Windows System Maintenance & Client Setup Guide

sfc /scannow; DISM /Online /Cleanup-Image /CheckHealth; DISM /Online /Cleanup-Image /ScanHealth; DISM /Online /Cleanup-Image /RestoreHealth

netsh winsock reset; netsh int ip reset; ipconfig /release; ipconfig /renew; ipconfig /flushdns; Get-NetAdapter | Where-Status -Eq "Up" | Set-DnsClientServerAddress -ServerAddresses ("9.9.9.9","1.1.1.2"); Get-NetAdapterBinding -ComponentID ms_tcpip6 | Disable-NetAdapterBinding

Stop-Service -Name wuauserv, bits, cryptsvc, msiserver -Force; Rename-Item -Path "$env:windir\SoftwareDistribution" -NewName "SoftwareDistribution.old" -Force -ErrorAction SilentlyContinue; Rename-Item -Path "$env:windir\System32\catroot2" -NewName "catroot2.old" -Force -ErrorAction SilentlyContinue; Start-Service -Name wuauserv, bits, cryptsvc, msiserver

Stop-Service -Name Spooler -Force; Remove-Item -Path "$env:windir\System32\spool\PRINTERS\*" -Force -Recurse -ErrorAction SilentlyContinue; Start-Service -Name Spooler

$d="$env:LOCALAPPDATA\SilentBootRepair"; mkdir $d -Force; @'
if(-not([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)){Start-Process powershell.exe "-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs;exit}$l="$env:TEMP\SilentBootRepair.log";"[{0}] Started" -f (Get-Date)|Out-File $l -Append;sfc /scannow|Out-File $l -Append;DISM /Online /Cleanup-Image /RestoreHealth|Out-File $l -Append;"[{0}] Done" -f (Get-Date)|Out-File $l -Append
'@|Out-File "$d\SilentBootRepair.ps1" -Force;(New-Object -ComObject WScript.Shell).CreateShortcut("$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\SilentBootRepair.lnk")|%{$_.TargetPath="powershell.exe";$_.Arguments="-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File `"$d\SilentBootRepair.ps1`"";$_.Save()}

1. System Repairs (SFC & DISM)

Run the following commands in an Administrator PowerShell or Command Prompt to scan and repair corrupted Windows system files and component stores.

Step 1: System File Checker (SFC)

Fixes corrupted or missing Windows system files.

sfc /scannow

Step 2: DISM Health Check

Checks whether the Windows image has been flagged as corrupted.

DISM /Online /Cleanup-Image /CheckHealth

Step 3: DISM Scan Health

Scans the Windows image for component store corruption.

DISM /Online /Cleanup-Image /ScanHealth

Step 4: DISM Restore Health

Repairs the Windows image using Windows Update as the repair source.

DISM /Online /Cleanup-Image /RestoreHealth

Step 5: Driver Updates (Optional)

Finds and installs outdated or missing hardware drivers.

Recommendation: Create a System Restore Point before updating drivers.

• Download Snappy Driver Installer Origin (SDIO).
• Click Download latest release, extract the archive, and launch SDIO_auto.
• Select Index This PC Only and enable Expert Mode.
• In the 1st Menu, toggle ON: Not installed, Newer, Better matches.
• In the 2nd Menu, toggle ON: Not Installed.
• In the 3rd Menu, toggle ON: Show only best.
• Click Select all and begin installing missing/outdated drivers.

Note: Restart your PC after completing all SFC and DISM operations.

2. Network & DNS Optimization

Reset network adapters, disable IPv6 to avoid resolution conflicts, and configure fast, security-focused DNS servers.

Step 1: Network Stack Reset

Open PowerShell (Admin) or Command Prompt (Admin) and run:

netsh winsock reset
netsh int ip reset
ipconfig /release
ipconfig /renew
ipconfig /flushdns

Step 2: Disable IPv6

1. Press Win + R, type ncpa.cpl, and press Enter.
2. Right-click your active Wi-Fi or Ethernet network adapter and select Properties.
3. Uncheck Internet Protocol Version 6 (TCP/IPv6).
4. Click OK to save.

PowerShell Alternative (Admin):

Get-NetAdapterBinding -ComponentID ms_tcpip6 | Disable-NetAdapterBinding

Step 3: Set Secure DNS (Quad9 & Cloudflare)

In the network adapter Properties menu:

1. Select Internet Protocol Version 4 (TCP/IPv4) and click Properties.
2. Select Use the following DNS server addresses:
   • Preferred DNS server: 9.9.9.9 (Quad9 Malware Protection)
   • Alternate DNS server: 1.1.1.2 (Cloudflare Security / Malware Blocking)
3. Click OK and restart your computer.

PowerShell Alternative (Admin):

Get-NetAdapter | Where-Status -Eq "Up" | Set-DnsClientServerAddress -ServerAddresses ("9.9.9.9","1.1.1.2")

3. Security & Malware Protection

Simple dual-layer protection using built-in Windows Defender alongside Malwarebytes.

Step 1: Windows Defender Quick Maintenance

1. Press Win + S, search for Windows Security, and open it.
2. Go to Virus & threat protection.
3. Click Check for updates under Protection updates.
4. Select Scan options -> Full scan -> Scan now.

PowerShell Alternative (Admin):

Update-MpSignature; Start-MpScan -ScanType FullScan

Step 2: Malwarebytes On-Demand Cleaner

1. Download Malwarebytes Free Installer.
2. Run the installer using default settings.
3. Open Malwarebytes, click Scan, and let it quarantine any discovered threats.
4. (Optional) Free version can remain on the system strictly for periodic manual scans.

4. Brave Browser Client Setup (Debloated & Clean)

Configure Brave for maximum speed, strong privacy, and zero clutter—optimized for non-technical users.

Step 1: Disable Web3 / Crypto Features

1. Open Brave and go to brave://settings/wallet.
2. Set Default Cryptocurrency Wallet to None.
3. Go to brave://settings/rewards and toggle Brave Rewards off.
4. Go to brave://settings/appearance and turn Off the Brave Wallet Button and Brave Rewards Button.

Step 2: Set Non-Breaking Ad & Tracker Protection

1. Go to brave://settings/shields.
2. Set Trackers & ads blocking to Standard.
   • Note: Standard mode blocks malicious ads and pop-ups without breaking standard websites or streaming services.

Step 3: Clean New Tab Page

1. Go to brave://settings/newTab.
2. Set New tab page shows to Blank page or Dashboard (Customize: Hide Cards, News, and Crypto).

5. Windows Setup (OOBE) Network Bypass

Skip the mandatory internet connection requirement during Windows initial setup (Out-Of-Box Experience).

1. On the "Let's connect you to a network" screen, press Shift + F10 (or Shift + Fn + F10) to open the Command Prompt.
2. Type the following command and press Enter:

oobe\bypassnro

3. The system will restart automatically. Upon reboot, select "I don't have internet" to proceed with local account creation.

6. Windows Update Troubleshooting & Reset

Windows Update often fails with cryptic error codes (e.g., 0x80070002, 0x80240020). This section provides a step-by-step methodology to reset the local Windows Update cache.

Step 1: Stop Windows Update Services

To reset the cache, we must stop the Background Intelligent Transfer Service (BITS), Windows Update Service, Cryptographic Services, and Windows Installer (msiserver).

In Command Prompt (Admin) or PowerShell (Admin):

net stop wuauserv
net stop bits
net stop cryptsvc
net stop msiserver

Step 2: Rename Cache & Component Folders

Windows uses these folders to store update files and signatures. Renaming them forces Windows to recreate them, purging any corruption.

ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
ren %systemroot%\System32\catroot2 catroot2.old

Step 3: Restart Windows Update Services

Restart the services stopped in Step 1.

net start wuauserv
net start bits
net start cryptsvc
net start msiserver

Step 4: Run Windows Update Troubleshooter

If errors persist, run the built-in Windows Update Troubleshooter:

• Go to Settings -> System -> Troubleshoot -> Other troubleshooters (or Update & Security -> Troubleshoot -> Additional troubleshooters).
• Run the Windows Update troubleshooter.

7. Print Spooler Reset & Stuck Job Purge

When a printer refuses to print, or jobs are stuck in the print queue (unable to delete), resetting the print spooler and purging the local queue folder resolves the issue in 95% of cases.

Step 1: Stop the Print Spooler Service

Open Command Prompt (Admin) or PowerShell (Admin) and run:

net stop spooler

Step 2: Delete Stuck Print Queue Files

Delete all temporary files stored in the printer spool directory.

del /Q /F /S "%systemroot%\System32\Spool\Printers\*.*"

Step 3: Restart the Print Spooler Service

net start spooler

8. Storage Clean-up & Disk Health

Slow system performance and low disk space are common client complaints. This section covers cleaning temp files, disabling hibernation (for SSD systems with low storage), and scanning for drive file-system errors.

Step 1: Automated Storage Temp Clean-up

Delete user and system temporary files using PowerShell:

Remove-Item -Path "$env:TEMP\*" -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item -Path "$env:windir\Temp\*" -Recurse -Force -ErrorAction SilentlyContinue

Step 2: Manage Hibernation File (Save GBs of SSD Space)

If the client is on a desktop or does not use hibernation, disabling hibernation deletes hiberfil.sys, freeing up gigabytes of disk space equal to ~75% of installed RAM.

Open Command Prompt (Admin) or PowerShell (Admin) and run:

powercfg /h off

(To re-enable later, run powercfg /h on)

Step 3: Check Disk (Chkdsk) for File System Errors

Check file system metadata and repair disk corruption on the primary C: drive. This requires a restart.

chkdsk C: /f /r

Note: Type Y when prompted to schedule the volume to be checked next time the system restarts, then reboot.

9. Silent System Repair on Boot

Automatically running a file system check and component store repair on every logon ensures automatic recovery from sudden crashes or corruption, completely in the background.

To do this properly, we use a hidden script located in local user configuration and register a silent startup shortcut.

Step 1: Create the Local Repair Script

Create a folder and save the following PowerShell script to $env:LOCALAPPDATA\SilentBootRepair\SilentBootRepair.ps1:

# Self-elevate the script to Administrator (triggers UAC)
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Start-Process powershell.exe -ArgumentList "-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs
    Exit
}

$logFile = "$env:TEMP\SilentBootRepair.log"
"[{0}] Boot repair started." -f (Get-Date) | Out-File $logFile -Append

# Run SFC and DISM Repairs silently
sfc /scannow | Out-File $logFile -Append
DISM /Online /Cleanup-Image /RestoreHealth | Out-File $logFile -Append

"[{0}] Boot repair completed." -f (Get-Date) | Out-File $logFile -Append

Step 2: Register in shell:startup

Since Windows opens .ps1 files in Notepad on startup by default, we register a silent shortcut .lnk in your Startup directory pointing to PowerShell.

Run this PowerShell command to create the startup link:

$WshShell = New-Object -ComObject WScript.Shell
$Shortcut = $WshShell.CreateShortcut("$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\SilentBootRepair.lnk")
$Shortcut.TargetPath = "powershell.exe"
$Shortcut.Arguments = "-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File `"$env:LOCALAPPDATA\SilentBootRepair\SilentBootRepair.ps1`""
$Shortcut.Save()

Step 3: Viewing Results

The repairs run silently. You can view the repair details and progress in the log file:

• Press Win + R, type %TEMP%\SilentBootRepair.log, and press Enter.

Step 4: Uninstallation

To completely remove the boot-time repairs:

1. Delete the startup shortcut:

Remove-Item -Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\SilentBootRepair.lnk" -Force

2. Delete the script folder:

Remove-Item -Path "$env:LOCALAPPDATA\SilentBootRepair" -Recurse -Force