Strip Windows of junk services, AppX packages, scheduled tasks, startup entries, and telemetry. Use when the user wants to clean up Windows, disable bloatware, or optimize for performance.
Audit and remove Windows bloat. Run as admin PowerShell via scripts (bash mangles $_).
Bash mangles $_, $p, and other PS variables. ALWAYS write .ps1 scripts to C:\code\endless\ and run via:
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\code\endless\scriptname.ps1"
Delete scripts after use. Never use $PID (reserved). Use $procId instead.
# Audit running services
Get-Service | Where-Object Status -eq Running | Select-Object Name, DisplayName, StartType | Sort-Object DisplayName
Disable method -- registry is authoritative, Set-Service often doesn't stick:
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\$svc" -Name 'Start' -Value 4
Stop-Service -Name $svc -Force -ErrorAction SilentlyContinue
Per-user services (ending in _xxxxx): disable BOTH the instance AND the template:
# Template (prevents respawn on new sessions)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\OneSyncSvc" -Name 'Start' -Value 4
# Instance
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\OneSyncSvc_89f2f" -Name 'Start' -Value 4
Stop with timeout -- some services hang on stop:
$s = Get-Service -Name $svc -ErrorAction SilentlyContinue
if ($s -and $s.Status -eq 'Running') {
try {
$s.Stop()
$s.WaitForStatus('Stopped', [TimeSpan]::FromSeconds(5))
} catch { }
}
Known safe-to-disable services:
GamingServices special case: backed by AppX package. Set-Service gets overridden. Must remove package:
Get-AppxPackage -AllUsers -Name 'Microsoft.GamingServices' | Remove-AppxPackage -AllUsers
# Audit
Get-AppxPackage | Select-Object Name | Sort-Object Name
Remove method -- deprovision + per-user removal (works even with InstallService disabled):
Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq $pkg | Remove-AppxProvisionedPackage -Online -ErrorAction SilentlyContinue
Get-AppxPackage -Name $pkg | Remove-AppxPackage -ErrorAction SilentlyContinue
If -AllUsers fails with 0x80070002, use the above pattern instead.
SystemApps (0x80073CFA) can't be removed via AppX. Use binary rename:
takeown /f "$exePath" /a
icacls "$exePath" /grant Administrators:F
Rename-Item "$exePath" "$exeName.disabled"
Note: this does NOT work in C:\Program Files\WindowsApps\ (integrity level lock). Only works in C:\Windows\SystemApps\.
Known safe-to-remove packages:
Keep: Claude, WindowsTerminal, WindowsStore, DesktopAppInstaller, Winget.Source, WindowsCalculator, ScreenSketch, MSPaint, Photos, NVIDIA, Realtek, Edge, all runtimes (.NET, VCLibs, UI.Xaml, WindowsAppRuntime, DirectX)
# Audit
Get-ScheduledTask | Where-Object State -eq Ready | Select-Object TaskName, TaskPath | Sort-Object TaskPath
Known safe-to-disable:
UpdateOrchestrator tasks are TrustedInstaller-protected -- disable via registry workaround or accept they're neutered once their parent services/apps are removed.
# HKLM Run (all users)
Get-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run'
# HKCU Run (current user)
Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run'
Remove entries with Remove-ItemProperty.
# Office telemetry
New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Common\Feedback" -Force
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Common\Feedback" -Name "Enabled" -Value 0 -Type DWord
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Common\Feedback" -Name "SurveyEnabled" -Value 0 -Type DWord
# ContentDeliveryManager (Start menu ads, silent installs)
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" -Name "SilentInstalledAppsEnabled" -Value 0 -Type DWord
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" -Name "SystemPaneSuggestionsEnabled" -Value 0 -Type DWord
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" -Name "SubscribedContent-338389Enabled" -Value 0 -Type DWord
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" -Name "SubscribedContent-310093Enabled" -Value 0 -Type DWord
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" -Name "SubscribedContent-338388Enabled" -Value 0 -Type DWord
# Store auto-updates
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore" -Force
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore" -Name "AutoDownload" -Value 2 -Type DWord
After disabling services, some svchost processes stay alive until reboot. Map and kill them:
# Map svchost to services
$allSvcs = Get-CimInstance Win32_Service
Get-Process -Name svchost | Sort-Object WorkingSet64 -Descending | ForEach-Object {
$procId = $_.Id
$mb = [math]::Round($_.WorkingSet64 / 1MB, 1)
$svcs = ($allSvcs | Where-Object { $_.ProcessId -eq $procId } | Select-Object -ExpandProperty Name) -join ', '
if (-not $svcs) { $svcs = '(no service mapped)' }
Write-Host ("{0,6} MB PID {1,6} {2}" -f $mb, $procId, $svcs)
}
Kill zombie PIDs with Stop-Process -Id $procId -Force.
Present findings as tables with columns: Service/Package | What it does | Verdict. Group into "kill" and "keep". Always explain what the user would lose. Ask before disabling anything that could affect hardware (webcam, Bluetooth, audio).