Debloat & Optimize Windows 11 ISO using NTLite (Free)

This document covers modification to Microsoft Windows 11 Pro for Workstations Disk Image for a bloat-free and versatile user experience. We'll be using Windows 11 64-bit 22H2 Build ISO downloaded from Microsoft's official website and a tool named NTLite made by an independent developer.

This guide should remain relevant with upcoming builds but I will update this post or maybe write a new one after every major build release if necessary.

I will also share additional configurations and some optimizations that can be done after installation using an open-source windows toolkit by Chris Titus Tech - Link.

Let’s begin...

Pre-requisites

• Windows 11 ISO - Link

At the time of writing this post, 22H2 was the latest available build.

• My Saved Preset (XML) for NTLite - Link

I saved the settings that I use for my personal workstation and am sharing the same here. You can review the XML file to see what components are removed and added. In brief words, I can say that nothing critical has been removed, windows will run just fine. This caters to all Gamers, Programmers & Creative Professionals out there.

• NTLite - Link

For this demo, NTLite v2023.3.9160 is being used. Also, everything shown here will be done under Free License of this tool.

• VMware Workstation Player - Link or Oracle VirtualBox - Link (For Testing)

You can use either one of them for testing the final ISO.

ISO Modification

I assume that you have already downloaded the latest Windows 11 build from Microsoft's official website and the NTLite tool using the links in the previous section.

Install NTLite as you would normally install other programs and launch it. You'll be asked to choose your License as you start it for the first time. Select the Free (limited, non-commercial) radio button and click OK.

Now, under the Image ribbon menu, click on Add button and then Image (ISO, WIM, ESD, SWM) option.

Browse your freshly downloaded ISO and click Open. Next, expand the Image which comes up on the screen and then select Windows 11 Pro for Workstations. Right click on it and click Load.

Once the image you chose is loaded, you will see a green dot alongside it and more options will come become available to you on the left hand side.

Now, under the Preset ribbon menu, click on Import. Browse the XML file you downloaded from the pre-requisite section.

The imported preset will be shown available on the right half of screen. Double-click on it to Load it. The grey circle icon will turn green as shown -

(Optional, But Recommended) Now, we'll integrate latest available windows updates in this ISO. From the left-hand side menu, under Integrate heading, select Updates. Next, under the Toolbar ribbon menu, click on Add button and then choose Latest online updates.

In the new window, you will find some KB(s) already checked ✔ and while others unchecked. I recommend that you leave all checkboxes as is and only check ✔ mark the KB that corresponds to .NET Framework 4.8.1 and that's it. Click on Enqueue. Even if you leave any important KB here, Windows Updates will take care of it after installation. So, nothing to worry about.

Next, from the left-hand side menu, under Automate heading, select Unattended. Here, you may want to modify the following 3 fields - Time zone, OEM Support URL and Computer name.

We're almost done with the ISO at this point. From the left-hand side menu, under Finish heading, select Apply.

Then under the Toolbar ribbon menu, click on Process button to start the process.

You will need to click OK on a couple of dialog boxes which is because we are using Free License. Then after all the processes complete, you will receive a completion dialog box with the location of your ISO file.

This completes the ISO modification. Use Rufus - Link to make a bootable windows USB drive. Do Not Select Any Additional Tweaks as you proceed to make your USB drive bootable .

Make sure you Disconnect the Internet Connection before you start installing windows. If you are testing in a Virtual Machine then disable the Network Adapter of Guest machine. Read the next section to know when you should connect back to the Internet. 

For fresh new installation, be sure to convert your Hard Drive or SSD from MBR to GPT - Link. Press Shift + F10 during Windows Setup for opening Command Prompt. If you want to do this conversion post installation, I recommend using EASEUS Partition Master software - Link.

Post-install Configurations & Optimizations

Now this section assumes that Windows installation is complete, you have just landed on the desktop and you haven't connected to the Internet yet. Also, don't worry about the weird/broken Dark Mode that you see right now. It will sort itself out after a reboot.

We will start by disabling the Fast Startup first and we'll do that by disabling Hibernation so that hiberfil.sys never gets created.

Open Windows Command Prompt or PowerShell (Admin). Type the following command and hit enter -

powercfg.exe /hibernate off

This will turn off hibernation as well as Fast Startup.

Next, we will set some Group Policies related to Windows Updates. 

Press Windows + R and type gpedit.msc then hit Enter. Navigate to the following path -

Computer Configuration → Administrative Templates → Windows Components → Windows Update

Here we will modify some entries in 2 folders -

1. Manage end user experience
2. Manage updates offered from Windows Update

Let's explore Manage end user experience first. Here we need to open Configure Automatic Updates policy -

We will Enable this policy and set option 3 - Auto download & notify for install. Feel free to explore other options if you want. Click OK to save.

Now, let's explore Manage updates offered from Windows Update. Here we will be modifying 2 policies - 

Enable these 2 polices and set Preview Builds and Feature Updates to 270 Days and set Quality Updates to 30 Days as shown -

You can read their descriptions if you want to know more.

After setting them, Open Windows Command Prompt (Admin). Type the following command and hit enter to enforce those policies throughout the system -

gpupdate /force

After it completes, restart your computer. 

(Optional, But Recommended) You can also enable Core Isolation feature of Windows Security to enhance the security. You can find it easily by searching for it in Start menu Search box.

Now, it is safe to connect to the Internet.

Continue further by Checking for Windows Updates. I recommend that after every set of updates are installed, restart your computer and then check for updates again. Repeat this until Checking for Windows Updates doesn't return that your Windows is up-to-date.

Next you can update Windows Store Apps. After that install Drivers, Antivirus, etc. I will also recommend TechPowerUp's Visual C++ Redistributable Runtimes All in One Package - Link.

After you are finished with everything, review the Startup apps tab in Task Manager and disable any app that you don't recognize or don't want to start with Windows. If you are not able to recognize some apps, then right-click on one of the columns and check mark the command line column. This will help you better recognize what is running on your computer. For example, it looks something like this for my computer -

Next optimization is done using windows toolkit developed by Chris Titus Tech - Link.

Open Windows PowerShell (Admin). Type either one of the following 2 commands and hit enter -

iwr -useb https://christitus.com/win | iex

OR

irm christitus.com/win | iex

You will see some dependencies getting downloaded and after few seconds a window will pop-up like this -

This is a very useful utility that you can explore later. But for now, mark the checkboxes as shown and click Run Tweaks. If you don't want to tinker too much, just click on Minimal button under the Recommended Selections heading. I will recommend that you don't play too much with settings under Misc. Tweaks. Use your ISO & this tool in a virtual machine first to test.

After it is done, restart your computer and you are done.

That's all for this guide. Enjoy!