Open-source alternatives to Windows Defender Remover

Reinstall is an automated operating system deployer and bare metal provisioning tool designed for virtual private servers and remote hardware. It functions as a remote disk imaging utility and OS management tool, enabling the deployment and reinstallation of Linux and Windows operating systems without requiring physical access to the machine. The project distinguishes itself by automating complex installation hurdles, such as bypassing hardware requirements for RAM, TPM, and SecureBoot. It manages critical low-level tasks including hardware-aware driver injection, raw disk image deployment wi

ReactOS is an open-source operating system designed to be binary compatible with Windows applications and drivers. It consists of a low-level system kernel that manages hardware resources and a binary compatibility layer that enables the execution of software designed for the Windows binary interface. The project implements a cross-platform build system and toolchain for compiling and deploying bootable operating system images across different hardware architectures. This includes the use of cross-compilation toolchains and a hardware-abstraction layer to support various processor and motherb

WSABuilds is a management framework designed to deploy and customize virtualized mobile runtime environments on desktop operating systems. It provides a comprehensive suite of tools for building, installing, and maintaining these environments, enabling the native execution of mobile applications alongside standard desktop software. The project distinguishes itself through its focus on deep system integration and lifecycle management. It allows users to generate tailored virtual environment packages by injecting administrative tools, service components, and specific configurations prior to dep

Tiny11builder is an automation utility designed to create customized, bootable Windows installation media. It functions by modifying offline installation images to remove pre-installed applications and non-essential system components, resulting in a reduced storage footprint and a more resource-efficient operating system deployment. The tool operates by mounting Windows installation images to a temporary directory, where it performs manifest-based package stripping and registry hive injections. These automated processes allow for the removal of specific system components and the disabling of

Windows10Debloater is a PowerShell-based utility designed to automate the removal of pre-installed software and the modification of system settings on Windows operating systems. It functions as a configuration manager that streamlines the desktop environment by uninstalling bundled applications and adjusting background services to reduce resource consumption. The tool distinguishes itself by providing a centralized orchestration layer for system hardening and privacy management. It allows users to restrict diagnostic data collection and block telemetry services, effectively limiting backgroun

RemoveWindowsAI is a Windows system debloater and component removal tool designed to delete protected system files and machine learning libraries by bypassing standard installation restrictions. It functions as an OS customizer and registry optimizer that modifies configuration keys and group policies to disable specific system features and application functionalities. The tool prevents the automatic reinstallation of removed components by marking packages as deprovisioned or deploying dummy update packages. It also enables the restoration of traditional workflows by replacing modern integrat

OffensiveNim is a red teaming framework and post-exploitation toolkit developed in Nim. It provides a collection of low-level primitives and a Windows API wrapper designed for offensive security operations, including malware development and shellcode loading. The project focuses on evasion and obfuscation through techniques such as API unhooking, direct system calls, and anti-debugging mechanisms. It features diverse payload delivery methods, including reflective binary loading, the execution of .NET assemblies via CLR hosting, and various shellcode injection techniques using fibers, COM obje

Unattend-generator is a .NET programmatic library designed for creating and parsing customized unattended installation files to automate operating system deployments. It functions as a configuration tool for building tailored setup scripts and installation answers for unattended operating system provisioning, enabling automated setup across physical or virtual hardware. The library supports two-way configuration parsing by deserializing existing markup files back into object graphs for round-trip modification of previously generated parameters. It utilizes object-oriented configuration buildi

Arpl is a bootloader manager and custom kernel loader for network attached storage devices. It provides a network boot environment to automate the fetching, flashing, and installation of modified operating systems and kernels onto hardware storage. The project distinguishes itself through a remote management suite that exposes bootloader controls via a web browser, secure shell connection, or local terminal. It utilizes RSS feeds to automate the retrieval of the latest system images and version metadata for online updates. The system handles hardware boot configuration by mapping network int

WinDiskWriter is a specialized utility for creating bootable Windows installation media from a macOS environment. It writes operating system images to USB drives while providing support for both UEFI and Legacy BIOS boot interfaces. The tool includes a file splitter to divide installation files larger than four gigabytes, ensuring compatibility with FAT32 formatted boot drives. It also provides a hardware bypass utility that modifies Windows 11 installers to remove TPM 2.0 and Secure Boot requirements. The software manages low-level disk image writing and bootloader integration. It handles s

ZyperWinOptimize is a Windows system optimization tool that automates performance tuning by removing bloatware, disabling unnecessary services, and cleaning junk files to improve system responsiveness. It functions as a profile-driven configuration tool, storing user-selected optimization settings in a JSON file for consistent reapplication across sessions, and includes capabilities for Windows and Office activation via embedded product keys and command-line tools. The tool distinguishes itself through its comprehensive approach to system modification, combining registry tweaking, service sta

Brave is a privacy-focused desktop browser built on Chromium that blocks ads and trackers by default, and includes an integrated AI assistant and a built-in VPN client. It is available for Windows, macOS, and Linux, and can be deployed across organizations using enterprise group policies for managed configuration. The browser distinguishes itself by combining default ad and tracker blocking with a system-level VPN that encrypts all device traffic, and an AI assistant that answers questions and generates text content directly within the browsing interface. It also supports private browsing and

Nishang is a PowerShell-based offensive security framework designed for red teaming and penetration testing on Windows targets. It functions as a post-exploitation toolkit and payload generator to automate attacks and manage remote targets. The project provides specialized capabilities for bypassing security controls, such as disabling the Antimalware Scan Interface and employing in-memory execution to avoid disk-based detection. It includes a variety of stealthy command and control mechanisms, utilizing non-standard channels like DNS TXT records, ICMP traffic, and webmail for communication a

Betterfox is a curated configuration profile for the Firefox web browser designed to optimize speed, security, privacy, and user interface minimalism. It provides a set of preferences and settings to harden the browser environment and improve overall performance. The project distinguishes itself through targeted configuration suites that refine scrolling behavior, font rendering, and interface elements while removing visual distractions from the new tab page and address bar. It includes specific directives to disable telemetry, tracking, and digital rights management. Its broader capabilitie

Re-imagining Windows like a minimal OS install, already debloated with minimal impact for most functionality.

This project is a suite of administrative tools designed for automated operating system deployment and server infrastructure provisioning. It provides a framework for installing Linux and Windows distributions on remote hardware using network-streamed imaging and shell-based provisioning logic. The toolset includes specialized capabilities for network-streamed disk imaging and a TCP network tuning suite to optimize kernel parameters and congestion control. It also features a Windows group policy migrator for transferring and backing up operational settings between different computer instances

Etcher is a disk image writer and operating system flashing tool used to create bootable USB drives and SD cards. It transfers binary system images to physical external media, enabling computers or microcontrollers to boot from the prepared storage. The application includes system drive protection to prevent the accidental erasure of internal hard drives by filtering available storage devices based on metadata. It also performs data verification by comparing written bytes against the source image to ensure no corruption occurred during the flashing process.

This project is a curated collection of guidelines and technical resources designed to improve C++ code safety, maintainability, and performance. It provides a comprehensive set of coding standards and best practices for establishing consistent naming, formatting, and structural patterns across C++ codebases. The guide offers specific technical advice on performance optimization, including methods for minimizing object copying, optimizing memory allocation, and reducing compilation cycles. It also provides a directory of tooling recommendations for implementing static analysis, fuzz testing,

gibMacOS is a Python-based suite of utilities used to fetch official macOS installation files and recovery components directly from Apple servers. Its primary purpose is to download system images and assemble them into bootable recovery USB drives. The tool specifically enables the creation of macOS recovery media from a Windows environment. It achieves this by using disk imaging and compression tools to flash the retrieved system components onto external USB storage. The project manages its own environment by automating the resolution and installation of required Python dependencies at runt

Windows Hardening is a PowerShell-based automation framework designed for security assessment and configuration management within Windows environments. It provides a suite of administrative utilities to enforce industry-standard security benchmarks, audit system compliance, and reduce the overall attack surface of host machines. The project distinguishes itself by offering specialized capabilities for enterprise-wide configuration management, including the ability to transform security findings into deployable group policy objects. It also integrates system state management, allowing administ

linux-cachyos is a performance-tuned Arch Linux kernel distribution that combines advanced compiler optimizations with multiple CPU scheduler options to enhance system responsiveness and throughput. The project provides kernel variants supporting BORE, EEVDF, and BMQ schedulers, enabling users to match scheduling behavior to interactive, general-purpose, or throughput-oriented workloads, alongside real-time preemption capabilities for time-sensitive applications. The kernel is compiled using Clang with Thin Link-Time Optimization and incorporates AutoFDO profile-guided optimization, which use

archinstall is a guided installer for the Arch Linux operating system. It provides a mechanism to automate the partitioning, package selection, and configuration of a system through an interactive menu interface or pre-defined configuration profiles. The tool supports both manual and automated deployment. It can function as an interactive installation guide or as an automated deployment utility that loads settings and credentials from external files to perform installations without manual intervention. The project includes capabilities for disk partition management to support single or dual

Kwrt is a custom router firmware generator and build system designed to compile personalized network hardware images and Linux-based router operating systems. It specifically serves as an OpenWrt firmware builder and image customizer, allowing for the creation of tailored operating systems based on specific software packages, kernel configurations, and hardware targets. The system produces firmware in multiple boot formats, including EFI, Legacy, virtual disk files, and root archives for containers. It enables the generation of specialized images for x86 or virtualized network hardware, provi

Rocky is an open-source enterprise operating system designed for server and cloud infrastructure. It is a community-maintained Linux server distribution that provides a platform focused on stability and security. The project is fundamentally a Red Hat Enterprise Linux compatible operating system, maintaining bug-for-bug binary compatibility to ensure identical software behavior. This allows it to serve as an enterprise-grade platform without proprietary licensing. The distribution covers a broad range of system administration capabilities, including package management via modular repository

Bloodhound is an Active Directory attack path mapper and security auditor designed to visualize trust relationships and permission chains. It serves as an attack surface management tool that identifies paths to domain administrator and other high-privileged accounts. The project uses a graph database analyzer to map complex identity and access relationships. It quantifies the risk of privilege escalation by identifying misconfigured permissions and trust links within Windows domains. The system provides capabilities for Active Directory security analysis, identity and access auditing, and ne

Commando-VM is a Windows penetration testing distribution and offensive security toolkit. It provides a specialized virtual machine environment loaded with a curated suite of security auditing and exploitation tools designed for red teaming operations. The project facilitates the creation of red team infrastructure and security audit environments. It focuses on windows security auditing and penetration testing to help simulate adversary behavior and identify exploitable security flaws. The environment is established through script-based provisioning and modular toolset deployment. This proce

Uses Empire's (https://github.com/BC-SECURITY/Empire) RESTful API to automate gaining Domain and/or Enterprise Admin rights in Active Directory environments using some of the most common offensive TTPs.