Microsurf — Stripping Windows 10 Down to the Metal
Windows 10 ships with a data collection pipeline that runs from the moment you boot. Microsurf's 10surf.ps1 tears it out — telemetry, Cortana, advertising ID, 30+ phoning-home endpoints, bloatware, and junk features — then lets you choose exactly how Windows Update behaves. No sign-in. No third-party tools. One script.
The Problem With Windows 10
Windows 10 is not a product you own. It's a service running on your hardware. Out of the box it logs keystrokes for "handwriting improvement", uploads your browsing history, sends your location, transmits crash dumps with full memory snapshots, and runs background services that phone home on a continuous schedule. Microsoft calls this "Connected User Experiences". Everyone else calls it what it is.
The Settings panel offers toggles. They are cosmetic. The telemetry services don't stop when you flip the switch. DiagTrack keeps running. CompatTelRunner.exe keeps firing its scheduled tasks. The hosts file is untouched. The firewall has no rules blocking the data collection binaries. The registry keys that control the real pipeline are buried three levels deep in policy paths the GUI never touches.
If you want it actually gone, you have to go beneath the UI — registry, service manager, firewall, hosts file, and task scheduler, all at once, with no gaps. That's what Microsurf does.
OS Guard — Windows 10 Only
The first thing 10surf.ps1 does after printing the banner is read your OS build number from WMI. Windows 10 occupies builds 10240–19045. Windows 11 starts at 22000. If the script detects the wrong OS it exits cleanly — nothing gets changed.
Sections 1–14 — Automated Privacy Hardening
A System Restore Point is created before any changes. Then the script works through 14 hardening sections with no prompts.
- Telemetry registry —
AllowTelemetry = 0via both policy path and direct path. Diagnostic log collection and OneSettings downloads blocked. - Services —
DiagTrack,dmwappushservice,WerSvc,DoSvcstopped and set to Disabled - Hosts file — 30+ telemetry endpoints redirected to
0.0.0.0includingvortex.data.microsoft.com,watson.telemetry.microsoft.com, all Bing and feedback domains - Firewall — Outbound block rules for
CompatTelRunner.exe,DeviceCensus.exe,wsqmcons.exe,MusNotification.exe - Scheduled tasks — All CEIP, feedback, appraiser, and disk diagnostics tasks disabled via Task Scheduler API
- Cortana — Killed via policy keys. Bing web search removed from Start search bar.
- Advertising ID — Global identifier and all personalization data pipelines disabled
- Activity History / Timeline — Activity feed, cross-device clipboard sync, and cloud upload all off
- App permissions — Force-denies access to camera, mic, location, contacts, calendar, call history, email, and messaging via
AppPrivacypolicy (value 2 = Force Deny) - Windows Error Reporting — Disabled at policy and service level. Additional data upload blocked.
- LLMNR — Multicast name resolution disabled. Closes the primary attack vector for Responder-style credential capture on local networks.
- WiFi Sense — Auto-connect credential sharing disabled
- Content Delivery Manager — Silent app install pipeline and Start menu sponsored suggestions fully off
- Font streaming / online tips — Cloud font provider and online help streaming disabled
How to Run It
- Right-click PowerShell → Run as Administrator
- A System Restore Point is created automatically as step one
- Roll back at any time:
rstrui.exe→ "Before Privacy Hardening" - Tested on Windows 10 21H2, 22H2, and 23H2
Section 15 — Update & Upgrade Windows
After the automated hardening pass, the script presents a numbered menu for Windows Update. Each option is completely independent — pick one, several, all, or skip. Nothing is applied without an explicit choice.
Section 16 — Debloat
The final section walks through nine debloat categories. Each gets its own [Y/N] prompt. Nothing runs without your confirmation. Explorer is restarted at the end to apply visual changes immediately.
Remove-AppxPackage -AllUsers plus provisioned package cleanup. Candy Crush, Clipchamp, Teams, TikTok, all Bing apps, Cortana UWP, social media, streaming apps.GameConfigStore and AllowGameDVR policy keys.OneDriveSetup.exe /uninstall. Removed from File Explorer navigation pane via CLSID key. Provisioned package cleaned.UserPreferencesMask.CloudContent policy.Policies\Microsoft\Edge.CapabilityAccessManager\ConsentStore\location.- Almost all registry changes can be reverted via Windows Settings or Group Policy
- Removed UWP apps can be reinstalled from the Microsoft Store
- OneDrive reinstall:
aka.ms/OneDriveSetup - Full rollback:
rstrui.exe→ select "Before Privacy Hardening"
The Bigger Point
The privacy settings panel in Windows 10 is theatre. The actual telemetry pipeline runs deeper than any toggle the GUI exposes — in services, in scheduled tasks, in firewall rules that were never created, in registry keys that Settings doesn't touch. The debloat layer removes the surface junk. The hardening layer cuts the cables underneath.
You don't have to trust them with your data. But you do have to go below the UI to make sure they can't take it anyway.