WTools feedback/suggestions

[Wagnard]

Can you please give us a checklist in the Store AppX Manager so we can uninstall multiple apps in one go instead of having to do it one at a time?

Thank you

Ill do that.

For the previous request about ipconfig. you may want to check another app I have called IP Changer. I may satisfy your need.

[okiedokie400]

Consider add 'Clean Shellbags' to file cleaner.

"Shellbags are hidden Windows registry keys that track your folder viewing preferences, such as window size, icon layout, and view mode (e.g., list vs. details). They are primarily used by digital forensic investigators to reconstruct user activity and uncover deleted, hidden, or external directories.

From an IT security and digital forensics standpoint, Shellbags are highly valuable because they are persistent. Even if a user deletes a folder, unplugs a USB drive, or clears their recent history, the Shellbag entry for that folder usually remains in the Windows registry."

I have been doing it manually it is delete 4 keys-

HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags

HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\BagMRU

HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags

HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU

They come back automatically so no further steps required.
=================================================================

Consider adding cleaner for Windows Defender files. There are several files that can be cleaned, like logs and temp files, but it must be done in safe mode. Copy however Bleachbit does this.

[Wagnard]

Consider add 'Clean Shellbags' to file cleaner.

"Shellbags are hidden Windows registry keys that track your folder viewing preferences, such as window size, icon layout, and view mode (e.g., list vs. details). They are primarily used by digital forensic investigators to reconstruct user activity and uncover deleted, hidden, or external directories.

From an IT security and digital forensics standpoint, Shellbags are highly valuable because they are persistent. Even if a user deletes a folder, unplugs a USB drive, or clears their recent history, the Shellbag entry for that folder usually remains in the Windows registry."

I have been doing it manually it is delete 4 keys-

HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags

HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\BagMRU

HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags

HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU

They come back automatically so no further steps required.
=================================================================

Consider adding cleaner for Windows Defender files. There are several files that can be cleaned, like logs and temp files, but it must be done in safe mode. Copy however Bleachbit does this.

Thanks, I'll consider adding this.

[okiedokie400]

Potential suggestion for 'Optimize' section with other telemetry disabling.

GDID was a big tech privacy story over the past week. https://www.windowslatest.com/2026/07/1 ... -captures/

Test and copy the mitigations from this repo
First read - https://windowsforum.com/threads/gdid-o ... it.436048/

https://github.com/Korben00/no-gdid

it is to block
'dds.microsoft.com'
'fd.dds.microsoft.com'
'aad.cs.dds.microsoft.com'
'cdpcs.access.microsoft.com'
'geo.prod.do.dsp.mp.microsoft.com'

it is to disable these services
CDPSvc -> Disabled (via Set-Service)"
DoSvc -> Disabled (via registry Start=4; SCM denies Set-Service)"
CDPUserSvc -> Disabled (stop first in services menu, then set registry Start=4)"

https://github.com/SmtimesIWndr/gdid-reversal
Reducing the exposure
The GDID exists because your device is registered into the Microsoft Account device graph and the Connected Devices Platform keeps it synced. To cut it back:
Kill the Connected Devices Platform (CDPSvc, CDPUserSvc) and turn off Activity History (Settings, Privacy, Activity history) to stop the graph sync and the activity uploads.

I have been testing some of these mitigations - blocking those addresses, and disabling both CDP services. It says it breaks Phone Link / "Continue on PC", and nearby sharing, but I dont use those functions so I have not noticed any issues with having those services disabled. CDP services seem to be the primary agreed upon services to disable to break functionality of GDID. PC still updates normally.

[Wagnard]

Potential suggestion for 'Optimize' section with other telemetry disabling.

GDID was a big tech privacy story over the past week. https://www.windowslatest.com/2026/07/1 ... -captures/

Test and copy the mitigations from this repo
First read - https://windowsforum.com/threads/gdid-o ... it.436048/

https://github.com/Korben00/no-gdid

it is to block
'dds.microsoft.com'
'fd.dds.microsoft.com'
'aad.cs.dds.microsoft.com'
'cdpcs.access.microsoft.com'
'geo.prod.do.dsp.mp.microsoft.com'

it is to disable these services
CDPSvc -> Disabled (via Set-Service)"
DoSvc -> Disabled (via registry Start=4; SCM denies Set-Service)"
CDPUserSvc -> Disabled (stop first in services menu, then set registry Start=4)"

https://github.com/SmtimesIWndr/gdid-reversal
Reducing the exposure
The GDID exists because your device is registered into the Microsoft Account device graph and the Connected Devices Platform keeps it synced. To cut it back:
Kill the Connected Devices Platform (CDPSvc, CDPUserSvc) and turn off Activity History (Settings, Privacy, Activity history) to stop the graph sync and the activity uploads.

I have been testing some of these mitigations - blocking those addresses, and disabling both CDP services. It says it breaks Phone Link / "Continue on PC", and nearby sharing, but I dont use those functions so I have not noticed any issues with having those services disabled. CDP services seem to be the primary agreed upon services to disable to break functionality of GDID. PC still updates normally.

Added most stuff that I consider safe to do.
For the Windows Defender I may not add this one as interacting with this may flag WTools.

[okiedokie400]

That is fine not to include the Defender cleaner. Sending people to safe mode to clean something that 99% of people already don't care about is probably a step too far as well. If you ever do go farther into telemetry type stuff it would be useful to rip many of the settings from O&O Shutup10 into WTools so I'd never have to use the O&O software again. I use Raphire Debloat, O&O Shutup, and WTools to optimize fresh Windows installations. Ultimately, eventually, it would be beneficial to see as much of this into an all-in-one tool as possible. Your tool is the best one available that covers multiple things in one program. Thanks for your works.

[okiedokie400]

Hello I have found more information on Shellbags.
I found exact paths Bleachbit is using -
https://github.com/bleachbit/bleachbit/ ... 3c3abb2a03
https://github.com/bleachbit/bleachbit/ ... plorer.xml
They seem to be basing that on this article -
https://www.ghacks.net/2014/06/09/remov ... s-privacy/ per
https://github.com/bleachbit/bleachbit/issues/353


Therefore I am not 100% sure if the 4 keys I said about are the only ones needed.(as per https://www.thewindowsclub.com/how-to-r ... on-windows) Deleting them seems to work because it resets my things, however we can't be sure we are not missing something because bleachbit removes more of them. I dont think any of this is officially documented by Microsoft as to which exact keys are required to be removed. What do we do with this information? I don't know.

Side note - Disabling CDP services may also provide a minimal performance benefit. During my testing - It seems to reduce overall CPU spikes based on my graphs. However, this would need to be verified by others, as it could be unrelated placebo.

[mrdoc22]

Just downloaded and testing "Wtools v1.0.9.1" which is crashing for me on 'Search Registry for Issues',
when selecting "interface issues" and "Class issues" not on "installer issues".

Name of the faulty program: WTools.exe, version: 1.0.9.1, timestamp: 0x6a3ed1eb
Name of the faulty module: KERNELBASE.dll, version: 10.0.26100.8875, timestamp: 0xca32cd54
Exception code: 0xe0434352
Error offset: 0x00000000000c1ada
ID of the faulty process: 0x32AC
Start time of the faulty program: 0x1DD27844D61DDBE
Path to the faulty program: \\nas3\Public\System\Tweaks\WTools\WTools.exe
Path to the faulty module: C:\WINDOWS\System32\KERNELBASE.dll

Application: WTools.exe
CoreCLR Version: 10.0.1026.32716
.NET Version: 10.0.10
Description: The process was terminated due to an unhandled exception.
Exception Info: System.IO.FileNotFoundException:
File name: 'System.Threading.Tasks.Parallel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'
at WTools.Data.CleanupEngine.ScanRegistryInterface(RegistryTabViewModel viewModel)
at WTools.Data.CleanupEngine.ScanRegistryInterface(RegistryTabViewModel viewModel)
at WTools.Data.CleanupEngine.<>c__DisplayClass5_0.<SearchRegAsync>b__3() in G:\wpf\WTools\Wtools.Data\CleanupEngine.cs:line 56
at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, Object state)
--- End of stack trace from previous location ---
at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, Object state)
at System.Threading.Tasks.Task.ExecuteWithThreadLocal(Task& currentTaskSlot, Thread threadPoolThread)
--- End of stack trace from previous location ---
at WTools.Data.CleanupEngine.<>c__DisplayClass5_0.<<SearchRegAsync>b__0>d.MoveNext() in G:\wpf\WTools\Wtools.Data\CleanupEngine.cs:line 69
--- End of stack trace from previous location ---
at WTools.Data.Win32.ImpersonateUser.<>c__DisplayClass11_0.<<RunImpersonatedSystemAsync>b__0>d.MoveNext() in G:\wpf\WTools\Wtools.Data\Win32\ImpersonateUser.cs:line 155
--- End of stack trace from previous location ---
at WTools.Data.Win32.ImpersonateUser.RunImpersonatedSystemAsync(Func`1 action) in G:\wpf\WTools\Wtools.Data\Win32\ImpersonateUser.cs:line 152
at WTools.Data.CleanupEngine.SearchRegAsync(RegistryTabViewModel viewModel) in G:\wpf\WTools\Wtools.Data\CleanupEngine.cs:line 46
at WTools.Data.ViewModels.RegistryTabViewModel.ExecuteSearchRegistryAsync() in G:\wpf\WTools\Wtools.Data\ViewModels\RegistryTabViewModel.cs:line 395
at WTools.Data.ViewModels.RelayCommand.Execute(Object parameter) in G:\wpf\WTools\Wtools.Data\ViewModels\RelayCommand.cs:line 88
at System.Threading.Tasks.Task.<>c.<ThrowAsync>b__124_0(Object state)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate callback, Object args, Int32 numArgs)
at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object source, Delegate callback, Object args, Int32 numArgs, Delegate catchHandler)
at System.Windows.Threading.DispatcherOperation.InvokeImpl()
at MS.Internal.CulturePreservingExecutionContext.CallbackWrapper(Object obj)
at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state)
--- End of stack trace from previous location ---
at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state)
at System.Windows.Threading.DispatcherOperation.Invoke()
at System.Windows.Threading.Dispatcher.ProcessQueue()
at System.Windows.Threading.Dispatcher.WndProcHook(IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam, Boolean& handled)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate callback, Object args, Int32 numArgs)
at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object source, Delegate callback, Object args, Int32 numArgs, Delegate catchHandler)
at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam)
at MS.Win32.UnsafeNativeMethods.DispatchMessage(MSG& msg)
at System.Windows.Threading.Dispatcher.PushFrameImpl(DispatcherFrame frame)
at System.Windows.Application.RunDispatcher(Object ignore)
at System.Windows.Application.RunInternal(Window window)
at WTools.App.Main()


Name of the faulty program: WTools.exe, version: 1.0.9.1, timestamp: 0x6a3ed1eb
Name of the faulty module: KERNELBASE.dll, version: 10.0.26100.8875, timestamp: 0xca32cd54
Exception code: 0xe0434352
Error offset: 0x00000000000c1ada
ID of the faulty process: 0x13C
Start time of the faulty program: 0x1DD2783997756C6
Path to the faulty program: \\nas3\Public\System\Tweaks\WTools\WTools.exe
Path to the faulty module: C:\WINDOWS\System32\KERNELBASE.dll

Application: WTools.exe
CoreCLR Version: 10.0.1026.32716
.NET Version: 10.0.10
Description: The process was terminated due to an unhandled exception.
Exception Info: System.IO.FileNotFoundException:
File name: 'System.Threading.Tasks.Parallel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'
at WTools.Data.CleanupEngine.ScanRegistryHKCR_CLSID(RegistryTabViewModel viewModel)
at WTools.Data.CleanupEngine.ScanRegistryHKCR_CLSID(RegistryTabViewModel viewModel)
at WTools.Data.CleanupEngine.<>c__DisplayClass5_0.<SearchRegAsync>b__2() in G:\wpf\WTools\Wtools.Data\CleanupEngine.cs:line 51
at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, Object state)
--- End of stack trace from previous location ---
at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, Object state)
at System.Threading.Tasks.Task.ExecuteWithThreadLocal(Task& currentTaskSlot, Thread threadPoolThread)
--- End of stack trace from previous location ---
at WTools.Data.CleanupEngine.<>c__DisplayClass5_0.<<SearchRegAsync>b__0>d.MoveNext() in G:\wpf\WTools\Wtools.Data\CleanupEngine.cs:line 69
--- End of stack trace from previous location ---
at WTools.Data.Win32.ImpersonateUser.<>c__DisplayClass11_0.<<RunImpersonatedSystemAsync>b__0>d.MoveNext() in G:\wpf\WTools\Wtools.Data\Win32\ImpersonateUser.cs:line 155
--- End of stack trace from previous location ---
at WTools.Data.Win32.ImpersonateUser.RunImpersonatedSystemAsync(Func`1 action) in G:\wpf\WTools\Wtools.Data\Win32\ImpersonateUser.cs:line 152
at WTools.Data.CleanupEngine.SearchRegAsync(RegistryTabViewModel viewModel) in G:\wpf\WTools\Wtools.Data\CleanupEngine.cs:line 46
at WTools.Data.ViewModels.RegistryTabViewModel.ExecuteSearchRegistryAsync() in G:\wpf\WTools\Wtools.Data\ViewModels\RegistryTabViewModel.cs:line 395
at WTools.Data.ViewModels.RelayCommand.Execute(Object parameter) in G:\wpf\WTools\Wtools.Data\ViewModels\RelayCommand.cs:line 88
at System.Threading.Tasks.Task.<>c.<ThrowAsync>b__124_0(Object state)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate callback, Object args, Int32 numArgs)
at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object source, Delegate callback, Object args, Int32 numArgs, Delegate catchHandler)
at System.Windows.Threading.DispatcherOperation.InvokeImpl()
at MS.Internal.CulturePreservingExecutionContext.CallbackWrapper(Object obj)
at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state)
--- End of stack trace from previous location ---
at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state)
at System.Windows.Threading.DispatcherOperation.Invoke()
at System.Windows.Threading.Dispatcher.ProcessQueue()
at System.Windows.Threading.Dispatcher.WndProcHook(IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam, Boolean& handled)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate callback, Object args, Int32 numArgs)
at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object source, Delegate callback, Object args, Int32 numArgs, Delegate catchHandler)
at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam)
at MS.Win32.UnsafeNativeMethods.DispatchMessage(MSG& msg)
at System.Windows.Threading.Dispatcher.PushFrameImpl(DispatcherFrame frame)
at System.Windows.Application.RunDispatcher(Object ignore)
at System.Windows.Application.RunInternal(Window window)
at WTools.App.Main()

[Wagnard]

Just downloaded and testing "Wtools v1.0.9.1" which is crashing for me on 'Search Registry for Issues',
when selecting "interface issues" and "Class issues" not on "installer issues".

I think I know, you ran WTools from a NAS on a \\ location. try to install it locally, or at least run it from a driver with a letter.
I'll try to work around that in the future.

[mrdoc22]

Just downloaded and testing "Wtools v1.0.9.1" which is crashing for me on 'Search Registry for Issues',
when selecting "interface issues" and "Class issues" not on "installer issues".

I think I know, you ran WTools from a NAS on a \\ location. try to install it locally, or at least run it from a driver with a letter.
I'll try to work around that in the future.

Hi
I am running all my tools from my network drive "Y:" which is mapped to a share on a NAS.

In v1.0.9.2 it's working now, just not "Orphanded firewall rules".


I’ve just noticed that you have added "Orphanded firewall rules", now Wtools is freezing when I click "OK" and I am geting this in the logs:

wtools error.png

{
"Log_Type": 2,
"Time": "2026-08-12T15:36:10.5213038+02:00",
"Action_Type": 7,
"Message": [
"Command failed: FileNotFoundException \u2014 \r\n at WTools.Data.CleanupEngine.ScanFirewallRules(RegistryTabViewModel viewModel)\r\n at WTools.Data.CleanupEngine.ScanFirewallRules(RegistryTabViewModel viewModel)\r\n at WTools.Data.CleanupEngine.\u003C\u003Ec__DisplayClass5_0.\u003CSearchRegAsync\u003Eb__7() in G:\\wpf\\WTools\\Wtools.Data\\CleanupEngine.cs:line 83\r\n at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, Object state)\r\n--- End of stack trace from previous location ---\r\n at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, Object state)\r\n at System.Threading.Tasks.Task.ExecuteWithThreadLocal(Task\u0026 currentTaskSlot, Thread threadPoolThread)\r\n--- End of stack trace from previous location ---\r\n at WTools.Data.CleanupEngine.\u003C\u003Ec__DisplayClass5_0.\u003C\u003CSearchRegAsync\u003Eb__1\u003Ed.MoveNext() in G:\\wpf\\WTools\\Wtools.Data\\CleanupEngine.cs:line 86\r\n--- End of stack trace from previous location ---\r\n at WTools.Data.Win32.ImpersonateUser.\u003C\u003Ec__DisplayClass11_0.\u003C\u003CRunImpersonatedSystemAsync\u003Eb__0\u003Ed.MoveNext() in G:\\wpf\\WTools\\Wtools.Data\\Win32\\ImpersonateUser.cs:line 155\r\n--- End of stack trace from previous location ---\r\n at WTools.Data.Win32.ImpersonateUser.RunImpersonatedSystemAsync(Func\u00601 action) in G:\\wpf\\WTools\\Wtools.Data\\Win32\\ImpersonateUser.cs:line 152\r\n at WTools.Data.CleanupEngine.SearchRegAsync(RegistryTabViewModel viewModel) in G:\\wpf\\WTools\\Wtools.Data\\CleanupEngine.cs:line 58\r\n at WTools.Data.ViewModels.RegistryTabViewModel.ExecuteSearchRegistryAsync() in G:\\wpf\\WTools\\Wtools.Data\\ViewModels\\RegistryTabViewModel.cs:line 396\r\n at WTools.Data.ViewModels.RelayCommand.Execute(Object parameter) in G:\\wpf\\WTools\\Wtools.Data\\ViewModels\\RelayCommand.cs:line 98"
],
"MessageText": "Command failed: FileNotFoundException \u2014 \r\n at WTools.Data.CleanupEngine.ScanFirewallRules(RegistryTabViewModel viewModel)\r\n at WTools.Data.CleanupEngine.ScanFirewallRules(RegistryTabViewModel viewModel)\r\n at WTools.Data.CleanupEngine.\u003C\u003Ec__DisplayClass5_0.\u003CSearchRegAsync\u003Eb__7() in G:\\wpf\\WTools\\Wtools.Data\\CleanupEngine.cs:line 83\r\n at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, Object state)\r\n--- End of stack trace from previous location ---\r\n at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, Object state)\r\n at System.Threading.Tasks.Task.ExecuteWithThreadLocal(Task\u0026 currentTaskSlot, Thread threadPoolThread)\r\n--- End of stack trace from previous location ---\r\n at WTools.Data.CleanupEngine.\u003C\u003Ec__DisplayClass5_0.\u003C\u003CSearchRegAsync\u003Eb__1\u003Ed.MoveNext() in G:\\wpf\\WTools\\Wtools.Data\\CleanupEngine.cs:line 86\r\n--- End of stack trace from previous location ---\r\n at WTools.Data.Win32.ImpersonateUser.\u003C\u003Ec__DisplayClass11_0.\u003C\u003CRunImpersonatedSystemAsync\u003Eb__0\u003Ed.MoveNext() in G:\\wpf\\WTools\\Wtools.Data\\Win32\\ImpersonateUser.cs:line 155\r\n--- End of stack trace from previous location ---\r\n at WTools.Data.Win32.ImpersonateUser.RunImpersonatedSystemAsync(Func\u00601 action) in G:\\wpf\\WTools\\Wtools.Data\\Win32\\ImpersonateUser.cs:line 152\r\n at WTools.Data.CleanupEngine.SearchRegAsync(RegistryTabViewModel viewModel) in G:\\wpf\\WTools\\Wtools.Data\\CleanupEngine.cs:line 58\r\n at WTools.Data.ViewModels.RegistryTabViewModel.ExecuteSearchRegistryAsync() in G:\\wpf\\WTools\\Wtools.Data\\ViewModels\\RegistryTabViewModel.cs:line 396\r\n at WTools.Data.ViewModels.RelayCommand.Execute(Object parameter) in G:\\wpf\\WTools\\Wtools.Data\\ViewModels\\RelayCommand.cs:line 98"
}