01 · DEFINITIONS
Three different operations wear the same word.
People say “debloat” and mean anything from turning off suggested content to deleting servicing components. The risk profile is completely different at each level.
| Level | What it does | Reversible? | Worth it? |
|---|---|---|---|
| Configuration | Settings, policies and registry values: suggestions, ads, telemetry level, startup apps, lock screen content | Fully | Yes — nearly all the real benefit lives here |
| App removal | Uninstalling preinstalled store apps you do not use | Yes, reinstall from the store or winget | Mostly cosmetic, occasionally frees real disk |
| Component removal | Stripping servicing stack pieces, Defender, WinSxS, update infrastructure | No, generally requires a reinstall | No. This is what produces the machine that cannot take a feature update. |
The useful part is the first row, and it is the part nobody makes videos about, because switching off six settings is not dramatic. The dramatic scripts operate in the third row, and the cost arrives six months later when a cumulative update fails with an error code nobody can search.
Set a restore point before anything. System Protection is off by default on many installations. Turn it on, create a point, and name it after what you are about to do. Two minutes now, versus reinstalling later.
02 · THE SAFE LAYER
Twelve switches that account for most of the annoyance.
Before any script, spend ten minutes in Settings. This is the layer Microsoft supports, which means it survives feature updates instead of being silently restored by them.
Privacy and content
- Privacy and security → General: turn off the advertising ID, personalised ads, suggested content and app-launch tracking.
- Privacy and security → Diagnostics: set diagnostic data to the required level, turn off tailored experiences, and clear the collected data once.
- Personalisation → Lock screen: replace Windows Spotlight with a static picture to remove the promotional cards.
- Personalisation → Start: disable recommendations, recently added apps and tips.
- Personalisation → Device usage: clear every category. It only exists to shape suggestions.
- System → Notifications: at the bottom, turn off the suggestions, tips and setup prompts. These are the notifications people mistake for malware.
Performance and behaviour
- Apps → Startup: the highest-value screen in the whole system. Disable everything you did not deliberately install, especially updaters and launcher helpers.
- Search permissions: turn off cloud content search and search history if you do not want web results in the Start menu.
- Widgets and the taskbar: remove what you do not use — widgets, chat, task view, search box.
- Power mode: set Best performance on a desktop; leave Balanced on a laptop unless you enjoy explaining the battery life to yourself.
- Storage sense: enable it, then configure it. It removes temp files and old downloads on a schedule, which is the cleanup people install third-party tools for.
- Delivery optimisation: restrict update sharing to the local network, or turn it off, if upload bandwidth matters to you.
Stop here if the machine is for work. Everything above is supported, reversible and update-safe. The remaining sections trade increasing amounts of that safety for decreasing amounts of benefit.
03 · APP REMOVAL
Uninstall properly, and know the five you should keep.
Preinstalled apps are mostly small. Removing them is about not seeing them, not about reclaiming disk space — with a couple of genuine exceptions.
Two supported routes: right-click and uninstall in the Start menu, or the package manager. The package manager is better because it is scriptable, repeatable on the next machine, and reversible with the same tool.
# See what is installed, with the exact package IDs
winget list
# Remove a specific package by ID
winget uninstall --id Microsoft.Teams
# Reinstall it later if you were wrong
winget install --id Microsoft.Teams
# Export your whole install list before you start changing things
winget export --output C:\backup\installed-apps.jsonThat last command is the point of using winget at all: an exported list is both a record of what you removed and the fastest way to rebuild the machine later with winget import.
What not to remove
| Component | Why people remove it | What actually breaks |
|---|---|---|
| Microsoft Store | Looks like bloat | App updates stop, including apps you rely on. Restoring it is awkward. |
| Windows Security / Defender | Performance folklore | You are unprotected, and some third-party suites refuse to install cleanly afterwards. |
| Microsoft Edge | Browser preference | Parts of the OS render web content through it: help pages, PDF handling, some sign-in flows. |
| Windows Update components | To stop reboots | Security updates stop arriving. Use active hours and pause instead. |
| .NET and Visual C++ runtimes | They look duplicated | They are not duplicates. Applications fail to launch with cryptic missing-DLL errors. |
Reasonable removals, by contrast, are the store-delivered extras: Xbox companion apps on a work machine, Clipchamp, the news and weather apps, third-party trials preinstalled by the laptop manufacturer, and duplicated OEM utilities that shadow features Windows already has.
04 · TOOLS AND SCRIPTS
How to read a debloat script before you run it.
Some of these tools are genuinely well made. The problem is not the tools, it is running one whose defaults you have never read on a machine you depend on.
The categories
- Privacy configurators — tools that toggle documented settings and policies, usually with an undo. Low risk, and often the fastest way to apply the section above consistently.
- Tweak collections with a menu — broad utilities that bundle app removal, service changes and installers. Fine if you select items deliberately; risky as a one-click preset.
- Aggressive removal scripts — anything that strips components, disables Defender or edits the servicing stack. This is where unrecoverable machines come from.
- Modified Windows images — pre-stripped installation media. You are trusting an anonymous build with your entire operating system, and you will not get feature updates cleanly.
Five checks before you run anything
You should be able to read what it changes. A closed binary that promises to optimise Windows is not a tool, it is a wish.
Good configurators record the previous value and can restore it. If a tool cannot revert, treat every change as permanent.
Either one is a red flag on a machine you use for real work. Skip that section, whatever the tool claims about performance.
A preset that ticks 200 boxes is not a considered configuration. Deselect everything and choose deliberately.
A virtual machine or a spare laptop first. If you would not run it on a client’s machine, do not run it on yours.
Never run a script you found in a video description as administrator without reading it. The elevated-PowerShell one-liner is the single most effective malware delivery mechanism aimed at enthusiasts, precisely because the audience is used to running exactly that.
05 · ACTUAL SPEED
What genuinely makes a Windows machine faster.
Debloating is about annoyance, not speed. If the machine feels slow, the cause is almost always on this list instead.
- Startup and background applications. Six updaters, two cloud clients and a launcher matter far more than any preinstalled store app that never runs.
- Storage. A mechanical drive holding the system is the single biggest cause of a slow modern PC. A full SSD is the second — keep 10 to 15 percent free.
- Memory pressure. Check the memory tab under load rather than at idle. Sustained high commit with disk activity is the pattern behind everything-freezes-for-a-second.
- Thermals and power limits. A laptop on a soft surface throttles. So does a desktop with three years of dust in the cooler.
- Chipset and storage drivers. Frequently still the generic ones from installation. Vendor packages are worth installing once and then leaving alone.
- Antivirus stacking. Two real-time scanners fighting over the same file system is a genuine, measurable slowdown. Pick one.
- Browser tabs and extensions. Usually the largest single consumer of memory on the machine, and the easiest thing to blame on Windows instead.
Measure before and after. Task Manager and Resource Monitor answer the question that matters — what is using the machine right now — and they are already installed. A subjective “feels snappier” after a 300-change script tells you nothing about which change helped.
06 · RECOVERY
If something is already broken.
In rough order: least destructive first. Work down this list, not up it.
# Repair the component store from Windows Update
DISM /Online /Cleanup-Image /RestoreHealth
# Then verify and repair protected system files
sfc /scannow
# Reinstall the built-in apps for the current user
Get-AppxPackage -AllUsers | ForEach-Object {
Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"
}- System Restore — if you made the restore point suggested at the top, this is the whole recovery.
- DISM, then SFC — in that order. SFC repairs from the component store, so a damaged store must be fixed first.
- Re-register the built-in apps — the command above restores Start menu entries and store apps that a script removed per user.
- Repair install — run setup from a current Windows ISO and choose to keep files and apps. This replaces the OS while preserving your data and installed programs, and it fixes almost everything short of component removal.
- Clean install — the honest endpoint if a script stripped servicing components. Restore from the backup you made first.
If you are reading this section because a one-click optimiser broke something: start at the repair install. It is faster than three evenings of forum archaeology, and you keep your applications.
07 · QUICK ANSWERS
Debloating Windows 11, briefly.
Configuration changes are safe and reversible: privacy settings, startup apps, notifications, suggested content and lock screen items. Uninstalling preinstalled store apps is also safe and reversible through winget or the Microsoft Store. Removing system components such as Defender, Windows Update infrastructure or servicing files is not safe and usually requires a reinstall to undo.
Rarely by much. Preinstalled apps that never run do not consume CPU. Real speed problems come from startup and background applications, a nearly full or mechanical system drive, thermal throttling, memory pressure and overlapping antivirus software. Fix those first and the debloating question mostly disappears.
Store-delivered extras you do not use: Xbox companion apps on a work machine, Clipchamp, news and weather apps, and manufacturer trial software. Keep the Microsoft Store, Windows Security, Edge, Windows Update components and the .NET and Visual C++ runtimes, because other software depends on them in ways that are not obvious until something fails.
Only after reading what it changes, deselecting the presets, and testing on a machine you can afford to reinstall. Prefer open-source tools that record previous values so changes can be reverted, and skip any section that touches Windows Defender or Windows Update. Never run an elevated one-liner from a video description unreviewed.
Try in this order: System Restore if you created a point, then DISM RestoreHealth followed by sfc scannow, then re-registering the built-in apps with PowerShell. If system components were removed, run a repair install from a current Windows ISO with the keep files and apps option, which replaces the operating system without losing your data.