As of 24H2 (10.0.26100)
Windows 11 Policing is the removal of anti- and consumer features. It only makes sense on consumer editions, where the license does not grant you the administration capabilities to fully disable what you don’t want. You can save time policing Windows if you obtain Enterprise licenses; however, even so it still makes sense to reduce the installation size of a Windows system.
If you decide to police Windows, first of all, I advise against using any unofficial content without understanding them. I further distrust projects that release only a Windows installation image without the code used to derive it. So, please only start with official Microsoft files, and only run code you can inspect and understand.
Positively Build an Image
I recommend that you start by building a Windows installation image rather than directly obtaining the official ISO release, as the former allows you to customize the image content to a certain extent. This is said to be building an image positively, and is more resource-efficient. It is possible to positively build a fully functional image that is much smaller than the official release. You can still apply any modifications you would to an official release, in the next step.
In order to build an image, we start with UUP. Universal Update Platform (UUP) is the Microsoft service delivering Windows Updates. Files from UUP can be used to derive a full Windows installation image. UUP Dump is a well-documented community project that provides tools to build a usable Windows installation image from UUP. Using UUP gives you an advanced view of the Windows building process.
A positive Windows image is produced by UUP Dump during the initial wimlib-imagex export step. As of 24H2, such an image is completely usable and does not contain Edge browser or any provisioned APPXs, and is very similar to the Enterprise LTSC 2024 edition. To achieve this, simply use the relevant options in UUP Dump.
Although I consider UUP Dump trustworthy, if you do not trust UUP Dump, use their tool to get files from Microsoft and refer to the mentioned wimlib-imagex export command to assemble an install.wim. To do this efficiently, you can comment out the @ECHO OFF line in Convert-UUP, run the tool once, wait for it to reach a command beginning with wimlib-imagex export, copy that command, and run it yourself with an authentic copy of wimlib-imagex. The result is a minimal install.wim image.
Negatively Modify an Image
After a positively built image from UUP, you can start to remove things from it. This section is the most interesting and subjective. You can expect to find many policing items by simply using a search engine.
Negative modifications are more arbitrary and error-prone than positive building: all parts used during positive building are well-defined, self-contained components designated by Microsoft, but this is not necessarily so for negative modifications. Certain deep hacks can break future Windows updates.
You can use many third-party scripts. Keep in mind that many authors intend to only support Microsoft official ISO releases, or the WIM file therein. They will likely work on your positive image with a few unexpected warnings, since some nonessential components are missing.
There is one tool I recommend extremely: an unattend file generator from https://schneegans.de/windows/unattend-generator, with many optional policing hacks. (Pay attention to uncheck those options intended for professional deployments; this tool is not designed solely for policing Windows.) This generator UI includes many references to the original hacks in case you wish to investigate.
This unattend file achieves our desired outcome by modifying the Windows installation at its first boot, not by changing the actual image. An unattend file is not a script but can contain one. The unattend file is an XML. I have made my modifications after this generator output, including the total removal of OneDrive (better than the generated.) You can add, for example, your own Group Policies.
Items that have been perfectly achieved in the following sample unattend file include:
- Disabling Windows Defender
- Using the same Windows Search as that in Enterprise LTSC
- Removal of OneDrive Win32 program
Restore Classic Windows Utilities
Microsoft really wants you to use their half-baked modern apps, but you don’t have to.
Here is what you can perfectly restore in 24H2:
- Windows 10 Explorer (Source)
- Shell Context Menu (Source)
- Notepad (Win32) with file type associations (Authored)
- Windows Photo Viewer (Source)
Find more resources on the Internet.
Results
I almost arrive at Enterprise LTSC 2024, except not having some classic Win32 utilities shipped with Enterprise LTSC, such as Calculator (Win32) and Paint.