Tuning documented, not asserted.
100 engineering notes on the exact registry keys, blobs and policies a trustworthy Windows tool touches — the same ones ProofTune shows you before it runs.
How Windows really tracks startup apps: the StartupApproved\Run blob
Task Manager's Disable button doesn't delete anything — it flips one byte in a 12-byte blob. Here's the layout, the timestamps inside it, and why deleting the Run entry is the amateur move.
HKCU vs HKLM: why “runs without admin” must be a promise about scope
“No admin required” is easy to claim. The meaningful guarantee is which registry hive a tool touches, which user it tunes, and what happens when it can't get elevation anyway.
Temp cleanup without fear: age filters, allowlists, and locked files
Disk-cleaning is the graveyard of overconfident tools. Three rules make it boring: only specific folders, only old files, and files in use are skipped — never forced.
Why most “PC optimizers” ask for admin rights — and what that tells you
Elevation isn't a quirk of the category; it's the product. Follow what admin actually buys these tools, and you'll know within minutes whether a utility aspires to be a tuner or a tenant.
SmartScreen called an app “unknown publisher.” Since when is that a deal-breaker?
SmartScreen blocks unsigned apps out of caution, not guilt. Here's how reputation actually works, and the SHA-256 workflow that makes an unsigned preview verifiable end-to-end.
Run vs RunOnce: the two startup keys Windows treats very differently
Both live under CurrentVersion and both launch things at sign-in — but one is persistent and one self-destructs. Knowing the difference explains half of 'mystery startup' behavior.
What Task Manager's “High startup impact” actually measured
High/Medium/Low aren't vibes — they're thresholds over CPU-seconds and disk megabytes at boot. Here's the measuring window and what the labels really cost you.
The 32-bit twin: Wow6432Node and the startup list you're not seeing
On 64-bit Windows, 32-bit apps get their own registry view. If you audit startup entries in one view only, you're reading half the story.
Active Setup: the first-logon staging step nobody audits
There's a mechanism older than most admins that runs per user at first sign-in to stamp machine-installed defaults. It's legitimate — and it's quietly abused.
Right-click menus that belong to you: shell integration in HKCU
Windows classes registration means tools can add your own right-click verbs — and remove them — without ever touching HKLM. The exact paths, the plateaus, the pitfalls.
The one-byte dark mode: AppsUseLightTheme, honestly
Personalization in Windows is a handful of documented HKCU values — not a theme engine. What the dark-mode key does, which apps listen, and which ignore it.
Why you can't script default-browser changes: the UserChoice hash
Windows deliberately makes default app assignment tamper-hardened. The hash format, what it proves, and how legitimate tools live with it instead of fighting it.
MenuShowDelay and friends: the timing values behind “snappy”
Menus wait before opening, hovering delays accelerate, and window drag behavior redraws — all under documented HKCU values with known defaults. The complete timing cheat-sheet.
HideFileExt: the tiny key with decades of drama
Showing file extensions is a single per-user DWORD — and the one customization that consistently pays for itself in security alone.
NumLock at logon: InitialKeyboardIndicators, finally explained
The key state at the sign-in screen isn't random — it's one per-user DWORD with values 0/2/2147483650 and family. Here's the map that ends the guessing.
Why your NumLock “fix” keeps coming back: Fast Startup's hibernation replay
Fast Startup hibernates kernel sessions, not your fixes. How partial hibernation changes which settings 'take' at boot, which don't, and how to test permanently.
The one policy value that turns web suggestions off in Start
Search box suggestions are controlled by a documented per-user policy value — not a service, not a scheduled task, and fully restorable.
VisualFXSetting 0/1/2/3: the master switch that wasn't a slider
One DWORD gates all dialog-driven visual effects choices. What each value means, why '3' is where custom lives, and what the dialog writes on your OK click.
WinSAT isn't benchmarking your PC on a schedule — it's scoring features
The Windows System Assessment Tool fills DataStore XMLs so glass, encoding, and experience-index consumers can query capability. What runs when, and why tools shouldn't 'fix' its scores.
Every taskbar checkbox is a documented per-user value
Alignment, Widgets, Chat, badges, jump list hover — taskbar configuration is a small set of HKCU values with known names. The full per-account map.
Snap layouts live in the per-user hive too
Snap assist, hover-to-show layouts, and zone persistence are HKCU values. For multimonitor dwellers these are the highest-return changes per byte you can make.
Focus Assist per user: the quiet-hours registry, decoded
Quiet hours are per-account state stored under documented HKCU paths — with begin/end minute counts and priority rules. The map for scripting it cleanly.
Clipboard history is one per-user value — and what that implies
EnableClipboardHistory flips with a DWORD. But the bigger story is what per-user state is store-and-forward: clipboard, sync, and the privacy line between them.
LongPathsEnabled is machine-scope — and what per-user tools do instead
Enabling 32k paths is an HKLM flip plus a manifest bit. A per-user tool has no business turning it on — but there's plenty it can do about long paths safely.
Five PowerShell one-liners that audit startup, temp and privacy settings safely
Read-only by construction: the five Get-ItemProperty commands that inspect everything ProofTune touches — without your machine changing a single byte.
Decoding FILETIME values without leaving PowerShell
Binary registry blobs hold FILETIMEs — the little-endian 64-bit timestamps Windows uses everywhere. A ten-line decoder you can paste anywhere.
The two-line safety pattern for every registry write
Registry writes that don't capture the previous state are one-way installs of future regret. The pattern: read before write, record the bytes, log it, then write.
Export your startup entries to a file Task Manager can't keep
Task Manager has no export. Twenty lines of PowerShell produce a dated CSV of every Run entry plus its approval state — the baseline inventory before any change.
Reading Application Error events without crashing your shell (or your schedule)
Get-WinEvent is the only right way to read WER event history; Get-EventLog is deprecated, slow, and differently filtered. The exact XPath, and why the last hour usually suffices.
Verifying a download in 10 seconds: Get-FileHash discipline
Hash before run. One command per artifact, a copy of the published SHA-256 beside it, and a hard fail if they disagree. The whole ceremony, with the habit nailed down.
Per-user scheduled tasks: how to make one, and why tuning apps shouldn't
Scheduled tasks at user scope are legitimate for personal automation — here is how — and the audit flags that tell you when a tool crossed from 'uses' into 'lives in' the scheduler.
A 30-line registry audit script that's provably read-only
Write-hosting style, zero Set-* calls — and a structure that lets a reviewer verify safety by grep alone. For teams that need a record, not a refactor.
Why 'create a restore point first' is no longer a safety plan
System Restore Protection is off by default on many Windows 10/11 installs and needs admin to enable. A better recovery story for per-account tweaks exists. Here's what it is.
Emit JSON like you're going to share it — support-bundle data hygiene
A diagnostic bundle should be evaluatable before it's shared. The PowerShell rules: fixed fields, computed summaries, explicit exclusions, and a preview step.
Progress heartbeats for long scans, bounded correctly
Silent long loops teach users that tools hang. A heartbeat per N items with a running tally is 5 lines of code and changes everything about how trustworthy a scan feels.
A cancellable lengthy operation in 6 lines
Ctrl-C isn't cancellation; it's a kill. Real cancellation responds mid-iteration, cleans up partial state, and reports what completed. The minimal working shape.
Measure-Command results worth quoting
A benchmark without iterations, warmth and resolution notes is a number in search of a story. The 60-second guide to timings you can defend.
Prove what changed: registry snapshot diffing anyone can run
Before-and-after exports plus Compare-Object give you ISO-grade evidence for whatever tweaked your system. The two-command technique that closes every argument.
Dismount components cleanly when a scan ISN'T your process: flocks, retries, and backoff
Good scripts treat sharing violations as expected load. The retry-with-backoff pattern, and when the honest answer is 'skip it' instead of retry harder.
HungAppTimeout and WaitToKillAppTimeout: shutdown speed, honestly
Two values decide how long Windows waits for apps at logoff. Shorter is snappier — until you lose unsaved work. The measured trade-off with documented defaults.
ForegroundFlashCount: the blinking-taskbar setting nobody calibrates
Default is 7 flashes; stock Windows aggression level: maximum subtle. When to lower it and what breaks (nothing) when you do.
ListviewShadow & ListviewAlphaSelect: the invisible 60Hz work
Explorer icon shadows and translucent selection rectangles look free until you're on integrated graphics remoting in. Two DWORDs, instant measure, honest revert.
Why 'add an AV exclusion' is the reddest flag in tuning
A performance tool that tells you to exclude folders from Defender has moved the cost of its poor code onto your threat model. Under the hood of the ask.
Why this preview is unsigned on purpose (and what would change if it weren't)
Publisher certificates cost money, custody discipline, and contractual identity. The preview's deal: you get the SHA-256 for every candidate, publicly, before install.
Journaling beats 'AI suggestions' when something goes wrong
When an action fails, a record of exactly what changed is worth more than any model's best guess at repair. On building undo that survives even your forgetfulness.
Allowlist-only export: the support bundle that can't overshare
A bundle exporter that accepts arbitrary paths is an exfiltration API with a JSON smile. The fix is structural: compile-time fixed fields, forbidden by type.
'No telemetry' is testable — here's how we'd prove it on your machine
Claims about network silence are falsifiable with built-in Windows tooling and one hour of time. A practical verification recipe you can run against this preview verbatim.
The real cost of UAC prompts isn't the click — it's the scope they imply
Every elevation prompt is a small contract signing: machine-scope access to run one action. Count them, and read them; a tool asking three times already told you its architecture.
Why support bundles keep failing the password-manager sniff test (by design)
Any export flow that ships full Documents, AppData or Desktop paths to a stranger is one autocomplete away from catastrophe. The sane bounds around support data.
Stop defragmenting your SSD — and the one maintenance you should run anyway
'Defrag' from 2005 folklore does active harm to flash wear budgets. What Windows already runs for SSDs, and where tweaking ends vs snake oil begins.
Your registry is not slow because it's big
A 600 MB registry loads its hot pages in milliseconds on modern storage. The registry-size myth: origin, measurement, and what (if anything) actually degrades with bloat.
The honest way to make Setup nags stop: don't run Setup again
Trial banners, driver-update offers, and 'Pro' prompts only appear because something runs at sign-in to show them. The pattern detective work to kill the process, reverably.
Where boot time actually goes: a measurement tour instead of commandments
Instead of 'turn off X', learn to read Event ID 100 and friends, arming you to fix YOUR machine's boot, not a forum's imaginary one.
'Windows uses all my RAM' and other Task Manager misunderstandings
Available is not free; cached is not used; compression is not a leak. The five reading errors that drive bad tuning purchases, and the mental model that fixes them.
The Advertising ID: one documented bit, off the right way
The ad ID your apps use for cross-app tracking lives in one per-account value with a documented default. The right off — and the wrong ways that fool the UI.
Tailored Experiences: the least-clicked toggle that decides what diagnostic data becomes
Off means your diagnostic data can't drive personalized tips and suggestions. The value name, what downstream features it gates, and why it's a policy-shaped decision.
Disabling consumer suggestions properly: the policy value with 'absent' semantics
CloudContent's DisableConsumerFeatures lives in a Policies branch where default = absent. Restore-by-delete semantics are the difference between clean and cosmetic privacy toggles.
The Settings privacy dashboard mapped to the actual registry values
Every Settings toggle you flip lands on a documented value. A mechanical mapping for people who prefer evidence over UI tours.
ContentDeliveryManager: the quiet module behind 'suggested' tiles
The per-user driver for content placements has its own subtree with a pattern: a dozen cousins that each map to something you've seen. Navigating it without breaking the shell.
Activity history off, responsibly
Timeline's off switch is per-account and respected instantly; what you lose, what you keep, and why cloud upload is a separate decision.
A diagnostic app that respects you asks before it inventories
Hardware inventory reads look harmless — until you realize per-machine identifiers are a fingerprint. What a scoped scan should leave on the floor.
'Local-first' — a checklist instead of a marketing adjective
Five verifiable statements that separate a tool that is local-first from one that merely can't prove otherwise. Your verification recipe against any claim in this category.
A red-flag field guide for 'PC speedup' product pages
Seven shipping-page claims, restated in English, with what the honest product would say instead. Print it; evaluate trialware against it; watch the pattern match in real time.
Tweak debt: why every change should come with its exact undo
A machine that accumulated forty undocked tweaks is undebuggable — not from any single change, but from the lost map. The tweak-as-loan model.
Case file: the cleanup that broke Start (and the three rules that prevent every version of it)
A composite incident from public support threads: an eager cleaner, an AppData sweep, and a shell that wouldn't come back. Read the failure tree before trusting any delete loop.
'Tuning' vs 'optimizing': pick vendors by the verbs they use
Vocabulary leaks intent. A field guide to which words correlate with documented actions, and which ones correlate with magic beheld only at purchase.
Before the download: verifying a vendor in 10 minutes flat
The pre-install checklist about the *organization*, not the binary: update history, policy documents, signed communications, and the Paper-Trail Test.
The whole workflow: hash-verify a download end to end
From vendor page to first launch: PowerShell, an explicit compare, and the policy that makes mismatches a hard stop. Short, boring, permanent.
A disposable VM is the best test bench a $0 budget buys
Hyper-V ships with Windows Pro for exactly this. Launch, install, shoot-from-the-hip evaluation, kill; zero trace on the host. The whole recipe, including the sane file-transfer path.
Decoding startup approval blobs from the shell — a tiny walkthrough tool
A paste-and-run PowerShell snippet that turns 'Disabled in Task Manager since June' back into verifiable bytes. Compacts the whole blob post into code.
HKCU, exactly: where 'your settings' actually live
HKEY_CURRENT_USER isn't a magic alias — it's your user hive file mounted to a visible root. The 60-second model that clears up thirty years of registry confusion.
HKLM: the hive where mistakes factory-ship
HKEY_LOCAL_MACHINE is machine state: drivers, services, security policy. Writes require admin and survive every user. Read it freely; edit it rarely.
Registry Editor for people who intend not to change anything
regedit's dangerous; the read-only workflow inside it is indispensable. Favorites, find-through-keys, and export-to-proof — the careful path through the GUI.
Task Manager: the four tabs that answer 90% of 'why is it slow'
Processes lies to you by default sort; Details' columns hide the real answers; App history tracks per-user resource cost. A Socratic tour of the built-in diagnostic.
Autoruns without tears: the checklist approach to the deep end
Autoruns exposes every persistence surface Windows has — hundreds of entries, many paths obsolete-but-listed. The choreographed way to use the tool without disabling your soundcard.
Auditing background updaters with winget and nothing else
List installed apps, detect auto-updaters by behavior, and decide containment per package — using the package manager Microsoft ships.
The clean-uninstall checklist: what 'completely removed' actually means
Uninstall criminals leave signatures behind. Each class of leftover has a find-method; the full sweep takes 6 minutes and it's fully offline.
Settings app vs registry: what each layer forgives
The Settings UI and regedit are two faces over the same values — but one validates and one trusts you. Learn which to reach for and when — and how to document the difference.
Comments sections, SEO and the static-site trade we made
Everything on this site is static files at the edge. No comments, no tracking pixels, no analytics SDK. The reasoning is the product promise, compiled.
A privacy policy you can read is a law for product decisions
Most privacy text is contract camouflage. If yours enumerates what never leaves the box, every feature request becomes a compliance test — which is the point.
How to read a preview announcement like an engineer
Every preview post is a promise inventory. The lines that matter: target floor, scope guarantees, gate evidence. Here's the speedrun of what to look for in ours and anyone else's.
Candidate, preview, signed release: the trust ladder, climbed deliberately
'Candidate' is an artifact that may become a release iff gates pass. The ladder exists so that every level of trust is earned — by tests, or by the signature someone pays for.
Windows 10 after October 2025: the supported-floor question every tool must answer
With 10's EOL, per-user tools inherit a matrix question: support window or not? How the floor is computed, and why in-support OS claims need policy evidence, not vibes.
Upgrade vs repair vs reinstall: the MSI trio nobody reads the docs for
The three ways an installer can touch an existing installation, the RemoveExistingProducts timing trap, and why file-version overwrites behave the way they do.
OneDrive files-on-demand: the reparse-point trap in content scans
'12.4 GB in Downloads' that materializes as a 4-hour sync is a placeholder misread. How reparse points cross-count cloud storage into local reports.
Notification creep is a startup problem wearing a UI skin
Every toast-notifying app is a startup entry with opinions. Fixing the feeling “too noisy” is half notifications, half startup approvals — here's the honest recalibration.
Preview build hygiene: what makes a technical preview worth your Actual disk space
Not 'features.' Instead: signed changelogs, hashes per candidate, eval windows and a kill-switch on persistence. The test is: what happens on a early release's worst day?
The per-account traditional context menu in Windows 11
Windows 11's condensed right-click menu hides verbs under 'Show more options.' There's a documented per-user way to restore the classic one — with the exact restore path.
Apps and shell themes diverge deliberately: what each listens to
AppsUseLightTheme drives app surfaces; SystemUsesLightTheme drives the shell. Setting them independently is a feature — with documented restore.
Reading settings through three lenses: UI, registry, API
The Settings UI, the registry value, and the Windows API all three exist — and disagree on edge cases. Using the conjunction, not whichever is fastest, for machine stories.
'Restart required' loops after tuning tools: a diagnostic path
When the shell keeps asking to reboot and tools report 'pending restart,' don't click blindly. The three pending-restart sources and how to bound them.
Reading Windows Error Reporting history like a witness, not a believer
'Application stopped working' dialogs write WER events with stable fields. The filter/view discipline that turns Event Viewer from a wall of noise into a case file.
Checking whether your Windows is still serviced — in 20 seconds
win + winver + one command checks build vs floor; policy rightsizing without ambiguity. The steady script for a question that changes meaning every October.
Proving a tool left no service: the post-uninstall audit in four queries
'We added nothing' is testable after uninstall. The four locations to check, what each shows, and what suffices as proof.
What hardware info a diagnostic app should — and shouldn't — surface
CPU class: yes. Disk health (SMART): outside user-scope justifiable scope. Serial numbers: never. Drawing the correct lines for support-bundle data.
Wow6432Node once and for all: the 32-bit view of a 64-bit registry
Redirection keeps 32-bit apps behaving like it's 2002 in machine scope. Where the view applies, where it doesn't, and how to audit both sides without confusion.
Userinit and Shell keys: the logon launch chain most auditors skip
Before Run keys fire, Winlogon runs Userinit, which starts the shell itself. Understanding the full chain locates the persistence almost no tool layer thinks to hide at.
Quick Access, frequent folders and the cleanup of an Explorer audit trail
Explorer keeps usage data in binary blobs under your profile. Where it lives, what it stores, and how to clear it without collateral.
Verifying an MSI door-to-door: from download to live process
Hash the file, install with a log, read the log for actual actions, confirm scope in Registry afterward. The whole chain of verification, no special tools.
The preview, the public release, and what your evaluation actually decides
What stays fixed between now and the signed release: UpgradeCode, scope guarantees, the safety invariants. What can change: features, cover art, the default preset mix.