I install Windows more often than most people install apps. Between refurbished laptops, a two-person repair bench and my own machines, I go through the same first hour again and again: set up the account, watch the Start menu fill with things nobody asked for, and start undoing it.
Winhance turned that hour into about ten minutes. This is exactly what I do in those ten minutes, in order, and — more usefully — what I deliberately leave alone.
Installed build or portable build
The setup wizard asks one question worth thinking about: installed or portable. The installed build integrates with the system — Start menu entry, shortcuts, the usual. The portable build runs from any folder, including a USB stick, and leaves nothing behind on the machine.
Feature-wise they are identical. My rule is simple: portable on machines that are not mine, installed on machines that are. A tool that touches system settings has no business leaving traces on a customer's disk once the job is finished.
Requirements are modest: 64-bit Windows 10 or Windows 11. It needs administrator rights, because almost everything it does is a registry write under HKLM or a package removal.
What happens on first launch
The part I care about most happens before I click anything. On the very first launch Winhance creates its own safety net: a system restore point named Winhance initial restore point, full registry backups written to C:\ProgramData\Winhance\Backups, and a backup configuration file that records the current value of every setting the app manages.
That last one is the interesting artefact. It is not a Windows feature — it is a snapshot of "here is how this machine looked before I arrived", in the same format the app uses for its own configs. If I want to put a machine back the way I found it, I import that file.
These backups are created once, on first run. If you want a fresh restore point later, make it yourself before a big session. I do, out of habit, using Create a restore point from the Start search box.
Learning the four rooms
The left rail splits the app into four areas, and it is worth spending sixty seconds in each before touching a switch:
- Software & Apps — remove built-in Windows apps and packages, or bulk-install external software on a fresh install.
- Optimize — privacy and security, power, gaming and performance, Windows Update, notifications, sound.
- Customize — theme, taskbar, Start menu, File Explorer.
- Advanced Tools — WIMUtil and the autounattend generator, for building custom installation media.
There is a search box at the top; on a machine where I know what I want, I type the setting name and skip the browsing entirely. Ctrl+1 through Ctrl+5 jump between sections, which matters more than it sounds when you are doing this on your fifth laptop of the day.
Turn on Technical Details immediately
Next to the search bar there is a toggle for technical details. Switch it on and every setting grows a panel showing the registry path, the value name, the current value and the recommended one. Ctrl+D toggles it for whichever setting has focus.
I leave it on permanently. It is the difference between "I clicked the privacy button" and "I set AllowTelemetry to 0 under HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection", and the second sentence is the one you can defend to a client, reverse later, or check independently with reg query.
If a tweaking tool will not tell you what it changed, the tool is asking for trust it has not earned. This one tells you, so use that.
The six I always flip
These are my defaults on any machine that is going to be used by a human being rather than tested:
Advertising ID off
Under general privacy. Stops apps building a per-device profile for personalized ads. Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo.
Ads, suggestions and promotional content set to Deny
This is the master switch over the whole ContentDeliveryManager family — suggested apps, lock screen "fun facts", Settings app promos, silent installs. One control, roughly a dozen values.
Diagnostic data to the minimum the edition allows
Home and Pro behave differently here. Winhance writes both the policy and the per-user values, which is what makes the change stick after an update.
OneDrive folder backup blocked
KFMBlockOptIn. Not because OneDrive is bad, but because a silent redirect of Documents and Desktop is the single most common source of "where did my files go" calls I get.
Windows Spotlight and lock screen overlays off
Rotating images are fine. The tips, facts and "like what you see" prompts layered on top are not.
Explorer: file extensions and full paths shown
Under Customize. It takes four seconds and prevents an entire genre of double-clicked invoice.pdf.exe.
What I leave alone
On a machine that belongs to someone else, I do not touch: User Account Control levels, Windows Update deferral beyond a few days, Remote Assistance if the household has a designated helper, or automatic maintenance. Every one of those has bitten me at least once, and the performance gain from switching them off is somewhere between small and imaginary.
I also do not remove anything from the Microsoft Store family, Edge included, on a first pass. Removal is quick; explaining to a client six weeks later why a school portal will not open is not.
Restart, then verify
Most toggles apply instantly, but services and Explorer-level changes settle properly only after a reboot. So: restart, log back in, and spend two minutes checking the obvious — network, sound, printer, Store opens, Windows Update runs a check without erroring.
Then export a config. Ten minutes of work becomes a file I can drop onto the next machine, and that is where the real time saving lives. I wrote about that workflow separately in one config file, twelve machines.
Written by Joseph Savastano. Measurements come from my own machines and are not a promise about yours. Corrections are welcome and get published — send one.