In this article, we’ll review how to tame the wild, crazy and often malicious Windows 11 by combining two separate, powerful tools. This is not only to achieve an Affirmative Defense against undesired advertising, bloat and espionage in Windows 11, but also a preventive Affirmative Defense. against those elements that the monthly Windows Update tends to re-install without our consent or knowledge, after we have already removed them previously. The tools we’ll be covering in this article are the full-featured Group Policy built-into the superior versions of Windows 11, and Winhance (which is free but gladly accepts donations). The full-featured Group Policy will act like the «outside bouncer» at a night club, and Winhance will act like the «inside bouncer», in additon to having many other valuable functions, as explained ahead. As I covered in my recent article Windows 11 versions beyond Home/Pro, to combat undesired advertising, bloat & espionage, Windows 11 Home and Windows 11 Pro won’t be allowed into the first part of this party. That’s because Windows 11 Home does not include any Group Policy functionality at all, and Windows 11 Pro sadly now has very limited Group Policy capabilities, which sadly lacks the capacity for the strongest and most important Policy (Directive) we’ll be implementing ahead, before doing the rest of the our process with Winhance. The most powerful Windows 11 versions are now Education, LTSC Enterprise and IoT Enterprise, since Pro was been sadly weakened regarding its Group Policy capabilities. But no worries: If you have one of those two «weaker» Windows 11 versions, it is quick and easy to upgrade from Windows 11 Home or Windows 11 Pro to Windows 11 Education (not Windows 11 Pro Education—We don’t want that one.), even in-place (without having to reformat your drive), as explained in my recent article, and the license price is under US$5 for one computer or under US$14 for 5 computers), although you may be able to receive a free license legally, if you have an email address ending with .edu. I clarify that WInhance does work—even with Windows 11 Home and Windows 11 Pro—but ahead I’ll explain why the ideal solution to tame Windows 11 is by combining both the full-featured Group Policy and Winhance, as our dynamic duo.

Why combine the full-featured Group Policy with Winhance?

As I began to explain earlier, we are in an era when the monthly Windows Updates not only add desired security updates (and possibly also feature updates, if we select that): Nowadays, the monthly Windows Updates often also reverse actions we have already made to remove undesired advertising, bloat and espionage, without our knowledge or consent. Although I applaud Winhance for its wonderful function to monitor the re-appearance of such undesired elements after each Windows reboot—and remove those undesired elements (again) within seconds after its detection after reboot—I would prefer to have Winhance act like the «indoor bouncer» in a fancy nightclub, which only has to deal with undesired elements that may have slipped through the «outdoor bouncer». In this analogy, the «outdoor bouncer» is Microsoft Group Policy, where the first and strongest policy we’ll set (as you’ll see ahead) actually commands Windows Update—with the absolute highest authority—to ignore specific undesired elements from ever being reinstalled, which is a relief to the second (inside) bouncer: Winhance. That way, Winhance will only have to deal with the fewer undersired elements which may have gotten past the «outside bouncer». That way, we’ll have much less interference with our system.

Microsoft’s nomenclature for its Group Policy in English and Castilian

I personally manage computers mainly in two languages: Castilian (castellano) (aka «Spanish» («español») and US English. Whoever was in charge of translating the Group Policy term at Microsoft (or its subcontractor) made it sound slighlty better in Castilian: Directivas de grupo local. Even though both are correct, I would have preferred Directriz (Directrices) de grupo local, which is back-translated to English as Directive(s), i.e. The Prime Directive. If you have never been into Star Trek, ask a friend who has. Anyone who has ever been into Star Trek (or any of its many spinoffs) will know about The Prime Directive. In any case, these words sound much better—in this context—than simply Policy or Policies.

In any case, ahead, I’ll mention the Microsoft’s actual Castilian translations in parentheses after the English names to facilitate you finding them if you have your Windows with its user inerface in Castilian.

Microsoft Group Policy (Policies)

Before attempting to implement any of the policies explained in this section, you must previously repeat doing Windows Update ad nauseam until all updates are finished. This often takes several cycles and Windows reboots until Windows is completely updated. If you neglect to do this, the below instructions won’t work.

In this section, we’ll implement two policies (directives). They are both important. I am certain that the first one (our «Prime Directive») will not work (or work as perfectly) with Windows 11 Pro, only with the superior ones indicated above (Windows 11 Education, Windows 11 LTSC Enterprise, Windows 11 IoT Enterprise). Several colleagues have confirmed the similar policy in Windows 11 Pro either no longer works, no longer exists, or only works for newer users beyond the current user, with newly created users. What I am about to demonstrate absolutely works at the end of May 2026 with Windows 11 Education (fully updated), and with the same user who implements it (not just newly-added users). This has been proven by me and by Rich of @CyberCPU. This fact is also indicated at the top of the Group Policy Editor when establishing it, as you’ll see in my screenshot i both languages. Thanks to Rich of @CyberCPU for informing us about the terrible situation with Windows 11 Pro and the favorable situation with Windows 11 Education (in addition to LTSC Enterprise and IoT Enterprise).

1: Our Prime Directive

In our first (i.e. Prime) directive is to set the Group Policy so that certain undesired apps be immediately removed (or not be ever re-installed by Windows Update). This is apparently new with version 25H2 (after all Windows Updates are done to it) and is missing in Pro, but available with Education, LTSC Enterprise and IoT Enterprise.

1. To do that, we must first open the Group Policy Editor in Windows 11 Education, Windows 11 LTSC Enterprise or Windows IoT Enterprise by typing the letters GPO in the search field to get and click on the option Edit Group Policy. (En castellano, ingresa la palabra Directiva hasta encontrar la opción Editar directiva de grupo.)
2. As soon as the Editor opens, it’s best to click to go to full screen.
3. In the left column, look for Computer configuration>Administrative Templates>App Package Deployment>Remove Default Microsoft Store Packages from the system and double-click it (Configuración de equipo/Plantillas administrativas/Implementación de paquetes de la aplicación/Eliminar los paquetes predeterminados de Microsoft Store del sistema)
4. Click on Enabled>Click on every apps or features you don’t want. Write-in other packages on the buttom, if desired. For every item (application or feature) you add a checkmark, it will be uninstalled (if already installed) and commanded never to be re-added via any future Windows Update, after you perform the upcoming step 5.
5. Either open Powershell as Administrator>Type in gpupdate /force
   followed by the Enter key on the keyboard, Log out and Log in or (much more simply) just restart the computer after step 4 above. After doing either of these, those undesired elements will be removed and should never return via a future Windows Update.

2: Our second policy

Before implementing this second policy (directive), we can first confirm that by visiting Privacy & Security>Diagnostic & feedback (Diagnóstico y comentarios), our only official options to normal users are to select between sending all data or «required data» to Microsoft. However, after implementing this Group Policy, the status changes from «required data» to None!

After we implement this as indicated below, it will be completely off, sending no data at all.

1. To do that, we must first open the Group Policy Editor in Windows 11 Education, Windows 11 LTSC Enterprise or Windows 11 IoT Enterprise by typing the letters GPO in the search field to get and click on the option Edit Group Policy. (En castellano, ingresa la palabra Directiva hasta encontrar la opción Editar directiva de grupo.)
2. As soon as the Editor opens, it’s best to click to go to full screen.
3. In the left column, look for Computer configuration>Administrative Templates>Windows Components>Data Collection and Preview Builds>>Allow Diagnostic Data (Recopilación de datos y versiones preliminares/Permitir datos de diagnóstico):
4. Open it and Click on Enabled (Habilitada).
5. In the pulldown menu, select Diagnostic data-off (Datos de diagnóstico desactivados). Press okay (Aceptar).
6. Unlike the first Policy (Directive) we invoked above, this one is instantaneous, and you can verify it immediately in Privacy & Security>Diagnostic & feedback (Diagnóstico y comentarios)

There are many more such policies that you may want to implement, as Rich of @CyberCPU demonstrates in this video.

Can Group Policies (directives) be saved and shared?

That is a very good question, which I first researched and later tested myself. I will share my personal experience, since it could (and can) save time and possible human error.

1. It can be done, as long as the target computer has the exact same Windows version and update status.
2. It requires the operator to have Windows show otherwise hidden folder names file names located in the path \Windows/System32/GroupPolicy and the files inside of it.

After copying the files to a folder on a USB drive, I tested it after many clean installations of Windows 11 on the same computer and it worked perfectly. I was doing several clean installations since I was testing an autounattend.xml filed I created—and continued to polish— to automate the installation of Windows. After making each clean installation of Windows 11 Education, I was able to drag the previously created Group Policies to the same location indicated above, restart the computer and they were implemented perfectly. As stated earlier, I only did that after going through the cycle of Windows Updates until there were no more available to update.

Winhance as our «indoor bouncer»

Winhance is a wonderful portmanteau (compound word where only one part remains of each original word) for one of the greatest Windows enhancement tools I have ever used to date. The name Winhance combines parts of the words Windows and Enhance. Many other tools I have seen can remove undesired apps and undesired features from Windows 10/11, but Winhance is the first one I have ever used that can continually monitor for the potential future presence of a previously removed and condemned elements within a few seconds after detection after a Windows reboot. Although—when possible—I prefer to exclude most of the undesired elements in advance (using Group Policy as the «outside bouncer», as indicated earlier), sometimes there is a need for the «indoor bouncer» too, due to different situations.

The Winhance user interface is friendly and available in multiple languages, including Castilian and English. What you will see in the screenshots below are only one of a few different views it offers to show and select Windows apps & features, for the purpose of for either installing them (if not already installed)…

or to uninstall them (if currently installed) or just blocklist them,(if not currently installed), when we want it to be automatically removed if ever detected due to a forced reinstallation by a future Windows Update not blocked by a Group Policy (directive) as indicated earlier in this article. That could be either because there is no such Group Policy (directive) for that particular app or feature, or because somehow the Group Policy failed.

In addition to using Winhance to remove and exclude certain undesired advertising, bloat and espionage, Winhance also includes very desired features to Optimize and Customize Windows. Although those two sections are officially outside the scope of this particular article, I’ll give you two examples I love under Customize:

• In Windows Theme, it allows setting Dark Mode for Windows even before we have had a chance to Activate Windows. What a relief!
• In Explorer, it allows showing file extensions and also showing hidden folders, files and drives.

In addition, Winhance has a section to install or uninstall third-party apps, all suggested by its creator, and some of which are great substitutes for the espionage-infested ones we’ll likely want to remove from Windows 11, like Notepad, in favor of Note++ which is suggested in the third- party apps section.

I have confirmed that using the third-party app installer function inside Inhance (which uses Microsoft’s own WinGet function) does it in a desired way. For example, if I use Winhance to download and install the Brave Browser (and my Windows is already set to show Castilian in its user interface), the downloaded and automatically installed Brave Browser displays the same language. Obviously, this only works with WinGet capable apps which have been translated to the current Windows display language.

For more information, visit Winhance.net or visit the creator’s YouTube channel here.

Related content

• Windows 11 versions beyond Home/Pro, to combat undesired advertising, bloat & espionage
• I created a superior software layout for the Spanish keyboard for Mac: «Español ISO mejorado»
• My new keymap Español ISO Mejorado for Windows
• Commercial music in podcasts under Fair Use, with a pre-published DMCA policy & procedure

Lee este artículo en buen castellano

Domemos a Windows 11 con Winhance y «directivas de grupo» como tu defensa afirmativa preventiva contra el espionaje, publicidad y relleno

(Re-)Subscribe for upcoming articles, reviews, radio shows, books and seminars/webinars

Stand by for upcoming articles, reviews, books and courses by subscribing to my bulletins.

In English:

• Email bulletins, bulletins.AllanTepper.com
• In Telegram, t.me/TecnoTurBulletins
• Twitter (bilingual), AllanLTepper

En castellano:

• Boletines por correo electrónico, boletines.AllanTepper.com
• En Telegram, t.me/boletinesdeAllan
• Twitter (bilingüe), AllanLTepper

Most of my current books are at books.AllanTepper.com, and also visit AllanTepper.com and radio.AllanTepper.com.

FTC disclosure

None of the listed individuals or companies mentioned above has paid for this article. Some of the manufacturers listed above have contracted Tépper and/or TecnoTur LLC to carry out consulting and/or translations/localizations/transcreations. So far, none of the manufacturers listed above is/are sponsors of the TecnoTur, BeyondPodcasting, CapicúaFM or TuSaludSecreta programs, although they are welcome to do so, and some are, may be (or may have been) sponsors of ProVideo Coalition magazine. Some links to third parties listed in this article and/or on this web page may indirectly benefit TecnoTur LLC via affiliate programs. Allan Tépper’s opinions are his own. Allan Tépper is not liable for misuse or misunderstanding of information he shares.