Microsoft now lets admins remove select provisioned in-box apps using straightforward policy on Windows 11 Enterprise or Windows 11 Education, version 25H2, which turns a Windows 11 debloat from guesswork into a checklist. That policy’s app list is the closest thing to an official answer on what is safe to strip, and it works as a yardstick on Home and Pro PCs too.
The safe order puts built-in tools ahead of scripts, with a restore point before either. Check that Windows can make one, because Microsoft says of System Protection that the feature is not enabled by default but is recommended. Every step below follows Microsoft Support and Microsoft Learn, every script claim comes from the project’s own repository, and the steps are current for Windows 11 version 25H2 as of October 2026.
Key Takeaways
- Microsoft documented the Policy-Based Removal of Pre-installed Microsoft Store Apps feature on August 15, 2025, for Windows Enterprise and Education editions.
- Microsoft’s Copilot removal policy acts only where Microsoft 365 Copilot and Microsoft Copilot are both installed, the user did not install the Copilot app, and the Microsoft Copilot app wasn’t launched in the last 28 days.
- Task Manager rates a startup app High impact when total CPU usage takes more than 1 second or total disk usage is more than 3 megabytes.
- WinUtil has 64,249 GitHub stars and Win11Debloat has 59,312, and neither count tells you what a script changes.
- Tiny11 Builder, with 20,441 GitHub stars, warns that Core cannot be updated or serviced.
What Is Safe to Remove: Microsoft’s Own List
Microsoft’s IT Pro Blog published the list behind its “Remove default Microsoft Store packages from the system” policy. In its words, the new policy is now available for devices running Windows 11 Enterprise, version 25H2 and Windows 11 Education, version 25H2. This policy is off by default, so you must explicitly enable it.
Windows ships two kinds of preinstalled app, and the difference matters for removal. Installed apps are installed as part of the OS, while provisioned apps are installed the first time you sign in with a new user account. System apps are installed in the system root directory and are part of the Windows OS, so leave those alone.
| App group | Apps Microsoft’s policy can remove |
|---|---|
| AI and communication | Microsoft 365 Copilot, Microsoft Copilot (consumer version), Microsoft Teams, Outlook for Windows |
| Media and creativity | Camera, Microsoft Clipchamp, Microsoft Photos, Paint, Sound Recorder, Windows Media Player |
| News, weather and games | Microsoft News, MSN Weather, Microsoft Solitaire Collection |
| Productivity tools | Calculator, Microsoft Sticky Notes, Microsoft To Do, Notepad, Snipping Tool |
| Xbox components | Xbox Gaming App, Xbox Identity Provider, Xbox Speech to Text Overlay, Xbox TCUI |
| Admin and support tools | Feedback Hub, Quick Assist, Windows Terminal |
Source: Microsoft Tech Community, Windows IT Pro Blog, 2025
The list names 25 apps, and the list will be updated as appropriate for future releases. Microsoft’s policy reference also marks some entries as default file handlers and warns: “Removing this app might result in a degraded user experience. We don’t recommend removing this app.”
Notepad, Paint, Calculator and Snipping Tool sit on the same list as Solitaire, so “removable” never means “useless”. Remove what you have replaced, and keep the small tools you still open.
What to Keep: The Components Windows 11 Needs
Microsoft Learn is blunt about the Microsoft Store: “In Windows, we don’t recommend removing or uninstalling the Microsoft Store app.” The same caution applies to the security app and to the runtimes other programs load.
| Keep this | Why, per Microsoft |
|---|---|
| Microsoft Store | The only Microsoft-supported way back is a reset or reinstall of Windows |
| Windows Security | Includes Microsoft Defender Antivirus, Windows Firewall and Smart App Control |
| Edge WebView2 Runtime | Included as part of the Windows 11 operating system |
| Visual C++ Redistributables | Many apps built with Microsoft Visual C++ require these libraries |
Source: Microsoft Learn, Microsoft Support, 2026
The Windows Security app is a comprehensive security solution integrated into Windows, and Microsoft Defender Antivirus continuously scans your device for potential threats. The Evergreen WebView2 Runtime will be included as part of the Windows 11 operating system, so apps built on WebView2 depend on it.
A Visual C++ Redistributable installs Microsoft C and C++ Runtime libraries, and many applications built by using Microsoft Visual C++ (MSVC) Build Tools require these libraries. Several old-looking Visual C++ entries in Installed apps are dependencies, not clutter. Leave device drivers and your PC maker’s support utility alone too, unless you know exactly what each one controls.
Can I uninstall the Microsoft Store?
You can, but Microsoft does not support uninstalling it. If you uninstalled Microsoft Store by any means and want to reinstall it, the only Microsoft-supported method is to reset or reinstall the operating system. There is no supported workaround to uninstall or reinstall Microsoft Store.
Step 1: Turn On System Protection and Create a Restore Point
System Protection is the Windows feature that makes restore points, and Microsoft Support says the feature is not enabled by default but is recommended. These restore points enable users to revert the system to a previous stable state without affecting personal data, which makes them the undo button for every step that follows. The setup takes 4 steps and only needs doing once.
Before you start: Sign in with an administrator account and back up your documents to an external drive or cloud storage. A restore point covers system files and settings, not your personal files.
- Select Start, type Create a restore point in the search box, and then select Create a restore point from the results.
- In the System Properties dialog box, under System Protection tab, select Configure.
- Select Turn on system protection, then use the slider to specify the maximum amount of disk space that can be used by System Protection, and select Apply.
- Back on the System Protection tab, select Create, specify a description for the restore point and select Create.
When a restore point is selected, System Restore reverts the system files, registry settings, and installed programs to the state they were in at the time the restore point was created. Name the point “before debloat” so it is easy to find later.
Step 2: Uninstall Apps from Settings, Windows Package Manager or PowerShell
Microsoft Support notes that there are different ways to remove apps and programs, and that some apps and programs are built into Windows and can’t be uninstalled. The 3 routes below differ in speed and in which apps they reach, so an app one route cannot remove may still come off through another.
From Start, Settings or Control Panel
- Select Start > Settings > Apps > Installed apps.
- Find the app you want to remove, select More > Uninstall.
- For a desktop program missing from that list, in search on the taskbar, enter Control Panel and select it from the results, then select Programs > Programs and Features.
- Press and hold (or right-click) on the program you want to remove and select Uninstall or Uninstall/Change.
The Start menu works too: select Start > All apps and search for the app in the list shown, then right-click it and choose Uninstall.
With the Windows Package Manager
The uninstall command of winget uninstalls the specified application, and requires that you specify the exact application name to uninstall. To avoid Microsoft Store agreement prompts when uninstalling, you can add the --source winget flag:
winget uninstall --name "App name" --source wingetThe --id option limits the uninstall to the ID of the application, which is the safer choice when two apps share a name.
With PowerShell Remove-AppxPackage
The Remove-AppxPackage cmdlet removes an app package from a user account, and an app package has an .msix or .appx file extension. Run PowerShell as administrator and remove one named package at a time:
Get-AppxPackage *Clipchamp* | Remove-AppxPackageThe AllUsers parameter removes the app package for all user accounts on the computer, and to use this parameter, you must run the command with administrator permissions.
New accounts get provisioned apps separately. Remove-AppxProvisionedPackage removes app packages from a Windows image, and the app packages will not be installed when new user accounts are created. Packages will not be removed from existing user accounts, so run both commands when you want an app gone for everyone:
Get-AppxProvisionedPackage -Online | Format-Table DisplayName, PackageName
Remove-AppxProvisionedPackage -Online -PackageName <PackageName>Never pipe every package into Remove-AppxPackage: A one-line command that removes all packages at once can take the Microsoft Store with it, and Microsoft supports no way to put the Store back short of a reset. Remove packages by name.
Step 3: Turn Off Startup Apps, Widgets, Copilot and Recall
Microsoft Support says the applications that run automatically when your device boots up can impact both the speed of your startup and the overall performance of your system. Task Manager rates each one, so start with the apps it scores as High impact; a WMI Provider Host stuck at high CPU is a separate problem with its own fix.
Startup Apps
- Select Start > Settings > Apps > Startup.
- Set the toggle to Off to prevent the app from starting automatically.
Impact rating | CPU time at startup | Disk use at startup |
|---|---|---|
Low | Less than 300 milliseconds | Less than 292 kilobytes |
Medium | 300 milliseconds to 1 second | 292 kilobytes to 3 megabytes |
High | More than 1 second | More than 3 megabytes |
Source: Microsoft Support, Configure Startup applications in Windows, 2026
A Low rating means total CPU usage takes less than 300 milliseconds and total disk usage is less than 292 kilobytes, so those apps cost little at boot. Trimming the High rows is the same lever behind speeding up an older Windows 10 PC, and Windows 11 rates startup apps the same way.
Widgets
Right-click on the taskbar and select Taskbar settings, then under Taskbar items, toggle the Widgets switch to Off. Even if you remove Widgets from the taskbar, you can still access the Widgets board by using the Windows key+W shortcut. To drop the news stream inside it, select the settings button on the navigation bar and, under Dashboards, toggle Discover to Off.
Copilot
The RemoveMicrosoftCopilotApp policy setting allows you to uninstall Microsoft Copilot from devices in a targeted way. It applies only when Microsoft 365 Copilot and Microsoft Copilot are both installed; the Microsoft Copilot app wasn’t installed by the user; the Microsoft Copilot app wasn’t launched in the last 28 days.
If this policy is enabled, the Microsoft Copilot app will be uninstalled. Users can still re-install if they choose to. On a personal PC, treat the Copilot app like any other entry you no longer use.
Recall
The Allow Recall to be enabled policy setting allows you to determine whether the Recall optional component is available for end users to enable on their device. If you disable this policy, the Recall component will be in disabled state and the bits for Recall will be removed from the device, and removing Recall requires a device restart.
Step 4: Use Group Policy on Enterprise and Education (Copilot Also on Pro)
On Enterprise and Education, Microsoft’s app-removal policy works through Group Policy, and apps are removed at the device level, not the user level. Edition decides access: the Remove Default Microsoft Store packages policy covers Enterprise, Education and IoT Enterprise editions, with Pro unchecked. On Pro, only the Copilot removal policy at the end of this step applies.
- Open the Group Policy Editor and navigate to Computer Configuration > Administrative Templates > Windows Components > App Package Deployment > Remove Default Microsoft Store apps.
- Select the apps for removal, then enable the policy.
- Log off and then log back in to the device.
On a supported edition, those 3 steps replace removal scripts for the apps on Microsoft’s list.
Once enabled, enforcement occurs automatically. A cleanup task deprovisions removed packages and local app data is removed from the user’s device. Devices that support multi-user sessions are not supported.
The Copilot switch reaches one edition further: this setting applies to Enterprise, Professional and Education client SKUs only. Home users rely on Settings, winget and PowerShell instead, which is one of the practical differences between Windows 11 editions worth knowing before you buy.
Open-Source Debloat Scripts and Their Real Risks
WinUtil, Win11Debloat and Tiny11 Builder each count their GitHub stars in the tens of thousands, and GitHub data shows WinUtil has 64,249 stars. Stars measure attention, though, and each project’s own README is the place to read what it changes.
View the data
Win11Debloat has 59,312 stars and Tiny11 Builder has 20,441, yet the three tools do very different jobs. Some change a running PC, and one builds a fresh installation image instead.
Is Win11Debloat safe?
It is open source and documents its options, but it does far more than remove apps. Win11Debloat is a lightweight, easy to use PowerShell script that can remove pre-installed apps, disable telemetry, remove intrusive interface elements and much more. Its README says: “Great care went into making sure this script does not unintentionally break any OS functionality, but use at your own risk!”
What Win11Debloat Changes
The riskier options sit in its feature list: Disable BitLocker automatic device encryption, Disable fast start-up to ensure a full shutdown and Prevent Windows from getting updates as soon as they’re available. On the upside, all of the changes made by Win11Debloat can easily be reverted and almost all of the apps can be reinstalled through the Microsoft Store.
Read every option before you apply it: Turning off automatic device encryption can leave a lost laptop’s drive readable, and delaying updates postpones security fixes. Leave both alone unless you have a specific reason to change them.
WinUtil
WinUtil is a curated compilation of Windows system tasks to streamline installs, debloat with tweaks, troubleshoot with config, and configure Windows updates. WinUtil must be run as Administrator because it performs system-wide changes. Its presets run from Minimal, minimal changes to suit every user, to Advanced, deep tweaks for power users.
Both READMEs offer a one-line command that downloads and runs the script in one go. Downloading the release, reading it, and then running it is slower and safer.
Tiny11 Builder
Tiny11 Builder builds a smaller Windows 11 ISO with a native WinUI app.
In its standard mode, Tiny11 removes bundled apps and unwanted features while keeping updates, Defender and recovery, while Tiny11 Core trims further by removing servicing and recovery support and disabling Defender. The README adds: “Core cannot be updated or serviced. Protected Custom removals can break Windows. Test your ISO in a VM before installing it.”
Is it safe to debloat Windows 11?
Yes, for app removal through Settings, winget or PowerShell with a restore point in place. The risk climbs with scripts that change encryption, updates or servicing, and peaks with an image that cannot be patched. Uninstalling the Microsoft Store app is not supported, and uninstalling it may cause unintended consequences, so that one app stays off every list.
How to Undo a Windows 11 Debloat
There are 3 ways back, depending on how much you removed. System Restore is the broadest, because with System Restore you can revert your PC’s state to a previous point in time. Press the Windows key + R, then type rstrui.exe and press Enter, and pick the restore point you made in Step 1.
If Windows no longer starts, reach the recovery menu through the routes in the Windows Startup Repair walkthrough; then, once in Windows RE, select Troubleshoot, choose Advanced options and then System Restore.
For a single app, reinstall it from the Microsoft Store. Policy removals take one more step: to reinstall an app removed by this policy, first clear the policy selection for the app. Then sync the policy and reinstall the app from the Microsoft Store or redeploy it using your management tool. The Store itself is the exception, since the only Microsoft-supported method is to reset or reinstall the operating system.
Conclusion
Microsoft now lets admins remove select provisioned in-box apps using straightforward policy on Windows 11 Enterprise or Windows 11 Education, version 25H2, and its list of 25 apps is the best map for any Windows 11 debloat. Switch on System Protection, remove apps by name through Settings, winget or PowerShell, and keep the Store, Windows Security and the runtimes.
Scripts save time for people who rebuild PCs often, but read the option list before you run one. The settings that matter most are the ones a debloat should never touch: encryption, updates and the ability to keep patching the system.
Leave a comment
Have something to say about this article? Add your comment and start the discussion.