01 Windows privacy changes without a GUI
Turn off the telemetry Windows ships with.
wintools disables the telemetry services, the scheduled tasks and the registry policies that report on a machine. It reads the machine first, writes what it finds to a Markdown report, and keeps a snapshot so it can undo its own changes.
| Category | Count | Risk |
|---|---|---|
| Telemetry | 7 | low |
| Bloatware | 15 | low |
| Optional | 59 | medium |
| Advanced | 24 | high |
61 services carry a low risk, 36 medium, 7 high and 1 critical. The tool confirms each high or critical service unless you pass --yes. Everything else runs once you accept the mode.
02 What it changes
Four kinds of setting, one snapshot file
Every change goes through the same path: read the current state, write the old state to a snapshot, apply the new one. A service registration stays in place after the tool disables it, so a later wintools restore finds the same entry again.
The service catalog
Telemetry services cover diagnostics, error reporting and push routing. Bloatware covers the helper entries that a hardware maker or an application vendor installs next to its own software. Optional covers desktop features that most machines never touch. Advanced holds the entries that break real work, and only the Aggressive mode reaches them.
| Category | Examples | Applies to |
|---|---|---|
| Telemetry | DiagTrack, WerSvc, dmwappushservice | Every mode |
| Bloatware | HP, Dell, Google, Mozilla and Adobe helpers | Standard, Aggressive |
| Optional | Search, Xbox, printing, smart card, Bluetooth | Aggressive |
| Advanced | wuauserv, WinDefend, BITS, Themes | Aggressive |
Telemetry tasks
Twenty scheduled tasks sit under eight roots in the Task Scheduler, and four more arrive with Windows 11 24H2. The tool disables the task and leaves the definition in place.
- \Microsoft\Windows\Application Experience
- \Microsoft\Windows\Customer Experience Improvement Program
- \Microsoft\Windows\Windows Error Reporting
- \Microsoft\Windows\Device Information
- \Microsoft\Windows\Diagnosis
- \Microsoft\Windows\DiskDiagnostic
- \Microsoft\Windows\PI
- \Microsoft\Windows\Power Efficiency Diagnostics
- \Microsoft\Windows\Management\Provisioning on 24H2 and later
Policy keys
Eight registry settings carry the policy side. Two of them only exist on Windows 10, and the last two apply to Windows 11 alone.
- AllowTelemetry = 0Machine policy, every version
- Disabled = 1Error reporting for the current user
- DisableWindowsConsumerFeatures = 1Consumer features, Windows 10 up
- Enabled = 0Advertising identifier, Windows 10 up
- DisableWindowsSpotlightFeatures = 1Spotlight, Windows 11
- DenyWebcam and location, Windows 11
Fifteen update packages
On Windows 7 the tool removes the telemetry update packages with wusa.exe /uninstall. It skips KB3133977 while BitLocker is active, because that package fixes a BitLocker bug.
The version decides the list
The tool reads the operating system version before it touches anything, then keeps only the services and the policy keys that exist on that version.
03 Commands
The menu and the command line run the same code
Running the tool with no arguments opens the menu. Every menu action has a command that does the same thing, which is what an unattended setup needs.
Three flags carry the weight
--dry-run lists what a mode would change and writes nothing. --yes skips the confirmation prompt, which matters for a machine that installs itself. --out chooses where the report lands.
The dry run prints the same list that the real run acts on, one service per line with its category and whether the service exists on the machine. Running it first costs a second. The real run then follows the list you already read.
04 Modes
The mode decides the scope
Each mode names a slice of the catalog. Standard is the one to start with, and Aggressive asks for a second look before it runs.
| Mode | What it disables | Risk |
|---|---|---|
| telemetry | The seven telemetry services | Lowest. Safe for every machine. |
| standard | Telemetry and bloatware | Low. The recommended starting point. |
| aggressive | Every service in the catalog | High. Some entries power real features. |
Standard leaves the optional category alone, so hardware services such as Bluetooth and touch support keep working. Aggressive covers the whole catalog, and the confirmation screen lists each service before anything is disabled.
05 The report
A report of the current state
The report command reads the machine and changes nothing on it. It is the before picture that the change can be compared against, and it works on a machine where the tool has never run.
What lands in the file
- ServicesCategory, risk, whether it is installed, start type
- TasksThe telemetry tasks, with the ones that exist marked
- RegistryThe value the tool would write and the value on the machine
- Windows 7The packages the tool would remove
The report marks a missing value as not set rather than guessing. You can read the file in a code review without asking the machine again.
06 Safety
What happens if the change is wrong
The tool keeps enough state to walk the machine back, and it asks before it touches the settings that break software.
The tool prompts for each high or critical service
The tool confirms each high or critical service one by one. Once you accept the mode, the rest run without a prompt.
One command, when you want it
The command calls Checkpoint-Computer, so you need System Restore switched on. The tool does not create one behind your back.
The tool keeps the old state
The tool writes every change to a snapshot file next to the log, and the restore command reads that file to put the previous values back.
The tool writes a line on every run
The log lives beside the report in the ProgramData folder. It records what the tool did and what it refused to do.
07 How it compares
Other projects work on the same settings
Each row links the page the description came from. The sources were checked on 21 October 2026.
| Project | What it is | Interface | License |
|---|---|---|---|
| Chris Titus Tech's WinUtil | Windows utility with a WPF interface over a PowerShell collection | GUI, install through irm | MIT |
| Privacy.sexy | Privacy hardening service that hands out an install script | Website plus offline installers | AGPL-3.0 |
| O&O ShutUp10 | Antispy utility that flips privacy switches | GUI | Freeware, premium edition sold |
| Windows Privacy Toolkit | PowerShell scripts that audit and harden privacy settings | Scripts | Apache-2.0 |
| Win-Debloat | Debloat and detelemetry tool with a dashboard | GUI and CLI | MIT |
Where wintools sits
- One fileThe published build is NativeAOT, so there is no .NET runtime and no script host
- Windows 7 to 11The version is read before anything is touched
- Before and afterThe report captures the state the change starts from
- UndoA snapshot file and the restore command put the old values back
What it leaves alone
The tool installs no programs, removes no bundled apps and creates no restore point on its own. WinUtil installs and updates software, and Win-Debloat removes bloatware apps from its profile list. The scope here is the telemetry settings and the paperwork to undo them.
08 Install
Two archives, one executable
Download the archive for your CPU from the releases page, extract it, and put the executable anywhere on the disk.
Two warnings worth reading
Windows SmartScreen may warn about an unsigned executable. The release carries a checksum file, so the archive can be checked against it before it runs.
The source is in the same repository, and the build needs the .NET 10 SDK and a Windows host for the NativeAOT publish. A build from source is the way to get a binary that carries your own signature.