[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU] "NoAutoUpdate"=dword:00000001
It doesn't report that size, and it's not a bug 24H2 is designed to keep 1 baseline version (installed or staged) "Windows Update Cleanup" correctly report the size of that version components what they can do is update Disk Cleanup (or servicing stack) to ignore the size of staged baseline
because windows 11 is using some new methods that people don't understand, then they report them as errors...
Even so, it's still good to know that staged baseline can be removed from offline image, without breaking windows update...
Cryptographic Services is what connects to ctldl.windowsupdate.com and it downloads root certificates. CryptSvc will reenable itself if you disable it. If you want to stop root certificate downloads, add this to the registry. On a fresh Windows installation this might break web browsing and programs might display that they are unverified. Code: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot] "DisableRootAutoUpdate"=dword:00000001