Prospira Tweaks
WinUtil is good software. It is open, it has around 32,000 stars on GitHub, every change sits in a public commit history, and it installs applications through Microsoft’s own package manager rather than downloading executables from anywhere. Nothing below is an argument against using it.
But the sentence that appears in almost every review of it - that a restore point is created automatically before anything is applied - is not true, and you can check that yourself in one line of their configuration file.
That matters more than it sounds, because of a second thing in the code: when you close WinUtil, it no longer knows what it did.
What WinUtil actually is
A PowerShell script with a graphical interface, run from a single line.
You run it with one command, as administrator, because it makes system-wide changes:
irm https://christitus.com/win | iex
It covers four areas: installing applications, tweaks, troubleshooting configuration, and Windows update control. Three preset selections are offered - Standard, Minimal and Advanced.
The tweak list is grouped into four categories, and two of them announce themselves: Essential Tweaks, Customize Preferences, Advanced Tweaks - CAUTION and Performance Plans - NOT FOR LAPTOPS. Warnings written into the category names is a good sign about the people who made it.
There is also a paid version, a faster reimplementation sold in the author’s own shop. The free tool is genuinely free and genuinely useful; it is also the top of a funnel, which is worth knowing.
Is it safe to run?
Two questions live inside that one, and they have different answers.
Is the code trustworthy? As far as anyone outside can judge, yes. It is open source with around 32,000 stars, a large user base and a public commit history. Application installs go through winget, which means Microsoft-signed packages rather than arbitrary downloads. The author is a public figure with a reputation attached to it.
Is the delivery method safe? That one line downloads a script from a website and executes it immediately, as administrator, without you reading it first. It is the same trust model as running any installer, and it is the normal way tools in this category are distributed. It is also a pattern where you trust the domain at the moment you run it, rather than the code you reviewed yesterday. The repository is public and you can fetch and read the script before running it. Most people will not, and that is the honest description of the risk.
Neither of those is the interesting part. What happens after it runs is.
Does it create a restore point?
No. Not unless you notice a box and tick it.
Almost every review of WinUtil contains a sentence like "all tweaks are reversible, a restore point is created automatically before anything is applied". We could not find any support for it, and their own configuration says otherwise.
WinUtil has a tweak called Restore Point - Create, described in their file as:
Creates a restore point at runtime in case a revert is needed from WinUtil modifications.
It sits in the Essential Tweaks list among the other tweaks, and carries one property that decides everything: Checked: False. It is off by default. It is an item you have to notice and select, in a list of things you are selecting for other reasons. Choose a preset and press Run, and you do not get one.
That is checkable in a single line of the project’s public configuration file, which is why we would rather you verified it than took our word.
And so this is fair: our own application does not create one automatically either. It has a button in the Backups tab and it asks you to press it. A checkbox off by default and a button you have to press are the same kind of gap. The difference between the two tools is not here.
Can you undo what it changed?
Mostly yes, and better than we expected. The limit is that it does not remember.
We started this article believing the popular claim that WinUtil cannot reverse most of what it does. We counted properly, and it is wrong. Of the 66 tweaks in the current configuration:
37 change only registry values or service startup types. Those store the original value alongside the new one, so undo writes the old value back. Genuinely reversible.
19 run a script and ship a matching undo script. Also reversible.
Six run a script with no undo. Three of those are one-way by nature - running disk cleanup, deleting temporary files, and creating the restore point itself. The two that matter are removing Widgets and the Windows AI removal. Two further registry entries have no stored original value, so there is nothing to write back for those particular keys.
So the tool is more reversible than its reputation. Here is the actual limit. Its undo function reads the list of tweaks that are ticked in the window at that moment, and if none are, it answers: "Please check the tweaks you wish to undo."
It does not read a record of what was applied, because it does not keep one. Nothing is written to disk. Close WinUtil, reopen it a week later, and every box is empty - the tool cannot tell you what it changed.
Which means the undo works perfectly, on the condition that you remember. Two weeks later, on a machine that has developed a problem, that condition is doing a great deal of work.
The part that is not tweaks
It also builds trimmed Windows installation images, and that is a different decision.
WinUtil can produce a slimmed Windows installation image, a feature called MicroWin. That is a different category of change from a registry toggle: it makes an install medium with components taken out before Windows is ever installed.
If you are weighing that specific feature, the questions are the ones we wrote about in the AtlasOS article: what comes out, what can be put back, and what a reinstall costs you. A tweak you can reverse and an installation image you cannot are not the same decision, even when they sit behind the same button.
When WinUtil is the right tool
Fresh installs, known changes, and anyone who keeps their own notes.
You are setting up a fresh machine. Installing twenty applications through winget from one list, in one pass, is the best thing this tool does and it is not close.
You want a specific, known change. You know what you are turning off and why. The categories are labelled, the risky ones say CAUTION, and the code for every tweak is readable.
You are comfortable keeping your own notes. Write down what you selected and the undo works. The memory gap does not apply to you.
You are not paying anyone. It is free, it is maintained, and for a competent user doing a fresh-install pass it does the job.
When it is not
When you will not remember, and when the machine is already misbehaving.
You will not remember. This is the honest failure mode and the common one. Twenty changes in one run, no record kept, and a fortnight later neither of you knows what was done.
You want to know what a tweak does before you turn it on. Finding that out means reading its entry in a configuration file on GitHub. Fine for some people, not a realistic ask for most.
You did not tick the restore point. If you skipped it and something is wrong afterwards, the recovery path is whatever Windows happened to create on its own, which may be nothing.
You are troubleshooting rather than configuring. A machine that is already misbehaving needs a diagnosis, not twenty simultaneous changes. Applying a batch of tweaks to an unexplained problem is how threads end with somebody reinstalling Windows and still having the problem.
How our approach differs
What happens between sessions, rather than during one.
We are not going to claim we are faster, and we are not going to call WinUtil irresponsible, because neither would be true. The difference is what happens between sessions.
We keep a record of what was applied. That is the whole answer to the section above. Open our application again and it shows what is on, because the state was written down rather than remembered.
Risk is on the card, not in a file on GitHub. Each tweak says what it does and what it risks before you turn it on, in the interface, in a sentence.
We name the things that cannot be undone, in the application itself. There are a small number, they carry a warning that names the consequence, and the ones that permanently remove Windows components ask you to confirm that specifically.
And the honest limits, so this section is worth reading: our restore point is a button you press, not something we do for you. We read the memory speed your modules are rated for, not the speed they are running at. We do not read your monitor’s refresh rate.