Ghost Setup for Windows

Everything Ghost Setup changes

For Ghost Setup 2.0.0. Download it

Restore point (tick box)

Clean up

Removes the ticked apps (Remove-AppxPackage -AllUsers and Remove-AppxProvisionedPackage -Online), then:

Privacy

Also: the DiagTrack service ("Connected User Experiences and Telemetry") is stopped and set to Disabled. Undo: sc config DiagTrack start= auto in an admin terminal.

Lighter Windows

Lighter does the first five rows and the Lighter items below the table; Lightest does everything in this section. Nothing here touches Microsoft Defender, Windows Update, the firewall, networking, sound, printing, Xbox or parental controls.

Also, not as registry values written by the app:

• Lighter - services set from Automatic to Manual (start only when something needs them), and only if they're Automatic now: MapsBroker, TrkWks, PcaSvc, InventorySvc, WMPNetworkSvc, RetailDemo, Fax, dmwappushservice, WerSvc, wisvc. The run log lists the ones changed. Undo one: sc config <name> start= auto (admin).
• Lighter - scheduled tasks disabled (Disable-ScheduledTask), all under \Microsoft\Windows\: Application Experience\Microsoft Compatibility Appraiser (and ...Exp), Application Experience\ProgramDataUpdater, Autochk\Proxy, Customer Experience Improvement Program\Consolidator, UsbCeip and KernelCeipTask, Device Information\Device and Device User, DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector, Feedback\Siuf\DmClient and DmClientOnScenarioDownload, Maps\MapsUpdateTask and MapsToastTask, PI\Sqm-Tasks, Windows Error Reporting\QueueReporting. Undo: Task Scheduler > right-click the task > Enable.
• Lightest - services stopped and set to Disabled: WSearch (search indexing), and SysMain unless Windows is on a hard drive. Undo: sc config WSearch start= delayed-auto and sc config SysMain start= auto (admin).
• Lightest - animations: SystemParametersInfo turns off the minimise/maximise, menu, drop-down and tooltip animations, and turns "Animation effects" on (the taskbar needs it to slide; 1.4 and 1.4.1 turned it off). Undo: Start > type performance > Adjust the appearance and performance of Windows > Let Windows choose.

Free up space

No registry keys. Deletes files not touched for a day in %TEMP% and C:\Windows\Temp, plus %LOCALAPPDATA%\CrashDumps, C:\Windows\Minidump and C:\ProgramData\Microsoft\Windows\WER\ReportArchive and ReportQueue. On desktops it runs powercfg /hibernate off (undo: powercfg /hibernate on).

Faster start-up

For each app you tick, one value under the matching key (the same switch Task Manager > Startup apps uses):

On your PC the suggested ones are RobloxPlayerBeta and MicrosoftEdgeAutoLaunch_1E31ED1E22ACBD0652800803FD14F868 (both HKCU Run).

Faster for games

Also: every screen is switched to its fastest refresh rate (Windows' display settings, not the registry), and on desktops the High performance power plan is turned on (powercfg /setactive SCHEME_MIN).

Faster, safer DNS

No registry keys written directly. Each connected network adapter gets the DNS servers of the service picked (Set-DnsClientServerAddress): Cloudflare 1.1.1.1, 1.0.0.1, 2606:4700:4700::1111, 2606:4700:4700::1001; Google 8.8.8.8, 8.8.4.4, 2001:4860:4860::8888, 2001:4860:4860::8844; Quad9 9.9.9.9, 149.112.112.112, 2620:fe::fe, 2620:fe::9; AdGuard 94.140.14.14, 94.140.15.15, 2a10:50c0::ad1:ff, 2a10:50c0::ad2:ff. Automatic runs Set-DnsClientServerAddress -ResetServerAddresses, which puts it back. Undo: pick Automatic, or Settings > Network & internet > your connection > DNS server assignment > Automatic.

Refresh the connection, Wi-Fi at full power

No registry keys. Refresh runs Clear-DnsClientCache and netsh interface ip delete arpcache. Wi-Fi at full power runs powercfg /setacvalueindex SCHEME_CURRENT 19cbb8fa-5279-450e-9fac-8a3d5fedd0c1 12bbebe6-58d6-4636-95bb-3217ef867c1a 0 (wireless adapter: Maximum performance, when plugged in) and powercfg /setactive SCHEME_CURRENT. Undo: Control Panel > Power Options > Change plan settings > Advanced > Wireless Adapter Settings.

Max performance power plan

No registry keys. Finds or makes the Ultimate Performance plan (powercfg /duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61) and makes it the active plan (High performance, SCHEME_MIN, if Windows has no Ultimate plan). When this is on, Faster for games leaves the power plan alone. Undo: the Tools page > Balanced power plan (powercfg /setactive SCHEME_BALANCED), or Control Panel > Power Options.

Keep USB and PCI Express awake

No registry keys. powercfg /setacvalueindex SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0 (USB selective suspend: Disabled, when plugged in) and powercfg /setacvalueindex SCHEME_CURRENT 501a4d13-42af-4429-9fd1-a8218c268e20 ee12f906-d277-404b-b6da-e5fa1a576df5 0 (PCI Express Link State Power Management: Off, when plugged in). Undo: Control Panel > Power Options > Change plan settings > Change advanced power settings.

Quiet Game Bar

No Sticky Keys pop-up

Faster shutdown

Stricter privacy

Clear caches

No registry keys. Deletes the contents of these folders (anything in use is left): the Cache, Code Cache and GPUCache folders in each Chrome, Edge and Brave profile (Default, Profile 1...), Firefox's cache2 in each profile, %LOCALAPPDATA%\D3DSCache, NVIDIA\DXCache, NVIDIA\GLCache, AMD\DxCache, AMD\GLCache, and %LOCALAPPDATA%\Microsoft\Windows\Explorer (thumbnail and icon caches; File Explorer redraws them). Passwords, logins, history and bookmarks are in other folders and are never touched.

Remove OneDrive

No registry keys. Stops OneDrive and runs its own uninstaller (winget, or OneDriveSetup.exe /uninstall). Files already on the PC stay where they are.

Game essentials, Drivers, Install apps, Update apps

No registry changes by the app itself. They install through winget, Windows Update and AMD's own installer:

• Game essentials (only what's missing): Microsoft.VCRedist.2015+.x64, Microsoft.VCRedist.2015+.x86, Microsoft.VCRedist.2013.x64, Microsoft.VCRedist.2013.x86, Microsoft.DirectX, Microsoft.DotNet.DesktopRuntime.8
• Drivers: Windows Update's driver catalogue, AMD chipset drivers from amd.com (run only if signed by AMD), and the NVIDIA App (XP8CLZL93F5Z4P from the Microsoft Store) if it's not installed
• Install apps: the winget ids listed in $GetAppsTable in the engine
• Update apps: winget upgrade --all

Swap Windows apps

Each swap installs Ghost's pick with winget and only then, if that worked, removes Windows' app (Remove-AppxPackage -AllUsers and Remove-AppxProvisionedPackage -Online; the Microsoft Store can put it back).

Default apps aren't changed: Windows only lets you choose those yourself (Settings > Apps > Default apps).

Look (dark mode, colour, wallpaper, lock screen)

Ghost cyan (the default) writes AccentColorMenu FFD3B617, StartColorMenu FFAA9213, ColorizationColor C417B6D3. The wallpaper itself is set with SystemParametersInfo (Shuffle uses Windows' own slideshow, a new picture every hour). The wallpapers are copied to C:\Windows\Web\Wallpaper\Ghost. Undo the lock screen: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PersonalizationCSP /f (admin).

Mouse pointer

Small crosshair, Crosshair, Red dot, Scope, Gaming arrow or Ghost. The app draws the style in the pointer colour picked (the small crosshair is always red); the files are copied to C:\Windows\Cursors\Ghost\<style> (small, crosshair, dot, scope, gamer or ghost).

Windows normal writes Windows' own "Windows Default" scheme back: (Default) Windows Default, Scheme Source 2, and the 17 paths from Windows' "Windows Aero" scheme (%SystemRoot%\cursors\aero_arrow.cur and so on; Crosshair and IBeam empty, meaning built in).

Either way the pointers are swapped in straight away with SetSystemCursor, and SystemParametersInfo(SPI_SETCURSORS) reloads the rest. Don't change leaves all of this alone. Undo by hand: Settings > Bluetooth & devices > Mouse > Additional mouse settings > Pointers > Scheme: Windows Default.

Ghost makeover

Ghost sounds. Made by the app, copied to C:\Windows\Media\Ghost.

Sounds: .Default, Notification.Default, Notification.IM, Notification.Mail, Notification.Reminder, Notification.SMS, MailBeep, SystemNotification -> ghost-pop.wav; SystemAsterisk, SystemExclamation, WindowsUAC -> ghost-chime.wav; SystemHand, DeviceFail -> ghost-error.wav; DeviceConnect -> ghost-connect.wav; DeviceDisconnect -> ghost-disconnect.wav. Undo: Settings > System > Sound > More sound settings > Sounds > Sound Scheme: Windows Default.

Desktop clock. GhostWidget.exe is copied to %LOCALAPPDATA%\Programs\Ghost and started as you (not as admin).

Undo: right-click the clock > Turn off the desktop clock.

Clean desktop. HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, HideIcons, DWORD 1. Undo: right-click the desktop > View > Show desktop icons.

Taskbar (Clean, See-through, Auto-hide, Left)

See-through also installs TranslucentTB (CharlesMilette.TranslucentTB) and writes its own settings.json (not the registry). Every other style removes TranslucentTB.

Developer Mode (only when run on its own with -InstallDevTools)

Not in the registry at all

• %TEMP%\GhostSetup - where the app unpacks the engine, wallpapers and desktop clock each time it opens (and draws the pointers and sounds just before a run)
• Desktop\GhostSetup-log.txt - the log of the last run

Ghost Setup never turns off Windows Update, Windows Defender, the firewall or parental controls, and it never touches your files. Spotted something that isn't on this page? Email hello@ghostavix.co.uk.