ms-private/README.md

# ms-private

**Make Windows yours.** A local Windows privacy toolkit for documented settings, app removal, browser choice, network controls, exact sensor selection, Recall, cleanup and session-lock actions. The release is one self-contained x64 executable with an elevation manifest and a graphical wizard. Its reviewable PowerShell engine is embedded in the executable; it never downloads and executes changing scripts from the web.

```text
  m s - p r i v a t e
  Make Windows yours.
  ----------------------------------------------------
  > Review plan
    Privacy profile       Strict
    Browsers              Zen
    Apps & debloat
    Microsoft app accounts Purge
    Windows updates       Keep
    Apply selected changes
    Restore policies
    Default browser settings
    Privacy guide
    Quit
  ----------------------------------------------------
  Arrows move   Enter select   Esc back
```

## Run

Download `ms-private-0.0.5.exe`, verify the adjacent SHA-256 file, then double-click the executable. Windows shows a UAC elevation prompt because the executable contains a `requireAdministrator` application manifest. Run it from the Windows account whose current-user apps and settings you intend to change; entering credentials for another administrator can target that account instead.

The executable contains the reviewed runtime and does not fetch code. It validates the embedded manifest and every SHA-256 before extracting to `%ProgramFiles%\ms-private\runtime\<version>-<payload hash>`, validates the installed copy on every launch, repairs modified or extra runtime files, removes older runtime versions, then opens the graphical wizard with Windows PowerShell 5.1. The executable is currently unsigned, so Windows may show an unknown-publisher warning.

Source and development runs remain available with 64-bit Windows PowerShell 5.1 or PowerShell 7:

```powershell
.\ms-private.ps1
# or the tabbed graphical wizard
.\ms-private-GUI.ps1
```

Move with **Up/Down**, select with **Enter**, toggle checkboxes with **Space**, return with **Esc**. **Page Up/Down** scroll long lists. Type to filter applications; Backspace erases the filter. The highlighted item's explanation appears below the list. Choices stay in memory until you apply them.

Launching the menu changes nothing. Review the plan, then select **Apply selected changes**. The final confirmation defaults to going back.

## Automatic presets

Both interfaces use the validated catalog in [presets.json](config/presets.json). At startup, ms-private recommends Fresh Install only when both Windows and the current user profile are no more than seven days old. Older, inconsistent or unreadable timestamps select Established PC. Choosing any preset fills every related control; **Review plan** enumerates the exact policy, application and device targets before one final Apply approval.

| Preset | Automatic behavior |
| --- | --- |
| Established PC | Conservative default for an older installation. Applies Standard privacy policy only. Keeps every app, browser, account, service, device, Recall item and file; networking and update settings remain unchanged. |
| Fresh Install | Complete initial setup: Strict policies/services, account purge, Recall removal, reviewed endpoint blocking, cleanup/schedule/lock handling, Mullvad/VeraCrypt, Zen/Tor, detected sensors and every unambiguously removable app including Store, Edge and OneDrive. |
| Gentle | Standard policy and curated promotional-app removal. Keeps personal apps, Store, Edge, OneDrive, accounts, sensors and networking. |
| Medium | Strict policies and services, Microsoft app-account purge, Recall deletion/feature removal, optional-endpoint blocking, cleanup/schedule/lock handling, Mullvad and VeraCrypt installation, and every unambiguously removable Microsoft or third-party app including Store, Edge and OneDrive. |
| Strong | Medium plus Tor Browser and automatic camera, microphone and sensor selection. This can disable Windows Hello and conferencing hardware. |
| Maximum | Strong plus Zen, Helium and Tor and timed default-outbound isolation. Keeping isolation blocks ordinary connectivity, including online updates, until suitable allow rules are created or isolation is restored. |

Fresh Install, Medium and stronger presets use exact installed identities. They do not issue wildcard package deletion commands. WebView2, drivers, firmware, runtimes, servicing components, Defender/security products, authentication components, chosen browsers, Mullvad, VeraCrypt and recovery infrastructure stay protected. Store removal is current-user scope and can require an official recovery or Windows repair path to reinstall.

### Source ZIP / repeated security prompts

Review the download first. In the ZIP's Properties, select **Unblock** before extracting. If already extracted, run the following **from this reviewed project folder**:

```powershell
Get-ChildItem -LiteralPath . -Recurse -File | Where-Object { $_.Extension -in '.ps1', '.psm1' } | Unblock-File; Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned -Force; .\ms-private-GUI.ps1
```

That line unblocks PowerShell files inside the current reviewed directory, changes policy only for the current PowerShell process, and starts the GUI. It does not fetch code. You do not need `Unrestricted`, a permanent execution-policy change or a download-and-execute command. Organization policies may override process policy; ms-private does not bypass those policies. Releases are currently unsigned. See Microsoft's [Unblock-File](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file) and [execution policy](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies) documentation.

## Defaults

| Choice | Default / behavior |
| --- | --- |
| Preset | Automatically Fresh Install only when Windows and the current profile are at most seven days old; otherwise Established PC. Manual selection remains available. |
| Privacy | Standard in Established PC and Gentle; Strict in Fresh Install, Medium, Strong and Maximum. |
| Microsoft app accounts | Kept in Established PC and Gentle; purged in Fresh Install, Medium and stronger. |
| Updates | Keep existing settings. Automatic, Notify and Manual are selectable. No update services are removed. |
| Browsers | Zen selected; choose Zen, Helium, Tor Browser or any combination. All selected browsers are checked before removals begin. |
| Bundled apps | Curated promotional/consumer packages selected for removal; review [the exact catalog](config/debloat.json). |
| Personal apps | Kept in Established PC and Gentle; every unambiguously removable app is selected in Fresh Install, Medium and stronger. |
| OneDrive | Kept in Established PC and Gentle and selected in Fresh Install, Medium and stronger. Cloud-only files remain online; ms-private does not delete sync folders. |
| Edge | Kept in Established PC and Gentle and selected in Fresh Install, Medium and stronger after replacement-browser verification. Windows may refuse removal. WebView2 is preserved. |

App identity cannot reliably distinguish a preinstalled Spotify/Outlook package from the same app installed manually. Uncheck any catalogued apps you want to retain. Unknown OEM apps are opt-in. ms-private protects OS-marked components and known drivers, runtimes, security tools and dependencies; the name-based list cannot identify every third-party dependency.

Appx removal affects the current user. Provisioned packages and other users' Appx registrations are left alone. Desktop uninstallers follow their displayed user/machine registration scope. Uninstallers can remove app settings and data: policy recovery journals are **not app backups**.

Windows restrictions on Edge are respected. There is no forced system-file removal or region-policy editing. If removal is refused, the run stops with an incomplete report; keep Edge in the next plan to continue. Set the replacement default in Windows Settings.

## Command line

```powershell
# Policy-only audit, preview, apply and recovery
.\ms-private.ps1 -Mode Audit -Profile Strict -Json
.\ms-private.ps1 -Mode Plan -Profile Strict -Updates Notify
.\ms-private.ps1 -Mode Apply -Profile Strict -WhatIf
.\ms-private.ps1 -Mode Apply -Profile Strict
.\ms-private.ps1 -Mode Restore -Journal 'C:\path\to\saved.journal.json'

# Strict service controls: Connected Devices/CDP, cloud sync/backup, diagnostics, location and WER
.\Services.ps1 -Mode Plan -Profile Strict
.\Services.ps1 -Mode Apply -Profile Strict
.\Services.ps1 -Mode Restore -Journal 'C:\path\to\service-journal.json'

# Current-user Microsoft app-account audit and irreversible sign-out
.\Accounts.ps1 -Mode Plan -Scope AllAppAccounts
.\Accounts.ps1 -Mode Apply -Scope AllAppAccounts -AcknowledgeAccountDataDeletion -WhatIf
.\Accounts.ps1 -Mode Apply -Scope AllAppAccounts -AcknowledgeAccountDataDeletion

# App plan, available IDs, and an explicit apply
.\Manage-Apps.ps1 -Mode Plan -Browser Zen,Helium,Tor
.\Manage-Apps.ps1 -Mode List -Json
.\Manage-Apps.ps1 -Mode Apply -Browser Zen,Helium -WhatIf
.\Manage-Apps.ps1 -Mode Apply -Browser Zen,Helium

# Keep groups or individual apps; use exact IDs returned by List
.\Manage-Apps.ps1 -SkipBundled -KeepOneDrive -KeepEdge
.\Manage-Apps.ps1 -ExtraId 'exact-listed-id' -ExcludeId 'another-listed-id'

# Aggressive exact-inventory preview used by Fresh Install, Medium and stronger presets
.\Manage-Apps.ps1 -Mode Plan -RemovePersonal -RemoveStore -Browser Zen

# Plan or apply one complete preset from the command line
.\Preset.ps1 -Mode Plan -Preset Auto
.\Preset.ps1 -Mode Plan -Preset FreshInstall
.\Preset.ps1 -Mode Apply -Preset FreshInstall -AcknowledgeDestructivePreset

# Optional VPN / encryption software; installation does not configure it
.\Install-Apps.ps1 -App Mullvad,VeraCrypt -WhatIf

# Narrow network preview, timed isolation and local capture
.\Network.ps1 -Mode Plan -Profile BlockOptionalTelemetry
.\Network.ps1 -Mode Apply -Profile Isolate -RollbackMinutes 10
.\Network.ps1 -Mode Validate -Json
.\Network.ps1 -Mode Confirm -Journal 'C:\path\to\network.json'
.\Network.ps1 -Mode CaptureStart

# Exact hardware, Recall, safe cleanup and session-lock handling
.\Hardware.ps1 -Mode List
.\Hardware.ps1 -Mode Plan -InstanceId 'exact PnP instance id'
.\Recall.ps1 -Mode Plan -RemoveFeature
.\Cleanup.ps1 -Mode Plan -AgeDays 7 -Category Temp
.\Cleanup.ps1 -Mode Plan -AgeDays 0 -Category CrashReports,RecentItems,ThumbnailCache,BrowserCache,PowerShellHistory
.\Security.ps1 -Json
.\Lock.ps1 -Mode Install -VeraCryptVolume X:
```

WinGet must be installed and its `winget` source usable. ms-private retains normal installer prompts, signature/hash checks and license requirements. It does not silently accept source agreements. If WinGet requires source initialization, open `winget list --source winget` yourself, review its prompts and retry. WinGet and installers make network requests and may keep their own logs.

## Support and recovery

- Policy apply/restore: Windows 11 Pro/Enterprise/Education families, builds 26100/26200. On Home, seven Microsoft-documented direct registry controls remain available; managed-edition CSP policies are explicitly skipped and linked to the manual guide. Unreviewed builds remain audit-only.
- App operations: build gate 19045/22631/26100/26200. Windows 10 requires an appropriately supported servicing arrangement. Build gating is not proof of successful live testing.
- Domain/MDM-managed devices and non-elevated changes are refused. Use an administrator-managed deployment for those devices.
- Policy changes save original values before writing and roll back failures. Restoration preserves later conflicting edits. Restore newer journals before older ones.
- App operations save intent and per-app outcomes. They stop on ambiguous state, errors, reboot-required results or unsuccessful readback. Earlier successful removals remain removed.
- Account purge is irreversible. It records only catalog IDs and outcomes, never account names, emails, credential targets or secrets. It does not remove the current Windows logon identity or an existing organizational registration.
- Complete presets execute each selected mutation area as a recorded group. A failed group is reported and does not prevent unrelated groups from running; only groups with a failed prerequisite are skipped. Each run writes a summary below `%LOCALAPPDATA%\MsPrivate\runs`, while component recovery journals remain authoritative for restoration.
- Reports and journals stay under `%LOCALAPPDATA%\MsPrivate`. ms-private has no analytics or automatic report uploads. Do not publish local reports: installed-app information can be personal.

Switching Strict to Standard permits clipboard history again and changes DO mode back to 0. It does not restore deleted history. `Updates Keep` retains the current setting, including changes made by an earlier run.

## Advanced controls

`Network.ps1` has three distinct modes. **Observe** changes nothing. **BlockOptionalTelemetry** creates dynamic-FQDN outbound block rules only for the reviewed catalog in [network.json](config/network.json). **Isolate** sets the default outbound action to Block for all firewall profiles and schedules a local SYSTEM rollback before changing them. Confirm an isolation journal only after local recovery and required connectivity checks succeed. Existing explicit allow rules can still pass traffic, and a firewall configuration is not proof of zero telemetry.

Packet captures use the built-in Pktmon tool, remain under `%LOCALAPPDATA%\MsPrivate\network`, and are converted to PCAPNG only when stopped explicitly. Captures may contain private addresses and DNS names. ms-private does not install a TLS interception certificate.

Recall apply requires `-AcknowledgeSnapshotDeletion`. The supported policy deletes existing snapshots; restoring the prior setting cannot recover them. Hardware controls act only on exact selected PnP instance IDs and select nothing by default.

Cleanup uses named, allowlisted categories. It can remove old Temp files, WER queues and crash dumps, Recent Items and Jump Lists, unlocked thumbnail caches, Zen/Tor/Helium cache subdirectories, PowerShell interactive history, selected expired ms-private reports, and the current clipboard. Browser-cache cleanup retains cookies, passwords, bookmarks, sessions and settings. It skips reparse points, changed files and locked files. It excludes Documents, Downloads, non-cache browser profile data, credential stores, ms-private recovery journals, Windows event logs, Defender logs, update logs and authentication logs. Deletion reduces local retention but does not erase provider records or guarantee physical erasure on SSDs.

The lock handler clears the current clipboard and can gracefully unmount selected VeraCrypt drive letters; it does not claim to wipe RAM. `Security.ps1` audits BitLocker/device-encryption status, Defender and cloud-protection posture, firewall profiles, Secure Boot, TPM, VBS/Credential Guard, LSA protection, UAC, SMB/SMB1, remote access and protected update/security services without reading recovery keys, account names, Defender exclusions or secrets.

Windows Home uses `Home.ps1` and the wizard's Home tab to open supported Settings pages. ms-private does not automate localized clicks or claim a visible toggle changed without user verification.

## Privacy boundaries

ms-private now applies 56 reviewed privacy policies, optionally disables eight privacy-related service templates, can purge current-user Microsoft application sign-ins, cleans the named privacy-bearing artifacts above and audits encryption and security status. Strict is the default in both wizards. The expanded policy catalog covers user-scoped personalization and input collection, Widgets, search highlights/location, device metadata, downloadable fonts, MSRT reporting, LLMNR and additional app access to foreground text, screen capture, presence, gaze, motion, notifications, phones, radios, location and background execution. It blocks future consumer Microsoft authentication in apps and new workplace registration while preserving the Windows logon identity. It protects Windows Security, Defender, firewall, authentication and update event channels because those records are evidence used to detect and investigate compromise; deleting them does not prevent collection or transmission. ms-private does not promise anonymity or zero Microsoft traffic, and it does not implement RAM/registry cleaners, undocumented identifier rotation, hosts-file blocklists, TLS interception or blanket Microsoft/Azure IP blocking. Network collection is reduced through supported policy, a reviewed 19-endpoint firewall catalog, service shutdown and capture-based validation with recovery paths. Catalog validation rejects update, trust, Defender, SmartScreen, Store-revocation and WNS endpoint families.

Read the [complete tool breakdown](docs/TOOL-BREAKDOWN.md), [current roadmap](docs/ROADMAP.md), [native API audit](docs/NATIVE-API.md), [privacy notes](docs/PRIVACY.md), [anonymity operating guide](docs/ANONYMITY.md), [blog draft](docs/BLOG.md), [privacy register](docs/Windows-privacy-register.xlsx), [manual guide](docs/HOME-GUIDE.md) and [offline update design](docs/OFFLINE-UPDATES.md). `Offline-Updates.ps1` inventories the OS or verifies a prepared bundle's integrity; it does not download, authenticate or install updates.

## Development and release status

The current source includes unreleased cleanup preview, stale-file, dependency-matching and packet-capture fixes after v0.0.5. Windows PowerShell 5.1 passes the expanded 142 checks. PowerShell 7 encounters an antivirus block in production cleanup catalog and target validation; see [validation status](docs/VALIDATION.md). The downloadable v0.0.5 executable does not contain these unreleased changes.

```powershell
.\tests\Run-All.ps1
.\Build-Executable.ps1
.\Build-Release.ps1
```

Tests use synthetic registry/app/network/service/account backends, read-only security inventory and temporary workspace files. CI is configured to run 142 PowerShell checks on Windows PowerShell 5.1 and PowerShell 7, plus ten native launcher checks, PE inspection and the one-file publish. Full live uninstall/sign-out/reboot/update/network/device validation on the supported OS matrix remains required before advertising a production-validated release. See [validation](docs/VALIDATION.md) and [contributing](CONTRIBUTING.md).

`Build-Executable.ps1` creates the self-contained x64 executable and checksum. `Build-Release.ps1` writes a source ZIP and checksum, and `Build-AmePlaybook.ps1` creates the separate AME wrapper when 7-Zip is installed. Builders exclude local reports, refuse to overwrite an existing artifact and do not sign or publish it.