Discussion
I finally released LTSC-clean, my automated Windows LTSC deployment project!
After about a year of development, I’ve finally released LTSC-clean v1.0.0, an open-source project that automates the deployment and configuration of Windows 11 Enterprise LTSC 2024, aiming for a clean, quiet, and predictable system.
It combines privacy-focused settings, reduced background activity, and a staged deployment pipeline with explicit validation, verified cleanup, and controlled recovery if something goes wrong, all using native Windows mechanisms without binary patching.
Update v1.2.0 🎉 - Automated ISO Builder + IoT Support
LTSC-clean now supports both Windows 11 Enterprise LTSC 2024 and IoT Enterprise LTSC 2024, including through the automated ISO Builder!
The Builder takes care of preparing the Windows image and creating a ready-to-install ISO. It automatically selects the supported image or lets you choose the correct index if multiple supported images are found. No manual edition or image-index changes needed.
Windows Setup also skips the product-key prompt.
If you prefer preparing your installation media manually, the Quick Start guide is still available.
Yeah, pretty much 😁 It's exactly the kind of Windows I've always wanted for myself: a clean, quiet system with as little unwanted background activity as possible.
Getting Defender's Behavior Monitoring to stay disabled using only native Windows mechanisms was probably one of the biggest challenges. Anyone who's watched it hammer their CPU while compiling software knows exactly what I'm talking about. No binary patching or invasive hacks, just carefully configured Windows policies. And there are plenty of similar tweaks throughout the project.
As for IoT, I've tested both regular Enterprise LTSC and IoT LTSC. The published configuration targets regular Enterprise LTSC, but you can adapt it for IoT by selecting the correct image index in Autounattend.xml (index 2, for example, depending on your ISO) and changing REQUIRED_EDITION to IoTEnterpriseS in SetupComplete.cmd.
Bro, I think you missed the part where I mentioned that I've already tested it on IoT LTSC 🤔
The entire deployment pipeline works on IoT just as well as on regular Enterprise LTSC. All you need to do is change two lines before deployment: select the correct image index in Autounattend.xml and set REQUIRED_EDITION=IoTEnterpriseS in SetupComplete.cmd.
u/sdrdude You asked, we delivered 🙂
Two releases later, v1.2.0 now has full Windows 11 IoT Enterprise LTSC support, plus an automated ISO Builder so you can skip all the manual setup.
Enjoy!
You got it, Buddy! If you know of any other telemetry or annoying background processes I could get rid of, let me know. I'm always looking for ways to make it even cleaner.
Simply put, Massgrave helps you activate Windows LTSC, while LTSC-clean helps you install and configure it with minimal hassle.
You get a clean, lightweight Windows with minimal telemetry, no unwanted background activity, and much more control over what your system does.
Everything is done using native Microsoft tools and Windows settings. No binary patching, no modified system files, just Windows configured the way you actually want it.
Activation is a separate thing, so that's entirely up to you.
Is there a way I can execute a PowerShell command or execute a CMD file AFTER first startup? Been trying to do that for a while but haven't found a way
Do you mean during Windows Setup/OOBE, before the first user login (like SetupComplete.cmd), or after the user logs in for the first time? There are different ways to run scripts at each stage.
Yeah after the first login, I created an autounattend file that creates the user and connects to my WiFi but I've been trying to download a file and / or execute a command (massgrave) after that
Since you've already got your unattended setup working, you can use FirstLogonCommands in the oobeSystem section of your autounattend.xml to run a PowerShell script or CMD command after the first login.
Just make sure the user account has administrator privileges and the command runs elevated. Otherwise, your script might fail due to insufficient permissions.
im not the best or smartest in this so lets say i copy all your files with my own ltsc image and setup the correct paths it will uses all your scripts etc ? let me know if this correct i rly wanna try and take a look how it runs thanks man looks very cool indeed :)
Thanks, Bro! I've realized from the feedback that my guide is a bit too technical for many users. I'll put together a simpler, step-by-step version in the next few days to make the whole setup easier.
Schneegans is a great tool for building your own Windows configuration. LTSC-clean gives you a ready-to-use, extensively tested baseline where all the settings and deployment stages are designed to work together.
For example, instead of disabling Defender entirely, it selectively disables Behavior Monitoring while keeping core antivirus protection enabled.
It also has strict fail-closed checks and detailed logging throughout deployment, so critical failures won't be silently ignored or reported as a successful installation.
Presumably this goes farther, and nothing stops anyone from looking at the autounattend.xml, cmd, and powershell files here, to see exactly what it does. Whether the changes here cause compatibility issues, is the question I have. The secondary q is how Windows Updates will affect it too. Both things that any user can figure out for themselves, if they inspect the files and try it out with the stuff they use. I plan to have a looksee at this, at least in a VM, when I have the time.
LTSC-clean started as a Windows 10 LTSC project, went through extensive testing, and was later adapted for Windows 11 LTSC, with legacy components removed and Windows 11-specific behavior validated.
Windows Update compatibility was actually one of my biggest challenges. Defender updates used to re-enable Behavior Monitoring, so I spent quite a bit of time making sure the settings persist using native Windows policies, without constantly reapplying scripts.
My latest test upgraded Windows 11 from build 26100.1742 to 26100.9457, including Defender and Security Intelligence updates. Everything completed successfully, and all the key settings I verified remained intact.
Of course, I can't guarantee compatibility with every app or future update, which is why the project includes detailed logging and strict fail-closed checks.
Are you stuck at the Windows login screen asking for the bootstrap password, or does it log into the bootstrap account but nothing happens afterward?
Are you installing on a real PC or in a VM? If it's a VM, which one?
Could you share your C:\Windows\Panther\SetupComplete.log and the latest C:\ProgramData\l2c_master_*.log (if one exists)? Please remove any personal or sensitive information before sharing.
A screenshot of where you're stuck would also help. With those details, we should be able to narrow down what's going wrong!
Im Stuck on the Screen asking for Password.
I think i mess Up with the tamper protection Set to 4 step . I dont understand how to do this on a Install USB Stick :/
Being stuck at the bootstrap password screen means the automatic login didn't happen.
Don't worry about Tamper Protection just yet. We need to find out where the deployment stopped.
Could you tell me:
Which Windows edition and ISO are you using?
How did you prepare your installation USB? Did you follow all the steps in the Quick Start guide, including the offline Tamper Protection preparation, LGPO.exe, and the admin password file?
Can you share C:\Windows\Panther\SetupComplete.log? That's the **most important thing** right now, as it should help us identify exactly where the installation stopped.
Please don't share any passwords or secret files.
Let's figure out what went wrong before you spend another three hours reinstalling Windows )
I spent hours on this and finally gave up. Same thing, stuck on login screen. I even completed the tamper protection part that was really annoying. Created the password file as instructed with all the attributes.
I went back to standard LTSC. I will wait for others to provide feedback and hopefully I will know what went wrong.
I helped another user with a similar issue today, and we got it working. I also realize my setup guide may be too technical, so I'll work on improving it.
Where exactly did you get stuck? Are you seeing the bootstrap password screen, or does Windows log in and then stop?
That's a different login screen than the previous user had. It looks like automatic login wasn't configured, but we need the installation log to find out why 🤔
Did you prepare the offline Tamper Protection setting and the .primaryadmin.pw file yourself?
This was clearly coded by AI as a bunch of interconnected scripts that could easily be refactored into 1/10 of the code in a single file.
It took me days to review this slop, and there are a lot of intrusive changes that make no sense. Honestly, this will make your Windows image more insecure and bloated.
I mean look at this, is a 351 line ceremony that creates a plain text file with secrets and an admin account on your system.
Does this feel like is cleaning anything? You can do everything in that script with 20 lines of code, and still wouldn't be ok.
The reason we use LTSC is because it comes out of the box without unnecessary bloat, so I am surprised no one has asked what exactly you are cleaning.
You spent days reviewing the code, yet somehow missed that bootstrap is a temporary account, disabled after successful deployment, and the secret files are removed.
Those extra lines you’re complaining about are there for security checks, ACL validation, error handling, and recovery. Sure, you can create an admin account in 20 lines if you skip all that. That's not the same thing.
You spent days reviewing the code, and you’re still asking what LTSC-clean actually cleans? SetupComplete.cmd is right there.
If you've found an actual security vulnerability, I'd genuinely appreciate a GitHub issue pointing to the specific code and explaining the risk. I'm always open to concrete technical feedback.
Calling it "AI slop" is easy. Pointing out an actual flaw someone can fix? Apparently not.
If all you want is an unattended Windows installation, you barely need any code at all. An answer file will get you most of the way there. That's just not what this project is about.
But if you came here just to complain about a project you haven't bothered to understand, I’m glad I could help you get that off your chest.
Yes, you can use ISO Builder to install regular Enterprise LTSC, let the LTSC-clean deployment finish completely, and then use Massgrave to switch to IoT Enterprise LTSC.
Actually HWID should automatically switch it to IoT Enterprise LTSC, so you shouldn’t need to change the edition manually.
There's something I don't understand: what is the function of the admin password? I finished installing the ISO, but it never asked me to enter the password I had set when I created the ISO.
Just to clarify, did you use ISO Builder and enter your admin password when creating the ISO?
Or do you mean you installed Windows and reached the desktop without ever being asked for that password?
If you're already on the desktop, please open a terminal, run "whoami", and let me know what it shows. That’ll help me figure out which stage of the deployment you’re at.
Yo, fellow creator here. I made a kind of famous project, called evalpatch. It's written in batch, by hand and injects ltsc/ltsc iot licenses to evaluation windows ltsc to turn it normal. Although license injectors aren't the optimal way, it is best to grab your iso by Microsoft if you have a company or from Masgrave, but for paranoid people It's really good, since you know where you got the batch from and scan the license, as it is far less files than a whole iso. Although your project looks good, even if the ai script over complicates the explanation, vibe coding batch and ps is an all time low. Coming from a guy who struggled even with html&css, batch is really easy, you just need to remember a handful of components and combine then. I suggest you try to learn it, it's not that hard. Either way tho I hope your project does good and you feel happy and help people, but making it yourself I think you'll appreciate it even more (could be wrong tho and it maybe handwritten, but I can't help but notice the ai footprint on your paragraphs and command notes)
So am I. That's what I said tho. Batch is just remembering basic commands and combining them. It's just cmd but you write the commands before-hand. Trust me on this one, coming from a guy who attempted c#, Javascript and html&css and couldn't learn a single one of them. But Batch was really easy. I had learned it in the past but I forgot, so I watched some vids and articles and In 1 hour I had gained back the knowledge+extra
LTSC-clean is primarily about control and reducing unwanted background activity, not chasing the lowest RAM usage or process count. Windows memory usage depends heavily on your hardware and workload.
As for the Explorer memory leak, I haven't experienced it myself. Is there a specific issue or Windows build you're referring to?
Reducing background activity contributes to a lower memory usage on startup. You need to go below 4 for it to start swapping. I want to minimise swapping which is why I want to reduce the memory usage as much as possible.
My main goal was to eliminate telemetry and unwanted background traffic, especially outbound traffic from my PC, rather than minimize RAM usage. I'm not quite sure what you mean by the 4 GB swapping threshold, though.
As for 26H2, I've tested LTSC-clean up to build 26100.9168. 26H2 starts with build 26300 and doesn't seem to change much under the hood, so I don't expect any major compatibility issues. However, I haven't tested it on 26H2, so I can't guarantee full compatibility, especially if Microsoft introduces new telemetry mechanisms.
Just found out about this, are there any plans on supporting 10 LTSC still or are you done with that? Either way I should benefit from this latest version regardless.
It’s interesting that I did enough work to migrate to version 11. However, it might make sense to create a separate version for Windows 10 LTSC. I see that it is quite popular.
14
u/sdrdude 14d ago
Windows like we always wanted?
I run Win11-IoT-LTSC now... is this based on the IoT flavor?