My very opinionated view of how to build a Windows 11 machine (from completely fresh OS install), with a focus on privacy and reduced bloat.
I normally rebuild my Windows machines a couple times a year. I've learnt various things along the way, and would like to have something laid out that I can consistently follow. So, I'm going to use this guide for my own reference, but also share it for anyone interested.
This guide is based on an install of Windows 11 Pro 10.0.22631.
- Download a fresh Windows 11 ISO image from here: https://www.microsoft.com/software-download/windows11
- Burn the ISO to a freshly FAT32 formatted USB drive with adequate volume, using Rufus (https://rufus.ie/en/).
- Boot to the USB, noting that you may need invoke boot options on startup or change your boot priority via bios.
- Install Windows 11. I recommend you:
- Setup the machine as a 'new device' (if connected to your Microsoft account during install).
- Turn off all data sharing options on the privacy settings page.
- Don't use any of the experience customizations.
- Skip the mobile phone integration setup.
- Decline M365 and the additional cloud storage offers.
- After the install, open 'Windows Updates' and perform an update. To do so:
- Uncheck the option to 'get latest updates as soon as they're available'.
- Select 'check for updates'.
- Install any updates through multiple reboots.
- Run CTTWinUtil (https://github.com/ChrisTitusTech/winutil) to apply common tweaks. To do so:
- Open a Powershell Prompt (with Admin rights).
- Run 'irm "https://christitus.com/win" | iex'
- On the 'Tweaks' page:
- Apply the 'Standard' tweaks.
- Add the 'Ultimate Performance' power profile if you're on a gaming-focused machine.
- Also apply the following custom preferences on the 'Tweaks' page:
- Dark Theme for Windows: enabled
- Bing Search in Start Menu: disabled
- Recommendations in Start Menu: disabled
- Show Hidden Files: enabled
- Show File Extensions: enabled
- Search Button in Taskbar: enabled
- Task View Button in Taskbar: disabled
- Center Taskbar Items: enabled
- Widgets Button in Taskbar: disabled
- On the 'Updates' page, enable the 'Security Settings' for Windows Updates.
- If you connected to your MSFT account during install, then open 'Settings':
- Go to Accounts > Sign-in options.
- Uncheck "For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device (recommended)".
- Open 'OneDrive':
- Go to Settings and turn off the option to 'Save space and download files as you use them'.
- Go to Backup > Manage backup, and stop backup of Desktop, Documents and Pictures.
- Open 'Edge':
- Uncheck the option to bring in browsing data.
- Skip the sync with Google.
- Uncheck options to make the MSFT experience more useful to you.
- If its a gaming-focused machine, I recommend:
- Ensuring 'Virtual Machine Platform' remains unchecked in Windows Features.
- Also turning off 'Core isolation- memory integrity'.
- If its a more development-focused machine and you intend to run a virtual platform (WSL for example), I recommend:
- Ensuring 'Hyper-V', 'Virtual Machine Platform', and 'Windows Subsystem for Linux' remain checked in Windows Features.
- If you have a dedicated AMD/ NVIDIA GPU, go through a process to clean/ re-install the GPU drivers manually. To do so:
- Download the latest driver for your GPU. Note: If you have a NVIDIA GPU, you may use nvidia-driver-manager (https://github.com/buswedg/windows-helpers/tree/main/nvidia-driver-manager).
- Disable any network adapaters connecting you to the internet.
- Restart your machine in safe mode.
- Run Display Driver Uninstaller (https://www.guru3d.com/download/display-driver-uninstaller-download/).
- Restart your machine.
- Install the GPU driver.
- Enable any previously disabled network adapaters.
- Restart your machine.
- Open 'Add or Remove Programs' and remove any unnecessary programs. I recommend using this helper script: https://github.com/buswedg/windows-helpers/tree/main/windows-app-uninstaller
- Turn off any unnecessary Windows optional features. To do so:
- Go to Settings > Apps > Optional features.
- Uninstall 'Windows Media Player Legacy', 'Steps Recorder', and 'Wordpad'.
- Use WinGet to install your preferred programs. I recommend using this helper script to install preferred packages in bulk: https://github.com/buswedg/windows-helpers/tree/main/winget-installer
- Download and install any preferred programs which WinGet doesn't offer.
- Open 'Task Manager' and go to Startup Apps. Turn off any apps which you don't want to run on boot.