Silencing Windows 11: SCCM Configuration Item for Disabling Ads and Suggestions

2026-05-19 17:50:51

5 min read

Silencing Windows 11: SCCM Configuration Item for Disabling Ads and Suggestions

Deploy a three-script SCCM Configuration Item that detects, remediates, and can revert 18 registry values controlling Windows 11 ads, suggestions, and bloat notifications - scoped to the logged-on user via HKCU.

Keywords: SCCM, Configuration Item, Windows 11, registry, PowerShell, ContentDeliveryManager, debloat, suggestions, compliance baseline

Windows 11 ships with a generous helping of ads baked into the shell - suggestions in Start, toast notifications pushing Microsoft services, silent installation of sponsored apps, and the welcome experience that reappears after every feature update. For managed endpoints these are noise at best and a compliance risk at worst. This post covers a Configuration Item baseline that detects and remediates all of them via three PowerShell scripts.

Registry values are sourced from the excellent Win11Debloat project by Raphire. This CI approach wraps those same values in SCCM-native detection and remediation so you get reporting, targeted deployment, and automatic re-application if a user or update reverts a setting.

What gets disabled

Windows welcome experience shown after feature updates
Suggested apps and Start menu recommendations
Tips, tricks, and suggestion toasts while using Windows
Suggested content panels inside the Settings app
Account notification banners in Settings
The “finish setting up your device” Scoobe prompt
Sync provider ads in File Explorer
Silent background installation of sponsored apps
Windows.SystemToast.Suggested notification channel
Phone Link / mobile device pairing suggestions
Account-related notifications in the Start menu
Windows Backup reminder notifications

All settings live under HKEY_CURRENT_USER, which is why the CI must run under the logged-on user’s credentials rather than SYSTEM.

SCCM CI configuration

Create a new Configuration Item in the Assets and Compliance workspace. Under Settings, add a single setting with these properties:

Setting type: Script
Data type: String
Discovery script: PowerShell — paste Detection script
Remediation script: PowerShell — paste Remediation script
Run scripts using the logged on user credentials: Yes

Add a compliance rule on the setting: Value equals “Compliant”, with remediation enabled. Deploy the baseline to your target collection.

Detection script

Iterates all 18 registry values. Any value that is missing or not equal to 0 is added to a non-compliant list. Outputs either Compliant or NonCompliant as a string for the CI rule to match against.

#Requires -Version 5.1
<#
.SYNOPSIS
    SCCM Configuration Item - Detection Script
    Disable Windows Suggestions, Ads, and Bloat Notifications

.DESCRIPTION
    Checks that all registry values disabling Windows ads, suggestions,
    and bloat notifications are correctly set to 0.

.NOTES
    CI Settings:
      - Script language : PowerShell
      - Run scripts using the logged on user credentials : YES  (HKCU scope)
      - Script execution policy : Bypass (or AllSigned per your environment)

    Returns "Compliant" if all values are correct.
    Set your CI compliance rule to: Value equals "Compliant"

    Credit: registry values sourced from
    https://github.com/Raphire/Win11Debloat/blob/master/Regfiles/Disable_Windows_Suggestions.reg
#>

$DesiredValue = 0

# Define all required registry settings as [Path, Name] pairs
$Settings = @(
    # Welcome experience after updates
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-310093Enabled' },

    # Suggestions in Start
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-338388Enabled' },
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SystemPaneSuggestionsEnabled' },

    # Start recommendations (tips, shortcuts, new apps)
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced';       Name = 'Start_IrisRecommendations' },

    # Tips, tricks, and suggestions as you use Windows
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-338389Enabled' },
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SoftLandingEnabled' },

    # Suggested content in Settings app
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-338393Enabled' },
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-353694Enabled' },
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-353696Enabled' },
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-353698Enabled' },

    # Notifications in Settings app
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\SystemSettings\AccountNotifications'; Name = 'EnableAccountNotifications' },

    # Finish setting up device (OOBE/Scoobe)
    @{ Path = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\UserProfileEngagement';  Name = 'ScoobeSystemSettingEnabled' },

    # Sync provider ads in Explorer
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced';       Name = 'ShowSyncProviderNotifications' },

    # Silent / automatic installation of suggested apps
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SilentInstalledAppsEnabled' },

    # Suggested app toast notifications (MS store ads)
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.Suggested'; Name = 'Enabled' },

    # Phone Link / mobile device suggestions
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Mobility';               Name = 'OptedIn' },

    # Account-related notifications in Start
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced';       Name = 'Start_AccountNotifications' },

    # Windows Backup reminder notifications
    @{ Path = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.BackupReminder'; Name = 'Enabled' }
)

$NonCompliant = [System.Collections.Generic.List[string]]::new()

foreach ($Setting in $Settings) {
    try {
        $RegValue = Get-ItemPropertyValue -Path $Setting.Path -Name $Setting.Name -ErrorAction Stop
        if ($RegValue -ne $DesiredValue) {
            $NonCompliant.Add("$($Setting.Path)\$($Setting.Name) = $RegValue (expected $DesiredValue)")
        }
    }
    catch {
        # Key or value missing - treat as non-compliant (remediation will create it)
        $NonCompliant.Add("$($Setting.Path)\$($Setting.Name) [MISSING]")
    }
}

if ($NonCompliant.Count -eq 0) {
    Write-Output "Compliant"
}
else {
    # Uncomment the line below during testing to surface details in SCCM logs
    # $NonCompliant | ForEach-Object { Write-Verbose $_ -Verbose }
    Write-Output "NonCompliant"
}

Remediation script

Drives the same settings array. Uses New-Item -Force to create any missing intermediate key paths before writing the DWORD value. Exits with code 1 on any failure so SCCM surfaces it as a remediation error rather than silently reporting success.

#Requires -Version 5.1
<#
.SYNOPSIS
    SCCM Configuration Item - Remediation Script
    Disable Windows Suggestions, Ads, and Bloat Notifications

.DESCRIPTION
    Creates or sets all registry values that disable Windows ads, suggestions,
    and bloat notifications to 0 (DWORD).
    Missing registry keys are created automatically.

.NOTES
    CI Settings:
      - Script language : PowerShell
      - Run scripts using the logged on user credentials : YES  (HKCU scope)
      - Script execution policy : Bypass (or AllSigned per your environment)

    Pair with CI_DisableWindowsAds_Detection.ps1
    No output on success; exits 0.  Exits 1 on any error.

    Credit: registry values sourced from
    https://github.com/Raphire/Win11Debloat/blob/master/Regfiles/Disable_Windows_Suggestions.reg
#>

$DesiredValue = 0
$ErrorCount   = 0

$Settings = @(
    # Welcome experience after updates
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-310093Enabled' },

    # Suggestions in Start
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-338388Enabled' },
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SystemPaneSuggestionsEnabled' },

    # Start recommendations (tips, shortcuts, new apps)
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced';       Name = 'Start_IrisRecommendations' },

    # Tips, tricks, and suggestions as you use Windows
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-338389Enabled' },
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SoftLandingEnabled' },

    # Suggested content in Settings app
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-338393Enabled' },
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-353694Enabled' },
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-353696Enabled' },
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-353698Enabled' },

    # Notifications in Settings app
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\SystemSettings\AccountNotifications'; Name = 'EnableAccountNotifications' },

    # Finish setting up device (OOBE/Scoobe)
    @{ Path = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\UserProfileEngagement';  Name = 'ScoobeSystemSettingEnabled' },

    # Sync provider ads in Explorer
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced';       Name = 'ShowSyncProviderNotifications' },

    # Silent / automatic installation of suggested apps
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SilentInstalledAppsEnabled' },

    # Suggested app toast notifications (MS store ads)
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.Suggested'; Name = 'Enabled' },

    # Phone Link / mobile device suggestions
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Mobility';               Name = 'OptedIn' },

    # Account-related notifications in Start
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced';       Name = 'Start_AccountNotifications' },

    # Windows Backup reminder notifications
    @{ Path = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.BackupReminder'; Name = 'Enabled' }
)

foreach ($Setting in $Settings) {
    try {
        # Ensure the registry key path exists before writing
        if (-not (Test-Path -Path $Setting.Path)) {
            New-Item -Path $Setting.Path -Force -ErrorAction Stop | Out-Null
        }

        New-ItemProperty -Path  $Setting.Path `
                         -Name  $Setting.Name `
                         -Value $DesiredValue `
                         -PropertyType DWord `
                         -Force `
                         -ErrorAction Stop | Out-Null
    }
    catch {
        Write-Warning "Failed to set $($Setting.Path)\$($Setting.Name): $_"
        $ErrorCount++
    }
}

if ($ErrorCount -gt 0) {
    Write-Error "Remediation completed with $ErrorCount error(s). Check warnings above."
    exit 1
}

exit 0

Revert script

For rollback or baseline removal, the revert script sets every value back to 1 (Windows default). Deploy it as a one-shot package to any collection where you need to undo the baseline, or run it manually. It is intentionally not wired into the CI itself - reverting is an explicit action, not an automated one.

#Requires -Version 5.1
<#
.SYNOPSIS
    SCCM Configuration Item - Revert Script
    Re-enable Windows Suggestions, Ads, and Bloat Notifications

.DESCRIPTION
    Restores all registry values to their Windows defaults (1 / enabled),
    reversing the changes applied by CI_DisableWindowsAds_Remediation.ps1.
    Missing registry keys are created automatically.

    Run this manually or deploy as a one-shot package to undo the CI baseline.

.NOTES
    Run scripts using the logged on user credentials : YES  (HKCU scope)

    Credit: registry values sourced from
    https://github.com/Raphire/Win11Debloat/blob/master/Regfiles/Disable_Windows_Suggestions.reg
#>

$DefaultValue = 1
$ErrorCount   = 0

$Settings = @(
    # Welcome experience after updates
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-310093Enabled' },

    # Suggestions in Start
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-338388Enabled' },
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SystemPaneSuggestionsEnabled' },

    # Start recommendations (tips, shortcuts, new apps)
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced';       Name = 'Start_IrisRecommendations' },

    # Tips, tricks, and suggestions as you use Windows
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-338389Enabled' },
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SoftLandingEnabled' },

    # Suggested content in Settings app
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-338393Enabled' },
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-353694Enabled' },
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-353696Enabled' },
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SubscribedContent-353698Enabled' },

    # Notifications in Settings app
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\SystemSettings\AccountNotifications'; Name = 'EnableAccountNotifications' },

    # Finish setting up device (OOBE/Scoobe)
    @{ Path = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\UserProfileEngagement';  Name = 'ScoobeSystemSettingEnabled' },

    # Sync provider ads in Explorer
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced';       Name = 'ShowSyncProviderNotifications' },

    # Silent / automatic installation of suggested apps
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; Name = 'SilentInstalledAppsEnabled' },

    # Suggested app toast notifications (MS store ads)
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.Suggested'; Name = 'Enabled' },

    # Phone Link / mobile device suggestions
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Mobility';               Name = 'OptedIn' },

    # Account-related notifications in Start
    @{ Path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced';       Name = 'Start_AccountNotifications' },

    # Windows Backup reminder notifications
    @{ Path = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.BackupReminder'; Name = 'Enabled' }
)

foreach ($Setting in $Settings) {
    try {
        if (-not (Test-Path -Path $Setting.Path)) {
            New-Item -Path $Setting.Path -Force -ErrorAction Stop | Out-Null
        }

        New-ItemProperty -Path  $Setting.Path `
                         -Name  $Setting.Name `
                         -Value $DefaultValue `
                         -PropertyType DWord `
                         -Force `
                         -ErrorAction Stop | Out-Null
    }
    catch {
        Write-Warning "Failed to restore $($Setting.Path)\$($Setting.Name): $_"
        $ErrorCount++
    }
}

if ($ErrorCount -gt 0) {
    Write-Error "Revert completed with $ErrorCount error(s). Check warnings above."
    exit 1
}

Write-Host "Revert complete. All Windows suggestion and notification settings restored to defaults."
exit 0

A note on HKCU scope

Because every key lives under HKEY_CURRENT_USER, the CI evaluates and remediates only for whichever user is logged in at evaluation time. A freshly imaged machine with no active session will report as unknown rather than non-compliant. If you need these applied before first logon, the cleanest complement is a Default User hive script run during OSD - mount C:\Users\Default\NTUSER.DAT, write the same values under HKU\DefaultUser, then dismount. The CI then serves as the ongoing drift-detection layer for users already provisioned.