A one-click solution to fix Windows PCs broken by debloat scripts, privacy.sexy tweaks, and aggressive registry modifications.
Debloat scripts and privacy tools like privacy.sexy, Win10Debloater, and similar utilities often go too far. They can disable Windows Defender, break Windows Update, disable critical services, and leave your system in an insecure or non-functional state.
Windows Restore Tool scans your system for these issues and restores Windows to safe, working defaults with a single click.
- Pre-scan diagnostics - Automatically detects what's broken before making changes
- Quick scan summary - Shows disabled services, tasks, missing apps, and registry modifications at a glance
- Multiple fix modes - Recommended, detected-only, security-only, or fully custom
- 47 restoration categories - Comprehensive coverage of common tweaks
- Progress bar - Real-time progress with percentage as categories are processed
- Category result indicators - FIXED, PARTIAL, FAILED, or SKIPPED status for each category
- Import undo manifest - Load JSON manifests from Debloat-Win11 v1.1.0 for precise restoration
- Debloat fingerprinting - Detects evidence from O&O ShutUp10, WPD, ThisIsWin11, Sophia Script, and Win10Privacy without executing their code
- Baseline inventory - Exports and compares registry/AppX state, including provisioned-package and offline-WIM comparisons
- Bounded offline servicing - Validates a WIM/VHD source, image index, edition, architecture, DISM version, locks, and scratch capacity before mounting; commit and discard are separate explicit actions
- Explicit restore scopes - Names current-user, all-existing-user, provisioned-image, and offline-image AppX observations; only current-user online registration is executable by the restore executor
- Managed-device safety - Reports structured domain, MDM, Group Policy, local-policy, and account-join provenance; managed values and categories are skipped by default unless an explicit operator override is recorded
- Independent restore verification - Records bounded native-command exit codes, stderr, failure taxonomy, fresh postconditions, and pending-reboot state in CLI, GUI, and deployment-wrapper results
- Operational recovery - Adds security reset, Search index rebuild, Store/WinGet repair, privacy-slider repair, integrity-checked rollback journals, and next-boot restore scheduling
- Privacy-bounded support bundles - Exports only allowlisted summaries and bounded redacted event text, with collision-safe output, size limits, a SHA-256 manifest, and a machine-readable redaction report
- Deployment wrappers - Read-only compliance and optional remediation entry points for Intune and Configuration Manager
- HTML report export - Save a detailed dark-themed report of everything restored with before/after states
- Safe by default - Creates a System Restore point before making changes
- Detailed logging - Full log saved to your Desktop
- Dark themed UI - Modern interface that's easy on the eyes
- No installation required - Single PowerShell script, run and done
- Download
Restore-WindowsDefaults.ps1 - Right-click the file
- Select Run with PowerShell
Set-ExecutionPolicy Bypass -Scope Process-Force
.\Restore-WindowsDefaults.ps1irm https://raw.githubusercontent.com/YOUR_USERNAME/YOUR_REPO/main/Restore-WindowsDefaults.ps1| iexThe script automatically elevates to Administrator and runs in Windows PowerShell 5.1 for maximum compatibility.
The same script supports non-GUI workflows for automation and diagnostics:
# Capture and compare a versioned registry snapshot
.\Restore-WindowsDefaults.ps1-NoGui -ExportSnapshot .\before.json
.\Restore-WindowsDefaults.ps1-NoGui -CompareSnapshot .\before.json
.\Restore-WindowsDefaults.ps1-NoGui -WhatIf -RestoreCategories chkDefender,chkWindowsUpdate
.\Restore-WindowsDefaults.ps1-NoGui -PlanPath .\restore-plan.json -RestoreCategories chkDefender,chkWindowsUpdate
.\Restore-WindowsDefaults.ps1-NoGui -BaselineReport
.\Restore-WindowsDefaults.ps1-NoGui -CapabilityReport -RestoreCategories chkDefender,chkWindowsUpdate
.\Restore-WindowsDefaults.ps1-NoGui -CapabilityReport -AllowManagedPolicy -RestoreCategories chkDefender,chkWindowsUpdate
.\Restore-WindowsDefaults.ps1-NoGui -CapabilityReport -RestoreCategories chkAppx -RestoreScope CurrentUser
.\Restore-WindowsDefaults.ps1-NoGui -WhatIf -RestoreCategories chkAppx -RestoreScope AllUsers
.\Restore-WindowsDefaults.ps1-NoGui -WhatIf -RestoreCategories chkAppx -RestoreScope Provisioned
.\Restore-WindowsDefaults.ps1-NoGui -CapabilityReport -RestoreCategories chkAppx -RestoreScope OfflineImage -OfflineImagePath D:\MountedImage
.\Restore-WindowsDefaults.ps1-NoGui -RollbackLastRun
.\Restore-WindowsDefaults.ps1-NoGui -ResumeRestoreJournal
# Run a bounded restore tier or a targeted operational workflow
.\Restore-WindowsDefaults.ps1-RestoreTier Quick
.\Restore-WindowsDefaults.ps1-SecurityReset
.\Restore-WindowsDefaults.ps1-RebuildSearch
.\Restore-WindowsDefaults.ps1-NoGui -PostUpdateCheck
.\Restore-WindowsDefaults.ps1-ExportSupportBundle .\support.zip
# Schedule selected categories for the next boot
.\Restore-WindowsDefaults.ps1-ScheduleRestore -RestoreCategories chkDefender,chkWindowsUpdate,chkTasks -ScheduleExpiryHours 24
.\Restore-WindowsDefaults.ps1-NoGui -ScheduledRestoreStatus
.\Restore-WindowsDefaults.ps1-NoGui -CancelScheduledRestore
.\Restore-WindowsDefaults.ps1-NoGui -ResumeScheduledRestore-NoGui is intended for automation. The Intune and Configuration Manager wrappers under deploy\ emit JSON compliance results by default; add -Remediate to run the critical security and service/task categories in an already elevated management context.
AppX scope is selected with -RestoreScope CurrentUser|AllUsers|Provisioned|OfflineImage. CurrentUser observes online registration and is the only AppX mutation scope supported by the online executor. AllUsers observes registrations for existing users, Provisioned observes the online image, and OfflineImage observes a mounted image through -OfflineImagePath; those targets are explicitly read-only or unsupported in the online restore plan. Registry snapshots and plan operations likewise declare CurrentUser, Machine, AllUsers, or MachineAndUser hive scope.
Offline WIM/VHD servicing is plan-first and never reuses the online mutation path. Generate a reviewed plan without mounting, then choose one explicit lifecycle action:
.\Restore-WindowsDefaults.ps1-NoGui -OfflineImageFile .\install.wim -OfflineImageAction Plan -OfflineImageIndex 1-OfflineServicingPlanPath .\offline-plan.json
.\Restore-WindowsDefaults.ps1-NoGui -OfflineImageAction Commit -OfflineServicingPlanPath .\offline-plan.json
.\Restore-WindowsDefaults.ps1-NoGui -OfflineImageAction Discard -OfflineServicingPlanPath .\offline-plan.jsonThe plan validates the source lock, free scratch space, selected index, Windows edition/build family, host/image architecture, and DISM version. The bounded adapters observe provisioned AppX and offline tasks, enable only the catalogued default-enabled optional features, and can remove only the versioned machine-policy values when -OfflineResetPolicies is explicitly included in the plan. AppX/task restoration remains read-only without a trusted package or XML source. Failed servicing attempts discard the mount and retain the original source whenever DISM permits cleanup.
Scheduled restores are versioned, integrity-checked jobs with an owner, plan hash, rollback-journal reference, and configurable 1–168 hour expiry (24 hours by default). -ScheduledRestoreStatus reports stale or incomplete registration without replaying it; -CancelScheduledRestore removes the matching RunOnce value, job state, and prepared rollback journal. Resume consumes the job once and later resume calls return an idempotent result.
Support-bundle export returns a versioned JSON result rather than a bare path. The archive contains only metadata.json, health-summary.json, aggregate quick-scan.json, optional bounded events.log, redaction-report.json, and manifest.json. Raw registry values, rollback journals, task XML, command lines, identities, hostnames, profile paths, and arbitrary scan names are excluded or redacted; an existing requested filename is never overwritten.
Restore and remediation JSON includes a structured outcome for each executable operation: Changed, Skipped, Unsupported, Failed, or VerificationFailed, with native exit code, bounded stdout/stderr, and failure taxonomy where applicable. Registry, file, service, task, AppX, optional-feature, and environment-variable operations are checked with fresh postcondition reads after execution. Native commands and restore points are reported as NotObservable when no deterministic reader exists. -PostUpdateCheck performs an independent fresh verification pass and reports VerificationStatus, VerificationReport, and structured PendingRebootState; a pending reboot or partial verification is never hidden by a successful process exit.
The BaselineReport CLI emits the versioned registry, AppX, fingerprint, service/task, and scheduled-task catalogs with source provenance, supported build and edition ranges, confidence, and warning-only handling for unknown entries. No catalog entry with unknown provenance or unsupported scope is eligible for automatic fixes.
Capability reports and action plans include the management schema, detected ownership evidence, policy source, default decision, and ManagedPolicyOverride. Domain/MDM/organization-owned categories are OrganizationOwned and remain non-executable by default. -AllowManagedPolicy records OverrideRequested in the report, plan metadata, and category results; use it only when the operator has authority to replace the organization policy. dsregcmd signals are parsed only from recognized structured fields. Unavailable or unrecognized output is retained only as a warning-labeled fallback and never treated as proof of local ownership.
| Category | What it fixes |
|---|---|
| Windows Defender | Re-enables real-time protection, cloud protection, automatic updates |
| Windows Firewall | Restores all firewall profiles (Domain, Private, Public) |
| SmartScreen | Re-enables app, download, and Edge SmartScreen filters |
| UAC | Restores User Account Control to default settings |
| Windows Update | Removes update blocks, re-enables automatic updates |
| Category | What it fixes |
|---|---|
| Core Services | SysMain, Windows Search, BITS, Windows Update services |
| Scheduled Tasks | Disk cleanup, defrag, diagnostics, CEIP tasks |
| Error Reporting | Windows Error Reporting service and settings |
| Category | What it fixes |
|---|---|
| Telemetry | Restores diagnostic data settings to defaults |
| Cortana & Copilot | Re-enables Cortana, Copilot, and AI features |
| Activity History | Restores timeline and activity sync |
| Advertising ID | Restores default ad personalization settings |
| Category | What it fixes |
|---|---|
| Taskbar | Restores search box, widgets, Chat, Meet Now icons |
| Explorer | Restores ribbons, OneDrive, recent files, 3D Objects |
| Start Menu | Restores suggestions, recent apps, Bing search |
| Context Menus | Restores full right-click menus (removes Win11 compact) |
| Category | What it fixes |
|---|---|
| Microsoft Edge | Removes restrictive policies |
| Microsoft Office | Restores telemetry and macro security defaults |
| Windows Apps | Can reinstall removed Calculator, Photos, Store, etc. |
| OneDrive | Restores OneDrive integration and sync |
| Category | What it fixes |
|---|---|
| Network | Restores NetBIOS, LLMNR, network discovery |
| Bluetooth | Re-enables Bluetooth services |
| Remote Desktop | Restores RDP services |
| Power Settings | Re-enables hibernation, restores power defaults |
Removes domain blocks commonly added by privacy scripts (telemetry, update, and tracking domains).
| Mode | Description |
|---|---|
| Recommended Fix | Restores all safe defaults. Keeps your dark theme. Does NOT reinstall removed apps. |
| Fix Detected Only | Only fixes the specific issues found by the scanner. |
| Security Only | Only fixes Defender, Firewall, SmartScreen, Windows Update, and UAC. |
| Custom | Pick exactly which categories to restore from all 47 options. |
| Preview Only | Shows what would change without making any changes. |
If you used Debloat-Win11 v1.1.0 or a similar tool that generates an undo manifest (JSON file), you can import it:
- Click Import Manifest on the main screen
- Select the JSON manifest file
- The tool auto-checks only the categories relevant to the manifest changes
- A summary shows exactly how many AppX packages, services, tasks, and registry keys will be restored
- Click Run Selected Fixes to restore precisely what was changed
The import path is evidence-only and uses a versioned, bounded safe schema: privacy.sexy compensation logs, Chris Titus WinUtil diffs, .reg exports, and newer nested undo manifests are limited by bytes, lines, depth, and items; validated entries carry provenance and are classified as verified/untrusted evidence, while malformed or unsupported entries retain a reason. Imported text is never executed as code.
After restoration completes, click Export Report to save a detailed HTML report containing:
- Summary of fixed, partial, and failed categories
- Total changes made
- Full detailed log with color-coded entries
- Before/after states for all operations
- System Restore Point - Automatically created before changes (optional but recommended)
- Non-destructive - Only restores settings to Windows defaults, doesn't delete user data
- Detailed Logging - Complete log saved to Desktop with timestamps
- Preview Mode - See exactly what would change before committing
- Versioned action plans - Export scoped operations with before/after state, risk, rollback metadata, capability decisions, and a plan hash
- Integrity-checked rollback - Each restore run keeps an atomic journal under
%ProgramData%\Restore-WindowsDefaults\rollback; interrupted runs can resume, and tampered journals are refused before mutation - Graceful Errors - Continues through errors, reports them at the end
- Category Results - FIXED, PARTIAL, FAILED, SKIPPED indicators show exactly what happened
- Windows 10 or Windows 11
- Windows 10 build 10240 or newer, or Windows 11 build 22000 or newer
- x86, x64, or ARM64 Windows architecture
- PowerShell 5.1 (included with Windows)
- Administrator privileges
Before any restore, the tool records the product family, build, edition, architecture, locale, PowerShell runtime, elevation state, and structured management provenance. Unknown or unsupported profiles, and categories owned by organization policy, are skipped without mutation. Policy findings in health and post-update reports identify source, ownership evidence, confidence, and the actionable skip/override decision. Use -CapabilityReport or -PlanPath to export the machine profile and per-category gate decisions for automation.
Q: Will this undo my dark theme? A: No, the Recommended Fix specifically preserves your theme settings.
Q: Will this reinstall bloatware apps? A: Not by default. App reinstallation is a separate option in Custom mode.
Q: Is it safe to run? A: Yes. It only restores Windows defaults and creates a restore point first. You can always undo changes via System Restore.
Q: My antivirus flags this script. Is it malware? A: No. PowerShell scripts that modify system settings often trigger false positives. Review the source code yourself - it's fully readable.
Q: I ran a specific debloat script. Will this fix it? A: This tool fixes the effects of most common debloat scripts including Win10Debloater, privacy.sexy exports, Sophia Script, and manual registry tweaks.
This is a single self-contained PowerShell script. No build process required.
To contribute:
- Fork the repository
- Make your changes
- Test thoroughly on a VM
- Submit a pull request
MIT License - See LICENSE for details.
This tool modifies Windows system settings and registry values. While it's designed to be safe and creates restore points, always ensure you have backups of important data. Use at your own risk.
Made for IT professionals tired of fixing PCs broken by overzealous "optimization" scripts.