It's been, a long long, very long time since I have posted on the forum. I used to dabble in the Micro XP and Micro Win 10 arena, but lately and because embarrassingly I lost my master preset, I've been building serviceable images (Fancy expression for: It Works with Windows Update). Naturally, I have clung to LTSC 2021 IoT since it is being serviced until January 13, 2032. Some Windows 11 early builds are arguably better, but their servicing terminates prematurely long before 2032 if they are still being serviced at all. Performance, Security, Privacy and Retail function have always been my targets. The Component Store and Component-Based Servicing (CBS) is not evil. For you just think of it as an organization method making sure critical files are never lost. You remove a feature, the component store says ok, but some of the files for that feature are still being used by another feature so I'll keep those, but remove the feature you wanted removed. This is basically every interaction between dism and the component store. It does it's main job very well, but sometimes too well holding onto too many versions of files. This is what the resetbase command is for. Remove or greatly strip the component store and your image becomes serviceable. This extends beyond windows update, you are basically making your system UN-adaptable hoping no circumstances or particular combination, which could be rectified with a working component store, doesn't rear its ugly head particularly once your system is configured how you like it. And some people, like me, were very good at giving you such images that largely worked without flaw and it was beautiful in the sense of how many fewer files the system needed. But such images are fundamentally flawed - this should be clear now as the component store is the foundation that Windows is built upon. Let's make it even clearer. The Component Store's job is to keep Windows File. Why is it in NTlite that you have to have the service stack compatibility option to enable deep removal; because the component store's job is to keep Windows Files and the component store is the servicing stack that is WinSXS and dism are the service stack. Now you don't need NTlite to service an image, but what NTlite does is effectively deconstructs large packages into manageable smaller chunks thus offering much greater selection for removal; otherwise you have to remove the big chunk which sometimes isn't even feasible. For I think there's a package called WindowsFoundation. Basically, Microsoft's way of giving you the middle finger except for the saving grace of NTlite.
So now the question is How small of an image can you create if you keep the component store; well my install.esd is 3.38 GB, but it is updated and has all the appx dependencies. Of course, you can make smaller, but the new priority is Serviceable, Performance, Security, Privacy and Retail. But to be honest, NTlite can only take you so far, you absolutely must be a scripter. NTlite has scripts and settings for sure, but even it is rather very limited to someone like me. Naturally, scripts are the secret sauce, not the quantity of files in the windows installation, not the size of install.esd or boot.wim, but the scripts. Speaking of which boot.wim should never be trimmed because its whole purpose is to ensure it can install windows via the windows image (install.wim or install.esd). Trimming it is therefore an exercise in stupidity especially for distribution reasons. NTlite should have an option not to trim boot.wim. Unfortunately for you, no scripts will provided for that would be like Garlin or Nuhi sharing their personal setup. Scripts are personal. "This too good for you. Very powerful! You want - you take!" (Diablo 1 - Gharbad the Weak). It's unfortunate because nobody knows everything which is a fancy way of saying, there's always something you can learn from somebody elses scripts. Yes, I'm sure both Garlin and Nuhi would learn at least one thing from my scripts as I would learn several things from theirs. It's almost impossible that they don't; I have extensive scripts. So if the scripts are the power, why then am I hiding my NTlite preset? Well I am not, and that is the reason of this thread apart from the new NTlite release which requires new presets.
So attached one of my presets focusing on Serviceable, Performance, Security, Privacy and Retail. So you get yourself a copy of LTSC 2021, mount the IoT edition, then you run as administrator c.cmd, IIS.cmd and p.cmd, then with elevated powershell you resetbase the image then you apply the master then you apply finalize. That gives you install.esd
For boot.wim....you just take the original and apply the updates without component removal which gives you the most capable boot.wim
You put the autounattend on your USB.
Obviously absent is firstrun.cmd (one of my many scripts).
There's only a few updates you need and you can get those easily.
As for the Appx stuff: Appx
As for the drivers: Integrate your own if you want.
You will notice I left Content Deliver Manager and Removed Delivery Optimization.
The former is in case you like some of the backgrounds it downloads, the later is for privacy.
Please note Windows Explorer is unstable on the first boot; that is frequently graphically glitches on first boot.
You can try Ctrl-Shift-Esc or Ctrl-Shift-Win-B (sometimes these help).
You obviously have to provide your own valid key or activation; I'll just say this image is HWID compatible.
Of course without my scripts the security and privacy of the release is limited to what NTlite is capable of.
The protected files are geared towards preserving diagnosis, hyper-v, active directory and .net 3.5; though practically 3.5 is added in finalize.
Windows Sandbox is the epitome (huh re-learned that spelling, already had Diablo on my mind, now I'm doomed) of extremely poor programming; so annoyed with the feature I have purposefully left it out.
An extra side note beyond the terrible programming behind windows sanbox, it is a feature that cannot be tested in a virtual machine with an AMD processor.
And that alone warrants it's removal.
As for application guard; it is even worse and depreciated code.
Microsoft writes those applications like they're designing an Elder Scrolls game.
Anyways Sandboxie is way leaner and better in every respect.
Also, the autounattend can include drivers both for initial setup (network, storage, touchpad) and for Stage 2 (Device Installation\Configuration).
BUT be weary, it installs these no matter what, so if you have drivers for different systems in there, it install them all.
Obviously you can use windows update, but for cumulative updates you'll find you have to use "Remove Reinstalls".
You need a license to fully apply the preset.
If you use rufus, use version 4.4, and do not use any of the pop-up options.
There are many ways to go about NTliting, this is just one way.
Note: Just so you are aware when you are using the scripts to remove components NTlite's compatibility options offer no protection.
It's possible that something I manually removed caused a yet unknown problem on the image.
Thus it is safer to apply those post ntlite, but then you won't be able to resetbase.
So make your decision; trust me or not.
Goes without saying that at least for LTSC 2021, for my preset, NTlite is not removing some packages I want removed.
If you want the middle ground, just remove the /remove from each entry
The features will be disabled, but files will persist at least in the component store, but it's 100% safe.
Before I say lesson over, I'll just add that certain features and all updates are staged as in install pending which prevents resetbase until the image is deployed.
Probably Nuhi knows something about this that I do not; for example maybe NTlite always has a way around this.
So now the question is How small of an image can you create if you keep the component store; well my install.esd is 3.38 GB, but it is updated and has all the appx dependencies. Of course, you can make smaller, but the new priority is Serviceable, Performance, Security, Privacy and Retail. But to be honest, NTlite can only take you so far, you absolutely must be a scripter. NTlite has scripts and settings for sure, but even it is rather very limited to someone like me. Naturally, scripts are the secret sauce, not the quantity of files in the windows installation, not the size of install.esd or boot.wim, but the scripts. Speaking of which boot.wim should never be trimmed because its whole purpose is to ensure it can install windows via the windows image (install.wim or install.esd). Trimming it is therefore an exercise in stupidity especially for distribution reasons. NTlite should have an option not to trim boot.wim. Unfortunately for you, no scripts will provided for that would be like Garlin or Nuhi sharing their personal setup. Scripts are personal. "This too good for you. Very powerful! You want - you take!" (Diablo 1 - Gharbad the Weak). It's unfortunate because nobody knows everything which is a fancy way of saying, there's always something you can learn from somebody elses scripts. Yes, I'm sure both Garlin and Nuhi would learn at least one thing from my scripts as I would learn several things from theirs. It's almost impossible that they don't; I have extensive scripts. So if the scripts are the power, why then am I hiding my NTlite preset? Well I am not, and that is the reason of this thread apart from the new NTlite release which requires new presets.
So attached one of my presets focusing on Serviceable, Performance, Security, Privacy and Retail. So you get yourself a copy of LTSC 2021, mount the IoT edition, then you run as administrator c.cmd, IIS.cmd and p.cmd, then with elevated powershell you resetbase the image then you apply the master then you apply finalize. That gives you install.esd
For boot.wim....you just take the original and apply the updates without component removal which gives you the most capable boot.wim
You put the autounattend on your USB.
Obviously absent is firstrun.cmd (one of my many scripts).
There's only a few updates you need and you can get those easily.
As for the Appx stuff: Appx
As for the drivers: Integrate your own if you want.
You will notice I left Content Deliver Manager and Removed Delivery Optimization.
The former is in case you like some of the backgrounds it downloads, the later is for privacy.
Please note Windows Explorer is unstable on the first boot; that is frequently graphically glitches on first boot.
You can try Ctrl-Shift-Esc or Ctrl-Shift-Win-B (sometimes these help).
You obviously have to provide your own valid key or activation; I'll just say this image is HWID compatible.
Of course without my scripts the security and privacy of the release is limited to what NTlite is capable of.
The protected files are geared towards preserving diagnosis, hyper-v, active directory and .net 3.5; though practically 3.5 is added in finalize.
Windows Sandbox is the epitome (huh re-learned that spelling, already had Diablo on my mind, now I'm doomed) of extremely poor programming; so annoyed with the feature I have purposefully left it out.
An extra side note beyond the terrible programming behind windows sanbox, it is a feature that cannot be tested in a virtual machine with an AMD processor.
And that alone warrants it's removal.
As for application guard; it is even worse and depreciated code.
Microsoft writes those applications like they're designing an Elder Scrolls game.
Anyways Sandboxie is way leaner and better in every respect.
Also, the autounattend can include drivers both for initial setup (network, storage, touchpad) and for Stage 2 (Device Installation\Configuration).
BUT be weary, it installs these no matter what, so if you have drivers for different systems in there, it install them all.
Obviously you can use windows update, but for cumulative updates you'll find you have to use "Remove Reinstalls".
You need a license to fully apply the preset.
If you use rufus, use version 4.4, and do not use any of the pop-up options.
There are many ways to go about NTliting, this is just one way.
Note: Just so you are aware when you are using the scripts to remove components NTlite's compatibility options offer no protection.
It's possible that something I manually removed caused a yet unknown problem on the image.
Thus it is safer to apply those post ntlite, but then you won't be able to resetbase.
So make your decision; trust me or not.
Goes without saying that at least for LTSC 2021, for my preset, NTlite is not removing some packages I want removed.
If you want the middle ground, just remove the /remove from each entry
The features will be disabled, but files will persist at least in the component store, but it's 100% safe.
Before I say lesson over, I'll just add that certain features and all updates are staged as in install pending which prevents resetbase until the image is deployed.
Probably Nuhi knows something about this that I do not; for example maybe NTlite always has a way around this.