WinUltix v3.14 — The "Zero-WMI" Engineering, Real-Time ETW & Performance Release

WinUltix v3.14 (formerly WinUltix Pro) is a major architectural hardening release focused on 100% Zero-WMI native execution, real-time Kernel ETW per-driver ISR/DPC profiling, sub-millisecond .NET / P/Invoke hardware and registry scanning, 100% locale-independent & 7-bit ASCII-pure operation, expanded 64-tool coverage, and full asynchronous Runspace responsiveness.

---

🚀 Highlights & New Capabilities

• Real-Time Kernel ETW Per-Driver (.sys) ISR & DPC Profiler (Hardware Tab):
  • Built-in lock-free native C# profiler ([WinUltix.DpcDriverProfiler]) inside the MSI & IRQ Affinity Enforcer that opens a private real-time EVENT_TRACE_SYSTEM_LOGGER_MODE kernel trace (EVENT_TRACE_FLAG_DPC | EVENT_TRACE_FLAG_INTERRUPT) using raw QPC timestamps.
  • Maps kernel routine instruction pointers (RIP across ETW opcodes 50, 66, 67, 68, 69) to loaded kernel drivers (SystemModuleInformation = 11) via $O(\log N)$ binary search and zero-allocation Interlocked counters.
  • Tracks Cumulative Session Average (Avg Load µs/s), Worst Single-Call Latency Spike (Max µs), and Live 1-Second Load (1s) with a 1-click [ Reset Stats ] button, multi-mode zero-jitter sorting, dynamic via tcpip.sys / via ndis.sys stack attribution, and optional [x] Show OS Kernel .sys visibility (exposing dxgkrnl.sys, Wdf01000.sys, ntoskrnl.exe, tcpip.sys, usbport.sys, ntfs.sys, iorate.sys, and ndis.sys directly alongside PCI hardware).
• Instant <1 ms Zero-WMI System & Hardware Fingerprint Banner (Main Log):
  • Every startup and exported .txt log now prints a 4-line hardware specification header (Write-UltixSystemBanner) queried in under 1 ms without WMI:
    • [SYS] OS: Exact Windows 10/11 edition, DisplayVersion (24H2/25H2/26H2), OS Build + UBR, and BIOS motherboard model (BaseBoardProduct).
    • [CPU] PRC: CPU name, physical/logical core count, detected topology profile (Intel Hybrid P+E, AMD 8C Single-CCD, AMD Dual-CCD X3D, Standard <6C - Lasso Off), and total L3 Cache (with per-CCD domain split on asymmetric X3D CPUs).
    • [RAM] MEM: Native C# kernel32!GetSystemFirmwareTable('RSMB') SMBIOS Type 17 parser reporting total capacity, DDR generation, active memory speed (MT/s), stick layout (2x 16 GB), occupied DIMM slots (2/4 Slots), multi-vendor SPD PartNumber CAS decoding, and automatic XMP/EXPO vs. JEDEC BIOS reset warnings.
    • [GPU] GFX: Active PCI GPU discovery via CfgMgr32, true 64-bit VRAM capacity (qwMemorySize), live negotiated PCIe Bus Link Speed & Width (PCIe 4.0 x16 / PCIe 5.0 x16), and WDDM-to-NVIDIA driver version translation.
• Live UI Font Scaling ([ A- ] / [ A+ ]) & Segoe UI Semibold Typography Engine:
  • Centralized typography engine ($global:UltixTypography & Get-UltixFont) rendered in crisp Segoe UI Semibold with live [ A- ] / [ A+ ] scaling buttons in the footer (-1.0 pt to +1.5 pt safety bounds, 0.5x proportional damping on compact 2-column controls, frozen 9.75 pt footer & 9.0 pt tab headers, and automatic persistence in HKCU:\Software\WinUltix).
• [ OPTIONAL ] (OptIn) Safety Architecture & WinGet Ecosystem Shield:
  • Rules that affect everyday peripherals, accounts, or package managers—such as Microphone/Webcam access, Toast Notifications, Print Spooler, Biometrics, Bluetooth, Xbox Live, Modern Standby S0, Remote Desktop, VBS/HVCI, USB Mass Storage blackout layers, and WinGet dependencies (DoSvc, edgeupdate, edgeupdatem, MicrosoftEdgeUpdate.exe)—are tagged as [ OPTIONAL ] (unchecked by default) so a default 1-click run never breaks daily workflows.
• 5-Button Live SCM Service Controller (System Services Manager):
  • Upgraded Show-ServicesGrid with 5 dedicated live action buttons (Start, Stop, Set Automatic, Set Manual, Set Disabled) backed by native advapi32!ChangeServiceConfigW / ControlService P/Invoke (SetServiceConfigLive / StopServiceLive with SYSTEM token impersonation). Clicking Start on a Disabled (Start=4) service automatically unlocks it to Manual (3) in both the registry and live SCM memory before starting.
• 2 New System First-Aid Tools (Integrity Tab):
  • Repair Time & NTP Clock Sync (w32time): Unlocks and re-registers W32Time, configures resilient pool.ntp.org / time.cloudflare.com peers, and forces an immediate clock resync to fix broken TLS, DoH, and Xbox Live authentication.
  • Repair UWP, Store, WinGet & Xbox Gaming Services: Automatically unlocks and starts AppXSvc, ClipSVC, StateRepository, InstallService, dosvc, and GamingServices, flushes WindowsStore cache (wsreset.exe -i), and re-registers existing Shell, Store, WinGet (DesktopAppInstaller), and Xbox AppxManifest.xml files without reinstalling removed bloatware.
• Live 1:1 Raw Mouse Input Reload (SPI_SETMOUSE): Zeroing out mouse acceleration curves in Tweaks now invokes user32!SystemParametersInfoW (SPI_SETMOUSE | SPIF_SENDCHANGE) to reload win32kfull.sys pointer tables instantly in real time without logging out.
• Expanded Service Profiles (12 Office / 60 Gaming) & Per-User Template Lockdown: Added GameInputSvc, dmwappushservice, InventorySvc, wercplsupport, pla, SCardSvr, and 5 Per-User background service templates (CDPUserSvc, OneSyncSvc, PimIndexMaintenanceSvc, UnistoreSvc, UserDataSvc) with automatic UserServiceFlags = 0 locking and live _LUID session termination.
• WPD / MTP Smartphone Protection in USB Perimeter Guard: Extended WriteProtect and TotalBlock layers to symmetrically enforce and revert Deny_Write / Deny_Read policies across both USB Mass Storage drives and MTP smartphones/portable devices.
• 8 Classic Win32 Admin Applets: Added direct 1-click launchers for Group Policy / RegEdit (gpedit.msc with automatic regedit.exe fallback on Home SKUs) and Computer Management (compmgmt.msc).

---

🧠 Core Engine & Main Launcher (Core_Helpers.ps1 & WinUltix.ps1)

• Single-Pass C# P/Invoke Consolidation & Pre-Compiled Host PE Fast-Path: Merged [WinUltix.UsbProberV2], [WinUltix.HubProbeResult], [WinUltix.SmbiosRamInfo], [WinUltix.DpcDriverProfiler], [WinUltix.DarkTabControl], and [WinUltix.DarkProgressBar] into Core_Helpers.ps1 with instant <0.3 ms Assembly::LoadFrom loading and high-resolution 256x256 bicubic splash screen rendering when launched via WinUltix.exe.
• Zero-WMI Native kernel32 & cfgmgr32 Queries: Added [WinUltix.NativeMethods]::GetTotalPhysicalMemoryKB() (GlobalMemoryStatusEx), [WinUltix.NativeMethods]::GetProcessExecutablePath(int pid) (OpenProcess + QueryFullProcessImageNameW), [WinUltix.NativeMethods]::IsVolumeDirty(string drive) (DeviceIoControl FSCTL_IS_VOLUME_DIRTY), [WinUltix.PnpTree]::IsDeviceDisabled(string instanceId) (CM_Get_DevNode_Status), and [WinUltix.PnpTree]::GetPcieLinkInfo(string instanceId) (CM_Get_DevNode_PropertyW DEVPKEY_PciDevice_*).
• 100% Locale-Independent Canonical INF Resolver & Ownership Helpers: Upgraded Format-UltixDeviceName to translate @driver.inf,%token%; prefixes into canonical English hardware names across all OS languages. Replaced localized takeown.exe /D Y calls with SID-based Grant-UltixDirectoryAdminAccess (icacls.exe *S-1-5-32-544) and added Unlock-UltixTrustedInstaller.
• Zero-WMI Multi-Profile Discovery (Get-UltixUserProfiles): Replaced Win32_UserProfile CIM enumeration with direct HKLM\...\ProfileList registry traversal (S-1-5-21-*) and live HKEY_USERS\<SID> hive detection with a pure Zero-WMI HKCU: fallback.
• Asynchronous & Full-Fidelity JSON Profile Engine: Moved Export-WinUltixProfile and Import-WinUltixProfile into background Runspaces (Invoke-AsyncTask) with re-entrancy progress preservation and thread-safe UI shims. Profiles preserve exact numerical Win32PrioritySeparation quantum values alongside Office (Light) services, 7-Point Power & Display settings, and 4-Layer USB Security Guard locks.

🧹 Deep Hygiene & Orphan Sweepers (Z1_Cleanup.ps1)

• Native .NET Registry Traversal (DriverStore, MSI/MSP, & Ghost Services): Replaced slow PowerShell provider loops across HKLM\SYSTEM\CurrentControlSet\Enum, Control\Class, Services, and Installer\UserData with direct [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey() calls and deterministic handle disposal, cutting scan times by up to 5x.
• Interactive JSON Backup & Restore in Registry Orphan Sweeper (Show-RegistryOrphanSweeper): Added SaveFileDialog and OpenFileDialog prompts so users can choose custom save and restore locations for registry orphan .json backups while maintaining an automatic emergency shadow copy in %LOCALAPPDATA%\WinUltix\RegOrphans_LastBackup.json.
• Zero-WMI Kernel Driver Enumeration & System32 Shield (Get-GhostServicesState): Replaced Win32_SystemDriver CIM queries with native [System.ServiceProcess.ServiceController]::GetDevices(), added OpenSubKey($svcName, $true) write-access filtering, shielded inbox System32/SysWOW64 OS binaries, and verified mounted volumes (DriveInfo.IsReady) so services on unplugged external drives are never flagged as ghosts.
• Locale-Hardened pnputil & App Paths Parsers: Hardened Get-DriverStoreOrphans_Worker to parse all regional date formats (MM/dd/yyyy, dd.MM.yyyy, yyyy-MM-dd) and upgraded Get-RegistryOrphans_Worker (App Paths) to strip quotes and CLI switches before verifying disk binaries.
• Smart Temp Deduplication, Modern Browser/GPU Cache Grouping & Clean TiWorker Release: Eliminated duplicate scanning of $env:TEMP, consolidated multi-folder Chromium (Network\Cache, Service Worker\CacheStorage) and NVIDIA `Per...

WinUltix v3.1

WinUltix v3.1.0 is a major engineering milestone. In this release, I expanded the toolkit with low-level CfgMgr32 + DeviceIoControl PCIe/USB topology and link-speed mapping, real-time kernel quantum scheduling, native DriverStore and Windows Installer (MSI/MSP) orphan sweepers, a 4-layer USB/BadUSB perimeter guard, and a complete reorganization of all 60 tools into a unified 7-tab, 4-color engineering interface.

---

🔥 Highlight New Features

1. USB XHCI Root-Hub Topology, Link-Speed & Contention Mapper (Hardware Tab)

Ever wondered which physical USB ports on your motherboard route directly to your CPU's SoC lanes and which ones are bottlenecked behind daisy-chained Chipset (PCH) PCIe bridges and onboard hub splitters?

• Instant Kernel Device-Tree Walk (<5 ms): Powered by a native P/Invoke cfgmgr32.dll walker ([WinUltix.PnpTree]) that maps every USBXHCI and USB4 controller back to the ACPI\PNP0A08 PCIe Root Complex and counts exact PCI-to-PCI bridge hops ([CPU DIRECT SoC LANES] vs [CHIPSET PCH] vs [SECONDARY BRIDGE]).
• Live Root-Hub Line & Link-Speed Probing ([WinUltix.UsbProberV2]): Sends low-level IOCTL_USB_GET_NODE_INFORMATION and IOCTL_USB_GET_NODE_CONNECTION_INFORMATION_EX_V2 queries directly to USBHUB3.sys to reveal how many logical lines each controller exposes (USB4 40 Gbps, USB 3.x SuperSpeed 5/10/20 Gbps, and USB 2.0 High-Speed 480 Mbps), which exact Port # or Hub Port # each device occupies, and its live negotiated link speed (12 Mbps FS, 480 Mbps HS, 5 Gbps SS, 10/20 Gbps SS+—including automatic [Throttled USB 3.x!] warnings when a SuperSpeed drive is plugged into a USB 2.0 port).
• True Silicon Names & Composite HID Filtering: Queries DEVPKEY_Device_BusReportedDeviceDesc directly from firmware descriptors and inspects primary USB HID Boot interfaces (&MI_00) so QMK/VIA keyboards and 4K/8KHz gaming mice never trigger false-positive virtual mouse/keyboard duplicates.
• Smart Onboard Hub/MCU De-Cluttering & Wiring Guide: Automatically separates passive motherboard port splitters ([ONBOARD HUBS], e.g., ASM107x, ASMT2307), static RGB controllers ([ONBOARD MCU], e.g., AURA LED), and unrouted internal AM5 SoC nodes (DEV_15B8) from active external peripherals, includes a live Show Raw USB Hub Nodes toggle, flags red [!] CONTENTION alerts when an 8KHz mouse shares an XHCI ring with an Isochronous Audio DAC or USB storage drive, and provides a built-in engineering wiring guide.

2. Live Quantum Scheduler Matrix — Win32PrioritySeparation Tuner (Hardware Tab)

• Real-time kernel scheduler tuner that decodes the active 6-bit binary mask (AA|BB|CC — Quantum Length, Variable/Fixed mode, Foreground Boost ratio).
• Switch between competitive presets (0x26 Short/Variable 3:1 Boost, 0x28 Short/Fixed 1:1 Deterministic, 0x2A Short/Fixed 3:1 Hybrid, 0x16 Long/Variable 3:1, and 0x02 Windows Factory) live without rebooting—allowing instant A/B frametime testing in games.

3. Native DriverStore (oemXX.inf) Orphan Sweeper (Cleanup Tab)

A fast, built-in replacement for DriverStore Explorer (RAPR):

• Scans C:\Windows\System32\DriverStore\FileRepository and cross-references pnputil.exe packages against HKLM:\SYSTEM\DriverDatabase\DriverPackages, active PnP device bindings across all system buses (PCI, USB, ROOT, SWD, HID), and DCH Extension / SoftwareComponent classes.
• Locks currently active hardware drivers in red ([ACTIVE - LOCKED]) while exposing gigabytes of superseded NVIDIA, AMD, Intel, and Realtek driver packages for safe 1-click removal.

4. Windows Installer (C:\Windows\Installer) Orphan Sweeper (Cleanup Tab)

A native replacement for PatchCleaner:

• Audits C:\Windows\Installer (.msi, .msp, and $PatchCache$\Managed) against registered UserData\<SID>\Products and Patches in the registry.
• Queries native WindowsInstaller.Installer COM SummaryInformation streams to reveal the real product name and vendor behind cryptic hex filenames (e.g., 1a4f8b.msp) and locks active uninstallers against accidental deletion.

5. Surgical Registry Orphan Sweeper with JSON Undo (Cleanup Tab)

Unlike legacy "registry cleaners" that recklessly nuke CLSID COM keys, I built a 100% path-verified scanner targeting 6 high-churn OS tables:

• Scans Firewall Rules, AppCompat Store & Layers, DirectX Per-App GPU Preferences, SharedDLLs, MSI Folder References, and App Paths for dead file paths left behind by uninstalled games and apps.
• Automatically shields unplugged external USB drives (via [System.IO.DriveInfo]::GetDrives()) so offline game drives are never flagged.
• Automatically saves a JSON backup (RegOrphans_LastBackup.json) before purging, with an always-available Restore Last Backup (JSON) button.

6. 4-Layer USB Storage & BadUSB Perimeter Guard (Security Tab)

Configurable, symmetrically revertible USB port lockdown:

• Layer 1 (Read-Only Guard): Blocks writing to USB drives (WriteProtect = 1 + GPO Deny_Write) to prevent data exfiltration or ransomware infection while allowing file reads.
• Layer 2 (Execution Guard): Blocks launching .exe payloads directly from removable storage (Deny_Execute = 1).
• Layer 3 (Total USB Storage Blackout): Disables both legacy USBSTOR (Bulk-Only) and modern UASPStor (USB Attached SCSI NVMe enclosures) kernel drivers.
• Layer 4 (Anti-BadUSB & DMA Lock-Screen Guard): Blocks new USB/PCIe/Thunderbolt device enumeration while the workstation screen is locked (Win+L).

---

🎨 Complete 7-Tab Architecture & 4-Color UI Overhaul

To eliminate clutter and group all 60 tools logically, I restructured the interface into 7 dedicated thematic tabs with a unified 4-color engineering palette (Matte Slate for standard actions, Steel Blue for interactive inspectors, Deep Crimson for aggressive/lockdown operations, and Neutral Gray for [?] audits):

1. Cleanup (9 Tools): Windows Update & CBS Cache, Temp/Prefetch/Dumps, 3rd-Party & GPU Shader Cache, Event Viewer Logs, DriverStore Orphan Sweeper, Windows Installer (MSI) Sweeper, Surgical Registry Orphan Sweeper, Ghost Services & Drivers Sweeper, and Hard Empty Recycle Bin.
2. Debloat (9 Tools): OneDrive Amputation, Aggressive Bloatware & Recall/AI Removal (64 targets), FOD Preset, Appx Framework Garbage Collector, CBS Capability Stubs + 4 Manual Sortable Grids (Appx User, Appx Base Image, Full FOD Capabilities, Optional Features).
3. Tweaks (7 Tools): Taskbar & Start Menu Tweaks, 1-Click Clean Start Menu (now also forces the Classic Alphabetical All-Apps List AllAppsViewMode=2 on Windows 11 25H2/26H2 and purges Recent Files), File Explorer & Win10 Context Menu, OS Annoyances (Modern Standby S0), 7-Point Power & Display Optimizer, 1:1 Raw Mouse Input, and Extreme Gaming Registry.
4. Services (6 Tools): Office Service Profile (Light), Gaming Service Profile (Heavy), Telemetry Scheduled Tasks Lockdown + 3 Interactive Managers (System Services Manager, Scheduled Tasks Inspector, Deep Startup Manager).
5. Security (11 Items): Privacy & UWP AppPrivacy (52 rules), Boot/SvcHost & UEFI WPBT Block, USB Storage & BadUSB Guard, Dual-Layer Execution Blocks (SRP + IFEO), Hardened DNS & Native DoH Enforcer (IPv4/IPv6), and 6 Classic Win32 Control Applets.
6. Integrity (7 Tools): System Scan (ChkDisk + DISM + SFC) with a new Fast <3s OS Health Audit [?], WinSxS /ResetBase Compression, WMI Repository Salvage, Windows Update & CryptSvc First-Aid, Network Stack Refresh, Print Spooler First-Aid, and Shell Icon/Thumbnail Cache Rebuild.
7. Hardware (11 Tools): New Pre-Flight Header + 2-Column Hardware Cockpit layout housing Affinity Lasso, CPPC Unhider + Dead Man's Switch, Pre-Flight Desktop Shortcut, Quantum Scheduler Matrix, MSI & IRQ Core 0 Offload Enforcer, 0.5ms Timer & TSC Fix, USB XHCI Topology Map, I/O & Memory Optimizer, Network NDIS & TCP Tuner, WHEA Overclocking Decoder, and the Live 1Hz Kernel DPC Monitor.

---

🐛 Windows 11 26H2 Combat Fixes & Under-the-Hood Improvements

• UCPD.sys Kernel Filter Bypass (Windows 11 24H2/25H2/26H2): Fixed Failed to modify key (Permissions/Lock) when disabling Taskbar Widgets by enforcing the new DisableWidgetsBoard=1 and DisableWidgetsOnLockScreen=1 policies alongside disarming the UCPD driver and UCPD velocity task.
• Unsigned REG_DWORD (0xFFFFFFFF) Audit Fix: Fixed NetworkThrottlingIndex always appearing as unoptimized due to .NET RegistryKey.GetValue() returning 0xFFFFFFFF as signed -1 (Int32). Invoke-RegistryAudit now converts negative DWord reads to unsigned UInt32.
• 100% Locale Independence (PL/EN/DE/FR/ES): Replaced localized text checks in DISM /CheckHealth, DISM /AnalyzeComponentStore, and fsutil dirty query with direct CBS registry corruption flags, positional table parsing, and Win32_LogicalDisk.VolumeDirty boolean queries.
• Power & Display Optimizer Refinement: Removed the counterproductive 100% Minimum Processor State rule from general power tweaks so modern AMD Zen / Intel CPUs retain full C-state residency and single-core boost headroom on the desktop.
• Logger False-Positive Color Fix: Refined Write-GUI regex lookarounds so legitimate service and task names containing "Windows Error Reporting" are no longer colored as [ERROR] lines.

3.0

🚀 WinUltix v3.0.0 — Major Architectural & Kernel Internals Release

Version 3.0.0 represents the largest low-level engineering overhaul in the history of WinUltix. I have unified all P/Invoke interop layers into a single core engine (Core_Helpers.ps1), migrated every heavy audit and execution workflow into real-time streamed background Runspaces ($UltixSync), replaced external Out-GridView windows with custom double-buffered dark WinForms grids, and introduced native kernel32.dll / ntdll.dll CPU topology and live DPC interrupt telemetry.

---

🧠 Core Engine & Architecture (Core_Helpers.ps1)

• Unified C# P/Invoke Runtime: Consolidated all native Win32/NT API calls into a single pre-compiled WinUltix namespace shared across the main UI thread and all background Runspaces:
  • [WinUltix.NativeMethods]: Native Win32 DWM Dark Title Bars (DWMWA_USE_IMMERSIVE_DARK_MODE = 20) across all forms and modals + High-DPI GDI scaling (SetProcessDpiAwarenessContext(-5)).
  • [WinUltix.ShellInterop]: Non-invasive shell and taskbar refresh via SHChangeNotify and SendMessageTimeout (WM_SETTINGCHANGE).
  • [WinUltix.PrivilegeEnabler]: Process token privilege escalation (SeTakeOwnershipPrivilege, SeRestorePrivilege) for modifying TrustedInstaller-protected registry keys.
  • [WinUltix.AppActivator]: Direct COM IApplicationActivationManager interop for deterministic Start Menu binary compilation.
  • [WinUltix.ListViewColumnSorter]: High-speed case-insensitive column sorting for WinForms ListView grids.
  • [WinUltix.CpuTopology]: Native kernel32.dll!GetLogicalProcessorInformationEx parser inspecting physical core masks, EfficiencyClass, and L3 Cache sizes.
  • [WinUltix.NtDll]: Native ntdll.dll!NtQueryTimerResolution, NtSetTimerResolution (live 0.5ms clock request), and NtQuerySystemInformation (SystemInterruptInformation 0x17) per-processor DPC telemetry.
• Real-Time $UltixSync Runspace Streaming (Invoke-AsyncTask): Pre-hydrates background Runspaces via InitialSessionState (Get-UltixUserProfiles, Get-UltixFastSize, Set-ProtectedServiceStart, Get-UltixPowerAcIndex) and injects a thread-safe $UltixSync context (ConcurrentQueue log streaming + live progress reporting polled every 150ms).
• Unified UI Factories & Protected Modals: Added New-UltixButton (with UseMnemonic = $false), New-UltixActionRow, Invoke-UltixAuditFlow, Enable-UltixDoubleBuffer, Show-ActionModal (with Select All, Deselect All, Select Detected, and live selection counter), and Show-UltixGridModal (live search filter, column sorting, state-preserving checkboxes, and IsLocked row protection for critical system services).
• JSON Profile Snapshot Engine (Export-WinUltixProfile / Import-WinUltixProfile): Exports and restores active Registry tweaks, custom SRP+IFEO rules, disabled Services, Telemetry Tasks, Affinity Lasso rosters, and Z7 Hardware Locks (WinUltix_Snapshot_v1).
• Zero-Bloat Custom GDI+ Dark UI ([WinUltix.DarkTabControl], [WinUltix.DarkProgressBar] & Color-Coded RichTextBox):
  • [WinUltix.DarkTabControl]: Eliminated legacy Win32 white 3D borders (TCM_ADJUSTRECT 0x1328 WndProc override) and gray tab strips in favor of an owner-drawn dark header with hover tracking and an active LightSkyBlue top accent bar.
  • [WinUltix.DarkProgressBar]: Replaced the glossy Vista-era green progress bar with a flat, double-buffered dark GDI+ status bar featuring a SteelBlue fill and a centered READY / 0%–100% readout.
  • Semantic Log Terminal (Write-GUI): Upgraded $global:infoBox to a syntax-highlighted RichTextBox that automatically color-codes timestamps (DarkGray), section headers (Cyan), [OK]/[+] completions (LightGreen), [!]/WARNING audit flags (Orange), and [ERROR]/[-] failures (IndianRed).

---

🧹 Module Z1: Deep System Cleanup (Z1_Cleanup.ps1)

• Core Engine Consolidation: Replaced local directory walkers and CIM boilerplate with shared Runspace intrinsics (Get-UltixFastSize, Get-UltixUserProfiles, Invoke-UltixAuditFlow, and New-UltixActionRow), cutting module code footprint by ~40%.
• Full Asynchronous Execution ($UltixSync): Migrated Invoke-InteractiveCleanup (wevtutil.exe cl channel loops, takeown.exe/icacls.exe SID *S-1-5-32-544 ACL overrides, and recursive Remove-Item passes) into an isolated background Runspace with real-time log and progress streaming.
• High-Speed .NET I/O Enumeration: Replaced slow Get-ChildItem -Recurse | Measure-Object pipelines with a stack-based [System.IO.Directory]::EnumerateFiles scanner that skips NTFS ReparsePoint junctions and survives UnauthorizedAccessException locks.
• Symmetrical Windows Update Service Hygiene: Added try/finally state preservation for wuauserv, bits, dosvc, and TrustedInstaller during SoftwareDistribution, DeliveryOptimization, and Logs\CBS purges—restarting only services that were actively running prior to cleanup.
• Expanded Multi-Profile Browser & Shader Coverage: Added multi-profile enumeration (Default and Profile *) for Chromium browsers (Chrome, Edge, Brave, Vivaldi) covering Cache, Code Cache, and GPUCache, alongside DirectX D3DSCache, global/per-user Windows Error Reporting (WER) queues, and CBS servicing logs.

---

🗑️ Module Z2: Bloatware, Recall & OneDrive Amputation (Z2_Bloatware.ps1)

• 100% Asynchronous Execution Pipeline: Moved all 5 heavy I/O and CBS servicing executors (Invoke-RemoveOneDrive, Invoke-RemoveCapabilities, Invoke-GarbageCollector, Invoke-RemoveBloatware, and Invoke-RemoveCapabilityStubs) off the UI thread into isolated Runspaces with live $UltixSync telemetry.
• Windows Recall & AI Lockdown (24H2 / 25H2 / 26H2): Added deep inspection and payload removal for the Recall Windows Optional Feature (Disable-WindowsOptionalFeature -Online -FeatureName "Recall" -Remove) alongside DisableAIDataAnalysis and TurnOffSavingSnapshots GPO enforcement.
• Granular 64-Item Bloatware Catalog: Unbundled grouped third-party casual games, social media clients, and OEM trialware suites into 64 individually selectable items (Spotify, TikTok, Netflix, Candy Crush, McAfee, Norton, Lenovo/Dell/HP stubs) with automatic AppxAllUserStore\Deprovisioned locking.
• Transitive Appx Garbage Collector Hardening: Implemented a transitive closure loop for Framework -> Framework dependency chains, added IsResourcePackage exclusions, and shielded Windows 11 24H2–26H2 shell components (MicrosoftWindows.Client.*, Windows.CBSPreview) across both installed and provisioned stores.
• Multi-Profile HKEY_USERS OneDrive Amputation: Extended OneDrive registry inspection and Run hook neutralization across all loaded Registry::HKEY_USERS\<SID> hives while evacuating locked FileSyncShell64.dll shell extensions to %TEMP%.

---

🛡️ Module Z3: Registry, Dual-Layer SRP+IFEO & Gaming (Z3_Registry.ps1)

• Handle-Cached Registry Audit Engine (Invoke-RegistryAudit): Implemented a per-run registry handle cache ($keyCache with deterministic .Dispose()) and direct .NET RegistryKey.GetValue() inspection. Accurately distinguishes uninitialized (Default) keys ($null) from initialized empty strings ("" required by InprocServer32 for the classic Win10 context menu) and supports MatchRegex evaluation.
• Scoped Dual-Layer SRP + IFEO Lockdown: Hardened Get-RegState_SRP to verify master Safer API switches (DefaultLevel = 262144, TransparentEnabled = 1). Upgraded Invoke-ApplySRP to enforce kernel UseFilter = 1 + FilterFullPath subkeys for custom .exe targets (preventing filename collisions across apps) while streaming background gpupdate.exe /force token refreshes via $UltixSync.
• Live Win32 Shell Broadcasts: Replaced blunt explorer.exe termination during Taskbar and Explorer tweaks with live SHChangeNotify and WM_SETTINGCHANGE broadcasts, restarting explorer.exe or SearchHost.exe strictly when flagged by RestartShell / RestartSearch.
• New Low-Level Kernel, Boot & Gaming Rules:
  • Added Boot: Disable Explorer Startup Delay (StartupDelayInMSec = 0 in Explorer\Serialize).
  • Added Kernel: Consolidate SvcHost Processes (SvcHostSplitThresholdInKB dynamically calculated from physical RAM capacity).
  • Added Gaming: Disable Multiplane Overlay (MPO) (OverlayTestMode = 5 in HKLM:\SOFTWARE\Microsoft\Windows\Dwm).
  • Added Gaming: Enable Windowed Game Optimizations (Flip Model) (non-destructive SwapEffectUpgradeEnable=1; injection/removal in DirectXUserGlobalSettings).
  • Migrated WNS App Push/Toast notification blocks (NoCloudApplicationNotification and NoToastApplicationNotification) to HKLM machine policies with clean DELETE_VALUE revert support.

---

⚙️ Module Z4: Services, Power/Display Tuner & Native Start Menu Compiler (Z4_Services.ps1)

• TrustedInstaller / SYSTEM Service DACL Escalation: Integrated Set-ProtectedServiceStart to dynamically enable SeTakeOwnershipPrivilege and SeRestorePrivilege tokens, allowing WinUltix to cleanly lock or revert ACL-protected services (WaaSMedicSvc, DoSvc, WSAIFabricSvc) without Access Denied exceptions.
• Interactive 8-Point Power & Display Optimizer (Get-PowerDisplayState & Invoke-ApplyPowerDisplay): Upgraded the Power & Display button into a full, symmetrically reversible interactive modal using Get-UltixPowerAcIndex. Audits and configures System Hibernation (hiberfil.sys), Standby/Sleep timeout, Monitor turn-off timeout (60 min AC), HDD/SATA AHCI spin-down (DISKIDLE), USB Selective Suspend (protecting DACs, VR headsets, and 4K/8KHz wireless dongles), Power Plan PCIe Link State Power Management (ASPM), 100% Minimum Processor AC state, and Display Content Adaptive...

2.7

WinUltix Pro v2.7.0 — Release Notes 🚀

The Windows 11 26H2 Compatibility, Multithreaded Runspace & Low-Level Hardware Overhaul

With v2.7.0, I conducted a comprehensive, three-stage engineering audit across the entire codebase (WinUltix_Pro.ps1, Core_Helpers.ps1, and modules Z1 through Z7) to prepare the toolkit for Windows 11 24H2, 25H2, and 26H2. This release completely eradicates legacy WMI/WMIC dependencies, centralizes background multithreading to eliminate UI freezes (ANR), introduces a native COM/MDM Start Menu compiler, and upgrades hardware topology detection.

---

🧠 Core Architecture & Multithreading (WinUltix_Pro.ps1 & Core_Helpers.ps1)

• Global Asynchronous Runspace Engine (Invoke-AsyncTask): I centralized all heavy background operations into a unified multithreading dispatcher powered by isolated PowerShell Runspaces ([powershell]::Create()) and a non-blocking 150ms WinForms polling timer ($timer.Tag state encapsulation). Controls are automatically locked (-ControlsToDisable) during execution and deterministically released in a finally block alongside .Dispose() calls, completely eliminating Application Not Responding (ANR) freezes and memory leaks.
• Complete WMI-to-CIM Migration: I removed all deprecated Get-WmiObject cmdlets and wmic.exe calls across the toolkit in favor of native Get-CimInstance and Invoke-CimMethod pipelines, guaranteeing 100% compatibility with Windows 11 26H2 where WMIC binaries are stripped from the OS image.
• GDI / HWND Resource Hardening: I wrapped the main WinForms application host, the About dialog, and Show-ActionModal inside try / finally blocks with explicit .Dispose() calls, enabled native visual styles (EnableVisualStyles()), and restricted global MouseLeave subscriptions strictly to Button controls.

---

📌 Start Menu Compiler & Services Engine (Z4_Services.ps1)

• Deterministic Start Menu Reset for 24H2–26H2 (Clear-StartMenu):
  • I replaced the static Base64 start2.bin binary replacement—which suffered from StartDocked.dll / StartTileData.dll serialization header changes and AppContainer DACL corruption on newer Windows 11 builds—with a One-Shot Native Policy Compiler.
  • I now disable ContentDeliveryManager placeholder tile injection, register a temporary MDM Enrollment (HKLM:\SOFTWARE\Microsoft\Enrollments\...) and ConfigureStartPins policy, purge CloudStore tile caches, and invoke StartMenuExperienceHost.exe in the background via COM IApplicationActivationManager (WinUltix.AppActivator).
  • Windows natively compiles a clean start2.bin containing only 3 essential pins (Microsoft Edge, Windows Settings, and File Explorer), records its byte signature (StartMenuClearedSize) for audit verification, and immediately strips all temporary MDM locks in the finally block so I can freely pin or unpin apps afterwards.
  • I also provision the Default user profile (LayoutModification.json) with the same clean 3-icon layout and purge default start*.bin* caches.
• Ghost Service & Driver Sweeper Refactor (Get-GhostServicesState): I fixed a greedy regex bug (^(.+?\.(?:exe|sys|dll))(?:$|\s)) that misidentified stopped svchost.exe/rundll32.exe services passing .dll arguments as missing binaries, integrated Win32_SystemDriver active kernel driver checks, and excluded internal NT Object Manager paths (\Driver\, \FileSystem\).
• Task Scheduler & Service Symmetry: I consolidated Get-TelemetryTasksState and Invoke-ApplyTasks into a single asynchronous Get-ScheduledTask query pass, corrected SCM service names (WerSvc, WaaSMedicSvc), and enforced full ExpectedStart / DefaultStart revert symmetry for Xbox and Camera services.

---

🧹 Bloatware Catalog, OneDrive DLL Evacuation & Cache Purge (Z1_Cleanup.ps1 & Z2_Bloatware.ps1)

• Redesigned 46-Category Bloatware Engine (Get-BloatwareState & Invoke-RemoveBloatware):
  • I structured a non-overlapping 46-item catalog covering modern Windows 11 24H2–26H2 bloatware (including Copilot, DevHome, New Outlook, MSTeams, Edge Game Assist, Clipchamp, Widgets, and Game Bar).
  • I removed the previous 10MB size cutoff blind spot: every detected package is now flagged for removal with accurate tags ([ X.X MB ], [ Installed Stub ], or [ Provisioned Image ]).
  • During removal, I enforce local GPO locks for Copilot (TurnOffWindowsCopilot = 1), write removed PackageFamilyName entries to HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned to block silent Windows Update reinstallations, and suppress benign 0x80070002 / 0x80070003 errors when -AllUsers removal already wiped the provisioned staging payload.
• SFC-Safe OneDrive Removal with Locked DLL Evacuation (Invoke-RemoveOneDrive):
  • I preserved dormant %SystemRoot% OneDrive binaries during uninstallation so sfc /scannow and DISM component verification remain 100% healthy.
  • To overcome explorer.exe locking memory-mapped shell extensions (such as FileSyncShell64.dll), I added an automated evacuation routine that moves locked .dll files to $env:TEMP\WinUltix_Locked_*.tmp, strips file attributes, and wipes residual OneDrive directories across all dynamically resolved Win32_UserProfile paths.
• Expanded Appx Garbage Collector Whitelist: I migrated all five Z2 scanners to Invoke-Z2ScannerAsync and hardened the dependency collector to protect XboxIdentityProvider, XboxGameCallableUI, PeopleExperienceHost, VCLibs, .NET, UI.Xaml, WinJS, Services.Store, WindowsAppRuntime, WindowsAppSDK, Graphics.Canvas, DirectX, AIFabric, and AugLoop.
• Service-Aware Cache Purge & Universal SIDs (Z1_Cleanup.ps1): I updated Invoke-InteractiveCleanup to stop wuauserv and bits before purging SoftwareDistribution\Download and replaced localized group names in icacls.exe with the universal Administrators SID (*S-1-5-32-544:F).

---

⚙️ Hardware Diagnostics, Multi-Architecture Affinity & CPPC (Z7_Hardware.ps1)

• Multi-Architecture Affinity Lasso (Get-CPUTopologyProfile):
  • I replaced the rigid 8-core check with dynamic CPU topology profiling:
    1. AMD 8-Core Single-CCD (e.g., 9800X3D, 7800X3D, 5800X3D): Isolates background apps to Cores 0–1 with SMT-aware bitmasks (0x0F for SMT ON, 0x03 for SMT OFF).
    2. AMD Dual-CCD (12C/16C, e.g., 7900X3D, 7950X3D, 9950X3D): Locks background apps to the last 4 threads on CCD1 ([int64]15 -shl ($logical - 4)), protecting 3D V-Cache on CCD0.
    3. Intel Hybrid (P+E Cores) & 6C+ CPUs: Isolates background processes to the last 4 logical threads (E-Cores) with BelowNormal priority.
  • I replaced per-process WMI path lookups with a single pre-cached Get-CimInstance Win32_Process hash table ($O(1)$ lookup) and fixed Remove-AppAffinity to restore full logical processor bitmasks (([int64]1 -shl $lpCount) - 1).
• SYSTEM-Level CPPC Dead Man's Switch & Locale-Independent Parser: I rewrote the powercfg.exe /qh hex parser to work across all OS display languages and upgraded WinUltix_CPPC_Failsafe to execute under NT AUTHORITY\SYSTEM (RunLevel Highest) with dual AtStartup and AtLogon triggers, guaranteeing power plan rollback from HKLM:\SOFTWARE\WinUltix\CPPC even after a pre-logon BSOD.
• Asynchronous WHEA XML Decoder & NDIS Optimizer: I upgraded Get-HardwareState_WHEA to extract APICId and ProcessorId directly from raw event XML trees ($evt.ToXml()) with SMT-aware core division, fixed variable shadowing ($adapterDispName vs. $propDispName) in Get-HardwareState_Network, and moved both scanners into Invoke-AsyncTask with explicit Scope 0 closure binding.
• Idempotent MSI Interrupt Backup: I hardened Show-MsiModal so repeated clicks on Force MSI Mode never overwrite the original factory interrupt state stored in HKCU:\Software\WinUltix\MSI_Backup.

---

🔒 Registry Engine, Dual-Layer SRP+IFEO & System Integrity (Z3_Registry.ps1, Z5_Utilities.ps1, Z6_Integrity.ps1)

• Dual-Layer Execution Locks (Get-RegState_SRP & Invoke-ApplySRP): To counter the deprecation of Safer API on Windows 11 26H2, I paired deterministic MD5-hashed Safer path rules (Get-DeterministicSrpGuid) with kernel-level Image File Execution Options (IFEO) debugger redirection (Debugger = "$env:SystemRoot\System32\systray.exe", WinUltixManaged = 1), updated Widgets.exe to use a version-agnostic WindowsApps wildcard, and offloaded gpupdate.exe /force to Invoke-AsyncTask.
• Symmetric Revert Engine Fixes (Z3_Registry.ps1): I updated Invoke-RegistryAudit to explicitly verify property existence before value comparison, switched all AppPrivacy UWP rules (including LetAppsAccessCamera and LetAppsAccessMicrophone set to Expected = 2) to use Default = "DELETE_VALUE" on revert (eliminating "Some settings are managed by your organization" banners), and added recursive parent CLSID cleanup ({86ca1aa0-34aa-4e8b-a509-50c905bae2a2}) when reverting the classic context menu.
• CBS RebootPending Protection & Async Subsystem Repairs (Z6_Integrity.ps1): I migrated Get-WinSxSState and Repair-PrintSubsystem to background Runspaces, added a pre-flight check for HKLM:\...\Component Based Servicing\RebootPending before Optimize-WinSXS (/ResetBase) to prevent 0x800f0806 (CBS_E_PENDING) errors, and fixed PowerShell 5.1 wildcard resolution when purging locked .SHD/.SPL print spooler files.
• Hardened Interactive Utilities (Z5_Utilities.ps1): I fixed CIM parameter binding in Set-CustomDNS (-Arguments @{ DNSServerSearchOrder = ... }), rewrote Show-StartupGrid to iterate directly over registry .Property names (removing PowerShell metadata clutter and adding WOW6432Node x86 support), shielded critical gaming/framework packages in ...

WinUltix Pro v2.5

Release: WinUltix Pro v2.5.0 - The Architecture & Hardware Update

This release marks the most significant evolution of WinUltix Pro. The toolkit has been completely re-architected from a monolithic script into a fully encapsulated, modular framework. I'm introduced a symmetric Revert Engine across all major system modifications and added a massive, dedicated Hardware & Diagnostics subsystem for low-level topology and interrupt tuning.

Script payload has increased from ~135KB to ~251KB, reflecting the scale of the new diagnostic engines.

🏗️ Architectural Changes
Modular Encapsulation: Core logic is now fully isolated into Z1 through Z7 modules, loaded dynamically by the main launcher.
Symmetric Revert Engine: Show-ActionModal now supports 2-way operations. Registry (Z3) and Service (Z4) tweaks can be symmetrically reverted back to Windows defaults without relying on external backups.
Asynchronous Execution: Z1 Cleanup now utilizes background Runspaces and WinForms timers to completely eliminate UI locking during heavy I/O file scans.

⚙️ New Features & Enhancements
Z7 Hardware Module (NEW): Low-level hardware control. Includes MSI Interrupt Enforcer (PCI bus IRQ mapping), CPPC P-State Unhider (EPP, Demote/Promote), and a WHEA logger with APIC ID decoding to pinpoint unstable CPU cores or RAM timings.
Affinity Lasso & Pre-Flight (Z7): Hard-lock background apps to specific cores. Generate a desktop macro-shortcut to instantly inject CPU restraints and force max CPPC states before launching a game.
Advanced NDIS & Timer Tuning (Z7): Enforce TCPNoDelay, disable PCIe ASPM/APST power states for NVMe stability, and inject GlobalTimerResolutionRequests to fix Win11 0.5ms TSC limits.
Aggressive Appx & CBS Purge (Z2): Added an intelligent Appx Garbage Collector for orphaned frameworks. Copilot removal now utilizes targeted GPOs and TrustedInstaller-bypassing binary amputation (takeown/icacls). CBS Capability Stubs can now be permanently ripped from the OS.
Software Restriction Policies (Z3): The legacy SRP engine now allows browsing and adding custom executables to the OS-level Safer API blacklist.
Subsystem Resets (Z6): Added dedicated utilities to flush the Winsock/DNS network stack and forcefully recover deadlocked Print Spooler / PrintWorkflow services by purging stuck RAW/SHD files.

🔧 Fixes & Refinements
Deprecated legacy WMI classes in favor of direct CIM instances and kernel-level registry hooks.
Redesigned interactive modals for better visibility of [ DETECTED ] vs [ OPTIMIZED ] system states.
Improved error handling and bypass mechanisms for Locked/Protected registry keys.

WinUltix Pro v2.1

WinUltix Pro v2.1 - The Interactive Architecture Update 🚀

Release Date: August 2026

I am really excited to share version 2.1 of WinUltix Pro. For this release, I decided to do a complete under-the-hood rewrite. My main goal was to move away from the typical "black box" optimization script and turn it into a fully interactive, diagnostic toolkit. I wanted to make sure you have absolute, granular control over every single tweak applied to your system.
🌟 Major Changes & New Features

Interactive Action Modals: Instead of applying changes blindly, clicking a tweak category now opens a dynamic checklist. You can precisely select or deselect specific registry keys, services, Appx packages and folders to clean before execution. 

Smart Live Detection: The tool now audits your live system state before acting. It intelligently tags elements as [ DETECTED ] (needs tweaking) or safely skips them as [ OPTIMIZED ] if they are already configured as intended.

Global Interactive Rescue Module: I've unified the backup systems into a single, global module on the main dashboard to act as a safety net. It scans your system for deviations and allows you to selectively revert specific registry changes and services back to Windows factory defaults.

Smarter Hardware Awareness: I updated the registry engine to natively recognize modern OS behaviors, such as hardware-level HAGS activation on high-end setups, which eliminates false-positive audit results.

Thorough Bloatware Cleanup: I expanded the Appx removal list using wildcards to better catch and safely remove stubborn consumer bloatware (Candy Crush, TikTok, etc.) and pre-installed OEM apps.

Still Lightweight & Portable: Despite the massive architectural upgrades, I managed to keep the entire toolkit (GUI, Audit, and Core engines) compiled into a single, zero-dependency executable (~240KB).

🛠️ Under the Hood

Split internal architecture into dedicated Optimizer_Audit (Dictionaries) and Optimizer_Core (Execution) logic to keep the code clean.

Focused on using safe, enterprise-grade MDM policies and standard service configurations rather than aggressive file-deletion hacks.

Improved UI scaling and anchored control layouts for a smoother desktop experience.

Enjoy a cleaner, faster, and fully transparent Windows 11 experience!

WinUltix Pro v1.0.0 - Initial Release

WinUltix Pro v1.0.0 - Initial Release

Welcome to the first official release of WinUltix Pro - Ultimate System Toolkit!

Tired of spending hours on tedious Windows configuration, clicking through the registry, and manually removing built-in garbage? WinUltix Pro is designed to save your time by automating extreme system optimization, telemetry removal, and performance tuning in one unified, easy-to-use interface.

🚀 Key Features in v1.0.0

• Deep System Cleanup: Clear Event Viewer logs, Windows Update cache, prefetch buffers, and perform a hard NTFS recycle bin flush.
• Bloatware Eradication: Aggressive removal of default Appx packages, sponsored apps, and unneeded System Features (FOD).
• Registry & Services Tuning: Apply specialized Office or Gaming background service profiles, disable task scheduler telemetry, and manage startup folders.
• Extreme Hardware Tweaks: Hard mouse acceleration disable (Raw Input), network latency reduction (TCP NoDelay), and power display optimization.
• System Integrity & Rescue: Built-in SFC/RestoreHealth scans, plus quick "Rescue Options" to safely revert restrictions and restore default Windows services if needed.

🔒 Security & VirusTotal (Important Note)

Please read regarding False Positives:
The WinUltix_Pro.exe file is a compiled PowerShell script that deeply modifies the operating system (registry, services, scheduled tasks, appx packages). Because of the packaging process and its system-level behavior, some heuristic/AI-based antivirus engines may flag it as a threat (e.g., MachineLearning/Anomalous). These are false positives.

• 🛡️ VirusTotal Scan: https://www.virustotal.com/gui/file/ca816660d447fd6c8e9392c9e44c813f97cffa6030c42cdf3af595e5ad1768a6
• 📜 Full Transparency: If you prefer not to run the compiled .exe file, there is included the raw WinUltix_Monolith_EN.ps1 script in the release assets. You can open it in any text editor, inspect the source code line by line, and run it directly via PowerShell.

📦 Installation

Download the assets below to get started. Run the .exe (or the .ps1 script) with Administrator privileges!