Minimum Image for Single App Embedded System

[tweebs]

I'm trying to create minimum Windows image for an embedded PC included as part of a scientific instrument which runs a single application. Is this NTLite able to do this?

This embedded system currently includes a full LTSC image (Win11 IoT Enterprise) which works well until it ends up at a customers site and their IT teams get their hands on it. Typically, most customers want to join it to their domain mainly for access control and transferring of data. As security requirements are becoming more stringent especially with large corporation, we have more customers installing windows updates, security suites, end point protection, software overlays, loggers, remote desktop tools, web browsers, etc etc (Despite our warnings that we can't support modified instruments). We keep running into compatibility issues with this 3rd party software, and it's a nightmare to support. Our software is written in mainly dotnet 4.8 and has some custom drivers and VC++ runtimes.

I realize we could deploy Windows in Kiosk mode with a UWF and other tweeks but it doesn't really make sense to install unneeded components and services which could be attack vectors or use resources, ultimately making the system less stable. This wouldn't solve our main issue of customers IT/security requirements.

I had tried running the software from a custom Window PE image which almost worked but provided some other challenges. Mainly, we can't sell a system with a Windows PE boot image being a MS Partner or not.

My question is how much can we remove from a Windows 11 Iot Ent 24H2 image, only leaving enough to boot and run our this single application and is NTLite capable of such a drastic removal? Are there a Preset/Templates for this purpose or just trial and error?

Ideally we could do the following:
Strip all drivers except the required ones for the single hardware configuration (and maybe the hyper-V VM drivers for testing)
Allow Windows to Activate with new product key after imaging
Include the .dot framework 4.8 and VC++ redistributable (or allow them to be installed afterwards)
MSI installer to install the software unless it's possible to slipstream
No updates - remove any unneeded updates
Windows time sync
Limit services and scheduled tasks to a minimum
Only English language
No explorer.exe shell needed, launch the app at start or further refine with Kiosk mode?

We would need to provide a method to transfer data and config files. Options:
Include drivers for USB flash storage (not ideal but easy and secure)
Include drivers and software for a USB to USB file sync cable and connect an external workstation for data analysis (no networking would be a plus)
Include components for network file sharing. Not sure which protocols would be acceptable for a corporate network.
Include components for domain sign-on or network file share access on corporate network. (not likely an acceptable solution for many corporate networks)

Hoping someone has done this before and I can stand on their shoulders.... or someone who can provide a good reason to not.

 

[garlin]

I had tried running the software from a custom Window PE image which almost worked but provided some other challenges. Mainly, we can't sell a system with a Windows PE boot image being a MS Partner or not.

That's unsupported, but you already know that as a MS Partner.

My question is how much can we remove from a Windows 11 Iot Ent 24H2 image, only leaving enough to boot and run our this single application and is NTLite capable of such a drastic removal? Are there a Preset/Templates for this purpose or just trial and error?

Most users want to remove different Windows features to improve system performance or to protect privacy, but not necessarily to lock users out of their own system. The typical presets and templates tend to protect critical features, which is opposite of your goal.

Ideally we could do the following:
Strip all drivers except the required ones for the single hardware configuration (and maybe the hyper-V VM drivers for testing)

You can. But you should try to understand which drivers your platform actually needs. Since you're doing this work, you probably have some validation process to understand how to test if you removed the wrong HW driver.

Allow Windows to Activate with new product key after imaging
Include the .dot framework 4.8 and VC++ redistributable (or allow them to be installed afterwards)

Both NET 4.8 and 4.8.1 can be added to the image. You can run the VC++ runtime installers (in silent mode) from Post-Setup.

The problem is Windows Activation requires at least contacting MS (or a licensing server) at least once. Unless you want to do phone activation, which would be a pain if you had to re-install the PC for any reason. This kinda conflicts with your desire to limit network access.

MSI installer to install the software unless it's possible to slipstream
No updates - remove any unneeded updates

The question is how future proof do you need to be? You can permanently remove Windows Update features which prevents you from servicing the system. Which means you will probably wipe and re-image the box from a new golden image. Or you can indefinitely pause WU, and have it not automatically download or apply any updates. This allows you to resume at a future date, if needed.

Windows time sync
Limit services and scheduled tasks to a minimum

NTLite can disable services, or remove entire features from the image.

We would need to provide a method to transfer data and config files. Options:
Include drivers for USB flash storage (not ideal but easy and secure)
Include drivers and software for a USB to USB file sync cable and connect an external workstation for data analysis (no networking would be a plus)
Include components for network file sharing. Not sure which protocols would be acceptable for a corporate network.

24H2 out of the box only allows SMB2 or higher, and won't allow SMB1 for file sharing.

Honestly, some of these are really "system hardening" questions which you'll have to decide on/test first, before asking how would that be done in an NTLite-based build.

 

[tweebs]

Thanks you for your prompt reply, I'm sorry I was distracted with summer and didn't see it. I've purchased NTLite and have been trying to follow some of the available guides and presets but haven't got my striped down Window 11 LTSC IoT 24H2 Enterprise either working or significantly smaller.

Yes, I need to consider the system hardening options before NTliting my WIMs. I realize this is security through obscurity, but for an embedded system with no network (or at least no internet connection) and locked down USB ports (or physically removed) I'm not worried about serviceability with updates and defender. Updates to our software would have to be provided with an updated golden image.

Our instrument software hasn't really changed since the days of Windows XP, it was first released for Windows 7. The problem that has developed over the years is not the software and it's hardware requirements, it's Windows and corporate IT requirements to keep connected systems updated and secure. The more bloat MS adds, the more security is required. It's incredibly difficult to support a product which is constantly being modified and updated by our customers IT teams. If this was a embedded IoT device running an embedded Linux OS, I don't think we would have the same issue, but practically every company has an IT policy governing any connected Windows PC. Unfortunately, the software is .NET framework 4.8 so Windows it is.

With cost of PC hardware, I think the better solution is to have a 2 PC architecture, one low end embedded system running the instrument control/data collection and a second (likely customer supplied) to do the data analysis. Our software is already packaged as 2 components, data collection and analysis. They just need to transfer data between them (and not even a large amount, 10MB for an hour of data collection).

Sadly, I think the networking needs to remain to join a direct ethernet connection to another PC or a small LAN. I'm sure there are some methods to lock down the ethernet traffic beyond a firewall.

I see MS has a guide for 'locking down' IoT-Ent, which should be sufficient, as long as I can keep/add those features in my installation.

Device lockdown features

Device lockdown features

learn.microsoft.com

I've tried some 'experimental', tiny, micro, x-lite, and AnkhTech. Even the lightest, none-serviceable, core or basic images seem to work well with my hardware and application. I don't even miss whatever was in the 3.5 of 5 GB of Windows image.

Phone activations aren't the worse thing. I'm surprised most people don't know they can tether their phones via USB to Windows PC, if not to just activate windows.

Back to my Win11 LTSC Embedded OS project....

 

[tweebs]

I don't know what I'm doing wrong, I have yet to get my Windows 11 LTSC 24H2 final ISO less than 4GB or the installation on disk less than 11GB and I've removed all drivers (expect Hyper-V) so many components, removed almost all 'compatibility' parameters, no updates, no defender.... and it won't boot.

I've tried some of the presets for 24H2 and the built in presets as well and don't see any real benefit. CTT MircoWin has them beat.

I see some show-offs screen-shots of members running ridiculously small 24H2 images but no explanations or sharing of presets.

And apparently there was a time when all one had to do was NTLite a Windows 10 LTSB image using this guide to get a 700MB ISO:

Create Minimal Win10 ISO - NTLite Guides

Create a 700MB Windows 10 image for fast virtual machines with minimal resources.

www.ntlite.com

If I could still get Windows 10 LTSB licenses I would.

Is this what Windows has come to?