninstaller/blob/main/Remove%20OneDrive.ps1

Optional: Edit the very bottom FIVE lines to REMOVE the "#" at the start of all five lines.

Right-click and select Run with PowerShell.

Disable mobsync.exe.

Save as <pick-a-name>.ps1 and run:
// Source - https://stackoverflow.com/a/27872686
// Posted by Andrew Odri, modified by community. See post 'Timeline' for change history
// Retrieved 2026-02-17, License - CC BY-SA 4.0

# Get the ID and security principal of the current user account
$myWindowsID = [System.Security.Principal.WindowsIdentity]::GetCurrent();
$myWindowsPrincipal = New-Object System.Security.Principal.WindowsPrincipal($myWindowsID);

# Get the security principal for the administrator role
$adminRole = [System.Security.Principal.WindowsBuiltInRole]::Administrator;

# Check to see if we are currently running as an administrator
if ($myWindowsPrincipal.IsInRole($adminRole))
{
# We are running as an administrator, so change the title and background colour to indicate this
$Host.UI.RawUI.WindowTitle = $myInvocation.MyCommand.Definition + "(Elevated)";
$Host.UI.RawUI.BackgroundColor = "DarkBlue";
Clear-Host;
}
else {
# We are not running as an administrator, so relaunch as administrator

# Create a new process object that starts PowerShell
$newProcess = New-Object System.Diagnostics.ProcessStartInfo "PowerShell";

# Specify the current script path and name as a parameter with added scope and support for scripts with spaces in it's path
$newProcess.Arguments = "& '" + $script:MyInvocation.MyCommand.Path + "'"

# Indicate that the process should be elevated
$newProcess.Verb = "runas";

# Start the new process
[System.Diagnostics.Process]::Start($newProcess);

# Exit from the current, unelevated, process
Exit;
}

# Run your code that needs to be elevated here...

# Write-Host -NoNewLine "Press any key to continue...";
# $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown");


# Your script here
New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mobsync.exe" | New-ItemProperty -Name Debugger -PropertyType String -Value "%windir%\System32\systray.exe" -Force

Remove Edge or Remove Edge + WebView (I remove Edge + WebView).

Obtain your preference from here:
https://github.com/ShadowWhisperer/Remove-MS-Edge

Run as administrator.

Disable SearchHost.exe and related.

Save as <pick-a-name>.bat and run as administrator:

takeown /s %computername% /u %username% /f "%WINDIR%\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"
icacls "%WINDIR%\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" /inheritance:r /grant:r %username%:F
taskkill /im SearchHost.exe /f
del "%WINDIR%\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" /s /f /q

sc config WSearch start= disabled
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d "0" /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "BingSearchEnabled" /t REG_DWORD /d "0" /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Windows Search" /v "CortanaConsent" /t REG_DWORD /d "0" /f
reg add "HKCU\Software\Policies\Microsoft\Windows\Explorer" /v "DisableSearchBoxSuggestions" /t REG_DWORD /d "1" /f
reg add "HKLM\Software\Policies\Microsoft\Windows\Windows Search" /v "DisableSearch" /t REG_DWORD /d "1" /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\SearchSettings" /v "IsAADCloudSearchEnabled" /t REG_DWORD /d "0" /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\SearchSettings" /v "IsDeviceSearchHistoryEnabled" /t REG_DWORD /d "0" /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\SearchSettings" /v "IsMSACloudSearchEnabled" /t REG_DWORD /d "0" /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\SearchSettings" /v "SafeSearchMode" /t REG_DWORD /d "0" /f

Reboot to fully take effect but reboot can be delayed until it is convenient.

Disable ctfmon.exe.

Save as <pick-a-name>.bat and run as administrator:

takeown /s %computername% /u %username% /f "%WINDIR%\System32\ctfmon.exe"
icacls "%WINDIR%\System32\ctfmon.exe" /inheritance:r /grant:r %username%:F
taskkill /im ctfmon.exe /f
icacls "%systemroot%\System32\ctfmon.exe" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18
del "%WINDIR%\System32\ctfmon.exe" /s /f /q

Disable Clipboard COLLECTION Service.
This does not disable your clipboard, you can still copy and paste.
It disables the collection (evolved into what newer versions of 11-mod'ing refers to as "AI data harvesting") of your clipboard HISTORY.

Go to:
https://privacy.sexy/

Type cbdhsvc in the search field.
Select Disable clipboard data collection.
Click the "download" button.

Run as administrator.

Experimental

Since I've primarily only ever used ENTERPRISE editions, this is my first run (with exception of previous post) of Privacy.Sexy.
I'm running the below in my Win11 VM and testing its effectiveness.
This technically "duplicates" some of the items we already removed (namely OneDrive, Edge, Windows Web Experience Pack [Widgets]).

Select all primary options of Remove Bloatware section, download, run as administrator.
Reboot.

Remove "Chat" icon from Taskbar.
Personal preference, optional.

Go here (or select different option):
https://www.elevenforum.com/t/add-or-remove-chat-button-on-taskbar-in-windows-11.696/#option5

Download and run Disable_Chat_icon_on_taskbar_for_all_users.reg
Reboot.

That's a lot of work just to have a normal OS, which should be the default state out of the box

The ENTERPRISE editions are "mostly" like this.
But even the Enterprise editions require some debloating for my preferences.

Technically, all of this can be "merged" into a "one-and-done".
But for now I figured most would prefer to know "what" they are removing instead of just "taking my word for it" and providing a "one-and-done".

Disable Windows Push Notification Services.

Save as <pick-a-name>.bat and run as administrator:

sc.exe config WpnUserService start= disabled

Reboot.

SKIP this if you use any Bluetooth devices.
At least, that's the rule of thumb regarding this service.
BUT my bluetooth headset still works, so "mileage may vary".

Disable Connected Devices Platform Service.

Save as <pick-a-name>.bat and run as administrator:

sc.exe config CDPSvc start= disabled
sc.exe config CDPUserSvc start= disabled

Reboot.

All of that gets me to the below.

0.8 GB RAM (down from "normal install" of 1.5 GB)
68 processes (down from "normal install" of 117)

Disable Udk User Service.
For more info: https://woshub.com/manage-per-user-services-windows/

Save as <pick-a-name>.bat and run as administrator:

sc.exe config UdkUserSvc start= disabled

Reboot.