Securing Windows 11 for Privacy [Part 1 of 5]

A minimal work station script for stripping Windows 11 down to essentials

---

---

What This Script Does

I wrote a PowerShell script that automates the process of stripping Windows 11 down to essentials. It's designed for work machines: VPN access, Office apps, web browsing. Not gaming rigs or media centers.

The script handles 6 areas:

1. Disables tracking services - Telemetry, diagnostics, Xbox services
2. Removes bloatware apps - Cortana, Bing apps, Xbox, OneDrive, and more
3. Applies privacy registry tweaks - Turns off advertising ID, activity history, tailored experiences
4. Cleans up the taskbar - Removes widgets, Chat, Task View clutter
5. Disables telemetry scheduled tasks - Stops background data collection
6. Blocks tracking folder recreation - Prevents Connected Devices Platform from coming back

---

What It Does NOT Touch

• Windows Defender - Stays active. You still need antivirus.
• Windows Update - Stays active. Security patches still matter.
• Core system components - Nothing structural gets modified.
• Your files - No personal data is changed or deleted.

---

Prerequisites

• Windows 11 (any edition)
• PowerShell running as Administrator
• A backup of anything you care about (always back up before running system scripts)

---

The Script

Save this as Win11-Minimal-WorkStation.ps1 and run it as Administrator.

#Requires -RunAsAdministrator

Write-Host "=== Windows 11 Minimal Work Station Setup ===" -ForegroundColor Cyan
Write-Host "This script will disable telemetry, bloatware, and tracking." -ForegroundColor Yellow
Write-Host ""

# --- SERVICES TO DISABLE ---
Write-Host "[1/6] Disabling unnecessary services..." -ForegroundColor Green

$servicesToDisable = @(
    "DiagTrack",                          # Telemetry
    "dmwappushservice",                   # WAP Push Message Routing
    "Connected User Experiences and Telemetry",
    "CDPSvc",                             # Connected Devices Platform
    "CDPUserSvc",                         # Connected Devices Platform User Service
    "SysMain",                            # Superfetch
    "XblAuthManager",                     # Xbox Live Auth
    "XblGameSave",                        # Xbox Live Game Save
    "XboxGipSvc",                         # Xbox Accessory Management
    "XboxNetApiSvc",                      # Xbox Live Networking
    "WSearch"                             # Windows Search (optional)
)

foreach ($service in $servicesToDisable) {
    $svc = Get-Service -Name $service -ErrorAction SilentlyContinue
    if ($svc) {
        Stop-Service -Name $service -Force -ErrorAction SilentlyContinue
        Set-Service -Name $service -StartupType Disabled -ErrorAction SilentlyContinue
        Write-Host "  Disabled: $service" -ForegroundColor Gray
    }
}

# --- REMOVE BLOATWARE APPS ---
Write-Host "[2/6] Removing bloatware apps..." -ForegroundColor Green

$appsToRemove = @(
    "Microsoft.549981C3F5F10",            # Cortana
    "Microsoft.BingNews",
    "Microsoft.BingWeather",
    "Microsoft.GamingApp",
    "Microsoft.GetHelp",
    "Microsoft.Getstarted",
    "Microsoft.MicrosoftSolitaireCollection",
    "Microsoft.People",
    "Microsoft.PowerAutomateDesktop",
    "Microsoft.Todos",
    "Microsoft.WindowsAlarms",
    "Microsoft.WindowsFeedbackHub",
    "Microsoft.WindowsMaps",
    "Microsoft.WindowsSoundRecorder",
    "Microsoft.Xbox.TCUI",
    "Microsoft.XboxGameOverlay",
    "Microsoft.XboxGamingOverlay",
    "Microsoft.XboxIdentityProvider",
    "Microsoft.XboxSpeechToTextOverlay",
    "Microsoft.YourPhone",
    "Microsoft.ZuneMusic",
    "Microsoft.ZuneVideo",
    "Clipchamp.Clipchamp",
    "Microsoft.OneDrive"
)

foreach ($app in $appsToRemove) {
    Get-AppxPackage -Name $app -AllUsers -ErrorAction SilentlyContinue |
        Remove-AppxPackage -AllUsers -ErrorAction SilentlyContinue
    Get-AppxProvisionedPackage -Online |
        Where-Object DisplayName -eq $app |
        Remove-AppxProvisionedPackage -Online -ErrorAction SilentlyContinue
    Write-Host "  Removed: $app" -ForegroundColor Gray
}

# --- REGISTRY TWEAKS - PRIVACY ---
Write-Host "[3/6] Applying privacy registry tweaks..." -ForegroundColor Green

# Disable Telemetry
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" `
    -Force -ErrorAction SilentlyContinue | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" `
    -Name "AllowTelemetry" -Value 0 -Type DWord -Force

# Disable Activity History
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" `
    -Name "EnableActivityFeed" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" `
    -Name "PublishUserActivities" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" `
    -Name "UploadUserActivities" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue

# Disable Advertising ID
New-Item -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\AdvertisingInfo" `
    -Force -ErrorAction SilentlyContinue | Out-Null
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\AdvertisingInfo" `
    -Name "Enabled" -Value 0 -Type DWord -Force

# Disable App Launch Tracking
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" `
    -Name "Start_TrackProgs" -Value 0 -Type DWord -Force

# Disable Tailored Experiences
New-Item -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Privacy" `
    -Force -ErrorAction SilentlyContinue | Out-Null
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Privacy" `
    -Name "TailoredExperiencesWithDiagnosticDataEnabled" -Value 0 -Type DWord -Force

Write-Host "  Privacy registry keys applied" -ForegroundColor Gray

# --- DISABLE TASKBAR CLUTTER ---
Write-Host "[4/6] Cleaning up taskbar..." -ForegroundColor Green

# Disable Widgets
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Dsh" `
    -Force -ErrorAction SilentlyContinue | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Dsh" `
    -Name "AllowNewsAndInterests" -Value 0 -Type DWord -Force

# Disable Chat/Teams icon
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" `
    -Name "TaskbarMn" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue

# Disable Task View button
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" `
    -Name "ShowTaskViewButton" -Value 0 -Type DWord -Force

# Disable Search box (show icon only)
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" `
    -Name "SearchboxTaskbarMode" -Value 1 -Type DWord -Force

Write-Host "  Taskbar cleaned" -ForegroundColor Gray

# --- DISABLE SCHEDULED TASKS ---
Write-Host "[5/6] Disabling telemetry scheduled tasks..." -ForegroundColor Green

$tasksToDisable = @(
    "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser",
    "\Microsoft\Windows\Application Experience\ProgramDataUpdater",
    "\Microsoft\Windows\Autochk\Proxy",
    "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator",
    "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip",
    "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector",
    "\Microsoft\Windows\Feedback\Siuf\DmClient",
    "\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload"
)

foreach ($task in $tasksToDisable) {
    Disable-ScheduledTask -TaskName $task -ErrorAction SilentlyContinue | Out-Null
    Write-Host "  Disabled task: $task" -ForegroundColor Gray
}

# --- BLOCK CONNECTED DEVICES PLATFORM FOLDER ---
Write-Host "[6/6] Blocking Connected Devices Platform folder recreation..." -ForegroundColor Green

$cdpPath = "$env:LOCALAPPDATA\ConnectedDevicesPlatform"
if (Test-Path $cdpPath) {
    Remove-Item $cdpPath -Recurse -Force -ErrorAction SilentlyContinue
}
New-Item $cdpPath -ItemType File -Force -ErrorAction SilentlyContinue | Out-Null
attrib +r +s +h $cdpPath

Write-Host "  CDP folder blocked" -ForegroundColor Gray

# --- DONE ---
Write-Host ""
Write-Host "=== COMPLETE ===" -ForegroundColor Cyan
Write-Host "Reboot your system for all changes to take effect." -ForegroundColor Yellow
Write-Host ""
Write-Host "Note: Windows Defender and Windows Update remain enabled." -ForegroundColor White

---

How to Run It

1. Save the script as Win11-Minimal-WorkStation.ps1
2. Right-click Terminal or PowerShell and select Run as Administrator
3. Navigate to the script location
4. Run: powershell -ExecutionPolicy Bypass -File .\Win11-Minimal-WorkStation.ps1
5. Reboot when complete

---

What to Expect After Running

• Your taskbar will be cleaner (no widgets, Chat, or Task View)
• Bloatware apps will be gone from the Start menu
• Background telemetry services will be stopped
• The system will feel snappier without Superfetch and unnecessary services running

This is not a permanent guarantee. Windows Updates can and will try to re-enable some of these settings. That is why Part 2 exists.