Windows Tweaks on gal.vin

Better Windows Updates For Everyone

Tue, 14 Dec 2021 01:49:09 +0000

In this post I’m going to show how to quickly configure Windows Updates so that you only receive important security updates. We’ll cover Home and Pro/Enterprise users of both Windows 10 and Windows 11.

These are also the settings I use myself and recommend for most users.

These settings may also be helpful for IT admins.

Set Active Hours - Windows 10

By default Active Hours are configured to be automatic but personally I think it’s better to set them manually.

Go to Settings using WIN + I, then Update & Security > Change active hours.

Turn off the setting Automatically adjust active hours... and click on Change next to Current active hours

Set the Active hours to the maximum allowed amount of 18 hours. I use 8am - 2am: This means Windows Update won’t restart my computer during this time period.

Set Active Hours - Windows 11

By default Active Hours are configured to be automatic but personally I think it’s better to set them manually.

Go to Settings using WIN + I, then go to Windows Update > Advanced Options > Active Hours

Change the Adjust active hours setting from Automatically to Manually.

Set the Active hours to the maximum allowed amount of 18 hours. I use 8am - 2am: This means Windows Update won’t restart my computer during this time period.

Registry Settings - Windows 10 Home

If you are running Windows 10 Home Edition, you’ll need to make these edits to the registry as Home edition does not have access to Group Policy.

Open an elevated PowerShell prompt and run this line to configure Windows Updates as noted in this article:

`1`	`Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://git.io/JDRIh'))`

Use the Registry Editor and make the changes manually:

Open regedit with WIN + R and then type regedit
Go to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings
Right-click New > DWORD (32-bit) Value
Name the new Value BranchReadinessLevel and set it to Base: Decimal, Value data: 20
Repeat steps 3 and 4 with the Value of DeferFeatureUpdatesPeriodInDays Value data: 365
Repeat steps 3 and 4 with the Value of DeferQualityUpdatesPeriodInDays Value data: 5

Group Policy Settings - Windows 10 Pro/Enterprise

With Windows 10 Pro or Enterprise we can use the Local Group Policy, or the Domain Group Policy for the IT admins out there.

Open the local group policy with WIN + R and then type gpedit.msc
Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows update for Business
Select Manage preview builds and set it to Enabled and change the drop down menu to Disable preview builds
Select Select when Preview Builds and Feature Updates are received and set it to Enabled
Change the drop down menu to Semi-Annual Channel and then for After a Preview Build or Feature Update is released, defer receiving it for this many days enter 365.
Select Select when Quality Updates are received and set it to Enabled
For After a Quality updates is released, defer receiving it for this many days enter 5.

Registry Settings - Windows 11 Home

If you are running Windows 11 Home Edition, you’ll need to make these edits to the registry as Home edition does not have access to Group Policy.

Open an elevated PowerShell prompt and run this line to configure Windows Updates as noted in this article:

`1`	`Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://git.io/JDRIh'))`

Use the Registry Editor and make the changes manually:

Open regedit with WIN + R and then type regedit
Go to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings
Right-click New > DWORD (32-bit) Value
Name the new Value BranchReadinessLevel and set it to Base: Decimal, Value data: 20
Repeat steps 3 and 4 with the Value of DeferFeatureUpdatesPeriodInDays Value data: 365
Repeat steps 3 and 4 with the Value of DeferQualityUpdatesPeriodInDays Value data: 5

Group Policy Settings - Windows 11 Pro/Enterprise

With Windows 11 Pro or Enterprise we can use the Local Group Policy, or the Domain Group Policy for the IT admins out there.

Open the local group policy with WIN + R and then type gpedit.msc
Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update
Select Select when Preview Builds and Feature Updates are received and set it to Enabled and then for How many days after a Feature Update is released... enter 365.
Next, select Select when Quality Updates are received and set it to Enabled and then for After a quality update is released.. enter 5.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Windows 11 Customisation

Sat, 04 Sep 2021 17:09:28 +0100

Windows 11 is very similar to Windows 10 is terms of technology and core services, however with the new UI and Start Menu refresh there are some new elements that you may want to remove.

Microsoft now expects the Start menu layout to be managed by an MDM service, if you want to do it without that then the easiest method is to copy the start.bin files.

Use a existing Windows 11 install to setup the Start menu layout how you want it.
Copy the start.bin file from %LocalAppData%\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState to a folder in the MDT Deployment Share - in my case, I’ll use “_custom”.
Within your deployment Task Sequence you’ll want to copy the start.bin file to C:\Users\Default\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState
For all new users they will now get the start menu layout you specified.

I use a PowerShell script to copy the start.bin to the correct location.

$src = "Z:\_custom"

New-Item -Type Directory -Path "$env:systemdrive\Users\Default\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState"
Copy-Item -Path "$src\w11_StartLayout\start.bin" -Destination "$env:systemdrive\Users\Default\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState" -Force

Disable Search On The Taskbar

Currently I have not found the Group Policy settings for the new additions to the Taskbar, so here are the registry entries to disable/hide the extra icons.

The registry entry for the setting is per-user and is located here:

`1`	`HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search"`

The key is a DWORD (32-bit) Value name SearchboxTaskbarMode and it has 2 states:

0 (Hide icon)
1 (Show icon)

Disable Widgets On The Taskbar

The registry entry for the setting is per-user and is located here:

`1`	`HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced"`

The key is a DWORD (32-bit) Value name TaskbarDa and it has 2 states:

0 (Hide icon)
1 (Show icon)

Disable Chat In The Taskbar

The registry entry for the setting is per-user and is located here:

`1`	`HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced"`

The key is a DWORD (32-bit) Value name TaskbarMn and it has 2 states:

0 (Hide icon)
1 (Show icon)

Default App Associations

Importing a list of default app associations for Windows 11 is the same as Windows 10, but I think it’s worth mentioning that Windows 11 has done away with the “Default Apps” section of Settings and so now it can be a lot more work to set them all on a template system to export. You can however still import a default app associations file that was created on Windows 10 into Windows 11.

Exporting A Default App Association File

`1`	`Dism /Online /Export-DefaultAppAssociations:"C:\foo\w11_AppAssoc.xml"`

Importing A Default App Association File as part of an MDT Task Sequence

You will need to create a new “Run Command Line” item just under “Postinstall” - see the image below.

`1`	`Dism.exe /Image:%OSDisk%\ /Import-DefaultAppAssociations:%deployroot%\_custom\w11_appassoc\w11_AppAssoc.xml`

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Disable The News and Interests Bar in Windows 10

Thu, 10 Jun 2021 15:26:20 +0100

The New News and Interests Bar for Windows 10

In the June updates for Windows 10 the News and interests bar has been rolled out to Windows 10 and is enabled by default. If you want to disable it as a user, it’s easily done by right-clicking on the Taskbar > News and Interests > Turn off. Job done. 👍

Registry

The registry entry for the setting is per-user and is located here:

`1`	`HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Feeds`

The key is a DWORD (32-bit) Value name ShellFeedsTaskbarViewMode and it has 3 states:

0 (Show icon and text)
1 (Show only icon)
2 (Hide everything)

Group Policy

To disable this feature for all users using Group Policy, the setting can be found here:

`1`	`Computer Configuration > Administrative Templates > Windows Components > News and interests`

Enable news and interests on the taskbar

Set this item to Disabled to remove it for all users on the PC by default.

Central Store

You may not see this setting in your Group Policy if you have created a Central Store for your Group Policy Objects. You’ll need to update the Central Store with the following files from a Windows 10 system with the June update:

1
2

C:\Windows\PolicyDefinitions\Feeds.admx
C:\Windows\PolicyDefinitions\en-US [or your language]\Feeds.adml

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Disable Network Discovery in Windows 10/11

Tue, 20 Apr 2021 23:18:59 +0100

Fully disabling Network Discovery in Windows 10 using Group Policy

To properly disable Network Discovery in Windows 10 in a way that the user cannot easily re-enable we must create some firewall rules and prevent some services from running on start-up. We can do both things using Group Policy.

Firewall Rules

Create a new Group Policy or use an existing one that takes effect on computer objects.

Go to Computer Configuration > Policies > Windows Settings > Security Settings > Windows Firewall with Advanced Security.
Inside the Inbound Rules node, right click and choose New Rule.
On Rule Type, select Predefined and choose Network Discovery then click Next.
You will be presented with a long list of rules, many of which are duplicates because of the Profile they belong to; Public, Domain, Private.
Select only the following rules, it does not matter which profile as we will change it later.
- Network Discovery (LLMNR-UDP-In)
- Network Discovery (NB-Datagram-In)
- Network Discovery (NB-Name-In)
- Network Discovery (Pub-WSD-In)
- Network Discovery (SSDP-In)
Next, choose Block the connection and click Finish.
We will now make some changes to those rules.
First, select Network Discovery (NB-Datagram-In) and go to its properties.
On the General tab, select the Allow the connection radio button.
Next on the Scope tab, under Remote IP address, select the These IP addresses: radio button and then click Add…
In the new window, select the Predefined set of computers: radio button and choose Local subnet from the drop-down list.
Next on the Advanced tab, make sure that the check boxes next to Domain, Private and Public are all checked.
Click on Apply, and close the properties window.
On the other 4 inbound rules repeat steps 10 - 13.

Your inbound firewall rules should look like this:

We are now going to repeat the steps above for the outbound rules.

Inside the Outbound Rules node, right click and choose New Rule.
On Rule Type, select Predefined and choose Network Discovery then click Next.
You will be presented with a long list of rules, many of which are duplicates because some the Profile they belong to e.g. Public, Domain, Private.
Select only the following rules, it does not matter which profile as we will change it later.
- Network Discovery (LLMNR-UDP-Out)
- Network Discovery (NB-Datagram-Out)
- Network Discovery (NB-Name-Out)
- Network Discovery (Pub-WSD-Out)
- Network Discovery (SSDP-Out)
Next, choose Block the connection and click Finish.
We will now make some changes to those rules.
First, select Network Discovery (NB-Datagram-Out) and go to its properties.
On the General tab, select the Allow the connection radio button.
Next on the Scope tab, under Remote IP address, select the These IP addresses: radio button and then click Add…
In the new window, select the Predefined set of computers: radio button and choose Local subnet from the drop-down list.
Next on the Advanced tab, make sure that the check boxes next to Domain, Private and Public are all checked.
Click on Apply, and close the properties window.
On the other 4 inbound rules repeat steps 9 - 12.

Your outbound firewall rules should look like this:

System Services

Now we are going to configure the Group Policy to disable some system services.

Go to Computer Configuration > Policies > Windows Settings > Security Settings > System Services.
Select the Function Discovery Provider Host service and go to it properties page.
Select Define this policy setting, choose Disabled and then click on Apply and close the properties window.
Repeat the above steps for the following services:

Function Discovery Resource Publication
Link-Layer Topology Discovery Mapper
SSDP Discovery
UPnP Device Host

The Group Policy is now configured. Link it to an OU or OU’s that contain computer objects and run gpupdate or restart the computers. Network Discovery will now be disabled and even if a user enabled it in the Network and Sharing Center it will remain disabled.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Tech Tips for These Tumultuous Times

Thu, 19 Mar 2020 14:52:18 +0000

Hi all, In these interesting times I thought I’d create a round-up of some tips and recommendations for those of you who are looking to improve your technology - whatever your situation. It’s a grab bag of various items I’ve been collecting for a while but I hope some of these suggestions are useful to you. I usually write posts geared towards IT professionals but this post is aimed at people from all walks of life working from home with little IT assistance. If you have any suggestions for other software or tips, please put them in the comments below. ☺

Improving Your Internet Connection

When it comes to networking, bandwidth isn’t everything. Reliability and latency are also required for it to be useful. It can sometimes be preferable to have less bandwidth available but achieve low latency and be reliable. There’s little point to having a 1Gbps that has a huge latency or hardly ever works. You can use the website SpeedTest to test your internet connection bandwidth and latency. Here are some more points that you should consider: Wi-Fi is one of the biggest variables that can affect your connection. Wi-Fi is greatly affected by walls, ceilings, and other Wi-Fi signals and interference generated by electronic devices. The age and quality of the equipment used in your network can also affect the quality of your Wi-Fi signal and network in general. Connecting via an Ethernet cable will provide the most reliable connection; however, you should consider swapping out older cables for new ones as damage can occur over time and this will affect the quality of the connection. When troubleshooting network issues, it’s important to check every part of the connection. In some rare cases the network hardware itself on a device could have developed a fault and in the past, I’ve had the networking stack on Windows get corrupted. 😬 When experience internet issues, it’s important to investigate and find out if you are having networking issues in general within your home or whether it’s an external issue. An external issue will be something you need your ISP to investigate, internal network issues are something that you can do something about. 👍

Improving Your DNS Service

DNS is one of the most important parts of networking. There’s a reason it’s a tech meme. You can control which DNS service provider you use either by changing it on your device (if you are on a network, I wouldn’t recommend this) or on your router or modem. If you change the DNS on your router it will affect all devices connected to it. Here are some DNS services that I can recommended. Both written and video Instruction for changing DNS settings are available on the sites below. A note about IPv6 - If you don’t know you need it you probably don’t, so don’t worry about it! 👍

Google DNS

IP addresses: 8.8.8.8 and 8.8.4.4

Google provide their own fast DNS service that is extremely popular. Just a quick reminder that before you use Google DNS, remember they are an advertising company and there are other very good alternatives.

Quad9

Quad9 is focused on security and blocking threats at the DNS level. It’s also the best DNS service to say out loud in the mirror to yourself, in my opinion.

IP addresses: 9.9.9.9 and 149.112.112.112

IPv6 addresses: 2620:fe::fe and 2620:fe::9

CloudFlare DNS also known as 1.1.1.1

CloudFlare DNS is geared towards being as fast as possible.

IP addresses: 1.1.1.1 and 1.0.0.1

IPv6 addresses: 2606:4700:4700::1111 and 2606:4700:4700::1001

AdGuard DNS

As the name suggests AdGuard is focused on DNS level ad blocking and has the option to block adult sites. AdGuard provides a good level of ad blocking but it will not block ads from streaming services as those ads are provided by the same servers as the content you want to watch. To block those ads later in this article I cover ad blocking web browser extensions.

For “Default” servers (basic ad blocking):

IP addresses: 176.103.130.130 and 176.103.130.131

IPv6 addresses: 2a00:5a60::ad1:0ff and 2a00:5a60::ad2:0ff

For “Family protection” servers (basic adult site blocking):

IP addresses: 176.103.130.132 and 176.103.130.134

IPv6 addresses: 2a00:5a60::bad1:0ff and 2a00:5a60::bad2:0ff

For “Non-filtering”:

IP addresses: 176.103.130.136 and 176.103.130.137

IPv6 addresses: 2a00:5a60::01:ff and 2a00:5a60::02:ff

Online Services Monitor

Down Detector is a great centralised resource for tracking every online service in existence and whether they are experiencing issues. A good way to know whether ‘it’s just you’ or not. Please bare in mind that online services are provided worldwide via various regional data centres so a service could be reported as being down in the US but be up in the UK or it could be down in the UK but due to the time-zone difference and a smaller population, it might not have been reported.

Remote Access Software

AnyDesk AnyDesk is easy to setup and use, it doesn’t even need to be installed. It’s a lot like Team Viewer except with less popups and can be set up to provide secure, unattended access to a computer. Unattended access does require it to be installed, however.

Team Viewer Team Viewer is well known for many reasons (both good and bad), but much like AnyDesk it is easy to use and can provide unattended access to a computer.

Ad Blocking Browser Extensions

If you use a modern browser, it’s very likely it supports extensions. Here are some that will block ads, malware, and other dodgy software that can be loaded via the browser. Even if you keep your anti-virus software up to date, it’s still worth using an ad blocking extension. Layers of security are a good thing! You can easily disable it for specific pages if it blocks a web page element you require. These extensions will also block YouTube ads and other types of streaming media ads. Please consider using these extensions responsibly and allowing ads for specific sites and creators.

Both AdBlock Plus and uBlock Origin are very good.

uBlock Origin

Mozilla Firefox Extension

The New Microsoft Edge Extension

Google Chrome Extension

AdBlock Plus Mozilla Firefox Extension

The New Microsoft Edge Extension
Google Chrome Extension

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Resurrecting the Windows Photo Viewer

Wed, 06 Nov 2019 15:27:52 +0000

I’ve avoided posting about this for a while mostly because I thought Windows Photo Viewer would get removed. But it’s still there in Windows 10 1909 and it’s still good - even though it doesn’t play animated GIFs and hasn’t been updated since the time of Windows 7. Here’s how to enable it in Windows 10.

Enable Windows Photo Viewer

To enable Windows Photo Viewer so it shows up as an option to open image file types with, copy and paste the text below as is into a new text file and save it with a “.reg” extension.

Windows Registry Editor Version 5.00
 
[HKEY_CLASSES_ROOT\Applications\photoviewer.dll]
 
[HKEY_CLASSES_ROOT\Applications\photoviewer.dll\shell]
 
[HKEY_CLASSES_ROOT\Applications\photoviewer.dll\shell\open]
"MuiVerb"="@photoviewer.dll,-3043"
 
[HKEY_CLASSES_ROOT\Applications\photoviewer.dll\shell\open\command]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,75,00,\
6e,00,64,00,6c,00,6c,00,33,00,32,00,2e,00,65,00,78,00,65,00,20,00,22,00,25,\
00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,00,65,00,73,00,\
25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,50,00,68,00,6f,\
00,74,00,6f,00,20,00,56,00,69,00,65,00,77,00,65,00,72,00,5c,00,50,00,68,00,\
6f,00,74,00,6f,00,56,00,69,00,65,00,77,00,65,00,72,00,2e,00,64,00,6c,00,6c,\
00,22,00,2c,00,20,00,49,00,6d,00,61,00,67,00,65,00,56,00,69,00,65,00,77,00,\
5f,00,46,00,75,00,6c,00,6c,00,73,00,63,00,72,00,65,00,65,00,6e,00,20,00,25,\
00,31,00,00,00
 
[HKEY_CLASSES_ROOT\Applications\photoviewer.dll\shell\open\DropTarget]
"Clsid"="{FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}"
 
[HKEY_CLASSES_ROOT\Applications\photoviewer.dll\shell\print]
 
[HKEY_CLASSES_ROOT\Applications\photoviewer.dll\shell\print\command]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,75,00,\
6e,00,64,00,6c,00,6c,00,33,00,32,00,2e,00,65,00,78,00,65,00,20,00,22,00,25,\
00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,00,65,00,73,00,\
25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,50,00,68,00,6f,\
00,74,00,6f,00,20,00,56,00,69,00,65,00,77,00,65,00,72,00,5c,00,50,00,68,00,\
6f,00,74,00,6f,00,56,00,69,00,65,00,77,00,65,00,72,00,2e,00,64,00,6c,00,6c,\
00,22,00,2c,00,20,00,49,00,6d,00,61,00,67,00,65,00,56,00,69,00,65,00,77,00,\
5f,00,46,00,75,00,6c,00,6c,00,73,00,63,00,72,00,65,00,65,00,6e,00,20,00,25,\
00,31,00,00,00
 
[HKEY_CLASSES_ROOT\Applications\photoviewer.dll\shell\print\DropTarget]
"Clsid"="{60fd46de-f830-4894-a628-6fa81bc0190d}"

Then import the REG file into the registry using the REG IMPORT command. You will need an elevated command prompt.

`1`	`REG IMPORT C:\foo\Win-Photo-Viewer.reg`

The program will not show up in the Start Menu as a program or in Settings as an default option for photos, but you will be able to choose it as an option to open files with.

Right-click > Open with > Choose another app > more apps > Windows Photo Viewer You could also import this REG file as part of an MDT or SCCM Task Sequence, using Group Policy Preferences or a simple start-up script.

If you have any questions or comments, please leave them below. I hope this article is useful to you. Please consider supporting my work with PayPal.

-Mike

Delving Into Disabling OneDrive

Wed, 17 May 2017 13:57:58 +0000

UPDATE 2017-11-07

After testing the method below on Windows 10 1703, I found that it wasn’t working as it did with 1607. To disable One Drive and remove the One Drive folder from the Navigation Pane of Windows Explorer, enable the group policy item: Computer Configuration/Policies/Administrative Templates/Windows Components/OneDrive/Prevent Usage of OneDrive for file storage and also set the following registry key from 1 to 0:

1
2

HKEY\_CLASSES\_ROOT\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}
"System.IsPinnedToNameSpaceTree"=dword:00000000

Please note that the registry key must be set on a per user basis. You can set it via a log in script. For my environment, I customise the Default Profile, so I edit the registry in the Task Sequence which sets the option for all future profiles created after deployment.

Original post

Disabling OneDrive for Windows 10 (and previous versions for that matter) is a relatively easy task to accomplish, but if you’re doing some profile customisation and setting the “CopyProfile” option in the Unattend.xml then you’ll need to do some extra work to make sure that it’s disabled, and hidden as expected. The first thing to do is to set the Group Policy option to disable OneDrive. It’s a computer only option which you’ll find under Computer Configuration/Policies/Administrative Templates/Windows Components/OneDrive/Prevent Usage of OneDrive for file storage you’ll need to set the option to enabled.

If your Windows 10 user profiles are created from the standard default profile then OneDrive should be disabled. When you logon you may see the OneDrive entry in the Navigation pane of Windows Explorer for a short time, but it should disappear eventually. If you are employing a different method creating profiles, either from a custom default profile being created and then copied via the CopyProfile setting in the Unattend.xml or another way, then you will need to make sure that the OneDrive first run setup is being run on login as the Group Policy setting only takes effect properly (removing the OneDrive entry from the Navigation bar) when this is done. For my environment I chose to do this during the deploy Task Sequence in MDT, after the Application Installs. I added the lines below into a batch script which I use to do a few small final tasks.

1
2
3

REG LOAD "hku\Default" "C:\Users\Default\NTUSER.DAT"
REG ADD HKU\Default\Software\Microsoft\Windows\CurrentVersion\Run /v OneDriveSetup /t REG\_SZ /d "C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup"
REG UNLOAD "hku\\Default"

The reason I’ve chosen to do this like is because during my build task sequence, options are set for the Administrator user, which when the image is captured and then deployed, the CopyProfile option copies the Administrator users profile and uses it for as the template for user profiles afterwards. The OneDrive setup first run doesn’t carry over because it’s already run as the Administrator, so you have to restore it. I attempted to just enter the reg key during the very end of the build Task Sequence but it didn’t work. Only after setting it as in the batch file above, during the final steps or the deploy sequence did it work as intended. This is an oddly specific problem that I faced, hopefully my sharing it will help others.

If you have any questions or comments, please leave them below.

-Mike

Removing Included Microsoft Store Apps from Windows 10 & Windows 11

Thu, 06 Apr 2017 18:11:44 +0000

When deploying Windows 10/11 you might want to remove some of the included Microsoft Store Apps to help speed up the login process, save storage space, bandwidth etc.

Important note!

A “provisioned app” is an app that is a part of the Windows 10/11 installation and will be available for all users. Otherwise the app is only installed for the currently logged on user. To remove apps for all future users and the currently logged on user, you must remove both types of app.

Removing Specific Microsoft Store Apps

To remove a specific app from your Windows 10/11 installation, first you need to find the application package name.

Provisioned apps:

`1`	`Get-AppxProvisionedPackage -Online \| Select PackageName`

Current user apps:

`1`	`Get-AppxPackage \| Select PackageFullName`

Then run the following PowerShell command to remove the specific app

Provisioned app:

`1`	`Remove-AppxProvisionedPackage -PackageName [PackageName here] -Online`

Current user app:

`1`	`Remove-AppxPackage -Package [PackageFullName here]`

App Names Table

Here is a table of app names in PowerShell and what they relate to in Windows.

Windows 11 Apps

PowerShell Display Name	App name	Notes
Clipchamp.Clipchamp	Clipchamp	New in 22H2
Microsoft.549981C3F5F10	Cortana	No change
Microsoft.BingNews	Microsoft News	No change
Microsoft.BingWeather	Weather	No change
Microsoft.DesktopAppInstaller	winget	No change
Microsoft.GamingApp	Xbox	No change
Microsoft.GetHelp	Get Help	No change
Microsoft.Getstarted	Tips	No change
Microsoft.HEIFImageExtension	None	No change
Microsoft.HEVCVideoExtension	None	New in 22H2
Microsoft.MicrosoftEdge.Stable	Microsoft Edge	No change
Microsoft.MicrosoftOfficeHub	Office	No change
Microsoft.MicrosoftSolitaireCollection	Microsoft Solitaire Collection	No change
Microsoft.MicrosoftStickyNotes	Sticky Notes	No change
Microsoft.Paint	Paint	No change
Microsoft.People	People	No change
Microsoft.PowerAutomateDesktop	Power Automate	No change
Microsoft.RawImageExtension	None	New in 22H2
Microsoft.ScreenSketch	Snip & Sketch	No change
Microsoft.SecHealthUI	None	No change
Microsoft.StorePurchaseApp	None	No change
Microsoft.Todos	Microsoft To Do	No change
Microsoft.VCLibs.140.00	None	No change
Microsoft.VP9VideoExtensions	None	No change
Microsoft.WebMediaExtensions	None	No change
Microsoft.WebpImageExtension	None	No change
Microsoft.Windows.Photos	(2) “Photos” and “Video editor”	No change
Microsoft.WindowsAlarms	Alarms & Clock	No change
Microsoft.WindowsCalculator	Calculator	No change
Microsoft.WindowsCamera	Camera	No change
microsoft.windowscommunicationsapps	(2) “Calendar” and “Mail”	No change
Microsoft.WindowsFeedbackHub	Feedback Hub	No change
Microsoft.WindowsMaps	Maps	No change
Microsoft.WindowsNotepad	Notepad	No change
Microsoft.WindowsSoundRecorder	Voice Recorder	No change
Microsoft.WindowsStore	Microsoft Store	No change
Microsoft.WindowsTerminal	Terminal	No change
Microsoft.Xbox.TCUI	None	No change
Microsoft.XboxGameOverlay	None	No change
Microsoft.XboxGamingOverlay	Xbox Game Bar	No change
Microsoft.XboxIdentityProvider	None	No change
Microsoft.XboxSpeechToTextOverlay	None	No change
Microsoft.YourPhone	Your Phone	No change
Microsoft.ZuneMusic	Media Player	No change
Microsoft.ZuneVideo	Films & TV	No change
MicrosoftCorporationII.QuickAssist	Quick Assist	New in 22H2
MicrosoftTeams	Microsoft Teams	No change
MicrosoftWindows.Client.WebExperience	None	No change

Windows 10 Apps

PowerShell Display Name	App name	Notes
Microsoft.549981C3F5F10	Cortana	New in 2004
Microsoft.BingWeather	Weather	No change
Microsoft.DesktopAppInstaller	winget	No change
Microsoft.GetHelp	Get Help	No change
Microsoft.Getstarted	Tips	No change
Microsoft.HEIFImageExtension	None	No change
Microsoft.Messaging	Messaging	Removed in 2004
Microsoft.Microsoft3DViewer	3D Viewer	No change
Microsoft.MicrosoftEdge.Stable	Microsoft Edge	New in 21H1
Microsoft.MicrosoftOfficeHub	Office	No change
Microsoft.MicrosoftSolitaireCollection	Microsoft Solitaire Collection	No change
Microsoft.MicrosoftStickyNotes	Sticky Notes	No change
Microsoft.MixedReality.Portal	Mixed Reality Portal	No change
Microsoft.MSPaint	Paint 3D	No change
Microsoft.Office.OneNote	OneNote	No change
Microsoft.OneConnect	None	Removed in 2004
Microsoft.People	People	No change
Microsoft.Print3D	Print 3D	Removed in 2004
Microsoft.ScreenSketch	Snip & Sketch	No change
Microsoft.SkypeApp	Skype	No change
Microsoft.StorePurchaseApp	None	No change
Microsoft.VCLibs.140.00	None	New in 2004
Microsoft.VP9VideoExtensions	None	No change
Microsoft.Wallet	None	No change
Microsoft.WebMediaExtensions	None	No change
Microsoft.WebpImageExtension	None	No change
Microsoft.Windows.Photos	(2) “Photos” and “Video editor”	No change
Microsoft.WindowsAlarms	Alarms & Clock	No change
Microsoft.WindowsCalculator	Calculator	No change
Microsoft.WindowsCamera	Camera	No change
microsoft.windowscommunicationsapps	(2) “Calendar” and “Mail”	No change
Microsoft.WindowsFeedbackHub	Feedback Hub	No change
Microsoft.WindowsMaps	Maps	No change
Microsoft.WindowsSoundRecorder	Voice Recorder	No change
Microsoft.WindowsStore	Microsoft Store	No change
Microsoft.Xbox.TCUI	None	No change
Microsoft.XboxApp	Xbox Console Companion	No change
Microsoft.XboxGameOverlay	None	No change
Microsoft.XboxGamingOverlay	Xbox Game Bar	No change
Microsoft.XboxIdentityProvider	None	No change
Microsoft.XboxSpeechToTextOverlay	None	No change
Microsoft.YourPhone	Your Phone	No change
Microsoft.ZuneMusic	Groove Music	No change
Microsoft.ZuneVideo	Films & TV	No change

Remove Specific MS Store Apps From An Online Windows 10/11 WIM Image

Note: The Start Menu in Windows 10 for new users, will still have icons for the removed apps. They can be removed manually by the user, or you can configure the Start Menu (and Taskbar) using a few different options. I’ve written about administratively configuring the Start Menu previously, here and here.

Download my PowerShell utility from GitHub.

The script removes the apps specified in a text file from the current logged on user and Windows 10/11. I use the script as a part of my Task Sequence for deploying Windows 10/11. The script is heavily based on work by Jörgen Nilsson - check out his post over on his site.

Remove Specified MS Store Apps From An Offline Windows 10/11 WIM Image

First, you will need to copy the contents of the Windows 10/11 ISO file to your hard drive.

Windows 10/11 includes many editions within it’s WIM file. You will need to specify the index ID of the image to operate on. You can obtain this by running the following PowerShell command:

`1`	`Get-WindowsImage -ImagePath "C:\foo\Windows 10\sources\install.wim" \| Format-Table -Property ImageIndex, ImageName`

The output of the command above should look similar to this:

ImageIndex ImageName
---------- ---------
1 Windows 10 Education
2 Windows 10 Education N
3 Windows 10 Enterprise
4 Windows 10 Enterprise N
5 Windows 10 Pro
6 Windows 10 Pro N
7 Windows 10 Pro Education
8 Windows 10 Pro Education N
9 Windows 10 Pro for Workstations
10 Windows 10 Pro N for Workstations

Now you can use the information above to configure the PowerShell utility to remove the specific apps from the Windows install image. This script will mount the image, remove the apps and then dismount it. The image can then be made into an ISO or used with MDT/SCCM to deploy Windows as normal.

Download my PowerShell utility from GitHub.

Remove All Included Microsoft Store Apps (Not Recommended)

Note: This process is destructive and non-reversible. Please ensure you have backups before proceeding. To simply remove all the apps possible for the current user, run the following PowerShell command:

`1`	`Get-AppxPackage \| Remove-AppxPackage`

To remove all the provisioned apps, run the following PowerShell command:

Note: Provisioned apps are the apps that will be installed for all new users when they first log on.

`1`	`Get-AppxProvisionedPackage -Online \| Remove-AppxProvisionedPackage -Online`

Support My Work

Please consider supporting my work:

Support with a one-time donation using PayPal.

If you have any questions or comments, please leave them below.

-Mike

Page History

Update 2022-10-20

Added information relating to Windows 10 22H2.

Update 2022-09-21

Added information relating to Windows 11 22H2.

Update 2021-11-22

Added information relating to Windows 10 21H2.

Update 2021-09-03

Added information relating to Windows 11 21H2.

Update 2021-05-12

Added information relating to Windows 10 21H1 May 2021 Update.

Update 2020-11-02

Added information relating to Windows 10 20H2 October 2020 Update.

Update 2020-06-12

Added information relating to Windows 10 2004 May 2020 Update (20H1).

Update 2020-01-27

Removed information for old unsupported versions of Win 10 and added a table to show which app maps to the display names in PowerShell.

Update 2019-10-06

Updated to include Windows 10 1909 November 2019 Update (19H2) Enterprise edition.

Update 2019-05-23

Updated to reflect the apps included in Windows 10 1903, May 2019 Update (19H1) Enterprise edition.

Update 2018-10-06

An update to reflect some tests I’ve done with Windows 10 1809, October 2018 Update.

Update 2018-05-07

A minor update to reflect some quick tests I’ve done with Windows 10 1803, April 2018 Update.

Update 2018-03-30

Minor maintenance update. Reworked some sections to be more clear and instructive. Added some new information from my own testing and fact checking.

Update 2017-10-17

Updated post with the list of apps included in Windows 10 1709 (Fall Creators Update) by default.

Update 2017-08-03

I’ve re-written much of this post to answer some questions that have come up and to help clarify the process. Thanks to Jörgen Nilsson over at ccmexec.com, with his original post that inspired me to write this one.

Windows 10 1607 (Anniversary Update) opens msn.com at login and how to stop it.

Thu, 12 Jan 2017 22:01:34 +0000

I thought about trying to find a better name for this post and this issue, but this is all I could come up with.

Update 2017-10-16: A few people have contacted me and made me aware that doing the reg hack below can prevent users from using Microsoft Office Clipart, so you should be aware of that before proceeding. Additionally, I’ve found that with Windows 10 1703 (Creators Update), allowing access to http://www.msftconnecttest.com/redirect through your firewall/proxy will achieve the same thing without the reg hack and without preventing access to Microsoft Office Clipart. Please note though, it does not work with 1607.

Original Post ANYWAY, I finally tracked down how to stop Windows 10 1607 (Anniversary Update) from opening the default browser with msn.com. There are no startup or login registry entries, Group Policy settings, Scheduled Tasks, or even programs in the Start Menu startup folder. This is *something* that Windows is doing itself. I’ve only encountered this issue on corporate networks, not on my home network, so I knew that some sort of authentication/proxy/filtering/firewall thing. I’ve also only had this issue with Windows 10 1607 (Anniversary Update), not 1511 (November Update) or 1507 (RTM).

It seems that Windows 10 is probing the network to get out to the internet, hitting some sort of issue (I’m guessing that it’s authentication in my case) and then opening up the default browser and browsing to a Microsoft owned address that results in a redirect to http://www.msn.com. In my case no authentication dialogue box pops up, it just browses to the site and appears to be happy with that. Weird. If it were only happening to “Admin” users I wouldn’t worry about it, but it happens to everyone! So, although not a cause for major concern or enough to halt my roll out of Windows 10 1607, I still wanted to fix it, if possible.

After some research it appears a similar issue to this occurred with Windows 8. I never had this issue during my roll out of Windows 8 but the resolution appears to work for Windows 10 1607 as well. At this stage I don’t know if making this change causes any unforeseen problems, but I’ll add to this post if I see anything. Here’s how to prevent it. Using the registry editor, navigate to the location below, and change the “1” (enabled) to a “0” (disabled).

`1`	`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet\EnableActiveProbing`

This should stop the browser from opening at login but Internet access should still be available. I hope this helps. If you’ve already done this and it’s caused another issue, please let me know in the comments or tweet me! You’ll probably want to roll this out to your Windows 10 clients, of course you can do it via Group Policy but as it’s a one time setting I would suggest adding it to the Task Sequence that builds your reference image.

Adding the registry change to Group Policy

Open Group Policy Management
Navigate to Group Policy Objects
Right click and Create or edit your Group Policy for your Windows 10 Clients
Navigate to Computer Configuration > Preferences > Windows Settings > Registry
Right click and go to New > Registry Item
Under Key Path enter SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet
Under Value name enter EnableActiveProbing
The Value type should be REG_DWORD
The Value data should be set to 00000000 - that’s six zeros for a Hexadecimal Base or you can just enter one zero for Decimal Base.
Click OK to save the changes.
If you created a new Group Policy Object, you will need to link it to an OU that contains the clients you want the GPO to affect. To do this right click the OU and select Link an existing Group Policy… and then select the Group Policy you created earlier.

Adding the registry change to a Task Sequence

Open Notepad and paste the following into it:

Windows Registry Editor Version 5.00
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet]
"EnableActiveProbing"=dword:00000000

Save the file with any name you like, but it must have the extension .reg
Copy the .reg file to your Deployment server. It needs to be accessible by the Task Sequence, so I put mine in E:\DeploymentShare\Applications\
In the Task Sequence, you’ll want to add it before the Windows Update (Pre-Application Installation) item, so select that item first.
Click the Add button at the top of the sequence, and go to General > Run Command Line.
Select the new Run Command Line item and click the Up button at the top of the sequence to move it above the Windows Update (Pre-Application Installation) item.
On the right hand side of the window, under Name, enter whatever you want, I called mine cmd - disable active probing
Under Command Line enter REG IMPORT Z:\Applications\ActiveProbing.reg
Click OK to save and close the Task Sequence and you’re done!

When you run the Task Sequence to create a reference image, the registry will be edited and during your build phase you won’t get any browser windows opening on login.

If you have any questions or comments, please leave them below.

-Mike

Windows Tweaks on gal.vin

Better Windows Updates For Everyone

Set Active Hours - Windows 10

Set Active Hours - Windows 11

Registry Settings - Windows 10 Home

Group Policy Settings - Windows 10 Pro/Enterprise

Registry Settings - Windows 11 Home

Group Policy Settings - Windows 11 Pro/Enterprise

Support My Work

Windows 11 Customisation

Start Menu Layout

Disable Search On The Taskbar

Disable Widgets On The Taskbar

Disable Chat In The Taskbar

Default App Associations

Exporting A Default App Association File

Importing A Default App Association File as part of an MDT Task Sequence

Support My Work

Disable The News and Interests Bar in Windows 10

The New News and Interests Bar for Windows 10

Registry

Group Policy

Central Store

Support My Work

Disable Network Discovery in Windows 10/11

Fully disabling Network Discovery in Windows 10 using Group Policy

Firewall Rules

System Services

Support My Work

Tech Tips for These Tumultuous Times

Improving Your Internet Connection

Improving Your DNS Service

Online Services Monitor

Remote Access Software

Ad Blocking Browser Extensions

uBlock Origin

Resurrecting the Windows Photo Viewer

Enable Windows Photo Viewer

Delving Into Disabling OneDrive

UPDATE 2017-11-07

Original post

Removing Included Microsoft Store Apps from Windows 10 & Windows 11

Removing Specific Microsoft Store Apps

App Names Table

Windows 11 Apps

Windows 10 Apps

Remove Specific MS Store Apps From An Online Windows 10/11 WIM Image

Remove Specified MS Store Apps From An Offline Windows 10/11 WIM Image

Remove All Included Microsoft Store Apps (Not Recommended)

Support My Work

Page History

Update 2022-10-20

Update 2022-09-21

Update 2021-11-22

Update 2021-09-03

Update 2021-05-12

Update 2020-11-02

Update 2020-06-12

Update 2020-01-27

Update 2019-10-06

Update 2019-05-23

Update 2018-10-06

Update 2018-05-07

Update 2018-03-30

Update 2017-10-17

Update 2017-08-03

Windows 10 1607 (Anniversary Update) opens msn.com at login and how to stop it.

Adding the registry change to Group Policy

Adding the registry change to a Task Sequence