DEV Community

Cover image for Before You Pipe Microsoft's One-Line Dev Box Setup into iex, Read What It Changes
Windows Mode
Windows Mode

Posted on

Before You Pipe Microsoft's One-Line Dev Box Setup into iex, Read What It Changes

#windows #powershell #devops #productivity

At Build 2026 Microsoft announced two things that matter if you set up Windows machines for coding: Windows Developer Configurations, a one-command setup for a fresh dev box, and Coreutils for Windows, native builds of ls, cp, grep and friends. Both were announced as generally available.

The setup is one line of PowerShell piped into iex. That is convenient, and it is also exactly the kind of command you should read before running on a machine you care about. So we read the repo docs and the scripts. Here is what actually happens, what changes on your machine, and the parts that could surprise you.

TL;DR

  • irm https://aka.ms/devconfig/standard/setup.ps1 | iex installs about 18 packages with winget, changes Explorer, Start, search and theme settings, installs WSL with Ubuntu, and may restart your PC once.
  • Standard runs the bootstrap with -Action Partial. Full runs -Action Full and adds Developer Mode, Sudo, widgets off, two Edge policies and Remote Desktop.
  • The scripts verify Microsoft Authenticode signatures on everything they download, but irm | iex itself does not verify the small wrapper script. You can check it yourself first.
  • The uninstall script permanently deletes the Ubuntu distro without asking, and it removes the tools it manages even if you had them installed before.
  • Coreutils for Windows installs with winget install Microsoft.Coreutils. In PowerShell several commands clash with built-in aliases, which matters for scripts.

The one-liners

From the WindowsDeveloperConfig repo:

# Standard experience
irm https://aka.ms/devconfig/standard/setup.ps1 | iex

# Full experience
irm https://aka.ms/devconfig/full/setup.ps1 | iex

# Uninstall (covers both)
irm https://aka.ms/devconfig/standard/uninstall.ps1 | iex
Enter fullscreen mode Exit fullscreen mode

The aka.ms links redirect to setup-standard.ps1, setup-full.ps1 and uninstall.ps1 in the repo. Each wrapper is about 20 lines. It downloads bootstrap.ps1 from a pinned commit, checks that the signer is Microsoft Corporation, and only then runs it with -Action Partial, -Action Full or -Action Uninstall.

The repo is honest about the gap: "irm | iex does not verify the wrapper's own signature; it trusts the HTTPS endpoint." If you want to check the entry script too, download it and look before you run anything:

$f = "$env:TEMP\setup-standard.ps1"
Invoke-WebRequest https://aka.ms/devconfig/standard/setup.ps1 -OutFile $f
Get-AuthenticodeSignature $f | Format-List Status, SignerCertificate
notepad $f
Enter fullscreen mode Exit fullscreen mode

It is short enough to read in a minute, and it is a good habit for any irm | iex install, not just this one.

What gets installed

The Standard setup installs these with winget:

Area Packages
Shell and terminal Windows Terminal, Intelligent Terminal, PowerShell 7, Oh My Posh
Source control Git, GitHub CLI
Editors and AI VS Code, GitHub Copilot CLI
Runtimes .NET SDK 10, Python 3.14 + uv, Node.js LTS + nvm for Windows
Cloud Azure CLI
Utilities Coreutils for Windows, Windows App CLI, PowerToys, Visual C++ Redistributable

It then sets PowerShell 7 as the default Terminal profile, installs Cascadia Code NF and Cascadia Mono NF for all users, adds a GitHub Copilot profile to the Terminal dropdown, and installs WSL plus Ubuntu with wsl --install -d Ubuntu --no-launch.

Practical numbers from the docs: roughly 30 minutes on a clean machine, about 15 GB of free disk space, up to two UAC prompts, and Windows 11 only. Windows 10 is not supported.

What it changes on your machine

This is the part worth reading twice. Some highlights from the documented registry changes and the "Known limitations" table:

  • Explorer: file extensions and hidden files shown, full path in the title bar, Explorer opens to This PC, no recent or frequent items in Quick Access.
  • Start and search: no web results in search, no Start recommendations, no search highlights.
  • Notifications: Do Not Disturb is turned on globally, not just for quiet hours, until you turn it back off.
  • Theme: dark mode for apps and the system.
  • Long paths: LongPathsEnabled set to 1.
  • Node: both Node.js LTS and nvm for Windows get installed. The docs suggest uninstalling Node.js first if you want nvm to own the PATH entry.
  • Your PowerShell profile: an Oh My Posh block is added to $PROFILE. If the profile already has other initialization, setup leaves it alone and flags it.
  • Terminal settings: settings.json is round-tripped through JSON, so comments are lost. A settings.json.bak is written first.

The Full setup adds more:

  • Developer Mode and Sudo (inline mode).
  • Widgets turned off through policy.
  • Two Edge settings written as policy, so Edge will say it is "managed by your organization".
  • Remote Desktop allowed (fDenyTSConnections set to 0). The docs note the firewall rule is not opened, but it is still a change to the machine's security posture.

What it does not do, per the docs: no telemetry, no sign-ins, no credential changes, no Windows Defender changes. Git and the GitHub CLI are installed but not configured, so you still need git config user.name and gh auth login.

There is also no dry run (-WhatIf) and no switch to skip individual packages. If you want a different package list, the documented path is to clone the repo, edit the files under src\windows-dev-config, and run the unsigned source with -AllowUnsigned.

The restart and the uninstall

WSL needs virtualization, so setup may restart the machine. It warns you and restarts after 10 seconds, so save your work before you start. A scheduled task called WindowsDevConfigResume picks the run up after you sign back in. If nothing happens:

Get-ScheduledTask -TaskName WindowsDevConfigResume
Enter fullscreen mode Exit fullscreen mode

Re-running the original one-liner is safe. Steps that are already done report already OK and are skipped. Logs go to devconfig-log.txt under %ProgramData%\CalmOS.

The uninstall deserves a warning of its own. According to the docs it:

  • Permanently deletes Ubuntu and its files, without confirmation.
  • Removes the tools it manages, including copies you had installed before running setup.
  • Resets settings to defaults rather than restoring what you had before (themes go back to light, for example).

If you have real work inside that Ubuntu distro, export it first:

wsl --export Ubuntu D:\backup\ubuntu.tar
Enter fullscreen mode Exit fullscreen mode

Coreutils for Windows

Coreutils for Windows is a Microsoft-maintained build of the Rust uutils projects (coreutils, findutils and grep), shipped as one multi-call binary. It is MIT licensed and has x64 and ARM64 builds. The current release at the time of writing is v2026.9.3. The Standard setup installs it, or you can install it alone:

winget install Microsoft.Coreutils
Enter fullscreen mode Exit fullscreen mode

Then the usual pipelines work in CMD and PowerShell:

grep -rn "TODO" src | wc -l
find . -name "*.log" -mtime +7
Enter fullscreen mode Exit fullscreen mode

A few things we would want to know before relying on it in scripts:

  • PowerShell 7.4 or later is required, and 7.6 or later is recommended for ~ support.
  • Alias clashes. In PowerShell, cat, cp, ls, mv, pwd, rm, sleep, sort, tee and others share names with built-in aliases. The installer hooks into PSReadLine to rewrite what you type interactively, but it does not remove the aliases. Check what a name resolves to with Get-Command ls -All.
  • Some commands are not shipped because they clash with Windows built-ins or need POSIX features: dir, more, whoami, kill and timeout among them. chmod, chown and uname are dropped too.
  • No /dev/null. Use NUL, as in find . -name "*.log" > NUL.
  • CRLF line endings can still trip byte-oriented tools like uniq.
  • You can turn off individual utilities with coreutils-manager disable <utility name>.

One detail that may confuse you: the Build blog calls Coreutils generally available, but the repo README still says "This project is in preview." Treat it like any young tool and test your scripts before switching a team over.

Our take

For a brand new machine or a throwaway VM, the Standard setup is a sensible default, and the signing and pinned-commit design is better than most irm | iex installers. On a machine you already use every day, we would read the settings list first, skip Full unless you actually want Remote Desktop and Edge policies, and back up WSL before you ever touch the uninstall script.

Have you tried Windows Developer Config or Coreutils for Windows on a real machine yet? Did it save you time, or did it change something you had to undo? And would you trust a one-line setup script on your main dev box, or only on a fresh VM?

We first wrote about the Build 2026 developer announcements on Windows Mode.

Top comments (0)