Скрипт отключающий лишнюю нагрузку системных процессов на Windows 11

disable-windows11-bloat.ps1

<#
PowerShell script: disable-windows11-bloat.ps1
Purpose: to disable background services, updates, telemetry, and other non-essential Windows 11 components to reduce resource usage.
WARNING: This makes the system vulnerable (no antivirus, no updates). Use only on controlled or offline servers.
Creates registry backups and a log of actions in C:\Temp\win11_cleanup_backup_YYYYMMDD_HHMMSS
#>

# --- Language selection ---
Write-Host "Select language / Выберите язык:" -ForegroundColor Cyan
Write-Host "1 - English" -ForegroundColor Yellow
Write-Host "2 - Русский" -ForegroundColor Yellow
$langChoice = Read-Host "Enter number / Введите номер"
if ($langChoice -eq '2') { $lang = 'ru' } else { $lang = 'en' }

function T($en, $ru) { if ($lang -eq 'ru') { return $ru } else { return $en } }

# --- Check admin rights ---
if (-not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Error (T "Run PowerShell as Administrator and retry." "Запустите PowerShell от имени администратора и повторите попытку.")
    exit 1
}

# --- Backup folders ---
$now = Get-Date -Format "yyyyMMdd_HHmmss"
$backupDir = "C:\Temp\win11_cleanup_backup_$now"
New-Item -Path $backupDir -ItemType Directory -Force | Out-Null
$logFile = Join-Path $backupDir "actions.log"
"Backup folder: $backupDir" | Out-File -FilePath $logFile -Encoding utf8

# --- Utility functions ---
function Log($msg) { $ts = (Get-Date).ToString('s'); "$ts`t$msg" | Out-File -FilePath $logFile -Append -Encoding utf8 }
function RegExportIfExists($key, $outFile) {
    try {
        reg.exe query "$key" > $null 2>&1
        if ($LASTEXITCODE -eq 0) {
            reg.exe export "$key" "$outFile" /y | Out-Null
            Log "Exported $key -> $outFile"
        } else { Log "Registry key not found: $key" }
    } catch { Log "Error exporting $key : $_" }
}

# --- Export registry keys for backup ---
RegExportIfExists "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" (Join-Path $backupDir "WindowsUpdate.reg")
RegExportIfExists "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" (Join-Path $backupDir "WindowsDefender.reg")
RegExportIfExists "HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive" (Join-Path $backupDir "OneDrive.reg")
RegExportIfExists "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" (Join-Path $backupDir "DataCollection.reg")
RegExportIfExists "HKLM\SYSTEM\CurrentControlSet\Services\" (Join-Path $backupDir "Services.reg")

# --- Stop and disable unnecessary services ---
$servicesToDisable = @(
    'WinDefend',      # Windows Defender
    'wuauserv',       # Windows Update
    'bits',           # Background Intelligent Transfer Service
    'dosvc',          # Delivery Optimization
    'DiagTrack',      # Telemetry
    'dmwappushservice',
    'WMPNetworkSvc',  # Media Player Network Sharing
    'WSearch',        # Search
    'OneSyncSvc',     # OneSync Service
    'MapsBroker'      # Maps Broker
)

foreach ($s in $servicesToDisable) {
    try {
        Log "Processing service: $s"
        if (Get-Service -Name $s -ErrorAction SilentlyContinue) {
            Stop-Service -Name $s -Force -ErrorAction SilentlyContinue
            sc.exe config $s start= disabled | Out-Null
            Log "Stopped and disabled $s"
        } else { Log "Service not found: $s" }
    } catch { Log "Error handling service $s : $_" }
}

# --- Disable Windows Defender ---
try {
    if (Get-Command -Name Set-MpPreference -ErrorAction SilentlyContinue) {
        Log "Applying Set-MpPreference settings"
        Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -DisablePrivacyMode $true -SubmitSamplesConsent 2 -MAPSReporting 0
    }
} catch { Log "Set-MpPreference failed: $_" }

try {
    New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Force | Out-Null
    New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 1 -PropertyType DWord -Force | Out-Null
    New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableRealtimeMonitoring" -Value 1 -PropertyType DWord -Force | Out-Null
    Log "Set Defender registry keys"
} catch { Log "Failed setting Defender registry keys: $_" }

try { sc.exe stop WinDefend | Out-Null; sc.exe config WinDefend start= disabled | Out-Null } catch {}

# --- Disable Windows Update ---
try {
    Stop-Service -Name wuauserv -Force -ErrorAction SilentlyContinue
    Stop-Service -Name bits -Force -ErrorAction SilentlyContinue
    sc.exe config wuauserv start= disabled | Out-Null
    sc.exe config bits start= disabled | Out-Null
    sc.exe config dosvc start= disabled | Out-Null
    New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Force | Out-Null
    New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "NoAutoUpdate" -Value 1 -PropertyType DWord -Force | Out-Null
    Log "Disabled Windows Update"
} catch { Log "Windows Update disable error: $_" }

# --- Disable telemetry ---
try {
    New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Force | Out-Null
    New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" -Value 0 -PropertyType DWord -Force | Out-Null
    Log "Telemetry disabled"
} catch { Log "Failed to set telemetry registry: $_" }

$telemetryServices = @('DiagTrack','dmwappushservice')
foreach ($t in $telemetryServices) {
    try { Stop-Service -Name $t -Force -ErrorAction SilentlyContinue } catch {}
    try { sc.exe config $t start= disabled | Out-Null; Log "Disabled $t" } catch {}
}

# --- Disable OneDrive ---
try {
    Log "Attempting OneDrive uninstall"
    $oneDrivePath64 = "$env:SystemRoot\SysWOW64\OneDriveSetup.exe"
    $oneDrivePath32 = "$env:SystemRoot\System32\OneDriveSetup.exe"
    if (Test-Path $oneDrivePath64) { Start-Process -FilePath $oneDrivePath64 -ArgumentList "/uninstall" -Wait -NoNewWindow -ErrorAction SilentlyContinue }
    elseif (Test-Path $oneDrivePath32) { Start-Process -FilePath $oneDrivePath32 -ArgumentList "/uninstall" -Wait -NoNewWindow -ErrorAction SilentlyContinue }
    New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" -Force | Out-Null
    New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" -Name "DisableFileSyncNGSC" -Value 1 -PropertyType DWord -Force | Out-Null
    Log "OneDrive disabled"
} catch { Log "OneDrive removal error: $_" }

# --- Disable background apps ---
try {
    $path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications'
    New-Item -Path $path -Force | Out-Null
    New-ItemProperty -Path $path -Name 'GlobalUserDisabled' -Value 1 -PropertyType DWord -Force | Out-Null
    Log "Background apps disabled"
} catch { Log "Failed disabling background apps: $_" }

# --- Finish ---
Log "Script finished. Backup: $backupDir"
Write-Host (T "Done. Logs in: $backupDir" "Готово. Логи и резервные копии в: $backupDir") -ForegroundColor Yellow

$reboot = Read-Host (T "Reboot now? (Y/N)" "Перезагрузить систему сейчас? (Y/N)")
if ($reboot -match '^[Yy]') { Restart-Computer -Force }

🧰 Windows 11 RDP Optimization Script

🇷🇺 Описание

Скрипт PowerShell для оптимизации Windows 11 на RDP-сервере.
Отключает Windows Defender, обновления, телеметрию, OneDrive и все ненужные фоновые службы, чтобы минимизировать использование ресурсов.
Создаёт резервные копии ключевых веток реестра и сохраняет журнал действий в C:\Temp.
⚠️ Рекомендуется использовать только на изолированных или контролируемых серверах, так как защита системы будет отключена.

🇬🇧 Description

PowerShell script for optimizing Windows 11 on an RDP server.
Disables Windows Defender, Windows Update, telemetry, OneDrive, and unnecessary background services to minimize resource usage.
Creates backups of critical registry keys and logs all performed actions in C:\Temp.
⚠️ Recommended for use only on isolated or controlled servers, as system protection will be disabled.