Turn a stock Windows 11 install into a hardened, debloated, high-performance machine in under 60 seconds.
Windows 11 ships with hundreds of background services you never use, telemetry that phones home constantly, power settings tuned for laptops from 2015, and security features left at their weakest defaults. Microsoft optimizes for compatibility with 15-year-old hardware — not for the machine on your desk.
The result:
- Idle CPU usage of 5-15% from background telemetry, indexing, and diagnostics
- Network latency spikes from Nagle's algorithm, delayed ACK, and power-saving NIC states
- Disk I/O contention from 14 kernel trace loggers writing constantly
- Memory pressure from services you'll never use (Xbox, Biometrics, Fax, Retail Demo)
- Security gaps left open: NTLMv1 accepted, LSASS readable by any process, PowerShell v2 available for downgrade attacks, WPAD auto-discovery enabled, SMB signing optional
W11Hammer applies 101 audited, idempotent, and fully reversible transformations in a single run. Every registry write is verified after application. A comprehensive audit at the end confirms all 430+ values match their intended state.
| Category | Before (Stock Win11) | After (W11Hammer) |
|---|---|---|
| Background services | 80+ running | 28 disabled, rest manual-only |
| Telemetry endpoints | 28 Microsoft domains contacted | All blocked at hosts file + registry |
| Kernel trace loggers | 14 active, writing constantly | All disabled |
| CPU power state | Balanced, cores parked, C6/C7/C8 deep sleep | Ultimate Performance, all cores unparked, C-states limited |
| TCP stack | Nagle on, window scaling off, delayed ACK | Nagle off, CTCP, 4MB window, Fast Open, RSS, DCA, ECN |
| NTFS | 8.3 names tracked, last-access written per file | Both disabled, MFT zone optimized |
| GPU | HAGS off, shared IRQ, D3 idle transitions | HAGS on, MSI mode, D3 transitions zeroed |
| Memory | Compression on, page combining on, small pages | Compression off (16GB+), large pages, kernel locked in RAM |
| Security posture | NTLMv1 accepted, LSASS readable, PSv2 available, WPAD on, SMB signing optional | NTLMv2-only, LSASS PPL, PSv2 removed, WPAD blocked, SMB signing required |
These are conservative estimates based on Windows internals documentation and community benchmarking:
- Boot time: 15-30% faster (fewer services, no startup delay, boot trace disabled)
- Idle CPU: 1-3% instead of 5-15% (telemetry, ETW, and diagnostics eliminated)
- Network latency: 5-15ms reduction per new connection (Nagle off, Fast Open, CTCP)
- Disk I/O: ~40% reduction in background writes (ETW loggers, last-access, 8.3 tracking off)
- RAM freed: 200-800MB (disabled services, memory compression off on 16GB+)
- Frame time variance: reduced (MMCSS tuned, GPU D3 off, PCIe ASPM off, 0.5ms timer)
- Security: 12 CVE classes mitigated, 7 ASR behavior rules active, 0 credential extraction surfaces
irm https://raw.githubusercontent.com/W11Hammer/main/W11Hammer.ps1 | iex- Download
W11Hammer.exe(0.68 MB — single file, no installer) - Right-click → Run as Administrator
- Wait ~45 seconds
- Reboot
.\W11Hammer.ps1 -WhatIfDry-run mode logs every intended change without modifying anything. Review the log at C:\W11HammerLogs\ to see exactly what would change.
This is not a random collection of registry tweaks. Every change is:
- Idempotent — reads the current value before writing; skips if already correct. Safe to run daily.
- Audited — after all 101 sections complete, every single registry key is read back and compared against its intended value. The audit result is logged:
AuditPass=439 AuditFail=0 AuditMissing=0. - Reversible — all modified registry keys are exported to
.regfiles before writing. BCD is backed up. Restore commands are documented. - Hardware-aware — detects laptop vs desktop, RAM amount, and Windows build. Adjusts behavior: laptops keep hibernation and moderate power saving; low-RAM systems keep memory compression.
- No data loss — does not touch Documents, Pictures, Desktop, Downloads, browser bookmarks, or installed programs. Only clears temp file caches.
- Security-first — VBS/HVCI, Credential Guard, Spectre/Meltdown mitigations, certificate revocation, and SEHOP are all enabled, not disabled. Performance gains come from eliminating waste, not from weakening security.
# Restore a registry key from backup
reg import C:\W11HammerLogs\RegBackups_<timestamp>\<key>.reg
# Restore BCD
bcdedit /import C:\W11HammerLogs\RegBackups_<timestamp>\BCD_Backup_*.bcd
# Re-enable hibernation
powercfg /h on
# Re-enable a service
Set-Service <ServiceName> -StartupType Automatic- Disables 28 non-essential services (SysMain, DiagTrack, Xbox, Biometrics, Fax, Retail Demo, etc.)
- Tunes memory management (DisablePagingExecutive, LargeSystemCache, IoPageLockLimit)
- Optimizes NTFS (8.3 names off, last-access off, MFT zone=2, memory usage=max, USN journal capped)
- Sets visual effects to Best Performance, restores legacy context menu
- Activates Ultimate Performance power plan with aggressive CPU boost
- Disables core parking, limits C-states, disables power throttling
- Kills 14 ETW autologger kernel trace sessions
- Tunes desktop heap, kernel timer resolution, pool quotas
- Configures NIC driver settings (RSS, checksum offload, interrupt moderation, buffers)
- Enables HAGS, GPU MSI mode
- Removes Widgets, Copilot, Teams Chat auto-install, OneDrive startup
- Disables AppCompat shim engine
- Disables QoS packet scheduler bandwidth reserve
- Disables USB selective suspend
- Grants SeLockMemoryPrivilege for 2MB large pages
- Cleans phantom devices, salvages WMI repository
- Disables CompactOS decompression overhead
- Spreads IRQ affinity off core 0
- Disables memory compression (16GB+ only) and page combining
- Disables ReadyBoot and BootTrace on SSD/NVMe
- Sets foreground I/O priority to High, background indexers to Very Low
- Eliminates startup delay, enables multi-core CBS
- Tunes PnP thread pool, I/O foreground boost
- Caps event logs at 16MB
- Deploys persistent 0.5ms global timer resolution
- Isolates svchost services (no cross-service CPU contention)
- Configures CPU latency sensitivity, zeros GPU D3 transitions
- Disables Fault Tolerant Heap (hidden performance degradation)
- Caps USN journal at 32MB
- Tunes cache manager lazy writer and dirty page threshold
- Reduces telemetry to Security level (0), blocks CompatTelRunner via IFEO
- Enables VBS/HVCI with hardware acceleration, Credential Guard, System Guard
- Enables Spectre/Meltdown hardware mitigations (eIBRS+PCID, near-zero overhead)
- Preserves certificate revocation (CRL/OCSP) and SEHOP
- Disables NetBIOS, LLMNR, mDNS broadcast protocols
- Cleans orphaned firewall rules
- Disables SMBv1 entirely
- Permanently disables WaaSMedicSvc (prevents Windows Update from undoing changes)
- Enables KVAS with hardware PCID acceleration
- Enforces DMA Guard on all external ports
- Hardens LSASS (PPL, WDigest off, anonymous recon blocked)
- Forces NTLMv2 + 128-bit session security, refuses LM/NTLMv1
- Enables mandatory ASLR on all images, DEP AlwaysOn
- Disables Autorun/AutoPlay on all drive types
- Requires SMB signing on client and server, disables SMB compression
- Resets Driver Verifier if accidentally active
- Blocks LOLBins (mshta, wscript, cscript) via IFEO debugger redirect
- Removes PowerShell v2 (downgrade attack path closed)
- Enables PS5 Script Block Logging and Module Logging
- Hardens DLL search order (SafeDllSearchMode, CWDIllegalInDllSearch)
- Disables WebClient service (NTLM relay over WebDAV blocked)
- Disables Print Spooler if no printers detected (PrintNightmare surface eliminated)
- Fixes SAM/SECURITY/SYSTEM hive ACLs (HiveNightmare CVE-2021-36934)
- Enables 7 Defender ASR behavior-based rules (LSASS dump, WMI persistence, ransomware, BYOVD, USB, Office macros, JS/VBS download)
- Disables cached domain credentials, removes plaintext AutoAdminLogon passwords
- Audits and quotes unquoted service paths (privilege escalation hardening)
- Disables Windows Error Reporting crash collection
- Enables heap corruption termination, object namespace sanitization
- Blocks WPAD at registry + hosts file level (CVE-2016-3236)
- Disables Teredo/6to4/ISATAP IPv6 tunnels (CVE-2020-16898)
- Hardens WinRM (unencrypted off, Basic/Digest auth disabled)
- Hardens RDP (TLS required, NLA enforced, 128-bit encryption)
- Disables UPnP/SSDP (automatic firewall hole-punch blocked)
- Enforces Netlogon secure channel signing + encryption (CVE-2021-42278/42287)
- Hardens named pipe impersonation (token kidnapping surface reduced)
| W11Hammer | Manual Tweaking | Other Optimizers | "Debloater" Scripts | |
|---|---|---|---|---|
| Number of changes | 430+ verified | Depends on skill | 20-50 typical | 50-100 typical |
| Idempotent | Yes | Manual check | Rarely | Sometimes |
| Post-write audit | Yes (439 keys) | No | No | No |
| Registry backups | Automatic (.reg) | Manual | Sometimes | Rarely |
| BCD backup | Automatic | Manual | No | No |
| Dry-run mode | Yes (-WhatIf) | N/A | No | No |
| Laptop-aware | Yes | Manual | No | No |
| Security-first | Yes | Depends | Often disables security | Often disables security |
| Single EXE | Yes (0.68 MB) | N/A | Varies | Usually .ps1 only |
| Boot persistence | Yes (SYSTEM task) | Manual | No | No |
| Open source | MIT | N/A | Varies | Varies |
- Windows 11 build 22000+ (Windows 10 partially supported)
- SSD or NVMe system drive recommended
- Administrator privileges
- PowerShell 5.1+ (built into Windows 10/11)
After every run, find your results at:
C:\W11HammerLogs\
OptimizeWindows_<timestamp>.log # Full change log
RegWriteLog.json # Persistent audit database
RegBackups_<timestamp>\ # .reg backup files
BCD_Backup_<timestamp>.bcd # Boot configuration backup
The log ends with a verification summary:
Applied=74 Skipped=513 Errors=0 Verified=471/471 AuditPass=439 AuditFail=0 AuditMissing=0
Active development. Version 3.2.0 is the current stable release.
- v3.2.0 — Laptop-aware power management, -WhatIf dry-run mode, pre-flight system check, professional header documentation, 30+ bug fixes, comprehensive registry audit (439 keys verified)
- v3.1.0 — Registry write audit system, RegWriteLog.json persistence, QuickEdit console fix, idempotent netsh/bcdedit/powercfg commands
- v3.0.0 — 101 sections complete, boot persistence task, NVMe deep tuning, security hardening suite (LSASS/NTLM/ASLR/DEP/SMB)
MIT — free for personal and commercial use. No warranty. Always have backups (this script creates them automatically).
If Windows 11 was a car, Microsoft shipped it with the parking brake on, the trunk full of rocks, and the doors unlocked. W11Hammer takes the brake off, empties the trunk, and locks the doors — in 45 seconds.