Taming Windows app permissions after every fresh install

Anyone who regularly installs Windows—whether setting up a new workstation, rebuilding a test laptop, or spinning up a fresh development virtual machine—knows the ritual that follows the first desktop boot.

Before you can actually do any real work, you have to spend twenty minutes hunting through the Settings app to rein in permissions.

Out of the box, Windows leaves dozens of capability levers wide open or in an ambiguous “not set” state where the operating system decides on your behalf. Built-in apps and third-party utilities can request background activity, listen through microphones, access webcams, poll location sensors, and read personal folders.

The pain of the 30-click maze

Managing these permissions in standard Windows 11 is remarkably tedious. There is no central dashboard. Instead, you are forced to navigate to Settings → Privacy & security, scroll through twenty different sub-menus—Camera, Microphone, Location, Contacts, Background apps, Radios, Diagnostic data—and click into each one individually.

Once inside each screen, you have to scroll through lists of installed applications, toggling sliders one by one. If you have fifty installed apps and want to ensure none of them can quietly use your microphone or poll your GPS in the background, you are looking at hundreds of repetitive clicks.

Repeat that process across multiple physical machines or half a dozen disposable VMs for testing, and it quickly becomes unbearable.

Why random “debloater” scripts are dangerous

Because this workflow is so frustrating, many developers and sysadmins resort to third-party “Windows debloater” scripts found on GitHub or tech forums.

While tempting, running opaque PowerShell scripts that blast registry keys with elevated privileges is risky:

• They act as a blunt hammer: Many scripts indiscriminately wipe keys or disable core Windows services, breaking legitimate system features, updates, or application dependencies.
• No visibility before writing: You rarely get to see an exact diff of what the script intends to change before it modifies your system.
• No way to undo: If a script breaks something a week later, there is usually no journal or rollback mechanism. Your only recourse is System Restore or reinstalling Windows.

I wanted something far safer: a dedicated utility that gives me total visibility over every permission on the machine, lets me audit and adjust them in bulk, and guarantees that every write is previewed, recorded, and reversible.

So I wrote WinLevers.

How WinLevers works

WinLevers is a native desktop application built with C# on .NET 10 and WinUI 3. It scans the machine’s actual capability store and lays out the entire system under a single, searchable interface:

1. One view for all permissions: Pick a permission in the sidebar—Microphone, Webcam, Location, Background Access, Notifications, or even the GPU power preference—and every application on your machine appears in a clean table. You can see who published it, its current permission state (Allowed, Denied, or Not Set), and when it last touched that sensor.
2. Bulk filtering and actions: Filter by app name, publisher, executable path, or state. Want to deny microphone access to every app that hasn’t run in the last 30 days? Or revoke location permissions from all packaged utilities at once? Tick the rows, select your target state, and apply them together.
3. The Privacy Advisor: If you don’t want to comb through individual settings, the Privacy Advisor groups the highest-consequence capabilities (watch, listen, locate, or read files) into clear risk bands. It tells you exactly which apps currently hold those rights and offers one-click bulk actions to deny unneeded access.
4. Previews before touching anything: WinLevers never writes to the registry silently. Every bulk edit, profile application, or advisor recommendation opens a comprehensive preview dialog showing the exact keys and values that will change.
5. Atomic snapshots and rollback history: Before writing a single byte, WinLevers flushes a full JSON snapshot of affected keys to disk. Every write is committed to a local SQLite journal in %LOCALAPPDATA%, capturing the previous state. If an app breaks or you change your mind, you can open History and revert that exact batch with one click.
6. Machine portability via profiles: You can export your tuned permission baseline as a clean profile file. When setting up a new computer or booting a fresh VM, you just open WinLevers, load your profile, review the preview, and configure the entire box in seconds.

Keeping it safe and local

From day one, WinLevers was built under strict constraints:

• Zero network code: There is no telemetry, no update ping, and no background reporting. The app cannot talk to the internet, and nothing about your installed software or machine identity ever leaves your computer.
• User-level scope: It operates strictly within HKEY_CURRENT_USER—the exact same user-level registry store that Windows Settings modifies. It never touches machine-wide security keys or requires administrator rights for normal operation.

Now open source on GitHub

I originally built WinLevers to solve my own irritation with repetitive Windows setups and virtual machine maintenance. It saved me hours of clicking and gave me confidence that my fresh environments weren’t leaking data or running unnecessary background tasks.

Because it proved so useful to me and a few friends who tested it, I decided to release it as free and open-source software under the MIT license.

If you are tired of clicking through dozens of privacy sub-menus after every fresh Windows install, you can read the documentation on the WinLevers project page, or grab the source code and build it directly from GitHub.