Removing the built-in (sometimes even unwanted) Windows Apps after an Autopilot deployment seems pretty straightforward. Just fire up PowerShell, run a few commands to uninstall the built-in Windows 10/11 Apps for all users, and watch the clutter disappear. But what happens when a single misstep breaks your whole device?
This blog isn’t just about removing apps with PowerShell (don’t worry, we’ll get to that). It’s about dodging those “oopsie” moments, digging into the risks, and exploring smarter options, like using the Uninstall feature in the Store or leveraging AppLocker, App Control for Business (WDAC) to keep your deployment both clean and fully functional.
Remove Windows 10/11 built-in Windows Apps: The Good, The Bad, and The Dangerous.
Windows Autopilot promises a clean and seamless deployment experience, but let’s be honest: it doesn’t take long before you’re staring at a pile of stuck preinstalled apps, wondering who thought Solitaire or Weather was a critical business tool. The knee-jerk reaction? Fire up PowerShell, type Get-AppxPackage -AllUsers | Remove-appxpackage, and start deleting everything in sight for the logged-in user.
But before you press enter, let’s discuss what can go wrong, because it will if you’re not careful. This blog isn’t just another guide to removing Windows 10 apps with PowerShell. It’s about understanding what you’re removing, avoiding the classic Dunning-Kruger trap, and learning smarter, safer alternatives to get the job done.
Keep reading if you’re ready to declutter your deployment without breaking everything.
Stop! Before You Remove All Built-In Apps with PowerShell…
Let’s dive into the risks of going scorched-earth on built-in Windows apps. Sure, PowerShell commands like Get-AppxPackage -AllUsers and Remove-AppxPackage make it simple to uninstall those unwanted Windows apps, but not all apps or services should be tampered with. For example (a good one also). Do you think it is a good idea to execute this command: Get-AppxPackage Microsoft.WindowsStore | Remove-AppxPackage ?
Cleanup scripts often go beyond their intended purpose, targeting services that might seem obsolete but are anything but. Take dmwappushservice, for example, a service critical for telemetry and Intune functionality. Removing it under the assumption it’s unnecessary can wreak havoc, leaving you with compliance failures and broken provisioning flows.
Removing built-in apps isn’t inherently bad; it’s removing them blindly, and that’s the problem.
Understanding Remove-AppxPackage vs. Remove-AppxProvisionedPackage
If you still want to clean up all of those pesty Windows Default apps with PowerShell, you’ve probably come across two key commands: Remove-AppxPackage and Remove-AppxProvisionedPackage. While they might sound similar, they serve very different purposes, and using the wrong one could lead to unexpected results.
Remove-AppxPackage
This command removes an already installed app for a specific user. It’s perfect for cleaning up apps like Xbox or Microsoft.3dBuilder for the current user without affecting others on the same device. However, it won’t stop the app from being installed for new users or those who already have it.
Example:
Get-AppxPackage -Name "Microsoft.XboxGameOverlay" | Remove-AppxPackageThis removes the XboxGameOverlay Store app from a specific user’s profile.
Remove-AppxProvisionedPackage
This command goes deeper, removing a provisioned app from the Windows image itself. In simpler terms, it stops the app from being installed for any new users created on the device. Keep in mind, though, that it doesn’t touch the app for users who already have it installed.
Example:
Get-AppxProvisionedPackage -Online | Where-Object DisplayName -like "*Microsoft.BingWeather*" | Remove-AppxProvisionedPackage -OnlineThis ensures Microsoft Bing Weather won’t be provisioned for any new users on the system.
Key Differences Between the Two
When to Use Which Command
Use Remove-AppxPackage if you want to clean up apps for a specific user without affecting others.
Use Remove-AppxProvisionedPackage if you want to stop a preinstalled app from being installed for new users entirely.
Using PowerShell to Remove Built-In Windows Apps (Safely and Smartly!)
We could start crafting our own debloat script, carefully targeting only the problematic built-in Windows apps. But why reinvent the wheel when one of our colleagues at Patch My PC has already done the heavy lifting?
Check out this fantastic PowerShell script on GitHub from Ben Whitmore: Remove-Appx-AllUsers.ps1.
This script is designed to target and remove only the real unwanted built-in Windows apps for all users without causing collateral damage to critical system functionality. It’s a safe, reliable way to declutter and debloat your devices while avoiding the risks of blindly removing apps or services.
If you’re committed to decluttering and debloating, this script is a great starting point, tested, trusted, and ready to use. Just remember to always test scripts in a non-production environment before rolling them out to ensure they align with your deployment goals!
The Risks of Reckless Cleanup Scripts
Let’s face it: some other cleanup scripts you find online should come with a warning label. It’s not unusual to see PowerShell one-liners that delete every app under the sun, often without checking what they’re removing.
Here’s the thing: blindly running these scripts is the IT equivalent of playing Jenga in the dark. You might pull the wrong piece and collapse the entire system.
I’ve seen scripts remove components tied to the Start Menu or Search, rendering devices useless. Worse, even seemingly minor removals can create ripple effects that break updates, provisioning, or app functionality.
The takeaway? Understand what you’re removing before you act.
A Smarter Alternative Option 1: AppLocker and App Control for Business
If PowerShell feels risky, it’s because it often is—especially in production environments. Thankfully, there are smarter alternatives:
AppLocker: Block specific apps for users or groups without uninstalling them. This keeps unwanted apps out of sight while preserving system integrity.With Applocker you can define which apps or executables are allowed to execute. If the app is not on the list, it will be blocked.
App Control for Business / Windows Defender Application Control (WDAC): Take it a step further with policies that prevent users from running specific apps entirely.
Both solutions give you control without removing anything, which means fewer risks, no broken dependencies, and easy reversals. But that was option 1. Shall we take a look at the built-in option?
A Smarter Alternative Option 2: The Uninstall Option
Intune has you covered if you’re looking for a smarter, safer way to uninstall Windows Apps without risking a script-induced disaster or the need to implement app control (which we still recommend you do). It’s streamlined and centralized and doesn’t require you to cross your fingers every time you hit “Run.”
How It Works:
- Add the Windows App (New Store App) you want to uninstall to Intune and make sure you Select “ System Install Behavior” (Sorry but Microsoft Solitaire is not on the list ) to ensure the app is deleted system wide!
- Add the Windows App (New Store App) you want to uninstall to Intune and make sure you Select ” User Install Behavior” to ensure that if people install the Store App manually, it will also be deleted!
- With the Apps being added in system and user install behavior, ensure that you assign it for uninstall
- Deploy the uninstall policy to the right groups to ensure that Windows App will be uninstalled for all users and/or all devices.
- Add all the new Store Apps individually until they look something like this. Every Windows app below will be uninstalled using a supported approach.
Intune takes the guesswork out of app management. It’s repeatable, scalable, and keeps you from sweating over potential mistakes. Plus, with built-in tracking, you can monitor which devices have successfully uninstalled the app, so you no longer have to wonder if your script actually did its job.
Please Note: Some apps could be difficult to add. To add them, you need to have the ID: For Example, the Microsoft Tips ID: 9WZDNCRDTBJJ
When I need to find the ID, I just search for the app on a specific website.
Once found, you can click the MSStore button to go to the MSStore itself. From there, you can find the ID you were desperately looking for.
Best Practices for Managing Built-In Windows Apps
Whether you’re using PowerShell or policy-based tools, follow these tips to debloat your deployment:
Audit First: Run Get-AppxPackage -AllUsers to see what’s installed. Take the time to research each app and understand its function.
Test in a Lab: Never deploy removal scripts to production without testing them on non-critical devices first.
Use Policies Where Possible: Tools like AppLocker and Appcontrol for Business (WDAC) provide safe ways to manage (block/allow) apps without uninstalling them.
- Using the Uninstall option in Intune: When you want a safe, repeatable process that integrates smoothly with your Autopilot deployment.
Final Thoughts
Removing built-in Windows apps during Autopilot can feel like a shortcut to a cleaner deployment—but it can be a slippery slope if you don’t know what you’re doing. A single command like Remove-AppxPackage might seem harmless, but the wrong removal can break feature app updates or the provisioning process.
Instead of going nuclear, focus on understanding each app’s role in the system. Use tools like AppLocker and WDAC to control apps, or use the built-in uninstall option to get rid of those apps. If you use PowerShell, test everything and make sure you don’t deploy it to production immediately.
In IT, the real skill isn’t deleting everything you don’t like; it’s knowing what to leave alone.