Tidy11

Disable Copilot, Recall, telemetry, ads, and bloat on Windows 11 and Microsoft 365. Fully offline. GUI + Intune + GPO with snapshot rollback.

Tidy11 is a fully offline, single-folder toolkit for taking back control of a Windows 11 machine or fleet. It ships as an interactive WPF GUI for single machines, an Intune Proactive Remediation pair for managed fleets, and static .reg baselines for GPO — all driven by the same tested logic.

No runtime network dependency. No telemetry of its own. No code you can't read.

Topics: windows-11 · privacy · cleanup · copilot · recall · telemetry · intune · gpo · powershell · wpf · microsoft-365 · ai-removal · windows-hardening

---

Disclaimer — read before running

Tidy11 is intended for power users who know what they are doing. It makes deep changes to Windows policy, services, scheduled tasks, firewall rules, and Appx packages. If you don't understand what a setting does, read Tidy11-Reference.md first, or don't tick that box.

• No warranty. This software is provided as is, without warranty of any kind, express or implied. You run it at your own risk.
• No support. There is no help desk, no SLA, no guarantee that issues will be answered or fixed. The GitHub issue tracker is not monitored — do not open issues; they will not be triaged.
• Tested to the author's satisfaction. I have used Tidy11 on my own machines and fixed every bug I encountered. Any remaining bugs are ones I did not hit. Your environment may differ.
• Use the safety net. Both the Windows System Restore point and the Tidy11 snapshot options are ticked by default for a reason — leave them ticked. If something breaks, you have three independent rollback paths (see Safety model).
• Review before you deploy. Read the source. Test on one machine before rolling to a fleet. Read the Caveats section.

If any of the above is a dealbreaker for you, don't use Tidy11.

---

Features

• Copilot / AI removal: Windows Copilot, Recall, Click To Do, Paint AI, Edge Copilot, Office Copilot, Notepad AI, Voice Access, generative-AI app privacy gates.
• Privacy: telemetry (DiagTrack + scheduled tasks + FQDN firewall blocks), advertising ID, activity history, location, tailored experiences, feedback prompts, typing data harvesting.
• System cleanup: Widgets, Bing/Cortana in Start, Xbox services (optional), Game DVR (optional), classic Win10 context menu, taskbar cleanup, Edge first-run, Office telemetry.
• Classic apps: four installation methods for replacing removed Win11 apps (Winget, Microsoft-native, Source Redist Online, Source Redist Local) with per-app choice. Optional opt-in install of Open-Shell (the freeware MIT-licensed successor to Classic Shell / Classic Start Menu) for users who want a Win7-style Start menu.
• Two rollback layers before any change:
  • Windows System Restore point (enabled automatically if disabled).
  • Tidy11's own snapshot with registry exports, services, scheduled tasks, firewall rules, hosts backup, and a net-new-value log for clean deletion.
• Config recipes: save your exact checkbox selection as JSON and replay on another machine.
• Verification mode: read-only 16-check audit to see what a Windows feature update re-enabled.
• Edition-aware: telemetry minimum values auto-adjust for Home / Pro / Enterprise.

---

Quickstart (single machine)

1. Download or clone this repository.
2. Right-click Tidy11.ps1 → Run with PowerShell. It auto-elevates via UAC.
3. Pick a preset (SAFE is the recommended default), or tick individual checkboxes.
4. Leave both safety options ticked (default):
   • ☑ Create Windows System Restore point
   • ☑ Create Tidy11 snapshot BEFORE applying changes
5. Click DISABLE Selected. Reboot when done.

Note on the button label: DISABLE Selected is also what runs the Classic App Replacements section — i.e. it is both the "remove Copilot/telemetry/ads" trigger and the "install classic apps (Notepad, Paint, Open-Shell, …)" trigger, all in one pass. REVERT Selected undoes the disables but does not uninstall apps you installed via the Classic Apps section — those have to be removed manually (Settings → Apps or winget uninstall).

If anything goes wrong, you have three independent rollback paths:

If …	Use …
The machine still boots, GUI still opens	GUI → Restore from Snapshot…
The GUI is broken but PowerShell works	.\Tidy11-Restore.ps1 (standalone, no module needed)
The machine won't boot properly	Recovery environment → System Restore → pick the Tidy11 pre-change checkpoint

---

Files in this pack

File	Purpose	Run as
Tidy11.ps1	Interactive WPF GUI for single-machine use	Admin (auto-elevates)
Tidy11.Modules.psm1	PowerShell module with all apply/revert/verify/snapshot/config functions	Loaded by the GUI
Tidy11-Restore.ps1	Standalone snapshot restorer — no module dependency	Admin (auto-elevates)
Tidy11-Detect.ps1	Intune Proactive Remediation detection script	SYSTEM
Tidy11-Remediate.ps1	Intune Proactive Remediation remediation script (self-contained)	SYSTEM
Tidy11-User.ps1	Intune user-context companion — HKCU keys for existing profiles	Logged-on user
Tidy11.reg	Static registry baseline for GPO Preferences / offline import	Admin
Tidy11-Revert.reg	Reverse of Tidy11.reg — deletes the policy values to restore defaults	Admin
Tidy11-Reference.md	Per-setting reference (paths, default values, proposed values, risk class)	Documentation
LICENSE	The Unlicense	—

---

Requirements

• Windows 11 (all editions). Windows 10 also works for the PS1 side; some Copilot-specific keys are no-ops.
• Windows PowerShell 5.1 (powershell.exe). The WPF GUI requires the PresentationFramework assembly stack that is only available in classic PowerShell — pwsh 7+ will refuse to launch with a clear error.
• Administrator rights (the scripts auto-elevate).

No internet required at runtime. All AI/Copilot/telemetry logic is native in the module file.

---

Scenario 1 — Single machine (your own PC)

Covered by the Quickstart above. A few extras worth knowing:

• Save Config Recipe… → export your exact selections as tidy11-recipe.json for later reuse or cross-machine replication.
• Verify (read-only) → runs a 16-check audit without touching anything. Handy after a Windows feature update to see what Microsoft re-enabled.
• Restore from Snapshot… → pick any snapshot folder, confirm, done. The restore does everything in the right order: re-imports registry exports, deletes net-new values Tidy11 created, auto-chains Tidy11-Revert.reg if present, restores services/tasks/firewall differentially, and restores the hosts file.

---

Scenario 2 — Small fleet via GPO (on-prem AD, no Intune)

Use Tidy11.reg as the static baseline.

Option A — Direct registry import

reg.exe import \\fileserver\share\Tidy11.reg

Wrap that in a startup script GPO (Computer Configuration → Windows Settings → Scripts → Startup).

Option B — GPO Preferences (recommended, reversible)

1. Open Group Policy Management → edit a GPO linked to the target OU.
2. Computer Configuration → Preferences → Windows Settings → Registry.
3. Right-click → New → Registry Wizard → Local Computer → browse to any key from Tidy11.reg → import → set action to Replace.

GPO Preferences let you unscope/remove keys cleanly by flipping the GPO to "Delete" mode, unlike a raw .reg import.

What .reg does NOT cover

The .reg is only static key data. For full coverage you also need service stops, task disables, Appx removal, and firewall rules. Deploy Tidy11-Remediate.ps1 as a startup script alongside it:

powershell.exe -NoProfile -ExecutionPolicy Bypass -File "\\fileserver\share\Tidy11-Remediate.ps1"

---

Scenario 3 — Intune (recommended for managed fleets)

Use Scripts and remediations (formerly Proactive Remediations). This is the durable answer because Windows feature updates silently re-enable things — the scheduled remediation puts them back.

Setup

1. Intune admin center → Devices → Scripts and remediations → Create script package.
2. Name: Tidy11 — AI & Privacy Baseline
3. Detection script file: upload Tidy11-Detect.ps1
4. Remediation script file: upload Tidy11-Remediate.ps1
5. Run this script using the logged-on credentials: No (run as SYSTEM)
6. Enforce script signature check: No (unless you sign them with your code signing cert)
7. Run script in 64-bit PowerShell: Yes
8. Assign to your device group.
9. Schedule: Daily at 03:00 is a reasonable default.

User-context companion

SYSTEM-context scripts cannot write HKCU for existing user profiles. Deploy Tidy11-User.ps1 as a separate Platform script (Devices → Scripts → Add → Windows 10 and later):

• Run this script using the logged-on credentials: Yes
• Enforce script signature check: No
• Run script in 64-bit PowerShell: Yes
• Assign to a user group, not a device group.

This covers: taskbar alignment, Start Recommended, Notepad AI, per-app Office Copilot toggles, Bing/Cortana, ContentDeliveryManager, InputPersonalization, Office telemetry, location consent, perf tweaks.

Why not a Settings Catalog profile?

Most of what Tidy11 touches (Paint AI, File Explorer Ask Copilot, Notepad AI, Edge Copilot flags, Game DVR policy, Widgets, Office Copilot master toggle, Cortana/Bing) is not exposed as a Settings Catalog definition. The catalog only covers keys Microsoft has wrapped in an MDM CSP. A hybrid works — Settings Catalog for Telemetry/Copilot/Widgets/AppPrivacy, Tidy11 for the rest — but the Tidy11 pair alone is simpler and covers everything.

---

Scenario 4 — Imaging / MDT / Autopilot

Bake it in at first-run:

# In your Autopilot/MDT deployment script, after OOBE completes:
Invoke-WebRequest -Uri 'https://yourshare/Tidy11-Remediate.ps1' -OutFile "$env:TEMP\wn.ps1"
& "$env:TEMP\wn.ps1"

Or drop Tidy11.reg into your reference image's FirstLogonCommands via unattend.xml.

---

What Tidy11 removes or disables

Items are grouped by category. Full per-setting reference with registry paths and default values is in Tidy11-Reference.md.

Category	Targets
Windows Copilot	TurnOffWindowsCopilot policy, Copilot Appx package (optional), taskbar button, hardware Copilot key, AppPrivacy generative-AI access
Recall / WindowsAI	DisableAIDataAnalysis, AllowRecallEnablement=0, Click To Do, Settings Agent, Agent Connectors/Workspaces
Paint AI	Cocreator, Generative Fill/Erase, Image Creator, Remove Background
Edge	Copilot sidebar, Compose inline, AI themes, History AI search, startup boost, background mode. Optional opt-in: lock the default search engine to DuckDuckGo instead of Bing.
Office Copilot	HKLM master policy + per-user Word/Excel/PPT/OneNote/Outlook toggles + Outlook BusinessChat add-in
Notepad AI	CopilotEnabled, AIFeaturesEnabled, ShowAIFeatures