Windows 11 Personal Setup

Installation process | Essential programs | Privacy tweaks with GPEDIT | PowerShell commands to remove Provisioned apps | General tweaks

1-Introduction and general information

Applicable to Windows 11 26H2 (originally made for W11 22H2)
Last update: 2026-09-30
Recent changes: Group policies updated, I have modified added policies in W11 24H2 / 25H2; minor QoL updates; repository clean-up

This covers all the steps I personally go though when performing a clean install of Windows 11. My aims are the following:

• As much automation as possible (portable programs, quick import of settings)
• A clean UI/UX (I disable/uninstall most of the bloat that comes with Windows)
• As much privacy as possible (see my Group Policy edits)
• Prioritizing native features (mostly group policies, but also PowerShell) when it comes to customizing Windows, and free and open-source software (FOSS) for features/programs.

Thanks to Duttyend for the tips and suggestions!

2-Installation

• Download the official iso file from Microsoft
• Create bootable USB with Rufus, leave everything as default (GPT, UEFI, NTFS), and customize the Windows User Experience after clicking on start. I recommend to tick every box.
  • Benefits: faster than Microsoft's tool, makes the use of a local account easier, skips privacy questions (all will be off)
• Naviagate to /sources in and add the ei.cfg file attached to this repo, so you can bypass your current Windows key and choose the Windows edition you want.
  • In my opinion, Education > Enterprise > Pro > Home. You can find a comparison of all versions here. Education edition is my favorite as it has all the features from Enterprise but it is available in the multi-edition iso that you can freely download, unlike the enterprise iso that is hard to get. Education and Enterprise editions have a few extra features compared to the Pro edition. The main benefit according to me is that you can completely disable diagnostic data, which is not possible with the Pro edition. Avoid the home edition because it doesn't include the Local Group Policy Editor and it has the least features.
  • Windows 11 IoT Enterprise LTSC 2024 (or Windows 10 IoT Enterprise LTSC 2021) are also good options if you prefer low maintenance and more legacy Windows programs (it can be relevant if you install it for a relative or for a secondary computer that you don't often use). I however advise in general to install the regular edition of Windows (General Availability Channel), specifically Windows 11 Education, as you're less likely to face incompatibilities (both regarding programs and drivers).
• Reboot and install Windows.
  • Make sure to delete all your partitions (except the data one, if you have one) and to choose the Education/Enterprise/Professional edition.
  • You can also pick English (World) as the time and currency format so most user apps won't be installed. You can always run wsreset -i via CMD (with admin rights) to reset/reinstall Microsoft Store.
  • Also, don't forget to copy your Wi-Fi drivers on your USB stick (after setting up with Rufus) so you can easily access your network once the Windows installation is complete.
• Extra steps: reset Microsoft Store; install lastest PowerShell; activate windows; install browser of choice & import profile & import extensions' settings; install Windows updates; install all drivers from manufacturers/OEM/Windows Catalog; restore classic context menu, e.g. with WinSetView; setup printers;

3-Applications that I use / install (FOSS / proprietary) (alphabetical order)

Portable applications

• ADB/Fastboot - Platform tools - mandatory to tinker with my Android phones
• Audacity - Tool to analyse/edit audio files (last update that doesn't include telemetry)
• Calibre - Management of my Kindle library
• chrlauncher - Portable Chromium and updater - macchrome and RobRich999 are both up to date and reliable.
• Easy Audio Sync - Synchronization of my main music library with the one for my phone. It automatically mirrors my main folder and transcodes on-the-fly my .flac files to .opus ones. Works great and it's very fast.
• Everything - Search files and folders instantly
• Foobar2000 - My favorite music player by far
• HandBrake - Video converter
• JPEGView - extremely fast and lightweight image viewer (fork)
• KeePassXC - Cross-Platform Password Manager
• LanXchange - Configuration-free, cross-platform file transfers for your local network
• MP3TAG - One of my favorite tag editor for music
• MPC-HC - One of my favorite video player (fork)
• MPV - My favorite video player
• Nicotine+ - open source client for Soulseek.
• Notepad++ - My favorite text editor
• OBS - Best screen recording / broadcasting software
• paint.NET - great easy-to-use image editor
• PDFsam - nice tool for basic PDF manipulations
• PDF24 - PDF toolbox with more features, but not FOSS
• qBittorrent - Favorite torrent client
• ShareX - Favorite screen capture tools, many other features
• simplewall - great firewall
• Spek - Acoustic spectrum analyser (fork)
• SumatraPDF - My favorite PDF viewer
• Syncthing - Wireless sync of my images, music, etc. in between my computer & Android Phone
• TagScanner - Another one of my favorite tag editor for music
• Waterfox - Portable edition of Waterfox, fork of Firefox without Mozilla's bloat, e.g. LLMs features.
• WinCDEmu - CD/DVD/BD emulator
• yt-dlp - Easily download video/audio files from YouTube (fork)

Portable tools

• BleachBit - Disk space cleaner, privacy manager, and computer system optimizer
• Caesium Image Compressor - image compression software, very impressive
• HWiNFO - System Information
• Driver Store Explorer [RAPR] - Manage drivers

Installed applications

Automated installation via a package manager

• Package managers (Winget)
  - see packages here
  - Command to search packages: winget search XXX (save the package ID to install programs, it's more accurate and reliable)
  - Command to install all programs: winget install 7zip.7zip && winget install File-New-Project.EarTrumpet && winget install flux.flux && winget install Oracle.JavaRuntimeEnvironment && winget install Nextcloud.NextcloudDesktop&& winget install geeksoftwareGmbH.PDF24Creator && winget install Microsoft.PowerToys && winget install RustDesk.RustDesk
  - Command to update all programs: winget upgrade --all --silent (you can also download the shortcut I created, Winget Update.ink
• 7-zip - Favorite file archiver
• EarTrumpet - Volume Control for Windows (Windows Store)
• Waterfox - Main browser
  • Add-ons:
    • uBlock Origin
    • Bypass Paywalls Clean
    • SponsorBlock
    • Firefox Multi-Account Containers
    • A working twitch adblocker, see TwitchAdSolutions
• f.lux - My favorite nightlight software on Windows
• Java - Needed for some programs
• NextCloud - Cloud Client
• PDF24 - PDF tools
• PDFsam Basic - PDF tools
• PowerToys - Useful system utilities
• RustDesk - best open source TeamViewer alternative (which has become awful lately by the way)

Not available on Winget

• FreeFileSync - My favorite file synchronization tool
• Microsoft Office - Office suite (direct link from Microsoft servers)

4-Settings & tweaks - Group Policy Editor

List of Group Policy changes (screenshots): Computer Configuration - User Configuration (updated 2026-07-30)

List of Group Policy changes (table): table

Context

• Sources: 1, 2, 3
• Benefits of using GPE instead of third-party programs or regedit
  • Easier to setup after a clean install (no need to tick all boxes one by one).
  • All GP edits are up to date, so there's no risk to mess with regedit by adding unnecessary keys.
  • Changes are easier to track than on regedit.
  • No third-party software = more reliable, more secure, more private.
  • GPE includes meaningful descriptions, wheras regedit doesn't offer any. Third-party softwares' are usually not very accurate or up to date.
• Information:
  • To keep track of new group policies, check this spreadsheet (26H2) and sort the first column.
  • Office and Edge policies
  • To update policies without restarting, run this command in CMD (it's not necessary to run it as administrator): gpupdate /force
  • (oudated) List of entries written down: Privacy settings - UI/UX settings

How to Backup / Restore group policies with LGPO utility to backup and restore local group policies.

• Example of commands:
  • Backup: lgpo /b "C:\Users\Tom\Nextcloud\3-Backups & infos\1-Windows\4-Programs backups\1-GroupPolicy\LGPO" /n Backup
  • Restore:: lgpo /g "C:\Users\Tom\Nextcloud\3-Backups & infos\1-Windows\4-Programs backups\1-GroupPolicy\LGPO\2026-07-14 Yoga backup"
  • Script via shortcut: target: C:\Windows\System32\cmd.exe /k ""C:\Users\Tom\Nextcloud\3-Backups & infos\1-Windows\4-Programs backups\1-GroupPolicy\LGPO\LGPO.exe" /b "C:\Users\Tom\Nextcloud\3-Backups & infos\1-Windows\4-Programs backups\1-GroupPolicy\LGPO"; start in: C:\Windows\System32

How to Backup / Restore group policies manually

• Backup: copy all files/folders from C:\Windows\System32\GroupPolicy
• Restore/import:
  • Paste these files to your new installation in the same folder
  • You can also directly import my config that is attached to this repository (WARNING: all my settings are perfectly safe except that I personally disable real-time protection from Windows Security but I can't advise you to do the same: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Real-time protection → Turn off real-time protection.)

5-Settings & tweaks - Others

• Uninstall all unnecessary preinstalled provisioned user apps
• Add some essential CLI programs to PATH with CMD (administrator mode) so they are always available when opening CMD or PowerShell:
  • setx /m PATH ""YourProgramPath";%PATH%"
  • e.g.: setx /m PATH ""C:\ffmpeg\bin";%PATH%"
  • Notes:
    • "/m" = all users
    • "setx" instead of "set" = permanent change
    • adding "" at the beginning and end of path is useful if you have spaces in your path)
    • Programs I add to path: StreamRip, yt-dlp, ADB/Fastboot, FFmpeg.
• Local Security Policy
  • Ask for password for administrator rights: Local Policies → Security Options → User Account Control: Behavior of the elevation prompt for administrators in Admin Approval mode → Prompt for credentials.
• services.msc: Connected User Experiences and Telemetry can be disabled; also disable WSAIFabricSvc to turn off AI results from Windows Explorer.
• Change default app for different file types
  • Video player: mp4, mov, avi, mkv, webm, flv, html5
  • Music player: mp3, aac, flac, ogg, opus
  • PDF reader: pdf
  • image viewer: png, jpg, jpeg, gif, webp, tiff, bmp, heif, xvg
  • Text viewer: txt
  • Torrent client: .torrent
• Optional features
  • Facial Recognition
  • Math Recognizer
  • Internet Explorer mode
  • Steps recorder
  • WMIC
  • Windows Media Player Legacy
  • Windows PowerShell ISE
  • WordPad
• Most important Windows Settings
  • System → Power
  • System → Multitasking
  • System → Clipboard
  • Bluetooth & devices → Mouse → Additional mouse settings → pointer options → disable enhance pointer precision
  • Bluetooth & devices → Touchpad
  • Network & interent → Wi-Fi / Ethernet → Hardware properties → Edit DNS (e.g. 1.1.1.1 & 1.0.0.1 encrypted)
  • Turn on BitLocker
  • Language & Region → Regional format: English (World) (allows to use DD/MM/YYYY format and programs will be installed in English instead of your local language)
• Performance tips:
  • Settings → Accessiblity → Disable transparency effects
  • Windows Security → Device Security → Disable core isolation (note: weakens security)
• Firefox:
  • make sure in about:support that compositing is rendered by WebRender (note: and not WebRender (software))
  • about:config tweaks:
    • browser.tabs.loadBookmarksInBackground → true
    • browser.bookmarks.openInTabClosesMenu → false
    • dom.ipc.processPriorityManager.backgroundUsesEcoQoS → false
    • full-screen-api.warning.timeout → 0
    • browser.compactmode.show → true
    • reader.parse-on-load.enabled → false
    • browser.cache.disk.enable → false
    • accessibility.force_disabled → 1
    • toolkit.telemetry.unified → false
    • browser.ml.enable → false (turns off AI, a kill switch should be available with Firefox 148)
• Change "model" name under PC's name: regedit → HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation → string: Model → data: model