Logo SCHEISSSEWASSER.XYZ
TUTORIALS / MODDING

WINDOWS 11 DEBLOAT & HARDENING

DIFFICULTY: INTERMEDIATE UPDATED:
Deutsche Version
Windows 11 Debloat

Time: about 30–45 minutes

Applies to Windows 11 24H2/25H2, as of September 2026. Step 1 only concerns a fresh install; steps 2–4 also work on an existing system.

INTRODUCTION

Debloating means removing preinstalled apps, ad surfaces and unneeded background services, and cutting the data sent to Microsoft down to the minimum. What you can realistically expect:

  • No more promoted apps and suggestions in the Start menu.
  • Fewer preinstalled apps and background processes. How much RAM or boot time that saves depends heavily on the system – blanket percentages are not honest.
  • Less diagnostic data. Telemetry cannot be switched off completely on Home and Pro: Microsoft always receives the "required diagnostic data" there.

First: create a restore point

Open Start, type Create a restore point → select the system drive → "Configure" → turn on system protection → "Create". Name it e.g. "Before debloat".

PREREQUISITES

  • For a fresh install: a USB stick of 8 GB or more and the Windows 11 ISO from microsoft.com.
  • An account with administrator rights.
  • For the Group Policy part of step 3: Windows 11 Pro. Home has no gpedit.msc.

STEP BY STEP

1. Install with a local account

Setup demands a Microsoft account and Microsoft has closed several well-known workarounds: the old OOBE\BYPASSNRO script and start ms-cxh:localonly no longer work on current builds. These three routes work (as of September 2026):

Route A: install stick made with Rufus (most reliable)

  1. Download and run Rufus, pick the ISO and the USB stick, click "Start".
  2. In the "Windows User Experience" dialog tick "Remove requirement for an online Microsoft account". Optionally set "Create a local account with username".
  3. Install from that stick. Setup then offers a local account.

Route B: registry value during setup

  1. On the network screen press Shift + F10 to open a command prompt.
  2. Run: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE /v BypassNRO /t REG_DWORD /d 1 /f
  3. Restart setup: shutdown /r /t 0
  4. Unplug the network cable or don't join Wi-Fi, then choose "I don't have internet" → "Continue with limited setup".

Microsoft may close this route with an update as well. Use route A or C then.

Route C: switch afterwards

Set up with a Microsoft account, then go to Settings → Accounts → Your info → "Sign in with a local account instead", set a user name and password, sign out and back in.

What you give up with a local account: settings sync across devices, "Find my device" and the automatic cloud backup of the BitLocker recovery key. Back that key up yourself.

Check

Settings → Accounts → Your info shows "Local account".

2. Clean up with WinUtil

WinUtil by Chris Titus is an open-source PowerShell tool with a GUI. The command below downloads the script from the official address and runs it – convenient, but it means trusting the project. If you don't, read the source on GitHub first.

  1. Right-click Start → "Terminal (Admin)" → confirm with "Yes". The window title then says "Administrator".
  2. Paste and press Enter: irm "https://christitus.com/win" | iex
  3. In the "Tweaks" tab click the "Standard" preset at the top. It selects the "Essential Tweaks", among them reducing telemetry and disabling activity history and consumer features (auto-installed promo apps).
  4. Click "Run Tweaks" and wait until the console reports completion. "Undo Selected Tweaks" reverts them.

Don't enable unless you know exactly what it does

  • • Anything under "Advanced Tweaks – CAUTION" – the warning is there for a reason.
  • • Disabling UAC: programs get administrator rights without asking – malware too.
  • • Disabling Defender or Windows Update: no protection, no security patches.
  • • Removing all Store apps: also removes dependencies other programs need.

Check

The Start menu shows no promoted apps. Task Manager (Ctrl+Shift+Esc) lists fewer background processes than before.

3. Privacy settings

These switches exist in every edition. The policy at the end is Pro only.

  • Settings → Privacy & security → General: turn off all four switches (advertising ID, language list, app launch tracking, suggested content).
  • Settings → Privacy & security → Diagnostics & feedback: turn off "Send optional diagnostic data" and "Tailored experiences", set feedback frequency to "Never".
  • Settings → Privacy & security → Search permissions: turn off "Show search highlights".
  • Settings → Personalization → Start: turn off recommendations and tips.
  • File Explorer → … → Options → View: untick "Show sync provider notifications" (hides OneDrive promos in Explorer).

Windows 11 Pro only: Group Policy

  1. Win + R → gpedit.msc
  2. Computer Configuration → Administrative Templates → Windows Components → Data Collection and Preview Builds
  3. "Allow Diagnostic Data" → "Enabled" → "Send required diagnostic data".

The "Diagnostic data off" level only works on Enterprise and Education. Pro falls back to "required".

4. Optional

  • Remove OneDrive if you don't use it: winget uninstall Microsoft.OneDrive. Make sure no files exist only in the cloud first.
  • Single preinstalled apps are best removed via Settings → Apps → Installed apps → "…" → Uninstall.
  • Services: WinUtil's "Set Services to Manual" switches many services to manual start; Windows still starts them when needed. Don't blanket-disable services.

PROBLEMS & FIXES

Windows is already set up with a Microsoft account

No problem: step 1, route C switches to a local account afterwards. Steps 2–4 work regardless of the account type.

WinUtil does not start
  • Is the terminal running as administrator? The window title must say "Administrator".
  • Did the antivirus flag the script? Check Windows Security → Protection history. Only allow it if you trust the project.
  • S mode cannot run PowerShell scripts. Switch out of S mode in the Microsoft Store first.
Something broke after the tweaks
  • Select the tweaks in WinUtil and run "Undo Selected Tweaks".
  • Otherwise use the restore point: Start → "Recovery" → "Open System Restore".
  • Microsoft Store missing: run wsreset -i in an admin terminal, then reinstall missing apps from the Store.
Windows no longer boots

After two interrupted boot attempts Windows opens the recovery environment automatically. There: Troubleshoot → Advanced options → System Restore → pick "Before debloat". F8 at boot does not work on Windows 11 by default.

Some things came back after a feature update

Feature updates (e.g. 24H2 → 25H2) reset individual settings. Just repeat steps 2 and 3.

Questions about WinUtil are best asked at the project itself:

WinUtil discussions on GitHub