←back to thread

Generate autounattend.xml files for Windows 10/11

(schneegans.de)
218 points nixass | 1 comments | 29 Mar 25 20:44 UTC | HN request time: 0.213s | source
Show context
atVelocet ◴[01 Apr 25 22:59 UTC] No.43552177[source]▶
Since i‘ve been doing this sort of thing for many years here are some basic rules: - Get LTSC (W10) or IoT/Enterprise (W11) images to begin with - Get https://www.ntlite.com/ .. you won‘t find any other tool which does a better job at removing packages, adding drivers, etc. Worth every penny with great support. - Use GroupPolicies to configure your system. Take the time and download them for Office, Edge, Chrome, Firefox and update those that come with Windows. - Integrate drivers not only for the base image but also in the recovery and setup image. - Install a firewall (binisoft is fine) - Use NextDNS - If you don’t mind the security implications: Disable Defender, SmartScreen, BootGuard and VBS (use bcdedit) - Disable Microcode loading (delete the DLL) - Disable Spectre/Meltdown mitigations - If you need Office: Use the LTSC version

Most third party tools are outdated or do stupid stuff which isn’t needed. You can silence Windows with the right GroupPolicies quite easy.

replies(4): >>43553011 #>>43554530 #>>43554546 #>>43558401 #
PufPufPuf ◴[02 Apr 25 07:59 UTC] No.43554546[source]▶
Exactly what is this trying to achieve? Running a third party tool to modify the OS, disabling security features, using "downloaded" group policies (what policies?), and sending all your DNS traffic to a third party (when on PC it's possible to just modify the etc/hosts file) -- these aren't exactly the best security practices. The only reasonable suggestion is the IoT Windows version.
replies(2): >>43558391 #>>43569027 #
1. atVelocet ◴[03 Apr 25 13:04 UTC] No.43569027[source]▶
Make the system need way less ressouces and get way more raw compute power.

There‘s a reason i wrote a hint about the security. If you keep this in mind and know what you are doing (like take such a setup as a base for VMs) this totally fine.

I am also not aware of any Spectre/Meltdown exploits ever to be found in the wild. If you are not running on a shared system i don’t see a need for those mitigations.

Regarding the third party tool: NTlite uses `dism` under the hood with which you can achieve the same results. You are already sending your DNS to a third party (like your ISP).

You also should never ever alter the hosts file and abuse it for ad blocking and such.

Microsoft supplies the latest group policies for their software. Or how else do you handle those on a local system?

I never said my post was about security but on how to alter your local system in a „more correct“ way with a clear hint about security. If you don’t know what you are doing then you should think twice when touching your system.