W11 Optimiser

What I Built

• A PowerShell tool with six modes: Audit, Preview, SafeOptimize, PostCheck, UndoLatest, OpenLastReport.
• A double-click CMD launcher — no PowerShell commands to type.
• Local HTML reports for every run, saved under Desktop\W11 Optimiser.
• Restore point and protected property-level rollback state before anything changes.
• A dedicated temporary power plan for each run, so the original plan is never edited and undo can remove the run-specific plan.
• A versioned release manifest: the PowerShell bootstrapper checks the downloaded script SHA-256 before it can run.

What Safe Optimise Changes

• Power plan. A temporary W11 Optimiser plan based on Ultimate Performance when available, otherwise High Performance. Your existing plan stays unchanged.
• AC power settings. Processor min 10% / max 100%, PCIe ASPM off, USB selective suspend off, wireless adapter power saving off.
• Game capture overhead. Game DVR off, Game Mode stays on.
• Visual responsiveness. A conservative effects profile, no shell surgery.
• Storage. TRIM enabled, ReTrim pass on supported NTFS/ReFS volumes.
• Network power. Stops active physical adapters powering down, where supported, including USB Wi-Fi adapters whose drivers hide the setting from the normal cmdlet.
• Optional cleanup. Old temp/cache files from safe, rebuildable locations, processed by a separate worker that refuses Administrator privileges — skippable.

What It Refuses To Touch

• No security downgrades. Defender, Firewall, Windows Update, Store, VBS, Memory Integrity — untouched.
• No driver or vendor hacks. GPUs are detected for reporting only, never modified.
• No unstable or third-party tweaks. No services, startup apps, HAGS, BIOS/UEFI, overclocking, undervolting, or third-party code.
• Manual stays manual. Startup apps, GPU panel settings, cooling modes, XMP/EXPO, Resizable BAR, BIOS updates are flagged for review, not changed.

Modes

• Audit. Full read of Windows version, CPU, RAM, GPU, storage, TRIM, power plan, Game DVR, Device Guard, startup, network power — into a report.
• Preview. Shows current values and what SafeOptimize would change. No changes made.
• SafeOptimize. Confirms, applies changes, backs up, reports, opens the result.
• PostCheck. Re-reads settings after a run to confirm what actually took effect.
• UndoLatest. Confirms, then restores registry values, the original power scheme, TRIM, and network settings before removing the run-specific power plan.
• OpenLastReport. Opens the most recent report.

Safety Model

• Capture before edit. Exact targeted registry properties and state are saved under an Administrator-only ProgramData directory before anything changes.
• Capture failure stops the run. If a targeted registry value cannot be captured, SafeOptimize exits before it changes settings.
• Property-level undo. Undo restores exact prior values, removes values originally absent, skips values changed again after optimisation, and never imports .reg files.
• Validated undo state. Undo trusts only protected run directories, requires the exact schema and allowlisted registry properties, and rejects unexpected network paths or power-plan identities.
• Truthful run reports. Each optional step records its actual outcome, so a failed step is shown as a warning rather than an OK.
• Windows 11 preflight. SafeOptimize verifies a Windows 11 client build before it offers to make changes.
• Dedicated power plan. SafeOptimize adjusts a run-specific plan instead of modifying an existing Windows plan.
• Preview changes nothing. No restore point, backup, or registry/power/adapter change.
• Confirmation required. Both the launcher and direct PowerShell path ask before SafeOptimize or UndoLatest runs.
• Same-account elevation. UAC must preserve the initiating Windows SID; alternate Administrator credentials are refused before any changes.
• Least-privilege cleanup. Recursive temp/cache deletion runs only in a worker that proves it is unelevated and using the initiating SID.
• Restore point by default. Required unless explicitly skipped with -SkipRestorePoint.
• Local-only. Reports, state, backups — all local, nothing uploaded.
• Optional verbose logs via -VerboseLog for troubleshooting.
• Readable output. Browser reports, not buried console text.
• Conservative by design. Riskier tweaks stay documented, manual, and outside the tool's scope.

Release Verification

• Visible version. The menu and generated reports show the script version so a bug report can name the exact release.
• Download integrity check. The published command and bootstrapper require HTTPS and reject redirects. The bootstrapper checks the script SHA-256, stages it in a random Administrator-only directory, and rechecks it immediately before every launch.
• Clear boundary. A manifest from the same website can catch corruption or an incomplete deployment, but it cannot independently protect against a compromised website. Authenticode signing is the future upgrade for that threat model.

What To Actually Expect

• Best on a machine that's been used for months — not fresh. TRIM and cache cleanup mostly no-op on a new install.
• Smoother frame timing, not higher FPS. The power/latency changes reduce stutter; they don't raise benchmark numbers.
• Possible network stability/throughput improvement. Some USB Wi-Fi adapters perform better when Windows is not allowed to power them down, but this depends on the adapter, driver, router, and signal.
• No FPS gain, ever. That's GPU driver and settings territory, deliberately untouched here.
• Visual-effects changes are close to cosmetic on modern hardware.
• This is a small, correct set of fixes done safely — not a "50% faster" tool.

Why It Matters

• Honest scope, on purpose. Most optimisers chase speed by disabling protection or overpromising results. This one states its limits and keeps the system recoverable.
• Real Windows automation. PowerShell, CIM queries, property-level registry rollback, powercfg, storage maintenance, network adapter APIs, elevation handling.
• Reusable. Launcher, reports, undo flow, and conservative defaults work across different Windows 11 machines.

Files