Is This Script Truly Safe? Exploring Better Alternatives

[owidat]

While tools like RemoveWindowsAI demonstrate impressive technical depth, it is important to distinguish privacy hardening from unsupported OS modification.

This utility does more than disable AI features via policy or supported configuration. It removes Windows Component Store (WinSxS) files, deletes CBS packages, modifies TrustedInstaller-protected resources, and bypasses the Windows servicing model entirely.

From a security governance and enterprise operations perspective, this introduces material risk:

• Breaks Windows Update and cumulative servicing guarantees
• Eliminates Microsoft supportability
• Complicates forensic integrity and system recovery

For organizations seeking to disable Copilot, Recall, or AI features, Microsoft already provides supported Group Policy, MDM, and registry controls that survive feature updates and preserve OS integrity.

Tools like this may be appropriate for research, labs, or disposable systems, but should not be positioned as safe or recommended for managed or compliance-driven environments.

Bottom line on safety:

Malware / Security = Safe
OS Stability = High risk
Windows Update Compatibility = High risk
Enterprise / ISO 27001 environment = Not acceptable
Personal lab / test VM = Acceptable with backups

Enterprise / Institutional systems (strong recommendation)

Do NOT use this script.

Instead, Disable Copilot and Recall using:

• Group Policy
• MDM / Intune CSPs
• Supported registry policies only

Leave:

• WinSxS intact
• CBS packages intact
• Inbox AppX packages provisioned but disabled

This preserves:

• Update support
• Vendor accountability
• Audit defensibility

For power users / privacy-focused personal systems (If this is a non-critical personal machine, then: Minimum safeguards before running again)

1. Full image backup (Veeam, Macrium, bare-metal)
2. Run with: -backupMode -EnableLogging
3. Accept that: (Feature updates may fail / In-place upgrade may be required later)
   Even here, I would recommend:

• Commenting out: (WinSxS deletion / CBS package removal)
• Keeping the script limited to: (Policies / AppX removal only)

“No-AI” Windows 11 configuration that survives feature updates

This is the correct, supportable approach. (Supported controls only)
1- Windows Copilot

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot
TurnOffWindowsCopilot = 1 (DWORD)

2- Recall

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsAI
AllowRecallEnablement = 0 (DWORD)
TurnOffSavingSnapshots = 1 (DWORD)

3- AI models access

HKLM\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy
LetAppsAccessGenerativeAI = 2
LetAppsAccessSystemAIModels = 2

4- Notepad AI

HKLM\SOFTWARE\Policies\WindowsNotepad
DisableAIFeatures = 1

5- Paint AI

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Paint
DisableImageCreator = 1
DisableGenerativeFill = 1

6- Edge Copilot

HKLM\SOFTWARE\Policies\Microsoft\Edge
BuiltInAIAPIsEnabled = 0
ComposeInlineEnabled = 0

✅ This configuration:

• Survives feature updates
• Is auditable
• Is reversible
• Is Microsoft-supported

Safe alternative script (policy-only, enterprise-grade)

Below is a safe baseline script you can actually deploy:

# SAFE Windows 11 AI Hardening Script
# Supported, reversible, update-safe

$reg = @{
    "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot" = @{
        "TurnOffWindowsCopilot" = 1
    }
    "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" = @{
        "AllowRecallEnablement" = 0
        "TurnOffSavingSnapshots" = 1
        "DisableAIDataAnalysis" = 1
    }
    "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" = @{
        "LetAppsAccessGenerativeAI" = 2
        "LetAppsAccessSystemAIModels" = 2
    }
    "HKLM:\SOFTWARE\Policies\WindowsNotepad" = @{
        "DisableAIFeatures" = 1
    }
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Paint" = @{
        "DisableImageCreator" = 1
        "DisableGenerativeFill" = 1
        "DisableGenerativeErase" = 1
    }
}

foreach ($path in $reg.Keys) {
    if (!(Test-Path $path)) {
        New-Item $path -Force | Out-Null
    }
    foreach ($name in $reg[$path].Keys) {
        New-ItemProperty -Path $path -Name $name -Value $reg[$path][$name] -PropertyType DWord -Force | Out-Null
    }
}

gpupdate /force

[zoicware]

id never recommend to run any third party scripts on an enterprise or education system thats what sys admins are for inside of the org

also pretty funny this is written with ai