SysManager for Windows

A modern Windows system monitoring and management toolkit: live network diagnostics with gamer-friendly presets, Windows updates, disk and memory health, gaming launcher cache cleanup, app updates and bulk install via winget, performance tuning, privacy and telemetry controls, context menu management, secure file shredding, DNS & hosts editor, duplicate finder, battery health, process management with built-in descriptions, startup control, shortcut cleanup, app blocking, install alerts, Windows features toggle, and a friendly Event Log viewer — all in one WPF desktop app.

---

⚡ Get it in one line

winget install laurentiu021.SysManager

…or download the portable .exe — self-contained, no installer, no .NET runtime needed. Runs on Windows 10/11.

⭐ If SysManager saves you a reinstall or a head-scratch, please star the repo — it's the single biggest help for a solo project and how others discover it.

---

Table of contents

• What it is
• Why SysManager?
• Features — all 58 tabs, grouped
• Screenshots
• Install
• Uninstalling
• Build from source
• First-time flow
• Documentation
• Reporting bugs and requesting features
• Tech stack
• Privacy
• Contributing
• Support
• License

What it is

SysManager is a local-first desktop tool for keeping an eye on a Windows PC. It rolls network diagnostics, system health, Windows Update, app management (updates, bulk install, uninstall), privacy controls, context menu management, secure file shredding, driver inventory, safe deep cleanup, and a readable Event Log viewer into a single tabbed WPF app.

Everything runs on the machine itself. No cloud, no telemetry, no account.

When SysManager uses the network. There is no background phone-home — the app never sends usage data. Network access only happens for features you explicitly use: the network diagnostics (ping / traceroute / speed test), and downloading an app you chose to install via winget. App icons in the Bulk Installer are an opt-in extra — off by default, and only when you tick "Load app icons from the web" does it fetch them from Google's favicon service. Nothing else leaves your PC.

The one call SysManager makes on its own is the version check: at startup it asks GitHub's public releases page which release is newest, so it can tell you when a fix is available. Nothing about you or your PC is sent. It runs at most once a day, and the About tab has a checkbox — "Check GitHub for a new version when SysManager starts" — that switches it off entirely. The Check for updates button still works on demand either way.

The local diagnostic log keeps 14 days of rolling files in %LocalAppData%\SysManager\logs, and your Windows user name is replaced with [user] in every line — including inside error messages — so a log you choose to share does not carry your account name with it.

Built with gamers in mind — live ping overlays for CS2, FACEIT, PUBG and streaming endpoints, Steam/Epic/Battle.net/Riot/GOG/EA launcher cache cleanup, and an honest "is it my PC, my ISP, or the server?" verdict.

A quick tour: Dashboard, Tweaks Hub, Resource History, Settings Watchdog, Scheduled Maintenance, CLI, Ping, Disk Analyzer. More below ↓

Why SysManager?

Most Windows utilities do one thing, or bundle telemetry and upsells. SysManager is a single, local-first app that covers the whole maintenance surface — and it's fully open source.

	SysManager	CCleaner	Wintoys	O&O ShutUp10	HWiNFO
Open source (MIT)	✅	❌	❌	❌	❌
No telemetry / no account	✅	❌	❌	✅	✅
Fully local (no cloud)	✅	❌	✅	✅	✅
Portable single .exe	✅	❌	✅	✅	✅
Disk / cache cleanup	✅	✅	✅	❌	❌
Privacy & telemetry toggles	✅	⚠️	✅	✅	❌
Network diagnostics (ping / traceroute / speed)	✅	❌	❌	❌	❌
Disk / RAM SMART health	✅	⚠️	❌	❌	✅
App updates + bulk install (winget)	✅	❌	⚠️	❌	❌
Free	✅	⚠️	✅	✅	✅

_{⚠️ = partial, paywalled, or limited. Comparison reflects the free editions as of 2026; features evolve — corrections welcome via an issue.}

Features

Sidebar navigation

The sidebar organises 58 feature tabs into 12 groups — 11 collapsible groups plus a flat top-level Dashboard entry — so you can find what you need without scrolling through a flat list. The active tab stays marked with an accent bar, selected background, and stronger label while you move between groups. Every tab row and every group header is also keyboard-operable with a visible focus cue. All 58 tabs are fully implemented:

Group	Tabs
🏠 Dashboard	Dashboard
🔧 System	System Health · Windows Update · Performance Mode · Services · Startup Manager · Windows Features · Restore Points · Task Scheduler · Boot Analyzer · System Fixes · Tweaks Hub 🔬
🎮 Gaming & Profiles	Gaming Profile 🔬 · Standby List Cleaner · Timer Resolution · CPU Core Affinity · Display Profiles
📊 Monitor	Process Manager · Resource History 🔬 · Camera/Mic/Location · App Alerts · File Lock Detector · Settings Watchdog 🔬 · Bandwidth Monitor
🧹 Cleanup	Quick Cleanup · Deep Cleanup · Shortcut Cleaner · Scheduled Maintenance 🔬
💾 Storage	Disk Analyzer · Duplicate Finder
🌐 Network	Ping · Traceroute · Speed Test · Network Repair · DNS & Hosts
📦 Apps	App Updates · Bulk Installer · Uninstaller
🛡️ Privacy & Security	Privacy & Telemetry · File Shredder · App Blocker · Debloater & Ads · Browser Cleaner · Edge/OneDrive Remover · Defender Tweaks · Notification Blocker 🔬
🎨 Customization	Context Menu · Dark Mode Scheduler · Volume Control
ℹ️ Info	Drivers · Battery Health · System Logs · System Report · Legacy Panels · About
⚙️ Advanced	Profile Export/Import · CLI Interface 🔬 · Environment Variables

🔬 = Preview — fully implemented and usable, marked in-app while it settles in.

Groups expand and collapse with a click. Collapsed groups show a child count badge, a subtitle with abbreviated child labels, and a tooltip with the full list. Dashboard renders as a flat top-level entry without an expander arrow. Each tab shows a slim progress bar under its name when performing a long-running operation, so you always know which tab is working.

Theme customization

A palette button in the top-right corner opens an appearance popup with:

• Dark mode — 6 curated presets (Midnight Indigo, Deep Ocean, Dark Forest, Neon Rose, Violet Night, Warm Ember)
• Light mode — 6 curated presets (Clean Indigo, Sky Breeze, Warm Sand, Mint Fresh, Soft Blossom, Lavender)
• Custom mode — free hex input for accent, background, surface, and text colors
• Background shade slider for fine-tuning lightness/darkness
• Settings persist between sessions

Graph lines follow the theme rather than fighting it. The Ping, Bandwidth Monitor and Resource History charts each draw with a fixed set of colours — blue is CPU, purple is memory — and those colours were chosen against a dark card. Switching to a light theme darkens each line by exactly as much as it needs to stay at 3:1 against the card it is drawn on, so the line remains followable without a second palette to maintain and without changing which colour means what. Brightness moves, hue does not; on the six dark presets, where the original colours already clear the bar, nothing changes at all.

Keyboard navigation

The app is operable without a mouse, and the control you are on is always visible. Tab moves forward, Shift+Tab back, Space presses a button or ticks a checkbox, and the arrow keys move within a table or a row of filter chips.

The focus outline is deliberately two thin lines of opposite shade — one light, one dark — rather than a single accent-coloured ring. A single colour cannot be visible everywhere: it has to show up on a purple primary button, a red delete button, a grey secondary button and a plain card, and any one colour disappears against at least one of those. With two, one line always contrasts whatever is underneath. Measured across all 12 themes, the outline stays at 4.5:1 or better against every surface it is drawn on — above the 3:1 WCAG asks of a non-text indicator.

Context Menu Manager

Manage Windows Explorer right-click entries — toggle them on or off without deleting anything (uses the standard LegacyDisable registry mechanism):

• Presets: Win10 Default (classic full menu), Win11 Default (modern compact), Custom
• Selecting a preset resets to clean defaults, disabling third-party entries — re-enable individually
• Win10/Win11 style toggle — switch between classic and modern menu (restarts Explorer)
• Visual preview on hover — real screenshots of each menu style
• Entry explanations — human-readable descriptions for common entries
• "Applies to" column — shows whether entry affects Files, Folders, Desktop, or Directory Background
• HKCU fallback — system-protected entries can be toggled via user-level registry override
• Admin elevation banner with one-click restart as administrator

Environment Variables

Edit Windows environment variables without the cramped built-in dialog:

• User and System scopes in one grid — filter by scope, search by name or value
• In-place value editing, plus add and remove variables
• Dedicated PATH editor for PATH-like variables — reorder directories, remove entries, and strip duplicates in one click
• Missing folders highlighted so you can spot dead PATH entries at a glance
• Local until Apply: changes are staged and each scope gets a one-time safety snapshot before its first write. New User snapshots stay under HKCU; System snapshots use access-controlled HKLM storage, and only that protected source can restore machine-wide variables
• Changes broadcast to Windows, so new terminals pick them up without a reboot
• System-scope edits need administrator rights (standard elevation banner); user variables can be edited without it

Dark Mode Scheduler

• Switch the Windows light/dark theme instantly — apps only, or the taskbar and Start too
• Schedule it — set a dark time and a light time (e.g. 19:00 / 07:00) and the theme follows automatically; handles the overnight switch correctly
• Applies immediately with no sign-out, no admin needed, and is fully reversible
• Honest about its limits — the schedule runs while SysManager (or its tray) is open; it's not a background Windows service

Volume Control

• Per-app volume mixer — lists every app currently playing on your default playback device, each with its own volume slider, mute toggle, and a live peak meter
• Live and lightweight — the app list reconciles on a ~1-second loop and the meters update on a shared timer, both paused while the tab is hidden so it costs nothing in the background
• Real names and icons — resolved from each audio session's process (with a safe fallback for protected processes), including the Windows "system sounds" session
• Per-app output routing — send one app to your headset and another to your speakers. Where Windows exposes the routing interface, each app gets an output-device picker in the row; on builds where it doesn't, the row shows a "Choose output device…" button that opens Windows' per-app sound settings so you're never left without a path
• Volume presets — save the current per-app volumes and mutes as a named preset (e.g. "Gaming", "Focus") and re-apply it in one click; presets are keyed by app so they work across restarts, and are stored locally in %LocalAppData%\SysManager
• Tray shortcut — a "Volume mixer" item in the system-tray menu opens the app straight to this tab

Network monitor

• Live ping across multiple targets overlaid on a single latency chart
• Auto-verdict that tells you in plain English whether packet loss is local, at your ISP, or at the far-end service
• Presets for gamers & streamers:
  • Global (Google, Cloudflare, your router)
  • CS2 Europe — Valve matchmaking relays (Vienna, Luxembourg, Warsaw, EU West/Central/East)
  • FACEIT Europe — competitive CS2 servers in DE, NL, UK
  • PUBG Europe — EU matchmaking cloud regions (Frankfurt, Ireland, London)
  • Streaming — YouTube, Twitch, Cloudflare
• Auto-traceroute on a configurable interval (30 s – 10 min)
• Speed tests: HTTP (Cloudflare) and the official Ookla CLI (auto-downloaded) with persistent history (last 20 results per engine) for tracking service degradation over time
• Every speed result comes with a plain-English verdict — what that speed is actually enough for (video calls, HD, 4K, several devices at once) rather than just a number — plus one line comparing it with your previous test on the same engine
• Jitter, loss %, and average ping per target rolled up into health pills
• Network repair tools: DNS flush, Winsock reset, TCP/IP reset with confirmation dialogs and admin checks

System logs (Windows Event Log, friendly)

• Browse System, Application, Security, and Setup logs
• Each event gets a plain-English explanation and recommended next steps
• Filter by severity and time range, plus full-text search
• Mark any event with the flag button to keep it findable while you keep scrolling or change filters. "Clear marks" removes them all, including any a filter is hiding
• Export to CSV, with a "search online" link for unknown events
• The Security log requires administrator rights. Without them the page says so outright rather than showing an empty list that looks like "no events"

System report

• One-click, read-only snapshot of the whole machine: OS, CPU, memory (with per-slot module detail), GPU, motherboard, storage health, and active network adapters
• Storage section carries SMART detail when available — temperature, wear %, and power-on time — reusing the same disk-health data as the System Health tab
• Export as plain text, a styled self-contained HTML page, or structured JSON — or copy the text straight to the clipboard
• Fully local: nothing on the system is changed and the report is written only to the file you choose — nothing leaves the machine

System health

• OS / CPU / RAM / storage overview
• SMART data per disk: temperature, wear %, power-on hours, read/write errors
• Colour-coded verdict per drive
• Memory diagnostic that scans the last 30 days of WHEA events for RAM errors
• Schedule the Windows Memory Diagnostic at next boot
• Read-only chkdsk with auto-discovered NTFS/ReFS drives and multi-select
• BIOS & firmware — BIOS version/date/vendor, motherboard model, boot mode (UEFI/Legacy), and Secure Boot status, all read-only. A Find BIOS update button opens the right manufacturer support page (ASUS, MSI, Gigabyte, ASRock, Dell, HP, Lenovo, …) for the detected board, and Copy info grabs the model + BIOS version for support searches. SysManager never flashes firmware itself.

Restore Points

• List every Windows System Restore point — sequence number, date, description, and type — newest first
• Create a restore point with an optional custom description (enables System Restore on the system drive first if it's off)
• Restore the PC to a selected point, with a clear confirmation that warns Windows will restart and that programs/drivers added since that point are removed
• Admin elevation banner — viewing the list works unprivileged; creating and restoring need administrator rights

Legacy Panels

• One-click launcher for the classic Windows applets that newer releases keep hiding: Control Panel, Sound, Power Options, Network Connections, Region, System Properties, User Accounts, Device Manager, Computer Management, Programs and Features, Mouse, and Date and Time
• Pure launchers — each just opens the built-in panel; nothing is modified, so no elevation or confirmation is needed
• The applet list is fixed in code, so no typed input ever reaches the launcher

System Fixes

One-click repairs for common Windows breakages, each with a clear description and a confirmation before it runs:

• Reset Windows Update — stop the update services, clear the SoftwareDistribution and catroot2 caches, and restart the services
• Reinstall WinGet — re-register the App Installer when app installs/uninstalls fail
• Set up Auto Sign-in — opens the built-in User Accounts dialog, so Windows stores the credential securely and SysManager never handles your password
• Live output, honest success/failure reporting, admin elevation banner
• Network-stack reset (Winsock / TCP-IP / DNS flush) lives on the Network → Network Repair tab, which offers those as individual one-click tools.

Tweaks Hub

• One place for safe, reversible optimizations that are otherwise spread across tabs — review them all in a single list, tick the ones you want, and apply or undo in bulk
• Essential group — low-risk, per-user tweaks that apply without administrator
• Advanced group — higher-impact, machine-wide tweaks behind a caution banner (need administrator)
• Apply Selected / Undo Selected with a live count of pending changes — nothing is written until you click, and each tweak is individually reversible
• SysManager tries to create a System Restore point before the first change in a session (best-effort — needs administrator and Windows' once-per-24h limit); the status line tells you when one was actually created. Every tweak is also individually reversible regardless
• Each row shows whether it's currently Applied or at the Windows Default; it's a front-end over the same reversible operations as the Privacy & Telemetry tab

Boot Analyzer

• Shows how long your PC takes to boot — total, core (main path), and desktop ready-up time — across recent boots, read from the Windows boot-performance history (Diagnostics-Performance log)
• A trend line tells you whether the last boot was faster or slower than your recent average
• Lists the apps, drivers, services, and devices Windows flagged as slowing boot, with the delay attributed to each
• Read-only; reading the log requires administrator (elevation banner shown)

Task Scheduler

• Browse every Windows scheduled task with its state, type, last and next run, and what the task is for in Windows' own words — hovering that shows which publisher created it, which is what decides the type label
• Color-coded by type — Third-party, well-known Telemetry (Compatibility Appraiser, CEIP, Feedback, Error Reporting), and System — so it's obvious what's safe to touch
• Enable / disable any task; disabling is fully reversible and never deletes the task — System tasks show an extra warning before you disable them
• Filter by name or path, and optionally hide system tasks to focus on the rest
• Changes need administrator and are verified by reading the task's state back

Windows Update (Windows Update Agent COM API)

• Direct Windows Update Agent COM integration (Microsoft.Update.Session) — installs everything WUA can offer, including optional drivers and firmware that PSWindowsUpdate filters out client-side
• Unified DataGrid for everything in one scan — standard, feature upgrades, optional drivers, and hidden updates
• Categorized with colored pills: Security, Cumulative, Defender, Driver, Servicing, .NET, Feature upgrade, Hidden — click headers to sort
• Per-update checkbox selection with Select all / Deselect all — install exactly what you want, skip what you don't
• Live progress per update: Connecting → Downloading → Installing → ✓ Installed streamed to the console as it happens
• Per-row Status column updated in real time (Pending… → Downloading… → Installing… → Installed / Installed (reboot required) / Failed / Not applied)
• Honest aggregate reporting: Installed X/Y. Failed: Z. Not applied: W.
• Reboot detection — toast notification if any update requires reboot
• Pending-reboot check, update history (last 30 — via PSWindowsUpdate)
• Admin banner with a one-click "Run as Administrator" relaunch
• PSWindowsUpdate is optional now (used only for the History view); install it from a normal, non-administrator SysManager session. The installer validates the official PowerShell Gallery endpoint and uses the current-user module directory. A Check now button confirms on demand whether the module is present, so you don't have to run Update History to find out
• Update timing & deferral — defer feature updates by N days while security patches keep flowing, pause all updates for a bounded window (max 35 days, then Windows auto-resumes), or restore defaults. Uses the documented Windows Update policy keys and is fully reversible. No "disable updates forever" option by design — the strongest action is a bounded pause, so the machine is never left permanently unpatched.

App Updates (winget)

• Scan for upgradable packages
• Sort by name, ID, version, or source via clickable column headers
• Select all or individual packages, bulk upgrade with per-package status

Cleanup (fast)

• Clear TEMP folders
• Empty the Recycle Bin
• Run SFC /scannow and DISM /RestoreHealth in the background — keep using the app while they grind

Deep cleanup (safe)

• Scan-first: every category is discovered with size + file count before a single byte is deleted. You pick what goes.
• System buckets: NVIDIA / AMD / Intel installer leftovers, Windows Update cache, Delivery Optimization cache, Windows Installer patch cache, TEMP, Prefetch, crash dumps, old CBS logs, DirectX shader cache, Recycle Bin on every drive.
• Gamer buckets — launcher caches only, never game files or logins: Steam (appcache, htmlcache, depotcache, shader cache), Epic Games Launcher, Battle.net, Riot / League of Legends, GOG Galaxy, EA Desktop.
• Windows.old is detected and flagged as irreversible, never selected by default.
• Safe by design: never touches browsers, passwords, the registry, active drivers, or actual game files. Locked files are skipped, never forced.

Large files finder (part of Deep Cleanup)

• Scan Downloads, Documents, Desktop, Videos, Pictures, Music, Program Files, or a whole drive.
• Configurable min-size (default 500 MB) and top-N (default 100).
• Read-only — only "Show in Explorer" and "Copy path" actions. Deletion is disabled by design so a mis-click can never hurt anything.

Startup Manager

• Lists every program that runs at Windows boot: the Run and RunOnce registry keys for both your account and the whole machine, including the separate location 64-bit Windows uses for programs installed by a 32-bit installer, plus both Startup folders and logon-triggered scheduled tasks
• Toggle on/off without deleting the original entry (same mechanism as Task Manager) — the disable flag is written to the location Windows actually reads for that kind of entry, so a disabled item really stays down
• Sort by name, publisher, safety, or status via clickable column headers
• Plain-language description for recognised programs (from the built-in database) instead of a raw command line, plus a Safety chip — Windows / Known app / Not recognised — so you can tell what an entry is before deciding whether to turn it off
• Shows name, publisher, and enabled/disabled status; the full command path is on hover
• Open file location in Explorer

Windows Features

• Lists all Windows optional features with current state (Enabled/Disabled)
• Toggle enable/disable per feature with confirmation dialog
• Categorized: Virtualization, Networking, Development, Media & Print, Legacy
• Shows reboot-required status after toggling
• Search/filter across all features
• Requires administrator privileges for modifications

Duplicate File Finder

• Three-pass scan: group by size, partial-hash pre-filter, then full SHA-256
• Duplicate groups sorted by wasted space (descending)
• Preset folders or custom folder selection
• Configurable minimum file size filter
• Suggests which copy to keep — one file per group is badged Keep, chosen as the oldest (usually the original). The rule is stated on screen rather than applied silently, each row shows its date so you can check it, and "Keep this one" moves the badge when you know better — a copy that preserved its timestamp, or a cloud-sync rewrite, will fool the heuristic
• Read-only — "Show in Explorer", "Copy path" and "Keep this one" only. Nothing is deleted, moved or renamed; deciding which of five identical photos to remove is done by you, in Explorer

Disk Analyzer

• Space breakdown by top-level folders with drill-down navigation
• Drive usage bar with total/used/free
• Preset paths (fixed drives, user profile, Program Files) or custom browse
• Show in Explorer for each folder
• Says what it doesn't count — four Windows system areas ($Recycle.Bin, System Volume Information, Windows\WinSxS, Windows\CSC) are skipped because they are slow or unreadable, and junctions are never followed, since following one would double-count or lead outside the folder you asked about. WinSxS alone is often several GB, so the tab states on screen that its total can be smaller than the free space Windows reports, and names the exact folders on hover
• Folders Windows wouldn't let it fully read are marked, so a partial figure never looks like a complete one

Process Manager

• Lists running Windows processes with PID, memory, threads, and status
• Real-time filter by name, description, category, or PID
• Sort by memory, CPU usage, name, category, or PID via clickable column headers
• Built-in description database — 108 common Windows processes and popular applications with plain-language descriptions and categories (System, Browser, Development, Communication, Media, Gaming, etc.). The description sits under each process name and the category has its own sortable column, so a process you don't recognise explains itself without a web search — including the Windows system processes whose own description Windows withholds unless SysManager is elevated
• Safety column — every process is labelled Windows, Known app or Not recognised, with a hover explanation of what that means for ending it. Sortable, so everything unrecognised can be grouped together at a glance
• Kill process with confirmation dialog, and the warning matches the real cost. Processes Windows genuinely cannot survive losing (winlogon, csrss, lsass, …) are refused outright. Security and servicing processes (Defender's engine, Windows Installer) can be ended, but only after a prompt that says plainly it can switch off protection or interrupt an update part-way, and that a restart does not undo that. Other Windows components get a warning that a feature may look broken until you sign out. Everything else gets the ordinary "unsaved work may be lost" confirm
• Open file location in Explorer

Resource History

• Historical CPU, RAM, GPU usage and temperatures — the app samples your vitals every 10 seconds in the background (including while minimized to the tray), so you can investigate what caused a spike yesterday instead of seeing only the live moment
• Scrollable timeline — pick a range (last hour, 6 hours, 24 hours, 7 days, 30 days); the usage chart (CPU / RAM / GPU %) and a separate temperature chart (CPU / GPU °C) redraw to fit, downsampled so even a 30-day view stays smooth
• Configurable retention — keep 7, 14, or 30 days of history; older samples are pruned automatically
• Export to CSV — save the visible range for analysis in Excel or elsewhere
• Strictly local: history is stored in your %LocalAppData%\SysManager folder and nothing ever leaves the machine

Bandwidth Monitor

• See your network usage at a glance — live total download and upload speed with a rolling throughput chart (the last ~2 minutes), so you can spot a sudden upload (a background sync, an update, something unexpected) the moment it starts
• Who's using the network — a per-app list showing which programs are talking, how many connections each holds, and the remote ports involved. This works with no administrator rights and no setup — it reads the same connection tables Windows exposes to any user
• Precise per-app speeds (optional) — for exact upload/download rates and session data totals per app (like Task Manager's Network column), enable precise mode; it uses a Windows kernel trace and so needs administrator. The tab offers it only when you're already running as administrator and falls back to the no-admin view automatically if the trace can't start — it never breaks the tab
• Threshold alert — set a Mbps limit and the tab warns you when total download or upload goes over it (handy for catching a runaway background upload); set it to 0 to turn the alert off
• Look back over the last hour, day, or week — pick a range and the chart shows the throughput it recorded, with how much you actually downloaded and uploaded over that period and the fastest speed you hit. That answers "where did my data cap go?" without any account or cloud service. History is recorded while the tab is open and kept for 7 days, in a plain file on your own PC
• Strictly local and read-only: SysManager only observes, never throttles or blocks, and nothing about your traffic leaves the machine

File Lock Detector

• Find what's holding a file — when you get a "file in use" error, enter or browse to a file/folder path and see which process(es) are using it, via the Windows Restart Manager (the same mechanism Explorer's own dialog uses)
• Shows process name, PID, type, and start time for each locker
• End process — terminate a selected locker (with confirmation) to release the file; critical system processes are protected from termination
• Detection works as a standard user; ending a process owned by SYSTEM or another user needs administrator rights (surfaced, not crashed)

Camera/Mic/Location

• Shows which apps recently used your camera, microphone, or location, and when
• Reads the Windows access history (CapabilityAccessManager consent store) — covers both Store apps and desktop programs
• Devices in use right now are flagged and sorted to the top
• Read-only: an Open privacy settings button hands off to Windows to grant or revoke a permission — SysManager never changes capability permissions itself

Settings Watchdog

• Catch the settings Windows Update silently resets — feature and quality updates often flip telemetry back to Full, re-enable web search, the Widgets board, lock-screen ads, and Start-menu suggestions
• See exactly what is being watched — the full list of monitored settings, each with its value right now in plain language and the reason it is watched, visible from the moment you open the tab rather than only after something has changed
• Save a baseline of your current preferences with one click; the watchdog remembers exactly what each watched setting was
• Check now re-reads the live values and lists any drift in plain language — e.g. "Diagnostic data: was 'Off (Security)', now 'Full'" — with the category and a before/after comparison
• Restore changed writes the drifted settings back to your baseline values in one step (HKLM-backed settings need administrator rights, surfaced not crashed)
• Strictly local: the baseline lives in your %LocalAppData%\SysManager folder and the watchdog only ever reads or writes a fixed list of well-known registry values

Operation Lock

• Prevents conflicting concurrent operations across tabs
• Operations grouped by category (Disk, Network, SystemModification)
• If a conflicting operation is already running, the UI shows which operation is blocking and refuses to start the new one
• Integrated into every tab that mutates disk, network, or system state (Cleanup, Deep Cleanup, Disk Analyzer, Duplicate Finder, Speed Test, Traceroute, Network Repair, Shortcut Cleaner, Performance Mode, Environment Variables, and the Dashboard's quick actions)

Shortcut Cleaner

• Scans Desktop, Start Menu, Quick Launch, and Recent Items for broken .lnk shortcuts whose targets no longer exist
• Lists results with name, location, and missing target path
• Select all / deselect individual items
• Move to Recycle Bin or permanent delete, with confirmation dialog
• COM-based IShellLink resolution for accurate target validation

Scheduled Maintenance

• Automate maintenance on a schedule — register one Windows scheduled task that runs SysManager in the background (via its CLI) to clean temporary files or purge standby memory, daily or weekly at a time you pick
• See the last run, next run, and last result of the task at a glance
• Update or remove the schedule any time, each with a confirmation
• Runs in your user context (no admin required) and only ever touches its own task at \SysManager\Scheduled Maintenance — no other scheduled tasks are affected
• Built on the same safe CLI verbs; nothing destructive is automated

Privacy & Telemetry

• 12 registry-based toggles across 3 categories (Telemetry, UI Declutter, Features)
• Telemetry: disable diagnostic data, activity history, advertising ID, feedback prompts
• UI Declutter: disable Start suggestions, tips, lock screen tips, Spotlight ads
• Features: disable Copilot, Cortana, web search in Start, widgets
• Explicit apply — flip toggles to stage changes, press Apply to write to the registry, or Discard to revert pending changes. A live counter shows how many changes are queued, so accidental clicks never modify the system silently.
• Category filter and search
• Requires admin for HKLM-backed toggles
• Fully reversible — re-enable any toggle with one click

File Shredder

• Secure multi-pass file and folder deletion beyond recovery
• Three shred methods: Quick (1 pass, zero fill), Standard (3 passes), Thorough (7 passes)
• Cryptographically random overwrite data (RandomNumberGenerator)
• Add files or entire folders via file picker dialogs
• Progress tracking per-item with cancel support
• Skips junction points and symbolic links (prevents symlink attacks)
• Confirmation dialog before irreversible shred

DNS & Hosts

• DNS Preset Switching — one-click DNS change: plain resolvers (Google, Cloudflare, Quad9, OpenDNS) plus ad/malware/family-blocking variants (Cloudflare 1.1.1.2 malware / 1.1.1.3 family, AdGuard DNS ad-blocking + family, OpenDNS FamilyShield), each with a description of what it blocks. IPv6 resolvers are configured automatically alongside IPv4. Preset changes and reset to automatic (DHCP) are confirmed, then verify the captured adapter and DNS state again inside the mutation script. An Undo button follows that adapter's stable identity and restores its exact prior IPv4 and IPv6 automatic/static configuration without persisting DHCP-supplied addresses as static overrides.
• Hosts File Editor — view, add, and remove entries from the Windows hosts file with a clean table UI. Add IP + hostname pairs, toggle entries, or remove them. Backs up hosts file before modifications.
• Requires administrator privileges for both DNS and hosts operations
• Admin elevation banner with one-click restart

Bulk Installer

• Curated catalog of popular applications grouped by category: Browsers, Communication, Media, Development, Utilities, Gaming, Security, Office & Productivity, Creativity, Networking & VPN, Runtimes & Frameworks
• Select multiple apps and install all via winget in one batch operation
• Custom winget search — search the entire winget repository and add any package to your install queue
• Category filter and text search across the catalog, plus a button that ticks every app in the chosen category at once
• Per-package install status tracking with ETA
• Live console output showing winget progress
• GroupedView with visual category headers

App Alerts

• Monitors Program Files, AppData\Programs, and registry uninstall keys for new application installations
• FileSystemWatcher on install directories + 30-second registry poll cycle
• Shows timestamped install history with app name, publisher, path, and detection source
• Start/stop monitoring, acknowledge alerts, show all currently installed apps, clear history
• Notifies you when a new install is detected, so you find out even when you are on another tab or the window is in the notification area

App Blocker

• Blocks applications from executing using Image File Execution Options (IFEO) registry mechanism
• Enter an exe name or browse for a file, confirm, and the app is prevented from launching
• Fully reversible — unblock restores normal execution
• Shows list of currently blocked apps with select/deselect and batch unblock
• Requires admin privileges for registry modifications

Debloater & Ads

Remove preinstalled Windows Store apps you don't use:

• Scan all installed Store apps with name, publisher, and a short description
• Curated "common bloat" preset pre-selects safe, frequently-removed apps (Bing News/Weather, Clipchamp, Solitaire, Xbox apps, consumer Teams, and more)
• System-critical apps are protected — the Store, frameworks, and security/shell components are denylisted and can never be selected or removed
• Impact summary + confirmation before anything is uninstalled
• Reversible — removal is per-user, so any app can be reinstalled from the Store
• Search and per-app descriptions help you decide before removing

Browser Cleaner

Reclaim space and clear browsing traces, per browser:

• Auto-detects Chrome, Edge, Brave, Opera, and Firefox
• Every profile, not just the first — if you keep separate Chrome/Edge/Brave profiles (personal and work, or one per person), each is scanned and named in its own row ("Google Chrome — Profile 1"), so you can see which one you're cleaning. Cleaning one profile never touches another
• Per-category with size shown: Cache, History, Cookies, Sessions
• Cookies/sessions are flagged and left unticked by default — cleaning them signs you out, so it's always an explicit choice; cache and history are pre-selected
• Confirmation with an impact summary before anything is deleted
• Per-user (no admin); locked files (browser open) are skipped, not forced, and symlinks/junctions are never followed

Edge/OneDrive Remover

Get Microsoft Edge and OneDrive out of your way — reversibly:

• OneDrive: full removal for your account — stops the client, runs the official uninstaller, and clears its File Explorer sidebar entry. No admin needed. Files already synced to this PC stay on disk; cloud-only files simply aren't downloaded
• Edge: disable & de-integrate, never uninstall — Windows relies on Edge (WebView2) and reinstalls it if forced out, so instead this turns off its background mode and startup boost (via the documented Group-Policy keys) and disables its automatic-update scheduled tasks, so Edge stops running on its own. You can still open it normally
• A Restore button for each — reinstall OneDrive and re-pin its sidebar entry, or clear the Edge policies and re-enable its update tasks — so nothing here is one-way
• Honest about the default browser — Windows hash-protects the default-browser choice, so no app can switch it for you; the tab opens Windows' default-apps settings and guides you instead of pretending to change it
• Every action confirms first with a plain-language impact summary; disabling Edge needs administrator (the tab explains why and what it unlocks), removing OneDrive does not

Defender Tweaks

Manage Microsoft Defender without digging through Windows Security:

• Status at a glance — real-time protection, cloud protection (MAPS), PUA protection, and Controlled Folder Access
• Toggle PUA protection and Controlled Folder Access (ransomware protection)
• Scan exclusions — add or remove folders Defender should skip (handy for big game libraries); paths are validated and additions never replace your existing exclusions
• Honest about Tamper Protection — if it's on, Windows can silently ignore changes, so the tab detects it, warns you, and only reports a change as done after reading it back and confirming Windows actually applied it
• Changes need administrator and are confirmed first; lowering a protection is always an explicit, reversible choice

Notification Blocker

Mute the apps that nag you with pop-up notifications — update reminders, trial offers, "rate us" prompts:

• Lists every app that has shown a notification, most recently active first, with how many notifications it sent recently so the noisy ones stand out
• Mute per app with a switch — it flips the same per-app setting as Windows Settings > Notifications, so nothing is hooked or hacked, and Windows itself honors it
• Master switch to silence everything at once (with a clear warning that it also mutes calendar and reminder alerts)
• Pending-changes flow — flips stay local until you press Apply, with a confirmation and a Discard to back out
• Fully reversible (flip the switch back), per-user, no administrator needed

Battery Health

• Charge %, health %, wear level, cycle count, chemistry
• Design vs full-charge capacity via WMI
• Estimated runtime display
• Gracefully shows "No battery detected" on desktops
• Health and wear need administrator rights (Windows only reports capacity to an elevated process). Without it they read "Not available" and the page explains why, instead of showing a number that isn't a measurement.

Uninstaller

• Lists all installed applications via winget with size from registry
• Filter by name or package ID
• Sort by name, size, or publisher via clickable column headers
• Select/deselect all, batch uninstall with confirmation dialog
• Local app support — uninstalls apps not in winget via registry UninstallString
• Runs uninstall actions only from an unelevated SysManager session; each package requests its own UAC elevation when required
• Live console output from winget

Gaming Profile 🔬

• One-click "game mode" — apply a bundle of reversible optimizations together, then restore them automatically when the game exits (or with a single Stop)
• Optionally target a running game — its CPU priority is raised to High and it's pinned to the performance cores, and its exit is what triggers the automatic revert
• System-wide optimizations — Ultimate Performance power plan, reduced visual effects, finest (~0.5 ms) timer resolution, freeing standby memory, pausing Windows Search indexing, and silencing notifications — each ticked individually
• Fully reversible & snapshot-based — the original state (power plan, visual effects, indexing, notifications) is captured before any change and restored exactly; SysManager also tries a System Restore point first (best-effort, needs administrator)
• Crash-safe — the session is recorded on disk, so if SysManager closes mid-game the system-wide changes are offered for restore on next launch
• Honest about admin — freeing standby memory and pausing indexing need administrator; without it they're clearly skipped, not silently failed
• 🔬 Preview — fully reversible today; closing background apps and saved per-game profiles are planned for a later update

Timer Resolution

• Lower input latency for games — requests the finest Windows timer resolution (≈0.5 ms) instead of the ~15.6 ms default, via the ntdll NtSetTimerResolution API
• Live current/finest/default readout — always re-queries the effective resolution (Windows 11 may stop honoring a request while the window is minimized), so the number shown is the real one
• One-click enable / restore — fully reversible; the request is released when you restore it or simply close the app. No admin required
• Power-cost warning — a finer timer wakes the CPU more often, increasing power draw and battery drain on laptops

Display Profiles

• Quick-switch resolution + refresh rate — pick a mode (e.g. 165 Hz for gaming, 60 Hz for work) from the list of everything your display supports, using only the Windows display APIs (no NVIDIA/AMD tool conflict)
• Safe by design — applies for the session, so a reboot reverts; on top of that a 15-second auto-revert restores the previous mode unless you confirm "Keep", so a bad mode can never strand you on a blank screen
• Per-display — choose which monitor to configure; shows the current mode
• Validates each mode (CDS_TEST) before applying; no admin required

CPU Core Affinity

• Pin a process to specific CPU cores — pick a running process and choose which logical CPUs it may run on, then Apply (or Restore the original)
• Hybrid-CPU aware — on Intel 12th-gen+ CPUs, P-cores and E-cores are detected and labelled (via GetLogicalProcessorInformationEx), with one-click P-cores / All cores presets
• Safe and temporary — affinity is per-running-process and reverts when the process exits; no admin for your own processes (changing another user's process is surfaced as needing admin, not a crash)
• An empty selection is rejected — Windows treats an empty mask as "let the OS decide", so the app never silently does the opposite of what you picked

Standby List Cleaner

• Frees cached standby memory — the built-in equivalent of ISLC, to reduce stutter when RAM runs low in games
• Live stats — total RAM, available, and memory load %, refreshed every 2s
• Purge on demand or auto-purge when available RAM drops below a threshold you set with a slider
• Safe and non-destructive — the standby list is clean, disk-backed file cache, so clearing it loses nothing; Windows reloads from disk on next use
• Reading stats needs no admin; purging requires administrator (it enables the same privilege RAMMap and ISLC use) and reports cleanly if not elevated
• The auto-purge switch and its threshold are remembered between sessions, so arming it once is enough

Performance Mode

• Per-tweak Apply buttons — each setting is independent
• Power Plan: Balanced / High Performance / Ultimate Performance
• Visual Effects: reduce animations via P/Invoke (instant, no logout)
• Game Mode: enable/disable via registry
• Xbox Game Bar: disable overlay and Game DVR via registry
• NVIDIA GPU: force max performance with auto-detected GPU subkey (reboot required)
• Processor State: force CPU min state to 100%
• Overlays info: manual instructions for Discord, Steam, NVIDIA GFE, EA App
• OriginalSnapshot: captures the exact system state before the first change, persists it locally, and reloads it when the tab opens so Restore All remains available after an app restart; persisted fields are validated before use and the confirmation shows when the baseline was captured
• Confirmation dialog before every change
• Restore point creation: create a Windows System Restore point before making changes (requires admin)
• RAM working set trim: free physical RAM by trimming all process working sets — same as RAMMap's "Empty Working Set" (useful before launching a game)
• Hibernation toggle: enable/disable hibernation to free disk space (deletes hiberfil.sys when disabled)

Services

• Lists all Windows services with current status and startup type
• Gaming recommendations: services tagged as "safe to disable", "advanced", or "keep enabled" — hover a row's description to read why, in plain language instead of Microsoft's own wording
• Filter by status (Running/Stopped), safety level (Safe/Caution/Critical), gaming recommendation (Safe to disable / Keep enabled / Advanced), or free-text search — each chip shows how many services it matches, so you know before pressing it
• Mark any row with the flag button to keep it findable while you keep filtering or searching. "Clear marks" removes them all, including any a filter is hiding
• Start, stop, disable, or enable services with confirmation dialogs
• Requires admin for all mutations

Drivers

• Sortable DataGrid table of all installed system drivers
• Columns: Device Name, Manufacturer, Version, Date — click headers to sort
• Hide built-in Windows drivers — tick the filter to leave only the drivers your hardware maker installed (graphics, audio, network, …), which is usually what you care about when checking whether something needs updating. The count shows both totals, so nothing looks like it vanished
• Data parsed from Get-CimInstance Win32_PnPSignedDriver

Dashboard

• One-line OS / CPU / RAM / disk summary
• Live uptime counter
• Real-time vitals — CPU, RAM, and GPU usage refreshed at 300 ms while the tab is visible (polling pauses automatically when it isn't), with live indicator dots.
• Recent Activity — what SysManager actually changed on this PC, with timestamps: cleanups, deletes, uninstalls, privacy and DNS changes, restore points, shredded files. Counts and sizes only — never file names, since the log is plain text on your own disk. Opening a tab isn't an action, so it isn't listed.
• Quick Tune-Up — one-click wizard that cleans temp files, optionally empties the Recycle Bin, scans for broken shortcuts, checks disk SMART health, flags high uptime (14+ days) and high RAM usage (85%+). Displays a summary card with freed space, warnings, and links to relevant tabs. Non-destructive, no admin required.
• Health Score — overall system health gauge (0–100) combining disk SMART, RAM usage, uptime, and battery wear. Color-coded ring (green / amber / red) with up to 3 actionable recommendations. Auto-computes on load and refreshes with "Scan system".
• System Tray — background health monitoring (60s polling), CPU/RAM tooltip, Windows notifications when RAM > 90%, uptime > 14 days, or disk health degrades. Context menu: Show / Exit.
• Closing is your choice — the first time you close the window, SysManager asks whether it should keep running in the notification area or close completely, and remembers the answer. If you pick the notification area, it tells you where the window went so it doesn't look like it vanished. Right-click the tray icon to reopen or exit at any time.

Updates (for SysManager itself)

• Auto-check on startup against the GitHub Releases API, plus a manual "Check for updates" button in the About tab.
• Discreet banner in the main window when a newer version is available.
• Background download of the new build with a progress bar. If the download is blocked, a "Manual download" button opens GitHub in the browser.
• SHA256 hash verification before install — the downloaded build is checked against the published .sha256, so a damaged or truncated download is blocked. Both files come from the same release, so this catches a corrupted download rather than a substituted release asset — see Verifying the download for the stronger check, the build attestation, which you run yourself.
• The build is also inspected for an Authenticode signature, and the check fails closed if a signature is present but cannot be read. SysManager ships unsigned today and no publisher is pinned yet, so a signature is not currently an integrity gate; the publisher-and-certificate-chain check is written and switches on with a one-line change the day a signing certificate exists.
• One-click "Install" replaces the running executable in-place and restarts automatically (no manual file copying needed).
• "Go back to the previous version" — the build being replaced is kept, so an update that installs cleanly but turns out to be broken is not a dead end. The button appears in the About tab only when a retained copy exists, asks for confirmation, and notes that whatever the newer version fixed will come back too. One generation is kept, so it never accumulates copies of the app.
• Full release-note history pulled live from GitHub.
• "Report a problem" opens the GitHub bug-report form with your SysManager version and administrator state already filled in — the two fields reports most often miss — and "Ask a question" opens Discussions for anything that is not a bug. Both are in the About tab; a browser tab opens only when you press them.

Profile Export / Import

• Export your SysManager settings — theme/appearance and speed-test history — to a single portable JSON file, and import them on another PC
• Selective export (tick which sections to include) and selective import (confirm what a profile contains before anything is overwritten)
• Version-aware — refuses profiles created by a newer, incompatible build
• Only SysManager's own config is ever touched (never system settings), so an import is fully reversible — just import a different profile

CLI Interface

• Automate the safe actions from scripts, Task Scheduler, or deployment tools — SysManager accepts command-line flags and runs headless (no window), writing its output to the launching console
• Commands: --health (read-only health score), --cleanup (temp-file cleanup, never follows junctions), --trim-ram (purge the standby list), plus --version, --help, and --list
• --json emits machine-readable output; --silent suppresses chatter for scripting; conventional exit codes (0 success · 1 error · 2 usage) let a script branch on the result
• Only read-only or non-destructive actions are exposed on the CLI — anything that changes the system irreversibly stays in the GUI behind a confirmation dialog
• The in-app CLI Interface tab is a reference: it lists every command with a one-click copy button. Example: SysManager.exe --cleanup --silent

Screenshots

Click any thumbnail to view full size. Screenshots live under docs/screenshots/ — see docs/screenshots/README.md for capture conventions.

In motion

The feature tour GIF is at the top of this README. Here's a second one focused on cleanup & maintenance tools:

Cleanup & tools: Quick/Deep Cleanup, Disk Analyzer, Dark Mode Scheduler, Defender Tweaks, Privacy & Telemetry.

🏠 Dashboard

🔧 System — Health · Windows Update · Performance · Windows Features · Restore Points · Boot Analyzer · System Fixes · Tweaks Hub

   

   

 

🎮 Gaming & Profiles — Gaming Profile · Standby Cleaner · Timer Resolution · CPU Affinity · Display Profiles

   

 

📊 Monitor — Resource History · App Alerts · File Lock · Settings Watchdog · Bandwidth

   

Bandwidth Monitor is implemented but its screenshot is still being recaptured — the previous one showed the tab while it was a placeholder, which no longer reflects the app.

🧹 Cleanup — Quick Cleanup · Deep Cleanup · Shortcut Cleaner · Scheduled Maintenance

   

💾 Storage — Disk Analyzer · Duplicate Finder

🌐 Network — Ping · Traceroute · Speed Test · Repair

   

📦 Apps — App Updates · Bulk Installer

 

🛡️ Privacy & Security — Privacy & Telemetry · File Shredder · App Blocker · Debloater · Browser Cleaner · Defender

   

   

🎨 Customization — Dark Mode Scheduler

ℹ️ Info — Drivers · Battery · Logs · System Report · About

   

 

⚙️ Advanced — Profile Export/Import · CLI Interface

 

Install

Via winget (recommended)

SysManager is published to the Windows Package Manager community repository. Install or update with a single command:

winget install laurentiu021.SysManager

Updates are delivered automatically with each release — run winget upgrade to stay on the latest version.

Direct download

Grab SysManager-v<version>.exe (the <version> shown on the latest release) from the latest release and double-click it. The executable is self-contained — no installer, no .NET runtime required.

About the download counter. The badge above counts release-asset downloads, not people. Most of that number is machinery: SysManager's own in-app updater fetches the exe, winget installs fetch it, and Microsoft's manifest validation fetches it for every submitted version. Across all releases the exe has been fetched roughly 88 times for every checksum file — and a human verifying a download takes both. Treat the badge as traffic, not as an install base.

Verifying the download

Each release ships a matching SysManager-v<version>.exe.sha256. Verify before running (replace <version> with the version you downloaded):

Get-FileHash .\SysManager-v<version>.exe -Algorithm SHA256
# Compare the output to the contents of SysManager-v<version>.exe.sha256.

That check confirms the file downloaded intact. To also confirm where the file came from, each release carries a GitHub build attestation — a signed record, kept in a public transparency log outside this repository, tying that exact binary to the commit and workflow that produced it. With the GitHub CLI:

gh attestation verify .\SysManager-v<version>.exe --repo laurentiu021/SystemManager

This is the stronger of the two checks. The .sha256 file is generated in the same job and published onto the same release as the binary it describes, so both come from one source — enough to catch a corrupted download, but not a substituted release asset. The attestation is signed by GitHub's own infrastructure at build time and logged publicly, so it also records which commit and workflow produced the file, and that record cannot be rewritten after the fact. Each release also ships SysManager-v<version>.sbom.json, a CycloneDX inventory of every NuGet package resolved for that build — useful for checking the dependency set against a vulnerability feed.

First launch: Windows will warn you

The first time you run it, Windows shows a blue box titled "Windows protected your PC". This is expected, and it is worth knowing what it does and does not mean.

It means Windows does not recognise the publisher. Code-signing certificates cost money and require a registered identity, and SysManager is a free one-person project without one yet, so every build is "unknown publisher" to Windows regardless of what it contains. It is not a virus warning — Windows has not found anything wrong with the file.

The dialog only offers a Don't run button. To continue:

1. Verify the SHA256 first, using the command above. Do this before anything else — it is what makes the next step safe rather than blind.
2. Click More info — a small link in the dialog, easy to miss.
3. The file name and publisher appear, along with a Run anyway button. Click it.

Windows remembers the choice, so this only happens once per downloaded version.

If you would rather avoid the warning altogether, install through winget instead:

winget install laurentiu021.SysManager

winget fetches and validates the package outside the browser download path, so the first-launch prompt does not appear.

Only click through this warning for a file you downloaded from the official releases page and whose hash you verified. The same dialog protects you from genuinely malicious files, so it is worth reading rather than reflexively dismissing.

If your antivirus flags the download

Windows Defender or another antivirus may flag or quarantine the .exe — sometimes days after it ran fine, because these tools also score a file on how widely it has been seen before. This is the second-most-likely thing to happen after the SmartScreen box above, so it is worth explaining rather than leaving you to guess.

Why it happens. Two reasons, and neither is about what the code does:

• The shape of the file. SysManager ships as one large executable that carries everything it needs inside it, compressed, and unpacks itself into a temporary folder when you launch it. That is a legitimate way to ship a portable app with no installer — and it is also what some malware does to hide, so a scanner that judges structure rather than behaviour treats it as suspicious. Add an unknown publisher and no signature, and a heuristic engine has every reason to be cautious.
• What the app genuinely does. It deletes files, changes registry settings and stops processes. That is the job of a maintenance tool, and it is also a fair description of something you would not want running unasked.

How to check, instead of guessing. Take the SHA-256 from the release page and open

https://www.virustotal.com/gui/file/<paste-the-sha256-here>

VirusTotal addresses files by hash, so if that exact build has been scanned this shows the report — including which engines flagged it and which did not. If nobody has submitted that build yet the page will say so, and you can upload it there yourself.

Then read the Verifying the download section above and run the build attestation. That is the check that actually settles the question: it proves the file you hold is the output of a public workflow, built from a public commit in this repository.

Be honest about what a scan proves. A couple of hits out of ~70 engines on an unsigned, compressed, self-extracting build is the ordinary pattern for this kind of file — it is not by itself evidence of a problem. Equally, a completely clean sheet is not proof that a file is safe; plenty of malware is clean on the day it is released. The attestation is stronger than either, because it ties the binary to source you can read.

If it has already been quarantined, restore it or add an exclusion only after the SHA-256 matches and gh attestation verify succeeds. If either check fails, delete the file and download it again from the releases page — do not add an exclusion for a file you have not verified.

Code signing

Releases are currently unsigned, which is why the warning above appears. The intention is to sign them through the SignPath Foundation — a programme that provides free code-signing certificates to open-source projects, with the signing performed by SignPath.io — and an application there is the plan for this project. It has not happened yet: the Foundation asks for a level of public visibility (stars, external write-ups, independent references) that a three-month-old project does not have, which is a fair bar for a certificate issued in their name. Until a certificate is actually in place, this section says so plainly rather than implying one exists.

Until a certificate is in place, the two checks above — the published SHA-256 and the GitHub build-provenance attestation — are what establish that a download is the genuine, unmodified build. The attestation is the stronger of the two, and it will remain useful after signing arrives: it records which commit and workflow produced a given binary, which a signature alone does not.

The update path is already written for signing, but not yet armed. The publisher it compares against is a single constant that is deliberately empty until a certificate exists, so today a signed build is accepted on the strength of the SHA-256 check alone; a signature that is present but unreadable is still refused. On the day signing is switched on, filling in that one constant turns on the publisher match and the certificate-chain validation together — the point of writing them now is that the check cannot quietly become a formality later. See SECURITY.md for the detail.

Code signing policy

Not yet in effect. This policy is written in advance of any certificate, because the SignPath Foundation programme the project hopes to sign through requires the roles and approval process below to be documented and public before an application is considered. Nothing here describes a signing arrangement that exists today — releases are unsigned, and the SHA-256 plus build attestation above are what verify a download. The provider attribution that belongs in this section will be added on the day a certificate is actually issued, and not a day earlier.

Team roles. SysManager is maintained by a single developer, so all three roles below are held by the same person. That is stated plainly rather than dressed up as a team, because it is the honest description of who can change the code and who approves a release.

• Authors (may commit to the repository): laurentiu021
• Reviewers (must review any change proposed by a non-committer): laurentiu021
• Approvers (decide whether a given release may be signed): laurentiu021

Every change reaches main through a pull request whose build-and-test check has passed; main is protected, requires branches to be up to date before merging, and force-pushes and deletions are disabled. Releases are built only by GitHub Actions from this public repository — no binary is ever built or uploaded from a developer machine — and each carries a SHA-256 checksum, a CycloneDX SBOM, and a GitHub build-provenance attestation recording the exact commit and workflow that produced it. That attestation is the load-bearing guarantee here: because a single maintainer necessarily holds administrative rights, the meaningful assurance is not "the rules cannot be bypassed" but "every published binary is verifiably the output of a public workflow run against a public commit", which anyone can check with gh attestation verify.

Privacy policy. This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it. The full policy — including a table of every file the app writes on your own machine, and the four situations in which it uses the network at all — is in SECURITY.md.

Third-party components are listed in the SBOM published with every release. The network features that contact anything outside your machine do so only against a destination you choose (ping, traceroute and speed-test targets; app installs through winget), plus one optional daily version check against the GitHub Releases API that can be switched off.

Uninstalling

SysManager is a single portable executable. There is no installer, nothing is copied into Program Files, and no system-wide registry keys are created for the app itself.

To remove it completely:

1. Delete the executable — SysManager-vX.Y.Z.exe, wherever you saved it. That is the whole program.
2. Delete its settings and logs (optional, a few hundred kilobytes):
   • %LocalAppData%\SysManager
   • %AppData%\SysManager
3. Remove the scheduled task, if you created one. Only applies if you used Scheduled Maintenance: open that tab and remove the schedule, and the app unregisters the task for you. It is the only thing SysManager registers with Windows, and only ever when you explicitly ask for it.

If you installed through winget, winget uninstall laurentiu021.SysManager covers step 1.

Changes you asked SysManager to make to Windows — privacy toggles, context-menu entries, services, tweaks — are Windows settings rather than part of the app, so they stay as you set them. Every tab that changes something offers the reverse action, so undo anything you want reverted before deleting the executable.

Build from source

Prerequisites: Windows 10 or newer and the .NET 10 SDK.

git clone https://github.com/laurentiu021/SystemManager.git
cd SystemManager
dotnet run --project SysManager/SysManager/SysManager.csproj

Produce a single-file exe

From the repo root:

.\publish.ps1

Or manually:

dotnet publish SysManager/SysManager/SysManager.csproj `
  -c Release -r win-x64 --self-contained true `
  -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true `
  -o publish

The resulting SysManager.exe lands in publish/ and runs standalone on any Windows 10 / 11 x64 machine.

First-time flow

1. Launch the app — it opens on the Dashboard.
2. Go to Network and press Start — live ping begins.
3. For anything in Windows Update, Cleanup (SFC/DISM), or system-wide App updates, click the yellow "Run as Administrator" banner when it appears. The app relaunches elevated.

Documentation

• ARCHITECTURE.md — project structure and key design decisions
• TESTING.md — how the test suite is organised and run
• CHANGELOG.md — release notes
• CONTRIBUTING.md — how to build, test, and open a PR
• SUPPORT.md — where to ask questions and get help
• SECURITY.md — reporting vulnerabilities, security model
• CODE_OF_CONDUCT.md — community standards

Reporting bugs and requesting features

Found something broken? Missing a feature you'd love to have?

• 🐛 Bugs — open an issue using the bug report template.
• 💡 Features — open an issue using the feature request template, or post in Discussions › Ideas if it's still a rough idea rather than a concrete request.
• 💬 Questions and how-to's — use Discussions › Q&A instead of issues for anything open-ended.
• 🔒 Security vulnerabilities — please report privately via the Security tab. See SECURITY.md for the full policy.

The About tab inside the app has a "Copy environment info" helper that dumps your SysManager version, Windows build, CPU, RAM, GPU, storage, display, and elevation state in a format ready to paste into a bug report.

Tech stack

• .NET 10 (WPF, C# 14)
• CommunityToolkit.Mvvm for MVVM plumbing
• Microsoft.Extensions.DependencyInjection for IoC
• WPF-UI (lepoco/wpfui) for Fluent Design theme and controls
• LiveCharts2 for the real-time latency chart
• H.NotifyIcon.Wpf for system tray integration
• LibreHardwareMonitor and NvAPIWrapper for CPU/GPU/disk temperature sensors
• Serilog for structured logging
• xUnit, NSubstitute, and FlaUI for unit, integration, and UI-automation tests

Privacy

SysManager runs entirely on your machine. It does not phone home, does not collect telemetry, and does not require an account. Network features only contact the hosts you explicitly configure (ping targets, speed-test servers, Windows Update / winget endpoints).

Contributing

PRs welcome! Please read CONTRIBUTING.md for the build setup, coding conventions, and pull-request workflow. New contributors are expected to follow the Code of Conduct.

Support

SysManager is free and open source, built by one person in their spare time. If it saved you a reinstall or a clean-up headache, you can back its development:

Sponsorships go toward a code-signing certificate — which makes Windows show the publisher's name instead of "unknown publisher", and reduces the SmartScreen warning as the signed builds accumulate reputation — plus the build pipeline and time to fix bugs and finish the tools that are still half-built. The app stays free either way.

License

MIT — see LICENSE.

Crafted by laurentiu021.