RidoGuard
A free Windows privacy and security suite. Windows telemetry, services, firewall rules, scheduled tasks and preinstalled apps in one place.
Read this before you download
The installer is not code signed. Windows SmartScreen will warn you.
Windows cannot tell who published it. The first time you run the installer you get a blue full screen panel:
Windows protected your PC. Microsoft Defender SmartScreen prevented an unrecognised app from starting. Running this app might put your PC at risk.
The publisher is listed as Unknown publisher. Where SmartScreen is set to block, or policy blocks unsigned installers, there is no Run anyway button and the install cannot proceed.
That is expected for an unsigned build. It is not a virus alert, and it is not a claim that something was found in the file. Windows has simply not seen this one before.
If you decide to go ahead
- Download the file, and keep it if your browser calls it uncommon.
- Run it.
- Click More info, then Run anyway. The installer starts.
- Approve the administrator prompt.
If any of that makes you uncomfortable, do not do it.
Why it is not signed
A code signing certificate is an annual cost RidoIT has not taken on yet. Once bought, builds get signed and show RidoIT as the publisher. A new certificate has no SmartScreen track record of its own, and a softer warning usually persists for a while.
RidoGuard is not verified by Microsoft and not on any Microsoft allow list. Anyone telling you otherwise, including any page claiming to mirror this download, is not Ridoco.
What it does
Twenty three screens, grouped as the app groups them, all in the current build.
Getting started
- Quick Setup, a guided first pass
- Dashboard, the current state
- Preset Profiles, grouped changes you apply in one go
Privacy and security
- Telemetry Control
- Privacy Settings
- Security Audit, reading the state of Defender, the firewall, UAC, BitLocker and Secure Boot
- Hardening Scanner, reporting processes that match a suspicious catalogue, startup items in user-writable folders, and startup items launched through a living-off-the-land binary
- App Permissions
Network
- Firewall and network rules
- Network Privacy
- Per-app firewall control
- DNS and the hosts file
System
- Bloatware Control
- Service Optimizer
- Scheduled Tasks
- Performance
- Windows Update policy and deferral
- Driver Management
- Convenience
- App Installer
Reports and logging
- Audit Log, every change made by a profile, a bloatware removal, a service preset or a rollback
- Compliance Report
- Event Log IDs, what it writes to the Windows event log
Command line
- apply, audit, verify, rollback and export-policy
A profile shows you its changes before it makes them
Inspect before apply
The list is exact. Approve it, or close it and nothing changes.
Restore point and registry backup
RidoGuard asks Windows for a restore point and backs up the registry keys it is about to touch, before that list appears. System Protection is off by default on most Windows 11 installs, and Windows refuses the restore point while it is off: RidoGuard writes it to the log and carries on. Turn System Protection on for that net. The registry backup is written either way.
Rollback
RidoGuard records each change as a reversible entry. It goes back without anyone hunting for the original value. Rollback runs from the command line only: ridoguard rollback. The window shows you the audit log.
Drift detection
Windows updates and other software reset settings. RidoGuard re-checks the Balanced profile against the machine as it is now and tells you what moved.
A restore point and a registry backup are not a real backup of your machine. Take one before you start.
What free means here
No price and no catch
Free to download and use, not a trial. No licence key, no account, no feature behind an upgrade.
No tracking
No analytics and no usage reporting. Builds from 1.2.2 check the release channel for a newer version when you open them, and download it only after you say yes. Nothing about you is sent with that check. One exception: blocking a telemetry hostname in the firewall needs it resolved to an address first, so a DNS lookup goes out when you create such a rule. Nothing about you goes with it. The audit log, the registry backups and exported reports stay on your machine. The privacy statement covers this site.
Windows only
Windows 10 version 2004 (build 19041) or newer, 64-bit, including Windows 11. It carries its own .NET 8 runtime. Nothing needs installing first. Administrator rights are required. No macOS or Linux version is planned.
Two builds
An installer that puts it in Program Files with an entry in Apps and Features. A portable zip that installs nothing, extracts anywhere and keeps its data beside the executable. Exporting a compliance report to PDF needs the Microsoft Visual C++ 2022 x64 runtime: the installer puts it in place, the zip cannot. Most machines already have it, and everything else in the portable build runs without it.
Free, not open source
RidoGuard is proprietary. You may download and run it on machines you own or control. You may not redistribute, resell or modify it, except where the law gives you that right anyway, which for a lawful acquirer in the EU it sometimes does. The source is not published. It bundles third-party open-source components under their own licences. Dutch law applies, and it comes with no warranty. The full licence ships with the download.
You decide what to change
Disable the wrong service and something you use stops working. Each setting says what it does and what it costs you.
Download
Both builds and the release notes are on that page.
Or install it from PowerShell
This fetches the current release, checks it against the published SHA256 and only then opens the installer. If the hash does not match it stops and tells you.
$r = irm https://api.github.com/repos/Ridocompany/ridoguard-releases/releases/latest
$exe = $r.assets | ? { $_.name -like 'RidoGuard-Setup-*.exe' }
$sums = $r.assets | ? { $_.name -like 'SHA256SUMS-*.txt' }
$out = "$env:TEMP\$($exe.name)"
iwr $exe.browser_download_url -OutFile $out
$want = ((irm $sums.browser_download_url) -split "`n" | ? { $_ -match [regex]::Escape($exe.name) }) -split '\s+' | select -First 1
if ((Get-FileHash $out -Algorithm SHA256).Hash -eq $want) { Start-Process $out } else { 'Hash mismatch. Do not run it.' }Windows PowerShell 5.1 or PowerShell 7, no admin needed to download. The installer itself asks for admin. It edits Windows services.
Or check it by hand
Every release ships a SHA256SUMS file. Compare it before you run anything:
certutil -hashfile RidoGuard-Setup-1.2.4.exe SHA256
1.2.4 should read 412A605296B089C12FC15F3175CE1A92B75B5C7CCC3E963FB267DCA2CCE1BFA3.
Questions and bug reports
Open a support ticket with your Windows version, your RidoGuard version, and what you were doing when it went wrong. One person reads them, so no reply time is attached or implied.