do as @GreenGremlin suggested. That's all that's needed. As to Windows 11 - I wouldn't touch it. It's garbage. I can't help you there. But generally speaking, and I don't know your level of expertise here, you can apply updates manually by mounting your install.wim from 24h2/25h2 and then use dism /image /add-package to apply the update if that is all you are doing. Or you could using CodingWonder's DISMTools available at github.
If all you want is updates of Windows 11 24H2 and 25H2 versions, just...[EDIT: save the text below as "UpdateWindows.cmd" and put it in a folder on your PC, along with your Windows .iso iand the helper file "oscdimg.exe", which you can get from inside the MSMG \Bin\x64\ or \Bin\x86 folders. Finally, put your updates in a subfolder names "updates" and execute the "UpdateWindows.cmd" as administsrator to slipstream your Windows updates into your .iso: Code: @echo off setlocal enabledelayedexpansion :: Automatically detect the folder where this script is running set "WORK=%~dp0" if "%WORK:~-1%"=="\" set "WORK=%WORK:~0,-1%" :: Look for the first .iso file in the same folder as the script set "ISO=" for %%I in ("%WORK%\*.iso") do ( set "ISO=%%I" set "ISONAME=%%~nI" goto :FoundISO ) :FoundISO if "%ISO%"=="" ( echo ERROR: No .iso file found in "%WORK%" echo Please place your ISO in this folder and try again. pause exit /b 1 ) :: Define the subfolders dynamically set "MOUNT=%WORK%\Mount" set "EXTRACT=%WORK%\XISO" set "UPDATES=%WORK%\updates" set "OUTPUT=%WORK%\%ISONAME%_Updated.iso" :: Create the required directories if they don't exist mkdir "%MOUNT%" 2>nul mkdir "%EXTRACT%" 2>nul mkdir "%UPDATES%" 2>nul :: --------------------------------------------------------------- :: Mount ISO (no .ESD) and wait until the drive letter is available :: --------------------------------------------------------------- echo Mounting ISO... powershell -NoProfile -Command "Mount-DiskImage -ImagePath '%ISO%'" echo Waiting for drive letter... :WAITDRIVE powershell -NoProfile -Command ^ "$dl = (Get-DiskImage '%ISO%' | Get-Volume).DriveLetter; if (-not $dl) { exit 1 }" if errorlevel 1 ( timeout /t 2 /nobreak >nul goto WAITDRIVE ) for /f "usebackq" %%i in (`powershell -NoProfile -Command ^ "(Get-DiskImage '%ISO%' | Get-Volume).DriveLetter"`) do set DRIVE=%%i: echo ISO mounted at %DRIVE% :: --------------------------------------------------------------- :: Verify install.wim exists before proceeding :: --------------------------------------------------------------- echo Copying files from ISO... xcopy "%DRIVE%\*" "%EXTRACT%\" /E /H /Y powershell -NoProfile -Command "Dismount-DiskImage -ImagePath '%ISO%'" if not exist "%EXTRACT%\sources\install.wim" ( echo. echo ERROR: install.wim not found in %EXTRACT%\sources\ echo The copy from the ISO may have failed. Check that xcopy completed without errors. pause exit /b 1 ) :: --------------------------------------------------------------- :: Show available indexes :: --------------------------------------------------------------- echo. echo Showing indexes in install.wim... dism /Get-WimInfo /WimFile:"%EXTRACT%\sources\install.wim" echo. set /p INDEX=Enter the index number to service: :: --------------------------------------------------------------- :: Clean up any leftover mounts from prior runs :: --------------------------------------------------------------- echo. echo Cleaning up stale mounts... dism /Cleanup-Wim :: --------------------------------------------------------------- :: Mount the WIM :: --------------------------------------------------------------- echo. echo Mounting image index %INDEX%... dism /Mount-Wim ^ /WimFile:"%EXTRACT%\sources\install.wim" ^ /Index:%INDEX% ^ /MountDir:"%MOUNT%" if errorlevel 1 ( echo ERROR: DISM failed to mount the WIM. Check the DISM log at %%windir%%\Logs\DISM\dism.log pause exit /b 1 ) :: --------------------------------------------------------------- :: Apply updates :: --------------------------------------------------------------- echo. echo Applying updates from %UPDATES%... for %%f in ("%UPDATES%\*.msu") do ( echo. echo Installing: %%f dism /Image:"%MOUNT%" /Add-Package /PackagePath:"%%f" ) :: --------------------------------------------------------------- :: Commit and unmount :: --------------------------------------------------------------- echo. echo Committing changes... dism /Unmount-Wim /MountDir:"%MOUNT%" /Commit if errorlevel 1 ( echo ERROR: Commit failed. The mount directory may still be active. echo Run: dism /Unmount-Wim /MountDir:"%MOUNT%" /Discard pause exit /b 1 ) :: --------------------------------------------------------------- :: Rebuild the ISO :: --------------------------------------------------------------- echo. echo Creating updated ISO... "%WORK%\oscdimg.exe" -m -o -u2 -udfver102 ^ -bootdata:2#p0,e,b"%EXTRACT%\boot\etfsboot.com"#pEF,e,b"%EXTRACT%\efi\microsoft\boot\efisys.bin" ^ "%EXTRACT%" "%OUTPUT%" if errorlevel 1 ( echo ERROR: oscdimg failed to create the ISO. pause exit /b 1 ) echo. echo Done! Output ISO: %OUTPUT% pause
Hi! Spoiler Code: # Disable Windows Defender Reg add "HKLM\TK_NTUSER\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t Reg_DWORD /d "2" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows Defender\Signature Updates" /v "FirstAuGracePeriod" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /t Reg_BINARY /d "030000000000000000000000" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray" /v "HideSystray" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScriptScanning" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableArchiveScanning" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupFullScan" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupQuickScan" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRemovableDriveScanning" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRestorePoint" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningMappedNetworkDrivesForFullScan" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningNetworkFiles" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanParameters" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleDay" /t Reg_DWORD /d "8" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleTime" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DisableUpdateOnStartupWithoutEngine" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleDay" /t Reg_DWORD /d "8" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleTime" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "SignatureUpdateCatchupInterval" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "DisableBlockAtFirstSeen" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "LocalSettingOverrideSpynetReporting" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SYSTEM\ControlSet001\Control\CI\Policy" /v "VerifiedAndReputablePolicyState" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SYSTEM\ControlSet001\Services\EventLog\System\Microsoft-Antimalware-ShieldProvider" /v "Start" /t Reg_DWORD /d "4" /f Reg add "HKLM\TK_SYSTEM\ControlSet001\Services\EventLog\System\WinDefend" /v "Start" /t Reg_DWORD /d "4" /f Reg add "HKLM\TK_SYSTEM\ControlSet001\Services\MsSecFlt" /v "Start" /t Reg_DWORD /d "4" /f Reg add "HKLM\TK_SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t Reg_DWORD /d "4" /f Reg add "HKLM\TK_SYSTEM\ControlSet001\Services\Sense" /v "Start" /t Reg_DWORD /d "4" /f Reg add "HKLM\TK_SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t Reg_DWORD /d "4" /f Reg add "HKLM\TK_SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t Reg_DWORD /d "4" /f Reg add "HKLM\TK_SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t Reg_DWORD /d "4" /f Reg add "HKLM\TK_SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t Reg_DWORD /d "4" /f Reg add "HKLM\TK_SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t Reg_DWORD /d "4" /f Reg add "HKLM\TK_SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t Reg_DWORD /d "4" /f Reg add "HKLM\TK_SYSTEM\ControlSet001\Services\webthreatdefsvc" /v "Start" /t Reg_DWORD /d "4" /f Reg add "HKLM\TK_SYSTEM\ControlSet001\Services\webthreatdefusersvc" /v "Start" /t Reg_DWORD /d "4" /f Reg add "HKLM\TK_SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t Reg_DWORD /d "0" /f # Disable Windows SmartScreen Reg add "HKLM\TK_DEFAULT\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_DEFAULT\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_DEFAULT\Software\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_NTUSER\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_NTUSER\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_NTUSER\Software\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t Reg_SZ /d "Off" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t Reg_SZ /d "Off" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControl" /t Reg_SZ /d "Anywhere" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows\CurrentVersion\WTDS\Components" /v "CaptureThreatWindow" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows\CurrentVersion\WTDS\Components" /v "NotifyMalicious" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows\CurrentVersion\WTDS\Components" /v "NotifyPasswordReuse" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows\CurrentVersion\WTDS\Components" /v "NotifyUnsafeApp" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows\CurrentVersion\WTDS\Components" /v "ServiceEnabled" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows Defender" /v "VerifiedAndReputableTrustModeEnabled" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows Defender" /v "SmartLockerMode" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access" /v "EnableControlledFolderAccess" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Edge\SmartScreenEnabled" /ve /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Edge\SmartScreenPuaEnabled" /ve /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "SettingsPageVisibility" /t Reg_SZ /d "hide:windowsdefender;" /f
Interesting error..., because there is only one cmd file i share (tiny11.cmd) Ok, First command: C:\tiny11\tiny11.cmd verify You must get Status: Pass Also could you send the "tiny-*.log" and "latest-error.txt" so i can check here. The Pdf documentation included, also self help that you may read it too. Cheers
received your logs, and most likely reason is that BypassNRO.cmd already exists in the source image, and its file permissions prevent the Administrator from overwriting it. The source file being used is: 26100.1.Germanium-X64-EN-US-XXL-SUPER-MULTI.iso This ISO contains 16 different Windows editions, and the engine selected Enterprise (index 6). Based on the file name and its contents, this does not look like an original, untouched Microsoft ISO. This doesn't automatically mean the ISO is bad. However, it is very likely that someone modified its OOBE files or access permissions (ACL) before you got it. This is a strong technical guess. the original setup is using unmodified/original ISO. meanwhile I'm looking workaround for "modified/customize ISO" if possible. cheers
Will test untouched en-us_windows_11_enterprise_ltsc_2024_x64_dvd_965cfb00.iso SHA-1: ab341c71d7c83cd5f4dd15e74a6ddda6ea303c46 As BypassNRO.cmd is already in E:\ISO\en-us_windows_11_enterprise_ltsc_2024_x64_dvd_965cfb00.iso\sources\install.wim\1\Windows\System32\oobe\ update: Code: +----------------------------------------------------------------------------------------------+ | DONE 68% | LEFT 32% | 2026-07-25 17:53:05 | [###########################-------------] | STAGE : BUILD FAILED | INFO : Access to the path 'C:\tiny11\work\Mount\Windows\System32\OOBE\BypassNRO.cmd' is denied. +----------------------------------------------------------------------------------------------+ FAILED: Access to the path 'C:\tiny11\work\Mount\Windows\System32\OOBE\BypassNRO.cmd' is denied. at New-OfflineOobeConfiguration, C:\Users\User\AppData\Local\Temp\Tiny11-Hybrid-14714-8289\tiny11-engine.ps1: line 4546 at <ScriptBlock>, C:\Users\User\AppData\Local\Temp\Tiny11-Hybrid-14714-8289\tiny11-engine.ps1: line 7027 at <ScriptBlock>, C:\Users\User\AppData\Local\Temp\Tiny11-Hybrid-14714-8289\tiny11-bootstrap.ps1: line 177 [2026-07-25 17:53:05] CLEANUP-CHECK: unmounting images and cleaning the workspace.
Yes, the same error still happened at your end. and now I have "loosen the guard" and made it a flexible script. The OOBE stage is now flexible across original and previously customized Windows source images. see attached revision file. if you don't mind rerun the script again, hope it fixes the issue. share with us your newest log file to confirm the progress. But one point I highlight: using already costumed windows ISO and forcing flexible the OOBE does not confirm the windows setup test smooth. please ensure you try at virtual machine or separated new partition disk to play, in case disaster come your healthy windows still active and safe. Thanks and cheers
Thanks for confirming. It looks like the issue is tied directly to the old script on your end. Does the script uninstall OneDrive? If it does, why does onedrive.exe still remain in the Windows\System32 folder?
Thank you for testing it, friend. I read your *.logs seem you success build the custom iso. the script blocks OneDrive and removes its setup payloads. You can also open Task Manager and look for OneDrive.exe. If it is not running and OneDrive sync is blocked, then OneDrive is functionally disabled, even if a leftover setup file still exists. thank you for the finding. just share may be you also aware, if the custom iso you found not slim enough and want to remove more bloatware, my expereince I used github project from Raphire and Titus. Cheers
Spoiler: Disable "App suggestions / Content Delivery Manager" # Path to the offline Windows image $OfflineRoot = "C:\Image\Mount" # Load the required registry hives from the offline image Reg load HKLM\TK_NTUSER "$OfflineRoot\Users\Default\NTUSER.DAT" Reg load HKLM\TK_SOFTWARE "$OfflineRoot\Windows\System32\Config\SOFTWARE" # Disable "App suggestions / Content Delivery Manager" Reg add "HKLM\TK_NTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_NTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OemPreInstalledAppsEnabled" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_NTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_NTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_NTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_NTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_NTUSER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t Reg_DWORD /d "0" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v "DisableSoftLanding" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v "DisableConsumerAccountStateContent" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v "DisableCloudOptimizedContent" /t Reg_DWORD /d "1" /f # Unload registry hives Reg unload HKLM\TK_NTUSER Reg unload HKLM\TK_SOFTWARE Spoiler: Disabled "Automatic BitLocker enablement and automatic encryption" # Path to the offline Windows image $OfflinePath = "C:\Image\Mount\Windows" # Load the required registry hives from the offline image Reg load HKLM\TK_SYSTEM "$OfflinePath\System32\Config\SYSTEM" Reg load HKLM\TK_SOFTWARE "$OfflinePath\System32\Config\SOFTWARE" # Disabled "Automatic BitLocker enablement and automatic encryption" Reg add "HKLM\TK_SYSTEM\ControlSet001\Control\BitLocker" /v "PreventDeviceEncryption" /t Reg_DWORD /d "1" /f Reg add "HKLM\TK_SOFTWARE\Policies\Microsoft\Windows\EnhancedStorageDevices" /v "TCGSecurityActivationDisabled" /t Reg_DWORD /d "1" /f # Unload registry hives Reg unload HKLM\TK_SYSTEM Reg unload HKLM\TK_SOFTWARE Spoiler: Disabling Microsoft Edge background activity and automatic updates Reg add "HKLM\Software\Policies\Microsoft\Edge\Recommended" /v "BackgroundModeEnabled" /t Reg_DWORD /d "0" /f Reg add "HKLM\Software\Policies\Microsoft\Edge\Recommended" /v "StartupBoostEnabled" /t Reg_DWORD /d "0" /f sc stop edgeupdate sc stop edgeupdatem sc config edgeupdate start= disabled sc config edgeupdatem start= disabled PowerShell -ExecutionPolicy Bypass -NoProfile -Command "Get-ScheduledTask *EdgeUpdate* | Disable-ScheduledTask"
MSMG 13.7 component removal stopped working correctly for windows 10 builds somewhere between March and July. It doesn't assign numbers to each component in the lists properly, it skips a bunch. It errors out during component removal process, the resulting image obviously doesn't reach desktop. If you're planning on doing component removal the manual way, don't integrate updates after March. They can be installed later.