RidoGuard
A free Windows privacy and security suite. Windows telemetry, services, firewall rules, scheduled tasks and preinstalled apps in one place.
Read this before you download
The installer is not code signed. Windows SmartScreen will warn you.
Windows cannot tell who published it. The first time you run the installer you get a blue full screen panel:
Windows protected your PC. Microsoft Defender SmartScreen prevented an unrecognised app from starting. Running this app might put your PC at risk.
The publisher is listed as Unknown publisher. Where SmartScreen is set to block, or policy blocks unsigned installers, there is no Run anyway button and the install cannot proceed.
That is expected for an unsigned build. It is not a virus alert. Windows has not seen this one before.
If you decide to go ahead
- Download the file, and keep it if your browser calls it uncommon.
- Run it.
- Click More info, then Run anyway. The installer starts.
- Approve the administrator prompt.
If any of that makes you uncomfortable, do not do it.
Why it is not signed
A code signing certificate is an annual cost RidoIT has not taken on yet. Once bought, builds get signed and show RidoIT as the publisher. A new certificate has no SmartScreen track record of its own, and a softer warning usually persists for a while.
RidoGuard is not verified by Microsoft and not on any Microsoft allow list. Anyone telling you otherwise, including any page claiming to mirror this download, is not Ridoco.
What it does
Twenty-five screens, all in the current build.
Getting started
- Quick Setup, a guided first pass
- Dashboard, the current state
- Preset Profiles, grouped changes you apply in one go
Privacy and security
- Telemetry Control
- Privacy Settings
- Security Audit, reading the state of Defender, the firewall, UAC, BitLocker and Secure Boot
- Hardening Scanner, reporting processes that match a suspicious catalogue, startup items in user-writable folders, and startup items launched through a living-off-the-land binary
- App Permissions
Network
- Firewall and network rules
- Network Privacy
- Per-app firewall control
- DNS and the hosts file
Health
- Diagnose Device, which reads the sensors and counters the machine already keeps, among them interrupt load per core, cooling against the power budget, USB devices that keep dropping out, kernel drivers, drive health, firmware and boot settings, screens and cables, and restore points. A finding RidoGuard can fix gets a button. Cooling test works the graphics card and processor flat out for about a minute, with nothing to install. Recover a file copies a file or folder out of a restore point into a folder you pick.
System
- Bloatware Control
- Service Optimizer
- Scheduled Tasks
- Performance
- Windows Update policy and deferral
- Driver Management
- Convenience, with a File Explorer fix that keeps the sort and grouping you choose. It lists what it will change first, and Undo puts every value back
- App Installer
Reports and logging
- Audit Log, newest first, with the value each change replaced, and Roll Back to Last Change
- Compliance Report
- Event Log IDs, what it writes to the Windows event log
About
- About, with the version and build, the log folder, Check for updates, the switch for the check at startup and the third-party notices
A profile shows you its changes before it makes them
Inspect before apply
The list is exact. Approve it, or close it and nothing changes.
Restore point and registry backup
Once you approve the list, RidoGuard asks Windows for a restore point and backs up each registry key just before it changes it. System Protection is often off on Windows 11, and Windows refuses the restore point while it is off: RidoGuard writes it to the log and carries on. Turn System Protection on for that net. The registry backup is written either way.
Rollback
RidoGuard records the changes made by profiles, service presets, app removals and the switches on twelve screens, with the value each change replaced. In Audit Log, Roll Back to Last Change lists what it will put back, and what it cannot, before you confirm. Press it again to go one step further back. A profile applied in one go is one step. A change with no automatic way back, such as new DNS servers or an app removed for every user, stays in the audit log. You set it back by hand. From a terminal in the RidoGuard folder, .\ridoguard rollback puts back the same step without the list.
Drift detection
Windows updates and other software reset settings. When you open RidoGuard it compares the profiles you applied with the machine as it is now: registry values, service start types, startup items and the power plan. A banner lists each setting that moved, with the value the profile left and the value it has now. Firewall rules are not checked.
A restore point and a registry backup are not a real backup of your machine. Take one before you start.
What free means here
No price and no catch
Free to download and use, not a trial. No licence key, no account, no feature behind an upgrade.
No tracking
No analytics and no usage reporting. RidoGuard checks for a newer version when you open it, and you can switch that off on the About screen. Nothing is downloaded until you click Download and install. The portable zip only tells you a newer version exists. Builds 1.2.2 to 1.2.4 download the new installer in the background and wait for Restart to Update before they install it. The check goes to GitHub, where the downloads live. It carries no identifier, but GitHub sees your IP address, as with any download. Other traffic only happens when you use a feature that needs it: a DNS lookup when you block a telemetry hostname in the firewall, winget when you open App Installer or install an app, and Windows Update when you check for updates on that screen. The audit log, the registry backups and exported reports stay on your machine. The privacy statement covers this site.
Windows only
Windows 10 version 2004 (build 19041) or newer, 64-bit, including Windows 11. It carries its own .NET 8 runtime. Nothing needs installing first. Administrator rights are required. No macOS or Linux version is planned.
Two builds
An installer that puts it in Program Files with an entry in Apps and Features. A portable zip that installs nothing, extracts anywhere and keeps its data beside the executable, its log included. Both builds carry ridoguard.exe beside the app, a command line tool with apply, audit, verify, rollback, export-policy and guards.
Free, not open source
RidoGuard is proprietary. You may download and run it on machines you own or control. You may not redistribute, resell or modify it, except where the law gives you that right anyway, which for a lawful acquirer in the EU it sometimes does. The source is not published. It bundles third-party open-source components under their own licences. NOTICE.txt in both downloads lists them, and the About screen opens it. Dutch law applies, and it comes with no warranty. RidoGuard is a free tool and ships no licence file of its own.
You decide what to change
Disable the wrong service and something you use stops working. Each setting says what it does.
Download
That is the installer. The portable build is RidoGuard-Portable-1.3.0.zip. The release notes are on the release page.
Or install it with winget
winget install RidoIT.RidoGuard
winget downloads 1.3.0 from the same GitHub releases and checks the SHA256 before it installs it.
Or install it from PowerShell
This fetches the current release, checks it against the published SHA256 and only then opens the installer. If the hash does not match it stops and tells you.
$r = irm https://api.github.com/repos/Ridocompany/ridoguard-releases/releases/latest
$exe = $r.assets | ? { $_.name -like 'RidoGuard-Setup-*.exe' }
$sums = $r.assets | ? { $_.name -like 'SHA256SUMS-*.txt' }
$out = "$env:TEMP\$($exe.name)"
iwr $exe.browser_download_url -OutFile $out
$want = ((irm $sums.browser_download_url) -split "`n" | ? { $_ -match [regex]::Escape($exe.name) }) -split '\s+' | select -First 1
if ((Get-FileHash $out -Algorithm SHA256).Hash -eq $want) { Start-Process $out } else { 'Hash mismatch. Do not run it.' }Windows PowerShell 5.1 or PowerShell 7, no admin needed to download. The installer itself asks for admin. It edits Windows services.
Or check it by hand
Every release ships a SHA256SUMS file. Compare it before you run anything:
certutil -hashfile RidoGuard-Setup-1.3.0.exe SHA256
1.3.0 should read F2F80C427C9C1B3E53C7EA0772765C83C9F31408B5745D4524D9F41A42EF7F81. For RidoGuard-Portable-1.3.0.zip it is 5DA4FC9445F2B2778F9EEE25D9FB455CEE156A9B874AE975B7F5382CECC2BE86.
Questions and bug reports
Open a support ticket with your Windows version, your RidoGuard version, and what you were doing when it went wrong. One person reads them. No reply time is promised. From 1.3.0 the version is in the title bar, next to the name, and Copy version details on the About screen copies it with your Windows version. RidoGuard 1.2.4 and older do not show it inside the app: look under Control Panel > Programs > Programs and Features, or run winget list --id RidoIT.RidoGuard. For the portable zip, it is on the Details tab of the Properties of RidoGuard.UI.exe. Found a security problem in RidoGuard? Mail contact@ridoco.com with "RidoGuard security" in the subject.