Win11-Lean-Safe.ps1 - Dan's Windows 11 cleanup preset
Published: October 17, 2026
Guide: https://dantheitman.dev/pc-builds/#windows-guide

This is the original code from my setup notes, published unchanged. My
workstation setup used a Rufus installation USB followed by this cleanup.
It is intended for a fresh personal Windows 11 installation. It is not a
custom Windows ISO or a promise of compatibility with every Windows release.
Source review and Windows PowerShell 5.1 syntax checks passed for publication;
the download has not been tested in a clean Windows VM or across releases.

READ BEFORE RUNNING

Running this script immediately makes changes as administrator. There is no
confirmation prompt, dry run, -WhatIf support or command-line option parsing.
Do not add -WhatIf expecting a preview: it will not prevent changes.

Selected apps AND their local app data are removed for ALL users. Provisioned
copies are also removed so those apps are not provisioned for new accounts.
This includes Sticky Notes, OneNote, To Do, Phone Link and the new Outlook.
Export or sync anything you need and verify an independent backup first.
An app reinstall does not restore its deleted local data.

Use this only on a personal PC you administer. Do not use it on a work,
school, shared or managed PC. It writes machine and current-user policies;
for example, AllowTelemetry is set to 1 even if a stricter value already
exists. Some settings depend on Windows edition/build and can be ignored.
Current-user settings apply to the account running the elevated shell.

PREPARE AND REVIEW

1. Finish Windows Update and restart. Back up files, exported app data and
   recovery keys separately. Check System Protection and create/verify an
   available restore point. The script tries to create one, but it continues
   if that fails. Restore points and its inventory files are not full backups.

2. Download Win11-Lean-Safe.ps1. Open 64-bit Windows PowerShell 5.1 using
   Run as administrator (not PowerShell 7 or Windows PowerShell (x86)).
   Change to the actual folder containing the download. For example, replace
   the path below with your folder; do not assume Downloads is on C:.

   Set-Location -LiteralPath 'C:\path\to\download-folder'
   Get-FileHash -LiteralPath '.\Win11-Lean-Safe.ps1' -Algorithm SHA256

   The original download is 12,957 bytes. Expected SHA-256:
   396cb4cd9ee70f693ec808a9396a1df3ad9949e08f362cd91af96b033182663f

   Check this before editing. A match confirms identical bytes, not safety.
   If the original file differs, stop and download it again from the guide.

3. Read the entire file before running it:

   notepad.exe '.\Win11-Lean-Safe.ps1'

   Review the three booleans near the top and the exact $remove app list.
   Change the source file, then save it, to customize the preset. Editing
   changes the hash, so retain a separate original copy for reference.

   Default: $DisableHibernate = $true
   Disables hibernation, Fast Startup and hibernation-backed hybrid sleep.
   Set it to $false before running to leave hibernation settings alone.

   Default: $EnableCompactOS = $true
   Compresses Windows system binaries. Space and CPU effects vary.
   Set it to $false before running to skip changing CompactOS.

   Default: $RemoveOneDrive = $false
   Leaves OneDrive installed. Leave this false; if removal is needed, use
   Windows Settings after verifying your sync state and file backups.

   Remove entries from $remove for apps you want to keep. The three booleans
   do not control the policy changes, DISM cleanup, legacy capability
   removal or Recall removal. Review those sections separately. Manual
   Settings > Apps > Installed apps removal is an alternative to this script.

RUN THE REVIEWED FILE

From the file's folder in the elevated 64-bit Windows PowerShell window:

   powershell.exe -NoProfile -ExecutionPolicy Bypass -File '.\Win11-Lean-Safe.ps1'

This execution policy is limited to the new PowerShell process; it does not
change the saved user or machine policy. Organizational Group Policy takes
precedence. If a managed policy blocks the script, do not change that policy.
The script itself checks Windows 11 client, 64-bit Windows PowerShell 5.1,
administrator access and a pending restart before its cleanup actions.

The first comment describes pasting the block, its original delivery format.
Saving and running the .ps1 file executes the same code block.

WHAT THE PRESET CHANGES

Exact app identifiers targeted, when removable and present:
  Clipchamp.Clipchamp
  Microsoft.BingNews
  Microsoft.BingWeather
  Microsoft.Copilot
  Microsoft.Windows.Copilot
  Microsoft.549981C3F5F10
  Microsoft.Getstarted
  Microsoft.Microsoft3DViewer
  Microsoft.MicrosoftOfficeHub
  Microsoft.MicrosoftSolitaireCollection
  Microsoft.MixedReality.Portal
  Microsoft.People
  Microsoft.SkypeApp
  Microsoft.Todos
  Microsoft.Wallet
  Microsoft.Windows.DevHome
  Microsoft.WindowsFeedbackHub
  Microsoft.WindowsMaps
  Microsoft.YourPhone
  MicrosoftCorporationII.MicrosoftFamily
  Microsoft.MicrosoftStickyNotes
  Microsoft.PowerAutomateDesktop
  Microsoft.OutlookForWindows
  Microsoft.Office.OneNote
  microsoft.windowscommunicationsapps
  MicrosoftTeams
  Microsoft.Windows.Teams

It leaves Microsoft Defender, Windows Update, Windows Recovery, Store,
winget, Xbox dependencies, codecs and the pagefile untargeted. The MSTeams
package is not in the removal list. These are design choices, not proof that
all those features remain healthy on every Windows version.

It also changes ads/suggestions/widgets/diagnostic preferences; runs DISM
/StartComponentCleanup without /ResetBase; and, when present, removes the
Math Recognizer, Steps Recorder, XPS Viewer and WordPad capabilities. It
disables and removes the Recall optional-feature payload when available.
These servicing steps can require a restart or be skipped while one is
pending. DISM/Windows servicing may need Windows Update or source files.

RESULTS, LOGS AND RECOVERY

Read the warning count and log even if the final line says "Finished".
Individual step errors are caught, so later steps can continue after a
failure. There is no automatic all-or-nothing rollback.

Logs, inventories, registry-before values and Warnings.txt are saved under:
  %ProgramData%\Win11Lean\<run-timestamp>\
These files can contain user/computer details. Review them before sharing.

Restart manually, then check Windows Update, Windows Security protection,
Store updates, everyday apps, games, network, audio and peripherals. The
reported free-space change is provisional and can change after restart.
This page makes no measured performance or storage-saving claim.

Re-enabling hibernation or removing CompactOS compression is possible from
an administrator terminal if that is the state you want:
  powercfg.exe /hibernate on
  compact.exe /CompactOS:never
These commands are not a full undo and do not restore every prior power
setting. The script has no automated registry/app/data restoration. Restore
from your own backup when needed; app data and servicing changes may not be
recoverable through System Restore.

OFFICIAL REFERENCES

Windows 11 ISO:
https://www.microsoft.com/en-us/software-download/windows11
Rufus:
https://rufus.ie/
File hash:
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-filehash?view=powershell-5.1
Execution policies:
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-5.1
Restore points:
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/checkpoint-computer?view=powershell-5.1
DISM cleanup:
https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/clean-up-the-winsxs-folder?view=windows-11
CompactOS:
https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/compact
Power states:
https://learn.microsoft.com/en-us/windows/win32/power/system-power-states