I am the kind of person that goes through settings and turns off as many things as I can and uninstalls anything I don't use. I figure every single app and service has vulnerabilities and if I don't have a 3d printer or hololens, then I'm safer with that stuff gone.
Presumably they - or some script they didn't really understand - turned off the "Let Windows track app launches to improve Start and search results" setting.
Settings -> Background Apps -> "Let apps run in the background"
It would disable search even though nothing related to search was in the apps list (along with other presumably hidden items). The workaround was to leave background apps globally enabled and manually disable every app that showed in the list (including any that got added over time). I think this was finally fixed in 1809.
Looking at just the block-telemetry.ps1 script in this repo tells me the creator is a novice. Changing the Group Policy does NOT block telemetry in Win10 Home or Pro. Furthermore, adding MS's own domains to the hosts file or firewall aren't great techniques either, since the OS doesn't have to honor them and those domains may serve other functions.
In disable-services.ps1:
- Home Groups was discontinued and these services aren't installed by default anymore. Even if they are present, the default config is manual and they'll use zero resources if you don't have a HomeGroup set up
- Futzing with remote access services is a minefield and could kill VPNs, network shares/printers, and domain access. It's one piece in a set of dependencies that might be okay to disable, but tends to pop up in unexpected situations. RaRA is disabled by default, so if it is enabled, there is probably a reason.
- Distributed Link Tracking Client - I mean, I like my shortcuts working, but okay.
- Windows Security Center Service - Disabling this basically makes it harder for you to actually access the security center and will break 3rd party AV/firewall/security tools.
- Xbox services - Disabling kills any games bought via the Windows Store and possibly controllers. Doesn't use resources, since it's set to manual.
Almost everything else the scripts say they're doing can be done within the Settings app. I phrased it that way because the toggles may be changing multiple settings to get the desired effect and changing a single registry value isn't enough. There are some sound tweaks mixed in (some that I use myself), but nothing new and nothing to make me think the author is particularly knowledgeable about Windows configurations. I prefer something like http://www.blackviper.com/
I wanted to add that I've been pretty heavily tweaking Windows since the Win9x days, and modern Windows is a different beast compared to even Win7. Lots of services and features have not-so-obvious dependencies.
For example, the Your Phone App can't be uninstalled via normal means, but there are plenty of articles that detail the steps to uninstall it with Powershell. The problem is that this app also hooks into the experience continuity features MS is pushing heavily, and forcing an uninstall will cause issues with syncing settings across devices and the timeline feature.
Also worth noting is that simply undoing some tweaks isn't always straightforward. Delete a registry entry? Hope you noted that it was owned by Installer, because adding it back as owned by admin ain't gonna cut it.
Lastly, 90%+ of the tweak guides/scripts I've seen would completely break programming IDEs, VPN access, and systems on a corporate network. They assume you want everything stripped and will add back individual pieces as situations present themselves, but it never works out that way. Instead, the whole process approaching those situations gets borked (e.g.- program checks for a service at launch, can't find it, and closes immediately or dumps the user into some config that's not appropriate once they untweak their OS).
Most of my tweaking now is simply changing settings, disabling a few scheduled tasks and services I'm familiar with, and making a couple dozen registry changes that are reversible and not tied to vital components.
I found it being around half cases of “windows update 100 cpu” issue (yes, that is still a thing in 2019). The silly fact is that windows configuration only works in almost-default state and fails with everything else. The entire system is full of hardcoded crap that doesn’t even assume configs and modes exist. The complete absence of readable diagnostics adds to this heavily, not to mention KB articles that officially suggest magic reinstall/fix steps that never work.
Otoh, I understand streamers who periodically see this idiotic “hey, pay some attention, i found no virus” in their gaming hours.
I would want to get rid of this even if it didn't cost any resources.
Well, my personal view of that topic is certainly a lot more valid than Microsoft's.
All "non-bloat" mentioned above is mostly one big pile of shit that you generally do not need and might need only on specific machine AND in specific context. Running this concrete debloater might produce some unwanted side effects which are easy enough to fix, but it sure as heaven makes a system at least x2 faster ALL THE TIME.
Yeah, spotify is a bloat if you don't use it, just as candy crash. Defender slows down computer amazingly and those people that know how to use this are typically not in a line for babysitting and don't go around clicking britni's nude photo.jpg.exe. Windows updates are better if controled, as they more often freck up computer then don't nowdays, I definitely do not want frecking biometric shit on anything that is not surface etc..
Furthermore, scripts can be inspected and quickly fixed/forked to your own desire. Do yourself a favor and run this first thing on fresh OS. I just imagine a world where MS ships barebone OS where stuff should be enabled rather then the opposite.
One more thing should be done for even faster OS - disable MS Store. I lived weeks wondering why my system suddenly becomes slow as a snail until I did this, later to find its a well known not fixed problem.
Or you can just make your brand new machine feel like its 5 years old, once all above and more of the shit starts fighiting for CPU/disk/mem/... attention....
^ One time I cloned it to an SSD and tried some fancy ACPI patching to hack eGPU support into my old hardware, but I ended up deleting it because it offered no improvement over “boring stock install” after days of work.
^^ There was a Windows update in 2017 that assumed your system has only one EFI bootable partition, and would panic if you had 2+, so I taught myself how to hide the rescue partition from Windows to avoid a reinstall.
Powershell drama, I like it :)
No drama really, just slow machine is all.
Do you understand what a drive-by attack is? Defender is the last line of defense against unknown vulnerabilities, assuming you have the latest security patches...
> Windows updates are better if controled
I leave windows defender on 100% of the time on my personal laptop. It's totally benign in my experience and doesn't have any obvious performance impact that I can see.
I would never tell anyone to turn off windows defender. I have told people to uninstall ageing AVG/avast/Norton et Al installs that have not had definition updates in months/years and really do seem to impact day to day use of the computer.
My view is leave the virus checker that was built by the people who made windows and is built directly into windows there to do the job that the people who built the damn thing designed it to do :)
Linux is a wasteland of terrible security practices that sysadmins excuse as "acceptable" for their own workstations and servers because they think that locking down SSH is sufficient defense against e.g. malicious infections or "curl | bash".
I'm sorry that Defender has harmed you, but that's no excuse to recommend others disable automated Defender scans on some sort of schedule.
It has little to do with the functions of Windows Defender. It was a special purpose function removing one very particular file from a specific location. It was not scanning your whole system, or downloads, for malware signatures.
When you say MacOS includes software that is "almost a carbon copy of Windows Defender," are you talking about something else? I am not aware of anything that comes with MacOS that has similar features to Windows Defender.
https://www.osnews.com/story/22059/snow-leopard-to-include-a...
Stop telling people to turn off Windows Defender.
Today, we consider C and C++ to be inherently unsafe, because nobody ever does the things you need to do to make them safe. It's time we said the same about operating systems. "Oh, just don't run anything sketchy off the web!" Except your user base won't do that.
In 2019, any OS that does not come with strong antimalware protection is inherently unsafe at any speed.
Yes, this means Windows is safer than Linux. Don't @ me.
If nothing else (and there is), mac and linux need anti-malware to make sure they will never spread windows malware. E.g. in mails, or uploaded files.
This is a prime example of "expert user footgun problem".
The phrase "debloat" is a marketing-hype word that's being used to bait you all into someone's personal view of how computers should be. Expect to be forced to reinstall Windows 10 a few days or weeks after running any such script.
Whenever I tech support any of my friends, the first question I ask is "did you do expert-user things to your system?" and they say "well, I mean, I edited some Registry settings" and I just stop and tell them to reinstall Windows because it's time to amputate. I'll have to add "Have you ever opened Windows PowerShell?" to my list, because that'll catch all of these right out of the gate.
In case that's not reason enough to be afraid — check out this random sampling of changes this makes!
* "This script disables Windows Defender" — Because anti-malware protection is "bloat"
* "Disable 'Updates are available' message" — Because you shouldn't have to be notified when security updates are available for your system, for example to address zero-day RCEs
* "Windows Biometric Service" — And suddenly you can't face-login to your Windows 10 computer any longer, but hey, it's "bloat"
* "Disable easy access keyboard stuff" — Because no one would ever use keyboard accessibility, that's just "bloat"
* "Restoring old volume slider" — I would get that this was "debloat" if it removed the volume slider, but simply restoring an older one?
* "PandoraMediaInc.29680B314EFC2", "SpotifyAB.SpotifyMusic" — Hope you don't like streaming music, that's just "bloat" anyways
And, consider how easily this repo could be compromised to result in you self-infecting your computer with malware by running all of these scripts without a close review of the steps they take. First step in any persistent Windows infection is to disable Windows Defender and Windows Update notifications so the user doesn't take steps that might uninstall the persistent infection. Repo does that already, so it's not like it'd be difficult.