Winnow v4.4.4

[4.4.4] - 2026-10-17

Fixed

• The Tweaks tab showed its feature labels, tooltips and category headers in English whatever the selected language. The language was applied to the feature table at startup, but the tab was built from a fresh, untranslated read of Features.json, and the category headers never went through the translation lookup at all. In Spanish the tab now shows the translated labels (for example "Desactivar Microsoft Copilot") and category names. Combo group labels and the "No Change" option are not translated by any catalogue yet.

Winnow v4.4.3

[4.4.3] - 2026-10-17

Fixed

• In Spanish, the app selection window pushed the "Only show installed apps" checkbox off its left edge ("ar solo las aplicaciones instaladas"). The footer was a right-aligned row that overflowed to the left when the translated label was too long; it is now a grid where the label wraps in the free space. English renders exactly as before.

Winnow v4.4.2

[4.4.2] - 2026-10-17

Fixed

• The Spanish home screen cut off the Custom Setup button label ("Configuración personalizada"). The two home buttons had a fixed width inside a fixed-width card; they now share a two-column grid with a minimum width and the card a minimum width, so both grow to fit the longer label and stay equal. English renders exactly as before.

Winnow v4.4.1

[4.4.1] - 2026-10-17

Fixed

• Feature steps that run outside the registry import now count as failures when they fail, instead of the run finishing as "All changes have been applied successfully!" with exit code 0. This covers the telemetry scheduled tasks behind DisableTelemetry, the optional features behind EnableWindowsSandbox and EnableWindowsSubsystemForLinux, the start menu replacement (ClearStart, ReplaceStart and the all-users variants), and Microsoft Store search suggestions. A failed step is listed in the console summary, marked Error in the run summary (FeaturesApplied/FeaturesUndone and ErrorCount), counted in the GUI completion panel, and makes the run exit 1. It does not trigger rollback, the same as an app removal failure. A start menu file or Store database that could not be resolved for the user is now also a failure rather than a silent skip.
• A scheduled task lookup that failed for any reason (access denied, the ScheduledTasks module not loading) was reported as "task not found" and treated as fine. Only a genuinely missing task counts as done now.
• The start menu replacement and the Store search suggestion lock-down printed an error from a failed copy or ACL change and then reported success anyway.

Winnow v4.4.0

[4.4.0] - 2026-10-17

Added

• "Disable AI features in Google Chrome" (-DisableChromeAI, category AI) sets Chrome's enterprise policies to block Gemini, AI Mode and its content and tab sharing, third-party AI chat in AI Mode, Help Me Write, AI history search, Tab Compare, Create Themes, DevTools AI, Talk to type, generative Autofill (including Find and Fill with Gemini), Chrome suggestions, and on-device AI model downloads. Each value was checked against Chromium's policy definitions: the policy that controls Find and Fill with Gemini is AutofillGenAiSettings, not the FindAndFillWithGeminiSettings name the upstream version uses (no such policy exists). Some policies only take effect from Chrome 150 or 151. Undo removes the policies.

Fixed

• WinGet apps installed for a single user were never removed and were reported as failed. WinGet refuses to uninstall a user-scope package from an elevated context (0x8A15007D), and Winnow always runs elevated; the exit code was discarded, so the post-removal check just found the app still installed. Winnow now detects the refusal and schedules the uninstall to run at the next sign-in, in the user's own context: for the named or current user, or, for the default All users target, every existing profile plus the Default profile for accounts created later. Such apps are listed as deferred in the console summary, the run summary (AppRemoval.DeferredToNextSignIn) and the GUI completion panel instead of as failures. If scheduling fails for any profile the app is still reported as failed.
• "Disable AI features in Microsoft Edge" left the Copilot icon in the Edge toolbar on current Edge. It relied on HubsSidebarEnabled, but since Edge 141 the toolbar icon is controlled only by Microsoft365CopilotChatIconEnabled. The feature now also sets that policy to 0 (and its undo removes it). Like most of the feature's policies, it applies to work or school (Entra ID) Edge profiles.
• The download launcher (Get.ps1) rejected 19 parameters that Winnow.ps1 accepts, including -Preset, -DryRun, -Undo, -NoAutoRollback, -VerifyWatchdog, -EnableUpdateWatchdog, the extended modules (-EnablePerformanceTweaks, -EnableCompetitiveGaming and the rest) and the software/unattend options. The launcher only forwards what its own param block declares, and these were added to Winnow.ps1 without being mirrored. All are now forwarded, and a unit guard fails the build if the two param blocks ever disagree in name or type, or if a Winnow.ps1 parameter is neither a feature, a control parameter, nor a switch Winnow.ps1 handles itself (such a switch would be accepted and silently ignored).
• -Undo and -SoftwareList now accept a comma-separated list when Winnow is started with powershell.exe -File. Under -File, PowerShell binds -Undo DisableTelemetry,DisableCopilot to a [string[]] parameter as the single value DisableTelemetry,DisableCopilot, so -Undo rejected it as one unknown feature and exited, and -SoftwareList passed the joined text to winget as one package id. The README's own -Undo example failed this way. Both lists are now split on commas, trimmed, and empty entries dropped; separate values passed under -Command work as before.
• Applied-state reads compared binary (REG_BINARY) and multi-string (REG_MULTI_SZ) registry values as unordered sets, so a value holding the right elements in the wrong order counted as applied, and the GUI checkmark followed it. They now compare position by position.

Winnow v4.3.1

[4.3.1] - 2026-09-24

Fixed

• Undoing "Disable Store search suggestions" failed with access denied. The undo removes the Everyone deny rule the feature puts on each user's store.db and then deletes the file, but the rule check was a try statement inside plain parentheses, which Windows PowerShell parses as a call to a command named try. It failed on every undo, the deny rule stayed, and deleting the file was then refused, so the feature could not be reverted through Winnow. Covered by Test-StoreSearchSuggestions.ps1, which runs the disable and undo against a real file.
• Two new build checks scan every script Winnow loads: one fails if a PowerShell keyword is being invoked as a command, the other if any call resolves to neither a Winnow function, a cmdlet, nor one of the external programs Winnow deliberately runs. The second is what found the bug above; the codebase has no other call to a missing command.

Winnow v4.3.0

[4.3.0] - 2026-09-23

Added

• Extended AI purge now covers the AI features Microsoft added across the 24H2/25H2 cycle: Click to Do (DisableClickToDo), the agentic Settings search (DisableSettingsAgent), and the Paint AI features Cocreator, generative fill, and Image Creator (DisableCocreator, DisableGenerativeFill, DisableImageCreator under the Paint policy key). DisableAIDataAnalysis and DisableClickToDo are written in both HKLM and HKCU, matching their machine-and-user policy scope. The update watchdog re-asserts the two new machine-wide WindowsAI policies after an update. Registry paths and scopes are from the WindowsAI policy CSP. Not yet verified against a real 24H2/25H2 Copilot+ device; the values and rollback coverage are unit-tested.

Fixed

• Block feature version upgrades now pins to the release the device is actually on. The DisableFeatureUpdates reg file hard-coded TargetReleaseVersionInfo to 24H2, so on a 25H2 machine the pin named an older release than the one installed. The applied value is now written from the running DisplayVersion at apply time, and verification (and the GUI applied-state read) compare the pin against the current release instead of a fixed literal. Quality and security updates are unaffected, so this does not interfere with Known Issue Rollback, which rides on quality updates.
• DisableTelemetryServices failed on every apply. Its apply and undo functions live in TelemetryServices.ps1, which Winnow.ps1 never loaded, so selecting the feature (it is part of the privacy-max preset) ended in "command not found" and an automatic rollback, and -Undo DisableTelemetryServices failed the same way. The file is now loaded, and a unit test fails the build if any script under Scripts is not dot-sourced by Winnow.ps1 (the download launcher and the watchdog payload are excluded by design).
• The run summary was never written. ExportRunSummary.ps1 was not loaded either, so the Winnow_RunSummary_*.json report in %TEMP% never appeared. It is now written at the end of every real apply and not for a dry run. After a rollback it reports the requested features as RolledBack (or Unknown if the rollback itself failed) instead of Applied, and it now counts registry import failures.
• -VerifyWatchdog reported a healthy watchdog as not installed. The watchdog's scheduled task folder was written as \Winnow, but Get-ScheduledTask -TaskPath only matches the stored form \Winnow\, so the health check never found the task and always exited 2, and re-installing the watchdog never found the old task to replace. The task identity is now defined once, with the trailing backslash. The unit tests had mocked Get-ScheduledTask without a path filter, which is how this went unnoticed.
• The PowerShell registry writer no longer prints "The operation completed successfully" after it skipped writes that access restrictions blocked. It says how many settings were skipped and that they are not in effect. Skipping is unchanged: one protected key still does not fail the whole feature.

Testing

• The Windows Sandbox integration suite now runs end to end and passes, including the mutating rollback and watchdog tests that had never been run. Running it found the four fixes above. The suite's runner no longer overwrites the per-test results with a generic bootstrap error when a test fails, and the summary now lists failed setup blocks. The rollback contract tests inject a failure the backup phase can read but the apply cannot write (a key that denies subkey creation), restore the registry after each test so one test cannot skew the next, and match the product's current messages. New live tests cover re-installing the watchdog and the apply/undo round trip of a feature implemented in code.

Winnow v4.2.3

[4.2.3] - 2026-09-18

Added

• -RemoveDefenderGamingExclusions reverses -AddDefenderGamingExclusions. The gaming exclusions could be added but not removed through Winnow, which was out of step with the tool's reversibility. Both operations now share one path list (Get-DefenderGamingExclusionPaths) so they cannot drift, and the remove clears every path even if the game directory no longer exists.

Security

• Pass the winget package id to the software installer as a discrete argument instead of interpolating it into one command line. A crafted id containing a double quote could otherwise have injected extra winget flags. No caller feeds an untrusted id today (the list is the curated default or the user's own selection), so this is defense-in-depth that removes the injection surface. Covered by Test-SoftwareInstaller.ps1.

Winnow v4.2.2

[4.2.2] - 2026-09-18

Fixed

• Escape the embedded Winnow config path in the generated autounattend.xml. ComputerName and the local admin name were XML-escaped, but the config path was interpolated raw, so a legal path containing &, <, or > produced a malformed unattend file that Windows Setup silently rejects. All three user-supplied values are now escaped.

Winnow v4.2.1

[4.2.1] - 2026-09-18

Fixed

• The PowerShell registry writer (used to apply reg files into a mounted user hive under -Sysprep/-User, and as the fallback when reg import fails) now applies qword, hex(2) (REG_EXPAND_SZ), and hex(7) (REG_MULTI_SZ) values instead of throwing "Unsupported value type". The reg-file parser and the applied-state verifier already handled all three; only the writer was out of step, so a future reg file using one of those types would have failed to apply through that path.
• Unload the target user's registry hive reliably. When a -Sysprep or per-user run (apply, verification, or restore-to-another-user) read or wrote the mounted hive through the registry provider, lingering .NET RegistryKey handles kept the hive open, so reg unload failed and the code only warned while the hive stayed mounted, which can lock the profile. The unload now forces a garbage collection to release those handles and retries once, and only warns if it still cannot unload.

Added

• Mutating integration tests (Windows Sandbox only) for the two paths that were previously only unit-tested with mocks: Scope B module registry rollback (ModuleRegistryRollback.Tests.ps1, capture and restore against the real registry with type preservation) and the update watchdog (WatchdogEnforcement.Tests.ps1, real install, directory lockdown, integrity check, live policy re-assertion, and tamper detection). They run under -Mutating and are excluded from CI.