Optimized AVD Session Hosts Out of the Box: How Atlas AVD Builds In the Windows Desktop Optimization Tool

By David, 2026-11-03

A stock Windows 11 Enterprise multi-session image is built for a laptop that one person owns. It ships Xbox services, consumer Store apps, a search indexer, prefetching, cellular and NFC services, and dozens of scheduled tasks for diagnostics and feedback. On a session host, each of those costs CPU, memory or disk IO, and on a multi-session host, a lot of it runs again for every user who signs in.

The usual answer is the Windows Desktop Optimization Tool (WDOT), written by Microsoft engineers on The Virtual Desktop Team as the next evolution of the Virtual Desktop Optimization Tool (VDOT). It's the standard starting point for trimming a Windows image for VDI.

Atlas AVD builds WDOT into provisioning. This post covers what WDOT does, why running it yourself takes more work than it looks, and how Atlas applies it to every session host it builds.

The short version: Windows Desktop Optimization is on by default in Atlas AVD. Every session host Atlas provisions gets nine low-risk optimization modules as the last step of its build, whatever image it's built from. The three modules that touch security, compliance or OneDrive stay off until you turn them on. You can change the set for the whole tenant or for one host pool, and every build logs which modules made a change.

What WDOT does

WDOT is a set of PowerShell scripts and configuration files. Each configuration file lists one kind of change, and you decide entry by entry whether to apply it:

• Services to disable, such as SysMain (Superfetch), Xbox Live services and mobile hotspot.
• Scheduled tasks to disable, such as Customer Experience Improvement Program uploads and power-efficiency diagnostics.
• AppX packages to remove, such as consumer apps, games and retired apps.
• Settings for networking, disk, Windows Search, visual effects, Edge, telemetry and more.

You run it against a reference VM before you capture an image, or against each host after it's built.

Why running it yourself takes more work than it looks

Every entry is your decision. WDOT's template configuration ships each entry set to skip and leave the choice to you. That's the right default for a general-purpose tool, because the safe answer depends on your environment. It also means someone on your team has to read every service, task and app, decide, and keep a record of why.

Some choices break things that aren't obviously related. Disabling the Volume Shadow Copy service breaks backup agents. Disabling the geolocation service breaks AVD location redirection. Removing a Store app can't be undone on a running host. These are the entries that turn an optimization pass into a support ticket.

It has to run on every host, every time. If you optimize the golden image, every new image version needs the same pass. If you optimize each host, the script has to run as part of every build, and someone has to check that it worked.

It's a script you maintain. Downloading WDOT onto each new VM means a third-party archive runs on every host, and a change upstream reaches your hosts the next time one is built.

How Atlas AVD applies it

On every new session host, from any image

Windows Desktop Optimization runs as the last section of the configuration script Atlas runs on each session host it provisions. It runs after apps, FSLogix and browser policies are in place, so its changes don't undo theirs. It works the same whether the host is built from an Azure Marketplace image or from your own golden image.

Your golden image stays the way you built it. The optimization is applied to each host built from it, so one image can serve pools that need different settings.

Lists reviewed for multi-session AVD

Atlas doesn't download WDOT onto your hosts. The services, scheduled tasks and AppX packages it changes come from Atlas's own lists, seeded from WDOT's configuration templates and reviewed entry by entry for multi-session AVD session hosts. Every WDOT entry is in the lists, including the ones Atlas doesn't apply, each with a short reason. Nothing is downloaded at build time, and no third-party script runs on your hosts.

The review follows a few rules:

• Keep anything an organization may depend on. Backup (Volume Shadow Copy), crash reporting, diagnostics, location redirection, the Microsoft Store, winget, and productivity and accessibility apps all stay.
• Remove only consumer, gaming and retired apps. Clipchamp, Solitaire, the Xbox apps, Bing News and Weather, Widgets, Phone Link, Cortana and Skype go. Classic Paint, the Store and work Teams stay. AppX removal can't be undone on a running host, so the list is deliberately short.
• Match scheduled tasks by their full path. A generic task name can't accidentally match a task another vendor installed.
• Leave out anything that needs your decision. Telemetry, Defender tuning and OneDrive removal are separate modules that are off by default.

Twelve modules, nine on by default

The three modules that are off by default affect security, compliance or a product your users may rely on. Turn them on once you've checked them against your organization's policy.

Tenant-wide defaults, with per-pool overrides

Windows Desktop Optimization is configured in the Settings Matrix, under Provisioning & Deployment. The Windows Desktop Optimization (WDOT) row turns it on or off, and each module has its own row, such as WDOT · AppX Removal. Like every setting in the matrix, the global value flows down to each tenant and host pool unless you override it.

A host pool can override the setting on its own: open the pool's Settings, choose Compute & Deployment, and go to Deployment Defaults. You can turn optimization off for one pool, or change a single module while the pool keeps following the tenant for the rest. Clearing the override returns the pool to the tenant's settings. Every override is recorded in the audit log.

When you need a host built from the bare image, for example to compare against an optimized host while troubleshooting, choose Disable all optimizations when you deploy the session host. Atlas then skips WDOT and the Settings Matrix host settings for that deployment only.

A result you can read

Each module reports one of three results: it made a change, it found nothing to change on this image, or it failed. The deployment log shows a one-line summary of all three, and the full transcript is saved on the host at C:\ProgramData\AtlasAVD\wdot\transcript.log. If one service or app can't be changed, the module logs it and carries on with the rest of its list. If a whole module fails, the step shows as a warning, and the host still finishes building and joins its pool.

What changes reach which hosts

Optimization is applied when a host is built. Changing a module affects session hosts provisioned after the change. Existing hosts pick it up the next time they're re-imaged or replaced, which in a pooled host pool is the normal way to roll out a change. For a staged approach, see replacing hosts vs. staged rings for image rollouts.

Where optimization fits with the rest of your build

Windows Desktop Optimization handles the parts of Windows a session host doesn't need. The rest of the host's configuration comes from the same provisioning step:

• Golden images carry your applications and baseline. See AVD golden image management for how Atlas captures, versions and rolls them out.
• Edge tuning for multi-session, such as sleeping tabs and memory limits, goes beyond WDOT's Edge settings. See how to optimize Microsoft Edge on multi-session hosts.
• Logon time depends on more than the image. Slow logons on Azure Virtual Desktop covers profiles, Group Policy and host warm-up.

FAQ

Does Atlas AVD download WDOT onto my session hosts?

No. The optimization script is generated by Atlas from its own reviewed lists, which are seeded from WDOT's configuration templates. Nothing is downloaded from GitHub at build time, and no third-party script runs on your hosts.

Does Atlas optimize my golden image?

No, your golden image is left as you built it. Atlas applies the optimization to each session host it builds from the image. You can still run your own optimization on the image before capture; any setting that's already applied is simply left as it is.

Is Windows Desktop Optimization on by default?

Yes. Every new session host gets the nine low-risk modules unless you turn optimization off for the tenant or for a host pool. Defender Optimization, Telemetry Reduction and OneDrive Removal stay off until you turn them on.

Does Defender Optimization turn off real-time protection?

No. It changes the scan schedule and PUA protection only. Real-time protection stays on.

Will optimization change hosts that are already running?

No. It's applied when a host is built, so existing hosts pick up a change when they're re-imaged or replaced.

Can I use different settings for different host pools?

Yes. Each host pool can turn optimization off, or override individual modules, in its Deployment Defaults. The other modules keep following the tenant's settings.

WDOT details reflect The Virtual Desktop Team's Windows Desktop Optimization Tool repository as of November 2026.