Managing Windows 11 bloatware is one of the first tasks after Intune enrollment. This guide covers every removal method — from the Autopilot Branding Package to Win32 app packaging — and explains how to keep devices clean long-term across your entire Intune-managed fleet.
What Is Windows 11 Bloatware?
Windows 11 bloatware is the collection of pre-installed apps that Microsoft and OEM manufacturers ship by default — apps IT never requested, end users rarely need, and that consume storage, bandwidth, and attack surface from day one.
- Examples you’ll find on nearly every device: Xbox, Clipchamp, Candy Crush Saga, Microsoft Solitaire Collection, TikTok, LinkedIn, and OEM trials like McAfee or HP Smart. Enterprise SKUs aren’t exempt — even Windows 11 Enterprise ships with inbox apps including Xbox and Teams consumer.
- Why it ships even on Enterprise: OEMs negotiate app pre-installs as a revenue stream. Microsoft bundles its own consumer apps by default regardless of licensing tier. LTSC is the only edition that ships truly clean.
- Security and performance impact: Pre-installed apps expand the attack surface with additional scheduled tasks, services, and telemetry. Apps like Clipchamp and Xbox require Xbox Identity Provider running in the background. OEM trials frequently have outdated, vulnerable binaries present on day one of enrollment.
How to Remove Bloatware from Windows 11 with Intune
The enterprise-grade approach is to package your removal logic as a Win32 app (.intunewin) — this gives you detection rules, deployment targeting, and full visibility in the Intune portal. There are three methods, in order of reliability:
Method 1: Autopilot Branding Package (Recommended for New Enrollments)
The Autopilot Branding Package, developed by Michael Niehaus, removes Windows 11 bloatware during the Autopilot provisioning phase via a config XML. Apps are stripped before the user ever sees the desktop.
- Deploy as a Win32 app targeting the Autopilot device group
- Runs under the SYSTEM context during the Enrollment Status Page (ESP) phase
- Config XML defines which AppX packages to remove by full or partial name match
- Best used in combination with Method 2 for ongoing enforcement post-provisioning
Method 2: PowerShell Script Packaged as Win32 App (Best for Ongoing Enforcement)
Package a PowerShell removal script as a .intunewin file and deploy it as a Win32 app. This is the approach recommended by the Get Rubix channel and it’s the right call — Win32 packaging gives you a detection rule, retry logic, and a clear installed/failed status per device.
- Script logic:
Get-AppxPackage -AllUsers | Where-Object { $_.Name -match "Xbox|Clipchamp|BingWeather|ZuneMusic" } | Remove-AppxPackage— extend the match list to your environment - Detection rule: Check for absence of a specific registry key you write on success, or verify
Get-AppxPackagereturns null for your target apps - Deploy targeting: All Devices or a dynamic group scoped to your managed fleet — runs as SYSTEM, no user interaction required
- For navigation to the Win32 app upload experience, see the Intune Admin Center guide → Apps > Windows > Add > Windows app (Win32)
Method 3: Intune Platform Scripts (Simpler, Less Reliable)
You can push a raw PowerShell script via Devices > Scripts and remediations > Platform scripts in the Intune Admin Center. It’s faster to set up but has a critical limitation: no detection rule. Intune won’t retry on failure and you have no reliable way to confirm execution per device. Use this only for one-off cleanup tasks, not production enforcement.
Why Windows Bloatware Comes Back After Removal
One-time removal isn’t enough. Windows 11 bloatware comes back through feature updates, new enrollments, and OEM reimage cycles if your removal policy isn’t enforced persistently.
- Windows Updates restore inbox apps: Major feature updates (23H2, 24H2) can re-provision previously removed AppX packages as part of the update process. Microsoft has acknowledged this behavior — without a persistent remediation policy, apps come back silently.
- New Autopilot enrollments hit the same OEM image: Every new device enrollment starts from the manufacturer’s base image. If your bloatware removal only ran once on existing devices, new enrollments arrive dirty. The Autopilot Branding Package or a persistent Win32 deployment covers this, but only if it’s scoped to All Devices including newly enrolled.
- No native Intune mechanism to block re-installation: Intune can remove apps, but it has no built-in persistent block on AppX re-provisioning without additional tooling. The Win32 detection rule approach mitigates this by re-running if the detection condition fails — but it’s not the same as prevention.
How to Block Apps from Installing in Windows 11 via Intune
Removal cleans what’s already there. Prevention stops apps from arriving in the first place. The right tool for this is Windows Defender Application Control (WDAC).
WDAC lets you define an allowlist policy — only apps that match your signed policy can run or install. When applied via Intune’s Application Control profile (Endpoint Security > Attack Surface Reduction > Application Control), it enforces silently in the background across the entire fleet.
- Start in Audit mode first to identify what would be blocked before switching to enforcement
- Policy authoring requires the WDAC Policy Wizard or manual XML — not trivial, but the only enterprise-grade prevention layer
- Get Rubix has a dedicated video: “Block apps from installing and launching with Intune: Get started” — a solid starting point for the WDAC setup flow
A full WDAC deep-dive is outside the scope of this post, but it pairs naturally with the removal methods above: remove what’s there, block what tries to return.
How MSPs Keep Windows Devices Bloatware-Free at Scale
The real challenge for MSPs isn’t the one-time removal script for Windows 11 bloatware. It’s maintaining a clean state across hundreds of endpoints, across multiple clients, as new devices enroll and Windows updates roll through.
That means you need:
- Automated detection — know when a bloatware app re-appears on a device, not when a user reports it
- Automated remediation — re-run the removal without a technician touching the policy
- Fleet-wide visibility — which clients are clean, which devices failed remediation, which enrollments missed the Autopilot policy
- Change control — when Microsoft pushes a feature update that restores inbox apps, you need the policy to fire automatically, not after a support ticket
This is the same operational pattern as third-party app patching: scheduled detection, automated remediation, status reporting per client. Running it manually at scale isn’t viable.
Always Up To Date handles this for MSPs managing Intune fleets — automated third-party patching and app management without the per-client script maintenance overhead. If keeping devices clean long-term is the goal, that’s the layer you need under the one-time removal.
Frequently Asked Questions
Does Windows 11 Enterprise still have bloatware?
Yes. Even Windows 11 Enterprise ships with inbox apps including Clipchamp, Xbox, Xbox Identity Provider, Microsoft Teams (consumer), and Microsoft Solitaire Collection. These are present in the default Enterprise image and must be explicitly removed via Intune or the Autopilot Branding Package. Only Windows 11 LTSC ships without these consumer apps.
Can Intune remove pre-installed apps?
Yes. The most reliable method is packaging a PowerShell removal script as a Win32 app (.intunewin) and deploying it with a detection rule. Intune Platform Scripts (Devices > Scripts) also work but lack detection rules and retry logic, making them less reliable for production use.
What is the Autopilot Branding Package?
The Autopilot Branding Package is an open-source tool created by Michael Niehaus that removes bloatware, applies branding, and configures settings during the Autopilot Enrollment Status Page (ESP) phase — before the user first logs in. It’s deployed as a Win32 app and configured via a JSON or XML config file that specifies which AppX packages to remove. It’s the cleanest approach for new device provisioning because removal happens at enrollment, not after.