Ryan Ludwig

Stop Alienware Monitors from Auto-Installing AWCC Bloat via Windows Update

If you own an Alienware monitor (like the AW3225QF, AW3423DWF, AW2725DF, etc.), you’ve likely noticed Windows Update relentlessly downloading Alienware Command Center (AWCC) in the background—even if you never connected a USB upstream cable and only use DisplayPort/HDMI.

Some threads suggest taking ownership of C:\Windows\System32\DriverStore\FileRepository to delete files. Do not do this. Modifying system ACLs in the DriverStore is fragile; subsequent cumulative updates, driver revisions, or sfc /scannow runs will restore the directory, reset permissions, and push the software again.

Here is an architectural breakdown of how Dell pulls this off and how to kill it permanently using native Windows tools (tested on both Windows 11 Pro and Windows 11 Home).

The Attack Vector: Why This Happens Over Pure DisplayPort / HDMI

Dell abuses modern Windows DCH Driver Architecture:

  1. EDID Handshake: Over DisplayPort or HDMI (via DDC/CI), Windows reads the monitor’s hardware ID (e.g., MONITOR\DELA24E). That is a panel port id (HDMI2 HDR on the AW3225QF); every AW3225QF port id in the extension INF shares the same install section. The id to deny in Step 2 stays SWC\VID001&PID0001&AWCCWINUI3APP.
  2. The Extension INF: Windows Update downloads Dell’s certified monitor driver along with an Extension Driver (awfxdisp_..._ext_monitor.inf).
  3. The Virtual Child Node: That extension driver injects an [AddComponent] directive into your display adapter device tree, spawning a virtual child device under Software components with Hardware ID: SWC\VID001&PID0001&AWCCWINUI3APP
  4. The Silent Payload: Windows PnP sees this virtual device, queries Windows Update, and stages AWCC_IM_Driver_Component.inf. This INF contains:
SoftwareBinary = AWCCInstallationManager.exe
SoftwareArguments = /silent /IS_DRIVER_FLOW:YES /ISFeatureInstall:ALL

/silent skips the InstallShield wizard. It does not skip consent. In the Driver Store build this INF names (SoftwareVersion 6.14.20.0), consent reads the value AWCCInstallationDeclined under HKLM\SOFTWARE\Alienware\Alienware Command Center. If that value is YES and InstallVersion is missing, the suite returns 1603 before AW.NotificationUtility.exe and before any package is installed. That value is only checked after Windows has already launched AWCCInstallationManager.exe. A later build can ignore it. Any launch of this suite without IS_DRIVER_FLOW:YES deletes it. If InstallVersion is already present, this build does not read the decline value.

/ISFeatureInstall:ALL is not “install every package.” When the run is silent and consent has already allowed it, the suite rewrites ALL to AWCC_core, Game Library, FX, Peripheral, Display, OC, Dell Core Service, and AW Arena. Peripheral, Display, and OC still stay off unless this machine is a first-party Alienware system or already has their version keys. There is no package named AWCCService in this suite. The service package is Dell Core Services, and the suite can start Dell TechHub when that service is already installed.

Step 2 is what keeps that EXE from starting. The decline value is not a substitute.

Step 1: Purge the Staged Driver via pnputil (Do this BEFORE enabling restrictions)

Note: You must uninstall existing instances before enabling device installation restrictions, otherwise Windows PnP will block its own uninstallation engine with “The installation of this device is forbidden by system policy.”

  1. Open PowerShell as Administrator.
  2. Find the published oemXX.inf names associated with the AWCC installer and monitor extension:
Get-WindowsDriver -Online | Where-Object { $_.OriginalFileName -like "*AWCC*" -or $_.OriginalFileName -like "*awfxdisp*" } | Select-Object Driver, OriginalFileName, ProviderName, Version
  1. Forcefully uninstall and delete those packages from your DriverStore using their specific oemXX.inf names (replace with the actual names returned above):
pnputil /delete-driver oem89.inf /uninstall /force
pnputil /delete-driver oem188.inf /uninstall /force
  1. Open Device Manager (Win + X > Device Manager), expand Software components, and verify that Alienware Command Center Win32 Component Device is gone. (If still visible, right-click > Uninstall device).
  2. In Settings > Apps > Installed apps, uninstall Alienware Command Center if it was previously installed.

Step 2: Blacklist the Virtual Hardware ID

Rather than disabling all driver updates globally (which breaks automatic driver fetching for useful peripherals like USB-serial microcontrollers, printers, or ADB interfaces), we surgically blacklist only the AWCC software component node:

SWC\VID001&PID0001&AWCCWINUI3APP

For Windows 11 / 10 Pro

  1. Press Win + R, type gpedit.msc, and press Enter.
  2. Navigate to: Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions
  3. Double-click Prevent installation of devices that match any of these device IDs.
  4. Set it to Enabled.
  5. Click Show…, paste SWC\VID001&PID0001&AWCCWINUI3APP, and click OK.
  6. Ensure Allow administrators to override Device Installation Restriction policies in the same folder is set to Not Configured (or Disabled), so Windows Update running under SYSTEM cannot bypass it.
  7. Run gpupdate /force in an elevated terminal.

For Windows 11 / 10 Home (No gpedit)

The underlying PnP device restriction engine exists in Windows Home; it just lacks the MMC snap-in. Add the policy keys directly to the registry:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions" /v DenyDeviceIDs /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs" /v 1 /t REG_SZ /d "SWC\VID001&PID0001&AWCCWINUI3APP" /f

Step 3: Automate Windows Update Suppression (Preventing “Retry” Errors)

Step 2 is the block. Because the device-id policy rejects the software-component install at the PnP gate, Windows Update records a failure:

Install error - 0x800f0248 (SPAPI_E_POLICY_DISALLOWED)

Windows Update treats that as an unfinished job and retries it. A Dell decline registry value does not stop Windows from launching the EXE; it only runs after the launch, and only inside this suite’s driver flow. Hiding titles that match *Alienware*SoftwareComponent* keeps Settings from sitting on that retry. When Dell pushes a new driver revision, Microsoft also assigns it a new package ID.

Schedule a lightweight script that queries the native Windows Update Agent (WUA) COM API and marks matching updates as IsHidden = $true.

Run this single block in an elevated PowerShell prompt:

# 1. Create directory and save the hiding script
$ScriptDir = Join-Path -Path $env:ProgramData -ChildPath "CustomScripts"
if (-not (Test-Path -Path $ScriptDir)) {
    New-Item -ItemType Directory -Path $ScriptDir -Force | Out-Null
}

$ScriptPath = Join-Path -Path $ScriptDir -ChildPath "Hide-AlienwareBloat.ps1"

$ScriptContent = @'
$Session = New-Object -ComObject Microsoft.Update.Session
$Searcher = $Session.CreateUpdateSearcher()
$SearchResult = $Searcher.Search("IsInstalled=0")

foreach ($Update in $SearchResult.Updates) {
    if ($Update.Title -like "*Alienware*SoftwareComponent*") {
        $Update.IsHidden = $true
    }
}
'@

Set-Content -Path $ScriptPath -Value $ScriptContent -Force

# 2. Register Scheduled Task (Runs silently as SYSTEM at Logon and Daily)
$ActionParams = @{
    Execute  = Join-Path -Path $env:SystemRoot -ChildPath "System32\WindowsPowerShell\v1.0\powershell.exe"
    Argument = "-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File `"$ScriptPath`""
}
$TaskAction = New-ScheduledTaskAction @ActionParams

$Triggers = @(
    (New-ScheduledTaskTrigger -AtLogOn),
    (New-ScheduledTaskTrigger -Daily -At "12:00")
)

$SettingsParams = @{
    AllowStartIfOnBatteries    = $true
    DontStopIfGoingOnBatteries = $true
    StartWhenAvailable         = $true
    ExecutionTimeLimit         = New-TimeSpan -Minutes 5
}
$TaskSettings = New-ScheduledTaskSettingsSet @SettingsParams

$TaskParams = @{
    TaskName    = "Hide-Alienware-Update"
    Action      = $TaskAction
    Trigger     = $Triggers
    Settings    = $TaskSettings
    User        = "NT AUTHORITY\SYSTEM"
    RunLevel    = "Highest"
    Description = "Automatically suppresses Alienware SoftwareComponent driver updates."
    Force       = $true
}

Register-ScheduledTask @TaskParams

Test-run it immediately:

Start-ScheduledTask -TaskName "Hide-Alienware-Update"

Verification & Final State

  1. Open Settings > Windows Update and click Check for updates.
    • It will transition directly to “You’re up to date” with a green checkmark.
  2. Open Device Manager:
    • Under Monitors, your Alienware display functions with native refresh rates, HDR, and VRR/G-Sync intact.
    • Under Software components, the Alienware bloatware node will not exist.
  3. Future-Proofing: Whenever Dell publishes a new version revision for the same hardware id, the Step 2 policy rejects installation at the PnP layer and AWCCInstallationManager.exe never starts. The scheduled task only hides a Windows Update title that still matches *Alienware*SoftwareComponent*. A new hardware id needs a new deny entry; a retitled update needs an updated hide pattern.