How to set up a fresh Windows 11 install in the first hour

You've just switched on a new PC or reinstalled Windows 11. This guide takes you through the first hour, in an order that keeps you safe. You need an internet connection, the account you made during setup (the first account is always an administrator) and, ideally, an external drive. Allow about an hour, plus download time.

Before you start

You'll end up with an up-to-date Windows with the right drivers, a restore point, far fewer ads and unwanted apps, good free programs, an encrypted drive with its recovery key saved, and a backup.

This guide is for Windows 11 version 26H2, released on 29 September 2026; 25H2 is nearly identical. To check yours, press Windows key + R, type winver and press Enter. If it says 24H2, update now: 24H2 Home and Pro got their last security update on 13 October 2026.

Windows 10 support ended on 14 October 2025. Its Extended Security Updates (ESU) programme for home users was due to end on 13 October 2026, but Microsoft extended it in June 2026 to 12 October 2027.

Update Windows first

Updates bring most of your drivers with them, so they come first.

1. Click Start → Settings → Windows Update.
2. Click Check for updates. On a new PC this can take a while.
3. When asked, click Restart now.
4. Back in Windows Update, click Check for updates again. Repeat until it says You're up to date.
5. Click Advanced options, then Optional updates (under Additional options). The number beside it shows what's waiting.
6. Expand Driver updates and tick everything listed.
7. Click Download & install.
8. Restart when asked, then check once more.

No optional updates? Nothing to do. If an update keeps failing, restart and retry, or carry on and try later.

Drivers, explained simply

A driver is a small program that lets Windows use a piece of hardware. Get them in this order:

1. Windows Update, just done, covers most of them.
2. Your PC maker's support page for your exact model. Install what it lists for Windows 11, especially chipset, Wi-Fi, audio and touchpad drivers, which make things like gestures and function keys work properly. The model is on a sticker, or search Start for System Information and read System Model. Built your own? Use the motherboard maker's page.
3. Graphics, from the chip maker: NVIDIA App for NVIDIA GeForce, AMD Software: Adrenalin Edition for AMD Radeon, Intel Driver & Support Assistant for Intel. On a laptop, check the maker's page first, as some ship customised graphics drivers.

To see which graphics chip you have:

1. Right-click Start and choose Device Manager.
2. Click the arrow next to Display adapters.
3. Read the name. Many laptops list two, such as Intel and NVIDIA: install drivers for both.

Microsoft Basic Display Adapter, or a yellow warning sign on any device, means a driver is missing. If a new driver causes trouble, right-click the device, choose Properties, open the Driver tab and click Roll Back Driver.

Make a restore point

A restore point is a snapshot of Windows' system files, settings and programs; your documents aren't touched. Make one now, with your drivers in place, because the next step changes system settings.

1. Click Start, type Create a restore point and select it. System Properties opens on the System Protection tab.
2. Under Protection Settings, find the drive marked (System). If Protection says Off, select it and click Configure....
3. Choose Turn on system protection, move the slider to about 5% and click OK.
4. Click Create.... If it's greyed out, protection is still off: repeat steps 2 and 3.
5. Type a name such as Before debloat and click Create.
6. You should see The restore point was created successfully. Click Close.

To go back, press Windows key + R, type rstrui.exe and press Enter. Click Next, pick the restore point (tick Show more restore points if needed), then Next and Finish. If Windows won't start, it shows the blue recovery screen after a couple of failed attempts: choose Troubleshoot → Advanced options → System Restore. An encrypted drive may ask for its recovery key here.

Clear out the bloat

"Bloat" is what you didn't ask for: preinstalled apps and games, suggestions and ads in Start and Settings, Bing web results in Start search, Copilot, the widgets news board, OneDrive backup prompts and telemetry (usage data sent to Microsoft).

The safe switches in Settings

These are built in; to undo one, switch it back on.

• Settings → Personalization → Start: turn off Show recommendations for tips, shortcuts, new apps, and more. If your Start menu has the newer Recent section, you can turn that off here too.
• Settings → System → Notifications → Additional settings: untick Get tips and suggestions when using Windows and the other boxes.
• Settings → Privacy & security → General: turn every switch off (advertising ID, suggested content).
• Settings → Privacy & security → Diagnostics & feedback: turn off optional diagnostic data and Tailored experiences.
• Widgets: right-click the taskbar, choose Taskbar settings and turn Widgets off under Taskbar items.
• Unwanted apps: in Settings → Apps → Installed apps, click ... beside an app, then Uninstall. The Copilot app goes this way too.
• OneDrive: Settings → Accounts → Windows backup shows whether your folders are being copied to OneDrive. Free accounts get 5 GB; once that's full, the prompts to pay begin. Change it under Manage sync settings.

Bing results in Start search are harder to remove; both tools below handle them.

Win11Debloat: the quick clean-up

Win11Debloat is a free, open-source script that removes preinstalled junk and turns off ads, tips, telemetry, Bing in search, Copilot and Recall, with every change chosen in one window. Here is its command, exactly as the official README gives it:

& ([scriptblock]::Create((irm "https://debloat.raphi.re/")))

irm downloads the script from that address and the rest of the line runs it. As administrator, it can change settings for the whole PC, not just your account: that's why Windows asks first, and why you should paste the command only from the project's GitHub page, never from a video, comment or lookalike site.

1. Right-click Start, choose Terminal (Admin) and click Yes.
2. Paste the command with Ctrl+V and press Enter.
3. The script fetches its latest release from GitHub and opens a setup window. Red error text instead? Check you're online and pasted the whole line, then retry.
4. On the apps page, the usual junk is already ticked. Untick anything you use, such as Quick Assist (lets someone help you remotely), Sticky Notes, OneNote or Family Safety. Never tick Microsoft Store (hard to reinstall), Microsoft Edge (other apps can depend on it) or Windows Terminal (the script fails if it's running there).
5. On the settings page, the project's defaults are sensible: telemetry, tips, ads, Bing web search, Copilot, Recall and widgets off, file extensions shown. Leave the options that disable BitLocker encryption and Storage Sense unticked.
6. Review the summary, keep the restore point option on and confirm. The taskbar may vanish for a moment.
7. Restart the PC.

WinUtil (Chris Titus Tech's Windows Utility): the bigger toolbox

WinUtil (Chris Titus Tech's Windows Utility) (Chris Titus Tech's Windows Utility) also installs apps, changes update settings and repairs Windows. You don't need both tools. Its README command works the same way (iex runs what irm downloaded):

irm https://christitus.com/win | iex

1. Open Terminal (Admin) as above.
2. Paste the command and press Enter. A window opens with tabs including Install, Tweaks and Updates.
3. Open Tweaks and, under Recommended Selections, click Standard.
4. Read what's ticked; it includes Restore Point - Create. Untick Location Tracking - Disable if you use Find my device.
5. Click Run Tweaks, wait until it finishes, then restart.

Avoid the Advanced Tweaks - CAUTION section and the Updates tab: they can remove Microsoft Edge and OneDrive, or change how Windows updates.

What to keep, and how to undo

Never remove or disable Microsoft Store, Windows Security, Windows Update, App Installer (it runs winget (Windows Package Manager)), Microsoft Edge or your drivers.

• Win11Debloat: run it again and untick what you want back, or choose Restore backup from its Options menu to restore the registry backup it made.
• WinUtil (Chris Titus Tech's Windows Utility): tick a tweak and click Undo Selected Tweaks.
• Removed apps: reinstall them from the Microsoft Store.
• Anything badly wrong: use your restore point.

Install your programs in one go

With Ninite

Ninite makes one installer for all the programs you tick. It fetches the latest official versions, installs them in the background and says no to toolbars and bundled offers.

1. Open our Ninite page and follow the link to the site.
2. Tick the programs you want (see the table below).
3. Click Get Your Ninite to download a small installer.
4. Open it, click Yes and wait until it says it's finished. If an app fails, run it again.
5. Keep the installer: running it later updates the same apps.

It doesn't offer KeePassXC, Bitwarden or Tixati; use winget (Windows Package Manager) or their app pages.

With winget (Windows Package Manager)

winget (Windows Package Manager) is Windows' built-in command-line installer: one line per program, official installers only.

1. Right-click Start and choose Terminal (admin isn't needed).
2. Type winget search firefox and press Enter. The Id column shows each program's ID.
3. If asked to accept the source agreements (first time only), type Y and press Enter.
4. Type winget install --id Mozilla.Firefox -e and press Enter. The -e means exact match, so you get that package and not a lookalike. It ends with Successfully installed.

If Terminal says winget (Windows Package Manager) isn't recognised, update App Installer from the Microsoft Store. Then paste this starter set, confirming if Terminal warns about pasting several lines:

winget install --id Mozilla.Firefox -e
winget install --id 7zip.7zip -e
winget install --id VideoLAN.VLC -e
winget install --id SumatraPDF.SumatraPDF -e
winget install --id TheDocumentFoundation.LibreOffice -e
winget install --id KeePassXCTeam.KeePassXC -e
winget install --id Notepad++.Notepad++ -e
winget install --id Microsoft.PowerToys -e
winget install --id voidtools.Everything -e
winget install --id ShareX.ShareX -e

For Brave or Bitwarden, use Brave.Brave or Bitwarden.Bitwarden; others from the table are qBittorrent.qBittorrent, OBSProject.OBSStudio and Valve.Steam. Later, winget upgrade lists what's out of date, and this updates the lot:

winget upgrade --all

The essentials

All free, low-bloat and in our library:

Antivirus: the built-in Windows Security is enough for most people. Malwarebytes free is a good occasional second opinion: it scans only when you ask, and you can ignore its 14-day Premium trial.

PC cleaners: skip CCleaner and its rivals. Windows' Storage Sense does the safe part (temporary files, old Recycle Bin items); turn it on at Settings → System → Storage → Storage Sense.

Security and backup

Encryption and the recovery key

Encryption means a lost or stolen PC gives nothing away.

• Settings → Privacy & security → Device encryption: check it's On. It turns on automatically if you sign in with a Microsoft account, but not with a local account.
• No such page on Windows 11 Pro? Search Start for BitLocker, open Manage BitLocker and click Turn on BitLocker for drive C:.

Now save the 48-digit recovery key. Windows asks for it after some firmware updates or hardware changes, and in the recovery screen. Without it, nobody can recover your files, Microsoft included.

• Microsoft account: the key is stored there. On another device, open aka.ms/myrecoverykey, check it's listed and write it down.
• Manage BitLocker: click Back up your recovery key, choose Save to a USB flash drive, Save to a file or Print the recovery key, then Finish. Never save it on the encrypted drive itself.
• Any edition: in Terminal (Admin), run manage-bde -protectors -get C:; the key is the long number under Numerical Password.

Windows Hello

In Settings → Accounts → Sign-in options, choose PIN (Windows Hello), Fingerprint recognition (Windows Hello) or Facial recognition (Windows Hello) and click Set up. A PIN works only on this PC, so it's safer than your account password.

Microsoft account or local account?

Windows 11 setup pushes hard for a Microsoft account, and Microsoft keeps closing the ways round it. A Microsoft account backs up your recovery key and makes the Store, OneDrive and password resets easy, at the price of more prompts and closer ties to Microsoft. A local account keeps the PC to yourself, but the key and password are then your job. Our bootable USB guide shows how to install with a local account using a Rufus stick, and how to switch afterwards.

Back up your files

Keep at least one copy off the PC:

• File History: plug in an external drive, search Start for Control Panel, and under System and Security click Save backup copies of your files with File History, then Turn on. It copies your personal folders whenever the drive is connected. To get an older copy back, right-click the folder in File Explorer and choose Show more options → Restore previous versions.
• OneDrive: Settings → Accounts → Windows backup copies your Desktop, Documents, Pictures, Videos and Music to OneDrive (Microsoft account needed; 5 GB free).

Final checklist

• Windows Update says You're up to date, with no driver updates left.
• Graphics driver in; no yellow warnings in Device Manager.
• Restore point made before the clean-up.
• Settings switches done, one clean-up tool run, PC restarted.
• Programs installed, and the Ninite installer kept.
• Encryption on, and the recovery key saved away from the PC.
• Windows Hello PIN set.
• A backup running.

Once a month, run Windows Update and winget upgrade --all, or your Ninite installer.