Background/Context:
It's been, a long long, very long time since I have posted on the forum. I used to dabble in the Micro XP and Micro Win 10 arena, but lately and because embarrassingly I lost my master preset, I've been building serviceable images (Fancy expression for: It Works with Windows Update). Naturally, I have clung to LTSC 2021 IoT since it is being serviced until January 13, 2032. Some Windows 11 early builds are arguably better, but their servicing terminates prematurely long before 2032 if they are still being serviced at all. Performance, Security, Privacy and Retail function have always been my targets. The Component Store and Component-Based Servicing (CBS) is not evil. For you just think of it as an organization method making sure critical files are never lost. You remove a feature, the component store says ok, but some of the files for that feature are still being used by another feature so I'll keep those, but remove the feature you wanted removed. This is basically every interaction between dism and the component store. It does it's main job very well, but sometimes too well holding onto too many versions of files. This is what the resetbase command is for. Remove or greatly strip the component store and your image becomes serviceable. This extends beyond windows update, you are basically making your system UN-adaptable hoping no circumstances or particular combination, which could be rectified with a working component store, doesn't rear its ugly head particularly once your system is configured how you like it. And some people, like me, were very good at giving you such images that largely worked without flaw and it was beautiful in the sense of how many fewer files the system needed. But such images are fundamentally flawed - this should be clear now as the component store is the foundation that Windows is built upon. Let's make it even clearer. The Component Store's job is to keep Windows File. Why is it in NTlite that you have to have the service stack compatibility option to enable deep removal; because the component store's job is to keep Windows Files and the component store is the servicing stack that is WinSXS and dism are the service stack. Now you don't need NTlite to service an image, but what NTlite does is effectively deconstructs large packages into manageable smaller chunks thus offering much greater selection for removal; otherwise you have to remove the big chunk which sometimes isn't even feasible. For I think there's a package called WindowsFoundation. Basically, Microsoft's way of giving you the middle finger except for the saving grace of NTlite.
So now the question is How small of an image can you create if you keep the component store; well my install.esd is about 3.5 GB, but it is updated and has all the appx dependencies, and now the Microsoft Store and a few grand master scripts and reg files. Naturally I have many more scripts, but in the spirit of adapting some tweaks found on the NTlite gamer thread, I thought it only fair but then I'm like it would so incomplete without my firstrun script so I added it back in for all to see and use. And it makes all the difference. If you value privacy and gaming, you have found no better thread.
Just a reminder boot.wim should never be trimmed because its whole purpose is to ensure it can install windows via the windows image (install.wim or install.esd). Trimming it is therefore moronic especially in lieu of distribution.
Instructions:
So attached one of my presets focusing on Serviceable, Performance, Security, Privacy and Retail. This one includes the Microsoft Store and thus Xbox Stuff as well. So you get yourself a copy of LTSC 2021, I use the IoT version for serviceability, but any version of LTSC 2021 will work.
You mount it with Nlite then apply the master preset. That will require this. That file is a beauty because it has all updated dependencies for all Appx and Microsoft Store; zero fluff. It's absolute perfection beyond having to reinstall the Microsoft Store from the native package. I didn't include the drivers because that's my sh*t. Now you run the dism scripts starting with c.cmd followed by p.cmd. Obviously, you run those as administrator. They remove more stuff NTLite failed to remove. Then you mount it again and use the finalize preset; sorry there is a bit of leg work because " I'm too fast". You need to add a post-setup after logon, you add firstrun.cmd to this (from $OEM$). Then in apply you remove to remove the addition you are not using. Usually better to keep the boot (PE). And I have it set to ESD, but you can change it to wim if you like. That gives you the boot.wim or install.esd + the entire $OEM$ structure which goes in the sources folder. They'll be a safemode file you can add to the files folder in $OEM$, since some tweaks must be applied from safe mode.
For boot.wim....you just take the original and apply the updates without component removal and update the boot manager.
That gives you the most capable boot.wim Finally you add in autounattend.xml to the root active win10 ntlite folder, and $OEM$ to the sources folder and create your iso.
Then you burn this iso to usb with Rufus 4.4 without any of the extra popup options.
You will notice I left Content Deliver Manager; in case you like some of the backgrounds it downloads.
Please note Windows Explorer is unstable on the first boot; that is frequently graphically glitches or appears to freeze eventually on first boot.
You can try Ctrl-Shift-Esc or Ctrl-Shift-Win-B (sometimes these help). Once you update your GPU driver and restart, there is no problem.
You obviously have to provide your own valid key or activation; I'll just say this image is HWID compatible.
The protected files are geared towards preserving diagnosis, hyper-v, active directory and .net 3.5; though practically 3.5 is added in finalize.
Windows Sandbox is the epitome (huh re-learned that spelling, already had Diablo on my mind, now I'm doomed) of extremely poor programming; so annoyed with the feature I have purposefully left it out.
An extra side note beyond the terrible programming behind windows sandbox, it is a feature that cannot be tested in a virtual machine with an AMD processor. And that alone warrants it's removal. As for application guard; it is even worse and depreciated code.
Microsoft writes those applications like they're designing an Elder Scrolls game.
Anyways Sandboxie is way leaner and better in every respect.
Also, the autounattend can include drivers both for initial setup (network, storage, touchpad) and for Stage 2 (Device Installation\Configuration).
BUT be weary, it installs these no matter what, so if you have drivers for different systems in there, it install them all.
The main draw of this particular release besides privacy and gaming, is that it is serviceable; works with Windows Update.
However, you'll find for cumulative updates that you have to use "Remove Reinstalls".
You need a license to fully apply the preset.
The username of this release is: Awesome
Easiest way to add a password is once you are logged in, alt-control-delete.
Obviously to use the Microsoft Store, you computer must be signed in to a Microsoft Account.
This particularly relevant because logging in from Microsoft Accounts is disabled.
I mean if you want to give MS a portal to everything you do then by all means re-enable it.
I'll add the safemode tweak at a later date.
It's been, a long long, very long time since I have posted on the forum. I used to dabble in the Micro XP and Micro Win 10 arena, but lately and because embarrassingly I lost my master preset, I've been building serviceable images (Fancy expression for: It Works with Windows Update). Naturally, I have clung to LTSC 2021 IoT since it is being serviced until January 13, 2032. Some Windows 11 early builds are arguably better, but their servicing terminates prematurely long before 2032 if they are still being serviced at all. Performance, Security, Privacy and Retail function have always been my targets. The Component Store and Component-Based Servicing (CBS) is not evil. For you just think of it as an organization method making sure critical files are never lost. You remove a feature, the component store says ok, but some of the files for that feature are still being used by another feature so I'll keep those, but remove the feature you wanted removed. This is basically every interaction between dism and the component store. It does it's main job very well, but sometimes too well holding onto too many versions of files. This is what the resetbase command is for. Remove or greatly strip the component store and your image becomes serviceable. This extends beyond windows update, you are basically making your system UN-adaptable hoping no circumstances or particular combination, which could be rectified with a working component store, doesn't rear its ugly head particularly once your system is configured how you like it. And some people, like me, were very good at giving you such images that largely worked without flaw and it was beautiful in the sense of how many fewer files the system needed. But such images are fundamentally flawed - this should be clear now as the component store is the foundation that Windows is built upon. Let's make it even clearer. The Component Store's job is to keep Windows File. Why is it in NTlite that you have to have the service stack compatibility option to enable deep removal; because the component store's job is to keep Windows Files and the component store is the servicing stack that is WinSXS and dism are the service stack. Now you don't need NTlite to service an image, but what NTlite does is effectively deconstructs large packages into manageable smaller chunks thus offering much greater selection for removal; otherwise you have to remove the big chunk which sometimes isn't even feasible. For I think there's a package called WindowsFoundation. Basically, Microsoft's way of giving you the middle finger except for the saving grace of NTlite.
So now the question is How small of an image can you create if you keep the component store; well my install.esd is about 3.5 GB, but it is updated and has all the appx dependencies, and now the Microsoft Store and a few grand master scripts and reg files. Naturally I have many more scripts, but in the spirit of adapting some tweaks found on the NTlite gamer thread, I thought it only fair but then I'm like it would so incomplete without my firstrun script so I added it back in for all to see and use. And it makes all the difference. If you value privacy and gaming, you have found no better thread.
Just a reminder boot.wim should never be trimmed because its whole purpose is to ensure it can install windows via the windows image (install.wim or install.esd). Trimming it is therefore moronic especially in lieu of distribution.
Instructions:
So attached one of my presets focusing on Serviceable, Performance, Security, Privacy and Retail. This one includes the Microsoft Store and thus Xbox Stuff as well. So you get yourself a copy of LTSC 2021, I use the IoT version for serviceability, but any version of LTSC 2021 will work.
You mount it with Nlite then apply the master preset. That will require this. That file is a beauty because it has all updated dependencies for all Appx and Microsoft Store; zero fluff. It's absolute perfection beyond having to reinstall the Microsoft Store from the native package. I didn't include the drivers because that's my sh*t. Now you run the dism scripts starting with c.cmd followed by p.cmd. Obviously, you run those as administrator. They remove more stuff NTLite failed to remove. Then you mount it again and use the finalize preset; sorry there is a bit of leg work because " I'm too fast". You need to add a post-setup after logon, you add firstrun.cmd to this (from $OEM$). Then in apply you remove to remove the addition you are not using. Usually better to keep the boot (PE). And I have it set to ESD, but you can change it to wim if you like. That gives you the boot.wim or install.esd + the entire $OEM$ structure which goes in the sources folder. They'll be a safemode file you can add to the files folder in $OEM$, since some tweaks must be applied from safe mode.
For boot.wim....you just take the original and apply the updates without component removal and update the boot manager.
That gives you the most capable boot.wim Finally you add in autounattend.xml to the root active win10 ntlite folder, and $OEM$ to the sources folder and create your iso.
Then you burn this iso to usb with Rufus 4.4 without any of the extra popup options.
You will notice I left Content Deliver Manager; in case you like some of the backgrounds it downloads.
Please note Windows Explorer is unstable on the first boot; that is frequently graphically glitches or appears to freeze eventually on first boot.
You can try Ctrl-Shift-Esc or Ctrl-Shift-Win-B (sometimes these help). Once you update your GPU driver and restart, there is no problem.
You obviously have to provide your own valid key or activation; I'll just say this image is HWID compatible.
The protected files are geared towards preserving diagnosis, hyper-v, active directory and .net 3.5; though practically 3.5 is added in finalize.
Windows Sandbox is the epitome (huh re-learned that spelling, already had Diablo on my mind, now I'm doomed) of extremely poor programming; so annoyed with the feature I have purposefully left it out.
An extra side note beyond the terrible programming behind windows sandbox, it is a feature that cannot be tested in a virtual machine with an AMD processor. And that alone warrants it's removal. As for application guard; it is even worse and depreciated code.
Microsoft writes those applications like they're designing an Elder Scrolls game.
Anyways Sandboxie is way leaner and better in every respect.
Also, the autounattend can include drivers both for initial setup (network, storage, touchpad) and for Stage 2 (Device Installation\Configuration).
BUT be weary, it installs these no matter what, so if you have drivers for different systems in there, it install them all.
The main draw of this particular release besides privacy and gaming, is that it is serviceable; works with Windows Update.
However, you'll find for cumulative updates that you have to use "Remove Reinstalls".
You need a license to fully apply the preset.
The username of this release is: Awesome
Easiest way to add a password is once you are logged in, alt-control-delete.
Obviously to use the Microsoft Store, you computer must be signed in to a Microsoft Account.
This particularly relevant because logging in from Microsoft Accounts is disabled.
I mean if you want to give MS a portal to everything you do then by all means re-enable it.
I'll add the safemode tweak at a later date.
Last edited: