MSMG ToolKit

ShellExperienceHost and ImmersiveControlPanel are the two major ones you want to leave alone.

Here's the list in my loop function that I always remove:

MicrosoftEdge
PPIProjection
ContentDeliveryManager
contactsupport
ParentalControls
SecureAssessmentBrowser
XboxGameCallableUI
SecHealthUI
HolographicFirstRun
HoloShell
holoitemplayerapp
Holograms
holocamera

Most of these are also restricted across the registry, too, like XBox:

Add-Reg $SoftwareHive\Policies\Microsoft\Windows\GameDVR" /v "AllowGameDVR" /t REG_DWORD /d "0" /f | Out-Null -ErrorVariable +ProcessError
Add-Reg $CUserHive\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "AppCaptureEnabled" /t "REG_DWORD" /d "0" /f | Out-Null -ErrorVariable +ProcessError
Add-Reg $CUserHive\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "AudioCaptureEnabled" /t "REG_DWORD" /d "0" /f | Out-Null -ErrorVariable +ProcessError
Add-Reg $CUserHive\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "CursorCaptureEnabled" /t "REG_DWORD" /d "0" /f | Out-Null -ErrorVariable +ProcessError
Add-Reg $CUserHive\Software\Microsoft\GameBar" /v "UseNexusForGameBarEnabled" /t REG_DWORD /d "0" /f | Out-Null -ErrorVariable +ProcessError
Add-Reg $CUserHive\Software\Microsoft\GameBar" /v "AllowAutoGameMode" /t REG_DWORD /d "0" /f | Out-Null -ErrorVariable +ProcessError
Add-Reg $CUserHive\System\GameConfigStore" /v "GameDVR_Enabled" /t REG_DWORD /d "0" /f | Out-Null -ErrorVariable +ProcessError
Add-Reg $CUserHive\System\GameConfigStore" /v "GameDVR_FSEBehavior" /t REG_DWORD /d "2" /f | Out-Null -ErrorVariable +ProcessError
Add-Reg $CUserHive\System\GameConfigStore" /v "GameDVR_FSEBehaviorMode" /t REG_DWORD /d "2" /f | Out-Null -ErrorVariable +ProcessError

Though doing this is a bit redundant - it's primarily for aesthetics by showing all feature switches as "Off" as opposed to some "On" despite the feature being completely disabled.

Services I disable usually by modifying ControlSet001 since CurrentControlSet does not parse over until a Default User is created.

RS2 will also occasionally check file integrity but not nearly as often as RS3. And I had a hunch they were doing that but decided to write a PShell script for my server's WSUS server to audit all input/output of cumulative updates requested from it, while also logging the Tracerpt process and in short, certain updates check for directory structure (the word I should have used) if a System App is getting an update, no matter how small. It fluctuates depending on update. I've tested it quite a bit at that time and could completely remove Windows Defender using the actual DISM.API and have no ill-effects when it came to updating/servicing but removing ParentalControls rendered the Troubleshooter apps non-functional and no health servicing worked. Hence why keeping their files on the system while just keeping them completely dead to the system is the route most people who do not want to install Windows every 3-4 weeks prefer. App Provisioned Packages are completely isolated from the system itself, which is why you can remove those without any adverse effects safe Store Troubleshooter not working, but AppxProvisionedPackages can be re-registered and reinstalled with a simple PowerShell command. System Apps are not so lucky.

Furthermore, Windows Defender is utter junk and interacts negatively with any server-to-client security software, so getting rid of it is pretty much a requirement unless one is going to use Microsoft's Endpoint Protection.

Heh, I don't roll out machines really. I have images certain folks can request via MDT/SCCM and once they're requested and the system approves their request, it runs the scripts that do all this during the actual deployment process and not offline, per se. Really it's just easier to stumble across various things when you can VPN into a server and check logs and audit functions. But my server is certainly not a full deployment server - it's mainly used for shielded virtual environments and to maintain various public databases that are required to remain isolated from the physical system itself for security.

But really my intention was to offer a more viable route to the individual who was having issues with Defender/Security Health still being "around" despite having the packages for it removed. What we do with our images - and how we customize them - is up to us, anyways. Some of us are just more of the mindset of doing things properly while ensuring system functionality, and that goes with anything mechanical, electronic and the like.

 

Hi, It was always wrong when I used 7.7 tools to add win32 calc to 1511 Win10.
( Sorry, my english is poor ... )

 

You need to login to view this posts content.

 

I have another question.
If Win10 1511 removes the Xbox & Gamning component, the system installation will not be able to jump to the OOBE( translation from youdao.com ).

 

Is it less proper or less effective or not possible to cleanly disable the functionality of the apps in your "loop list" after installation?
It seems in my mind, that if you are retaining the packages intact on your system, then disabling them with a script or a registry edit after installation might further improve system stability
One reason I can think of is any future issue could be quickly resolved by temporarily or--worse case--permanently re-enabling a disabled package.

I provide a couple of third party options for disabling defender in my prior post:

 

However, It was okay when I used 7.6 tools to add win32 calc to 1511 Win10.

 

MSMG,
remove People button on the taskbar after remove People metro app.
thx

 

Hah! Don't give me too much credit here. The For/Do loop is just a tiny part of my script that deals with the keys for the corresponding System Applications I posted. It's definitely not a unique set of code I have, and I simply added the System Apps that are completely pointless + have ridiculous amounts of services attributed with them + serve zero purpose for 99% of people. The only App in that list I have omitted is PPIProjection and that's specific to laptops since even I use that to output my laptop's screen to wireless/blutooth/etc. monitors or flat-screen televisions.

Only reason I have not posted that part of the script in the scripting forum is, as I said before, if you muck up your offline registry hive then your actual install will be absolute rubbush. But now that I think about it, I'd rather people have a script to go to to do it automatically and properly than try to wing it and break something. A while back I was giving a person instructions (on another forum) on editing an offline registry hive and at the end he lost it and told me his system would not boot. Here he was doing the changes to his LIVE registry and not the godd*mn hives that were loaded. Ugh!

I'm not sure what you mean by "cleanly disable"? They are disabled entirely by removing the associate key that Windows uses to provision/install them because the system is never even made aware of the presence of said App. The services associated with System Apps are completely independent from the App itself.

And yes, you can remove everything in respect to a System App, including the App and all associated services/registry settings it interacts with using the DISM.API Using a wrapper like PowerShell that calls the DISM.API, you can allocate the full System App structures into what's called a "heap," insofar as mapping an entire image's content structure into a separate isolated directory. Basically that clones the WIM except it's a full allocated mapping of the WIM's contents which can then be deciphered by the script to verify all close/end points of whatever you want to remove. Then you call the DismOpenSession Function which basically traces the image's content structure as dictated by the script to make sure anything and everything associated with that App is removed, before finally calling the DismDelete function that proceeds with the removal process.

 

i dont know i made a tpk files