Disable Delivery Optimization (TrustedInstaller Bypass)

Overview

This PowerShell script forcefully disables the Windows Delivery Optimization service (DoSvc).

Often, attempting to disable this service manually via services.msc or standard administrative command prompts results in an "Access Denied" error. This occurs because the service and its registry keys are protected by TrustedInstaller access control lists (ACLs).

This script utilizes C# P/Invoke to duplicate the TrustedInstaller process token, allowing the script to execute commands at the highest possible system integrity level. By doing so, it modifies the ACLs, disables the service in the registry, and forcefully stops the running process.

Prerequisites

Windows OS

PowerShell 5.1 or later

You MUST run this script from an Elevated PowerShell session (Run as Administrator).

Usage

Open PowerShell as Administrator.

Execute the script:

.\DisableDeliveryOptimization.ps1

The script will briefly spawn the TrustedInstaller service if it isn't running, duplicate its token, and execute a hidden command prompt to alter the DoSvc registry permissions and start type.

Verify the service is disabled by running:

Get-Service -Name DoSvc | Select-Object Name, Status, StartType

Disclaimer

Modifying system services and bypassing TrustedInstaller protections can have unintended consequences on Windows Update and system stability. Use this script at your own risk.

Credits

Joseph Peransi

GitHub: Github.com/pascalkeeper

X (Twitter): X.com/xAIModerator