WinUtil: Chris Titus Tech's Windows Debloat and Setup Tool (GitHub, Scanned)

WinUtil is a PowerShell utility with a graphical window that gathers the jobs people do on a fresh Windows install. It bulk-installs apps through winget or Chocolatey, turns off telemetry, activity history and consumer features, can remove OneDrive or Edge if you ask, applies common fixes and sets how Windows Update behaves. You paste one line into an admin terminal and choose what you want from its tabs.

It earns its place by being open about what it does. Every tweak is defined in the repository's config files, and the three presets (Standard, Minimal and Advanced) are listed in config/preset.json, so you can read the exact changes before applying them. Standard and Advanced create a restore point first. It is MIT-licensed, maintained by Chris Titus with 186 contributors, and has about 65,000 stars, at release 26.10.07 when scanned.

The honest limit is the nature of the job: these are system-wide changes made as Administrator. Some tweaks, such as removing Edge or disabling services, can break things other software expects, and the Minimal preset does not make a restore point. A faster .NET version is sold separately; the PowerShell script on GitHub is the free one.

• Repository: github.com/ChrisTitusTech/winutil
• Licence: MIT (MIT License)
• Language: PowerShell. Stars: 65K. Forks: 3,808. Last push: Oct 26, 2026.
• Scan: safe, Oct 26, 2026, commit 2f0bdc8

Who it is for

People setting up a new Windows PC who want it quieter and less cluttered, IT technicians repeating the same installs on many machines, and anyone who would otherwise work through a long debloat guide by hand.

Getting started

1. Open PowerShell or Terminal as Administrator and run the stable branch

irm https://christitus.com/win | iex

2. Or apply a preset (Standard, Minimal or Advanced) without clicking through the window

& ([ScriptBlock]::Create((irm https://christitus.com/win))) -Preset Standard

The one-liner downloads the script from christitus.com and runs it at once with admin rights. To see what a preset changes before you run it, read config/preset.json in the repository; each tweak is defined in config/tweaks.json. Have a backup or restore point before trying the Advanced tweaks.

Safety scan

We cloned ChrisTitusTech/winutil at commit 2f0bdc8 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets, no committed binaries and no bare-IP URLs across about 27,000 lines of PowerShell.
• The 3 pattern hits are PowerShell -EncodedCommand calls. Two, in scripts/start.ps1 at lines 201 and 217, relaunch WinUtil itself with admin rights; the encoded command is built from its own script path and your parameters by New-WinUtilElevationCommand, a normal way to carry arguments through a UAC prompt. The third is in a Pester test, pester/sanity.Tests.ps1.
• The 16 installer-style files are the app's own install engine and its tests: functions that set up winget and Chocolatey (from community.chocolatey.org) and install the programs you tick. None uses sudo-style tricks, pipes a download into a shell or edits a shell profile.
• 50 known advisories, none in the script you run. 41 are in tools/title-screen/uv.lock, a Python helper with an old Pillow that renders the README's title screenshot, and 9 in docs/package-lock.json, the documentation site. WinUtil itself has no package dependencies.
• 12 workflows. One uses pull_request_target (label-pr.yaml), and it only reads the pull request's description to add labels; it never checks out the submitted code. None of the 8 third-party actions is pinned to a commit. Security policy, Dependabot, contributing guide and code of conduct present.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: PowerShell 26.8K, Markdown 7,582, JSON 5,137, Python 1,166, YAML 1,145, CSS 491.

Questions

Is WinUtil free?

Yes. The PowerShell script is MIT-licensed and free. A faster .NET version is sold on the author's store and offered to recurring sponsors; you do not need it to use WinUtil.

Is WinUtil safe to run?

The scan found nothing hidden: what it runs is in the repository, readable PowerShell. The risk is in the changes you choose. Start with the Standard preset, which makes a restore point, read a tweak's definition before applying anything from Advanced, and only use the official one-liner or the GitHub release, since copies elsewhere could be altered.

Can I undo WinUtil's changes?

The restore point that Standard and Advanced create is the dependable way back. Some tweaks, such as removing Edge or OneDrive, mean reinstalling that software to reverse them.

Why does WinUtil need Administrator rights?

Its tweaks change system-wide settings, services and installed software, which Windows only allows from an elevated session. If you start it without admin rights, it relaunches itself through a UAC prompt.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.