windows-optimize

name	windows-optimize
description	Diagnose Windows laptop performance issues and apply safe, reversible optimizations. Trigger when the user reports slowness, slow boot, lag, fan noise, high CPU, low disk, or asks for Windows cleanup/tuning/optimization. Performs read-only diagnostics first, then applies fixes only with explicit consent. Never deletes user data or disables corporate security agents.

Windows laptop optimization

Goal: identify why a Windows laptop is slow, then apply safe, reversible fixes with explicit consent at each step.

Operating principles

Safety first — non-negotiable:

• Always diagnose before recommending. Read before write.
• Reversible by default:
  • Disable startup items via the StartupApproved registry key (the same method Task Manager uses) — never delete Run entries.
  • Change service StartupType to Manual — never delete services.
  • Clean temp/cache by age filter — never wipe full folders blind.
• Never delete user files, Recycle Bin contents, browser session data (cookies/passwords/history), WinSxS, or AppData\Local\Packages without an explicit per-action confirmation from the user.
• Never disable corporate security agents even if they're consuming CPU. Examples to recognize and leave alone: Microsoft Defender (WinDefend, MsMpEng), Defender for Endpoint (Sense, MsSense), Purview DLP (MDDlpSvc), Illumio VEN (ven*Svc), Global Secure Access (GlobalSecureAccess*), Intune (IntuneManagementExtension), SCCM (CcmExec), WSAIFabricSvc. For dev-workload CPU caused by Defender, recommend the user file an IT ticket for Defender process/path exclusions instead.
• If a change needs admin and the session isn't elevated, write a script for the user to run — do not attempt to self-elevate.

Phase 1 — diagnose (read-only)

Run the diagnostic script:

& "$env:USERPROFILE\.claude\skills\windows-optimize\scripts\diagnose.ps1"

Capture its output. It returns sections for:

• Hardware (model, CPU, RAM, disk, battery health, OS, uptime)
• Live CPU and memory pressure (3-sec sample of top processes)
• Power plan + clock speed vs. max
• Startup items in all hives (HKCU Run, HKLM Run, HKLM WOW6432 Run, Startup folder)
• Auto-start services (highlighting known-noisy ones)
• Disk space + size of common bloat folders
• Browser process sprawl (Edge / WebView2 / Chrome counts and total RAM)
• Recent system errors and app crashes
• Pending reboot state

Do not narrate every line. Synthesize.

Phase 2 — report

Produce a compact, admin-quality report:

1. TL;DR — one sentence on the actual cause of slowness.
2. Hardware status — table with healthy/warning per component.
3. Top live CPU consumers from the 3-second sample.
4. Findings ranked by impact, each with the root cause.
5. Recommendations, grouped by safety:
   • Group A — Safe & reversible (can apply now in this session)
   • Group B — Needs admin (generate a script for the user to run elevated)
   • Group C — User judgment / behavior / IT ticket (recommend, do not execute)

End by asking the user which groups to apply. Do not assume consent.

Phase 3 — apply (only what the user explicitly OKs)

Group A — apply via the safe-fixes script

& "$env:USERPROFILE\.claude\skills\windows-optimize\scripts\apply-safe.ps1" `
    -PowerPlanHighPerf `
    -DisableHKCUStartup @('Item1','Item2') `
    -CleanTemp -CleanCaches

What the safe-fixes script can do (all reversible, all user-level — no admin needed):

• -PowerPlanHighPerf — activate High Performance plan, duplicating from default GUID if missing.
• -DisableHKCUStartup @(...) — disable startup items in HKCU\...\Run via StartupApproved.
• -CleanTemp — delete files in %TEMP% older than -TempAgeDays (default 1).
• -CleanCaches — clean INetCache, WER reports, crash dumps, Chrome/Edge code caches older than -CacheAgeDays (default 14). Does not touch session data.

Every change is logged to %LOCALAPPDATA%\windows-optimize\rollback.json so rollback.ps1 can reverse it.

Group B — admin script

When findings include HKLM startup entries, service startup-type changes, or Windows Update cache cleanup, write a tailored admin script. Save it to a path the user picks (e.g. $env:USERPROFILE\Desktop\finish-cleanup-as-admin.ps1) and tell the user:

Open PowerShell as administrator, then run: & "$env:USERPROFILE\Desktop\finish-cleanup-as-admin.ps1"

The script should use the same StartupApproved method for any HKLM disables, and Set-Service -StartupType Manual for service changes.

Group C — recommend, never execute

Behaviors and IT requests, not commands:

• Defender exclusions for dev tools and repos if allowed by IT (IT ticket — user has no admin on corporate machine), do not bypass IT rules.
• Browser memory saver / sleeping tabs in Edge and Chrome settings.
• Consolidate browsers if both are running heavily in parallel.
• Replace battery if full-charge capacity < 70% of design capacity.
• Reboot if uptime > 14 days or pending-reboot is detected.

Common findings → standard fixes

Symptom	Standard recommendation
Power plan = Balanced on high-end laptop	Switch to High Performance (Group A)
Combined browser RAM > 10 GB or > 50 procs	Sleeping tabs + memory saver + close idle tabs (Group C)
Defender / MDE high CPU on dev workloads	IT ticket for process/path exclusions (Group C)
Startup items > 15	Disable non-essential via StartupApproved (Group A/B)
Temp folder > 1 GB	Clean by age (Group A)
Battery full-charge < 70% of design	Flag for replacement (Group C)
Disk free < 15%	Clean caches; run Storage Sense (Group A + C)
Uptime > 14 days	Recommend reboot (Group C)
Many WebView2 processes	Often Teams/Outlook embedded views; recommend signing out of unused workspaces
Many printer/scanner startup entries (Epson, HP, Canon)	Almost always safe to disable from startup (Group A/B)

Rollback

If the user wants to undo:

& "$env:USERPROFILE\.claude\skills\windows-optimize\scripts\rollback.ps1"

It reads the rollback log and reverses every change: re-enables startup items, restores the previous power plan, restores service startup types. Cleaned temp/cache files are not recoverable (and shouldn't need to be).

Out of scope (do not do)

• chkdsk, sfc /scannow, DISM /RestoreHealth — only run if corruption is suspected, and only on explicit user request.
• Defrag — not needed on SSDs, harmful for SSD lifespan.
• Third-party "registry cleaners" or "PC optimizers" — snake oil.
• Touching user documents, mail stores, browser profiles, OneDrive sync state.
• Modifying Group Policy, BitLocker, firewall rules, network adapter settings.
• Disabling Windows Update or any security service.
• Driver updates from third parties — defer to Windows Update or vendor tools (Surface app, Lenovo Vantage, Dell SupportAssist, etc.).