Table of Contents

Windows-Optimize-Debloat

For those who seek to minimize their Windows 10 installs.

Download all the required files from the GitHub Repository

Introduction:

Windows 10 is an invasive and insecure operating system out of the box. Organizations like PrivacyTools.io, Microsoft, Cyber.mil, the Department of Defense, and the National Security Agency have recommended configuration changes to lockdown, harden, and secure the operating system. These changes cover a wide range of mitigations including blocking telemetry, macros, removing bloatware, and preventing many digital and physical attacks on a system. This script aims to automate the configurations recommended by those organizations.

Notes:

  • This script is designed for operation in primarily Personal Use environments. With that in mind, certain enterprise configuration settings are not implemented. This script is not designed to bring a system to 100% compliance. Rather it should be used as a stepping stone to complete most, if not all, the configuration changes that can be scripted while skipping past issues like branding and banners where those should not be implemented even in a hardened personal use environment.
  • This script is designed in such a way that the optimizations, unlike some other scripts, will not break core windows functionality.
  • Features like Windows Update, Windows Defender, the Windows Store, and Cortona have been restricted, but are not in a disfunctional state like most other Windows 10 Privacy scripts.
  • If you seek a minimized script targeted only to commercial environments, please see this GitHub Repository

Requirements:

Additions:

This script adds, removes, and changes settings on your system. Please review the script before running it.

  • Browsers will have additional extentions installed to aid in privacy and security.
    • See here for additional information.
  • To aid in automating Windows Updates the PowerShell PSWindowsUpdate module will be added to your system.

A list of scripts and tools this collection utilizes:

First Party:

Third Party:

Additional configurations were considered from:

STIGS/SRGs Applied:

How to run the script:

Manual Install:

If manually downloaded, the script must be launched from an administrative powershell in the directory containing all the files from the GitHub Repository

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force
Get-ChildItem -Recurse *.ps1 | Unblock-File
.\sos-optimize-windows.ps1

Automated Install:

Use this one-liner to automatically download, unzip all supporting files, and run the latest version of the script.

iwr -useb 'https://simeononsecurity.ch/scripts/windowsoptimizeandharden.ps1'|iex