[DISCUSSION] Windows 10 Enterprise/IoT Enterprise (N) LTSC 2021

Hi
wondering how to do that (removing telemetry + offline user) with Rufus.
Could you help ?

 

You need to login to view this posts content.

 

Windows 10 IoT Enterprise LTSC 2021 / Windows 10 Enterprise LTSC 2021 Image Updates

Effective as of the date of this post, to create an up-to-date image of Windows 10 IoT Enterprise LTSC 2021 / Windows 10 Enterprise LTSC 2021, integrate the following updates to the en-us_windows_10_iot_enterprise_ltsc_2021_x64_dvd_257ad90f.iso image using abbodi1406's amazing W10UI Windows NT 10.0 Updates Installer.

Without NDP481 Base (Similar to original image)

defender-dism-x64.cab
windows10.0-kb5007401-x64_f1bf61d834bb8d9951c7efa23454643daae195b0.cab
windows10.0-kb5023847-x64_0d515544d250e8d35de07eb37cf84c06284a04aa.cab
windows10.0-kb5027122-x64-ndp48_b4a399e994cdaa75c9b9bd3771b8670c89e5f17b.msu
windows10.0-kb5027215-x64_45971faad5d92b3fe36347a915dd7144b7f3f0c0.msu
windows10.0-kb5027389-x64_8d1880d95f920fc8a4c2d96ca8d3b44f3e044581.cab

With NDP481 Base Added

defender-dism-x64.cab
Windows10.0-KB5011048-x64.cab
windows10.0-kb5023847-x64_0d515544d250e8d35de07eb37cf84c06284a04aa.cab
windows10.0-kb5027117-x64-ndp481_b15dec2fff51cb5296f7081b10038aeef36de151.msu
windows10.0-kb5027215-x64_45971faad5d92b3fe36347a915dd7144b7f3f0c0.msu
windows10.0-kb5027389-x64_8d1880d95f920fc8a4c2d96ca8d3b44f3e044581.cab

* Either resulting image will result in an installation that will be completely up-to-date with the exception of the Defender Updates (changing frequently), and the Malicious Software Removal Tool. I have thoroughly tested both methods.

Edge Browser Removal

On a separate note, years ago I obtained a Windows Enterprise LTSC 2021 early test release 19044.1147 which did NOT have the Edge Browser integrated - similar to LTSC 2019. I did a careful registry comparison, and noted the registry and file differences.

To create a revised image of en-us_windows_10_iot_enterprise_ltsc_2021_x64_dvd_257ad90f.iso with the Edge Browser completely removed, please delete the following registry keys and files from either or both indexes of the original image:

Remove These Registry Keys from the Offline Image

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppUserModelId\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSEdgeHTM]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications\Microsoft.MicrosoftEdge_44.19041.1266.0_neutral__8wekyb3d8bbwe]

*[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-edgechromium_31bf3856ad364e35_none_df3ee7b2c5023fd1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-m..osoftedge.appxsetup_31bf3856ad364e35_none_d0472dbbd37cfd67]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-microsoftedgebrowser_31bf3856ad364e35_none_cc4c2155158afa1d]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoftedge-autologger_31bf3856ad364e35_none_dd39fb9187e61e2e]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate]

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge]

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\edgeupdate]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\edgeupdatem]

Remove This Directory from the Offline Image

C:\Program files (x86)\Microsoft

* After making these changes, adding all updates using W10UI.cmd and the "skipedge" option will result in an ISO which installs an up-to-date LTSC 2021 without the Edge Browser and no noticeable ill effects.

I'll eventually be updating this post with links to ISO images that I created with the above listed process. They seem to work very well so far.

 

From what I can see it gives a few options in the latest Rufus version to skip privacy options, create an offline user, skip automatic bitlocker and set region same as current system.
None of the options mention disabling telemetry but here's old reliable group policy registry key script that disables telemetry data collection.
Telemetry-Disable-Enable.cmd:

Code:

@echo off

title Disable/Enable Windows Telemetry
color 1f
:Begin UAC check and Auto-Elevate Permissions
:-------------------------------------
REM  --> Check for permissions
>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"

REM --> If error flag set, we do not have admin.
if '%errorlevel%' NEQ '0' (
echo:
echo   Requesting Administrative Privileges...
echo   Press YES in UAC Prompt to Continue
echo:

    goto UACPrompt
) else ( goto gotAdmin )

:UACPrompt
    echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs"
    echo UAC.ShellExecute "%~s0", "", "", "runas", 1 >> "%temp%\getadmin.vbs"

    "%temp%\getadmin.vbs"
    exit /B

:gotAdmin
    if exist "%temp%\getadmin.vbs" ( del "%temp%\getadmin.vbs" )
    pushd "%CD%"
    CD /D "%~dp0"
:--------------------------------------

:Check the key:
(reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v "AllowTelemetry"|find /i "0x0")>NUL 2>NUL
if %errorlevel% NEQ 0 GOTO :KEYOFF

:KEYON
echo ============================================================
echo Windows Telemetry currently disabled.
echo Would you like to re-enable it? (Y/N)
echo ============================================================
echo.
choice /c yn /n
If %ERRORLEVEL% NEQ 1 GOTO :QUIT

Echo Deleting Telemetry Registry key
REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v "AllowTelemetry" /F>NUL 2>NUL
IF %ERRORLEVEL% NEQ 0 GOTO :ERROR
Echo.

Echo Windows Telemetry enabled
Echo.
goto :QUIT


:KEYOFF
echo ============================================================
echo Windows Telemetry is currently enabled.
echo Would you like to disable it? (Y/N)
echo ============================================================
echo.
choice /c yn /n
If %ERRORLEVEL% NEQ 1 GOTO :QUIT

Echo Changing Registry key
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v "AllowTelemetry">NUL 2>NUL
if %errorlevel% equ 1 REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v "AllowTelemetry" /F>NUL 2>NUL
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v "AllowTelemetry" /D 0 /T REG_DWORD /F>NUL 2>NUL
IF %ERRORLEVEL% NEQ 0 GOTO :ERROR
Echo.

Echo Windows Telemetry disabled
Echo.
goto :QUIT


:QUIT
echo ============================================================
echo Press any key to exit...
echo ============================================================
pause>NUL
goto :EOF

:ERROR
echo ============================================================
echo The script ran into an unexpected error setting reg key.
echo Press any key to exit...
echo ============================================================
pause>NUL
goto :EOF

 

This is similar to work that I have done, but I note that you are not listing OOBE:

windows10.0-kb5020683-x64_119695f48aa3f28a5f68a3dff367957ef8b0f576.msu

Is this no longer needed?

 

You need to login to view this posts content.

 

It seems there are 4 updates integrated into the LTSC 21H2 ISO. 2 are security so I want them but 2 are regular updates;

KB5003791, KB5004331

As I am only going to install security (and maybe some critical) updates, am I ok to remove these?

 

KB5003791 is 21H2
KB5004331 is .NET update, it's not very security, but still important

you cannot uninstall the 1st, and should not uninstall the 2nd

 

To update the ISO without NDP481, it looks like the following are now needed as of 28-Jun-2023:

defender-dism-x64.cab

windows10.0-kb5007401-x64_f1bf61d834bb8d9951c7efa23454643daae195b0.cab

windows10.0-kb5023847-x64_0d515544d250e8d35de07eb37cf84c06284a04aa.cab

windows10.0-kb5027122-x64-ndp48_b4a399e994cdaa75c9b9bd3771b8670c89e5f17b.msu

windows10.0-kb5027293-x64_8afd36694e06cee0165f126deff8ba08088d8e5e.msu

windows10.0-kb5027389-x64_8d1880d95f920fc8a4c2d96ca8d3b44f3e044581.cab

windows10.0-kb5028579-x64-ndp48_145c2592b00edc66c31d5e3032822cc36e3b2848.msu

 

I just compared my non-NDP481 to your post, and it is the same. Thank you.

 

You need to login to view this posts content.

 

Still the same LPs version 4.8.9037.9

 

In which scenarios are these OOBE updates good, i have windows ltsc 2021. My next update will be win 11 ltsc in 2024.

Out Of Box Experience (OOBE) Update
NDP35-48 OOB Updates
NDP35-481 OOB Updates

 

Out Of Box Experience (OOBE) update != Out Of Band (OOB) update

you don't need OOBE update for LTSC
but you need (or can install) .NET OOB updates

 

Is that a store app? If so it defeats the purpose of installing LTSC version.